# Flog Txt Version 1 # Analyzer Version: 2.4.0 # Analyzer Build Date: Jul 24 2018 18:08:56 # Log Creation Date: 12.10.2018 00:20:02.829 Process: id = "1" image_name = "unlikexpc.exe" filename = "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\unlikexpc.exe" page_root = "0x38628000" os_pid = "0x9f8" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "analysis_target" parent_id = "0" os_parent_pid = "0x0" cmd_line = "\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\unlikexpc.exe\" " cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f065" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 1 start_va = 0x10000 end_va = 0x2ffff entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 2 start_va = 0x30000 end_va = 0x31fff entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 3 start_va = 0x40000 end_va = 0x40fff entry_point = 0x40000 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 4 start_va = 0x50000 end_va = 0x53fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000050000" filename = "" Region: id = 5 start_va = 0x60000 end_va = 0x60fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000060000" filename = "" Region: id = 6 start_va = 0x130000 end_va = 0x16ffff entry_point = 0x0 region_type = private name = "private_0x0000000000130000" filename = "" Region: id = 7 start_va = 0x310000 end_va = 0x34dfff entry_point = 0x310000 region_type = mapped_file name = "unlikexpc.exe" filename = "\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\unlikexpc.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\unlikexpc.exe") Region: id = 8 start_va = 0x3a0000 end_va = 0x49ffff entry_point = 0x0 region_type = private name = "private_0x00000000003a0000" filename = "" Region: id = 9 start_va = 0x778d0000 end_va = 0x77a78fff entry_point = 0x778d0000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 10 start_va = 0x77ab0000 end_va = 0x77c2ffff entry_point = 0x77ab0000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 11 start_va = 0x7efb0000 end_va = 0x7efd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efb0000" filename = "" Region: id = 12 start_va = 0x7efdb000 end_va = 0x7efddfff entry_point = 0x0 region_type = private name = "private_0x000000007efdb000" filename = "" Region: id = 13 start_va = 0x7efde000 end_va = 0x7efdefff entry_point = 0x0 region_type = private name = "private_0x000000007efde000" filename = "" Region: id = 14 start_va = 0x7efdf000 end_va = 0x7efdffff entry_point = 0x0 region_type = private name = "private_0x000000007efdf000" filename = "" Region: id = 15 start_va = 0x7efe0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 16 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 17 start_va = 0x7fff0000 end_va = 0x7fffffeffff entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 150 start_va = 0x220000 end_va = 0x29ffff entry_point = 0x0 region_type = private name = "private_0x0000000000220000" filename = "" Region: id = 151 start_va = 0x74ff0000 end_va = 0x74ff7fff entry_point = 0x74ff0000 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 152 start_va = 0x75000000 end_va = 0x7505bfff entry_point = 0x75000000 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 153 start_va = 0x75060000 end_va = 0x7509efff entry_point = 0x75060000 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 154 start_va = 0x550000 end_va = 0x64ffff entry_point = 0x0 region_type = private name = "private_0x0000000000550000" filename = "" Region: id = 155 start_va = 0x754b0000 end_va = 0x754f9fff entry_point = 0x754b0000 region_type = mapped_file name = "mscoree.dll" filename = "\\Windows\\SysWOW64\\mscoree.dll" (normalized: "c:\\windows\\syswow64\\mscoree.dll") Region: id = 156 start_va = 0x757c0000 end_va = 0x758cffff entry_point = 0x757c0000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 157 start_va = 0x76260000 end_va = 0x762a5fff entry_point = 0x76260000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 158 start_va = 0x776b0000 end_va = 0x777a9fff entry_point = 0x0 region_type = private name = "private_0x00000000776b0000" filename = "" Region: id = 159 start_va = 0x777b0000 end_va = 0x778cefff entry_point = 0x0 region_type = private name = "private_0x00000000777b0000" filename = "" Region: id = 160 start_va = 0x10000 end_va = 0x1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 161 start_va = 0x70000 end_va = 0xd6fff entry_point = 0x70000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 162 start_va = 0x1d0000 end_va = 0x20ffff entry_point = 0x0 region_type = private name = "private_0x00000000001d0000" filename = "" Region: id = 163 start_va = 0x780000 end_va = 0x78ffff entry_point = 0x0 region_type = private name = "private_0x0000000000780000" filename = "" Region: id = 164 start_va = 0x75600000 end_va = 0x7560bfff entry_point = 0x75600000 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 165 start_va = 0x75610000 end_va = 0x7566ffff entry_point = 0x75610000 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 166 start_va = 0x75720000 end_va = 0x757bffff entry_point = 0x75720000 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll") Region: id = 167 start_va = 0x75fe0000 end_va = 0x7608bfff entry_point = 0x75fe0000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 168 start_va = 0x76090000 end_va = 0x7617ffff entry_point = 0x76090000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 169 start_va = 0x761b0000 end_va = 0x761c8fff entry_point = 0x761b0000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 170 start_va = 0x7efe0000 end_va = 0x7f0dffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 171 start_va = 0x7f0e0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 172 start_va = 0x530000 end_va = 0x53ffff entry_point = 0x0 region_type = private name = "private_0x0000000000530000" filename = "" Region: id = 173 start_va = 0x75430000 end_va = 0x754a7fff entry_point = 0x75430000 region_type = mapped_file name = "mscoreei.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscoreei.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\mscoreei.dll") Region: id = 174 start_va = 0x758d0000 end_va = 0x7596cfff entry_point = 0x758d0000 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\SysWOW64\\usp10.dll" (normalized: "c:\\windows\\syswow64\\usp10.dll") Region: id = 175 start_va = 0x75a70000 end_va = 0x75a79fff entry_point = 0x75a70000 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\SysWOW64\\lpk.dll" (normalized: "c:\\windows\\syswow64\\lpk.dll") Region: id = 176 start_va = 0x761d0000 end_va = 0x76226fff entry_point = 0x761d0000 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\SysWOW64\\shlwapi.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll") Region: id = 177 start_va = 0x766d0000 end_va = 0x7675ffff entry_point = 0x766d0000 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 178 start_va = 0x775b0000 end_va = 0x776affff entry_point = 0x775b0000 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 179 start_va = 0x790000 end_va = 0x917fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000790000" filename = "" Region: id = 180 start_va = 0x75ea0000 end_va = 0x75f6bfff entry_point = 0x75ea0000 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll") Region: id = 181 start_va = 0x75f80000 end_va = 0x75fdffff entry_point = 0x75f80000 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 182 start_va = 0x20000 end_va = 0x20fff entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 183 start_va = 0x30000 end_va = 0x30fff entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 184 start_va = 0x920000 end_va = 0xaa0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000920000" filename = "" Region: id = 185 start_va = 0xab0000 end_va = 0x1eaffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000ab0000" filename = "" Region: id = 186 start_va = 0x75420000 end_va = 0x75428fff entry_point = 0x75420000 region_type = mapped_file name = "version.dll" filename = "\\Windows\\SysWOW64\\version.dll" (normalized: "c:\\windows\\syswow64\\version.dll") Region: id = 187 start_va = 0x74890000 end_va = 0x74f37fff entry_point = 0x74890000 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\clr.dll") Region: id = 188 start_va = 0x75320000 end_va = 0x75414fff entry_point = 0x75320000 region_type = mapped_file name = "msvcr120_clr0400.dll" filename = "\\Windows\\SysWOW64\\msvcr120_clr0400.dll" (normalized: "c:\\windows\\syswow64\\msvcr120_clr0400.dll") Region: id = 189 start_va = 0xe0000 end_va = 0xe0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 190 start_va = 0xf0000 end_va = 0xfffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000f0000" filename = "" Region: id = 191 start_va = 0x100000 end_va = 0x10ffff entry_point = 0x0 region_type = private name = "private_0x0000000000100000" filename = "" Region: id = 192 start_va = 0x110000 end_va = 0x11ffff entry_point = 0x0 region_type = private name = "private_0x0000000000110000" filename = "" Region: id = 193 start_va = 0x120000 end_va = 0x12ffff entry_point = 0x0 region_type = private name = "private_0x0000000000120000" filename = "" Region: id = 194 start_va = 0x170000 end_va = 0x17ffff entry_point = 0x0 region_type = private name = "private_0x0000000000170000" filename = "" Region: id = 195 start_va = 0x180000 end_va = 0x18ffff entry_point = 0x0 region_type = private name = "private_0x0000000000180000" filename = "" Region: id = 196 start_va = 0x190000 end_va = 0x190fff entry_point = 0x0 region_type = private name = "private_0x0000000000190000" filename = "" Region: id = 197 start_va = 0x1a0000 end_va = 0x1a0fff entry_point = 0x0 region_type = private name = "private_0x00000000001a0000" filename = "" Region: id = 198 start_va = 0x2c0000 end_va = 0x2fffff entry_point = 0x0 region_type = private name = "private_0x00000000002c0000" filename = "" Region: id = 199 start_va = 0x690000 end_va = 0x6cffff entry_point = 0x0 region_type = private name = "private_0x0000000000690000" filename = "" Region: id = 200 start_va = 0x6d0000 end_va = 0x76ffff entry_point = 0x0 region_type = private name = "private_0x00000000006d0000" filename = "" Region: id = 201 start_va = 0x1f80000 end_va = 0x1fbffff entry_point = 0x0 region_type = private name = "private_0x0000000001f80000" filename = "" Region: id = 202 start_va = 0x1fd0000 end_va = 0x200ffff entry_point = 0x0 region_type = private name = "private_0x0000000001fd0000" filename = "" Region: id = 203 start_va = 0x2020000 end_va = 0x211ffff entry_point = 0x0 region_type = private name = "private_0x0000000002020000" filename = "" Region: id = 204 start_va = 0x2120000 end_va = 0x411ffff entry_point = 0x0 region_type = private name = "private_0x0000000002120000" filename = "" Region: id = 205 start_va = 0x4140000 end_va = 0x417ffff entry_point = 0x0 region_type = private name = "private_0x0000000004140000" filename = "" Region: id = 206 start_va = 0x41e0000 end_va = 0x42dffff entry_point = 0x0 region_type = private name = "private_0x00000000041e0000" filename = "" Region: id = 207 start_va = 0x4310000 end_va = 0x440ffff entry_point = 0x0 region_type = private name = "private_0x0000000004310000" filename = "" Region: id = 208 start_va = 0x4410000 end_va = 0x46defff entry_point = 0x4410000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 209 start_va = 0x72440000 end_va = 0x7366afff entry_point = 0x72440000 region_type = mapped_file name = "mscorlib.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\b7a12c4c0032847fcc6b9c710460456f\\mscorlib.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\mscorlib\\b7a12c4c0032847fcc6b9c710460456f\\mscorlib.ni.dll") Region: id = 210 start_va = 0x7efad000 end_va = 0x7efaffff entry_point = 0x0 region_type = private name = "private_0x000000007efad000" filename = "" Region: id = 211 start_va = 0x7efd5000 end_va = 0x7efd7fff entry_point = 0x0 region_type = private name = "private_0x000000007efd5000" filename = "" Region: id = 212 start_va = 0x7efd8000 end_va = 0x7efdafff entry_point = 0x0 region_type = private name = "private_0x000000007efd8000" filename = "" Region: id = 213 start_va = 0x764e0000 end_va = 0x7663bfff entry_point = 0x764e0000 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\SysWOW64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll") Region: id = 214 start_va = 0x74f60000 end_va = 0x74fdffff entry_point = 0x74f60000 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\SysWOW64\\uxtheme.dll" (normalized: "c:\\windows\\syswow64\\uxtheme.dll") Region: id = 215 start_va = 0x1eb0000 end_va = 0x1f7ffff entry_point = 0x0 region_type = private name = "private_0x0000000001eb0000" filename = "" Region: id = 216 start_va = 0x46e0000 end_va = 0x47befff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000046e0000" filename = "" Region: id = 217 start_va = 0x1b0000 end_va = 0x1bffff entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 218 start_va = 0x752a0000 end_va = 0x7531cfff entry_point = 0x752a0000 region_type = mapped_file name = "clrjit.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clrjit.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\clrjit.dll") Region: id = 219 start_va = 0x762b0000 end_va = 0x7633efff entry_point = 0x762b0000 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\SysWOW64\\oleaut32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll") Region: id = 220 start_va = 0x1c0000 end_va = 0x1cffff entry_point = 0x0 region_type = private name = "private_0x00000000001c0000" filename = "" Region: id = 221 start_va = 0x2a0000 end_va = 0x2b0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002a0000" filename = "" Region: id = 222 start_va = 0x4a0000 end_va = 0x501fff entry_point = 0x4a0000 region_type = mapped_file name = "mscorrc.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorrc.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\mscorrc.dll") Region: id = 223 start_va = 0x4970000 end_va = 0x49affff entry_point = 0x0 region_type = private name = "private_0x0000000004970000" filename = "" Region: id = 224 start_va = 0x71d20000 end_va = 0x72435fff entry_point = 0x71d20000 region_type = mapped_file name = "system.core.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Core\\386fde9190d499d6645df8b90eb76242\\System.Core.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.core\\386fde9190d499d6645df8b90eb76242\\system.core.ni.dll") Region: id = 225 start_va = 0x736d0000 end_va = 0x7407cfff entry_point = 0x736d0000 region_type = mapped_file name = "system.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System\\500ffa28b327e171fe664023003e947e\\System.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system\\500ffa28b327e171fe664023003e947e\\system.ni.dll") Region: id = 226 start_va = 0x750d0000 end_va = 0x7529afff entry_point = 0x750d0000 region_type = mapped_file name = "microsoft.visualbasic.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Microsoft.V9921e851#\\cfbddeb6e93e8f421b92229b20e51233\\Microsoft.VisualBasic.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\microsoft.v9921e851#\\cfbddeb6e93e8f421b92229b20e51233\\microsoft.visualbasic.ni.dll") Region: id = 227 start_va = 0x750b0000 end_va = 0x750c2fff entry_point = 0x750b0000 region_type = mapped_file name = "nlssorting.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\nlssorting.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\nlssorting.dll") Region: id = 228 start_va = 0x49b0000 end_va = 0x4c81fff entry_point = 0x49b0000 region_type = mapped_file name = "sortdefault.nlp" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\sortdefault.nlp" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\sortdefault.nlp") Region: id = 229 start_va = 0x74870000 end_va = 0x74885fff entry_point = 0x74870000 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\SysWOW64\\cryptsp.dll" (normalized: "c:\\windows\\syswow64\\cryptsp.dll") Region: id = 230 start_va = 0x74830000 end_va = 0x7486afff entry_point = 0x74830000 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 231 start_va = 0x210000 end_va = 0x21ffff entry_point = 0x0 region_type = private name = "private_0x0000000000210000" filename = "" Region: id = 232 start_va = 0x300000 end_va = 0x30ffff entry_point = 0x0 region_type = private name = "private_0x0000000000300000" filename = "" Region: id = 233 start_va = 0x350000 end_va = 0x374fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000350000" filename = "" Region: id = 234 start_va = 0x380000 end_va = 0x39cfff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 235 start_va = 0x75a60000 end_va = 0x75a64fff entry_point = 0x75a60000 region_type = mapped_file name = "psapi.dll" filename = "\\Windows\\SysWOW64\\psapi.dll" (normalized: "c:\\windows\\syswow64\\psapi.dll") Region: id = 236 start_va = 0x1eb0000 end_va = 0x1ebffff entry_point = 0x0 region_type = private name = "private_0x0000000001eb0000" filename = "" Region: id = 237 start_va = 0x1f40000 end_va = 0x1f7ffff entry_point = 0x0 region_type = private name = "private_0x0000000001f40000" filename = "" Region: id = 238 start_va = 0x47c0000 end_va = 0x47fffff entry_point = 0x0 region_type = private name = "private_0x00000000047c0000" filename = "" Region: id = 239 start_va = 0x4810000 end_va = 0x481ffff entry_point = 0x0 region_type = private name = "private_0x0000000004810000" filename = "" Region: id = 240 start_va = 0x4820000 end_va = 0x491ffff entry_point = 0x0 region_type = private name = "private_0x0000000004820000" filename = "" Region: id = 241 start_va = 0x4cb0000 end_va = 0x4ceffff entry_point = 0x0 region_type = private name = "private_0x0000000004cb0000" filename = "" Region: id = 242 start_va = 0x4eb0000 end_va = 0x4faffff entry_point = 0x0 region_type = private name = "private_0x0000000004eb0000" filename = "" Region: id = 243 start_va = 0x7efa7000 end_va = 0x7efa9fff entry_point = 0x0 region_type = private name = "private_0x000000007efa7000" filename = "" Region: id = 244 start_va = 0x7efaa000 end_va = 0x7efacfff entry_point = 0x0 region_type = private name = "private_0x000000007efaa000" filename = "" Region: id = 245 start_va = 0x510000 end_va = 0x51ffff entry_point = 0x0 region_type = private name = "private_0x0000000000510000" filename = "" Region: id = 246 start_va = 0x710c0000 end_va = 0x71d17fff entry_point = 0x710c0000 region_type = mapped_file name = "system.windows.forms.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Windows.Forms\\7a6894982f35a1d75ec73d447c583da2\\System.Windows.Forms.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.windows.forms\\7a6894982f35a1d75ec73d447c583da2\\system.windows.forms.ni.dll") Region: id = 247 start_va = 0x746a0000 end_va = 0x7482cfff entry_point = 0x746a0000 region_type = mapped_file name = "system.drawing.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Drawing\\553c0312fdf5a5449f3649f0515e70fb\\System.Drawing.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.drawing\\553c0312fdf5a5449f3649f0515e70fb\\system.drawing.ni.dll") Region: id = 248 start_va = 0x4d00000 end_va = 0x4d0ffff entry_point = 0x0 region_type = private name = "private_0x0000000004d00000" filename = "" Region: id = 264 start_va = 0x1ef0000 end_va = 0x1efffff entry_point = 0x0 region_type = private name = "private_0x0000000001ef0000" filename = "" Region: id = 268 start_va = 0x4da0000 end_va = 0x4ddffff entry_point = 0x0 region_type = private name = "private_0x0000000004da0000" filename = "" Region: id = 269 start_va = 0x5050000 end_va = 0x514ffff entry_point = 0x0 region_type = private name = "private_0x0000000005050000" filename = "" Region: id = 270 start_va = 0x7efa4000 end_va = 0x7efa6fff entry_point = 0x0 region_type = private name = "private_0x000000007efa4000" filename = "" Region: id = 271 start_va = 0x750a0000 end_va = 0x750adfff entry_point = 0x750a0000 region_type = mapped_file name = "rpcrtremote.dll" filename = "\\Windows\\SysWOW64\\RpcRtRemote.dll" (normalized: "c:\\windows\\syswow64\\rpcrtremote.dll") Thread: id = 1 os_tid = 0x9fc [0044.749] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0 [0046.517] EtwEventRegister () returned 0x0 [0046.564] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\unlikexpc.exe.config", nBufferLength=0x105, lpBuffer=0x49e7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\unlikexpc.exe.config", lpFilePart=0x0) returned 0x3a [0046.565] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x49ec84) returned 1 [0046.565] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\unlikexpc.exe.config" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\unlikexpc.exe.config"), fInfoLevelId=0x0, lpFileInformation=0x49ed00 | out: lpFileInformation=0x49ed00*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0046.565] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x49ec80) returned 1 [0056.314] GetCurrentProcessId () returned 0x9f8 [0056.884] LookupPrivilegeValueW (in: lpSystemName=0x0, lpName="SeDebugPrivilege", lpLuid=0x49b3dc | out: lpLuid=0x49b3dc*(LowPart=0x14, HighPart=0)) returned 1 [0056.885] GetCurrentProcess () returned 0xffffffff [0056.885] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x20, TokenHandle=0x49b3d8 | out: TokenHandle=0x49b3d8*=0x2f0) returned 1 [0056.885] AdjustTokenPrivileges (in: TokenHandle=0x2f0, DisableAllPrivileges=0, NewState=0x225dd5c*(PrivilegesCount=0x1, Privileges=((Luid.LowPart=0x14, Luid.HighPart=0, Attributes=0x2))), BufferLength=0x0, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1 [0056.909] CloseHandle (hObject=0x2f0) returned 1 [0056.979] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x9f8) returned 0x2f0 [0056.986] EnumProcessModules (in: hProcess=0x2f0, lphModule=0x225e5d8, cb=0x100, lpcbNeeded=0x49bab0 | out: lphModule=0x225e5d8, lpcbNeeded=0x49bab0) returned 1 [0056.987] GetModuleInformation (in: hProcess=0x2f0, hModule=0x310000, lpmodinfo=0x225e718, cb=0xc | out: lpmodinfo=0x225e718*(lpBaseOfDll=0x310000, SizeOfImage=0x3e000, EntryPoint=0x3479ce)) returned 1 [0056.988] CoTaskMemAlloc (cb=0x804) returned 0x5cfcb0 [0056.988] GetModuleBaseNameW (in: hProcess=0x2f0, hModule=0x310000, lpBaseName=0x5cfcb0, nSize=0x800 | out: lpBaseName="unlikexpc.exe") returned 0xd [0056.989] CoTaskMemFree (pv=0x5cfcb0) [0056.989] CoTaskMemAlloc (cb=0x804) returned 0x5cfcb0 [0056.989] GetModuleFileNameExW (in: hProcess=0x2f0, hModule=0x310000, lpFilename=0x5cfcb0, nSize=0x800 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\unlikexpc.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\unlikexpc.exe")) returned 0x33 [0056.989] CoTaskMemFree (pv=0x5cfcb0) [0056.990] GetModuleInformation (in: hProcess=0x2f0, hModule=0x77ab0000, lpmodinfo=0x2260888, cb=0xc | out: lpmodinfo=0x2260888*(lpBaseOfDll=0x77ab0000, SizeOfImage=0x180000, EntryPoint=0x0)) returned 1 [0056.990] CoTaskMemAlloc (cb=0x804) returned 0x5cfcb0 [0056.990] GetModuleBaseNameW (in: hProcess=0x2f0, hModule=0x77ab0000, lpBaseName=0x5cfcb0, nSize=0x800 | out: lpBaseName="ntdll.dll") returned 0x9 [0056.990] CoTaskMemFree (pv=0x5cfcb0) [0056.990] CoTaskMemAlloc (cb=0x804) returned 0x5cfcb0 [0056.990] GetModuleFileNameExW (in: hProcess=0x2f0, hModule=0x77ab0000, lpFilename=0x5cfcb0, nSize=0x800 | out: lpFilename="C:\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll")) returned 0x1d [0056.990] CoTaskMemFree (pv=0x5cfcb0) [0056.990] GetModuleInformation (in: hProcess=0x2f0, hModule=0x754b0000, lpmodinfo=0x226298c, cb=0xc | out: lpmodinfo=0x226298c*(lpBaseOfDll=0x754b0000, SizeOfImage=0x4a000, EntryPoint=0x754b2e54)) returned 1 [0056.990] CoTaskMemAlloc (cb=0x804) returned 0x5cfcb0 [0056.990] GetModuleBaseNameW (in: hProcess=0x2f0, hModule=0x754b0000, lpBaseName=0x5cfcb0, nSize=0x800 | out: lpBaseName="MSCOREE.DLL") returned 0xb [0056.990] CoTaskMemFree (pv=0x5cfcb0) [0056.990] CoTaskMemAlloc (cb=0x804) returned 0x5cfcb0 [0056.990] GetModuleFileNameExW (in: hProcess=0x2f0, hModule=0x754b0000, lpFilename=0x5cfcb0, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\MSCOREE.DLL" (normalized: "c:\\windows\\system32\\mscoree.dll")) returned 0x1f [0056.991] CoTaskMemFree (pv=0x5cfcb0) [0056.991] GetModuleInformation (in: hProcess=0x2f0, hModule=0x757c0000, lpmodinfo=0x2264a98, cb=0xc | out: lpmodinfo=0x2264a98*(lpBaseOfDll=0x757c0000, SizeOfImage=0x110000, EntryPoint=0x757d32d3)) returned 1 [0056.991] CoTaskMemAlloc (cb=0x804) returned 0x5cfcb0 [0056.991] GetModuleBaseNameW (in: hProcess=0x2f0, hModule=0x757c0000, lpBaseName=0x5cfcb0, nSize=0x800 | out: lpBaseName="KERNEL32.dll") returned 0xc [0056.991] CoTaskMemFree (pv=0x5cfcb0) [0056.991] CoTaskMemAlloc (cb=0x804) returned 0x5cfcb0 [0056.991] GetModuleFileNameExW (in: hProcess=0x2f0, hModule=0x757c0000, lpFilename=0x5cfcb0, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\KERNEL32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll")) returned 0x20 [0056.991] CoTaskMemFree (pv=0x5cfcb0) [0056.991] GetModuleInformation (in: hProcess=0x2f0, hModule=0x76260000, lpmodinfo=0x2266bac, cb=0xc | out: lpmodinfo=0x2266bac*(lpBaseOfDll=0x76260000, SizeOfImage=0x46000, EntryPoint=0x76267478)) returned 1 [0056.991] CoTaskMemAlloc (cb=0x804) returned 0x5cfcb0 [0056.991] GetModuleBaseNameW (in: hProcess=0x2f0, hModule=0x76260000, lpBaseName=0x5cfcb0, nSize=0x800 | out: lpBaseName="KERNELBASE.dll") returned 0xe [0056.991] CoTaskMemFree (pv=0x5cfcb0) [0056.991] CoTaskMemAlloc (cb=0x804) returned 0x5cfcb0 [0056.991] GetModuleFileNameExW (in: hProcess=0x2f0, hModule=0x76260000, lpFilename=0x5cfcb0, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\KERNELBASE.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll")) returned 0x22 [0056.992] CoTaskMemFree (pv=0x5cfcb0) [0056.992] GetModuleInformation (in: hProcess=0x2f0, hModule=0x75720000, lpmodinfo=0x2268cf4, cb=0xc | out: lpmodinfo=0x2268cf4*(lpBaseOfDll=0x75720000, SizeOfImage=0xa0000, EntryPoint=0x757349e5)) returned 1 [0056.992] CoTaskMemAlloc (cb=0x804) returned 0x5cfcb0 [0056.992] GetModuleBaseNameW (in: hProcess=0x2f0, hModule=0x75720000, lpBaseName=0x5cfcb0, nSize=0x800 | out: lpBaseName="ADVAPI32.dll") returned 0xc [0056.992] CoTaskMemFree (pv=0x5cfcb0) [0056.992] CoTaskMemAlloc (cb=0x804) returned 0x5cfcb0 [0056.992] GetModuleFileNameExW (in: hProcess=0x2f0, hModule=0x75720000, lpFilename=0x5cfcb0, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\ADVAPI32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll")) returned 0x20 [0056.992] CoTaskMemFree (pv=0x5cfcb0) [0056.992] GetModuleInformation (in: hProcess=0x2f0, hModule=0x75fe0000, lpmodinfo=0x226ae08, cb=0xc | out: lpmodinfo=0x226ae08*(lpBaseOfDll=0x75fe0000, SizeOfImage=0xac000, EntryPoint=0x75fea472)) returned 1 [0056.992] CoTaskMemAlloc (cb=0x804) returned 0x5cfcb0 [0056.992] GetModuleBaseNameW (in: hProcess=0x2f0, hModule=0x75fe0000, lpBaseName=0x5cfcb0, nSize=0x800 | out: lpBaseName="msvcrt.dll") returned 0xa [0056.993] CoTaskMemFree (pv=0x5cfcb0) [0056.993] CoTaskMemAlloc (cb=0x804) returned 0x5cfcb0 [0056.993] GetModuleFileNameExW (in: hProcess=0x2f0, hModule=0x75fe0000, lpFilename=0x5cfcb0, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll")) returned 0x1e [0056.993] CoTaskMemFree (pv=0x5cfcb0) [0056.993] GetModuleInformation (in: hProcess=0x2f0, hModule=0x761b0000, lpmodinfo=0x226cf14, cb=0xc | out: lpmodinfo=0x226cf14*(lpBaseOfDll=0x761b0000, SizeOfImage=0x19000, EntryPoint=0x761b4975)) returned 1 [0056.993] CoTaskMemAlloc (cb=0x804) returned 0x5cfcb0 [0056.993] GetModuleBaseNameW (in: hProcess=0x2f0, hModule=0x761b0000, lpBaseName=0x5cfcb0, nSize=0x800 | out: lpBaseName="sechost.dll") returned 0xb [0056.993] CoTaskMemFree (pv=0x5cfcb0) [0056.993] CoTaskMemAlloc (cb=0x804) returned 0x5cfcb0 [0056.993] GetModuleFileNameExW (in: hProcess=0x2f0, hModule=0x761b0000, lpFilename=0x5cfcb0, nSize=0x800 | out: lpFilename="C:\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll")) returned 0x1f [0056.994] CoTaskMemFree (pv=0x5cfcb0) [0056.994] GetModuleInformation (in: hProcess=0x2f0, hModule=0x76090000, lpmodinfo=0x226f020, cb=0xc | out: lpmodinfo=0x226f020*(lpBaseOfDll=0x76090000, SizeOfImage=0xf0000, EntryPoint=0x760a0569)) returned 1 [0056.994] CoTaskMemAlloc (cb=0x804) returned 0x5cfcb0 [0056.994] GetModuleBaseNameW (in: hProcess=0x2f0, hModule=0x76090000, lpBaseName=0x5cfcb0, nSize=0x800 | out: lpBaseName="RPCRT4.dll") returned 0xa [0056.994] CoTaskMemFree (pv=0x5cfcb0) [0056.994] CoTaskMemAlloc (cb=0x804) returned 0x5cfcb0 [0056.994] GetModuleFileNameExW (in: hProcess=0x2f0, hModule=0x76090000, lpFilename=0x5cfcb0, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\RPCRT4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll")) returned 0x1e [0056.994] CoTaskMemFree (pv=0x5cfcb0) [0056.994] GetModuleInformation (in: hProcess=0x2f0, hModule=0x75610000, lpmodinfo=0x2271178, cb=0xc | out: lpmodinfo=0x2271178*(lpBaseOfDll=0x75610000, SizeOfImage=0x60000, EntryPoint=0x7562a3b3)) returned 1 [0056.995] CoTaskMemAlloc (cb=0x804) returned 0x5cfcb0 [0056.995] GetModuleBaseNameW (in: hProcess=0x2f0, hModule=0x75610000, lpBaseName=0x5cfcb0, nSize=0x800 | out: lpBaseName="SspiCli.dll") returned 0xb [0056.995] CoTaskMemFree (pv=0x5cfcb0) [0056.995] CoTaskMemAlloc (cb=0x804) returned 0x5cfcb0 [0056.995] GetModuleFileNameExW (in: hProcess=0x2f0, hModule=0x75610000, lpFilename=0x5cfcb0, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\SspiCli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll")) returned 0x1f [0056.995] CoTaskMemFree (pv=0x5cfcb0) [0056.995] GetModuleInformation (in: hProcess=0x2f0, hModule=0x75600000, lpmodinfo=0x2273284, cb=0xc | out: lpmodinfo=0x2273284*(lpBaseOfDll=0x75600000, SizeOfImage=0xc000, EntryPoint=0x756010e1)) returned 1 [0056.995] CoTaskMemAlloc (cb=0x804) returned 0x5cfcb0 [0056.995] GetModuleBaseNameW (in: hProcess=0x2f0, hModule=0x75600000, lpBaseName=0x5cfcb0, nSize=0x800 | out: lpBaseName="CRYPTBASE.dll") returned 0xd [0056.996] CoTaskMemFree (pv=0x5cfcb0) [0056.996] CoTaskMemAlloc (cb=0x804) returned 0x5cfcb0 [0056.996] GetModuleFileNameExW (in: hProcess=0x2f0, hModule=0x75600000, lpFilename=0x5cfcb0, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\CRYPTBASE.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll")) returned 0x21 [0056.996] CoTaskMemFree (pv=0x5cfcb0) [0056.996] GetModuleInformation (in: hProcess=0x2f0, hModule=0x75430000, lpmodinfo=0x2275398, cb=0xc | out: lpmodinfo=0x2275398*(lpBaseOfDll=0x75430000, SizeOfImage=0x78000, EntryPoint=0x7543f7ba)) returned 1 [0056.996] CoTaskMemAlloc (cb=0x804) returned 0x5cfcb0 [0056.996] GetModuleBaseNameW (in: hProcess=0x2f0, hModule=0x75430000, lpBaseName=0x5cfcb0, nSize=0x800 | out: lpBaseName="mscoreei.dll") returned 0xc [0056.996] CoTaskMemFree (pv=0x5cfcb0) [0056.996] CoTaskMemAlloc (cb=0x804) returned 0x5cfcb0 [0056.996] GetModuleFileNameExW (in: hProcess=0x2f0, hModule=0x75430000, lpFilename=0x5cfcb0, nSize=0x800 | out: lpFilename="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscoreei.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\mscoreei.dll")) returned 0x3a [0056.997] CoTaskMemFree (pv=0x5cfcb0) [0056.997] GetModuleInformation (in: hProcess=0x2f0, hModule=0x761d0000, lpmodinfo=0x22774e0, cb=0xc | out: lpmodinfo=0x22774e0*(lpBaseOfDll=0x761d0000, SizeOfImage=0x57000, EntryPoint=0x761e9ba6)) returned 1 [0056.997] CoTaskMemAlloc (cb=0x804) returned 0x5cfcb0 [0056.997] GetModuleBaseNameW (in: hProcess=0x2f0, hModule=0x761d0000, lpBaseName=0x5cfcb0, nSize=0x800 | out: lpBaseName="SHLWAPI.dll") returned 0xb [0056.997] CoTaskMemFree (pv=0x5cfcb0) [0056.997] CoTaskMemAlloc (cb=0x804) returned 0x5cfcb0 [0056.997] GetModuleFileNameExW (in: hProcess=0x2f0, hModule=0x761d0000, lpFilename=0x5cfcb0, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\SHLWAPI.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll")) returned 0x1f [0056.998] CoTaskMemFree (pv=0x5cfcb0) [0056.998] GetModuleInformation (in: hProcess=0x2f0, hModule=0x766d0000, lpmodinfo=0x22795ec, cb=0xc | out: lpmodinfo=0x22795ec*(lpBaseOfDll=0x766d0000, SizeOfImage=0x90000, EntryPoint=0x766e6343)) returned 1 [0056.998] CoTaskMemAlloc (cb=0x804) returned 0x5cfcb0 [0056.998] GetModuleBaseNameW (in: hProcess=0x2f0, hModule=0x766d0000, lpBaseName=0x5cfcb0, nSize=0x800 | out: lpBaseName="GDI32.dll") returned 0x9 [0056.998] CoTaskMemFree (pv=0x5cfcb0) [0056.998] CoTaskMemAlloc (cb=0x804) returned 0x5cfcb0 [0056.998] GetModuleFileNameExW (in: hProcess=0x2f0, hModule=0x766d0000, lpFilename=0x5cfcb0, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\GDI32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll")) returned 0x1d [0056.998] CoTaskMemFree (pv=0x5cfcb0) [0056.998] GetModuleInformation (in: hProcess=0x2f0, hModule=0x775b0000, lpmodinfo=0x227b6f0, cb=0xc | out: lpmodinfo=0x227b6f0*(lpBaseOfDll=0x775b0000, SizeOfImage=0x100000, EntryPoint=0x775cb6ed)) returned 1 [0056.999] CoTaskMemAlloc (cb=0x804) returned 0x5cfcb0 [0056.999] GetModuleBaseNameW (in: hProcess=0x2f0, hModule=0x775b0000, lpBaseName=0x5cfcb0, nSize=0x800 | out: lpBaseName="USER32.dll") returned 0xa [0056.999] CoTaskMemFree (pv=0x5cfcb0) [0056.999] CoTaskMemAlloc (cb=0x804) returned 0x5cfcb0 [0056.999] GetModuleFileNameExW (in: hProcess=0x2f0, hModule=0x775b0000, lpFilename=0x5cfcb0, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\USER32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll")) returned 0x1e [0056.999] CoTaskMemFree (pv=0x5cfcb0) [0056.999] GetModuleInformation (in: hProcess=0x2f0, hModule=0x75a70000, lpmodinfo=0x227d7fc, cb=0xc | out: lpmodinfo=0x227d7fc*(lpBaseOfDll=0x75a70000, SizeOfImage=0xa000, EntryPoint=0x75a736a0)) returned 1 [0057.000] CoTaskMemAlloc (cb=0x804) returned 0x5cfcb0 [0057.000] GetModuleBaseNameW (in: hProcess=0x2f0, hModule=0x75a70000, lpBaseName=0x5cfcb0, nSize=0x800 | out: lpBaseName="LPK.dll") returned 0x7 [0057.000] CoTaskMemFree (pv=0x5cfcb0) [0057.000] CoTaskMemAlloc (cb=0x804) returned 0x5cfcb0 [0057.000] GetModuleFileNameExW (in: hProcess=0x2f0, hModule=0x75a70000, lpFilename=0x5cfcb0, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\LPK.dll" (normalized: "c:\\windows\\syswow64\\lpk.dll")) returned 0x1b [0057.000] CoTaskMemFree (pv=0x5cfcb0) [0057.000] GetModuleInformation (in: hProcess=0x2f0, hModule=0x758d0000, lpmodinfo=0x227f8f8, cb=0xc | out: lpmodinfo=0x227f8f8*(lpBaseOfDll=0x758d0000, SizeOfImage=0x9d000, EntryPoint=0x75903fd7)) returned 1 [0057.001] CoTaskMemAlloc (cb=0x804) returned 0x5cfcb0 [0057.001] GetModuleBaseNameW (in: hProcess=0x2f0, hModule=0x758d0000, lpBaseName=0x5cfcb0, nSize=0x800 | out: lpBaseName="USP10.dll") returned 0x9 [0057.001] CoTaskMemFree (pv=0x5cfcb0) [0057.001] CoTaskMemAlloc (cb=0x804) returned 0x5cfcb0 [0057.001] GetModuleFileNameExW (in: hProcess=0x2f0, hModule=0x758d0000, lpFilename=0x5cfcb0, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\USP10.dll" (normalized: "c:\\windows\\syswow64\\usp10.dll")) returned 0x1d [0057.001] CoTaskMemFree (pv=0x5cfcb0) [0057.001] GetModuleInformation (in: hProcess=0x2f0, hModule=0x75f80000, lpmodinfo=0x2281a88, cb=0xc | out: lpmodinfo=0x2281a88*(lpBaseOfDll=0x75f80000, SizeOfImage=0x60000, EntryPoint=0x75f9158f)) returned 1 [0057.002] CoTaskMemAlloc (cb=0x804) returned 0x5cfcb0 [0057.002] GetModuleBaseNameW (in: hProcess=0x2f0, hModule=0x75f80000, lpBaseName=0x5cfcb0, nSize=0x800 | out: lpBaseName="IMM32.DLL") returned 0x9 [0057.002] CoTaskMemFree (pv=0x5cfcb0) [0057.002] CoTaskMemAlloc (cb=0x804) returned 0x5cfcb0 [0057.002] GetModuleFileNameExW (in: hProcess=0x2f0, hModule=0x75f80000, lpFilename=0x5cfcb0, nSize=0x800 | out: lpFilename="C:\\Windows\\system32\\IMM32.DLL" (normalized: "c:\\windows\\system32\\imm32.dll")) returned 0x1d [0057.002] CoTaskMemFree (pv=0x5cfcb0) [0057.002] GetModuleInformation (in: hProcess=0x2f0, hModule=0x75ea0000, lpmodinfo=0x2283b8c, cb=0xc | out: lpmodinfo=0x2283b8c*(lpBaseOfDll=0x75ea0000, SizeOfImage=0xcc000, EntryPoint=0x75ea168b)) returned 1 [0057.003] CoTaskMemAlloc (cb=0x804) returned 0x5cfcb0 [0057.003] GetModuleBaseNameW (in: hProcess=0x2f0, hModule=0x75ea0000, lpBaseName=0x5cfcb0, nSize=0x800 | out: lpBaseName="MSCTF.dll") returned 0x9 [0057.003] CoTaskMemFree (pv=0x5cfcb0) [0057.003] CoTaskMemAlloc (cb=0x804) returned 0x5cfcb0 [0057.003] GetModuleFileNameExW (in: hProcess=0x2f0, hModule=0x75ea0000, lpFilename=0x5cfcb0, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\MSCTF.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll")) returned 0x1d [0057.004] CoTaskMemFree (pv=0x5cfcb0) [0057.004] GetModuleInformation (in: hProcess=0x2f0, hModule=0x75420000, lpmodinfo=0x2285c90, cb=0xc | out: lpmodinfo=0x2285c90*(lpBaseOfDll=0x75420000, SizeOfImage=0x9000, EntryPoint=0x75421220)) returned 1 [0057.004] CoTaskMemAlloc (cb=0x804) returned 0x5cfcb0 [0057.004] GetModuleBaseNameW (in: hProcess=0x2f0, hModule=0x75420000, lpBaseName=0x5cfcb0, nSize=0x800 | out: lpBaseName="VERSION.dll") returned 0xb [0057.004] CoTaskMemFree (pv=0x5cfcb0) [0057.004] CoTaskMemAlloc (cb=0x804) returned 0x5cfcb0 [0057.004] GetModuleFileNameExW (in: hProcess=0x2f0, hModule=0x75420000, lpFilename=0x5cfcb0, nSize=0x800 | out: lpFilename="C:\\Windows\\system32\\VERSION.dll" (normalized: "c:\\windows\\system32\\version.dll")) returned 0x1f [0057.005] CoTaskMemFree (pv=0x5cfcb0) [0057.005] GetModuleInformation (in: hProcess=0x2f0, hModule=0x74890000, lpmodinfo=0x2287d9c, cb=0xc | out: lpmodinfo=0x2287d9c*(lpBaseOfDll=0x74890000, SizeOfImage=0x6a8000, EntryPoint=0x749d7040)) returned 1 [0057.005] CoTaskMemAlloc (cb=0x804) returned 0x5cfcb0 [0057.005] GetModuleBaseNameW (in: hProcess=0x2f0, hModule=0x74890000, lpBaseName=0x5cfcb0, nSize=0x800 | out: lpBaseName="clr.dll") returned 0x7 [0057.005] CoTaskMemFree (pv=0x5cfcb0) [0057.005] CoTaskMemAlloc (cb=0x804) returned 0x5cfcb0 [0057.005] GetModuleFileNameExW (in: hProcess=0x2f0, hModule=0x74890000, lpFilename=0x5cfcb0, nSize=0x800 | out: lpFilename="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\clr.dll")) returned 0x35 [0057.006] CoTaskMemFree (pv=0x5cfcb0) [0057.006] GetModuleInformation (in: hProcess=0x2f0, hModule=0x75320000, lpmodinfo=0x2289ecc, cb=0xc | out: lpmodinfo=0x2289ecc*(lpBaseOfDll=0x75320000, SizeOfImage=0xf5000, EntryPoint=0x75374160)) returned 1 [0057.006] CoTaskMemAlloc (cb=0x804) returned 0x5cfcb0 [0057.006] GetModuleBaseNameW (in: hProcess=0x2f0, hModule=0x75320000, lpBaseName=0x5cfcb0, nSize=0x800 | out: lpBaseName="MSVCR120_CLR0400.dll") returned 0x14 [0057.007] CoTaskMemFree (pv=0x5cfcb0) [0057.007] CoTaskMemAlloc (cb=0x804) returned 0x5cfcb0 [0057.007] GetModuleFileNameExW (in: hProcess=0x2f0, hModule=0x75320000, lpFilename=0x5cfcb0, nSize=0x800 | out: lpFilename="C:\\Windows\\system32\\MSVCR120_CLR0400.dll" (normalized: "c:\\windows\\system32\\msvcr120_clr0400.dll")) returned 0x28 [0057.007] CoTaskMemFree (pv=0x5cfcb0) [0057.007] GetModuleInformation (in: hProcess=0x2f0, hModule=0x72440000, lpmodinfo=0x228c000, cb=0xc | out: lpmodinfo=0x228c000*(lpBaseOfDll=0x72440000, SizeOfImage=0x122b000, EntryPoint=0x0)) returned 1 [0057.007] CoTaskMemAlloc (cb=0x804) returned 0x5cfcb0 [0057.007] GetModuleBaseNameW (in: hProcess=0x2f0, hModule=0x72440000, lpBaseName=0x5cfcb0, nSize=0x800 | out: lpBaseName="mscorlib.ni.dll") returned 0xf [0057.008] CoTaskMemFree (pv=0x5cfcb0) [0057.008] CoTaskMemAlloc (cb=0x804) returned 0x5cfcb0 [0057.008] GetModuleFileNameExW (in: hProcess=0x2f0, hModule=0x72440000, lpFilename=0x5cfcb0, nSize=0x800 | out: lpFilename="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\b7a12c4c0032847fcc6b9c710460456f\\mscorlib.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\mscorlib\\b7a12c4c0032847fcc6b9c710460456f\\mscorlib.ni.dll")) returned 0x68 [0057.008] CoTaskMemFree (pv=0x5cfcb0) [0057.008] GetModuleInformation (in: hProcess=0x2f0, hModule=0x764e0000, lpmodinfo=0x228e1a8, cb=0xc | out: lpmodinfo=0x228e1a8*(lpBaseOfDll=0x764e0000, SizeOfImage=0x15c000, EntryPoint=0x7652ba3d)) returned 1 [0057.009] CoTaskMemAlloc (cb=0x804) returned 0x5cfcb0 [0057.009] GetModuleBaseNameW (in: hProcess=0x2f0, hModule=0x764e0000, lpBaseName=0x5cfcb0, nSize=0x800 | out: lpBaseName="ole32.dll") returned 0x9 [0057.009] CoTaskMemFree (pv=0x5cfcb0) [0057.009] CoTaskMemAlloc (cb=0x804) returned 0x5cfcb0 [0057.009] GetModuleFileNameExW (in: hProcess=0x2f0, hModule=0x764e0000, lpFilename=0x5cfcb0, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll")) returned 0x1d [0057.010] CoTaskMemFree (pv=0x5cfcb0) [0057.010] GetModuleInformation (in: hProcess=0x2f0, hModule=0x74f60000, lpmodinfo=0x22902ac, cb=0xc | out: lpmodinfo=0x22902ac*(lpBaseOfDll=0x74f60000, SizeOfImage=0x80000, EntryPoint=0x74f737c9)) returned 1 [0057.010] CoTaskMemAlloc (cb=0x804) returned 0x5cfcb0 [0057.010] GetModuleBaseNameW (in: hProcess=0x2f0, hModule=0x74f60000, lpBaseName=0x5cfcb0, nSize=0x800 | out: lpBaseName="uxtheme.dll") returned 0xb [0057.011] CoTaskMemFree (pv=0x5cfcb0) [0057.011] CoTaskMemAlloc (cb=0x804) returned 0x5cfcb0 [0057.011] GetModuleFileNameExW (in: hProcess=0x2f0, hModule=0x74f60000, lpFilename=0x5cfcb0, nSize=0x800 | out: lpFilename="C:\\Windows\\system32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll")) returned 0x1f [0057.011] CoTaskMemFree (pv=0x5cfcb0) [0057.012] GetModuleInformation (in: hProcess=0x2f0, hModule=0x752a0000, lpmodinfo=0x22923b8, cb=0xc | out: lpmodinfo=0x22923b8*(lpBaseOfDll=0x752a0000, SizeOfImage=0x7d000, EntryPoint=0x752a1140)) returned 1 [0057.012] CoTaskMemAlloc (cb=0x804) returned 0x5cfcb0 [0057.012] GetModuleBaseNameW (in: hProcess=0x2f0, hModule=0x752a0000, lpBaseName=0x5cfcb0, nSize=0x800 | out: lpBaseName="clrjit.dll") returned 0xa [0057.013] CoTaskMemFree (pv=0x5cfcb0) [0057.013] CoTaskMemAlloc (cb=0x804) returned 0x5cfcb0 [0057.013] GetModuleFileNameExW (in: hProcess=0x2f0, hModule=0x752a0000, lpFilename=0x5cfcb0, nSize=0x800 | out: lpFilename="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clrjit.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\clrjit.dll")) returned 0x38 [0057.013] CoTaskMemFree (pv=0x5cfcb0) [0057.013] GetModuleInformation (in: hProcess=0x2f0, hModule=0x762b0000, lpmodinfo=0x22944f8, cb=0xc | out: lpmodinfo=0x22944f8*(lpBaseOfDll=0x762b0000, SizeOfImage=0x8f000, EntryPoint=0x762b3fb1)) returned 1 [0057.014] CoTaskMemAlloc (cb=0x804) returned 0x5cfcb0 [0057.014] GetModuleBaseNameW (in: hProcess=0x2f0, hModule=0x762b0000, lpBaseName=0x5cfcb0, nSize=0x800 | out: lpBaseName="OLEAUT32.dll") returned 0xc [0057.014] CoTaskMemFree (pv=0x5cfcb0) [0057.014] CoTaskMemAlloc (cb=0x804) returned 0x5cfcb0 [0057.014] GetModuleFileNameExW (in: hProcess=0x2f0, hModule=0x762b0000, lpFilename=0x5cfcb0, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\OLEAUT32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll")) returned 0x20 [0057.015] CoTaskMemFree (pv=0x5cfcb0) [0057.015] GetModuleInformation (in: hProcess=0x2f0, hModule=0x736d0000, lpmodinfo=0x229660c, cb=0xc | out: lpmodinfo=0x229660c*(lpBaseOfDll=0x736d0000, SizeOfImage=0x9ad000, EntryPoint=0x0)) returned 1 [0057.015] CoTaskMemAlloc (cb=0x804) returned 0x5cfcb0 [0057.015] GetModuleBaseNameW (in: hProcess=0x2f0, hModule=0x736d0000, lpBaseName=0x5cfcb0, nSize=0x800 | out: lpBaseName="System.ni.dll") returned 0xd [0057.016] CoTaskMemFree (pv=0x5cfcb0) [0057.016] CoTaskMemAlloc (cb=0x804) returned 0x5cfcb0 [0057.016] GetModuleFileNameExW (in: hProcess=0x2f0, hModule=0x736d0000, lpFilename=0x5cfcb0, nSize=0x800 | out: lpFilename="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System\\500ffa28b327e171fe664023003e947e\\System.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system\\500ffa28b327e171fe664023003e947e\\system.ni.dll")) returned 0x64 [0057.017] CoTaskMemFree (pv=0x5cfcb0) [0057.017] GetModuleInformation (in: hProcess=0x2f0, hModule=0x71d20000, lpmodinfo=0x22987a8, cb=0xc | out: lpmodinfo=0x22987a8*(lpBaseOfDll=0x71d20000, SizeOfImage=0x716000, EntryPoint=0x0)) returned 1 [0057.017] CoTaskMemAlloc (cb=0x804) returned 0x5cfcb0 [0057.017] GetModuleBaseNameW (in: hProcess=0x2f0, hModule=0x71d20000, lpBaseName=0x5cfcb0, nSize=0x800 | out: lpBaseName="System.Core.ni.dll") returned 0x12 [0057.018] CoTaskMemFree (pv=0x5cfcb0) [0057.018] CoTaskMemAlloc (cb=0x804) returned 0x5cfcb0 [0057.018] GetModuleFileNameExW (in: hProcess=0x2f0, hModule=0x71d20000, lpFilename=0x5cfcb0, nSize=0x800 | out: lpFilename="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Core\\386fde9190d499d6645df8b90eb76242\\System.Core.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.core\\386fde9190d499d6645df8b90eb76242\\system.core.ni.dll")) returned 0x6e [0057.018] CoTaskMemFree (pv=0x5cfcb0) [0057.018] GetModuleInformation (in: hProcess=0x2f0, hModule=0x750d0000, lpmodinfo=0x229a964, cb=0xc | out: lpmodinfo=0x229a964*(lpBaseOfDll=0x750d0000, SizeOfImage=0x1cb000, EntryPoint=0x0)) returned 1 [0057.019] CoTaskMemAlloc (cb=0x804) returned 0x5cfcb0 [0057.019] GetModuleBaseNameW (in: hProcess=0x2f0, hModule=0x750d0000, lpBaseName=0x5cfcb0, nSize=0x800 | out: lpBaseName="Microsoft.VisualBasic.ni.dll") returned 0x1c [0057.019] CoTaskMemFree (pv=0x5cfcb0) [0057.019] CoTaskMemAlloc (cb=0x804) returned 0x5cfcb0 [0057.019] GetModuleFileNameExW (in: hProcess=0x2f0, hModule=0x750d0000, lpFilename=0x5cfcb0, nSize=0x800 | out: lpFilename="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Microsoft.V9921e851#\\cfbddeb6e93e8f421b92229b20e51233\\Microsoft.VisualBasic.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\microsoft.v9921e851#\\cfbddeb6e93e8f421b92229b20e51233\\microsoft.visualbasic.ni.dll")) returned 0x81 [0057.020] CoTaskMemFree (pv=0x5cfcb0) [0057.020] GetModuleInformation (in: hProcess=0x2f0, hModule=0x750b0000, lpmodinfo=0x229cb58, cb=0xc | out: lpmodinfo=0x229cb58*(lpBaseOfDll=0x750b0000, SizeOfImage=0x13000, EntryPoint=0x750b18f0)) returned 1 [0057.021] CoTaskMemAlloc (cb=0x804) returned 0x5cfcb0 [0057.021] GetModuleBaseNameW (in: hProcess=0x2f0, hModule=0x750b0000, lpBaseName=0x5cfcb0, nSize=0x800 | out: lpBaseName="nlssorting.dll") returned 0xe [0057.021] CoTaskMemFree (pv=0x5cfcb0) [0057.021] CoTaskMemAlloc (cb=0x804) returned 0x5cfcb0 [0057.021] GetModuleFileNameExW (in: hProcess=0x2f0, hModule=0x750b0000, lpFilename=0x5cfcb0, nSize=0x800 | out: lpFilename="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\nlssorting.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\nlssorting.dll")) returned 0x3c [0057.022] CoTaskMemFree (pv=0x5cfcb0) [0057.022] GetModuleInformation (in: hProcess=0x2f0, hModule=0x74870000, lpmodinfo=0x229eca8, cb=0xc | out: lpmodinfo=0x229eca8*(lpBaseOfDll=0x74870000, SizeOfImage=0x16000, EntryPoint=0x74872dc3)) returned 1 [0057.023] CoTaskMemAlloc (cb=0x804) returned 0x5cfcb0 [0057.023] GetModuleBaseNameW (in: hProcess=0x2f0, hModule=0x74870000, lpBaseName=0x5cfcb0, nSize=0x800 | out: lpBaseName="CRYPTSP.dll") returned 0xb [0057.023] CoTaskMemFree (pv=0x5cfcb0) [0057.023] CoTaskMemAlloc (cb=0x804) returned 0x5cfcb0 [0057.023] GetModuleFileNameExW (in: hProcess=0x2f0, hModule=0x74870000, lpFilename=0x5cfcb0, nSize=0x800 | out: lpFilename="C:\\Windows\\system32\\CRYPTSP.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll")) returned 0x1f [0057.024] CoTaskMemFree (pv=0x5cfcb0) [0057.024] GetModuleInformation (in: hProcess=0x2f0, hModule=0x74830000, lpmodinfo=0x22a0db4, cb=0xc | out: lpmodinfo=0x22a0db4*(lpBaseOfDll=0x74830000, SizeOfImage=0x3b000, EntryPoint=0x7483128d)) returned 1 [0057.024] CoTaskMemAlloc (cb=0x804) returned 0x5cfcb0 [0057.025] GetModuleBaseNameW (in: hProcess=0x2f0, hModule=0x74830000, lpBaseName=0x5cfcb0, nSize=0x800 | out: lpBaseName="rsaenh.dll") returned 0xa [0057.025] CoTaskMemFree (pv=0x5cfcb0) [0057.025] CoTaskMemAlloc (cb=0x804) returned 0x5cfcb0 [0057.025] GetModuleFileNameExW (in: hProcess=0x2f0, hModule=0x74830000, lpFilename=0x5cfcb0, nSize=0x800 | out: lpFilename="C:\\Windows\\system32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll")) returned 0x1e [0057.026] CoTaskMemFree (pv=0x5cfcb0) [0057.026] GetModuleInformation (in: hProcess=0x2f0, hModule=0x75a60000, lpmodinfo=0x22a2fcc, cb=0xc | out: lpmodinfo=0x22a2fcc*(lpBaseOfDll=0x75a60000, SizeOfImage=0x5000, EntryPoint=0x75a61438)) returned 1 [0057.026] CoTaskMemAlloc (cb=0x804) returned 0x5cfcb0 [0057.026] GetModuleBaseNameW (in: hProcess=0x2f0, hModule=0x75a60000, lpBaseName=0x5cfcb0, nSize=0x800 | out: lpBaseName="psapi.dll") returned 0x9 [0057.027] CoTaskMemFree (pv=0x5cfcb0) [0057.027] CoTaskMemAlloc (cb=0x804) returned 0x5cfcb0 [0057.027] GetModuleFileNameExW (in: hProcess=0x2f0, hModule=0x75a60000, lpFilename=0x5cfcb0, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\psapi.dll" (normalized: "c:\\windows\\syswow64\\psapi.dll")) returned 0x1d [0057.028] CoTaskMemFree (pv=0x5cfcb0) [0057.028] CloseHandle (hObject=0x2f0) returned 1 [0058.021] SleepEx (dwMilliseconds=0x7d0, bAlertable=1) returned 0x0 [0060.375] SleepEx (dwMilliseconds=0x7d0, bAlertable=1) returned 0x0 [0062.651] SleepEx (dwMilliseconds=0x7d0, bAlertable=1) returned 0x0 [0065.462] SleepEx (dwMilliseconds=0x7d0, bAlertable=1) returned 0x0 [0068.272] SleepEx (dwMilliseconds=0x7d0, bAlertable=1) returned 0x0 [0072.587] SleepEx (dwMilliseconds=0x7d0, bAlertable=1) returned 0x0 [0075.027] SleepEx (dwMilliseconds=0x7d0, bAlertable=1) returned 0x0 [0077.321] SleepEx (dwMilliseconds=0x7d0, bAlertable=1) returned 0x0 [0079.604] SleepEx (dwMilliseconds=0x7d0, bAlertable=1) returned 0x0 [0081.894] SleepEx (dwMilliseconds=0x7d0, bAlertable=1) returned 0x0 [0084.247] SleepEx (dwMilliseconds=0x7d0, bAlertable=1) returned 0x0 [0086.647] SleepEx (dwMilliseconds=0x7d0, bAlertable=1) returned 0x0 [0089.005] SleepEx (dwMilliseconds=0x7d0, bAlertable=1) returned 0x0 [0091.281] SleepEx (dwMilliseconds=0x7d0, bAlertable=1) returned 0x0 [0093.468] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="SYSTEM\\CurrentControlSet\\Enum\\SCSI\\Disk&en_VMware_ &Prod_VMware_Virtual_S", ulOptions=0x0, samDesired=0x20019, phkResult=0x49b598 | out: phkResult=0x49b598*=0x0) returned 0x2 [0093.469] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="SYSTEM\\CurrentControlSet\\Control\\VirtualDeviceDrivers", ulOptions=0x0, samDesired=0x20019, phkResult=0x49b598 | out: phkResult=0x49b598*=0x0) returned 0x2 [0093.469] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="SOFTWARE\\Microsoft\\Virtual Machine", ulOptions=0x0, samDesired=0x20019, phkResult=0x49b598 | out: phkResult=0x49b598*=0x0) returned 0x2 [0094.749] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\unlikexpc.exe", nBufferLength=0x105, lpBuffer=0x49b16c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\unlikexpc.exe", lpFilePart=0x0) returned 0x33 [0094.842] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\unlikexpc.exe", nBufferLength=0x105, lpBuffer=0x49a6f8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\unlikexpc.exe", lpFilePart=0x0) returned 0x33 [0094.842] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x49abec) returned 1 [0094.842] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\unlikexpc.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\unlikexpc.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x2f8 [0094.843] GetFileType (hFile=0x2f8) returned 0x1 [0094.843] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x49abe8) returned 1 [0094.843] GetFileType (hFile=0x2f8) returned 0x1 [0094.843] GetFileSize (in: hFile=0x2f8, lpFileSizeHigh=0x49acf4 | out: lpFileSizeHigh=0x49acf4*=0x0) returned 0x4de47 [0094.843] ReadFile (in: hFile=0x2f8, lpBuffer=0x319fd30, nNumberOfBytesToRead=0x4de47, lpNumberOfBytesRead=0x49aca0, lpOverlapped=0x0 | out: lpBuffer=0x319fd30*, lpNumberOfBytesRead=0x49aca0*=0x4de47, lpOverlapped=0x0) returned 1 [0094.846] CloseHandle (hObject=0x2f8) returned 1 [0094.934] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\unlikexpc.exe", nBufferLength=0x105, lpBuffer=0x49b16c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\unlikexpc.exe", lpFilePart=0x0) returned 0x33 [0095.262] GetCurrentProcessId () returned 0x9f8 [0095.263] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x9f8) returned 0x2f8 [0095.264] EnumProcessModules (in: hProcess=0x2f8, lphModule=0x21c097c, cb=0x100, lpcbNeeded=0x4990c0 | out: lphModule=0x21c097c, lpcbNeeded=0x4990c0) returned 1 [0095.264] GetModuleInformation (in: hProcess=0x2f8, hModule=0x310000, lpmodinfo=0x21c0abc, cb=0xc | out: lpmodinfo=0x21c0abc*(lpBaseOfDll=0x310000, SizeOfImage=0x3e000, EntryPoint=0x3479ce)) returned 1 [0095.264] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.264] GetModuleBaseNameW (in: hProcess=0x2f8, hModule=0x310000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="unlikexpc.exe") returned 0xd [0095.264] CoTaskMemFree (pv=0x5d1c28) [0095.265] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.265] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x310000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\unlikexpc.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\unlikexpc.exe")) returned 0x33 [0095.265] CoTaskMemFree (pv=0x5d1c28) [0095.265] GetModuleInformation (in: hProcess=0x2f8, hModule=0x77ab0000, lpmodinfo=0x21c2c10, cb=0xc | out: lpmodinfo=0x21c2c10*(lpBaseOfDll=0x77ab0000, SizeOfImage=0x180000, EntryPoint=0x0)) returned 1 [0095.265] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.265] GetModuleBaseNameW (in: hProcess=0x2f8, hModule=0x77ab0000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="ntdll.dll") returned 0x9 [0095.265] CoTaskMemFree (pv=0x5d1c28) [0095.265] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.265] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x77ab0000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll")) returned 0x1d [0095.265] CoTaskMemFree (pv=0x5d1c28) [0095.265] GetModuleInformation (in: hProcess=0x2f8, hModule=0x754b0000, lpmodinfo=0x21c4d14, cb=0xc | out: lpmodinfo=0x21c4d14*(lpBaseOfDll=0x754b0000, SizeOfImage=0x4a000, EntryPoint=0x754b2e54)) returned 1 [0095.266] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.266] GetModuleBaseNameW (in: hProcess=0x2f8, hModule=0x754b0000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="MSCOREE.DLL") returned 0xb [0095.266] CoTaskMemFree (pv=0x5d1c28) [0095.266] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.266] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x754b0000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\MSCOREE.DLL" (normalized: "c:\\windows\\system32\\mscoree.dll")) returned 0x1f [0095.266] CoTaskMemFree (pv=0x5d1c28) [0095.266] GetModuleInformation (in: hProcess=0x2f8, hModule=0x757c0000, lpmodinfo=0x21c6e20, cb=0xc | out: lpmodinfo=0x21c6e20*(lpBaseOfDll=0x757c0000, SizeOfImage=0x110000, EntryPoint=0x757d32d3)) returned 1 [0095.266] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.266] GetModuleBaseNameW (in: hProcess=0x2f8, hModule=0x757c0000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="KERNEL32.dll") returned 0xc [0095.267] CoTaskMemFree (pv=0x5d1c28) [0095.267] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.267] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x757c0000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\KERNEL32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll")) returned 0x20 [0095.267] CoTaskMemFree (pv=0x5d1c28) [0095.267] GetModuleInformation (in: hProcess=0x2f8, hModule=0x76260000, lpmodinfo=0x21c8f34, cb=0xc | out: lpmodinfo=0x21c8f34*(lpBaseOfDll=0x76260000, SizeOfImage=0x46000, EntryPoint=0x76267478)) returned 1 [0095.267] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.267] GetModuleBaseNameW (in: hProcess=0x2f8, hModule=0x76260000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="KERNELBASE.dll") returned 0xe [0095.267] CoTaskMemFree (pv=0x5d1c28) [0095.267] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.267] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x76260000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\KERNELBASE.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll")) returned 0x22 [0095.268] CoTaskMemFree (pv=0x5d1c28) [0095.268] GetModuleInformation (in: hProcess=0x2f8, hModule=0x75720000, lpmodinfo=0x21cb07c, cb=0xc | out: lpmodinfo=0x21cb07c*(lpBaseOfDll=0x75720000, SizeOfImage=0xa0000, EntryPoint=0x757349e5)) returned 1 [0095.268] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.268] GetModuleBaseNameW (in: hProcess=0x2f8, hModule=0x75720000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="ADVAPI32.dll") returned 0xc [0095.268] CoTaskMemFree (pv=0x5d1c28) [0095.268] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.268] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x75720000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\ADVAPI32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll")) returned 0x20 [0095.268] CoTaskMemFree (pv=0x5d1c28) [0095.268] GetModuleInformation (in: hProcess=0x2f8, hModule=0x75fe0000, lpmodinfo=0x21cd190, cb=0xc | out: lpmodinfo=0x21cd190*(lpBaseOfDll=0x75fe0000, SizeOfImage=0xac000, EntryPoint=0x75fea472)) returned 1 [0095.269] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.269] GetModuleBaseNameW (in: hProcess=0x2f8, hModule=0x75fe0000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="msvcrt.dll") returned 0xa [0095.269] CoTaskMemFree (pv=0x5d1c28) [0095.269] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.269] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x75fe0000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll")) returned 0x1e [0095.269] CoTaskMemFree (pv=0x5d1c28) [0095.269] GetModuleInformation (in: hProcess=0x2f8, hModule=0x761b0000, lpmodinfo=0x21cf29c, cb=0xc | out: lpmodinfo=0x21cf29c*(lpBaseOfDll=0x761b0000, SizeOfImage=0x19000, EntryPoint=0x761b4975)) returned 1 [0095.269] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.270] GetModuleBaseNameW (in: hProcess=0x2f8, hModule=0x761b0000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="sechost.dll") returned 0xb [0095.270] CoTaskMemFree (pv=0x5d1c28) [0095.270] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.270] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x761b0000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll")) returned 0x1f [0095.270] CoTaskMemFree (pv=0x5d1c28) [0095.270] GetModuleInformation (in: hProcess=0x2f8, hModule=0x76090000, lpmodinfo=0x21d13a8, cb=0xc | out: lpmodinfo=0x21d13a8*(lpBaseOfDll=0x76090000, SizeOfImage=0xf0000, EntryPoint=0x760a0569)) returned 1 [0095.270] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.270] GetModuleBaseNameW (in: hProcess=0x2f8, hModule=0x76090000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="RPCRT4.dll") returned 0xa [0095.271] CoTaskMemFree (pv=0x5d1c28) [0095.271] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.271] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x76090000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\RPCRT4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll")) returned 0x1e [0095.271] CoTaskMemFree (pv=0x5d1c28) [0095.271] GetModuleInformation (in: hProcess=0x2f8, hModule=0x75610000, lpmodinfo=0x21d3500, cb=0xc | out: lpmodinfo=0x21d3500*(lpBaseOfDll=0x75610000, SizeOfImage=0x60000, EntryPoint=0x7562a3b3)) returned 1 [0095.271] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.271] GetModuleBaseNameW (in: hProcess=0x2f8, hModule=0x75610000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="SspiCli.dll") returned 0xb [0095.272] CoTaskMemFree (pv=0x5d1c28) [0095.272] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.272] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x75610000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\SspiCli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll")) returned 0x1f [0095.273] CoTaskMemFree (pv=0x5d1c28) [0095.273] GetModuleInformation (in: hProcess=0x2f8, hModule=0x75600000, lpmodinfo=0x21d560c, cb=0xc | out: lpmodinfo=0x21d560c*(lpBaseOfDll=0x75600000, SizeOfImage=0xc000, EntryPoint=0x756010e1)) returned 1 [0095.273] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.273] GetModuleBaseNameW (in: hProcess=0x2f8, hModule=0x75600000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="CRYPTBASE.dll") returned 0xd [0095.273] CoTaskMemFree (pv=0x5d1c28) [0095.274] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.274] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x75600000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\CRYPTBASE.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll")) returned 0x21 [0095.274] CoTaskMemFree (pv=0x5d1c28) [0095.274] GetModuleInformation (in: hProcess=0x2f8, hModule=0x75430000, lpmodinfo=0x21d7720, cb=0xc | out: lpmodinfo=0x21d7720*(lpBaseOfDll=0x75430000, SizeOfImage=0x78000, EntryPoint=0x7543f7ba)) returned 1 [0095.274] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.274] GetModuleBaseNameW (in: hProcess=0x2f8, hModule=0x75430000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="mscoreei.dll") returned 0xc [0095.275] CoTaskMemFree (pv=0x5d1c28) [0095.275] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.275] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x75430000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscoreei.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\mscoreei.dll")) returned 0x3a [0095.275] CoTaskMemFree (pv=0x5d1c28) [0095.275] GetModuleInformation (in: hProcess=0x2f8, hModule=0x761d0000, lpmodinfo=0x21d9868, cb=0xc | out: lpmodinfo=0x21d9868*(lpBaseOfDll=0x761d0000, SizeOfImage=0x57000, EntryPoint=0x761e9ba6)) returned 1 [0095.275] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.275] GetModuleBaseNameW (in: hProcess=0x2f8, hModule=0x761d0000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="SHLWAPI.dll") returned 0xb [0095.276] CoTaskMemFree (pv=0x5d1c28) [0095.276] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.276] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x761d0000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\SHLWAPI.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll")) returned 0x1f [0095.276] CoTaskMemFree (pv=0x5d1c28) [0095.276] GetModuleInformation (in: hProcess=0x2f8, hModule=0x766d0000, lpmodinfo=0x21db974, cb=0xc | out: lpmodinfo=0x21db974*(lpBaseOfDll=0x766d0000, SizeOfImage=0x90000, EntryPoint=0x766e6343)) returned 1 [0095.276] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.276] GetModuleBaseNameW (in: hProcess=0x2f8, hModule=0x766d0000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="GDI32.dll") returned 0x9 [0095.277] CoTaskMemFree (pv=0x5d1c28) [0095.277] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.277] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x766d0000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\GDI32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll")) returned 0x1d [0095.277] CoTaskMemFree (pv=0x5d1c28) [0095.277] GetModuleInformation (in: hProcess=0x2f8, hModule=0x775b0000, lpmodinfo=0x21dda78, cb=0xc | out: lpmodinfo=0x21dda78*(lpBaseOfDll=0x775b0000, SizeOfImage=0x100000, EntryPoint=0x775cb6ed)) returned 1 [0095.278] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.278] GetModuleBaseNameW (in: hProcess=0x2f8, hModule=0x775b0000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="USER32.dll") returned 0xa [0095.278] CoTaskMemFree (pv=0x5d1c28) [0095.278] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.278] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x775b0000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\USER32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll")) returned 0x1e [0095.278] CoTaskMemFree (pv=0x5d1c28) [0095.278] GetModuleInformation (in: hProcess=0x2f8, hModule=0x75a70000, lpmodinfo=0x21dfb84, cb=0xc | out: lpmodinfo=0x21dfb84*(lpBaseOfDll=0x75a70000, SizeOfImage=0xa000, EntryPoint=0x75a736a0)) returned 1 [0095.279] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.279] GetModuleBaseNameW (in: hProcess=0x2f8, hModule=0x75a70000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="LPK.dll") returned 0x7 [0095.279] CoTaskMemFree (pv=0x5d1c28) [0095.279] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.279] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x75a70000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\LPK.dll" (normalized: "c:\\windows\\syswow64\\lpk.dll")) returned 0x1b [0095.280] CoTaskMemFree (pv=0x5d1c28) [0095.280] GetModuleInformation (in: hProcess=0x2f8, hModule=0x758d0000, lpmodinfo=0x21e1c80, cb=0xc | out: lpmodinfo=0x21e1c80*(lpBaseOfDll=0x758d0000, SizeOfImage=0x9d000, EntryPoint=0x75903fd7)) returned 1 [0095.280] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.280] GetModuleBaseNameW (in: hProcess=0x2f8, hModule=0x758d0000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="USP10.dll") returned 0x9 [0095.280] CoTaskMemFree (pv=0x5d1c28) [0095.280] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.280] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x758d0000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\USP10.dll" (normalized: "c:\\windows\\syswow64\\usp10.dll")) returned 0x1d [0095.281] CoTaskMemFree (pv=0x5d1c28) [0095.281] GetModuleInformation (in: hProcess=0x2f8, hModule=0x75f80000, lpmodinfo=0x21e3e10, cb=0xc | out: lpmodinfo=0x21e3e10*(lpBaseOfDll=0x75f80000, SizeOfImage=0x60000, EntryPoint=0x75f9158f)) returned 1 [0095.281] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.281] GetModuleBaseNameW (in: hProcess=0x2f8, hModule=0x75f80000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="IMM32.DLL") returned 0x9 [0095.281] CoTaskMemFree (pv=0x5d1c28) [0095.281] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.281] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x75f80000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\system32\\IMM32.DLL" (normalized: "c:\\windows\\system32\\imm32.dll")) returned 0x1d [0095.282] CoTaskMemFree (pv=0x5d1c28) [0095.282] GetModuleInformation (in: hProcess=0x2f8, hModule=0x75ea0000, lpmodinfo=0x21e5f14, cb=0xc | out: lpmodinfo=0x21e5f14*(lpBaseOfDll=0x75ea0000, SizeOfImage=0xcc000, EntryPoint=0x75ea168b)) returned 1 [0095.282] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.282] GetModuleBaseNameW (in: hProcess=0x2f8, hModule=0x75ea0000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="MSCTF.dll") returned 0x9 [0095.282] CoTaskMemFree (pv=0x5d1c28) [0095.282] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.282] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x75ea0000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\MSCTF.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll")) returned 0x1d [0095.283] CoTaskMemFree (pv=0x5d1c28) [0095.283] GetModuleInformation (in: hProcess=0x2f8, hModule=0x75420000, lpmodinfo=0x21e8018, cb=0xc | out: lpmodinfo=0x21e8018*(lpBaseOfDll=0x75420000, SizeOfImage=0x9000, EntryPoint=0x75421220)) returned 1 [0095.283] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.283] GetModuleBaseNameW (in: hProcess=0x2f8, hModule=0x75420000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="VERSION.dll") returned 0xb [0095.283] CoTaskMemFree (pv=0x5d1c28) [0095.283] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.283] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x75420000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\system32\\VERSION.dll" (normalized: "c:\\windows\\system32\\version.dll")) returned 0x1f [0095.284] CoTaskMemFree (pv=0x5d1c28) [0095.284] GetModuleInformation (in: hProcess=0x2f8, hModule=0x74890000, lpmodinfo=0x21ea124, cb=0xc | out: lpmodinfo=0x21ea124*(lpBaseOfDll=0x74890000, SizeOfImage=0x6a8000, EntryPoint=0x749d7040)) returned 1 [0095.284] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.284] GetModuleBaseNameW (in: hProcess=0x2f8, hModule=0x74890000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="clr.dll") returned 0x7 [0095.285] CoTaskMemFree (pv=0x5d1c28) [0095.285] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.285] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x74890000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\clr.dll")) returned 0x35 [0095.285] CoTaskMemFree (pv=0x5d1c28) [0095.285] GetModuleInformation (in: hProcess=0x2f8, hModule=0x75320000, lpmodinfo=0x21ec254, cb=0xc | out: lpmodinfo=0x21ec254*(lpBaseOfDll=0x75320000, SizeOfImage=0xf5000, EntryPoint=0x75374160)) returned 1 [0095.286] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.286] GetModuleBaseNameW (in: hProcess=0x2f8, hModule=0x75320000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="MSVCR120_CLR0400.dll") returned 0x14 [0095.286] CoTaskMemFree (pv=0x5d1c28) [0095.286] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.286] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x75320000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\system32\\MSVCR120_CLR0400.dll" (normalized: "c:\\windows\\system32\\msvcr120_clr0400.dll")) returned 0x28 [0095.287] CoTaskMemFree (pv=0x5d1c28) [0095.287] GetModuleInformation (in: hProcess=0x2f8, hModule=0x72440000, lpmodinfo=0x21ee388, cb=0xc | out: lpmodinfo=0x21ee388*(lpBaseOfDll=0x72440000, SizeOfImage=0x122b000, EntryPoint=0x0)) returned 1 [0095.287] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.287] GetModuleBaseNameW (in: hProcess=0x2f8, hModule=0x72440000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="mscorlib.ni.dll") returned 0xf [0095.288] CoTaskMemFree (pv=0x5d1c28) [0095.288] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.288] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x72440000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\b7a12c4c0032847fcc6b9c710460456f\\mscorlib.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\mscorlib\\b7a12c4c0032847fcc6b9c710460456f\\mscorlib.ni.dll")) returned 0x68 [0095.288] CoTaskMemFree (pv=0x5d1c28) [0095.288] GetModuleInformation (in: hProcess=0x2f8, hModule=0x764e0000, lpmodinfo=0x21f0530, cb=0xc | out: lpmodinfo=0x21f0530*(lpBaseOfDll=0x764e0000, SizeOfImage=0x15c000, EntryPoint=0x7652ba3d)) returned 1 [0095.289] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.289] GetModuleBaseNameW (in: hProcess=0x2f8, hModule=0x764e0000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="ole32.dll") returned 0x9 [0095.289] CoTaskMemFree (pv=0x5d1c28) [0095.289] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.289] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x764e0000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll")) returned 0x1d [0095.289] CoTaskMemFree (pv=0x5d1c28) [0095.289] GetModuleInformation (in: hProcess=0x2f8, hModule=0x74f60000, lpmodinfo=0x21f2634, cb=0xc | out: lpmodinfo=0x21f2634*(lpBaseOfDll=0x74f60000, SizeOfImage=0x80000, EntryPoint=0x74f737c9)) returned 1 [0095.290] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.290] GetModuleBaseNameW (in: hProcess=0x2f8, hModule=0x74f60000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="uxtheme.dll") returned 0xb [0095.290] CoTaskMemFree (pv=0x5d1c28) [0095.290] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.290] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x74f60000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\system32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll")) returned 0x1f [0095.291] CoTaskMemFree (pv=0x5d1c28) [0095.291] GetModuleInformation (in: hProcess=0x2f8, hModule=0x752a0000, lpmodinfo=0x21f4740, cb=0xc | out: lpmodinfo=0x21f4740*(lpBaseOfDll=0x752a0000, SizeOfImage=0x7d000, EntryPoint=0x752a1140)) returned 1 [0095.291] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.291] GetModuleBaseNameW (in: hProcess=0x2f8, hModule=0x752a0000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="clrjit.dll") returned 0xa [0095.292] CoTaskMemFree (pv=0x5d1c28) [0095.292] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.292] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x752a0000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clrjit.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\clrjit.dll")) returned 0x38 [0095.292] CoTaskMemFree (pv=0x5d1c28) [0095.292] GetModuleInformation (in: hProcess=0x2f8, hModule=0x762b0000, lpmodinfo=0x21f6880, cb=0xc | out: lpmodinfo=0x21f6880*(lpBaseOfDll=0x762b0000, SizeOfImage=0x8f000, EntryPoint=0x762b3fb1)) returned 1 [0095.293] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.293] GetModuleBaseNameW (in: hProcess=0x2f8, hModule=0x762b0000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="OLEAUT32.dll") returned 0xc [0095.293] CoTaskMemFree (pv=0x5d1c28) [0095.293] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.293] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x762b0000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\OLEAUT32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll")) returned 0x20 [0095.294] CoTaskMemFree (pv=0x5d1c28) [0095.294] GetModuleInformation (in: hProcess=0x2f8, hModule=0x736d0000, lpmodinfo=0x21f8994, cb=0xc | out: lpmodinfo=0x21f8994*(lpBaseOfDll=0x736d0000, SizeOfImage=0x9ad000, EntryPoint=0x0)) returned 1 [0095.294] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.294] GetModuleBaseNameW (in: hProcess=0x2f8, hModule=0x736d0000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="System.ni.dll") returned 0xd [0095.294] CoTaskMemFree (pv=0x5d1c28) [0095.294] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.294] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x736d0000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System\\500ffa28b327e171fe664023003e947e\\System.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system\\500ffa28b327e171fe664023003e947e\\system.ni.dll")) returned 0x64 [0095.295] CoTaskMemFree (pv=0x5d1c28) [0095.295] GetModuleInformation (in: hProcess=0x2f8, hModule=0x71d20000, lpmodinfo=0x21fab30, cb=0xc | out: lpmodinfo=0x21fab30*(lpBaseOfDll=0x71d20000, SizeOfImage=0x716000, EntryPoint=0x0)) returned 1 [0095.295] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.295] GetModuleBaseNameW (in: hProcess=0x2f8, hModule=0x71d20000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="System.Core.ni.dll") returned 0x12 [0095.296] CoTaskMemFree (pv=0x5d1c28) [0095.296] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.296] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x71d20000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Core\\386fde9190d499d6645df8b90eb76242\\System.Core.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.core\\386fde9190d499d6645df8b90eb76242\\system.core.ni.dll")) returned 0x6e [0095.296] CoTaskMemFree (pv=0x5d1c28) [0095.296] GetModuleInformation (in: hProcess=0x2f8, hModule=0x750d0000, lpmodinfo=0x21fccec, cb=0xc | out: lpmodinfo=0x21fccec*(lpBaseOfDll=0x750d0000, SizeOfImage=0x1cb000, EntryPoint=0x0)) returned 1 [0095.297] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.297] GetModuleBaseNameW (in: hProcess=0x2f8, hModule=0x750d0000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="Microsoft.VisualBasic.ni.dll") returned 0x1c [0095.297] CoTaskMemFree (pv=0x5d1c28) [0095.297] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.297] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x750d0000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Microsoft.V9921e851#\\cfbddeb6e93e8f421b92229b20e51233\\Microsoft.VisualBasic.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\microsoft.v9921e851#\\cfbddeb6e93e8f421b92229b20e51233\\microsoft.visualbasic.ni.dll")) returned 0x81 [0095.298] CoTaskMemFree (pv=0x5d1c28) [0095.298] GetModuleInformation (in: hProcess=0x2f8, hModule=0x750b0000, lpmodinfo=0x21feee0, cb=0xc | out: lpmodinfo=0x21feee0*(lpBaseOfDll=0x750b0000, SizeOfImage=0x13000, EntryPoint=0x750b18f0)) returned 1 [0095.298] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.298] GetModuleBaseNameW (in: hProcess=0x2f8, hModule=0x750b0000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="nlssorting.dll") returned 0xe [0095.299] CoTaskMemFree (pv=0x5d1c28) [0095.299] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.299] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x750b0000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\nlssorting.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\nlssorting.dll")) returned 0x3c [0095.299] CoTaskMemFree (pv=0x5d1c28) [0095.299] GetModuleInformation (in: hProcess=0x2f8, hModule=0x74870000, lpmodinfo=0x2201030, cb=0xc | out: lpmodinfo=0x2201030*(lpBaseOfDll=0x74870000, SizeOfImage=0x16000, EntryPoint=0x74872dc3)) returned 1 [0095.300] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.300] GetModuleBaseNameW (in: hProcess=0x2f8, hModule=0x74870000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="CRYPTSP.dll") returned 0xb [0095.300] CoTaskMemFree (pv=0x5d1c28) [0095.300] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.300] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x74870000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\system32\\CRYPTSP.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll")) returned 0x1f [0095.301] CoTaskMemFree (pv=0x5d1c28) [0095.301] GetModuleInformation (in: hProcess=0x2f8, hModule=0x74830000, lpmodinfo=0x220313c, cb=0xc | out: lpmodinfo=0x220313c*(lpBaseOfDll=0x74830000, SizeOfImage=0x3b000, EntryPoint=0x7483128d)) returned 1 [0095.301] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.301] GetModuleBaseNameW (in: hProcess=0x2f8, hModule=0x74830000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="rsaenh.dll") returned 0xa [0095.302] CoTaskMemFree (pv=0x5d1c28) [0095.302] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.302] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x74830000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\system32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll")) returned 0x1e [0095.303] CoTaskMemFree (pv=0x5d1c28) [0095.303] GetModuleInformation (in: hProcess=0x2f8, hModule=0x75a60000, lpmodinfo=0x2205354, cb=0xc | out: lpmodinfo=0x2205354*(lpBaseOfDll=0x75a60000, SizeOfImage=0x5000, EntryPoint=0x75a61438)) returned 1 [0095.303] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.303] GetModuleBaseNameW (in: hProcess=0x2f8, hModule=0x75a60000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="psapi.dll") returned 0x9 [0095.304] CoTaskMemFree (pv=0x5d1c28) [0095.304] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.304] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x75a60000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\psapi.dll" (normalized: "c:\\windows\\syswow64\\psapi.dll")) returned 0x1d [0095.304] CoTaskMemFree (pv=0x5d1c28) [0095.304] GetModuleInformation (in: hProcess=0x2f8, hModule=0x746a0000, lpmodinfo=0x2207458, cb=0xc | out: lpmodinfo=0x2207458*(lpBaseOfDll=0x746a0000, SizeOfImage=0x18d000, EntryPoint=0x0)) returned 1 [0095.305] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.305] GetModuleBaseNameW (in: hProcess=0x2f8, hModule=0x746a0000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="System.Drawing.ni.dll") returned 0x15 [0095.305] CoTaskMemFree (pv=0x5d1c28) [0095.305] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.305] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x746a0000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Drawing\\553c0312fdf5a5449f3649f0515e70fb\\System.Drawing.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.drawing\\553c0312fdf5a5449f3649f0515e70fb\\system.drawing.ni.dll")) returned 0x74 [0095.306] CoTaskMemFree (pv=0x5d1c28) [0095.306] GetModuleInformation (in: hProcess=0x2f8, hModule=0x710c0000, lpmodinfo=0x2209624, cb=0xc | out: lpmodinfo=0x2209624*(lpBaseOfDll=0x710c0000, SizeOfImage=0xc58000, EntryPoint=0x0)) returned 1 [0095.306] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.306] GetModuleBaseNameW (in: hProcess=0x2f8, hModule=0x710c0000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="System.Windows.Forms.ni.dll") returned 0x1b [0095.307] CoTaskMemFree (pv=0x5d1c28) [0095.307] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.307] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x710c0000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Windows.Forms\\7a6894982f35a1d75ec73d447c583da2\\System.Windows.Forms.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.windows.forms\\7a6894982f35a1d75ec73d447c583da2\\system.windows.forms.ni.dll")) returned 0x80 [0095.308] CoTaskMemFree (pv=0x5d1c28) [0095.308] CloseHandle (hObject=0x2f8) returned 1 [0095.325] GetCurrentProcessId () returned 0x9f8 [0095.325] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x9f8) returned 0x2f8 [0095.325] EnumProcessModules (in: hProcess=0x2f8, lphModule=0x22fce98, cb=0x100, lpcbNeeded=0x4990c0 | out: lphModule=0x22fce98, lpcbNeeded=0x4990c0) returned 1 [0095.326] GetModuleInformation (in: hProcess=0x2f8, hModule=0x310000, lpmodinfo=0x22fcfd8, cb=0xc | out: lpmodinfo=0x22fcfd8*(lpBaseOfDll=0x310000, SizeOfImage=0x3e000, EntryPoint=0x3479ce)) returned 1 [0095.326] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.326] GetModuleBaseNameW (in: hProcess=0x2f8, hModule=0x310000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="unlikexpc.exe") returned 0xd [0095.326] CoTaskMemFree (pv=0x5d1c28) [0095.326] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.326] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x310000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\unlikexpc.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\unlikexpc.exe")) returned 0x33 [0095.326] CoTaskMemFree (pv=0x5d1c28) [0095.326] GetModuleInformation (in: hProcess=0x2f8, hModule=0x77ab0000, lpmodinfo=0x22ff12c, cb=0xc | out: lpmodinfo=0x22ff12c*(lpBaseOfDll=0x77ab0000, SizeOfImage=0x180000, EntryPoint=0x0)) returned 1 [0095.326] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.326] GetModuleBaseNameW (in: hProcess=0x2f8, hModule=0x77ab0000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="ntdll.dll") returned 0x9 [0095.326] CoTaskMemFree (pv=0x5d1c28) [0095.326] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.326] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x77ab0000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll")) returned 0x1d [0095.327] CoTaskMemFree (pv=0x5d1c28) [0095.327] GetModuleInformation (in: hProcess=0x2f8, hModule=0x754b0000, lpmodinfo=0x2301230, cb=0xc | out: lpmodinfo=0x2301230*(lpBaseOfDll=0x754b0000, SizeOfImage=0x4a000, EntryPoint=0x754b2e54)) returned 1 [0095.327] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.327] GetModuleBaseNameW (in: hProcess=0x2f8, hModule=0x754b0000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="MSCOREE.DLL") returned 0xb [0095.327] CoTaskMemFree (pv=0x5d1c28) [0095.327] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.327] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x754b0000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\MSCOREE.DLL" (normalized: "c:\\windows\\system32\\mscoree.dll")) returned 0x1f [0095.327] CoTaskMemFree (pv=0x5d1c28) [0095.327] GetModuleInformation (in: hProcess=0x2f8, hModule=0x757c0000, lpmodinfo=0x230333c, cb=0xc | out: lpmodinfo=0x230333c*(lpBaseOfDll=0x757c0000, SizeOfImage=0x110000, EntryPoint=0x757d32d3)) returned 1 [0095.327] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.327] GetModuleBaseNameW (in: hProcess=0x2f8, hModule=0x757c0000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="KERNEL32.dll") returned 0xc [0095.327] CoTaskMemFree (pv=0x5d1c28) [0095.327] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.328] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x757c0000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\KERNEL32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll")) returned 0x20 [0095.328] CoTaskMemFree (pv=0x5d1c28) [0095.328] GetModuleInformation (in: hProcess=0x2f8, hModule=0x76260000, lpmodinfo=0x2305450, cb=0xc | out: lpmodinfo=0x2305450*(lpBaseOfDll=0x76260000, SizeOfImage=0x46000, EntryPoint=0x76267478)) returned 1 [0095.328] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.328] GetModuleBaseNameW (in: hProcess=0x2f8, hModule=0x76260000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="KERNELBASE.dll") returned 0xe [0095.328] CoTaskMemFree (pv=0x5d1c28) [0095.328] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.328] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x76260000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\KERNELBASE.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll")) returned 0x22 [0095.328] CoTaskMemFree (pv=0x5d1c28) [0095.328] GetModuleInformation (in: hProcess=0x2f8, hModule=0x75720000, lpmodinfo=0x2307598, cb=0xc | out: lpmodinfo=0x2307598*(lpBaseOfDll=0x75720000, SizeOfImage=0xa0000, EntryPoint=0x757349e5)) returned 1 [0095.328] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.328] GetModuleBaseNameW (in: hProcess=0x2f8, hModule=0x75720000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="ADVAPI32.dll") returned 0xc [0095.329] CoTaskMemFree (pv=0x5d1c28) [0095.329] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.329] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x75720000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\ADVAPI32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll")) returned 0x20 [0095.329] CoTaskMemFree (pv=0x5d1c28) [0095.329] GetModuleInformation (in: hProcess=0x2f8, hModule=0x75fe0000, lpmodinfo=0x23096ac, cb=0xc | out: lpmodinfo=0x23096ac*(lpBaseOfDll=0x75fe0000, SizeOfImage=0xac000, EntryPoint=0x75fea472)) returned 1 [0095.329] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.329] GetModuleBaseNameW (in: hProcess=0x2f8, hModule=0x75fe0000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="msvcrt.dll") returned 0xa [0095.329] CoTaskMemFree (pv=0x5d1c28) [0095.329] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.329] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x75fe0000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll")) returned 0x1e [0095.330] CoTaskMemFree (pv=0x5d1c28) [0095.330] GetModuleInformation (in: hProcess=0x2f8, hModule=0x761b0000, lpmodinfo=0x230b7b8, cb=0xc | out: lpmodinfo=0x230b7b8*(lpBaseOfDll=0x761b0000, SizeOfImage=0x19000, EntryPoint=0x761b4975)) returned 1 [0095.330] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.330] GetModuleBaseNameW (in: hProcess=0x2f8, hModule=0x761b0000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="sechost.dll") returned 0xb [0095.330] CoTaskMemFree (pv=0x5d1c28) [0095.330] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.330] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x761b0000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll")) returned 0x1f [0095.330] CoTaskMemFree (pv=0x5d1c28) [0095.330] GetModuleInformation (in: hProcess=0x2f8, hModule=0x76090000, lpmodinfo=0x230d8c4, cb=0xc | out: lpmodinfo=0x230d8c4*(lpBaseOfDll=0x76090000, SizeOfImage=0xf0000, EntryPoint=0x760a0569)) returned 1 [0095.331] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.331] GetModuleBaseNameW (in: hProcess=0x2f8, hModule=0x76090000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="RPCRT4.dll") returned 0xa [0095.331] CoTaskMemFree (pv=0x5d1c28) [0095.331] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.331] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x76090000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\RPCRT4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll")) returned 0x1e [0095.331] CoTaskMemFree (pv=0x5d1c28) [0095.331] GetModuleInformation (in: hProcess=0x2f8, hModule=0x75610000, lpmodinfo=0x230fa1c, cb=0xc | out: lpmodinfo=0x230fa1c*(lpBaseOfDll=0x75610000, SizeOfImage=0x60000, EntryPoint=0x7562a3b3)) returned 1 [0095.331] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.331] GetModuleBaseNameW (in: hProcess=0x2f8, hModule=0x75610000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="SspiCli.dll") returned 0xb [0095.332] CoTaskMemFree (pv=0x5d1c28) [0095.332] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.332] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x75610000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\SspiCli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll")) returned 0x1f [0095.332] CoTaskMemFree (pv=0x5d1c28) [0095.332] GetModuleInformation (in: hProcess=0x2f8, hModule=0x75600000, lpmodinfo=0x2311b28, cb=0xc | out: lpmodinfo=0x2311b28*(lpBaseOfDll=0x75600000, SizeOfImage=0xc000, EntryPoint=0x756010e1)) returned 1 [0095.332] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.332] GetModuleBaseNameW (in: hProcess=0x2f8, hModule=0x75600000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="CRYPTBASE.dll") returned 0xd [0095.333] CoTaskMemFree (pv=0x5d1c28) [0095.333] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.333] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x75600000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\CRYPTBASE.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll")) returned 0x21 [0095.333] CoTaskMemFree (pv=0x5d1c28) [0095.333] GetModuleInformation (in: hProcess=0x2f8, hModule=0x75430000, lpmodinfo=0x2313c3c, cb=0xc | out: lpmodinfo=0x2313c3c*(lpBaseOfDll=0x75430000, SizeOfImage=0x78000, EntryPoint=0x7543f7ba)) returned 1 [0095.333] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.333] GetModuleBaseNameW (in: hProcess=0x2f8, hModule=0x75430000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="mscoreei.dll") returned 0xc [0095.334] CoTaskMemFree (pv=0x5d1c28) [0095.334] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.334] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x75430000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscoreei.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\mscoreei.dll")) returned 0x3a [0095.334] CoTaskMemFree (pv=0x5d1c28) [0095.334] GetModuleInformation (in: hProcess=0x2f8, hModule=0x761d0000, lpmodinfo=0x2315d84, cb=0xc | out: lpmodinfo=0x2315d84*(lpBaseOfDll=0x761d0000, SizeOfImage=0x57000, EntryPoint=0x761e9ba6)) returned 1 [0095.335] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.335] GetModuleBaseNameW (in: hProcess=0x2f8, hModule=0x761d0000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="SHLWAPI.dll") returned 0xb [0095.335] CoTaskMemFree (pv=0x5d1c28) [0095.335] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.335] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x761d0000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\SHLWAPI.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll")) returned 0x1f [0095.335] CoTaskMemFree (pv=0x5d1c28) [0095.335] GetModuleInformation (in: hProcess=0x2f8, hModule=0x766d0000, lpmodinfo=0x2317e90, cb=0xc | out: lpmodinfo=0x2317e90*(lpBaseOfDll=0x766d0000, SizeOfImage=0x90000, EntryPoint=0x766e6343)) returned 1 [0095.336] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.336] GetModuleBaseNameW (in: hProcess=0x2f8, hModule=0x766d0000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="GDI32.dll") returned 0x9 [0095.336] CoTaskMemFree (pv=0x5d1c28) [0095.336] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.336] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x766d0000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\GDI32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll")) returned 0x1d [0095.336] CoTaskMemFree (pv=0x5d1c28) [0095.336] GetModuleInformation (in: hProcess=0x2f8, hModule=0x775b0000, lpmodinfo=0x2319f94, cb=0xc | out: lpmodinfo=0x2319f94*(lpBaseOfDll=0x775b0000, SizeOfImage=0x100000, EntryPoint=0x775cb6ed)) returned 1 [0095.337] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.337] GetModuleBaseNameW (in: hProcess=0x2f8, hModule=0x775b0000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="USER32.dll") returned 0xa [0095.337] CoTaskMemFree (pv=0x5d1c28) [0095.337] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.337] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x775b0000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\USER32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll")) returned 0x1e [0095.338] CoTaskMemFree (pv=0x5d1c28) [0095.338] GetModuleInformation (in: hProcess=0x2f8, hModule=0x75a70000, lpmodinfo=0x231c0a0, cb=0xc | out: lpmodinfo=0x231c0a0*(lpBaseOfDll=0x75a70000, SizeOfImage=0xa000, EntryPoint=0x75a736a0)) returned 1 [0095.338] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.338] GetModuleBaseNameW (in: hProcess=0x2f8, hModule=0x75a70000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="LPK.dll") returned 0x7 [0095.338] CoTaskMemFree (pv=0x5d1c28) [0095.338] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.338] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x75a70000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\LPK.dll" (normalized: "c:\\windows\\syswow64\\lpk.dll")) returned 0x1b [0095.339] CoTaskMemFree (pv=0x5d1c28) [0095.339] GetModuleInformation (in: hProcess=0x2f8, hModule=0x758d0000, lpmodinfo=0x231e19c, cb=0xc | out: lpmodinfo=0x231e19c*(lpBaseOfDll=0x758d0000, SizeOfImage=0x9d000, EntryPoint=0x75903fd7)) returned 1 [0095.339] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.339] GetModuleBaseNameW (in: hProcess=0x2f8, hModule=0x758d0000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="USP10.dll") returned 0x9 [0095.339] CoTaskMemFree (pv=0x5d1c28) [0095.339] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.339] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x758d0000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\USP10.dll" (normalized: "c:\\windows\\syswow64\\usp10.dll")) returned 0x1d [0095.340] CoTaskMemFree (pv=0x5d1c28) [0095.340] GetModuleInformation (in: hProcess=0x2f8, hModule=0x75f80000, lpmodinfo=0x232032c, cb=0xc | out: lpmodinfo=0x232032c*(lpBaseOfDll=0x75f80000, SizeOfImage=0x60000, EntryPoint=0x75f9158f)) returned 1 [0095.340] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.340] GetModuleBaseNameW (in: hProcess=0x2f8, hModule=0x75f80000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="IMM32.DLL") returned 0x9 [0095.341] CoTaskMemFree (pv=0x5d1c28) [0095.341] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.341] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x75f80000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\system32\\IMM32.DLL" (normalized: "c:\\windows\\system32\\imm32.dll")) returned 0x1d [0095.341] CoTaskMemFree (pv=0x5d1c28) [0095.341] GetModuleInformation (in: hProcess=0x2f8, hModule=0x75ea0000, lpmodinfo=0x2322430, cb=0xc | out: lpmodinfo=0x2322430*(lpBaseOfDll=0x75ea0000, SizeOfImage=0xcc000, EntryPoint=0x75ea168b)) returned 1 [0095.342] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.342] GetModuleBaseNameW (in: hProcess=0x2f8, hModule=0x75ea0000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="MSCTF.dll") returned 0x9 [0095.342] CoTaskMemFree (pv=0x5d1c28) [0095.342] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.342] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x75ea0000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\MSCTF.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll")) returned 0x1d [0095.342] CoTaskMemFree (pv=0x5d1c28) [0095.342] GetModuleInformation (in: hProcess=0x2f8, hModule=0x75420000, lpmodinfo=0x2324534, cb=0xc | out: lpmodinfo=0x2324534*(lpBaseOfDll=0x75420000, SizeOfImage=0x9000, EntryPoint=0x75421220)) returned 1 [0095.343] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.343] GetModuleBaseNameW (in: hProcess=0x2f8, hModule=0x75420000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="VERSION.dll") returned 0xb [0095.343] CoTaskMemFree (pv=0x5d1c28) [0095.343] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.343] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x75420000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\system32\\VERSION.dll" (normalized: "c:\\windows\\system32\\version.dll")) returned 0x1f [0095.344] CoTaskMemFree (pv=0x5d1c28) [0095.344] GetModuleInformation (in: hProcess=0x2f8, hModule=0x74890000, lpmodinfo=0x2326640, cb=0xc | out: lpmodinfo=0x2326640*(lpBaseOfDll=0x74890000, SizeOfImage=0x6a8000, EntryPoint=0x749d7040)) returned 1 [0095.344] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.344] GetModuleBaseNameW (in: hProcess=0x2f8, hModule=0x74890000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="clr.dll") returned 0x7 [0095.345] CoTaskMemFree (pv=0x5d1c28) [0095.345] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.345] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x74890000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\clr.dll")) returned 0x35 [0095.345] CoTaskMemFree (pv=0x5d1c28) [0095.345] GetModuleInformation (in: hProcess=0x2f8, hModule=0x75320000, lpmodinfo=0x2328770, cb=0xc | out: lpmodinfo=0x2328770*(lpBaseOfDll=0x75320000, SizeOfImage=0xf5000, EntryPoint=0x75374160)) returned 1 [0095.346] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.346] GetModuleBaseNameW (in: hProcess=0x2f8, hModule=0x75320000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="MSVCR120_CLR0400.dll") returned 0x14 [0095.346] CoTaskMemFree (pv=0x5d1c28) [0095.346] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.346] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x75320000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\system32\\MSVCR120_CLR0400.dll" (normalized: "c:\\windows\\system32\\msvcr120_clr0400.dll")) returned 0x28 [0095.347] CoTaskMemFree (pv=0x5d1c28) [0095.347] GetModuleInformation (in: hProcess=0x2f8, hModule=0x72440000, lpmodinfo=0x232a8a4, cb=0xc | out: lpmodinfo=0x232a8a4*(lpBaseOfDll=0x72440000, SizeOfImage=0x122b000, EntryPoint=0x0)) returned 1 [0095.347] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.347] GetModuleBaseNameW (in: hProcess=0x2f8, hModule=0x72440000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="mscorlib.ni.dll") returned 0xf [0095.347] CoTaskMemFree (pv=0x5d1c28) [0095.347] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.348] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x72440000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\b7a12c4c0032847fcc6b9c710460456f\\mscorlib.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\mscorlib\\b7a12c4c0032847fcc6b9c710460456f\\mscorlib.ni.dll")) returned 0x68 [0095.348] CoTaskMemFree (pv=0x5d1c28) [0095.348] GetModuleInformation (in: hProcess=0x2f8, hModule=0x764e0000, lpmodinfo=0x232ca4c, cb=0xc | out: lpmodinfo=0x232ca4c*(lpBaseOfDll=0x764e0000, SizeOfImage=0x15c000, EntryPoint=0x7652ba3d)) returned 1 [0095.348] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.348] GetModuleBaseNameW (in: hProcess=0x2f8, hModule=0x764e0000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="ole32.dll") returned 0x9 [0095.349] CoTaskMemFree (pv=0x5d1c28) [0095.349] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.349] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x764e0000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll")) returned 0x1d [0095.349] CoTaskMemFree (pv=0x5d1c28) [0095.349] GetModuleInformation (in: hProcess=0x2f8, hModule=0x74f60000, lpmodinfo=0x232eb50, cb=0xc | out: lpmodinfo=0x232eb50*(lpBaseOfDll=0x74f60000, SizeOfImage=0x80000, EntryPoint=0x74f737c9)) returned 1 [0095.350] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.350] GetModuleBaseNameW (in: hProcess=0x2f8, hModule=0x74f60000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="uxtheme.dll") returned 0xb [0095.350] CoTaskMemFree (pv=0x5d1c28) [0095.350] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.350] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x74f60000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\system32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll")) returned 0x1f [0095.351] CoTaskMemFree (pv=0x5d1c28) [0095.351] GetModuleInformation (in: hProcess=0x2f8, hModule=0x752a0000, lpmodinfo=0x2330c5c, cb=0xc | out: lpmodinfo=0x2330c5c*(lpBaseOfDll=0x752a0000, SizeOfImage=0x7d000, EntryPoint=0x752a1140)) returned 1 [0095.351] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.351] GetModuleBaseNameW (in: hProcess=0x2f8, hModule=0x752a0000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="clrjit.dll") returned 0xa [0095.352] CoTaskMemFree (pv=0x5d1c28) [0095.352] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.352] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x752a0000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clrjit.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\clrjit.dll")) returned 0x38 [0095.353] CoTaskMemFree (pv=0x5d1c28) [0095.353] GetModuleInformation (in: hProcess=0x2f8, hModule=0x762b0000, lpmodinfo=0x2332d9c, cb=0xc | out: lpmodinfo=0x2332d9c*(lpBaseOfDll=0x762b0000, SizeOfImage=0x8f000, EntryPoint=0x762b3fb1)) returned 1 [0095.353] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.353] GetModuleBaseNameW (in: hProcess=0x2f8, hModule=0x762b0000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="OLEAUT32.dll") returned 0xc [0095.354] CoTaskMemFree (pv=0x5d1c28) [0095.354] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.354] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x762b0000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\OLEAUT32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll")) returned 0x20 [0095.354] CoTaskMemFree (pv=0x5d1c28) [0095.354] GetModuleInformation (in: hProcess=0x2f8, hModule=0x736d0000, lpmodinfo=0x2334eb0, cb=0xc | out: lpmodinfo=0x2334eb0*(lpBaseOfDll=0x736d0000, SizeOfImage=0x9ad000, EntryPoint=0x0)) returned 1 [0095.355] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.355] GetModuleBaseNameW (in: hProcess=0x2f8, hModule=0x736d0000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="System.ni.dll") returned 0xd [0095.355] CoTaskMemFree (pv=0x5d1c28) [0095.355] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.355] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x736d0000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System\\500ffa28b327e171fe664023003e947e\\System.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system\\500ffa28b327e171fe664023003e947e\\system.ni.dll")) returned 0x64 [0095.356] CoTaskMemFree (pv=0x5d1c28) [0095.356] GetModuleInformation (in: hProcess=0x2f8, hModule=0x71d20000, lpmodinfo=0x233704c, cb=0xc | out: lpmodinfo=0x233704c*(lpBaseOfDll=0x71d20000, SizeOfImage=0x716000, EntryPoint=0x0)) returned 1 [0095.356] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.356] GetModuleBaseNameW (in: hProcess=0x2f8, hModule=0x71d20000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="System.Core.ni.dll") returned 0x12 [0095.357] CoTaskMemFree (pv=0x5d1c28) [0095.357] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.357] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x71d20000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Core\\386fde9190d499d6645df8b90eb76242\\System.Core.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.core\\386fde9190d499d6645df8b90eb76242\\system.core.ni.dll")) returned 0x6e [0095.358] CoTaskMemFree (pv=0x5d1c28) [0095.358] GetModuleInformation (in: hProcess=0x2f8, hModule=0x750d0000, lpmodinfo=0x2339208, cb=0xc | out: lpmodinfo=0x2339208*(lpBaseOfDll=0x750d0000, SizeOfImage=0x1cb000, EntryPoint=0x0)) returned 1 [0095.358] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.358] GetModuleBaseNameW (in: hProcess=0x2f8, hModule=0x750d0000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="Microsoft.VisualBasic.ni.dll") returned 0x1c [0095.359] CoTaskMemFree (pv=0x5d1c28) [0095.359] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.359] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x750d0000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Microsoft.V9921e851#\\cfbddeb6e93e8f421b92229b20e51233\\Microsoft.VisualBasic.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\microsoft.v9921e851#\\cfbddeb6e93e8f421b92229b20e51233\\microsoft.visualbasic.ni.dll")) returned 0x81 [0095.359] CoTaskMemFree (pv=0x5d1c28) [0095.359] GetModuleInformation (in: hProcess=0x2f8, hModule=0x750b0000, lpmodinfo=0x233b3fc, cb=0xc | out: lpmodinfo=0x233b3fc*(lpBaseOfDll=0x750b0000, SizeOfImage=0x13000, EntryPoint=0x750b18f0)) returned 1 [0095.360] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.360] GetModuleBaseNameW (in: hProcess=0x2f8, hModule=0x750b0000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="nlssorting.dll") returned 0xe [0095.360] CoTaskMemFree (pv=0x5d1c28) [0095.360] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.360] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x750b0000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\nlssorting.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\nlssorting.dll")) returned 0x3c [0095.361] CoTaskMemFree (pv=0x5d1c28) [0095.361] GetModuleInformation (in: hProcess=0x2f8, hModule=0x74870000, lpmodinfo=0x233d54c, cb=0xc | out: lpmodinfo=0x233d54c*(lpBaseOfDll=0x74870000, SizeOfImage=0x16000, EntryPoint=0x74872dc3)) returned 1 [0095.361] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.361] GetModuleBaseNameW (in: hProcess=0x2f8, hModule=0x74870000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="CRYPTSP.dll") returned 0xb [0095.362] CoTaskMemFree (pv=0x5d1c28) [0095.362] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.362] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x74870000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\system32\\CRYPTSP.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll")) returned 0x1f [0095.362] CoTaskMemFree (pv=0x5d1c28) [0095.362] GetModuleInformation (in: hProcess=0x2f8, hModule=0x74830000, lpmodinfo=0x233f658, cb=0xc | out: lpmodinfo=0x233f658*(lpBaseOfDll=0x74830000, SizeOfImage=0x3b000, EntryPoint=0x7483128d)) returned 1 [0095.363] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.363] GetModuleBaseNameW (in: hProcess=0x2f8, hModule=0x74830000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="rsaenh.dll") returned 0xa [0095.363] CoTaskMemFree (pv=0x5d1c28) [0095.363] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.363] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x74830000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\system32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll")) returned 0x1e [0095.364] CoTaskMemFree (pv=0x5d1c28) [0095.364] GetModuleInformation (in: hProcess=0x2f8, hModule=0x75a60000, lpmodinfo=0x2341870, cb=0xc | out: lpmodinfo=0x2341870*(lpBaseOfDll=0x75a60000, SizeOfImage=0x5000, EntryPoint=0x75a61438)) returned 1 [0095.364] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.364] GetModuleBaseNameW (in: hProcess=0x2f8, hModule=0x75a60000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="psapi.dll") returned 0x9 [0095.365] CoTaskMemFree (pv=0x5d1c28) [0095.365] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.365] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x75a60000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\psapi.dll" (normalized: "c:\\windows\\syswow64\\psapi.dll")) returned 0x1d [0095.365] CoTaskMemFree (pv=0x5d1c28) [0095.365] GetModuleInformation (in: hProcess=0x2f8, hModule=0x746a0000, lpmodinfo=0x2343974, cb=0xc | out: lpmodinfo=0x2343974*(lpBaseOfDll=0x746a0000, SizeOfImage=0x18d000, EntryPoint=0x0)) returned 1 [0095.366] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.366] GetModuleBaseNameW (in: hProcess=0x2f8, hModule=0x746a0000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="System.Drawing.ni.dll") returned 0x15 [0095.366] CoTaskMemFree (pv=0x5d1c28) [0095.366] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.366] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x746a0000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Drawing\\553c0312fdf5a5449f3649f0515e70fb\\System.Drawing.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.drawing\\553c0312fdf5a5449f3649f0515e70fb\\system.drawing.ni.dll")) returned 0x74 [0095.367] CoTaskMemFree (pv=0x5d1c28) [0095.367] GetModuleInformation (in: hProcess=0x2f8, hModule=0x710c0000, lpmodinfo=0x2345b40, cb=0xc | out: lpmodinfo=0x2345b40*(lpBaseOfDll=0x710c0000, SizeOfImage=0xc58000, EntryPoint=0x0)) returned 1 [0095.367] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.367] GetModuleBaseNameW (in: hProcess=0x2f8, hModule=0x710c0000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="System.Windows.Forms.ni.dll") returned 0x1b [0095.368] CoTaskMemFree (pv=0x5d1c28) [0095.368] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.368] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x710c0000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Windows.Forms\\7a6894982f35a1d75ec73d447c583da2\\System.Windows.Forms.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.windows.forms\\7a6894982f35a1d75ec73d447c583da2\\system.windows.forms.ni.dll")) returned 0x80 [0095.368] CoTaskMemFree (pv=0x5d1c28) [0095.368] CloseHandle (hObject=0x2f8) returned 1 [0095.376] GetCurrentProcessId () returned 0x9f8 [0095.376] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x9f8) returned 0x2f8 [0095.376] EnumProcessModules (in: hProcess=0x2f8, lphModule=0x21c7264, cb=0x100, lpcbNeeded=0x4990c0 | out: lphModule=0x21c7264, lpcbNeeded=0x4990c0) returned 1 [0095.376] GetModuleInformation (in: hProcess=0x2f8, hModule=0x310000, lpmodinfo=0x21c73a4, cb=0xc | out: lpmodinfo=0x21c73a4*(lpBaseOfDll=0x310000, SizeOfImage=0x3e000, EntryPoint=0x3479ce)) returned 1 [0095.377] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.377] GetModuleBaseNameW (in: hProcess=0x2f8, hModule=0x310000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="unlikexpc.exe") returned 0xd [0095.377] CoTaskMemFree (pv=0x5d1c28) [0095.377] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.377] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x310000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\unlikexpc.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\unlikexpc.exe")) returned 0x33 [0095.377] CoTaskMemFree (pv=0x5d1c28) [0095.377] GetModuleInformation (in: hProcess=0x2f8, hModule=0x77ab0000, lpmodinfo=0x21c94f8, cb=0xc | out: lpmodinfo=0x21c94f8*(lpBaseOfDll=0x77ab0000, SizeOfImage=0x180000, EntryPoint=0x0)) returned 1 [0095.377] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.377] GetModuleBaseNameW (in: hProcess=0x2f8, hModule=0x77ab0000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="ntdll.dll") returned 0x9 [0095.377] CoTaskMemFree (pv=0x5d1c28) [0095.377] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.377] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x77ab0000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll")) returned 0x1d [0095.377] CoTaskMemFree (pv=0x5d1c28) [0095.377] GetModuleInformation (in: hProcess=0x2f8, hModule=0x754b0000, lpmodinfo=0x21cb5fc, cb=0xc | out: lpmodinfo=0x21cb5fc*(lpBaseOfDll=0x754b0000, SizeOfImage=0x4a000, EntryPoint=0x754b2e54)) returned 1 [0095.377] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.377] GetModuleBaseNameW (in: hProcess=0x2f8, hModule=0x754b0000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="MSCOREE.DLL") returned 0xb [0095.378] CoTaskMemFree (pv=0x5d1c28) [0095.378] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.378] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x754b0000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\MSCOREE.DLL" (normalized: "c:\\windows\\system32\\mscoree.dll")) returned 0x1f [0095.378] CoTaskMemFree (pv=0x5d1c28) [0095.378] GetModuleInformation (in: hProcess=0x2f8, hModule=0x757c0000, lpmodinfo=0x21cd708, cb=0xc | out: lpmodinfo=0x21cd708*(lpBaseOfDll=0x757c0000, SizeOfImage=0x110000, EntryPoint=0x757d32d3)) returned 1 [0095.378] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.378] GetModuleBaseNameW (in: hProcess=0x2f8, hModule=0x757c0000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="KERNEL32.dll") returned 0xc [0095.378] CoTaskMemFree (pv=0x5d1c28) [0095.378] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.378] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x757c0000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\KERNEL32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll")) returned 0x20 [0095.378] CoTaskMemFree (pv=0x5d1c28) [0095.378] GetModuleInformation (in: hProcess=0x2f8, hModule=0x76260000, lpmodinfo=0x21cf81c, cb=0xc | out: lpmodinfo=0x21cf81c*(lpBaseOfDll=0x76260000, SizeOfImage=0x46000, EntryPoint=0x76267478)) returned 1 [0095.378] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.378] GetModuleBaseNameW (in: hProcess=0x2f8, hModule=0x76260000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="KERNELBASE.dll") returned 0xe [0095.379] CoTaskMemFree (pv=0x5d1c28) [0095.379] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.379] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x76260000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\KERNELBASE.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll")) returned 0x22 [0095.379] CoTaskMemFree (pv=0x5d1c28) [0095.379] GetModuleInformation (in: hProcess=0x2f8, hModule=0x75720000, lpmodinfo=0x21d1964, cb=0xc | out: lpmodinfo=0x21d1964*(lpBaseOfDll=0x75720000, SizeOfImage=0xa0000, EntryPoint=0x757349e5)) returned 1 [0095.379] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.379] GetModuleBaseNameW (in: hProcess=0x2f8, hModule=0x75720000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="ADVAPI32.dll") returned 0xc [0095.379] CoTaskMemFree (pv=0x5d1c28) [0095.379] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.379] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x75720000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\ADVAPI32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll")) returned 0x20 [0095.379] CoTaskMemFree (pv=0x5d1c28) [0095.379] GetModuleInformation (in: hProcess=0x2f8, hModule=0x75fe0000, lpmodinfo=0x21d3a78, cb=0xc | out: lpmodinfo=0x21d3a78*(lpBaseOfDll=0x75fe0000, SizeOfImage=0xac000, EntryPoint=0x75fea472)) returned 1 [0095.380] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.380] GetModuleBaseNameW (in: hProcess=0x2f8, hModule=0x75fe0000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="msvcrt.dll") returned 0xa [0095.380] CoTaskMemFree (pv=0x5d1c28) [0095.380] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.380] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x75fe0000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll")) returned 0x1e [0095.380] CoTaskMemFree (pv=0x5d1c28) [0095.380] GetModuleInformation (in: hProcess=0x2f8, hModule=0x761b0000, lpmodinfo=0x21d5b84, cb=0xc | out: lpmodinfo=0x21d5b84*(lpBaseOfDll=0x761b0000, SizeOfImage=0x19000, EntryPoint=0x761b4975)) returned 1 [0095.380] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.380] GetModuleBaseNameW (in: hProcess=0x2f8, hModule=0x761b0000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="sechost.dll") returned 0xb [0095.380] CoTaskMemFree (pv=0x5d1c28) [0095.380] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.380] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x761b0000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll")) returned 0x1f [0095.381] CoTaskMemFree (pv=0x5d1c28) [0095.381] GetModuleInformation (in: hProcess=0x2f8, hModule=0x76090000, lpmodinfo=0x21d7c90, cb=0xc | out: lpmodinfo=0x21d7c90*(lpBaseOfDll=0x76090000, SizeOfImage=0xf0000, EntryPoint=0x760a0569)) returned 1 [0095.381] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.381] GetModuleBaseNameW (in: hProcess=0x2f8, hModule=0x76090000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="RPCRT4.dll") returned 0xa [0095.382] CoTaskMemFree (pv=0x5d1c28) [0095.382] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.382] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x76090000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\RPCRT4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll")) returned 0x1e [0095.382] CoTaskMemFree (pv=0x5d1c28) [0095.382] GetModuleInformation (in: hProcess=0x2f8, hModule=0x75610000, lpmodinfo=0x21d9de8, cb=0xc | out: lpmodinfo=0x21d9de8*(lpBaseOfDll=0x75610000, SizeOfImage=0x60000, EntryPoint=0x7562a3b3)) returned 1 [0095.382] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.382] GetModuleBaseNameW (in: hProcess=0x2f8, hModule=0x75610000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="SspiCli.dll") returned 0xb [0095.382] CoTaskMemFree (pv=0x5d1c28) [0095.382] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.382] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x75610000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\SspiCli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll")) returned 0x1f [0095.383] CoTaskMemFree (pv=0x5d1c28) [0095.383] GetModuleInformation (in: hProcess=0x2f8, hModule=0x75600000, lpmodinfo=0x21dbef4, cb=0xc | out: lpmodinfo=0x21dbef4*(lpBaseOfDll=0x75600000, SizeOfImage=0xc000, EntryPoint=0x756010e1)) returned 1 [0095.383] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.383] GetModuleBaseNameW (in: hProcess=0x2f8, hModule=0x75600000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="CRYPTBASE.dll") returned 0xd [0095.383] CoTaskMemFree (pv=0x5d1c28) [0095.383] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.383] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x75600000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\CRYPTBASE.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll")) returned 0x21 [0095.383] CoTaskMemFree (pv=0x5d1c28) [0095.383] GetModuleInformation (in: hProcess=0x2f8, hModule=0x75430000, lpmodinfo=0x21de008, cb=0xc | out: lpmodinfo=0x21de008*(lpBaseOfDll=0x75430000, SizeOfImage=0x78000, EntryPoint=0x7543f7ba)) returned 1 [0095.384] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.384] GetModuleBaseNameW (in: hProcess=0x2f8, hModule=0x75430000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="mscoreei.dll") returned 0xc [0095.384] CoTaskMemFree (pv=0x5d1c28) [0095.384] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.384] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x75430000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscoreei.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\mscoreei.dll")) returned 0x3a [0095.384] CoTaskMemFree (pv=0x5d1c28) [0095.384] GetModuleInformation (in: hProcess=0x2f8, hModule=0x761d0000, lpmodinfo=0x21e0150, cb=0xc | out: lpmodinfo=0x21e0150*(lpBaseOfDll=0x761d0000, SizeOfImage=0x57000, EntryPoint=0x761e9ba6)) returned 1 [0095.384] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.384] GetModuleBaseNameW (in: hProcess=0x2f8, hModule=0x761d0000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="SHLWAPI.dll") returned 0xb [0095.385] CoTaskMemFree (pv=0x5d1c28) [0095.385] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.385] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x761d0000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\SHLWAPI.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll")) returned 0x1f [0095.385] CoTaskMemFree (pv=0x5d1c28) [0095.385] GetModuleInformation (in: hProcess=0x2f8, hModule=0x766d0000, lpmodinfo=0x21e225c, cb=0xc | out: lpmodinfo=0x21e225c*(lpBaseOfDll=0x766d0000, SizeOfImage=0x90000, EntryPoint=0x766e6343)) returned 1 [0095.385] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.385] GetModuleBaseNameW (in: hProcess=0x2f8, hModule=0x766d0000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="GDI32.dll") returned 0x9 [0095.385] CoTaskMemFree (pv=0x5d1c28) [0095.385] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.385] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x766d0000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\GDI32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll")) returned 0x1d [0095.386] CoTaskMemFree (pv=0x5d1c28) [0095.386] GetModuleInformation (in: hProcess=0x2f8, hModule=0x775b0000, lpmodinfo=0x21e4360, cb=0xc | out: lpmodinfo=0x21e4360*(lpBaseOfDll=0x775b0000, SizeOfImage=0x100000, EntryPoint=0x775cb6ed)) returned 1 [0095.386] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.386] GetModuleBaseNameW (in: hProcess=0x2f8, hModule=0x775b0000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="USER32.dll") returned 0xa [0095.386] CoTaskMemFree (pv=0x5d1c28) [0095.386] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.386] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x775b0000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\USER32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll")) returned 0x1e [0095.387] CoTaskMemFree (pv=0x5d1c28) [0095.387] GetModuleInformation (in: hProcess=0x2f8, hModule=0x75a70000, lpmodinfo=0x21e646c, cb=0xc | out: lpmodinfo=0x21e646c*(lpBaseOfDll=0x75a70000, SizeOfImage=0xa000, EntryPoint=0x75a736a0)) returned 1 [0095.387] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.387] GetModuleBaseNameW (in: hProcess=0x2f8, hModule=0x75a70000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="LPK.dll") returned 0x7 [0095.387] CoTaskMemFree (pv=0x5d1c28) [0095.387] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.387] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x75a70000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\LPK.dll" (normalized: "c:\\windows\\syswow64\\lpk.dll")) returned 0x1b [0095.387] CoTaskMemFree (pv=0x5d1c28) [0095.387] GetModuleInformation (in: hProcess=0x2f8, hModule=0x758d0000, lpmodinfo=0x21e8568, cb=0xc | out: lpmodinfo=0x21e8568*(lpBaseOfDll=0x758d0000, SizeOfImage=0x9d000, EntryPoint=0x75903fd7)) returned 1 [0095.388] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.388] GetModuleBaseNameW (in: hProcess=0x2f8, hModule=0x758d0000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="USP10.dll") returned 0x9 [0095.388] CoTaskMemFree (pv=0x5d1c28) [0095.388] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.388] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x758d0000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\USP10.dll" (normalized: "c:\\windows\\syswow64\\usp10.dll")) returned 0x1d [0095.388] CoTaskMemFree (pv=0x5d1c28) [0095.388] GetModuleInformation (in: hProcess=0x2f8, hModule=0x75f80000, lpmodinfo=0x21ea6f8, cb=0xc | out: lpmodinfo=0x21ea6f8*(lpBaseOfDll=0x75f80000, SizeOfImage=0x60000, EntryPoint=0x75f9158f)) returned 1 [0095.389] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.389] GetModuleBaseNameW (in: hProcess=0x2f8, hModule=0x75f80000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="IMM32.DLL") returned 0x9 [0095.389] CoTaskMemFree (pv=0x5d1c28) [0095.389] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.389] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x75f80000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\system32\\IMM32.DLL" (normalized: "c:\\windows\\system32\\imm32.dll")) returned 0x1d [0095.389] CoTaskMemFree (pv=0x5d1c28) [0095.389] GetModuleInformation (in: hProcess=0x2f8, hModule=0x75ea0000, lpmodinfo=0x21ec7fc, cb=0xc | out: lpmodinfo=0x21ec7fc*(lpBaseOfDll=0x75ea0000, SizeOfImage=0xcc000, EntryPoint=0x75ea168b)) returned 1 [0095.390] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.390] GetModuleBaseNameW (in: hProcess=0x2f8, hModule=0x75ea0000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="MSCTF.dll") returned 0x9 [0095.390] CoTaskMemFree (pv=0x5d1c28) [0095.390] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.390] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x75ea0000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\MSCTF.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll")) returned 0x1d [0095.390] CoTaskMemFree (pv=0x5d1c28) [0095.390] GetModuleInformation (in: hProcess=0x2f8, hModule=0x75420000, lpmodinfo=0x21ee900, cb=0xc | out: lpmodinfo=0x21ee900*(lpBaseOfDll=0x75420000, SizeOfImage=0x9000, EntryPoint=0x75421220)) returned 1 [0095.391] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.391] GetModuleBaseNameW (in: hProcess=0x2f8, hModule=0x75420000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="VERSION.dll") returned 0xb [0095.391] CoTaskMemFree (pv=0x5d1c28) [0095.391] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.391] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x75420000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\system32\\VERSION.dll" (normalized: "c:\\windows\\system32\\version.dll")) returned 0x1f [0095.391] CoTaskMemFree (pv=0x5d1c28) [0095.391] GetModuleInformation (in: hProcess=0x2f8, hModule=0x74890000, lpmodinfo=0x21f0a0c, cb=0xc | out: lpmodinfo=0x21f0a0c*(lpBaseOfDll=0x74890000, SizeOfImage=0x6a8000, EntryPoint=0x749d7040)) returned 1 [0095.392] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.392] GetModuleBaseNameW (in: hProcess=0x2f8, hModule=0x74890000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="clr.dll") returned 0x7 [0095.392] CoTaskMemFree (pv=0x5d1c28) [0095.392] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.392] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x74890000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\clr.dll")) returned 0x35 [0095.392] CoTaskMemFree (pv=0x5d1c28) [0095.392] GetModuleInformation (in: hProcess=0x2f8, hModule=0x75320000, lpmodinfo=0x21f2b3c, cb=0xc | out: lpmodinfo=0x21f2b3c*(lpBaseOfDll=0x75320000, SizeOfImage=0xf5000, EntryPoint=0x75374160)) returned 1 [0095.393] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.393] GetModuleBaseNameW (in: hProcess=0x2f8, hModule=0x75320000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="MSVCR120_CLR0400.dll") returned 0x14 [0095.393] CoTaskMemFree (pv=0x5d1c28) [0095.393] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.393] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x75320000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\system32\\MSVCR120_CLR0400.dll" (normalized: "c:\\windows\\system32\\msvcr120_clr0400.dll")) returned 0x28 [0095.393] CoTaskMemFree (pv=0x5d1c28) [0095.394] GetModuleInformation (in: hProcess=0x2f8, hModule=0x72440000, lpmodinfo=0x21f4c70, cb=0xc | out: lpmodinfo=0x21f4c70*(lpBaseOfDll=0x72440000, SizeOfImage=0x122b000, EntryPoint=0x0)) returned 1 [0095.394] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.394] GetModuleBaseNameW (in: hProcess=0x2f8, hModule=0x72440000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="mscorlib.ni.dll") returned 0xf [0095.394] CoTaskMemFree (pv=0x5d1c28) [0095.394] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.394] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x72440000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\b7a12c4c0032847fcc6b9c710460456f\\mscorlib.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\mscorlib\\b7a12c4c0032847fcc6b9c710460456f\\mscorlib.ni.dll")) returned 0x68 [0095.395] CoTaskMemFree (pv=0x5d1c28) [0095.395] GetModuleInformation (in: hProcess=0x2f8, hModule=0x764e0000, lpmodinfo=0x21f6e18, cb=0xc | out: lpmodinfo=0x21f6e18*(lpBaseOfDll=0x764e0000, SizeOfImage=0x15c000, EntryPoint=0x7652ba3d)) returned 1 [0095.395] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.395] GetModuleBaseNameW (in: hProcess=0x2f8, hModule=0x764e0000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="ole32.dll") returned 0x9 [0095.395] CoTaskMemFree (pv=0x5d1c28) [0095.395] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.395] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x764e0000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll")) returned 0x1d [0095.396] CoTaskMemFree (pv=0x5d1c28) [0095.396] GetModuleInformation (in: hProcess=0x2f8, hModule=0x74f60000, lpmodinfo=0x21f8f1c, cb=0xc | out: lpmodinfo=0x21f8f1c*(lpBaseOfDll=0x74f60000, SizeOfImage=0x80000, EntryPoint=0x74f737c9)) returned 1 [0095.396] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.396] GetModuleBaseNameW (in: hProcess=0x2f8, hModule=0x74f60000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="uxtheme.dll") returned 0xb [0095.397] CoTaskMemFree (pv=0x5d1c28) [0095.397] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.397] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x74f60000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\system32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll")) returned 0x1f [0095.397] CoTaskMemFree (pv=0x5d1c28) [0095.397] GetModuleInformation (in: hProcess=0x2f8, hModule=0x752a0000, lpmodinfo=0x21fb028, cb=0xc | out: lpmodinfo=0x21fb028*(lpBaseOfDll=0x752a0000, SizeOfImage=0x7d000, EntryPoint=0x752a1140)) returned 1 [0095.397] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.397] GetModuleBaseNameW (in: hProcess=0x2f8, hModule=0x752a0000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="clrjit.dll") returned 0xa [0095.398] CoTaskMemFree (pv=0x5d1c28) [0095.398] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.398] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x752a0000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clrjit.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\clrjit.dll")) returned 0x38 [0095.398] CoTaskMemFree (pv=0x5d1c28) [0095.398] GetModuleInformation (in: hProcess=0x2f8, hModule=0x762b0000, lpmodinfo=0x21fd168, cb=0xc | out: lpmodinfo=0x21fd168*(lpBaseOfDll=0x762b0000, SizeOfImage=0x8f000, EntryPoint=0x762b3fb1)) returned 1 [0095.399] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.399] GetModuleBaseNameW (in: hProcess=0x2f8, hModule=0x762b0000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="OLEAUT32.dll") returned 0xc [0095.399] CoTaskMemFree (pv=0x5d1c28) [0095.399] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.399] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x762b0000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\OLEAUT32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll")) returned 0x20 [0095.399] CoTaskMemFree (pv=0x5d1c28) [0095.400] GetModuleInformation (in: hProcess=0x2f8, hModule=0x736d0000, lpmodinfo=0x21ff27c, cb=0xc | out: lpmodinfo=0x21ff27c*(lpBaseOfDll=0x736d0000, SizeOfImage=0x9ad000, EntryPoint=0x0)) returned 1 [0095.400] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.400] GetModuleBaseNameW (in: hProcess=0x2f8, hModule=0x736d0000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="System.ni.dll") returned 0xd [0095.400] CoTaskMemFree (pv=0x5d1c28) [0095.400] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.400] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x736d0000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System\\500ffa28b327e171fe664023003e947e\\System.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system\\500ffa28b327e171fe664023003e947e\\system.ni.dll")) returned 0x64 [0095.401] CoTaskMemFree (pv=0x5d1c28) [0095.401] GetModuleInformation (in: hProcess=0x2f8, hModule=0x71d20000, lpmodinfo=0x2201418, cb=0xc | out: lpmodinfo=0x2201418*(lpBaseOfDll=0x71d20000, SizeOfImage=0x716000, EntryPoint=0x0)) returned 1 [0095.401] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.401] GetModuleBaseNameW (in: hProcess=0x2f8, hModule=0x71d20000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="System.Core.ni.dll") returned 0x12 [0095.402] CoTaskMemFree (pv=0x5d1c28) [0095.402] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.402] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x71d20000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Core\\386fde9190d499d6645df8b90eb76242\\System.Core.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.core\\386fde9190d499d6645df8b90eb76242\\system.core.ni.dll")) returned 0x6e [0095.402] CoTaskMemFree (pv=0x5d1c28) [0095.402] GetModuleInformation (in: hProcess=0x2f8, hModule=0x750d0000, lpmodinfo=0x22035d4, cb=0xc | out: lpmodinfo=0x22035d4*(lpBaseOfDll=0x750d0000, SizeOfImage=0x1cb000, EntryPoint=0x0)) returned 1 [0095.402] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.402] GetModuleBaseNameW (in: hProcess=0x2f8, hModule=0x750d0000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="Microsoft.VisualBasic.ni.dll") returned 0x1c [0095.403] CoTaskMemFree (pv=0x5d1c28) [0095.403] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.403] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x750d0000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Microsoft.V9921e851#\\cfbddeb6e93e8f421b92229b20e51233\\Microsoft.VisualBasic.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\microsoft.v9921e851#\\cfbddeb6e93e8f421b92229b20e51233\\microsoft.visualbasic.ni.dll")) returned 0x81 [0095.403] CoTaskMemFree (pv=0x5d1c28) [0095.403] GetModuleInformation (in: hProcess=0x2f8, hModule=0x750b0000, lpmodinfo=0x22057c8, cb=0xc | out: lpmodinfo=0x22057c8*(lpBaseOfDll=0x750b0000, SizeOfImage=0x13000, EntryPoint=0x750b18f0)) returned 1 [0095.404] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.404] GetModuleBaseNameW (in: hProcess=0x2f8, hModule=0x750b0000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="nlssorting.dll") returned 0xe [0095.404] CoTaskMemFree (pv=0x5d1c28) [0095.404] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.404] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x750b0000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\nlssorting.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\nlssorting.dll")) returned 0x3c [0095.405] CoTaskMemFree (pv=0x5d1c28) [0095.405] GetModuleInformation (in: hProcess=0x2f8, hModule=0x74870000, lpmodinfo=0x2207918, cb=0xc | out: lpmodinfo=0x2207918*(lpBaseOfDll=0x74870000, SizeOfImage=0x16000, EntryPoint=0x74872dc3)) returned 1 [0095.405] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.405] GetModuleBaseNameW (in: hProcess=0x2f8, hModule=0x74870000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="CRYPTSP.dll") returned 0xb [0095.406] CoTaskMemFree (pv=0x5d1c28) [0095.406] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.406] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x74870000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\system32\\CRYPTSP.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll")) returned 0x1f [0095.406] CoTaskMemFree (pv=0x5d1c28) [0095.406] GetModuleInformation (in: hProcess=0x2f8, hModule=0x74830000, lpmodinfo=0x2209a24, cb=0xc | out: lpmodinfo=0x2209a24*(lpBaseOfDll=0x74830000, SizeOfImage=0x3b000, EntryPoint=0x7483128d)) returned 1 [0095.407] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.407] GetModuleBaseNameW (in: hProcess=0x2f8, hModule=0x74830000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="rsaenh.dll") returned 0xa [0095.407] CoTaskMemFree (pv=0x5d1c28) [0095.407] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.407] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x74830000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\system32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll")) returned 0x1e [0095.407] CoTaskMemFree (pv=0x5d1c28) [0095.408] GetModuleInformation (in: hProcess=0x2f8, hModule=0x75a60000, lpmodinfo=0x220bc3c, cb=0xc | out: lpmodinfo=0x220bc3c*(lpBaseOfDll=0x75a60000, SizeOfImage=0x5000, EntryPoint=0x75a61438)) returned 1 [0095.408] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.408] GetModuleBaseNameW (in: hProcess=0x2f8, hModule=0x75a60000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="psapi.dll") returned 0x9 [0095.408] CoTaskMemFree (pv=0x5d1c28) [0095.408] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.408] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x75a60000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\psapi.dll" (normalized: "c:\\windows\\syswow64\\psapi.dll")) returned 0x1d [0095.409] CoTaskMemFree (pv=0x5d1c28) [0095.409] GetModuleInformation (in: hProcess=0x2f8, hModule=0x746a0000, lpmodinfo=0x220dd40, cb=0xc | out: lpmodinfo=0x220dd40*(lpBaseOfDll=0x746a0000, SizeOfImage=0x18d000, EntryPoint=0x0)) returned 1 [0095.409] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.409] GetModuleBaseNameW (in: hProcess=0x2f8, hModule=0x746a0000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="System.Drawing.ni.dll") returned 0x15 [0095.410] CoTaskMemFree (pv=0x5d1c28) [0095.410] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.410] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x746a0000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Drawing\\553c0312fdf5a5449f3649f0515e70fb\\System.Drawing.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.drawing\\553c0312fdf5a5449f3649f0515e70fb\\system.drawing.ni.dll")) returned 0x74 [0095.410] CoTaskMemFree (pv=0x5d1c28) [0095.410] GetModuleInformation (in: hProcess=0x2f8, hModule=0x710c0000, lpmodinfo=0x220ff0c, cb=0xc | out: lpmodinfo=0x220ff0c*(lpBaseOfDll=0x710c0000, SizeOfImage=0xc58000, EntryPoint=0x0)) returned 1 [0095.411] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.411] GetModuleBaseNameW (in: hProcess=0x2f8, hModule=0x710c0000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="System.Windows.Forms.ni.dll") returned 0x1b [0095.411] CoTaskMemFree (pv=0x5d1c28) [0095.411] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.411] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x710c0000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Windows.Forms\\7a6894982f35a1d75ec73d447c583da2\\System.Windows.Forms.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.windows.forms\\7a6894982f35a1d75ec73d447c583da2\\system.windows.forms.ni.dll")) returned 0x80 [0095.412] CoTaskMemFree (pv=0x5d1c28) [0095.412] CloseHandle (hObject=0x2f8) returned 1 [0095.416] EnumProcessModules (in: hProcess=0x2f8, lphModule=0x22e74ac, cb=0x100, lpcbNeeded=0x4990c0 | out: lphModule=0x22e74ac, lpcbNeeded=0x4990c0) returned 1 [0095.417] GetModuleInformation (in: hProcess=0x2f8, hModule=0x310000, lpmodinfo=0x22e75ec, cb=0xc | out: lpmodinfo=0x22e75ec*(lpBaseOfDll=0x310000, SizeOfImage=0x3e000, EntryPoint=0x3479ce)) returned 1 [0095.417] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.417] GetModuleBaseNameW (in: hProcess=0x2f8, hModule=0x310000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="unlikexpc.exe") returned 0xd [0095.417] CoTaskMemFree (pv=0x5d1c28) [0095.417] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.417] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x310000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\unlikexpc.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\unlikexpc.exe")) returned 0x33 [0095.417] CoTaskMemFree (pv=0x5d1c28) [0095.417] GetModuleInformation (in: hProcess=0x2f8, hModule=0x77ab0000, lpmodinfo=0x22e9740, cb=0xc | out: lpmodinfo=0x22e9740*(lpBaseOfDll=0x77ab0000, SizeOfImage=0x180000, EntryPoint=0x0)) returned 1 [0095.417] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.417] GetModuleBaseNameW (in: hProcess=0x2f8, hModule=0x77ab0000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="ntdll.dll") returned 0x9 [0095.417] CoTaskMemFree (pv=0x5d1c28) [0095.417] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.417] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x77ab0000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll")) returned 0x1d [0095.418] CoTaskMemFree (pv=0x5d1c28) [0095.418] GetModuleInformation (in: hProcess=0x2f8, hModule=0x754b0000, lpmodinfo=0x22eb844, cb=0xc | out: lpmodinfo=0x22eb844*(lpBaseOfDll=0x754b0000, SizeOfImage=0x4a000, EntryPoint=0x754b2e54)) returned 1 [0095.418] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.418] GetModuleBaseNameW (in: hProcess=0x2f8, hModule=0x754b0000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="MSCOREE.DLL") returned 0xb [0095.418] CoTaskMemFree (pv=0x5d1c28) [0095.418] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.418] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x754b0000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\MSCOREE.DLL" (normalized: "c:\\windows\\system32\\mscoree.dll")) returned 0x1f [0095.418] CoTaskMemFree (pv=0x5d1c28) [0095.418] GetModuleInformation (in: hProcess=0x2f8, hModule=0x757c0000, lpmodinfo=0x22ed950, cb=0xc | out: lpmodinfo=0x22ed950*(lpBaseOfDll=0x757c0000, SizeOfImage=0x110000, EntryPoint=0x757d32d3)) returned 1 [0095.418] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.418] GetModuleBaseNameW (in: hProcess=0x2f8, hModule=0x757c0000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="KERNEL32.dll") returned 0xc [0095.418] CoTaskMemFree (pv=0x5d1c28) [0095.418] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.418] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x757c0000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\KERNEL32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll")) returned 0x20 [0095.419] CoTaskMemFree (pv=0x5d1c28) [0095.419] GetModuleInformation (in: hProcess=0x2f8, hModule=0x76260000, lpmodinfo=0x22efa64, cb=0xc | out: lpmodinfo=0x22efa64*(lpBaseOfDll=0x76260000, SizeOfImage=0x46000, EntryPoint=0x76267478)) returned 1 [0095.419] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.419] GetModuleBaseNameW (in: hProcess=0x2f8, hModule=0x76260000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="KERNELBASE.dll") returned 0xe [0095.419] CoTaskMemFree (pv=0x5d1c28) [0095.419] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.419] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x76260000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\KERNELBASE.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll")) returned 0x22 [0095.419] CoTaskMemFree (pv=0x5d1c28) [0095.419] GetModuleInformation (in: hProcess=0x2f8, hModule=0x75720000, lpmodinfo=0x22f1bac, cb=0xc | out: lpmodinfo=0x22f1bac*(lpBaseOfDll=0x75720000, SizeOfImage=0xa0000, EntryPoint=0x757349e5)) returned 1 [0095.419] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.419] GetModuleBaseNameW (in: hProcess=0x2f8, hModule=0x75720000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="ADVAPI32.dll") returned 0xc [0095.419] CoTaskMemFree (pv=0x5d1c28) [0095.419] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.419] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x75720000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\ADVAPI32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll")) returned 0x20 [0095.420] CoTaskMemFree (pv=0x5d1c28) [0095.420] GetModuleInformation (in: hProcess=0x2f8, hModule=0x75fe0000, lpmodinfo=0x22f3cc0, cb=0xc | out: lpmodinfo=0x22f3cc0*(lpBaseOfDll=0x75fe0000, SizeOfImage=0xac000, EntryPoint=0x75fea472)) returned 1 [0095.420] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.420] GetModuleBaseNameW (in: hProcess=0x2f8, hModule=0x75fe0000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="msvcrt.dll") returned 0xa [0095.420] CoTaskMemFree (pv=0x5d1c28) [0095.420] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.420] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x75fe0000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll")) returned 0x1e [0095.420] CoTaskMemFree (pv=0x5d1c28) [0095.420] GetModuleInformation (in: hProcess=0x2f8, hModule=0x761b0000, lpmodinfo=0x22f5dcc, cb=0xc | out: lpmodinfo=0x22f5dcc*(lpBaseOfDll=0x761b0000, SizeOfImage=0x19000, EntryPoint=0x761b4975)) returned 1 [0095.420] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.420] GetModuleBaseNameW (in: hProcess=0x2f8, hModule=0x761b0000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="sechost.dll") returned 0xb [0095.421] CoTaskMemFree (pv=0x5d1c28) [0095.421] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.421] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x761b0000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll")) returned 0x1f [0095.421] CoTaskMemFree (pv=0x5d1c28) [0095.421] GetModuleInformation (in: hProcess=0x2f8, hModule=0x76090000, lpmodinfo=0x22f7ed8, cb=0xc | out: lpmodinfo=0x22f7ed8*(lpBaseOfDll=0x76090000, SizeOfImage=0xf0000, EntryPoint=0x760a0569)) returned 1 [0095.421] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.421] GetModuleBaseNameW (in: hProcess=0x2f8, hModule=0x76090000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="RPCRT4.dll") returned 0xa [0095.421] CoTaskMemFree (pv=0x5d1c28) [0095.421] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.421] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x76090000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\RPCRT4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll")) returned 0x1e [0095.421] CoTaskMemFree (pv=0x5d1c28) [0095.421] GetModuleInformation (in: hProcess=0x2f8, hModule=0x75610000, lpmodinfo=0x22fa030, cb=0xc | out: lpmodinfo=0x22fa030*(lpBaseOfDll=0x75610000, SizeOfImage=0x60000, EntryPoint=0x7562a3b3)) returned 1 [0095.422] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.422] GetModuleBaseNameW (in: hProcess=0x2f8, hModule=0x75610000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="SspiCli.dll") returned 0xb [0095.422] CoTaskMemFree (pv=0x5d1c28) [0095.422] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.422] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x75610000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\SspiCli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll")) returned 0x1f [0095.422] CoTaskMemFree (pv=0x5d1c28) [0095.422] GetModuleInformation (in: hProcess=0x2f8, hModule=0x75600000, lpmodinfo=0x22fc13c, cb=0xc | out: lpmodinfo=0x22fc13c*(lpBaseOfDll=0x75600000, SizeOfImage=0xc000, EntryPoint=0x756010e1)) returned 1 [0095.422] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.422] GetModuleBaseNameW (in: hProcess=0x2f8, hModule=0x75600000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="CRYPTBASE.dll") returned 0xd [0095.422] CoTaskMemFree (pv=0x5d1c28) [0095.422] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.422] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x75600000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\CRYPTBASE.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll")) returned 0x21 [0095.423] CoTaskMemFree (pv=0x5d1c28) [0095.423] GetModuleInformation (in: hProcess=0x2f8, hModule=0x75430000, lpmodinfo=0x22fe250, cb=0xc | out: lpmodinfo=0x22fe250*(lpBaseOfDll=0x75430000, SizeOfImage=0x78000, EntryPoint=0x7543f7ba)) returned 1 [0095.423] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.423] GetModuleBaseNameW (in: hProcess=0x2f8, hModule=0x75430000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="mscoreei.dll") returned 0xc [0095.423] CoTaskMemFree (pv=0x5d1c28) [0095.423] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.423] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x75430000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscoreei.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\mscoreei.dll")) returned 0x3a [0095.423] CoTaskMemFree (pv=0x5d1c28) [0095.423] GetModuleInformation (in: hProcess=0x2f8, hModule=0x761d0000, lpmodinfo=0x2300398, cb=0xc | out: lpmodinfo=0x2300398*(lpBaseOfDll=0x761d0000, SizeOfImage=0x57000, EntryPoint=0x761e9ba6)) returned 1 [0095.424] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.424] GetModuleBaseNameW (in: hProcess=0x2f8, hModule=0x761d0000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="SHLWAPI.dll") returned 0xb [0095.424] CoTaskMemFree (pv=0x5d1c28) [0095.424] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.424] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x761d0000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\SHLWAPI.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll")) returned 0x1f [0095.424] CoTaskMemFree (pv=0x5d1c28) [0095.424] GetModuleInformation (in: hProcess=0x2f8, hModule=0x766d0000, lpmodinfo=0x23024a4, cb=0xc | out: lpmodinfo=0x23024a4*(lpBaseOfDll=0x766d0000, SizeOfImage=0x90000, EntryPoint=0x766e6343)) returned 1 [0095.425] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.425] GetModuleBaseNameW (in: hProcess=0x2f8, hModule=0x766d0000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="GDI32.dll") returned 0x9 [0095.425] CoTaskMemFree (pv=0x5d1c28) [0095.425] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.425] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x766d0000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\GDI32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll")) returned 0x1d [0095.425] CoTaskMemFree (pv=0x5d1c28) [0095.425] GetModuleInformation (in: hProcess=0x2f8, hModule=0x775b0000, lpmodinfo=0x23045a8, cb=0xc | out: lpmodinfo=0x23045a8*(lpBaseOfDll=0x775b0000, SizeOfImage=0x100000, EntryPoint=0x775cb6ed)) returned 1 [0095.425] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.425] GetModuleBaseNameW (in: hProcess=0x2f8, hModule=0x775b0000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="USER32.dll") returned 0xa [0095.426] CoTaskMemFree (pv=0x5d1c28) [0095.426] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.426] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x775b0000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\USER32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll")) returned 0x1e [0095.426] CoTaskMemFree (pv=0x5d1c28) [0095.426] GetModuleInformation (in: hProcess=0x2f8, hModule=0x75a70000, lpmodinfo=0x23066b4, cb=0xc | out: lpmodinfo=0x23066b4*(lpBaseOfDll=0x75a70000, SizeOfImage=0xa000, EntryPoint=0x75a736a0)) returned 1 [0095.426] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.426] GetModuleBaseNameW (in: hProcess=0x2f8, hModule=0x75a70000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="LPK.dll") returned 0x7 [0095.426] CoTaskMemFree (pv=0x5d1c28) [0095.427] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.427] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x75a70000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\LPK.dll" (normalized: "c:\\windows\\syswow64\\lpk.dll")) returned 0x1b [0095.427] CoTaskMemFree (pv=0x5d1c28) [0095.427] GetModuleInformation (in: hProcess=0x2f8, hModule=0x758d0000, lpmodinfo=0x23087b0, cb=0xc | out: lpmodinfo=0x23087b0*(lpBaseOfDll=0x758d0000, SizeOfImage=0x9d000, EntryPoint=0x75903fd7)) returned 1 [0095.427] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.427] GetModuleBaseNameW (in: hProcess=0x2f8, hModule=0x758d0000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="USP10.dll") returned 0x9 [0095.427] CoTaskMemFree (pv=0x5d1c28) [0095.428] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x758d0000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\USP10.dll" (normalized: "c:\\windows\\syswow64\\usp10.dll")) returned 0x1d [0095.455] GetModuleInformation (in: hProcess=0x2f8, hModule=0x75f80000, lpmodinfo=0x230a940, cb=0xc | out: lpmodinfo=0x230a940*(lpBaseOfDll=0x75f80000, SizeOfImage=0x60000, EntryPoint=0x75f9158f)) returned 1 [0095.456] GetModuleBaseNameW (in: hProcess=0x2f8, hModule=0x75f80000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="IMM32.DLL") returned 0x9 [0095.456] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x75f80000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\system32\\IMM32.DLL" (normalized: "c:\\windows\\system32\\imm32.dll")) returned 0x1d [0095.456] GetModuleInformation (in: hProcess=0x2f8, hModule=0x75ea0000, lpmodinfo=0x230ca44, cb=0xc | out: lpmodinfo=0x230ca44*(lpBaseOfDll=0x75ea0000, SizeOfImage=0xcc000, EntryPoint=0x75ea168b)) returned 1 [0095.457] GetModuleBaseNameW (in: hProcess=0x2f8, hModule=0x75ea0000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="MSCTF.dll") returned 0x9 [0095.457] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x75ea0000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\MSCTF.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll")) returned 0x1d [0095.457] GetModuleInformation (in: hProcess=0x2f8, hModule=0x75420000, lpmodinfo=0x230eb48, cb=0xc | out: lpmodinfo=0x230eb48*(lpBaseOfDll=0x75420000, SizeOfImage=0x9000, EntryPoint=0x75421220)) returned 1 [0095.457] GetModuleBaseNameW (in: hProcess=0x2f8, hModule=0x75420000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="VERSION.dll") returned 0xb [0095.458] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x75420000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\system32\\VERSION.dll" (normalized: "c:\\windows\\system32\\version.dll")) returned 0x1f [0095.458] GetModuleInformation (in: hProcess=0x2f8, hModule=0x74890000, lpmodinfo=0x2310c54, cb=0xc | out: lpmodinfo=0x2310c54*(lpBaseOfDll=0x74890000, SizeOfImage=0x6a8000, EntryPoint=0x749d7040)) returned 1 [0095.458] GetModuleBaseNameW (in: hProcess=0x2f8, hModule=0x74890000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="clr.dll") returned 0x7 [0095.459] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x74890000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\clr.dll")) returned 0x35 [0095.459] GetModuleInformation (in: hProcess=0x2f8, hModule=0x75320000, lpmodinfo=0x2312d84, cb=0xc | out: lpmodinfo=0x2312d84*(lpBaseOfDll=0x75320000, SizeOfImage=0xf5000, EntryPoint=0x75374160)) returned 1 [0095.459] GetModuleBaseNameW (in: hProcess=0x2f8, hModule=0x75320000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="MSVCR120_CLR0400.dll") returned 0x14 [0095.460] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x75320000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\system32\\MSVCR120_CLR0400.dll" (normalized: "c:\\windows\\system32\\msvcr120_clr0400.dll")) returned 0x28 [0095.460] GetModuleInformation (in: hProcess=0x2f8, hModule=0x72440000, lpmodinfo=0x2314eb8, cb=0xc | out: lpmodinfo=0x2314eb8*(lpBaseOfDll=0x72440000, SizeOfImage=0x122b000, EntryPoint=0x0)) returned 1 [0095.460] GetModuleBaseNameW (in: hProcess=0x2f8, hModule=0x72440000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="mscorlib.ni.dll") returned 0xf [0095.461] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x72440000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\b7a12c4c0032847fcc6b9c710460456f\\mscorlib.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\mscorlib\\b7a12c4c0032847fcc6b9c710460456f\\mscorlib.ni.dll")) returned 0x68 [0095.461] GetModuleInformation (in: hProcess=0x2f8, hModule=0x764e0000, lpmodinfo=0x2317060, cb=0xc | out: lpmodinfo=0x2317060*(lpBaseOfDll=0x764e0000, SizeOfImage=0x15c000, EntryPoint=0x7652ba3d)) returned 1 [0095.461] GetModuleBaseNameW (in: hProcess=0x2f8, hModule=0x764e0000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="ole32.dll") returned 0x9 [0095.462] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x764e0000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll")) returned 0x1d [0095.462] GetModuleInformation (in: hProcess=0x2f8, hModule=0x74f60000, lpmodinfo=0x2319164, cb=0xc | out: lpmodinfo=0x2319164*(lpBaseOfDll=0x74f60000, SizeOfImage=0x80000, EntryPoint=0x74f737c9)) returned 1 [0095.462] GetModuleBaseNameW (in: hProcess=0x2f8, hModule=0x74f60000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="uxtheme.dll") returned 0xb [0095.463] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x74f60000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\system32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll")) returned 0x1f [0095.463] GetModuleInformation (in: hProcess=0x2f8, hModule=0x752a0000, lpmodinfo=0x231b270, cb=0xc | out: lpmodinfo=0x231b270*(lpBaseOfDll=0x752a0000, SizeOfImage=0x7d000, EntryPoint=0x752a1140)) returned 1 [0095.464] GetModuleBaseNameW (in: hProcess=0x2f8, hModule=0x752a0000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="clrjit.dll") returned 0xa [0095.464] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x752a0000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clrjit.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\clrjit.dll")) returned 0x38 [0095.464] GetModuleInformation (in: hProcess=0x2f8, hModule=0x762b0000, lpmodinfo=0x231d3b0, cb=0xc | out: lpmodinfo=0x231d3b0*(lpBaseOfDll=0x762b0000, SizeOfImage=0x8f000, EntryPoint=0x762b3fb1)) returned 1 [0095.465] GetModuleBaseNameW (in: hProcess=0x2f8, hModule=0x762b0000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="OLEAUT32.dll") returned 0xc [0095.465] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x762b0000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\OLEAUT32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll")) returned 0x20 [0095.465] GetModuleInformation (in: hProcess=0x2f8, hModule=0x736d0000, lpmodinfo=0x231f4c4, cb=0xc | out: lpmodinfo=0x231f4c4*(lpBaseOfDll=0x736d0000, SizeOfImage=0x9ad000, EntryPoint=0x0)) returned 1 [0095.466] GetModuleBaseNameW (in: hProcess=0x2f8, hModule=0x736d0000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="System.ni.dll") returned 0xd [0095.466] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x736d0000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System\\500ffa28b327e171fe664023003e947e\\System.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system\\500ffa28b327e171fe664023003e947e\\system.ni.dll")) returned 0x64 [0095.467] GetModuleInformation (in: hProcess=0x2f8, hModule=0x71d20000, lpmodinfo=0x2321660, cb=0xc | out: lpmodinfo=0x2321660*(lpBaseOfDll=0x71d20000, SizeOfImage=0x716000, EntryPoint=0x0)) returned 1 [0095.467] GetModuleBaseNameW (in: hProcess=0x2f8, hModule=0x71d20000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="System.Core.ni.dll") returned 0x12 [0095.467] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x71d20000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Core\\386fde9190d499d6645df8b90eb76242\\System.Core.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.core\\386fde9190d499d6645df8b90eb76242\\system.core.ni.dll")) returned 0x6e [0095.468] GetModuleInformation (in: hProcess=0x2f8, hModule=0x750d0000, lpmodinfo=0x232381c, cb=0xc | out: lpmodinfo=0x232381c*(lpBaseOfDll=0x750d0000, SizeOfImage=0x1cb000, EntryPoint=0x0)) returned 1 [0095.468] GetModuleBaseNameW (in: hProcess=0x2f8, hModule=0x750d0000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="Microsoft.VisualBasic.ni.dll") returned 0x1c [0095.469] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x750d0000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Microsoft.V9921e851#\\cfbddeb6e93e8f421b92229b20e51233\\Microsoft.VisualBasic.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\microsoft.v9921e851#\\cfbddeb6e93e8f421b92229b20e51233\\microsoft.visualbasic.ni.dll")) returned 0x81 [0095.469] GetModuleInformation (in: hProcess=0x2f8, hModule=0x750b0000, lpmodinfo=0x2325a10, cb=0xc | out: lpmodinfo=0x2325a10*(lpBaseOfDll=0x750b0000, SizeOfImage=0x13000, EntryPoint=0x750b18f0)) returned 1 [0095.469] GetModuleBaseNameW (in: hProcess=0x2f8, hModule=0x750b0000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="nlssorting.dll") returned 0xe [0095.470] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x750b0000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\nlssorting.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\nlssorting.dll")) returned 0x3c [0095.470] GetModuleInformation (in: hProcess=0x2f8, hModule=0x74870000, lpmodinfo=0x2327b60, cb=0xc | out: lpmodinfo=0x2327b60*(lpBaseOfDll=0x74870000, SizeOfImage=0x16000, EntryPoint=0x74872dc3)) returned 1 [0095.471] GetModuleBaseNameW (in: hProcess=0x2f8, hModule=0x74870000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="CRYPTSP.dll") returned 0xb [0095.471] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x74870000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\system32\\CRYPTSP.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll")) returned 0x1f [0095.472] GetModuleInformation (in: hProcess=0x2f8, hModule=0x74830000, lpmodinfo=0x2329c6c, cb=0xc | out: lpmodinfo=0x2329c6c*(lpBaseOfDll=0x74830000, SizeOfImage=0x3b000, EntryPoint=0x7483128d)) returned 1 [0095.472] GetModuleBaseNameW (in: hProcess=0x2f8, hModule=0x74830000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="rsaenh.dll") returned 0xa [0095.472] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x74830000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\system32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll")) returned 0x1e [0095.473] GetModuleInformation (in: hProcess=0x2f8, hModule=0x75a60000, lpmodinfo=0x232be84, cb=0xc | out: lpmodinfo=0x232be84*(lpBaseOfDll=0x75a60000, SizeOfImage=0x5000, EntryPoint=0x75a61438)) returned 1 [0095.473] GetModuleBaseNameW (in: hProcess=0x2f8, hModule=0x75a60000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="psapi.dll") returned 0x9 [0095.474] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x75a60000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\psapi.dll" (normalized: "c:\\windows\\syswow64\\psapi.dll")) returned 0x1d [0095.474] GetModuleInformation (in: hProcess=0x2f8, hModule=0x746a0000, lpmodinfo=0x232df88, cb=0xc | out: lpmodinfo=0x232df88*(lpBaseOfDll=0x746a0000, SizeOfImage=0x18d000, EntryPoint=0x0)) returned 1 [0095.475] GetModuleBaseNameW (in: hProcess=0x2f8, hModule=0x746a0000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="System.Drawing.ni.dll") returned 0x15 [0095.475] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x746a0000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Drawing\\553c0312fdf5a5449f3649f0515e70fb\\System.Drawing.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.drawing\\553c0312fdf5a5449f3649f0515e70fb\\system.drawing.ni.dll")) returned 0x74 [0095.476] GetModuleInformation (in: hProcess=0x2f8, hModule=0x710c0000, lpmodinfo=0x2330154, cb=0xc | out: lpmodinfo=0x2330154*(lpBaseOfDll=0x710c0000, SizeOfImage=0xc58000, EntryPoint=0x0)) returned 1 [0095.476] GetModuleBaseNameW (in: hProcess=0x2f8, hModule=0x710c0000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="System.Windows.Forms.ni.dll") returned 0x1b [0095.477] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x710c0000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Windows.Forms\\7a6894982f35a1d75ec73d447c583da2\\System.Windows.Forms.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.windows.forms\\7a6894982f35a1d75ec73d447c583da2\\system.windows.forms.ni.dll")) returned 0x80 [0095.490] GetCurrentProcessId () returned 0x9f8 [0095.491] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x9f8) returned 0x2f8 [0095.491] EnumProcessModules (in: hProcess=0x2f8, lphModule=0x21f7d90, cb=0x100, lpcbNeeded=0x4990c0 | out: lphModule=0x21f7d90, lpcbNeeded=0x4990c0) returned 1 [0095.491] GetModuleInformation (in: hProcess=0x2f8, hModule=0x310000, lpmodinfo=0x21f7ed0, cb=0xc | out: lpmodinfo=0x21f7ed0*(lpBaseOfDll=0x310000, SizeOfImage=0x3e000, EntryPoint=0x3479ce)) returned 1 [0095.491] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.491] GetModuleBaseNameW (in: hProcess=0x2f8, hModule=0x310000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="unlikexpc.exe") returned 0xd [0095.491] CoTaskMemFree (pv=0x5d1c28) [0095.491] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.491] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x310000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\unlikexpc.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\unlikexpc.exe")) returned 0x33 [0095.492] CoTaskMemFree (pv=0x5d1c28) [0095.492] GetModuleInformation (in: hProcess=0x2f8, hModule=0x77ab0000, lpmodinfo=0x21fa024, cb=0xc | out: lpmodinfo=0x21fa024*(lpBaseOfDll=0x77ab0000, SizeOfImage=0x180000, EntryPoint=0x0)) returned 1 [0095.492] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.492] GetModuleBaseNameW (in: hProcess=0x2f8, hModule=0x77ab0000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="ntdll.dll") returned 0x9 [0095.492] CoTaskMemFree (pv=0x5d1c28) [0095.492] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.492] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x77ab0000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll")) returned 0x1d [0095.492] CoTaskMemFree (pv=0x5d1c28) [0095.492] GetModuleInformation (in: hProcess=0x2f8, hModule=0x754b0000, lpmodinfo=0x21fc128, cb=0xc | out: lpmodinfo=0x21fc128*(lpBaseOfDll=0x754b0000, SizeOfImage=0x4a000, EntryPoint=0x754b2e54)) returned 1 [0095.492] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.492] GetModuleBaseNameW (in: hProcess=0x2f8, hModule=0x754b0000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="MSCOREE.DLL") returned 0xb [0095.492] CoTaskMemFree (pv=0x5d1c28) [0095.492] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.492] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x754b0000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\MSCOREE.DLL" (normalized: "c:\\windows\\system32\\mscoree.dll")) returned 0x1f [0095.493] CoTaskMemFree (pv=0x5d1c28) [0095.493] GetModuleInformation (in: hProcess=0x2f8, hModule=0x757c0000, lpmodinfo=0x21fe234, cb=0xc | out: lpmodinfo=0x21fe234*(lpBaseOfDll=0x757c0000, SizeOfImage=0x110000, EntryPoint=0x757d32d3)) returned 1 [0095.493] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.493] GetModuleBaseNameW (in: hProcess=0x2f8, hModule=0x757c0000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="KERNEL32.dll") returned 0xc [0095.493] CoTaskMemFree (pv=0x5d1c28) [0095.493] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.493] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x757c0000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\KERNEL32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll")) returned 0x20 [0095.493] CoTaskMemFree (pv=0x5d1c28) [0095.493] GetModuleInformation (in: hProcess=0x2f8, hModule=0x76260000, lpmodinfo=0x2200348, cb=0xc | out: lpmodinfo=0x2200348*(lpBaseOfDll=0x76260000, SizeOfImage=0x46000, EntryPoint=0x76267478)) returned 1 [0095.493] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.493] GetModuleBaseNameW (in: hProcess=0x2f8, hModule=0x76260000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="KERNELBASE.dll") returned 0xe [0095.493] CoTaskMemFree (pv=0x5d1c28) [0095.493] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.493] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x76260000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\KERNELBASE.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll")) returned 0x22 [0095.494] CoTaskMemFree (pv=0x5d1c28) [0095.494] GetModuleInformation (in: hProcess=0x2f8, hModule=0x75720000, lpmodinfo=0x2202490, cb=0xc | out: lpmodinfo=0x2202490*(lpBaseOfDll=0x75720000, SizeOfImage=0xa0000, EntryPoint=0x757349e5)) returned 1 [0095.494] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.494] GetModuleBaseNameW (in: hProcess=0x2f8, hModule=0x75720000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="ADVAPI32.dll") returned 0xc [0095.494] CoTaskMemFree (pv=0x5d1c28) [0095.494] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.494] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x75720000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\ADVAPI32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll")) returned 0x20 [0095.494] CoTaskMemFree (pv=0x5d1c28) [0095.494] GetModuleInformation (in: hProcess=0x2f8, hModule=0x75fe0000, lpmodinfo=0x22045a4, cb=0xc | out: lpmodinfo=0x22045a4*(lpBaseOfDll=0x75fe0000, SizeOfImage=0xac000, EntryPoint=0x75fea472)) returned 1 [0095.494] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.494] GetModuleBaseNameW (in: hProcess=0x2f8, hModule=0x75fe0000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="msvcrt.dll") returned 0xa [0095.495] CoTaskMemFree (pv=0x5d1c28) [0095.495] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.495] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x75fe0000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll")) returned 0x1e [0095.495] CoTaskMemFree (pv=0x5d1c28) [0095.495] GetModuleInformation (in: hProcess=0x2f8, hModule=0x761b0000, lpmodinfo=0x22066b0, cb=0xc | out: lpmodinfo=0x22066b0*(lpBaseOfDll=0x761b0000, SizeOfImage=0x19000, EntryPoint=0x761b4975)) returned 1 [0095.495] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.495] GetModuleBaseNameW (in: hProcess=0x2f8, hModule=0x761b0000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="sechost.dll") returned 0xb [0095.495] CoTaskMemFree (pv=0x5d1c28) [0095.495] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.495] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x761b0000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll")) returned 0x1f [0095.495] CoTaskMemFree (pv=0x5d1c28) [0095.495] GetModuleInformation (in: hProcess=0x2f8, hModule=0x76090000, lpmodinfo=0x22087bc, cb=0xc | out: lpmodinfo=0x22087bc*(lpBaseOfDll=0x76090000, SizeOfImage=0xf0000, EntryPoint=0x760a0569)) returned 1 [0095.496] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.496] GetModuleBaseNameW (in: hProcess=0x2f8, hModule=0x76090000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="RPCRT4.dll") returned 0xa [0095.496] CoTaskMemFree (pv=0x5d1c28) [0095.496] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.496] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x76090000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\RPCRT4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll")) returned 0x1e [0095.496] CoTaskMemFree (pv=0x5d1c28) [0095.496] GetModuleInformation (in: hProcess=0x2f8, hModule=0x75610000, lpmodinfo=0x220a914, cb=0xc | out: lpmodinfo=0x220a914*(lpBaseOfDll=0x75610000, SizeOfImage=0x60000, EntryPoint=0x7562a3b3)) returned 1 [0095.496] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.496] GetModuleBaseNameW (in: hProcess=0x2f8, hModule=0x75610000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="SspiCli.dll") returned 0xb [0095.497] CoTaskMemFree (pv=0x5d1c28) [0095.497] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.497] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x75610000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\SspiCli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll")) returned 0x1f [0095.497] CoTaskMemFree (pv=0x5d1c28) [0095.497] GetModuleInformation (in: hProcess=0x2f8, hModule=0x75600000, lpmodinfo=0x220ca20, cb=0xc | out: lpmodinfo=0x220ca20*(lpBaseOfDll=0x75600000, SizeOfImage=0xc000, EntryPoint=0x756010e1)) returned 1 [0095.497] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.497] GetModuleBaseNameW (in: hProcess=0x2f8, hModule=0x75600000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="CRYPTBASE.dll") returned 0xd [0095.497] CoTaskMemFree (pv=0x5d1c28) [0095.497] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.497] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x75600000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\CRYPTBASE.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll")) returned 0x21 [0095.498] CoTaskMemFree (pv=0x5d1c28) [0095.498] GetModuleInformation (in: hProcess=0x2f8, hModule=0x75430000, lpmodinfo=0x220eb34, cb=0xc | out: lpmodinfo=0x220eb34*(lpBaseOfDll=0x75430000, SizeOfImage=0x78000, EntryPoint=0x7543f7ba)) returned 1 [0095.498] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.498] GetModuleBaseNameW (in: hProcess=0x2f8, hModule=0x75430000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="mscoreei.dll") returned 0xc [0095.498] CoTaskMemFree (pv=0x5d1c28) [0095.498] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.498] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x75430000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscoreei.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\mscoreei.dll")) returned 0x3a [0095.498] CoTaskMemFree (pv=0x5d1c28) [0095.498] GetModuleInformation (in: hProcess=0x2f8, hModule=0x761d0000, lpmodinfo=0x2210c7c, cb=0xc | out: lpmodinfo=0x2210c7c*(lpBaseOfDll=0x761d0000, SizeOfImage=0x57000, EntryPoint=0x761e9ba6)) returned 1 [0095.499] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.499] GetModuleBaseNameW (in: hProcess=0x2f8, hModule=0x761d0000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="SHLWAPI.dll") returned 0xb [0095.499] CoTaskMemFree (pv=0x5d1c28) [0095.499] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.499] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x761d0000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\SHLWAPI.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll")) returned 0x1f [0095.499] CoTaskMemFree (pv=0x5d1c28) [0095.499] GetModuleInformation (in: hProcess=0x2f8, hModule=0x766d0000, lpmodinfo=0x2212d88, cb=0xc | out: lpmodinfo=0x2212d88*(lpBaseOfDll=0x766d0000, SizeOfImage=0x90000, EntryPoint=0x766e6343)) returned 1 [0095.499] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.499] GetModuleBaseNameW (in: hProcess=0x2f8, hModule=0x766d0000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="GDI32.dll") returned 0x9 [0095.500] CoTaskMemFree (pv=0x5d1c28) [0095.500] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.500] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x766d0000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\GDI32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll")) returned 0x1d [0095.500] CoTaskMemFree (pv=0x5d1c28) [0095.500] GetModuleInformation (in: hProcess=0x2f8, hModule=0x775b0000, lpmodinfo=0x2214e8c, cb=0xc | out: lpmodinfo=0x2214e8c*(lpBaseOfDll=0x775b0000, SizeOfImage=0x100000, EntryPoint=0x775cb6ed)) returned 1 [0095.500] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.500] GetModuleBaseNameW (in: hProcess=0x2f8, hModule=0x775b0000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="USER32.dll") returned 0xa [0095.501] CoTaskMemFree (pv=0x5d1c28) [0095.501] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.501] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x775b0000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\USER32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll")) returned 0x1e [0095.501] CoTaskMemFree (pv=0x5d1c28) [0095.501] GetModuleInformation (in: hProcess=0x2f8, hModule=0x75a70000, lpmodinfo=0x2216f98, cb=0xc | out: lpmodinfo=0x2216f98*(lpBaseOfDll=0x75a70000, SizeOfImage=0xa000, EntryPoint=0x75a736a0)) returned 1 [0095.501] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.501] GetModuleBaseNameW (in: hProcess=0x2f8, hModule=0x75a70000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="LPK.dll") returned 0x7 [0095.501] CoTaskMemFree (pv=0x5d1c28) [0095.501] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.501] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x75a70000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\LPK.dll" (normalized: "c:\\windows\\syswow64\\lpk.dll")) returned 0x1b [0095.502] CoTaskMemFree (pv=0x5d1c28) [0095.502] GetModuleInformation (in: hProcess=0x2f8, hModule=0x758d0000, lpmodinfo=0x2219094, cb=0xc | out: lpmodinfo=0x2219094*(lpBaseOfDll=0x758d0000, SizeOfImage=0x9d000, EntryPoint=0x75903fd7)) returned 1 [0095.502] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.502] GetModuleBaseNameW (in: hProcess=0x2f8, hModule=0x758d0000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="USP10.dll") returned 0x9 [0095.502] CoTaskMemFree (pv=0x5d1c28) [0095.502] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.502] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x758d0000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\USP10.dll" (normalized: "c:\\windows\\syswow64\\usp10.dll")) returned 0x1d [0095.503] CoTaskMemFree (pv=0x5d1c28) [0095.503] GetModuleInformation (in: hProcess=0x2f8, hModule=0x75f80000, lpmodinfo=0x221b224, cb=0xc | out: lpmodinfo=0x221b224*(lpBaseOfDll=0x75f80000, SizeOfImage=0x60000, EntryPoint=0x75f9158f)) returned 1 [0095.503] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.503] GetModuleBaseNameW (in: hProcess=0x2f8, hModule=0x75f80000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="IMM32.DLL") returned 0x9 [0095.503] CoTaskMemFree (pv=0x5d1c28) [0095.503] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.503] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x75f80000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\system32\\IMM32.DLL" (normalized: "c:\\windows\\system32\\imm32.dll")) returned 0x1d [0095.504] CoTaskMemFree (pv=0x5d1c28) [0095.504] GetModuleInformation (in: hProcess=0x2f8, hModule=0x75ea0000, lpmodinfo=0x221d328, cb=0xc | out: lpmodinfo=0x221d328*(lpBaseOfDll=0x75ea0000, SizeOfImage=0xcc000, EntryPoint=0x75ea168b)) returned 1 [0095.504] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.504] GetModuleBaseNameW (in: hProcess=0x2f8, hModule=0x75ea0000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="MSCTF.dll") returned 0x9 [0095.504] CoTaskMemFree (pv=0x5d1c28) [0095.504] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.504] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x75ea0000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\MSCTF.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll")) returned 0x1d [0095.505] CoTaskMemFree (pv=0x5d1c28) [0095.505] GetModuleInformation (in: hProcess=0x2f8, hModule=0x75420000, lpmodinfo=0x221f42c, cb=0xc | out: lpmodinfo=0x221f42c*(lpBaseOfDll=0x75420000, SizeOfImage=0x9000, EntryPoint=0x75421220)) returned 1 [0095.505] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.505] GetModuleBaseNameW (in: hProcess=0x2f8, hModule=0x75420000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="VERSION.dll") returned 0xb [0095.505] CoTaskMemFree (pv=0x5d1c28) [0095.505] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.505] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x75420000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\system32\\VERSION.dll" (normalized: "c:\\windows\\system32\\version.dll")) returned 0x1f [0095.506] CoTaskMemFree (pv=0x5d1c28) [0095.506] GetModuleInformation (in: hProcess=0x2f8, hModule=0x74890000, lpmodinfo=0x2221538, cb=0xc | out: lpmodinfo=0x2221538*(lpBaseOfDll=0x74890000, SizeOfImage=0x6a8000, EntryPoint=0x749d7040)) returned 1 [0095.506] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.506] GetModuleBaseNameW (in: hProcess=0x2f8, hModule=0x74890000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="clr.dll") returned 0x7 [0095.506] CoTaskMemFree (pv=0x5d1c28) [0095.506] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.507] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x74890000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\clr.dll")) returned 0x35 [0095.507] CoTaskMemFree (pv=0x5d1c28) [0095.507] GetModuleInformation (in: hProcess=0x2f8, hModule=0x75320000, lpmodinfo=0x2223668, cb=0xc | out: lpmodinfo=0x2223668*(lpBaseOfDll=0x75320000, SizeOfImage=0xf5000, EntryPoint=0x75374160)) returned 1 [0095.507] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.507] GetModuleBaseNameW (in: hProcess=0x2f8, hModule=0x75320000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="MSVCR120_CLR0400.dll") returned 0x14 [0095.508] CoTaskMemFree (pv=0x5d1c28) [0095.508] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.508] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x75320000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\system32\\MSVCR120_CLR0400.dll" (normalized: "c:\\windows\\system32\\msvcr120_clr0400.dll")) returned 0x28 [0095.508] CoTaskMemFree (pv=0x5d1c28) [0095.508] GetModuleInformation (in: hProcess=0x2f8, hModule=0x72440000, lpmodinfo=0x222579c, cb=0xc | out: lpmodinfo=0x222579c*(lpBaseOfDll=0x72440000, SizeOfImage=0x122b000, EntryPoint=0x0)) returned 1 [0095.508] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.508] GetModuleBaseNameW (in: hProcess=0x2f8, hModule=0x72440000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="mscorlib.ni.dll") returned 0xf [0095.509] CoTaskMemFree (pv=0x5d1c28) [0095.509] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.509] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x72440000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\b7a12c4c0032847fcc6b9c710460456f\\mscorlib.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\mscorlib\\b7a12c4c0032847fcc6b9c710460456f\\mscorlib.ni.dll")) returned 0x68 [0095.509] CoTaskMemFree (pv=0x5d1c28) [0095.509] GetModuleInformation (in: hProcess=0x2f8, hModule=0x764e0000, lpmodinfo=0x2227944, cb=0xc | out: lpmodinfo=0x2227944*(lpBaseOfDll=0x764e0000, SizeOfImage=0x15c000, EntryPoint=0x7652ba3d)) returned 1 [0095.509] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.509] GetModuleBaseNameW (in: hProcess=0x2f8, hModule=0x764e0000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="ole32.dll") returned 0x9 [0095.510] CoTaskMemFree (pv=0x5d1c28) [0095.510] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.510] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x764e0000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll")) returned 0x1d [0095.510] CoTaskMemFree (pv=0x5d1c28) [0095.510] GetModuleInformation (in: hProcess=0x2f8, hModule=0x74f60000, lpmodinfo=0x2229a48, cb=0xc | out: lpmodinfo=0x2229a48*(lpBaseOfDll=0x74f60000, SizeOfImage=0x80000, EntryPoint=0x74f737c9)) returned 1 [0095.511] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.511] GetModuleBaseNameW (in: hProcess=0x2f8, hModule=0x74f60000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="uxtheme.dll") returned 0xb [0095.511] CoTaskMemFree (pv=0x5d1c28) [0095.511] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.511] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x74f60000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\system32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll")) returned 0x1f [0095.511] CoTaskMemFree (pv=0x5d1c28) [0095.511] GetModuleInformation (in: hProcess=0x2f8, hModule=0x752a0000, lpmodinfo=0x222bb54, cb=0xc | out: lpmodinfo=0x222bb54*(lpBaseOfDll=0x752a0000, SizeOfImage=0x7d000, EntryPoint=0x752a1140)) returned 1 [0095.512] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.512] GetModuleBaseNameW (in: hProcess=0x2f8, hModule=0x752a0000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="clrjit.dll") returned 0xa [0095.512] CoTaskMemFree (pv=0x5d1c28) [0095.512] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.512] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x752a0000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clrjit.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\clrjit.dll")) returned 0x38 [0095.513] CoTaskMemFree (pv=0x5d1c28) [0095.513] GetModuleInformation (in: hProcess=0x2f8, hModule=0x762b0000, lpmodinfo=0x222dc94, cb=0xc | out: lpmodinfo=0x222dc94*(lpBaseOfDll=0x762b0000, SizeOfImage=0x8f000, EntryPoint=0x762b3fb1)) returned 1 [0095.513] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.513] GetModuleBaseNameW (in: hProcess=0x2f8, hModule=0x762b0000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="OLEAUT32.dll") returned 0xc [0095.513] CoTaskMemFree (pv=0x5d1c28) [0095.513] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.513] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x762b0000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\OLEAUT32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll")) returned 0x20 [0095.514] CoTaskMemFree (pv=0x5d1c28) [0095.514] GetModuleInformation (in: hProcess=0x2f8, hModule=0x736d0000, lpmodinfo=0x222fda8, cb=0xc | out: lpmodinfo=0x222fda8*(lpBaseOfDll=0x736d0000, SizeOfImage=0x9ad000, EntryPoint=0x0)) returned 1 [0095.514] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.514] GetModuleBaseNameW (in: hProcess=0x2f8, hModule=0x736d0000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="System.ni.dll") returned 0xd [0095.515] CoTaskMemFree (pv=0x5d1c28) [0095.515] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.515] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x736d0000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System\\500ffa28b327e171fe664023003e947e\\System.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system\\500ffa28b327e171fe664023003e947e\\system.ni.dll")) returned 0x64 [0095.515] CoTaskMemFree (pv=0x5d1c28) [0095.515] GetModuleInformation (in: hProcess=0x2f8, hModule=0x71d20000, lpmodinfo=0x2231f44, cb=0xc | out: lpmodinfo=0x2231f44*(lpBaseOfDll=0x71d20000, SizeOfImage=0x716000, EntryPoint=0x0)) returned 1 [0095.516] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.516] GetModuleBaseNameW (in: hProcess=0x2f8, hModule=0x71d20000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="System.Core.ni.dll") returned 0x12 [0095.516] CoTaskMemFree (pv=0x5d1c28) [0095.516] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.516] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x71d20000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Core\\386fde9190d499d6645df8b90eb76242\\System.Core.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.core\\386fde9190d499d6645df8b90eb76242\\system.core.ni.dll")) returned 0x6e [0095.517] CoTaskMemFree (pv=0x5d1c28) [0095.517] GetModuleInformation (in: hProcess=0x2f8, hModule=0x750d0000, lpmodinfo=0x2234100, cb=0xc | out: lpmodinfo=0x2234100*(lpBaseOfDll=0x750d0000, SizeOfImage=0x1cb000, EntryPoint=0x0)) returned 1 [0095.517] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.517] GetModuleBaseNameW (in: hProcess=0x2f8, hModule=0x750d0000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="Microsoft.VisualBasic.ni.dll") returned 0x1c [0095.517] CoTaskMemFree (pv=0x5d1c28) [0095.517] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.517] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x750d0000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Microsoft.V9921e851#\\cfbddeb6e93e8f421b92229b20e51233\\Microsoft.VisualBasic.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\microsoft.v9921e851#\\cfbddeb6e93e8f421b92229b20e51233\\microsoft.visualbasic.ni.dll")) returned 0x81 [0095.518] CoTaskMemFree (pv=0x5d1c28) [0095.518] GetModuleInformation (in: hProcess=0x2f8, hModule=0x750b0000, lpmodinfo=0x22362f4, cb=0xc | out: lpmodinfo=0x22362f4*(lpBaseOfDll=0x750b0000, SizeOfImage=0x13000, EntryPoint=0x750b18f0)) returned 1 [0095.518] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.518] GetModuleBaseNameW (in: hProcess=0x2f8, hModule=0x750b0000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="nlssorting.dll") returned 0xe [0095.519] CoTaskMemFree (pv=0x5d1c28) [0095.519] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.519] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x750b0000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\nlssorting.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\nlssorting.dll")) returned 0x3c [0095.519] CoTaskMemFree (pv=0x5d1c28) [0095.519] GetModuleInformation (in: hProcess=0x2f8, hModule=0x74870000, lpmodinfo=0x2238444, cb=0xc | out: lpmodinfo=0x2238444*(lpBaseOfDll=0x74870000, SizeOfImage=0x16000, EntryPoint=0x74872dc3)) returned 1 [0095.520] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.520] GetModuleBaseNameW (in: hProcess=0x2f8, hModule=0x74870000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="CRYPTSP.dll") returned 0xb [0095.520] CoTaskMemFree (pv=0x5d1c28) [0095.520] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.520] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x74870000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\system32\\CRYPTSP.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll")) returned 0x1f [0095.521] CoTaskMemFree (pv=0x5d1c28) [0095.521] GetModuleInformation (in: hProcess=0x2f8, hModule=0x74830000, lpmodinfo=0x223a550, cb=0xc | out: lpmodinfo=0x223a550*(lpBaseOfDll=0x74830000, SizeOfImage=0x3b000, EntryPoint=0x7483128d)) returned 1 [0095.521] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.521] GetModuleBaseNameW (in: hProcess=0x2f8, hModule=0x74830000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="rsaenh.dll") returned 0xa [0095.522] CoTaskMemFree (pv=0x5d1c28) [0095.522] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.522] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x74830000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\system32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll")) returned 0x1e [0095.522] CoTaskMemFree (pv=0x5d1c28) [0095.522] GetModuleInformation (in: hProcess=0x2f8, hModule=0x75a60000, lpmodinfo=0x223c768, cb=0xc | out: lpmodinfo=0x223c768*(lpBaseOfDll=0x75a60000, SizeOfImage=0x5000, EntryPoint=0x75a61438)) returned 1 [0095.523] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.523] GetModuleBaseNameW (in: hProcess=0x2f8, hModule=0x75a60000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="psapi.dll") returned 0x9 [0095.523] CoTaskMemFree (pv=0x5d1c28) [0095.523] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.523] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x75a60000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\psapi.dll" (normalized: "c:\\windows\\syswow64\\psapi.dll")) returned 0x1d [0095.524] CoTaskMemFree (pv=0x5d1c28) [0095.524] GetModuleInformation (in: hProcess=0x2f8, hModule=0x746a0000, lpmodinfo=0x223e86c, cb=0xc | out: lpmodinfo=0x223e86c*(lpBaseOfDll=0x746a0000, SizeOfImage=0x18d000, EntryPoint=0x0)) returned 1 [0095.524] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.524] GetModuleBaseNameW (in: hProcess=0x2f8, hModule=0x746a0000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="System.Drawing.ni.dll") returned 0x15 [0095.525] CoTaskMemFree (pv=0x5d1c28) [0095.525] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.525] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x746a0000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Drawing\\553c0312fdf5a5449f3649f0515e70fb\\System.Drawing.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.drawing\\553c0312fdf5a5449f3649f0515e70fb\\system.drawing.ni.dll")) returned 0x74 [0095.525] CoTaskMemFree (pv=0x5d1c28) [0095.525] GetModuleInformation (in: hProcess=0x2f8, hModule=0x710c0000, lpmodinfo=0x2240a38, cb=0xc | out: lpmodinfo=0x2240a38*(lpBaseOfDll=0x710c0000, SizeOfImage=0xc58000, EntryPoint=0x0)) returned 1 [0095.526] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.526] GetModuleBaseNameW (in: hProcess=0x2f8, hModule=0x710c0000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="System.Windows.Forms.ni.dll") returned 0x1b [0095.526] CoTaskMemFree (pv=0x5d1c28) [0095.526] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.526] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x710c0000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Windows.Forms\\7a6894982f35a1d75ec73d447c583da2\\System.Windows.Forms.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.windows.forms\\7a6894982f35a1d75ec73d447c583da2\\system.windows.forms.ni.dll")) returned 0x80 [0095.527] CoTaskMemFree (pv=0x5d1c28) [0095.527] CloseHandle (hObject=0x2f8) returned 1 [0095.537] GetCurrentProcessId () returned 0x9f8 [0095.537] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x9f8) returned 0x2f8 [0095.537] EnumProcessModules (in: hProcess=0x2f8, lphModule=0x22a8bd4, cb=0x100, lpcbNeeded=0x4990c0 | out: lphModule=0x22a8bd4, lpcbNeeded=0x4990c0) returned 1 [0095.537] GetModuleInformation (in: hProcess=0x2f8, hModule=0x310000, lpmodinfo=0x22a8d14, cb=0xc | out: lpmodinfo=0x22a8d14*(lpBaseOfDll=0x310000, SizeOfImage=0x3e000, EntryPoint=0x3479ce)) returned 1 [0095.537] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.537] GetModuleBaseNameW (in: hProcess=0x2f8, hModule=0x310000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="unlikexpc.exe") returned 0xd [0095.538] CoTaskMemFree (pv=0x5d1c28) [0095.538] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.538] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x310000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\unlikexpc.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\unlikexpc.exe")) returned 0x33 [0095.538] CoTaskMemFree (pv=0x5d1c28) [0095.538] GetModuleInformation (in: hProcess=0x2f8, hModule=0x77ab0000, lpmodinfo=0x22aae68, cb=0xc | out: lpmodinfo=0x22aae68*(lpBaseOfDll=0x77ab0000, SizeOfImage=0x180000, EntryPoint=0x0)) returned 1 [0095.538] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.538] GetModuleBaseNameW (in: hProcess=0x2f8, hModule=0x77ab0000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="ntdll.dll") returned 0x9 [0095.538] CoTaskMemFree (pv=0x5d1c28) [0095.538] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.538] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x77ab0000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll")) returned 0x1d [0095.538] CoTaskMemFree (pv=0x5d1c28) [0095.538] GetModuleInformation (in: hProcess=0x2f8, hModule=0x754b0000, lpmodinfo=0x22acf6c, cb=0xc | out: lpmodinfo=0x22acf6c*(lpBaseOfDll=0x754b0000, SizeOfImage=0x4a000, EntryPoint=0x754b2e54)) returned 1 [0095.538] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.538] GetModuleBaseNameW (in: hProcess=0x2f8, hModule=0x754b0000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="MSCOREE.DLL") returned 0xb [0095.539] CoTaskMemFree (pv=0x5d1c28) [0095.539] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.539] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x754b0000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\MSCOREE.DLL" (normalized: "c:\\windows\\system32\\mscoree.dll")) returned 0x1f [0095.539] CoTaskMemFree (pv=0x5d1c28) [0095.539] GetModuleInformation (in: hProcess=0x2f8, hModule=0x757c0000, lpmodinfo=0x22af078, cb=0xc | out: lpmodinfo=0x22af078*(lpBaseOfDll=0x757c0000, SizeOfImage=0x110000, EntryPoint=0x757d32d3)) returned 1 [0095.539] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.539] GetModuleBaseNameW (in: hProcess=0x2f8, hModule=0x757c0000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="KERNEL32.dll") returned 0xc [0095.539] CoTaskMemFree (pv=0x5d1c28) [0095.539] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.539] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x757c0000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\KERNEL32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll")) returned 0x20 [0095.539] CoTaskMemFree (pv=0x5d1c28) [0095.539] GetModuleInformation (in: hProcess=0x2f8, hModule=0x76260000, lpmodinfo=0x22b118c, cb=0xc | out: lpmodinfo=0x22b118c*(lpBaseOfDll=0x76260000, SizeOfImage=0x46000, EntryPoint=0x76267478)) returned 1 [0095.539] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.539] GetModuleBaseNameW (in: hProcess=0x2f8, hModule=0x76260000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="KERNELBASE.dll") returned 0xe [0095.540] CoTaskMemFree (pv=0x5d1c28) [0095.540] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.540] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x76260000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\KERNELBASE.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll")) returned 0x22 [0095.540] CoTaskMemFree (pv=0x5d1c28) [0095.540] GetModuleInformation (in: hProcess=0x2f8, hModule=0x75720000, lpmodinfo=0x22b32d4, cb=0xc | out: lpmodinfo=0x22b32d4*(lpBaseOfDll=0x75720000, SizeOfImage=0xa0000, EntryPoint=0x757349e5)) returned 1 [0095.540] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.540] GetModuleBaseNameW (in: hProcess=0x2f8, hModule=0x75720000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="ADVAPI32.dll") returned 0xc [0095.540] CoTaskMemFree (pv=0x5d1c28) [0095.540] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.540] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x75720000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\ADVAPI32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll")) returned 0x20 [0095.540] CoTaskMemFree (pv=0x5d1c28) [0095.540] GetModuleInformation (in: hProcess=0x2f8, hModule=0x75fe0000, lpmodinfo=0x22b53e8, cb=0xc | out: lpmodinfo=0x22b53e8*(lpBaseOfDll=0x75fe0000, SizeOfImage=0xac000, EntryPoint=0x75fea472)) returned 1 [0095.541] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.541] GetModuleBaseNameW (in: hProcess=0x2f8, hModule=0x75fe0000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="msvcrt.dll") returned 0xa [0095.541] CoTaskMemFree (pv=0x5d1c28) [0095.541] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.541] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x75fe0000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll")) returned 0x1e [0095.541] CoTaskMemFree (pv=0x5d1c28) [0095.541] GetModuleInformation (in: hProcess=0x2f8, hModule=0x761b0000, lpmodinfo=0x22b74f4, cb=0xc | out: lpmodinfo=0x22b74f4*(lpBaseOfDll=0x761b0000, SizeOfImage=0x19000, EntryPoint=0x761b4975)) returned 1 [0095.541] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.541] GetModuleBaseNameW (in: hProcess=0x2f8, hModule=0x761b0000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="sechost.dll") returned 0xb [0095.542] CoTaskMemFree (pv=0x5d1c28) [0095.542] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.542] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x761b0000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll")) returned 0x1f [0095.542] CoTaskMemFree (pv=0x5d1c28) [0095.542] GetModuleInformation (in: hProcess=0x2f8, hModule=0x76090000, lpmodinfo=0x22b9600, cb=0xc | out: lpmodinfo=0x22b9600*(lpBaseOfDll=0x76090000, SizeOfImage=0xf0000, EntryPoint=0x760a0569)) returned 1 [0095.542] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.542] GetModuleBaseNameW (in: hProcess=0x2f8, hModule=0x76090000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="RPCRT4.dll") returned 0xa [0095.542] CoTaskMemFree (pv=0x5d1c28) [0095.542] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.542] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x76090000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\RPCRT4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll")) returned 0x1e [0095.542] CoTaskMemFree (pv=0x5d1c28) [0095.542] GetModuleInformation (in: hProcess=0x2f8, hModule=0x75610000, lpmodinfo=0x22bb758, cb=0xc | out: lpmodinfo=0x22bb758*(lpBaseOfDll=0x75610000, SizeOfImage=0x60000, EntryPoint=0x7562a3b3)) returned 1 [0095.543] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.543] GetModuleBaseNameW (in: hProcess=0x2f8, hModule=0x75610000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="SspiCli.dll") returned 0xb [0095.543] CoTaskMemFree (pv=0x5d1c28) [0095.543] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.543] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x75610000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\SspiCli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll")) returned 0x1f [0095.543] CoTaskMemFree (pv=0x5d1c28) [0095.543] GetModuleInformation (in: hProcess=0x2f8, hModule=0x75600000, lpmodinfo=0x22bd864, cb=0xc | out: lpmodinfo=0x22bd864*(lpBaseOfDll=0x75600000, SizeOfImage=0xc000, EntryPoint=0x756010e1)) returned 1 [0095.543] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.543] GetModuleBaseNameW (in: hProcess=0x2f8, hModule=0x75600000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="CRYPTBASE.dll") returned 0xd [0095.544] CoTaskMemFree (pv=0x5d1c28) [0095.544] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.544] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x75600000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\CRYPTBASE.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll")) returned 0x21 [0095.544] CoTaskMemFree (pv=0x5d1c28) [0095.544] GetModuleInformation (in: hProcess=0x2f8, hModule=0x75430000, lpmodinfo=0x22bf978, cb=0xc | out: lpmodinfo=0x22bf978*(lpBaseOfDll=0x75430000, SizeOfImage=0x78000, EntryPoint=0x7543f7ba)) returned 1 [0095.544] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.544] GetModuleBaseNameW (in: hProcess=0x2f8, hModule=0x75430000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="mscoreei.dll") returned 0xc [0095.544] CoTaskMemFree (pv=0x5d1c28) [0095.544] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.545] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x75430000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscoreei.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\mscoreei.dll")) returned 0x3a [0095.545] CoTaskMemFree (pv=0x5d1c28) [0095.545] GetModuleInformation (in: hProcess=0x2f8, hModule=0x761d0000, lpmodinfo=0x22c1ac0, cb=0xc | out: lpmodinfo=0x22c1ac0*(lpBaseOfDll=0x761d0000, SizeOfImage=0x57000, EntryPoint=0x761e9ba6)) returned 1 [0095.545] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.545] GetModuleBaseNameW (in: hProcess=0x2f8, hModule=0x761d0000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="SHLWAPI.dll") returned 0xb [0095.545] CoTaskMemFree (pv=0x5d1c28) [0095.545] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.545] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x761d0000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\SHLWAPI.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll")) returned 0x1f [0095.546] CoTaskMemFree (pv=0x5d1c28) [0095.546] GetModuleInformation (in: hProcess=0x2f8, hModule=0x766d0000, lpmodinfo=0x22c3bcc, cb=0xc | out: lpmodinfo=0x22c3bcc*(lpBaseOfDll=0x766d0000, SizeOfImage=0x90000, EntryPoint=0x766e6343)) returned 1 [0095.546] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.546] GetModuleBaseNameW (in: hProcess=0x2f8, hModule=0x766d0000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="GDI32.dll") returned 0x9 [0095.546] CoTaskMemFree (pv=0x5d1c28) [0095.546] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.546] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x766d0000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\GDI32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll")) returned 0x1d [0095.546] CoTaskMemFree (pv=0x5d1c28) [0095.546] GetModuleInformation (in: hProcess=0x2f8, hModule=0x775b0000, lpmodinfo=0x22c5cd0, cb=0xc | out: lpmodinfo=0x22c5cd0*(lpBaseOfDll=0x775b0000, SizeOfImage=0x100000, EntryPoint=0x775cb6ed)) returned 1 [0095.547] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.547] GetModuleBaseNameW (in: hProcess=0x2f8, hModule=0x775b0000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="USER32.dll") returned 0xa [0095.547] CoTaskMemFree (pv=0x5d1c28) [0095.547] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.547] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x775b0000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\USER32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll")) returned 0x1e [0095.547] CoTaskMemFree (pv=0x5d1c28) [0095.547] GetModuleInformation (in: hProcess=0x2f8, hModule=0x75a70000, lpmodinfo=0x22c7ddc, cb=0xc | out: lpmodinfo=0x22c7ddc*(lpBaseOfDll=0x75a70000, SizeOfImage=0xa000, EntryPoint=0x75a736a0)) returned 1 [0095.548] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.548] GetModuleBaseNameW (in: hProcess=0x2f8, hModule=0x75a70000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="LPK.dll") returned 0x7 [0095.548] CoTaskMemFree (pv=0x5d1c28) [0095.548] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.548] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x75a70000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\LPK.dll" (normalized: "c:\\windows\\syswow64\\lpk.dll")) returned 0x1b [0095.548] CoTaskMemFree (pv=0x5d1c28) [0095.548] GetModuleInformation (in: hProcess=0x2f8, hModule=0x758d0000, lpmodinfo=0x22c9ed8, cb=0xc | out: lpmodinfo=0x22c9ed8*(lpBaseOfDll=0x758d0000, SizeOfImage=0x9d000, EntryPoint=0x75903fd7)) returned 1 [0095.549] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.549] GetModuleBaseNameW (in: hProcess=0x2f8, hModule=0x758d0000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="USP10.dll") returned 0x9 [0095.549] CoTaskMemFree (pv=0x5d1c28) [0095.549] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.549] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x758d0000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\USP10.dll" (normalized: "c:\\windows\\syswow64\\usp10.dll")) returned 0x1d [0095.549] CoTaskMemFree (pv=0x5d1c28) [0095.549] GetModuleInformation (in: hProcess=0x2f8, hModule=0x75f80000, lpmodinfo=0x22cc068, cb=0xc | out: lpmodinfo=0x22cc068*(lpBaseOfDll=0x75f80000, SizeOfImage=0x60000, EntryPoint=0x75f9158f)) returned 1 [0095.549] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.550] GetModuleBaseNameW (in: hProcess=0x2f8, hModule=0x75f80000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="IMM32.DLL") returned 0x9 [0095.550] CoTaskMemFree (pv=0x5d1c28) [0095.550] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.550] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x75f80000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\system32\\IMM32.DLL" (normalized: "c:\\windows\\system32\\imm32.dll")) returned 0x1d [0095.550] CoTaskMemFree (pv=0x5d1c28) [0095.550] GetModuleInformation (in: hProcess=0x2f8, hModule=0x75ea0000, lpmodinfo=0x22ce16c, cb=0xc | out: lpmodinfo=0x22ce16c*(lpBaseOfDll=0x75ea0000, SizeOfImage=0xcc000, EntryPoint=0x75ea168b)) returned 1 [0095.550] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.550] GetModuleBaseNameW (in: hProcess=0x2f8, hModule=0x75ea0000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="MSCTF.dll") returned 0x9 [0095.551] CoTaskMemFree (pv=0x5d1c28) [0095.551] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.551] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x75ea0000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\MSCTF.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll")) returned 0x1d [0095.551] CoTaskMemFree (pv=0x5d1c28) [0095.551] GetModuleInformation (in: hProcess=0x2f8, hModule=0x75420000, lpmodinfo=0x22d0270, cb=0xc | out: lpmodinfo=0x22d0270*(lpBaseOfDll=0x75420000, SizeOfImage=0x9000, EntryPoint=0x75421220)) returned 1 [0095.551] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.551] GetModuleBaseNameW (in: hProcess=0x2f8, hModule=0x75420000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="VERSION.dll") returned 0xb [0095.552] CoTaskMemFree (pv=0x5d1c28) [0095.552] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.552] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x75420000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\system32\\VERSION.dll" (normalized: "c:\\windows\\system32\\version.dll")) returned 0x1f [0095.552] CoTaskMemFree (pv=0x5d1c28) [0095.552] GetModuleInformation (in: hProcess=0x2f8, hModule=0x74890000, lpmodinfo=0x22d237c, cb=0xc | out: lpmodinfo=0x22d237c*(lpBaseOfDll=0x74890000, SizeOfImage=0x6a8000, EntryPoint=0x749d7040)) returned 1 [0095.552] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.552] GetModuleBaseNameW (in: hProcess=0x2f8, hModule=0x74890000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="clr.dll") returned 0x7 [0095.553] CoTaskMemFree (pv=0x5d1c28) [0095.553] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.553] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x74890000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\clr.dll")) returned 0x35 [0095.553] CoTaskMemFree (pv=0x5d1c28) [0095.553] GetModuleInformation (in: hProcess=0x2f8, hModule=0x75320000, lpmodinfo=0x22d44ac, cb=0xc | out: lpmodinfo=0x22d44ac*(lpBaseOfDll=0x75320000, SizeOfImage=0xf5000, EntryPoint=0x75374160)) returned 1 [0095.554] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.554] GetModuleBaseNameW (in: hProcess=0x2f8, hModule=0x75320000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="MSVCR120_CLR0400.dll") returned 0x14 [0095.554] CoTaskMemFree (pv=0x5d1c28) [0095.554] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.554] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x75320000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\system32\\MSVCR120_CLR0400.dll" (normalized: "c:\\windows\\system32\\msvcr120_clr0400.dll")) returned 0x28 [0095.554] CoTaskMemFree (pv=0x5d1c28) [0095.554] GetModuleInformation (in: hProcess=0x2f8, hModule=0x72440000, lpmodinfo=0x22d65e0, cb=0xc | out: lpmodinfo=0x22d65e0*(lpBaseOfDll=0x72440000, SizeOfImage=0x122b000, EntryPoint=0x0)) returned 1 [0095.555] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.555] GetModuleBaseNameW (in: hProcess=0x2f8, hModule=0x72440000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="mscorlib.ni.dll") returned 0xf [0095.555] CoTaskMemFree (pv=0x5d1c28) [0095.555] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.555] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x72440000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\b7a12c4c0032847fcc6b9c710460456f\\mscorlib.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\mscorlib\\b7a12c4c0032847fcc6b9c710460456f\\mscorlib.ni.dll")) returned 0x68 [0095.555] CoTaskMemFree (pv=0x5d1c28) [0095.555] GetModuleInformation (in: hProcess=0x2f8, hModule=0x764e0000, lpmodinfo=0x22d8788, cb=0xc | out: lpmodinfo=0x22d8788*(lpBaseOfDll=0x764e0000, SizeOfImage=0x15c000, EntryPoint=0x7652ba3d)) returned 1 [0095.556] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.556] GetModuleBaseNameW (in: hProcess=0x2f8, hModule=0x764e0000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="ole32.dll") returned 0x9 [0095.556] CoTaskMemFree (pv=0x5d1c28) [0095.556] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.556] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x764e0000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll")) returned 0x1d [0095.557] CoTaskMemFree (pv=0x5d1c28) [0095.557] GetModuleInformation (in: hProcess=0x2f8, hModule=0x74f60000, lpmodinfo=0x22da88c, cb=0xc | out: lpmodinfo=0x22da88c*(lpBaseOfDll=0x74f60000, SizeOfImage=0x80000, EntryPoint=0x74f737c9)) returned 1 [0095.557] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.557] GetModuleBaseNameW (in: hProcess=0x2f8, hModule=0x74f60000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="uxtheme.dll") returned 0xb [0095.557] CoTaskMemFree (pv=0x5d1c28) [0095.557] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.557] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x74f60000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\system32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll")) returned 0x1f [0095.558] CoTaskMemFree (pv=0x5d1c28) [0095.558] GetModuleInformation (in: hProcess=0x2f8, hModule=0x752a0000, lpmodinfo=0x22dc998, cb=0xc | out: lpmodinfo=0x22dc998*(lpBaseOfDll=0x752a0000, SizeOfImage=0x7d000, EntryPoint=0x752a1140)) returned 1 [0095.558] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.558] GetModuleBaseNameW (in: hProcess=0x2f8, hModule=0x752a0000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="clrjit.dll") returned 0xa [0095.559] CoTaskMemFree (pv=0x5d1c28) [0095.559] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.559] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x752a0000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clrjit.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\clrjit.dll")) returned 0x38 [0095.559] CoTaskMemFree (pv=0x5d1c28) [0095.559] GetModuleInformation (in: hProcess=0x2f8, hModule=0x762b0000, lpmodinfo=0x22dead8, cb=0xc | out: lpmodinfo=0x22dead8*(lpBaseOfDll=0x762b0000, SizeOfImage=0x8f000, EntryPoint=0x762b3fb1)) returned 1 [0095.559] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.559] GetModuleBaseNameW (in: hProcess=0x2f8, hModule=0x762b0000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="OLEAUT32.dll") returned 0xc [0095.560] CoTaskMemFree (pv=0x5d1c28) [0095.560] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.560] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x762b0000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\OLEAUT32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll")) returned 0x20 [0095.560] CoTaskMemFree (pv=0x5d1c28) [0095.560] GetModuleInformation (in: hProcess=0x2f8, hModule=0x736d0000, lpmodinfo=0x22e0bec, cb=0xc | out: lpmodinfo=0x22e0bec*(lpBaseOfDll=0x736d0000, SizeOfImage=0x9ad000, EntryPoint=0x0)) returned 1 [0095.561] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.561] GetModuleBaseNameW (in: hProcess=0x2f8, hModule=0x736d0000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="System.ni.dll") returned 0xd [0095.561] CoTaskMemFree (pv=0x5d1c28) [0095.561] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.561] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x736d0000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System\\500ffa28b327e171fe664023003e947e\\System.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system\\500ffa28b327e171fe664023003e947e\\system.ni.dll")) returned 0x64 [0095.562] CoTaskMemFree (pv=0x5d1c28) [0095.562] GetModuleInformation (in: hProcess=0x2f8, hModule=0x71d20000, lpmodinfo=0x22e2d88, cb=0xc | out: lpmodinfo=0x22e2d88*(lpBaseOfDll=0x71d20000, SizeOfImage=0x716000, EntryPoint=0x0)) returned 1 [0095.562] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.562] GetModuleBaseNameW (in: hProcess=0x2f8, hModule=0x71d20000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="System.Core.ni.dll") returned 0x12 [0095.562] CoTaskMemFree (pv=0x5d1c28) [0095.562] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.562] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x71d20000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Core\\386fde9190d499d6645df8b90eb76242\\System.Core.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.core\\386fde9190d499d6645df8b90eb76242\\system.core.ni.dll")) returned 0x6e [0095.563] CoTaskMemFree (pv=0x5d1c28) [0095.563] GetModuleInformation (in: hProcess=0x2f8, hModule=0x750d0000, lpmodinfo=0x22e4f44, cb=0xc | out: lpmodinfo=0x22e4f44*(lpBaseOfDll=0x750d0000, SizeOfImage=0x1cb000, EntryPoint=0x0)) returned 1 [0095.563] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.563] GetModuleBaseNameW (in: hProcess=0x2f8, hModule=0x750d0000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="Microsoft.VisualBasic.ni.dll") returned 0x1c [0095.564] CoTaskMemFree (pv=0x5d1c28) [0095.564] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.564] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x750d0000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Microsoft.V9921e851#\\cfbddeb6e93e8f421b92229b20e51233\\Microsoft.VisualBasic.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\microsoft.v9921e851#\\cfbddeb6e93e8f421b92229b20e51233\\microsoft.visualbasic.ni.dll")) returned 0x81 [0095.564] CoTaskMemFree (pv=0x5d1c28) [0095.564] GetModuleInformation (in: hProcess=0x2f8, hModule=0x750b0000, lpmodinfo=0x22e7138, cb=0xc | out: lpmodinfo=0x22e7138*(lpBaseOfDll=0x750b0000, SizeOfImage=0x13000, EntryPoint=0x750b18f0)) returned 1 [0095.565] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.565] GetModuleBaseNameW (in: hProcess=0x2f8, hModule=0x750b0000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="nlssorting.dll") returned 0xe [0095.565] CoTaskMemFree (pv=0x5d1c28) [0095.565] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.565] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x750b0000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\nlssorting.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\nlssorting.dll")) returned 0x3c [0095.566] CoTaskMemFree (pv=0x5d1c28) [0095.566] GetModuleInformation (in: hProcess=0x2f8, hModule=0x74870000, lpmodinfo=0x22e9288, cb=0xc | out: lpmodinfo=0x22e9288*(lpBaseOfDll=0x74870000, SizeOfImage=0x16000, EntryPoint=0x74872dc3)) returned 1 [0095.566] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.566] GetModuleBaseNameW (in: hProcess=0x2f8, hModule=0x74870000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="CRYPTSP.dll") returned 0xb [0095.567] CoTaskMemFree (pv=0x5d1c28) [0095.567] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.567] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x74870000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\system32\\CRYPTSP.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll")) returned 0x1f [0095.567] CoTaskMemFree (pv=0x5d1c28) [0095.567] GetModuleInformation (in: hProcess=0x2f8, hModule=0x74830000, lpmodinfo=0x22eb394, cb=0xc | out: lpmodinfo=0x22eb394*(lpBaseOfDll=0x74830000, SizeOfImage=0x3b000, EntryPoint=0x7483128d)) returned 1 [0095.567] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.568] GetModuleBaseNameW (in: hProcess=0x2f8, hModule=0x74830000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="rsaenh.dll") returned 0xa [0095.568] CoTaskMemFree (pv=0x5d1c28) [0095.568] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.568] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x74830000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\system32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll")) returned 0x1e [0095.569] CoTaskMemFree (pv=0x5d1c28) [0095.569] GetModuleInformation (in: hProcess=0x2f8, hModule=0x75a60000, lpmodinfo=0x22ed5ac, cb=0xc | out: lpmodinfo=0x22ed5ac*(lpBaseOfDll=0x75a60000, SizeOfImage=0x5000, EntryPoint=0x75a61438)) returned 1 [0095.569] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.569] GetModuleBaseNameW (in: hProcess=0x2f8, hModule=0x75a60000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="psapi.dll") returned 0x9 [0095.569] CoTaskMemFree (pv=0x5d1c28) [0095.569] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.570] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x75a60000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\psapi.dll" (normalized: "c:\\windows\\syswow64\\psapi.dll")) returned 0x1d [0095.570] CoTaskMemFree (pv=0x5d1c28) [0095.570] GetModuleInformation (in: hProcess=0x2f8, hModule=0x746a0000, lpmodinfo=0x22ef6b0, cb=0xc | out: lpmodinfo=0x22ef6b0*(lpBaseOfDll=0x746a0000, SizeOfImage=0x18d000, EntryPoint=0x0)) returned 1 [0095.570] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.570] GetModuleBaseNameW (in: hProcess=0x2f8, hModule=0x746a0000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="System.Drawing.ni.dll") returned 0x15 [0095.571] CoTaskMemFree (pv=0x5d1c28) [0095.571] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.571] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x746a0000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Drawing\\553c0312fdf5a5449f3649f0515e70fb\\System.Drawing.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.drawing\\553c0312fdf5a5449f3649f0515e70fb\\system.drawing.ni.dll")) returned 0x74 [0095.571] CoTaskMemFree (pv=0x5d1c28) [0095.572] GetModuleInformation (in: hProcess=0x2f8, hModule=0x710c0000, lpmodinfo=0x22f187c, cb=0xc | out: lpmodinfo=0x22f187c*(lpBaseOfDll=0x710c0000, SizeOfImage=0xc58000, EntryPoint=0x0)) returned 1 [0095.572] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.572] GetModuleBaseNameW (in: hProcess=0x2f8, hModule=0x710c0000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="System.Windows.Forms.ni.dll") returned 0x1b [0095.572] CoTaskMemFree (pv=0x5d1c28) [0095.573] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.573] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x710c0000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Windows.Forms\\7a6894982f35a1d75ec73d447c583da2\\System.Windows.Forms.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.windows.forms\\7a6894982f35a1d75ec73d447c583da2\\system.windows.forms.ni.dll")) returned 0x80 [0095.573] CoTaskMemFree (pv=0x5d1c28) [0095.573] CloseHandle (hObject=0x2f8) returned 1 [0095.577] GetCurrentProcessId () returned 0x9f8 [0095.577] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x9f8) returned 0x2f8 [0095.577] EnumProcessModules (in: hProcess=0x2f8, lphModule=0x21e7a7c, cb=0x100, lpcbNeeded=0x4990c0 | out: lphModule=0x21e7a7c, lpcbNeeded=0x4990c0) returned 1 [0095.578] GetModuleInformation (in: hProcess=0x2f8, hModule=0x310000, lpmodinfo=0x21e7bbc, cb=0xc | out: lpmodinfo=0x21e7bbc*(lpBaseOfDll=0x310000, SizeOfImage=0x3e000, EntryPoint=0x3479ce)) returned 1 [0095.578] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.578] GetModuleBaseNameW (in: hProcess=0x2f8, hModule=0x310000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="unlikexpc.exe") returned 0xd [0095.578] CoTaskMemFree (pv=0x5d1c28) [0095.578] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.578] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x310000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\unlikexpc.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\unlikexpc.exe")) returned 0x33 [0095.578] CoTaskMemFree (pv=0x5d1c28) [0095.578] GetModuleInformation (in: hProcess=0x2f8, hModule=0x77ab0000, lpmodinfo=0x21e9d10, cb=0xc | out: lpmodinfo=0x21e9d10*(lpBaseOfDll=0x77ab0000, SizeOfImage=0x180000, EntryPoint=0x0)) returned 1 [0095.578] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.578] GetModuleBaseNameW (in: hProcess=0x2f8, hModule=0x77ab0000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="ntdll.dll") returned 0x9 [0095.578] CoTaskMemFree (pv=0x5d1c28) [0095.578] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.578] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x77ab0000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll")) returned 0x1d [0095.578] CoTaskMemFree (pv=0x5d1c28) [0095.578] GetModuleInformation (in: hProcess=0x2f8, hModule=0x754b0000, lpmodinfo=0x21ebe14, cb=0xc | out: lpmodinfo=0x21ebe14*(lpBaseOfDll=0x754b0000, SizeOfImage=0x4a000, EntryPoint=0x754b2e54)) returned 1 [0095.579] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.579] GetModuleBaseNameW (in: hProcess=0x2f8, hModule=0x754b0000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="MSCOREE.DLL") returned 0xb [0095.579] CoTaskMemFree (pv=0x5d1c28) [0095.579] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.579] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x754b0000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\MSCOREE.DLL" (normalized: "c:\\windows\\system32\\mscoree.dll")) returned 0x1f [0095.579] CoTaskMemFree (pv=0x5d1c28) [0095.579] GetModuleInformation (in: hProcess=0x2f8, hModule=0x757c0000, lpmodinfo=0x21edf20, cb=0xc | out: lpmodinfo=0x21edf20*(lpBaseOfDll=0x757c0000, SizeOfImage=0x110000, EntryPoint=0x757d32d3)) returned 1 [0095.579] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.579] GetModuleBaseNameW (in: hProcess=0x2f8, hModule=0x757c0000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="KERNEL32.dll") returned 0xc [0095.579] CoTaskMemFree (pv=0x5d1c28) [0095.579] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.579] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x757c0000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\KERNEL32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll")) returned 0x20 [0095.579] CoTaskMemFree (pv=0x5d1c28) [0095.579] GetModuleInformation (in: hProcess=0x2f8, hModule=0x76260000, lpmodinfo=0x21f0034, cb=0xc | out: lpmodinfo=0x21f0034*(lpBaseOfDll=0x76260000, SizeOfImage=0x46000, EntryPoint=0x76267478)) returned 1 [0095.580] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.580] GetModuleBaseNameW (in: hProcess=0x2f8, hModule=0x76260000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="KERNELBASE.dll") returned 0xe [0095.580] CoTaskMemFree (pv=0x5d1c28) [0095.580] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.580] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x76260000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\KERNELBASE.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll")) returned 0x22 [0095.580] CoTaskMemFree (pv=0x5d1c28) [0095.580] GetModuleInformation (in: hProcess=0x2f8, hModule=0x75720000, lpmodinfo=0x21f217c, cb=0xc | out: lpmodinfo=0x21f217c*(lpBaseOfDll=0x75720000, SizeOfImage=0xa0000, EntryPoint=0x757349e5)) returned 1 [0095.580] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.580] GetModuleBaseNameW (in: hProcess=0x2f8, hModule=0x75720000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="ADVAPI32.dll") returned 0xc [0095.580] CoTaskMemFree (pv=0x5d1c28) [0095.580] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.580] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x75720000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\ADVAPI32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll")) returned 0x20 [0095.580] CoTaskMemFree (pv=0x5d1c28) [0095.581] GetModuleInformation (in: hProcess=0x2f8, hModule=0x75fe0000, lpmodinfo=0x21f4290, cb=0xc | out: lpmodinfo=0x21f4290*(lpBaseOfDll=0x75fe0000, SizeOfImage=0xac000, EntryPoint=0x75fea472)) returned 1 [0095.581] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.581] GetModuleBaseNameW (in: hProcess=0x2f8, hModule=0x75fe0000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="msvcrt.dll") returned 0xa [0095.581] CoTaskMemFree (pv=0x5d1c28) [0095.581] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.581] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x75fe0000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll")) returned 0x1e [0095.581] CoTaskMemFree (pv=0x5d1c28) [0095.581] GetModuleInformation (in: hProcess=0x2f8, hModule=0x761b0000, lpmodinfo=0x21f639c, cb=0xc | out: lpmodinfo=0x21f639c*(lpBaseOfDll=0x761b0000, SizeOfImage=0x19000, EntryPoint=0x761b4975)) returned 1 [0095.581] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.581] GetModuleBaseNameW (in: hProcess=0x2f8, hModule=0x761b0000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="sechost.dll") returned 0xb [0095.581] CoTaskMemFree (pv=0x5d1c28) [0095.581] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.582] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x761b0000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll")) returned 0x1f [0095.582] CoTaskMemFree (pv=0x5d1c28) [0095.582] GetModuleInformation (in: hProcess=0x2f8, hModule=0x76090000, lpmodinfo=0x21f84a8, cb=0xc | out: lpmodinfo=0x21f84a8*(lpBaseOfDll=0x76090000, SizeOfImage=0xf0000, EntryPoint=0x760a0569)) returned 1 [0095.582] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.582] GetModuleBaseNameW (in: hProcess=0x2f8, hModule=0x76090000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="RPCRT4.dll") returned 0xa [0095.582] CoTaskMemFree (pv=0x5d1c28) [0095.582] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.582] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x76090000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\RPCRT4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll")) returned 0x1e [0095.582] CoTaskMemFree (pv=0x5d1c28) [0095.582] GetModuleInformation (in: hProcess=0x2f8, hModule=0x75610000, lpmodinfo=0x21fa600, cb=0xc | out: lpmodinfo=0x21fa600*(lpBaseOfDll=0x75610000, SizeOfImage=0x60000, EntryPoint=0x7562a3b3)) returned 1 [0095.583] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.583] GetModuleBaseNameW (in: hProcess=0x2f8, hModule=0x75610000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="SspiCli.dll") returned 0xb [0095.583] CoTaskMemFree (pv=0x5d1c28) [0095.583] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.583] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x75610000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\SspiCli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll")) returned 0x1f [0095.583] CoTaskMemFree (pv=0x5d1c28) [0095.583] GetModuleInformation (in: hProcess=0x2f8, hModule=0x75600000, lpmodinfo=0x21fc70c, cb=0xc | out: lpmodinfo=0x21fc70c*(lpBaseOfDll=0x75600000, SizeOfImage=0xc000, EntryPoint=0x756010e1)) returned 1 [0095.583] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.583] GetModuleBaseNameW (in: hProcess=0x2f8, hModule=0x75600000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="CRYPTBASE.dll") returned 0xd [0095.583] CoTaskMemFree (pv=0x5d1c28) [0095.583] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.583] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x75600000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\CRYPTBASE.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll")) returned 0x21 [0095.584] CoTaskMemFree (pv=0x5d1c28) [0095.584] GetModuleInformation (in: hProcess=0x2f8, hModule=0x75430000, lpmodinfo=0x21fe820, cb=0xc | out: lpmodinfo=0x21fe820*(lpBaseOfDll=0x75430000, SizeOfImage=0x78000, EntryPoint=0x7543f7ba)) returned 1 [0095.584] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.584] GetModuleBaseNameW (in: hProcess=0x2f8, hModule=0x75430000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="mscoreei.dll") returned 0xc [0095.584] CoTaskMemFree (pv=0x5d1c28) [0095.584] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.584] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x75430000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscoreei.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\mscoreei.dll")) returned 0x3a [0095.585] CoTaskMemFree (pv=0x5d1c28) [0095.585] GetModuleInformation (in: hProcess=0x2f8, hModule=0x761d0000, lpmodinfo=0x2200968, cb=0xc | out: lpmodinfo=0x2200968*(lpBaseOfDll=0x761d0000, SizeOfImage=0x57000, EntryPoint=0x761e9ba6)) returned 1 [0095.585] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.585] GetModuleBaseNameW (in: hProcess=0x2f8, hModule=0x761d0000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="SHLWAPI.dll") returned 0xb [0095.585] CoTaskMemFree (pv=0x5d1c28) [0095.585] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.585] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x761d0000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\SHLWAPI.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll")) returned 0x1f [0095.585] CoTaskMemFree (pv=0x5d1c28) [0095.585] GetModuleInformation (in: hProcess=0x2f8, hModule=0x766d0000, lpmodinfo=0x2202a74, cb=0xc | out: lpmodinfo=0x2202a74*(lpBaseOfDll=0x766d0000, SizeOfImage=0x90000, EntryPoint=0x766e6343)) returned 1 [0095.586] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.586] GetModuleBaseNameW (in: hProcess=0x2f8, hModule=0x766d0000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="GDI32.dll") returned 0x9 [0095.586] CoTaskMemFree (pv=0x5d1c28) [0095.586] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.586] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x766d0000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\GDI32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll")) returned 0x1d [0095.586] CoTaskMemFree (pv=0x5d1c28) [0095.586] GetModuleInformation (in: hProcess=0x2f8, hModule=0x775b0000, lpmodinfo=0x2204b78, cb=0xc | out: lpmodinfo=0x2204b78*(lpBaseOfDll=0x775b0000, SizeOfImage=0x100000, EntryPoint=0x775cb6ed)) returned 1 [0095.586] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.586] GetModuleBaseNameW (in: hProcess=0x2f8, hModule=0x775b0000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="USER32.dll") returned 0xa [0095.587] CoTaskMemFree (pv=0x5d1c28) [0095.587] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.587] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x775b0000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\USER32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll")) returned 0x1e [0095.587] CoTaskMemFree (pv=0x5d1c28) [0095.587] GetModuleInformation (in: hProcess=0x2f8, hModule=0x75a70000, lpmodinfo=0x2206c84, cb=0xc | out: lpmodinfo=0x2206c84*(lpBaseOfDll=0x75a70000, SizeOfImage=0xa000, EntryPoint=0x75a736a0)) returned 1 [0095.587] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.587] GetModuleBaseNameW (in: hProcess=0x2f8, hModule=0x75a70000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="LPK.dll") returned 0x7 [0095.588] CoTaskMemFree (pv=0x5d1c28) [0095.588] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.588] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x75a70000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\LPK.dll" (normalized: "c:\\windows\\syswow64\\lpk.dll")) returned 0x1b [0095.588] CoTaskMemFree (pv=0x5d1c28) [0095.588] GetModuleInformation (in: hProcess=0x2f8, hModule=0x758d0000, lpmodinfo=0x2208d80, cb=0xc | out: lpmodinfo=0x2208d80*(lpBaseOfDll=0x758d0000, SizeOfImage=0x9d000, EntryPoint=0x75903fd7)) returned 1 [0095.588] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.588] GetModuleBaseNameW (in: hProcess=0x2f8, hModule=0x758d0000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="USP10.dll") returned 0x9 [0095.588] CoTaskMemFree (pv=0x5d1c28) [0095.588] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.588] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x758d0000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\USP10.dll" (normalized: "c:\\windows\\syswow64\\usp10.dll")) returned 0x1d [0095.589] CoTaskMemFree (pv=0x5d1c28) [0095.589] GetModuleInformation (in: hProcess=0x2f8, hModule=0x75f80000, lpmodinfo=0x220af10, cb=0xc | out: lpmodinfo=0x220af10*(lpBaseOfDll=0x75f80000, SizeOfImage=0x60000, EntryPoint=0x75f9158f)) returned 1 [0095.589] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.589] GetModuleBaseNameW (in: hProcess=0x2f8, hModule=0x75f80000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="IMM32.DLL") returned 0x9 [0095.589] CoTaskMemFree (pv=0x5d1c28) [0095.589] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.589] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x75f80000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\system32\\IMM32.DLL" (normalized: "c:\\windows\\system32\\imm32.dll")) returned 0x1d [0095.590] CoTaskMemFree (pv=0x5d1c28) [0095.590] GetModuleInformation (in: hProcess=0x2f8, hModule=0x75ea0000, lpmodinfo=0x220d014, cb=0xc | out: lpmodinfo=0x220d014*(lpBaseOfDll=0x75ea0000, SizeOfImage=0xcc000, EntryPoint=0x75ea168b)) returned 1 [0095.590] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.590] GetModuleBaseNameW (in: hProcess=0x2f8, hModule=0x75ea0000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="MSCTF.dll") returned 0x9 [0095.590] CoTaskMemFree (pv=0x5d1c28) [0095.590] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.590] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x75ea0000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\MSCTF.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll")) returned 0x1d [0095.591] CoTaskMemFree (pv=0x5d1c28) [0095.591] GetModuleInformation (in: hProcess=0x2f8, hModule=0x75420000, lpmodinfo=0x220f118, cb=0xc | out: lpmodinfo=0x220f118*(lpBaseOfDll=0x75420000, SizeOfImage=0x9000, EntryPoint=0x75421220)) returned 1 [0095.591] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.591] GetModuleBaseNameW (in: hProcess=0x2f8, hModule=0x75420000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="VERSION.dll") returned 0xb [0095.591] CoTaskMemFree (pv=0x5d1c28) [0095.591] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.591] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x75420000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\system32\\VERSION.dll" (normalized: "c:\\windows\\system32\\version.dll")) returned 0x1f [0095.592] CoTaskMemFree (pv=0x5d1c28) [0095.592] GetModuleInformation (in: hProcess=0x2f8, hModule=0x74890000, lpmodinfo=0x2211224, cb=0xc | out: lpmodinfo=0x2211224*(lpBaseOfDll=0x74890000, SizeOfImage=0x6a8000, EntryPoint=0x749d7040)) returned 1 [0095.592] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.592] GetModuleBaseNameW (in: hProcess=0x2f8, hModule=0x74890000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="clr.dll") returned 0x7 [0095.592] CoTaskMemFree (pv=0x5d1c28) [0095.592] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.592] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x74890000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\clr.dll")) returned 0x35 [0095.593] CoTaskMemFree (pv=0x5d1c28) [0095.593] GetModuleInformation (in: hProcess=0x2f8, hModule=0x75320000, lpmodinfo=0x2213354, cb=0xc | out: lpmodinfo=0x2213354*(lpBaseOfDll=0x75320000, SizeOfImage=0xf5000, EntryPoint=0x75374160)) returned 1 [0095.593] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.593] GetModuleBaseNameW (in: hProcess=0x2f8, hModule=0x75320000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="MSVCR120_CLR0400.dll") returned 0x14 [0095.593] CoTaskMemFree (pv=0x5d1c28) [0095.593] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.593] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x75320000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\system32\\MSVCR120_CLR0400.dll" (normalized: "c:\\windows\\system32\\msvcr120_clr0400.dll")) returned 0x28 [0095.594] CoTaskMemFree (pv=0x5d1c28) [0095.594] GetModuleInformation (in: hProcess=0x2f8, hModule=0x72440000, lpmodinfo=0x2215488, cb=0xc | out: lpmodinfo=0x2215488*(lpBaseOfDll=0x72440000, SizeOfImage=0x122b000, EntryPoint=0x0)) returned 1 [0095.594] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.594] GetModuleBaseNameW (in: hProcess=0x2f8, hModule=0x72440000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="mscorlib.ni.dll") returned 0xf [0095.594] CoTaskMemFree (pv=0x5d1c28) [0095.594] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.594] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x72440000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\b7a12c4c0032847fcc6b9c710460456f\\mscorlib.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\mscorlib\\b7a12c4c0032847fcc6b9c710460456f\\mscorlib.ni.dll")) returned 0x68 [0095.595] CoTaskMemFree (pv=0x5d1c28) [0095.595] GetModuleInformation (in: hProcess=0x2f8, hModule=0x764e0000, lpmodinfo=0x2217630, cb=0xc | out: lpmodinfo=0x2217630*(lpBaseOfDll=0x764e0000, SizeOfImage=0x15c000, EntryPoint=0x7652ba3d)) returned 1 [0095.595] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.595] GetModuleBaseNameW (in: hProcess=0x2f8, hModule=0x764e0000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="ole32.dll") returned 0x9 [0095.595] CoTaskMemFree (pv=0x5d1c28) [0095.595] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.595] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x764e0000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll")) returned 0x1d [0095.596] CoTaskMemFree (pv=0x5d1c28) [0095.596] GetModuleInformation (in: hProcess=0x2f8, hModule=0x74f60000, lpmodinfo=0x2219734, cb=0xc | out: lpmodinfo=0x2219734*(lpBaseOfDll=0x74f60000, SizeOfImage=0x80000, EntryPoint=0x74f737c9)) returned 1 [0095.596] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.596] GetModuleBaseNameW (in: hProcess=0x2f8, hModule=0x74f60000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="uxtheme.dll") returned 0xb [0095.597] CoTaskMemFree (pv=0x5d1c28) [0095.597] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.597] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x74f60000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\system32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll")) returned 0x1f [0095.597] CoTaskMemFree (pv=0x5d1c28) [0095.597] GetModuleInformation (in: hProcess=0x2f8, hModule=0x752a0000, lpmodinfo=0x221b840, cb=0xc | out: lpmodinfo=0x221b840*(lpBaseOfDll=0x752a0000, SizeOfImage=0x7d000, EntryPoint=0x752a1140)) returned 1 [0095.597] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.597] GetModuleBaseNameW (in: hProcess=0x2f8, hModule=0x752a0000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="clrjit.dll") returned 0xa [0095.598] CoTaskMemFree (pv=0x5d1c28) [0095.598] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.598] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x752a0000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clrjit.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\clrjit.dll")) returned 0x38 [0095.598] CoTaskMemFree (pv=0x5d1c28) [0095.598] GetModuleInformation (in: hProcess=0x2f8, hModule=0x762b0000, lpmodinfo=0x221d980, cb=0xc | out: lpmodinfo=0x221d980*(lpBaseOfDll=0x762b0000, SizeOfImage=0x8f000, EntryPoint=0x762b3fb1)) returned 1 [0095.599] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.599] GetModuleBaseNameW (in: hProcess=0x2f8, hModule=0x762b0000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="OLEAUT32.dll") returned 0xc [0095.599] CoTaskMemFree (pv=0x5d1c28) [0095.599] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.599] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x762b0000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\OLEAUT32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll")) returned 0x20 [0095.599] CoTaskMemFree (pv=0x5d1c28) [0095.599] GetModuleInformation (in: hProcess=0x2f8, hModule=0x736d0000, lpmodinfo=0x221fa94, cb=0xc | out: lpmodinfo=0x221fa94*(lpBaseOfDll=0x736d0000, SizeOfImage=0x9ad000, EntryPoint=0x0)) returned 1 [0095.600] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.600] GetModuleBaseNameW (in: hProcess=0x2f8, hModule=0x736d0000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="System.ni.dll") returned 0xd [0095.600] CoTaskMemFree (pv=0x5d1c28) [0095.600] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.600] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x736d0000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System\\500ffa28b327e171fe664023003e947e\\System.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system\\500ffa28b327e171fe664023003e947e\\system.ni.dll")) returned 0x64 [0095.601] CoTaskMemFree (pv=0x5d1c28) [0095.601] GetModuleInformation (in: hProcess=0x2f8, hModule=0x71d20000, lpmodinfo=0x2221c30, cb=0xc | out: lpmodinfo=0x2221c30*(lpBaseOfDll=0x71d20000, SizeOfImage=0x716000, EntryPoint=0x0)) returned 1 [0095.601] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.601] GetModuleBaseNameW (in: hProcess=0x2f8, hModule=0x71d20000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="System.Core.ni.dll") returned 0x12 [0095.601] CoTaskMemFree (pv=0x5d1c28) [0095.601] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.601] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x71d20000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Core\\386fde9190d499d6645df8b90eb76242\\System.Core.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.core\\386fde9190d499d6645df8b90eb76242\\system.core.ni.dll")) returned 0x6e [0095.602] CoTaskMemFree (pv=0x5d1c28) [0095.602] GetModuleInformation (in: hProcess=0x2f8, hModule=0x750d0000, lpmodinfo=0x2223dec, cb=0xc | out: lpmodinfo=0x2223dec*(lpBaseOfDll=0x750d0000, SizeOfImage=0x1cb000, EntryPoint=0x0)) returned 1 [0095.602] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.602] GetModuleBaseNameW (in: hProcess=0x2f8, hModule=0x750d0000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="Microsoft.VisualBasic.ni.dll") returned 0x1c [0095.603] CoTaskMemFree (pv=0x5d1c28) [0095.603] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.603] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x750d0000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Microsoft.V9921e851#\\cfbddeb6e93e8f421b92229b20e51233\\Microsoft.VisualBasic.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\microsoft.v9921e851#\\cfbddeb6e93e8f421b92229b20e51233\\microsoft.visualbasic.ni.dll")) returned 0x81 [0095.603] CoTaskMemFree (pv=0x5d1c28) [0095.603] GetModuleInformation (in: hProcess=0x2f8, hModule=0x750b0000, lpmodinfo=0x2225fe0, cb=0xc | out: lpmodinfo=0x2225fe0*(lpBaseOfDll=0x750b0000, SizeOfImage=0x13000, EntryPoint=0x750b18f0)) returned 1 [0095.604] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.604] GetModuleBaseNameW (in: hProcess=0x2f8, hModule=0x750b0000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="nlssorting.dll") returned 0xe [0095.604] CoTaskMemFree (pv=0x5d1c28) [0095.604] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.604] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x750b0000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\nlssorting.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\nlssorting.dll")) returned 0x3c [0095.605] CoTaskMemFree (pv=0x5d1c28) [0095.605] GetModuleInformation (in: hProcess=0x2f8, hModule=0x74870000, lpmodinfo=0x2228130, cb=0xc | out: lpmodinfo=0x2228130*(lpBaseOfDll=0x74870000, SizeOfImage=0x16000, EntryPoint=0x74872dc3)) returned 1 [0095.605] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.605] GetModuleBaseNameW (in: hProcess=0x2f8, hModule=0x74870000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="CRYPTSP.dll") returned 0xb [0095.605] CoTaskMemFree (pv=0x5d1c28) [0095.605] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.605] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x74870000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\system32\\CRYPTSP.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll")) returned 0x1f [0095.606] CoTaskMemFree (pv=0x5d1c28) [0095.606] GetModuleInformation (in: hProcess=0x2f8, hModule=0x74830000, lpmodinfo=0x222a23c, cb=0xc | out: lpmodinfo=0x222a23c*(lpBaseOfDll=0x74830000, SizeOfImage=0x3b000, EntryPoint=0x7483128d)) returned 1 [0095.606] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.606] GetModuleBaseNameW (in: hProcess=0x2f8, hModule=0x74830000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="rsaenh.dll") returned 0xa [0095.607] CoTaskMemFree (pv=0x5d1c28) [0095.607] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.607] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x74830000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\system32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll")) returned 0x1e [0095.607] CoTaskMemFree (pv=0x5d1c28) [0095.608] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.608] CoTaskMemFree (pv=0x5d1c28) [0095.608] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.608] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x75a60000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\psapi.dll" (normalized: "c:\\windows\\syswow64\\psapi.dll")) returned 0x1d [0095.608] CoTaskMemFree (pv=0x5d1c28) [0095.608] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.608] CoTaskMemFree (pv=0x5d1c28) [0095.608] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.608] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x746a0000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Drawing\\553c0312fdf5a5449f3649f0515e70fb\\System.Drawing.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.drawing\\553c0312fdf5a5449f3649f0515e70fb\\system.drawing.ni.dll")) returned 0x74 [0095.609] CoTaskMemFree (pv=0x5d1c28) [0095.609] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.609] CoTaskMemFree (pv=0x5d1c28) [0095.609] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.609] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x710c0000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Windows.Forms\\7a6894982f35a1d75ec73d447c583da2\\System.Windows.Forms.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.windows.forms\\7a6894982f35a1d75ec73d447c583da2\\system.windows.forms.ni.dll")) returned 0x80 [0095.609] CoTaskMemFree (pv=0x5d1c28) [0095.609] CloseHandle (hObject=0x2f8) returned 1 [0095.614] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.614] CoTaskMemFree (pv=0x5d1c28) [0095.614] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.614] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x310000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\unlikexpc.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\unlikexpc.exe")) returned 0x33 [0095.614] CoTaskMemFree (pv=0x5d1c28) [0095.614] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.614] CoTaskMemFree (pv=0x5d1c28) [0095.615] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.615] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x77ab0000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll")) returned 0x1d [0095.615] CoTaskMemFree (pv=0x5d1c28) [0095.615] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.615] CoTaskMemFree (pv=0x5d1c28) [0095.615] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.615] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x754b0000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\MSCOREE.DLL" (normalized: "c:\\windows\\system32\\mscoree.dll")) returned 0x1f [0095.615] CoTaskMemFree (pv=0x5d1c28) [0095.615] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.615] CoTaskMemFree (pv=0x5d1c28) [0095.615] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.615] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x757c0000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\KERNEL32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll")) returned 0x20 [0095.615] CoTaskMemFree (pv=0x5d1c28) [0095.615] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.615] CoTaskMemFree (pv=0x5d1c28) [0095.615] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.615] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x76260000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\KERNELBASE.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll")) returned 0x22 [0095.615] CoTaskMemFree (pv=0x5d1c28) [0095.615] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.615] CoTaskMemFree (pv=0x5d1c28) [0095.615] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.615] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x75720000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\ADVAPI32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll")) returned 0x20 [0095.616] CoTaskMemFree (pv=0x5d1c28) [0095.616] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.616] CoTaskMemFree (pv=0x5d1c28) [0095.616] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.616] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x75fe0000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll")) returned 0x1e [0095.616] CoTaskMemFree (pv=0x5d1c28) [0095.616] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.616] CoTaskMemFree (pv=0x5d1c28) [0095.616] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.616] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x761b0000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll")) returned 0x1f [0095.616] CoTaskMemFree (pv=0x5d1c28) [0095.616] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.616] CoTaskMemFree (pv=0x5d1c28) [0095.616] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.616] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x76090000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\RPCRT4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll")) returned 0x1e [0095.617] CoTaskMemFree (pv=0x5d1c28) [0095.617] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.617] CoTaskMemFree (pv=0x5d1c28) [0095.617] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.617] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x75610000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\SspiCli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll")) returned 0x1f [0095.617] CoTaskMemFree (pv=0x5d1c28) [0095.617] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.617] CoTaskMemFree (pv=0x5d1c28) [0095.617] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.617] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x75600000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\CRYPTBASE.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll")) returned 0x21 [0095.617] CoTaskMemFree (pv=0x5d1c28) [0095.617] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.617] CoTaskMemFree (pv=0x5d1c28) [0095.617] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.617] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x75430000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscoreei.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\mscoreei.dll")) returned 0x3a [0095.617] CoTaskMemFree (pv=0x5d1c28) [0095.617] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.618] CoTaskMemFree (pv=0x5d1c28) [0095.618] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.618] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x761d0000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\SHLWAPI.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll")) returned 0x1f [0095.618] CoTaskMemFree (pv=0x5d1c28) [0095.618] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.618] CoTaskMemFree (pv=0x5d1c28) [0095.618] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.618] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x766d0000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\GDI32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll")) returned 0x1d [0095.618] CoTaskMemFree (pv=0x5d1c28) [0095.618] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.618] CoTaskMemFree (pv=0x5d1c28) [0095.618] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.618] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x775b0000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\USER32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll")) returned 0x1e [0095.618] CoTaskMemFree (pv=0x5d1c28) [0095.619] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.619] CoTaskMemFree (pv=0x5d1c28) [0095.619] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.619] GetModuleFileNameExW (in: hProcess=0x2f8, hModule=0x75a70000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\LPK.dll" (normalized: "c:\\windows\\syswow64\\lpk.dll")) returned 0x1b [0095.619] CoTaskMemFree (pv=0x5d1c28) [0095.619] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0095.619] CoTaskMemFree (pv=0x5d1c28) [0095.627] GetCurrentProcessId () returned 0x9f8 [0095.628] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x9f8) returned 0x2f8 [0096.239] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3594718, Length=0x20000, ResultLength=0x499480 | out: SystemInformation=0x3594718, ResultLength=0x499480*=0x9a18) returned 0x0 [0096.421] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x3594718, Length=0x20000, ResultLength=0x499480 | out: SystemInformation=0x3594718, ResultLength=0x499480*=0x9a18) returned 0x0 [0096.602] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=0, lpMultiByteStr=0x499868, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\xc8\xc1\xd0\x04\x43\x3a\x5c\x55\x73\x65\x72\x73\x5c\x35\x70\x35\x4e\x72\x47\x4a\x6e\x30\x6a\x53\x20\x48\x41\x4c\x50\x6d\x63\x78\x7a\x5c\x44\x65\x73\x6b\x74\x6f\x70\x5c\x75\x6e\x6c\x69\x6b\x65\x78\x70\x63\x2e\x65\x78\x65", lpUsedDefaultChar=0x0) returned 0 [0096.602] CreateProcessA (in: lpApplicationName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\unlikexpc.exe", lpCommandLine="", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x4, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x499900*(cb=0x0, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x49b57c | out: lpCommandLine="", lpProcessInformation=0x49b57c*(hProcess=0x2fc, hThread=0x2f8, dwProcessId=0xb58, dwThreadId=0xb5c)) returned 1 [0096.871] CoTaskMemFree (pv=0x0) [0096.923] GetCurrentProcessId () returned 0x9f8 [0096.923] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x9f8) returned 0x304 [0096.924] EnumProcessModules (in: hProcess=0x304, lphModule=0x21fc9dc, cb=0x100, lpcbNeeded=0x498850 | out: lphModule=0x21fc9dc, lpcbNeeded=0x498850) returned 1 [0096.924] GetModuleInformation (in: hProcess=0x304, hModule=0x310000, lpmodinfo=0x21fcb1c, cb=0xc | out: lpmodinfo=0x21fcb1c*(lpBaseOfDll=0x310000, SizeOfImage=0x3e000, EntryPoint=0x3479ce)) returned 1 [0096.924] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0096.924] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x310000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="unlikexpc.exe") returned 0xd [0096.924] CoTaskMemFree (pv=0x5d1c28) [0096.924] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0096.924] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x310000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\unlikexpc.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\unlikexpc.exe")) returned 0x33 [0096.924] CoTaskMemFree (pv=0x5d1c28) [0096.924] GetModuleInformation (in: hProcess=0x304, hModule=0x77ab0000, lpmodinfo=0x21fec70, cb=0xc | out: lpmodinfo=0x21fec70*(lpBaseOfDll=0x77ab0000, SizeOfImage=0x180000, EntryPoint=0x0)) returned 1 [0096.925] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0096.925] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x77ab0000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="ntdll.dll") returned 0x9 [0096.925] CoTaskMemFree (pv=0x5d1c28) [0096.925] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0096.925] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x77ab0000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll")) returned 0x1d [0096.925] CoTaskMemFree (pv=0x5d1c28) [0096.925] GetModuleInformation (in: hProcess=0x304, hModule=0x754b0000, lpmodinfo=0x2200d74, cb=0xc | out: lpmodinfo=0x2200d74*(lpBaseOfDll=0x754b0000, SizeOfImage=0x4a000, EntryPoint=0x754b2e54)) returned 1 [0096.925] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0096.925] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x754b0000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="MSCOREE.DLL") returned 0xb [0096.925] CoTaskMemFree (pv=0x5d1c28) [0096.925] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0096.925] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x754b0000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\MSCOREE.DLL" (normalized: "c:\\windows\\system32\\mscoree.dll")) returned 0x1f [0096.926] CoTaskMemFree (pv=0x5d1c28) [0096.926] GetModuleInformation (in: hProcess=0x304, hModule=0x757c0000, lpmodinfo=0x2202e80, cb=0xc | out: lpmodinfo=0x2202e80*(lpBaseOfDll=0x757c0000, SizeOfImage=0x110000, EntryPoint=0x757d32d3)) returned 1 [0096.926] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0096.926] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x757c0000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="KERNEL32.dll") returned 0xc [0096.926] CoTaskMemFree (pv=0x5d1c28) [0096.926] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0096.926] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x757c0000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\KERNEL32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll")) returned 0x20 [0096.927] CoTaskMemFree (pv=0x5d1c28) [0096.927] GetModuleInformation (in: hProcess=0x304, hModule=0x76260000, lpmodinfo=0x2204f94, cb=0xc | out: lpmodinfo=0x2204f94*(lpBaseOfDll=0x76260000, SizeOfImage=0x46000, EntryPoint=0x76267478)) returned 1 [0096.927] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0096.927] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x76260000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="KERNELBASE.dll") returned 0xe [0096.927] CoTaskMemFree (pv=0x5d1c28) [0096.927] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0096.927] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x76260000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\KERNELBASE.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll")) returned 0x22 [0096.927] CoTaskMemFree (pv=0x5d1c28) [0096.927] GetModuleInformation (in: hProcess=0x304, hModule=0x75720000, lpmodinfo=0x22070dc, cb=0xc | out: lpmodinfo=0x22070dc*(lpBaseOfDll=0x75720000, SizeOfImage=0xa0000, EntryPoint=0x757349e5)) returned 1 [0096.928] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0096.928] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75720000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="ADVAPI32.dll") returned 0xc [0096.928] CoTaskMemFree (pv=0x5d1c28) [0096.928] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0096.928] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75720000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\ADVAPI32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll")) returned 0x20 [0096.928] CoTaskMemFree (pv=0x5d1c28) [0096.928] GetModuleInformation (in: hProcess=0x304, hModule=0x75fe0000, lpmodinfo=0x22091f0, cb=0xc | out: lpmodinfo=0x22091f0*(lpBaseOfDll=0x75fe0000, SizeOfImage=0xac000, EntryPoint=0x75fea472)) returned 1 [0096.928] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0096.928] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75fe0000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="msvcrt.dll") returned 0xa [0096.928] CoTaskMemFree (pv=0x5d1c28) [0096.928] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0096.928] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75fe0000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll")) returned 0x1e [0096.929] CoTaskMemFree (pv=0x5d1c28) [0096.929] GetModuleInformation (in: hProcess=0x304, hModule=0x761b0000, lpmodinfo=0x220b2fc, cb=0xc | out: lpmodinfo=0x220b2fc*(lpBaseOfDll=0x761b0000, SizeOfImage=0x19000, EntryPoint=0x761b4975)) returned 1 [0096.929] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0096.929] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x761b0000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="sechost.dll") returned 0xb [0096.929] CoTaskMemFree (pv=0x5d1c28) [0096.929] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0096.929] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x761b0000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll")) returned 0x1f [0096.929] CoTaskMemFree (pv=0x5d1c28) [0096.929] GetModuleInformation (in: hProcess=0x304, hModule=0x76090000, lpmodinfo=0x220d408, cb=0xc | out: lpmodinfo=0x220d408*(lpBaseOfDll=0x76090000, SizeOfImage=0xf0000, EntryPoint=0x760a0569)) returned 1 [0096.930] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0096.930] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x76090000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="RPCRT4.dll") returned 0xa [0096.930] CoTaskMemFree (pv=0x5d1c28) [0096.930] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0096.930] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x76090000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\RPCRT4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll")) returned 0x1e [0096.930] CoTaskMemFree (pv=0x5d1c28) [0096.930] GetModuleInformation (in: hProcess=0x304, hModule=0x75610000, lpmodinfo=0x220f560, cb=0xc | out: lpmodinfo=0x220f560*(lpBaseOfDll=0x75610000, SizeOfImage=0x60000, EntryPoint=0x7562a3b3)) returned 1 [0096.930] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0096.930] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75610000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="SspiCli.dll") returned 0xb [0096.930] CoTaskMemFree (pv=0x5d1c28) [0096.930] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0096.931] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75610000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\SspiCli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll")) returned 0x1f [0096.931] CoTaskMemFree (pv=0x5d1c28) [0096.931] GetModuleInformation (in: hProcess=0x304, hModule=0x75600000, lpmodinfo=0x221166c, cb=0xc | out: lpmodinfo=0x221166c*(lpBaseOfDll=0x75600000, SizeOfImage=0xc000, EntryPoint=0x756010e1)) returned 1 [0096.931] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0096.931] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75600000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="CRYPTBASE.dll") returned 0xd [0096.931] CoTaskMemFree (pv=0x5d1c28) [0096.931] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0096.931] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75600000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\CRYPTBASE.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll")) returned 0x21 [0096.932] CoTaskMemFree (pv=0x5d1c28) [0096.932] GetModuleInformation (in: hProcess=0x304, hModule=0x75430000, lpmodinfo=0x2213780, cb=0xc | out: lpmodinfo=0x2213780*(lpBaseOfDll=0x75430000, SizeOfImage=0x78000, EntryPoint=0x7543f7ba)) returned 1 [0096.932] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0096.932] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75430000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="mscoreei.dll") returned 0xc [0096.932] CoTaskMemFree (pv=0x5d1c28) [0096.932] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0096.932] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75430000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscoreei.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\mscoreei.dll")) returned 0x3a [0096.932] CoTaskMemFree (pv=0x5d1c28) [0096.933] GetModuleInformation (in: hProcess=0x304, hModule=0x761d0000, lpmodinfo=0x22158c8, cb=0xc | out: lpmodinfo=0x22158c8*(lpBaseOfDll=0x761d0000, SizeOfImage=0x57000, EntryPoint=0x761e9ba6)) returned 1 [0096.933] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0096.933] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x761d0000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="SHLWAPI.dll") returned 0xb [0096.933] CoTaskMemFree (pv=0x5d1c28) [0096.933] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0096.933] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x761d0000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\SHLWAPI.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll")) returned 0x1f [0096.933] CoTaskMemFree (pv=0x5d1c28) [0096.933] GetModuleInformation (in: hProcess=0x304, hModule=0x766d0000, lpmodinfo=0x22179d4, cb=0xc | out: lpmodinfo=0x22179d4*(lpBaseOfDll=0x766d0000, SizeOfImage=0x90000, EntryPoint=0x766e6343)) returned 1 [0096.934] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0096.934] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x766d0000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="GDI32.dll") returned 0x9 [0096.934] CoTaskMemFree (pv=0x5d1c28) [0096.934] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0096.934] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x766d0000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\GDI32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll")) returned 0x1d [0096.934] CoTaskMemFree (pv=0x5d1c28) [0096.934] GetModuleInformation (in: hProcess=0x304, hModule=0x775b0000, lpmodinfo=0x2219ad8, cb=0xc | out: lpmodinfo=0x2219ad8*(lpBaseOfDll=0x775b0000, SizeOfImage=0x100000, EntryPoint=0x775cb6ed)) returned 1 [0096.934] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0096.934] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x775b0000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="USER32.dll") returned 0xa [0096.935] CoTaskMemFree (pv=0x5d1c28) [0096.935] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0096.935] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x775b0000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\USER32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll")) returned 0x1e [0096.935] CoTaskMemFree (pv=0x5d1c28) [0096.935] GetModuleInformation (in: hProcess=0x304, hModule=0x75a70000, lpmodinfo=0x221bbe4, cb=0xc | out: lpmodinfo=0x221bbe4*(lpBaseOfDll=0x75a70000, SizeOfImage=0xa000, EntryPoint=0x75a736a0)) returned 1 [0096.935] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0096.935] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75a70000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="LPK.dll") returned 0x7 [0096.936] CoTaskMemFree (pv=0x5d1c28) [0096.936] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0096.936] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75a70000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\LPK.dll" (normalized: "c:\\windows\\syswow64\\lpk.dll")) returned 0x1b [0096.936] CoTaskMemFree (pv=0x5d1c28) [0096.936] GetModuleInformation (in: hProcess=0x304, hModule=0x758d0000, lpmodinfo=0x221dce0, cb=0xc | out: lpmodinfo=0x221dce0*(lpBaseOfDll=0x758d0000, SizeOfImage=0x9d000, EntryPoint=0x75903fd7)) returned 1 [0096.936] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0096.936] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x758d0000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="USP10.dll") returned 0x9 [0096.937] CoTaskMemFree (pv=0x5d1c28) [0096.937] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0096.937] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x758d0000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\USP10.dll" (normalized: "c:\\windows\\syswow64\\usp10.dll")) returned 0x1d [0096.937] CoTaskMemFree (pv=0x5d1c28) [0096.937] GetModuleInformation (in: hProcess=0x304, hModule=0x75f80000, lpmodinfo=0x221fe70, cb=0xc | out: lpmodinfo=0x221fe70*(lpBaseOfDll=0x75f80000, SizeOfImage=0x60000, EntryPoint=0x75f9158f)) returned 1 [0096.937] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0096.937] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75f80000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="IMM32.DLL") returned 0x9 [0096.938] CoTaskMemFree (pv=0x5d1c28) [0096.938] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0096.938] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75f80000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\system32\\IMM32.DLL" (normalized: "c:\\windows\\system32\\imm32.dll")) returned 0x1d [0096.938] CoTaskMemFree (pv=0x5d1c28) [0096.938] GetModuleInformation (in: hProcess=0x304, hModule=0x75ea0000, lpmodinfo=0x2221f74, cb=0xc | out: lpmodinfo=0x2221f74*(lpBaseOfDll=0x75ea0000, SizeOfImage=0xcc000, EntryPoint=0x75ea168b)) returned 1 [0096.938] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0096.938] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75ea0000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="MSCTF.dll") returned 0x9 [0096.938] CoTaskMemFree (pv=0x5d1c28) [0096.939] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0096.939] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75ea0000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\MSCTF.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll")) returned 0x1d [0096.939] CoTaskMemFree (pv=0x5d1c28) [0096.939] GetModuleInformation (in: hProcess=0x304, hModule=0x75420000, lpmodinfo=0x2224078, cb=0xc | out: lpmodinfo=0x2224078*(lpBaseOfDll=0x75420000, SizeOfImage=0x9000, EntryPoint=0x75421220)) returned 1 [0096.939] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0096.939] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75420000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="VERSION.dll") returned 0xb [0096.939] CoTaskMemFree (pv=0x5d1c28) [0096.940] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0096.940] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75420000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\system32\\VERSION.dll" (normalized: "c:\\windows\\system32\\version.dll")) returned 0x1f [0096.940] CoTaskMemFree (pv=0x5d1c28) [0096.940] GetModuleInformation (in: hProcess=0x304, hModule=0x74890000, lpmodinfo=0x2226184, cb=0xc | out: lpmodinfo=0x2226184*(lpBaseOfDll=0x74890000, SizeOfImage=0x6a8000, EntryPoint=0x749d7040)) returned 1 [0096.940] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0096.940] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x74890000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="clr.dll") returned 0x7 [0096.941] CoTaskMemFree (pv=0x5d1c28) [0096.941] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0096.941] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x74890000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\clr.dll")) returned 0x35 [0096.942] CoTaskMemFree (pv=0x5d1c28) [0096.942] GetModuleInformation (in: hProcess=0x304, hModule=0x75320000, lpmodinfo=0x22282b4, cb=0xc | out: lpmodinfo=0x22282b4*(lpBaseOfDll=0x75320000, SizeOfImage=0xf5000, EntryPoint=0x75374160)) returned 1 [0096.942] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0096.942] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75320000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="MSVCR120_CLR0400.dll") returned 0x14 [0096.943] CoTaskMemFree (pv=0x5d1c28) [0096.943] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0096.943] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75320000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\system32\\MSVCR120_CLR0400.dll" (normalized: "c:\\windows\\system32\\msvcr120_clr0400.dll")) returned 0x28 [0096.943] CoTaskMemFree (pv=0x5d1c28) [0096.943] GetModuleInformation (in: hProcess=0x304, hModule=0x72440000, lpmodinfo=0x222a3e8, cb=0xc | out: lpmodinfo=0x222a3e8*(lpBaseOfDll=0x72440000, SizeOfImage=0x122b000, EntryPoint=0x0)) returned 1 [0096.944] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0096.944] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x72440000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="mscorlib.ni.dll") returned 0xf [0096.944] CoTaskMemFree (pv=0x5d1c28) [0096.944] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0096.944] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x72440000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\b7a12c4c0032847fcc6b9c710460456f\\mscorlib.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\mscorlib\\b7a12c4c0032847fcc6b9c710460456f\\mscorlib.ni.dll")) returned 0x68 [0096.945] CoTaskMemFree (pv=0x5d1c28) [0096.945] GetModuleInformation (in: hProcess=0x304, hModule=0x764e0000, lpmodinfo=0x222c590, cb=0xc | out: lpmodinfo=0x222c590*(lpBaseOfDll=0x764e0000, SizeOfImage=0x15c000, EntryPoint=0x7652ba3d)) returned 1 [0096.945] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0096.945] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x764e0000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="ole32.dll") returned 0x9 [0096.946] CoTaskMemFree (pv=0x5d1c28) [0096.946] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0096.946] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x764e0000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll")) returned 0x1d [0096.946] CoTaskMemFree (pv=0x5d1c28) [0096.946] GetModuleInformation (in: hProcess=0x304, hModule=0x74f60000, lpmodinfo=0x222e694, cb=0xc | out: lpmodinfo=0x222e694*(lpBaseOfDll=0x74f60000, SizeOfImage=0x80000, EntryPoint=0x74f737c9)) returned 1 [0096.947] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0096.947] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x74f60000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="uxtheme.dll") returned 0xb [0096.947] CoTaskMemFree (pv=0x5d1c28) [0096.947] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0096.947] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x74f60000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\system32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll")) returned 0x1f [0096.948] CoTaskMemFree (pv=0x5d1c28) [0096.948] GetModuleInformation (in: hProcess=0x304, hModule=0x752a0000, lpmodinfo=0x22307a0, cb=0xc | out: lpmodinfo=0x22307a0*(lpBaseOfDll=0x752a0000, SizeOfImage=0x7d000, EntryPoint=0x752a1140)) returned 1 [0096.948] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0096.948] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x752a0000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="clrjit.dll") returned 0xa [0096.949] CoTaskMemFree (pv=0x5d1c28) [0096.949] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0096.949] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x752a0000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clrjit.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\clrjit.dll")) returned 0x38 [0096.950] CoTaskMemFree (pv=0x5d1c28) [0096.950] GetModuleInformation (in: hProcess=0x304, hModule=0x762b0000, lpmodinfo=0x22328e0, cb=0xc | out: lpmodinfo=0x22328e0*(lpBaseOfDll=0x762b0000, SizeOfImage=0x8f000, EntryPoint=0x762b3fb1)) returned 1 [0096.950] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0096.950] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x762b0000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="OLEAUT32.dll") returned 0xc [0096.951] CoTaskMemFree (pv=0x5d1c28) [0096.951] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0096.951] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x762b0000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\OLEAUT32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll")) returned 0x20 [0096.951] CoTaskMemFree (pv=0x5d1c28) [0096.951] GetModuleInformation (in: hProcess=0x304, hModule=0x736d0000, lpmodinfo=0x22349f4, cb=0xc | out: lpmodinfo=0x22349f4*(lpBaseOfDll=0x736d0000, SizeOfImage=0x9ad000, EntryPoint=0x0)) returned 1 [0096.952] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0096.952] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x736d0000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="System.ni.dll") returned 0xd [0096.952] CoTaskMemFree (pv=0x5d1c28) [0096.952] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0096.952] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x736d0000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System\\500ffa28b327e171fe664023003e947e\\System.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system\\500ffa28b327e171fe664023003e947e\\system.ni.dll")) returned 0x64 [0096.953] CoTaskMemFree (pv=0x5d1c28) [0096.953] GetModuleInformation (in: hProcess=0x304, hModule=0x71d20000, lpmodinfo=0x2236b90, cb=0xc | out: lpmodinfo=0x2236b90*(lpBaseOfDll=0x71d20000, SizeOfImage=0x716000, EntryPoint=0x0)) returned 1 [0096.953] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0096.953] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x71d20000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="System.Core.ni.dll") returned 0x12 [0096.953] CoTaskMemFree (pv=0x5d1c28) [0096.953] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0096.953] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x71d20000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Core\\386fde9190d499d6645df8b90eb76242\\System.Core.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.core\\386fde9190d499d6645df8b90eb76242\\system.core.ni.dll")) returned 0x6e [0096.954] CoTaskMemFree (pv=0x5d1c28) [0096.954] GetModuleInformation (in: hProcess=0x304, hModule=0x750d0000, lpmodinfo=0x2238d4c, cb=0xc | out: lpmodinfo=0x2238d4c*(lpBaseOfDll=0x750d0000, SizeOfImage=0x1cb000, EntryPoint=0x0)) returned 1 [0096.954] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0096.954] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x750d0000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="Microsoft.VisualBasic.ni.dll") returned 0x1c [0096.955] CoTaskMemFree (pv=0x5d1c28) [0096.955] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0096.955] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x750d0000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Microsoft.V9921e851#\\cfbddeb6e93e8f421b92229b20e51233\\Microsoft.VisualBasic.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\microsoft.v9921e851#\\cfbddeb6e93e8f421b92229b20e51233\\microsoft.visualbasic.ni.dll")) returned 0x81 [0096.955] CoTaskMemFree (pv=0x5d1c28) [0096.955] GetModuleInformation (in: hProcess=0x304, hModule=0x750b0000, lpmodinfo=0x223af40, cb=0xc | out: lpmodinfo=0x223af40*(lpBaseOfDll=0x750b0000, SizeOfImage=0x13000, EntryPoint=0x750b18f0)) returned 1 [0096.956] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0096.956] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x750b0000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="nlssorting.dll") returned 0xe [0096.956] CoTaskMemFree (pv=0x5d1c28) [0096.956] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0096.956] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x750b0000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\nlssorting.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\nlssorting.dll")) returned 0x3c [0096.957] CoTaskMemFree (pv=0x5d1c28) [0096.957] GetModuleInformation (in: hProcess=0x304, hModule=0x74870000, lpmodinfo=0x223d090, cb=0xc | out: lpmodinfo=0x223d090*(lpBaseOfDll=0x74870000, SizeOfImage=0x16000, EntryPoint=0x74872dc3)) returned 1 [0096.957] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0096.957] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x74870000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="CRYPTSP.dll") returned 0xb [0096.958] CoTaskMemFree (pv=0x5d1c28) [0096.958] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0096.958] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x74870000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\system32\\CRYPTSP.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll")) returned 0x1f [0096.958] CoTaskMemFree (pv=0x5d1c28) [0096.958] GetModuleInformation (in: hProcess=0x304, hModule=0x74830000, lpmodinfo=0x223f19c, cb=0xc | out: lpmodinfo=0x223f19c*(lpBaseOfDll=0x74830000, SizeOfImage=0x3b000, EntryPoint=0x7483128d)) returned 1 [0096.959] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0096.959] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x74830000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="rsaenh.dll") returned 0xa [0096.959] CoTaskMemFree (pv=0x5d1c28) [0096.959] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0096.959] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x74830000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\system32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll")) returned 0x1e [0096.960] CoTaskMemFree (pv=0x5d1c28) [0096.960] GetModuleInformation (in: hProcess=0x304, hModule=0x75a60000, lpmodinfo=0x22413b4, cb=0xc | out: lpmodinfo=0x22413b4*(lpBaseOfDll=0x75a60000, SizeOfImage=0x5000, EntryPoint=0x75a61438)) returned 1 [0096.960] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0096.960] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75a60000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="psapi.dll") returned 0x9 [0096.960] CoTaskMemFree (pv=0x5d1c28) [0096.960] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0096.961] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75a60000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\psapi.dll" (normalized: "c:\\windows\\syswow64\\psapi.dll")) returned 0x1d [0096.961] CoTaskMemFree (pv=0x5d1c28) [0096.961] GetModuleInformation (in: hProcess=0x304, hModule=0x746a0000, lpmodinfo=0x22434b8, cb=0xc | out: lpmodinfo=0x22434b8*(lpBaseOfDll=0x746a0000, SizeOfImage=0x18d000, EntryPoint=0x0)) returned 1 [0096.961] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0096.961] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x746a0000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="System.Drawing.ni.dll") returned 0x15 [0096.962] CoTaskMemFree (pv=0x5d1c28) [0096.962] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0096.962] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x746a0000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Drawing\\553c0312fdf5a5449f3649f0515e70fb\\System.Drawing.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.drawing\\553c0312fdf5a5449f3649f0515e70fb\\system.drawing.ni.dll")) returned 0x74 [0096.962] CoTaskMemFree (pv=0x5d1c28) [0096.963] GetModuleInformation (in: hProcess=0x304, hModule=0x710c0000, lpmodinfo=0x2245684, cb=0xc | out: lpmodinfo=0x2245684*(lpBaseOfDll=0x710c0000, SizeOfImage=0xc58000, EntryPoint=0x0)) returned 1 [0096.963] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0096.963] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x710c0000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="System.Windows.Forms.ni.dll") returned 0x1b [0096.963] CoTaskMemFree (pv=0x5d1c28) [0096.964] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0096.964] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x710c0000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Windows.Forms\\7a6894982f35a1d75ec73d447c583da2\\System.Windows.Forms.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.windows.forms\\7a6894982f35a1d75ec73d447c583da2\\system.windows.forms.ni.dll")) returned 0x80 [0096.964] CoTaskMemFree (pv=0x5d1c28) [0096.964] CloseHandle (hObject=0x304) returned 1 [0096.980] GetCurrentProcessId () returned 0x9f8 [0096.980] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x9f8) returned 0x304 [0096.981] EnumProcessModules (in: hProcess=0x304, lphModule=0x233d00c, cb=0x100, lpcbNeeded=0x498850 | out: lphModule=0x233d00c, lpcbNeeded=0x498850) returned 1 [0096.981] GetModuleInformation (in: hProcess=0x304, hModule=0x310000, lpmodinfo=0x233d14c, cb=0xc | out: lpmodinfo=0x233d14c*(lpBaseOfDll=0x310000, SizeOfImage=0x3e000, EntryPoint=0x3479ce)) returned 1 [0096.981] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0096.981] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x310000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="unlikexpc.exe") returned 0xd [0096.982] CoTaskMemFree (pv=0x5d1c28) [0096.982] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0096.982] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x310000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\unlikexpc.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\unlikexpc.exe")) returned 0x33 [0096.982] CoTaskMemFree (pv=0x5d1c28) [0096.982] GetModuleInformation (in: hProcess=0x304, hModule=0x77ab0000, lpmodinfo=0x233f2a0, cb=0xc | out: lpmodinfo=0x233f2a0*(lpBaseOfDll=0x77ab0000, SizeOfImage=0x180000, EntryPoint=0x0)) returned 1 [0096.982] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0096.982] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x77ab0000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="ntdll.dll") returned 0x9 [0096.982] CoTaskMemFree (pv=0x5d1c28) [0096.982] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0096.982] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x77ab0000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll")) returned 0x1d [0096.982] CoTaskMemFree (pv=0x5d1c28) [0096.982] GetModuleInformation (in: hProcess=0x304, hModule=0x754b0000, lpmodinfo=0x23413a4, cb=0xc | out: lpmodinfo=0x23413a4*(lpBaseOfDll=0x754b0000, SizeOfImage=0x4a000, EntryPoint=0x754b2e54)) returned 1 [0096.983] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0096.983] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x754b0000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="MSCOREE.DLL") returned 0xb [0096.983] CoTaskMemFree (pv=0x5d1c28) [0096.983] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0096.983] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x754b0000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\MSCOREE.DLL" (normalized: "c:\\windows\\system32\\mscoree.dll")) returned 0x1f [0096.983] CoTaskMemFree (pv=0x5d1c28) [0096.983] GetModuleInformation (in: hProcess=0x304, hModule=0x757c0000, lpmodinfo=0x23434b0, cb=0xc | out: lpmodinfo=0x23434b0*(lpBaseOfDll=0x757c0000, SizeOfImage=0x110000, EntryPoint=0x757d32d3)) returned 1 [0096.983] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0096.983] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x757c0000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="KERNEL32.dll") returned 0xc [0096.984] CoTaskMemFree (pv=0x5d1c28) [0096.984] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0096.984] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x757c0000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\KERNEL32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll")) returned 0x20 [0096.984] CoTaskMemFree (pv=0x5d1c28) [0096.984] GetModuleInformation (in: hProcess=0x304, hModule=0x76260000, lpmodinfo=0x23455c4, cb=0xc | out: lpmodinfo=0x23455c4*(lpBaseOfDll=0x76260000, SizeOfImage=0x46000, EntryPoint=0x76267478)) returned 1 [0096.984] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0096.984] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x76260000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="KERNELBASE.dll") returned 0xe [0096.984] CoTaskMemFree (pv=0x5d1c28) [0096.984] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0096.984] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x76260000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\KERNELBASE.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll")) returned 0x22 [0096.985] CoTaskMemFree (pv=0x5d1c28) [0096.985] GetModuleInformation (in: hProcess=0x304, hModule=0x75720000, lpmodinfo=0x234770c, cb=0xc | out: lpmodinfo=0x234770c*(lpBaseOfDll=0x75720000, SizeOfImage=0xa0000, EntryPoint=0x757349e5)) returned 1 [0096.985] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0096.985] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75720000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="ADVAPI32.dll") returned 0xc [0096.985] CoTaskMemFree (pv=0x5d1c28) [0096.985] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0096.985] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75720000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\ADVAPI32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll")) returned 0x20 [0096.985] CoTaskMemFree (pv=0x5d1c28) [0096.985] GetModuleInformation (in: hProcess=0x304, hModule=0x75fe0000, lpmodinfo=0x2349820, cb=0xc | out: lpmodinfo=0x2349820*(lpBaseOfDll=0x75fe0000, SizeOfImage=0xac000, EntryPoint=0x75fea472)) returned 1 [0096.986] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0096.986] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75fe0000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="msvcrt.dll") returned 0xa [0096.986] CoTaskMemFree (pv=0x5d1c28) [0096.986] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0096.986] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75fe0000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll")) returned 0x1e [0096.986] CoTaskMemFree (pv=0x5d1c28) [0096.986] GetModuleInformation (in: hProcess=0x304, hModule=0x761b0000, lpmodinfo=0x234b92c, cb=0xc | out: lpmodinfo=0x234b92c*(lpBaseOfDll=0x761b0000, SizeOfImage=0x19000, EntryPoint=0x761b4975)) returned 1 [0096.987] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0096.987] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x761b0000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="sechost.dll") returned 0xb [0096.987] CoTaskMemFree (pv=0x5d1c28) [0096.987] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0096.987] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x761b0000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll")) returned 0x1f [0096.987] CoTaskMemFree (pv=0x5d1c28) [0096.987] GetModuleInformation (in: hProcess=0x304, hModule=0x76090000, lpmodinfo=0x234da38, cb=0xc | out: lpmodinfo=0x234da38*(lpBaseOfDll=0x76090000, SizeOfImage=0xf0000, EntryPoint=0x760a0569)) returned 1 [0096.987] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0096.987] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x76090000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="RPCRT4.dll") returned 0xa [0096.988] CoTaskMemFree (pv=0x5d1c28) [0096.988] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0096.988] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x76090000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\RPCRT4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll")) returned 0x1e [0096.988] CoTaskMemFree (pv=0x5d1c28) [0096.988] GetModuleInformation (in: hProcess=0x304, hModule=0x75610000, lpmodinfo=0x234fb90, cb=0xc | out: lpmodinfo=0x234fb90*(lpBaseOfDll=0x75610000, SizeOfImage=0x60000, EntryPoint=0x7562a3b3)) returned 1 [0096.989] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0096.989] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75610000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="SspiCli.dll") returned 0xb [0096.989] CoTaskMemFree (pv=0x5d1c28) [0096.989] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0096.989] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75610000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\SspiCli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll")) returned 0x1f [0096.989] CoTaskMemFree (pv=0x5d1c28) [0096.989] GetModuleInformation (in: hProcess=0x304, hModule=0x75600000, lpmodinfo=0x2351c9c, cb=0xc | out: lpmodinfo=0x2351c9c*(lpBaseOfDll=0x75600000, SizeOfImage=0xc000, EntryPoint=0x756010e1)) returned 1 [0096.990] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0096.990] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75600000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="CRYPTBASE.dll") returned 0xd [0096.990] CoTaskMemFree (pv=0x5d1c28) [0096.990] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0096.990] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75600000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\CRYPTBASE.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll")) returned 0x21 [0096.990] CoTaskMemFree (pv=0x5d1c28) [0096.990] GetModuleInformation (in: hProcess=0x304, hModule=0x75430000, lpmodinfo=0x2353db0, cb=0xc | out: lpmodinfo=0x2353db0*(lpBaseOfDll=0x75430000, SizeOfImage=0x78000, EntryPoint=0x7543f7ba)) returned 1 [0096.991] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0096.991] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75430000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="mscoreei.dll") returned 0xc [0096.991] CoTaskMemFree (pv=0x5d1c28) [0096.991] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0096.991] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75430000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscoreei.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\mscoreei.dll")) returned 0x3a [0096.991] CoTaskMemFree (pv=0x5d1c28) [0096.992] GetModuleInformation (in: hProcess=0x304, hModule=0x761d0000, lpmodinfo=0x2355ef8, cb=0xc | out: lpmodinfo=0x2355ef8*(lpBaseOfDll=0x761d0000, SizeOfImage=0x57000, EntryPoint=0x761e9ba6)) returned 1 [0096.992] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0096.992] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x761d0000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="SHLWAPI.dll") returned 0xb [0096.992] CoTaskMemFree (pv=0x5d1c28) [0096.992] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0096.992] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x761d0000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\SHLWAPI.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll")) returned 0x1f [0096.993] CoTaskMemFree (pv=0x5d1c28) [0096.993] GetModuleInformation (in: hProcess=0x304, hModule=0x766d0000, lpmodinfo=0x2358004, cb=0xc | out: lpmodinfo=0x2358004*(lpBaseOfDll=0x766d0000, SizeOfImage=0x90000, EntryPoint=0x766e6343)) returned 1 [0096.993] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0096.993] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x766d0000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="GDI32.dll") returned 0x9 [0096.993] CoTaskMemFree (pv=0x5d1c28) [0096.993] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0096.993] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x766d0000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\GDI32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll")) returned 0x1d [0096.994] CoTaskMemFree (pv=0x5d1c28) [0096.994] GetModuleInformation (in: hProcess=0x304, hModule=0x775b0000, lpmodinfo=0x235a108, cb=0xc | out: lpmodinfo=0x235a108*(lpBaseOfDll=0x775b0000, SizeOfImage=0x100000, EntryPoint=0x775cb6ed)) returned 1 [0096.994] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0096.994] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x775b0000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="USER32.dll") returned 0xa [0096.995] CoTaskMemFree (pv=0x5d1c28) [0096.995] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0096.995] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x775b0000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\USER32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll")) returned 0x1e [0096.995] CoTaskMemFree (pv=0x5d1c28) [0096.995] GetModuleInformation (in: hProcess=0x304, hModule=0x75a70000, lpmodinfo=0x235c214, cb=0xc | out: lpmodinfo=0x235c214*(lpBaseOfDll=0x75a70000, SizeOfImage=0xa000, EntryPoint=0x75a736a0)) returned 1 [0096.995] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0096.996] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75a70000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="LPK.dll") returned 0x7 [0096.996] CoTaskMemFree (pv=0x5d1c28) [0096.996] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0096.996] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75a70000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\LPK.dll" (normalized: "c:\\windows\\syswow64\\lpk.dll")) returned 0x1b [0096.996] CoTaskMemFree (pv=0x5d1c28) [0096.996] GetModuleInformation (in: hProcess=0x304, hModule=0x758d0000, lpmodinfo=0x235e310, cb=0xc | out: lpmodinfo=0x235e310*(lpBaseOfDll=0x758d0000, SizeOfImage=0x9d000, EntryPoint=0x75903fd7)) returned 1 [0096.997] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0096.997] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x758d0000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="USP10.dll") returned 0x9 [0096.997] CoTaskMemFree (pv=0x5d1c28) [0096.997] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0096.997] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x758d0000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\USP10.dll" (normalized: "c:\\windows\\syswow64\\usp10.dll")) returned 0x1d [0096.998] CoTaskMemFree (pv=0x5d1c28) [0096.998] GetModuleInformation (in: hProcess=0x304, hModule=0x75f80000, lpmodinfo=0x23604a0, cb=0xc | out: lpmodinfo=0x23604a0*(lpBaseOfDll=0x75f80000, SizeOfImage=0x60000, EntryPoint=0x75f9158f)) returned 1 [0096.998] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0096.998] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75f80000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="IMM32.DLL") returned 0x9 [0096.999] CoTaskMemFree (pv=0x5d1c28) [0096.999] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0096.999] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75f80000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\system32\\IMM32.DLL" (normalized: "c:\\windows\\system32\\imm32.dll")) returned 0x1d [0096.999] CoTaskMemFree (pv=0x5d1c28) [0096.999] GetModuleInformation (in: hProcess=0x304, hModule=0x75ea0000, lpmodinfo=0x23625a4, cb=0xc | out: lpmodinfo=0x23625a4*(lpBaseOfDll=0x75ea0000, SizeOfImage=0xcc000, EntryPoint=0x75ea168b)) returned 1 [0096.999] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0096.999] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75ea0000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="MSCTF.dll") returned 0x9 [0097.000] CoTaskMemFree (pv=0x5d1c28) [0097.000] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0097.000] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75ea0000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\MSCTF.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll")) returned 0x1d [0097.000] CoTaskMemFree (pv=0x5d1c28) [0097.001] GetModuleInformation (in: hProcess=0x304, hModule=0x75420000, lpmodinfo=0x23646a8, cb=0xc | out: lpmodinfo=0x23646a8*(lpBaseOfDll=0x75420000, SizeOfImage=0x9000, EntryPoint=0x75421220)) returned 1 [0097.001] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0097.001] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75420000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="VERSION.dll") returned 0xb [0097.001] CoTaskMemFree (pv=0x5d1c28) [0097.001] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0097.001] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75420000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\system32\\VERSION.dll" (normalized: "c:\\windows\\system32\\version.dll")) returned 0x1f [0097.002] CoTaskMemFree (pv=0x5d1c28) [0097.002] GetModuleInformation (in: hProcess=0x304, hModule=0x74890000, lpmodinfo=0x23667b4, cb=0xc | out: lpmodinfo=0x23667b4*(lpBaseOfDll=0x74890000, SizeOfImage=0x6a8000, EntryPoint=0x749d7040)) returned 1 [0097.002] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0097.002] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x74890000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="clr.dll") returned 0x7 [0097.003] CoTaskMemFree (pv=0x5d1c28) [0097.003] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0097.003] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x74890000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\clr.dll")) returned 0x35 [0097.003] CoTaskMemFree (pv=0x5d1c28) [0097.003] GetModuleInformation (in: hProcess=0x304, hModule=0x75320000, lpmodinfo=0x23688e4, cb=0xc | out: lpmodinfo=0x23688e4*(lpBaseOfDll=0x75320000, SizeOfImage=0xf5000, EntryPoint=0x75374160)) returned 1 [0097.004] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0097.004] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75320000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="MSVCR120_CLR0400.dll") returned 0x14 [0097.004] CoTaskMemFree (pv=0x5d1c28) [0097.004] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0097.004] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75320000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\system32\\MSVCR120_CLR0400.dll" (normalized: "c:\\windows\\system32\\msvcr120_clr0400.dll")) returned 0x28 [0097.005] CoTaskMemFree (pv=0x5d1c28) [0097.005] GetModuleInformation (in: hProcess=0x304, hModule=0x72440000, lpmodinfo=0x236aa18, cb=0xc | out: lpmodinfo=0x236aa18*(lpBaseOfDll=0x72440000, SizeOfImage=0x122b000, EntryPoint=0x0)) returned 1 [0097.005] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0097.005] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x72440000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="mscorlib.ni.dll") returned 0xf [0097.006] CoTaskMemFree (pv=0x5d1c28) [0097.006] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0097.006] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x72440000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\b7a12c4c0032847fcc6b9c710460456f\\mscorlib.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\mscorlib\\b7a12c4c0032847fcc6b9c710460456f\\mscorlib.ni.dll")) returned 0x68 [0097.006] CoTaskMemFree (pv=0x5d1c28) [0097.006] GetModuleInformation (in: hProcess=0x304, hModule=0x764e0000, lpmodinfo=0x236cbc0, cb=0xc | out: lpmodinfo=0x236cbc0*(lpBaseOfDll=0x764e0000, SizeOfImage=0x15c000, EntryPoint=0x7652ba3d)) returned 1 [0097.006] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0097.006] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x764e0000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="ole32.dll") returned 0x9 [0097.007] CoTaskMemFree (pv=0x5d1c28) [0097.007] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0097.007] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x764e0000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll")) returned 0x1d [0097.007] CoTaskMemFree (pv=0x5d1c28) [0097.007] GetModuleInformation (in: hProcess=0x304, hModule=0x74f60000, lpmodinfo=0x236ecc4, cb=0xc | out: lpmodinfo=0x236ecc4*(lpBaseOfDll=0x74f60000, SizeOfImage=0x80000, EntryPoint=0x74f737c9)) returned 1 [0097.007] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0097.007] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x74f60000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="uxtheme.dll") returned 0xb [0097.008] CoTaskMemFree (pv=0x5d1c28) [0097.008] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0097.008] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x74f60000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\system32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll")) returned 0x1f [0097.008] CoTaskMemFree (pv=0x5d1c28) [0097.008] GetModuleInformation (in: hProcess=0x304, hModule=0x752a0000, lpmodinfo=0x2370dd0, cb=0xc | out: lpmodinfo=0x2370dd0*(lpBaseOfDll=0x752a0000, SizeOfImage=0x7d000, EntryPoint=0x752a1140)) returned 1 [0097.009] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0097.009] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x752a0000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="clrjit.dll") returned 0xa [0097.009] CoTaskMemFree (pv=0x5d1c28) [0097.009] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0097.009] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x752a0000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clrjit.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\clrjit.dll")) returned 0x38 [0097.009] CoTaskMemFree (pv=0x5d1c28) [0097.010] GetModuleInformation (in: hProcess=0x304, hModule=0x762b0000, lpmodinfo=0x2372f10, cb=0xc | out: lpmodinfo=0x2372f10*(lpBaseOfDll=0x762b0000, SizeOfImage=0x8f000, EntryPoint=0x762b3fb1)) returned 1 [0097.010] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0097.010] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x762b0000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="OLEAUT32.dll") returned 0xc [0097.010] CoTaskMemFree (pv=0x5d1c28) [0097.010] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0097.010] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x762b0000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\OLEAUT32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll")) returned 0x20 [0097.011] CoTaskMemFree (pv=0x5d1c28) [0097.011] GetModuleInformation (in: hProcess=0x304, hModule=0x736d0000, lpmodinfo=0x2375024, cb=0xc | out: lpmodinfo=0x2375024*(lpBaseOfDll=0x736d0000, SizeOfImage=0x9ad000, EntryPoint=0x0)) returned 1 [0097.011] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0097.011] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x736d0000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="System.ni.dll") returned 0xd [0097.012] CoTaskMemFree (pv=0x5d1c28) [0097.012] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0097.012] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x736d0000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System\\500ffa28b327e171fe664023003e947e\\System.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system\\500ffa28b327e171fe664023003e947e\\system.ni.dll")) returned 0x64 [0097.012] CoTaskMemFree (pv=0x5d1c28) [0097.012] GetModuleInformation (in: hProcess=0x304, hModule=0x71d20000, lpmodinfo=0x23771c0, cb=0xc | out: lpmodinfo=0x23771c0*(lpBaseOfDll=0x71d20000, SizeOfImage=0x716000, EntryPoint=0x0)) returned 1 [0097.012] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0097.012] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x71d20000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="System.Core.ni.dll") returned 0x12 [0097.013] CoTaskMemFree (pv=0x5d1c28) [0097.013] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0097.013] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x71d20000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Core\\386fde9190d499d6645df8b90eb76242\\System.Core.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.core\\386fde9190d499d6645df8b90eb76242\\system.core.ni.dll")) returned 0x6e [0097.013] CoTaskMemFree (pv=0x5d1c28) [0097.013] GetModuleInformation (in: hProcess=0x304, hModule=0x750d0000, lpmodinfo=0x237937c, cb=0xc | out: lpmodinfo=0x237937c*(lpBaseOfDll=0x750d0000, SizeOfImage=0x1cb000, EntryPoint=0x0)) returned 1 [0097.014] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0097.014] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x750d0000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="Microsoft.VisualBasic.ni.dll") returned 0x1c [0097.014] CoTaskMemFree (pv=0x5d1c28) [0097.014] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0097.014] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x750d0000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Microsoft.V9921e851#\\cfbddeb6e93e8f421b92229b20e51233\\Microsoft.VisualBasic.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\microsoft.v9921e851#\\cfbddeb6e93e8f421b92229b20e51233\\microsoft.visualbasic.ni.dll")) returned 0x81 [0097.015] CoTaskMemFree (pv=0x5d1c28) [0097.015] GetModuleInformation (in: hProcess=0x304, hModule=0x750b0000, lpmodinfo=0x237b570, cb=0xc | out: lpmodinfo=0x237b570*(lpBaseOfDll=0x750b0000, SizeOfImage=0x13000, EntryPoint=0x750b18f0)) returned 1 [0097.015] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0097.015] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x750b0000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="nlssorting.dll") returned 0xe [0097.016] CoTaskMemFree (pv=0x5d1c28) [0097.016] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0097.016] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x750b0000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\nlssorting.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\nlssorting.dll")) returned 0x3c [0097.016] CoTaskMemFree (pv=0x5d1c28) [0097.016] GetModuleInformation (in: hProcess=0x304, hModule=0x74870000, lpmodinfo=0x237d6c0, cb=0xc | out: lpmodinfo=0x237d6c0*(lpBaseOfDll=0x74870000, SizeOfImage=0x16000, EntryPoint=0x74872dc3)) returned 1 [0097.017] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0097.017] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x74870000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="CRYPTSP.dll") returned 0xb [0097.017] CoTaskMemFree (pv=0x5d1c28) [0097.017] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0097.017] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x74870000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\system32\\CRYPTSP.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll")) returned 0x1f [0097.018] CoTaskMemFree (pv=0x5d1c28) [0097.018] GetModuleInformation (in: hProcess=0x304, hModule=0x74830000, lpmodinfo=0x237f7cc, cb=0xc | out: lpmodinfo=0x237f7cc*(lpBaseOfDll=0x74830000, SizeOfImage=0x3b000, EntryPoint=0x7483128d)) returned 1 [0097.018] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0097.018] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x74830000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="rsaenh.dll") returned 0xa [0097.018] CoTaskMemFree (pv=0x5d1c28) [0097.018] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0097.019] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x74830000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\system32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll")) returned 0x1e [0097.019] CoTaskMemFree (pv=0x5d1c28) [0097.019] GetModuleInformation (in: hProcess=0x304, hModule=0x75a60000, lpmodinfo=0x23819e4, cb=0xc | out: lpmodinfo=0x23819e4*(lpBaseOfDll=0x75a60000, SizeOfImage=0x5000, EntryPoint=0x75a61438)) returned 1 [0097.019] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0097.019] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75a60000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="psapi.dll") returned 0x9 [0097.020] CoTaskMemFree (pv=0x5d1c28) [0097.020] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0097.020] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75a60000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\psapi.dll" (normalized: "c:\\windows\\syswow64\\psapi.dll")) returned 0x1d [0097.021] CoTaskMemFree (pv=0x5d1c28) [0097.021] GetModuleInformation (in: hProcess=0x304, hModule=0x746a0000, lpmodinfo=0x2383ae8, cb=0xc | out: lpmodinfo=0x2383ae8*(lpBaseOfDll=0x746a0000, SizeOfImage=0x18d000, EntryPoint=0x0)) returned 1 [0097.021] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0097.021] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x746a0000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="System.Drawing.ni.dll") returned 0x15 [0097.022] CoTaskMemFree (pv=0x5d1c28) [0097.022] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0097.022] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x746a0000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Drawing\\553c0312fdf5a5449f3649f0515e70fb\\System.Drawing.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.drawing\\553c0312fdf5a5449f3649f0515e70fb\\system.drawing.ni.dll")) returned 0x74 [0097.022] CoTaskMemFree (pv=0x5d1c28) [0097.022] GetModuleInformation (in: hProcess=0x304, hModule=0x710c0000, lpmodinfo=0x2385cb4, cb=0xc | out: lpmodinfo=0x2385cb4*(lpBaseOfDll=0x710c0000, SizeOfImage=0xc58000, EntryPoint=0x0)) returned 1 [0097.023] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0097.023] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x710c0000, lpBaseName=0x5d1c28, nSize=0x800 | out: lpBaseName="System.Windows.Forms.ni.dll") returned 0x1b [0097.023] CoTaskMemFree (pv=0x5d1c28) [0097.023] CoTaskMemAlloc (cb=0x804) returned 0x5d1c28 [0097.023] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x710c0000, lpFilename=0x5d1c28, nSize=0x800 | out: lpFilename="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Windows.Forms\\7a6894982f35a1d75ec73d447c583da2\\System.Windows.Forms.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.windows.forms\\7a6894982f35a1d75ec73d447c583da2\\system.windows.forms.ni.dll")) returned 0x80 [0097.024] CoTaskMemFree (pv=0x5d1c28) [0097.024] CloseHandle (hObject=0x304) returned 1 [0097.117] GetCurrentProcessId () returned 0x9f8 [0097.118] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x9f8) returned 0x304 [0097.118] EnumProcessModules (in: hProcess=0x304, lphModule=0x22890a8, cb=0x100, lpcbNeeded=0x498850 | out: lphModule=0x22890a8, lpcbNeeded=0x498850) returned 1 [0097.118] GetModuleInformation (in: hProcess=0x304, hModule=0x310000, lpmodinfo=0x22891e8, cb=0xc | out: lpmodinfo=0x22891e8*(lpBaseOfDll=0x310000, SizeOfImage=0x3e000, EntryPoint=0x3479ce)) returned 1 [0097.118] CoTaskMemAlloc (cb=0x804) returned 0x5d7100 [0097.118] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x310000, lpBaseName=0x5d7100, nSize=0x800 | out: lpBaseName="unlikexpc.exe") returned 0xd [0097.119] CoTaskMemFree (pv=0x5d7100) [0097.119] CoTaskMemAlloc (cb=0x804) returned 0x5d7100 [0097.119] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x310000, lpFilename=0x5d7100, nSize=0x800 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\unlikexpc.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\unlikexpc.exe")) returned 0x33 [0097.119] CoTaskMemFree (pv=0x5d7100) [0097.119] GetModuleInformation (in: hProcess=0x304, hModule=0x77ab0000, lpmodinfo=0x228b33c, cb=0xc | out: lpmodinfo=0x228b33c*(lpBaseOfDll=0x77ab0000, SizeOfImage=0x180000, EntryPoint=0x0)) returned 1 [0097.119] CoTaskMemAlloc (cb=0x804) returned 0x5d7100 [0097.119] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x77ab0000, lpBaseName=0x5d7100, nSize=0x800 | out: lpBaseName="ntdll.dll") returned 0x9 [0097.119] CoTaskMemFree (pv=0x5d7100) [0097.119] CoTaskMemAlloc (cb=0x804) returned 0x5d7100 [0097.119] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x77ab0000, lpFilename=0x5d7100, nSize=0x800 | out: lpFilename="C:\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll")) returned 0x1d [0097.119] CoTaskMemFree (pv=0x5d7100) [0097.119] GetModuleInformation (in: hProcess=0x304, hModule=0x754b0000, lpmodinfo=0x228d440, cb=0xc | out: lpmodinfo=0x228d440*(lpBaseOfDll=0x754b0000, SizeOfImage=0x4a000, EntryPoint=0x754b2e54)) returned 1 [0097.119] CoTaskMemAlloc (cb=0x804) returned 0x5d7100 [0097.119] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x754b0000, lpBaseName=0x5d7100, nSize=0x800 | out: lpBaseName="MSCOREE.DLL") returned 0xb [0097.120] CoTaskMemFree (pv=0x5d7100) [0097.120] CoTaskMemAlloc (cb=0x804) returned 0x5d7100 [0097.120] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x754b0000, lpFilename=0x5d7100, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\MSCOREE.DLL" (normalized: "c:\\windows\\system32\\mscoree.dll")) returned 0x1f [0097.120] CoTaskMemFree (pv=0x5d7100) [0097.120] GetModuleInformation (in: hProcess=0x304, hModule=0x757c0000, lpmodinfo=0x228f54c, cb=0xc | out: lpmodinfo=0x228f54c*(lpBaseOfDll=0x757c0000, SizeOfImage=0x110000, EntryPoint=0x757d32d3)) returned 1 [0097.120] CoTaskMemAlloc (cb=0x804) returned 0x5d7100 [0097.120] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x757c0000, lpBaseName=0x5d7100, nSize=0x800 | out: lpBaseName="KERNEL32.dll") returned 0xc [0097.120] CoTaskMemFree (pv=0x5d7100) [0097.120] CoTaskMemAlloc (cb=0x804) returned 0x5d7100 [0097.120] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x757c0000, lpFilename=0x5d7100, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\KERNEL32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll")) returned 0x20 [0097.120] CoTaskMemFree (pv=0x5d7100) [0097.120] GetModuleInformation (in: hProcess=0x304, hModule=0x76260000, lpmodinfo=0x2291660, cb=0xc | out: lpmodinfo=0x2291660*(lpBaseOfDll=0x76260000, SizeOfImage=0x46000, EntryPoint=0x76267478)) returned 1 [0097.120] CoTaskMemAlloc (cb=0x804) returned 0x5d7100 [0097.120] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x76260000, lpBaseName=0x5d7100, nSize=0x800 | out: lpBaseName="KERNELBASE.dll") returned 0xe [0097.121] CoTaskMemFree (pv=0x5d7100) [0097.121] CoTaskMemAlloc (cb=0x804) returned 0x5d7100 [0097.121] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x76260000, lpFilename=0x5d7100, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\KERNELBASE.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll")) returned 0x22 [0097.121] CoTaskMemFree (pv=0x5d7100) [0097.121] GetModuleInformation (in: hProcess=0x304, hModule=0x75720000, lpmodinfo=0x22937a8, cb=0xc | out: lpmodinfo=0x22937a8*(lpBaseOfDll=0x75720000, SizeOfImage=0xa0000, EntryPoint=0x757349e5)) returned 1 [0097.121] CoTaskMemAlloc (cb=0x804) returned 0x5d7100 [0097.121] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75720000, lpBaseName=0x5d7100, nSize=0x800 | out: lpBaseName="ADVAPI32.dll") returned 0xc [0097.121] CoTaskMemFree (pv=0x5d7100) [0097.121] CoTaskMemAlloc (cb=0x804) returned 0x5d7100 [0097.121] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75720000, lpFilename=0x5d7100, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\ADVAPI32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll")) returned 0x20 [0097.121] CoTaskMemFree (pv=0x5d7100) [0097.121] GetModuleInformation (in: hProcess=0x304, hModule=0x75fe0000, lpmodinfo=0x22958bc, cb=0xc | out: lpmodinfo=0x22958bc*(lpBaseOfDll=0x75fe0000, SizeOfImage=0xac000, EntryPoint=0x75fea472)) returned 1 [0097.122] CoTaskMemAlloc (cb=0x804) returned 0x5d7100 [0097.122] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75fe0000, lpBaseName=0x5d7100, nSize=0x800 | out: lpBaseName="msvcrt.dll") returned 0xa [0097.122] CoTaskMemFree (pv=0x5d7100) [0097.122] CoTaskMemAlloc (cb=0x804) returned 0x5d7100 [0097.122] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75fe0000, lpFilename=0x5d7100, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll")) returned 0x1e [0097.122] CoTaskMemFree (pv=0x5d7100) [0097.122] GetModuleInformation (in: hProcess=0x304, hModule=0x761b0000, lpmodinfo=0x22979c8, cb=0xc | out: lpmodinfo=0x22979c8*(lpBaseOfDll=0x761b0000, SizeOfImage=0x19000, EntryPoint=0x761b4975)) returned 1 [0097.122] CoTaskMemAlloc (cb=0x804) returned 0x5d7100 [0097.122] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x761b0000, lpBaseName=0x5d7100, nSize=0x800 | out: lpBaseName="sechost.dll") returned 0xb [0097.122] CoTaskMemFree (pv=0x5d7100) [0097.122] CoTaskMemAlloc (cb=0x804) returned 0x5d7100 [0097.122] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x761b0000, lpFilename=0x5d7100, nSize=0x800 | out: lpFilename="C:\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll")) returned 0x1f [0097.123] CoTaskMemFree (pv=0x5d7100) [0097.123] GetModuleInformation (in: hProcess=0x304, hModule=0x76090000, lpmodinfo=0x2299ad4, cb=0xc | out: lpmodinfo=0x2299ad4*(lpBaseOfDll=0x76090000, SizeOfImage=0xf0000, EntryPoint=0x760a0569)) returned 1 [0097.123] CoTaskMemAlloc (cb=0x804) returned 0x5d7100 [0097.123] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x76090000, lpBaseName=0x5d7100, nSize=0x800 | out: lpBaseName="RPCRT4.dll") returned 0xa [0097.123] CoTaskMemFree (pv=0x5d7100) [0097.123] CoTaskMemAlloc (cb=0x804) returned 0x5d7100 [0097.123] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x76090000, lpFilename=0x5d7100, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\RPCRT4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll")) returned 0x1e [0097.123] CoTaskMemFree (pv=0x5d7100) [0097.123] GetModuleInformation (in: hProcess=0x304, hModule=0x75610000, lpmodinfo=0x229bc2c, cb=0xc | out: lpmodinfo=0x229bc2c*(lpBaseOfDll=0x75610000, SizeOfImage=0x60000, EntryPoint=0x7562a3b3)) returned 1 [0097.123] CoTaskMemAlloc (cb=0x804) returned 0x5d7100 [0097.124] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75610000, lpBaseName=0x5d7100, nSize=0x800 | out: lpBaseName="SspiCli.dll") returned 0xb [0097.124] CoTaskMemFree (pv=0x5d7100) [0097.124] CoTaskMemAlloc (cb=0x804) returned 0x5d7100 [0097.124] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75610000, lpFilename=0x5d7100, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\SspiCli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll")) returned 0x1f [0097.124] CoTaskMemFree (pv=0x5d7100) [0097.124] GetModuleInformation (in: hProcess=0x304, hModule=0x75600000, lpmodinfo=0x229dd38, cb=0xc | out: lpmodinfo=0x229dd38*(lpBaseOfDll=0x75600000, SizeOfImage=0xc000, EntryPoint=0x756010e1)) returned 1 [0097.124] CoTaskMemAlloc (cb=0x804) returned 0x5d7100 [0097.124] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75600000, lpBaseName=0x5d7100, nSize=0x800 | out: lpBaseName="CRYPTBASE.dll") returned 0xd [0097.124] CoTaskMemFree (pv=0x5d7100) [0097.124] CoTaskMemAlloc (cb=0x804) returned 0x5d7100 [0097.124] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75600000, lpFilename=0x5d7100, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\CRYPTBASE.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll")) returned 0x21 [0097.125] CoTaskMemFree (pv=0x5d7100) [0097.125] GetModuleInformation (in: hProcess=0x304, hModule=0x75430000, lpmodinfo=0x229fe4c, cb=0xc | out: lpmodinfo=0x229fe4c*(lpBaseOfDll=0x75430000, SizeOfImage=0x78000, EntryPoint=0x7543f7ba)) returned 1 [0097.125] CoTaskMemAlloc (cb=0x804) returned 0x5d7100 [0097.125] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75430000, lpBaseName=0x5d7100, nSize=0x800 | out: lpBaseName="mscoreei.dll") returned 0xc [0097.125] CoTaskMemFree (pv=0x5d7100) [0097.125] CoTaskMemAlloc (cb=0x804) returned 0x5d7100 [0097.125] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75430000, lpFilename=0x5d7100, nSize=0x800 | out: lpFilename="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscoreei.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\mscoreei.dll")) returned 0x3a [0097.125] CoTaskMemFree (pv=0x5d7100) [0097.125] GetModuleInformation (in: hProcess=0x304, hModule=0x761d0000, lpmodinfo=0x22a1f94, cb=0xc | out: lpmodinfo=0x22a1f94*(lpBaseOfDll=0x761d0000, SizeOfImage=0x57000, EntryPoint=0x761e9ba6)) returned 1 [0097.126] CoTaskMemAlloc (cb=0x804) returned 0x5d7100 [0097.126] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x761d0000, lpBaseName=0x5d7100, nSize=0x800 | out: lpBaseName="SHLWAPI.dll") returned 0xb [0097.126] CoTaskMemFree (pv=0x5d7100) [0097.126] CoTaskMemAlloc (cb=0x804) returned 0x5d7100 [0097.126] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x761d0000, lpFilename=0x5d7100, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\SHLWAPI.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll")) returned 0x1f [0097.126] CoTaskMemFree (pv=0x5d7100) [0097.126] GetModuleInformation (in: hProcess=0x304, hModule=0x766d0000, lpmodinfo=0x22a40a0, cb=0xc | out: lpmodinfo=0x22a40a0*(lpBaseOfDll=0x766d0000, SizeOfImage=0x90000, EntryPoint=0x766e6343)) returned 1 [0097.126] CoTaskMemAlloc (cb=0x804) returned 0x5d7100 [0097.127] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x766d0000, lpBaseName=0x5d7100, nSize=0x800 | out: lpBaseName="GDI32.dll") returned 0x9 [0097.127] CoTaskMemFree (pv=0x5d7100) [0097.127] CoTaskMemAlloc (cb=0x804) returned 0x5d7100 [0097.127] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x766d0000, lpFilename=0x5d7100, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\GDI32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll")) returned 0x1d [0097.127] CoTaskMemFree (pv=0x5d7100) [0097.127] GetModuleInformation (in: hProcess=0x304, hModule=0x775b0000, lpmodinfo=0x22a61a4, cb=0xc | out: lpmodinfo=0x22a61a4*(lpBaseOfDll=0x775b0000, SizeOfImage=0x100000, EntryPoint=0x775cb6ed)) returned 1 [0097.127] CoTaskMemAlloc (cb=0x804) returned 0x5d7100 [0097.127] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x775b0000, lpBaseName=0x5d7100, nSize=0x800 | out: lpBaseName="USER32.dll") returned 0xa [0097.128] CoTaskMemFree (pv=0x5d7100) [0097.128] CoTaskMemAlloc (cb=0x804) returned 0x5d7100 [0097.128] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x775b0000, lpFilename=0x5d7100, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\USER32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll")) returned 0x1e [0097.128] CoTaskMemFree (pv=0x5d7100) [0097.128] GetModuleInformation (in: hProcess=0x304, hModule=0x75a70000, lpmodinfo=0x22a82b0, cb=0xc | out: lpmodinfo=0x22a82b0*(lpBaseOfDll=0x75a70000, SizeOfImage=0xa000, EntryPoint=0x75a736a0)) returned 1 [0097.128] CoTaskMemAlloc (cb=0x804) returned 0x5d7100 [0097.128] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75a70000, lpBaseName=0x5d7100, nSize=0x800 | out: lpBaseName="LPK.dll") returned 0x7 [0097.129] CoTaskMemFree (pv=0x5d7100) [0097.129] CoTaskMemAlloc (cb=0x804) returned 0x5d7100 [0097.129] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75a70000, lpFilename=0x5d7100, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\LPK.dll" (normalized: "c:\\windows\\syswow64\\lpk.dll")) returned 0x1b [0097.129] CoTaskMemFree (pv=0x5d7100) [0097.129] GetModuleInformation (in: hProcess=0x304, hModule=0x758d0000, lpmodinfo=0x22aa3ac, cb=0xc | out: lpmodinfo=0x22aa3ac*(lpBaseOfDll=0x758d0000, SizeOfImage=0x9d000, EntryPoint=0x75903fd7)) returned 1 [0097.129] CoTaskMemAlloc (cb=0x804) returned 0x5d7100 [0097.129] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x758d0000, lpBaseName=0x5d7100, nSize=0x800 | out: lpBaseName="USP10.dll") returned 0x9 [0097.130] CoTaskMemFree (pv=0x5d7100) [0097.130] CoTaskMemAlloc (cb=0x804) returned 0x5d7100 [0097.130] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x758d0000, lpFilename=0x5d7100, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\USP10.dll" (normalized: "c:\\windows\\syswow64\\usp10.dll")) returned 0x1d [0097.130] CoTaskMemFree (pv=0x5d7100) [0097.130] GetModuleInformation (in: hProcess=0x304, hModule=0x75f80000, lpmodinfo=0x22ac53c, cb=0xc | out: lpmodinfo=0x22ac53c*(lpBaseOfDll=0x75f80000, SizeOfImage=0x60000, EntryPoint=0x75f9158f)) returned 1 [0097.130] CoTaskMemAlloc (cb=0x804) returned 0x5d7100 [0097.130] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75f80000, lpBaseName=0x5d7100, nSize=0x800 | out: lpBaseName="IMM32.DLL") returned 0x9 [0097.131] CoTaskMemFree (pv=0x5d7100) [0097.131] CoTaskMemAlloc (cb=0x804) returned 0x5d7100 [0097.131] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75f80000, lpFilename=0x5d7100, nSize=0x800 | out: lpFilename="C:\\Windows\\system32\\IMM32.DLL" (normalized: "c:\\windows\\system32\\imm32.dll")) returned 0x1d [0097.131] CoTaskMemFree (pv=0x5d7100) [0097.131] GetModuleInformation (in: hProcess=0x304, hModule=0x75ea0000, lpmodinfo=0x22ae640, cb=0xc | out: lpmodinfo=0x22ae640*(lpBaseOfDll=0x75ea0000, SizeOfImage=0xcc000, EntryPoint=0x75ea168b)) returned 1 [0097.131] CoTaskMemAlloc (cb=0x804) returned 0x5d7100 [0097.131] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75ea0000, lpBaseName=0x5d7100, nSize=0x800 | out: lpBaseName="MSCTF.dll") returned 0x9 [0097.132] CoTaskMemFree (pv=0x5d7100) [0097.132] CoTaskMemAlloc (cb=0x804) returned 0x5d7100 [0097.132] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75ea0000, lpFilename=0x5d7100, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\MSCTF.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll")) returned 0x1d [0097.132] CoTaskMemFree (pv=0x5d7100) [0097.132] GetModuleInformation (in: hProcess=0x304, hModule=0x75420000, lpmodinfo=0x22b0744, cb=0xc | out: lpmodinfo=0x22b0744*(lpBaseOfDll=0x75420000, SizeOfImage=0x9000, EntryPoint=0x75421220)) returned 1 [0097.132] CoTaskMemAlloc (cb=0x804) returned 0x5d7100 [0097.132] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75420000, lpBaseName=0x5d7100, nSize=0x800 | out: lpBaseName="VERSION.dll") returned 0xb [0097.133] CoTaskMemFree (pv=0x5d7100) [0097.133] CoTaskMemAlloc (cb=0x804) returned 0x5d7100 [0097.133] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75420000, lpFilename=0x5d7100, nSize=0x800 | out: lpFilename="C:\\Windows\\system32\\VERSION.dll" (normalized: "c:\\windows\\system32\\version.dll")) returned 0x1f [0097.133] CoTaskMemFree (pv=0x5d7100) [0097.133] GetModuleInformation (in: hProcess=0x304, hModule=0x74890000, lpmodinfo=0x22b2850, cb=0xc | out: lpmodinfo=0x22b2850*(lpBaseOfDll=0x74890000, SizeOfImage=0x6a8000, EntryPoint=0x749d7040)) returned 1 [0097.133] CoTaskMemAlloc (cb=0x804) returned 0x5d7100 [0097.133] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x74890000, lpBaseName=0x5d7100, nSize=0x800 | out: lpBaseName="clr.dll") returned 0x7 [0097.134] CoTaskMemFree (pv=0x5d7100) [0097.134] CoTaskMemAlloc (cb=0x804) returned 0x5d7100 [0097.134] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x74890000, lpFilename=0x5d7100, nSize=0x800 | out: lpFilename="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\clr.dll")) returned 0x35 [0097.134] CoTaskMemFree (pv=0x5d7100) [0097.134] GetModuleInformation (in: hProcess=0x304, hModule=0x75320000, lpmodinfo=0x22b4980, cb=0xc | out: lpmodinfo=0x22b4980*(lpBaseOfDll=0x75320000, SizeOfImage=0xf5000, EntryPoint=0x75374160)) returned 1 [0097.134] CoTaskMemAlloc (cb=0x804) returned 0x5d7100 [0097.134] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75320000, lpBaseName=0x5d7100, nSize=0x800 | out: lpBaseName="MSVCR120_CLR0400.dll") returned 0x14 [0097.135] CoTaskMemFree (pv=0x5d7100) [0097.135] CoTaskMemAlloc (cb=0x804) returned 0x5d7100 [0097.135] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75320000, lpFilename=0x5d7100, nSize=0x800 | out: lpFilename="C:\\Windows\\system32\\MSVCR120_CLR0400.dll" (normalized: "c:\\windows\\system32\\msvcr120_clr0400.dll")) returned 0x28 [0097.135] CoTaskMemFree (pv=0x5d7100) [0097.135] GetModuleInformation (in: hProcess=0x304, hModule=0x72440000, lpmodinfo=0x22b6ab4, cb=0xc | out: lpmodinfo=0x22b6ab4*(lpBaseOfDll=0x72440000, SizeOfImage=0x122b000, EntryPoint=0x0)) returned 1 [0097.135] CoTaskMemAlloc (cb=0x804) returned 0x5d7100 [0097.135] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x72440000, lpBaseName=0x5d7100, nSize=0x800 | out: lpBaseName="mscorlib.ni.dll") returned 0xf [0097.136] CoTaskMemFree (pv=0x5d7100) [0097.136] CoTaskMemAlloc (cb=0x804) returned 0x5d7100 [0097.136] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x72440000, lpFilename=0x5d7100, nSize=0x800 | out: lpFilename="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\b7a12c4c0032847fcc6b9c710460456f\\mscorlib.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\mscorlib\\b7a12c4c0032847fcc6b9c710460456f\\mscorlib.ni.dll")) returned 0x68 [0097.136] CoTaskMemFree (pv=0x5d7100) [0097.136] GetModuleInformation (in: hProcess=0x304, hModule=0x764e0000, lpmodinfo=0x22b8c5c, cb=0xc | out: lpmodinfo=0x22b8c5c*(lpBaseOfDll=0x764e0000, SizeOfImage=0x15c000, EntryPoint=0x7652ba3d)) returned 1 [0097.137] CoTaskMemAlloc (cb=0x804) returned 0x5d7100 [0097.137] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x764e0000, lpBaseName=0x5d7100, nSize=0x800 | out: lpBaseName="ole32.dll") returned 0x9 [0097.137] CoTaskMemFree (pv=0x5d7100) [0097.137] CoTaskMemAlloc (cb=0x804) returned 0x5d7100 [0097.137] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x764e0000, lpFilename=0x5d7100, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll")) returned 0x1d [0097.137] CoTaskMemFree (pv=0x5d7100) [0097.137] GetModuleInformation (in: hProcess=0x304, hModule=0x74f60000, lpmodinfo=0x22bad60, cb=0xc | out: lpmodinfo=0x22bad60*(lpBaseOfDll=0x74f60000, SizeOfImage=0x80000, EntryPoint=0x74f737c9)) returned 1 [0097.138] CoTaskMemAlloc (cb=0x804) returned 0x5d7100 [0097.138] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x74f60000, lpBaseName=0x5d7100, nSize=0x800 | out: lpBaseName="uxtheme.dll") returned 0xb [0097.138] CoTaskMemFree (pv=0x5d7100) [0097.138] CoTaskMemAlloc (cb=0x804) returned 0x5d7100 [0097.138] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x74f60000, lpFilename=0x5d7100, nSize=0x800 | out: lpFilename="C:\\Windows\\system32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll")) returned 0x1f [0097.139] CoTaskMemFree (pv=0x5d7100) [0097.139] GetModuleInformation (in: hProcess=0x304, hModule=0x752a0000, lpmodinfo=0x22bce6c, cb=0xc | out: lpmodinfo=0x22bce6c*(lpBaseOfDll=0x752a0000, SizeOfImage=0x7d000, EntryPoint=0x752a1140)) returned 1 [0097.139] CoTaskMemAlloc (cb=0x804) returned 0x5d7100 [0097.139] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x752a0000, lpBaseName=0x5d7100, nSize=0x800 | out: lpBaseName="clrjit.dll") returned 0xa [0097.139] CoTaskMemFree (pv=0x5d7100) [0097.139] CoTaskMemAlloc (cb=0x804) returned 0x5d7100 [0097.139] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x752a0000, lpFilename=0x5d7100, nSize=0x800 | out: lpFilename="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clrjit.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\clrjit.dll")) returned 0x38 [0097.140] CoTaskMemFree (pv=0x5d7100) [0097.140] GetModuleInformation (in: hProcess=0x304, hModule=0x762b0000, lpmodinfo=0x22befac, cb=0xc | out: lpmodinfo=0x22befac*(lpBaseOfDll=0x762b0000, SizeOfImage=0x8f000, EntryPoint=0x762b3fb1)) returned 1 [0097.140] CoTaskMemAlloc (cb=0x804) returned 0x5d7100 [0097.140] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x762b0000, lpBaseName=0x5d7100, nSize=0x800 | out: lpBaseName="OLEAUT32.dll") returned 0xc [0097.141] CoTaskMemFree (pv=0x5d7100) [0097.141] CoTaskMemAlloc (cb=0x804) returned 0x5d7100 [0097.141] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x762b0000, lpFilename=0x5d7100, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\OLEAUT32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll")) returned 0x20 [0097.141] CoTaskMemFree (pv=0x5d7100) [0097.141] GetModuleInformation (in: hProcess=0x304, hModule=0x736d0000, lpmodinfo=0x22c10c0, cb=0xc | out: lpmodinfo=0x22c10c0*(lpBaseOfDll=0x736d0000, SizeOfImage=0x9ad000, EntryPoint=0x0)) returned 1 [0097.141] CoTaskMemAlloc (cb=0x804) returned 0x5d7100 [0097.141] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x736d0000, lpBaseName=0x5d7100, nSize=0x800 | out: lpBaseName="System.ni.dll") returned 0xd [0097.142] CoTaskMemFree (pv=0x5d7100) [0097.142] CoTaskMemAlloc (cb=0x804) returned 0x5d7100 [0097.142] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x736d0000, lpFilename=0x5d7100, nSize=0x800 | out: lpFilename="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System\\500ffa28b327e171fe664023003e947e\\System.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system\\500ffa28b327e171fe664023003e947e\\system.ni.dll")) returned 0x64 [0097.142] CoTaskMemFree (pv=0x5d7100) [0097.142] GetModuleInformation (in: hProcess=0x304, hModule=0x71d20000, lpmodinfo=0x22c325c, cb=0xc | out: lpmodinfo=0x22c325c*(lpBaseOfDll=0x71d20000, SizeOfImage=0x716000, EntryPoint=0x0)) returned 1 [0097.143] CoTaskMemAlloc (cb=0x804) returned 0x5d7100 [0097.143] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x71d20000, lpBaseName=0x5d7100, nSize=0x800 | out: lpBaseName="System.Core.ni.dll") returned 0x12 [0097.143] CoTaskMemFree (pv=0x5d7100) [0097.143] CoTaskMemAlloc (cb=0x804) returned 0x5d7100 [0097.144] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x71d20000, lpFilename=0x5d7100, nSize=0x800 | out: lpFilename="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Core\\386fde9190d499d6645df8b90eb76242\\System.Core.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.core\\386fde9190d499d6645df8b90eb76242\\system.core.ni.dll")) returned 0x6e [0097.144] CoTaskMemFree (pv=0x5d7100) [0097.144] GetModuleInformation (in: hProcess=0x304, hModule=0x750d0000, lpmodinfo=0x22c5418, cb=0xc | out: lpmodinfo=0x22c5418*(lpBaseOfDll=0x750d0000, SizeOfImage=0x1cb000, EntryPoint=0x0)) returned 1 [0097.145] CoTaskMemAlloc (cb=0x804) returned 0x5d7100 [0097.145] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x750d0000, lpBaseName=0x5d7100, nSize=0x800 | out: lpBaseName="Microsoft.VisualBasic.ni.dll") returned 0x1c [0097.145] CoTaskMemFree (pv=0x5d7100) [0097.145] CoTaskMemAlloc (cb=0x804) returned 0x5d7100 [0097.145] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x750d0000, lpFilename=0x5d7100, nSize=0x800 | out: lpFilename="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Microsoft.V9921e851#\\cfbddeb6e93e8f421b92229b20e51233\\Microsoft.VisualBasic.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\microsoft.v9921e851#\\cfbddeb6e93e8f421b92229b20e51233\\microsoft.visualbasic.ni.dll")) returned 0x81 [0097.146] CoTaskMemFree (pv=0x5d7100) [0097.146] GetModuleInformation (in: hProcess=0x304, hModule=0x750b0000, lpmodinfo=0x22c760c, cb=0xc | out: lpmodinfo=0x22c760c*(lpBaseOfDll=0x750b0000, SizeOfImage=0x13000, EntryPoint=0x750b18f0)) returned 1 [0097.146] CoTaskMemAlloc (cb=0x804) returned 0x5d7100 [0097.146] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x750b0000, lpBaseName=0x5d7100, nSize=0x800 | out: lpBaseName="nlssorting.dll") returned 0xe [0097.147] CoTaskMemFree (pv=0x5d7100) [0097.147] CoTaskMemAlloc (cb=0x804) returned 0x5d7100 [0097.147] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x750b0000, lpFilename=0x5d7100, nSize=0x800 | out: lpFilename="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\nlssorting.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\nlssorting.dll")) returned 0x3c [0097.147] CoTaskMemFree (pv=0x5d7100) [0097.147] GetModuleInformation (in: hProcess=0x304, hModule=0x74870000, lpmodinfo=0x22c975c, cb=0xc | out: lpmodinfo=0x22c975c*(lpBaseOfDll=0x74870000, SizeOfImage=0x16000, EntryPoint=0x74872dc3)) returned 1 [0097.148] CoTaskMemAlloc (cb=0x804) returned 0x5d7100 [0097.148] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x74870000, lpBaseName=0x5d7100, nSize=0x800 | out: lpBaseName="CRYPTSP.dll") returned 0xb [0097.148] CoTaskMemFree (pv=0x5d7100) [0097.148] CoTaskMemAlloc (cb=0x804) returned 0x5d7100 [0097.148] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x74870000, lpFilename=0x5d7100, nSize=0x800 | out: lpFilename="C:\\Windows\\system32\\CRYPTSP.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll")) returned 0x1f [0097.149] CoTaskMemFree (pv=0x5d7100) [0097.149] GetModuleInformation (in: hProcess=0x304, hModule=0x74830000, lpmodinfo=0x22cb868, cb=0xc | out: lpmodinfo=0x22cb868*(lpBaseOfDll=0x74830000, SizeOfImage=0x3b000, EntryPoint=0x7483128d)) returned 1 [0097.149] CoTaskMemAlloc (cb=0x804) returned 0x5d7100 [0097.149] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x74830000, lpBaseName=0x5d7100, nSize=0x800 | out: lpBaseName="rsaenh.dll") returned 0xa [0097.150] CoTaskMemFree (pv=0x5d7100) [0097.150] CoTaskMemAlloc (cb=0x804) returned 0x5d7100 [0097.150] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x74830000, lpFilename=0x5d7100, nSize=0x800 | out: lpFilename="C:\\Windows\\system32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll")) returned 0x1e [0097.150] CoTaskMemFree (pv=0x5d7100) [0097.150] GetModuleInformation (in: hProcess=0x304, hModule=0x75a60000, lpmodinfo=0x22cda80, cb=0xc | out: lpmodinfo=0x22cda80*(lpBaseOfDll=0x75a60000, SizeOfImage=0x5000, EntryPoint=0x75a61438)) returned 1 [0097.150] CoTaskMemAlloc (cb=0x804) returned 0x5d7100 [0097.151] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75a60000, lpBaseName=0x5d7100, nSize=0x800 | out: lpBaseName="psapi.dll") returned 0x9 [0097.151] CoTaskMemFree (pv=0x5d7100) [0097.151] CoTaskMemAlloc (cb=0x804) returned 0x5d7100 [0097.151] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75a60000, lpFilename=0x5d7100, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\psapi.dll" (normalized: "c:\\windows\\syswow64\\psapi.dll")) returned 0x1d [0097.151] CoTaskMemFree (pv=0x5d7100) [0097.151] GetModuleInformation (in: hProcess=0x304, hModule=0x746a0000, lpmodinfo=0x22cfb84, cb=0xc | out: lpmodinfo=0x22cfb84*(lpBaseOfDll=0x746a0000, SizeOfImage=0x18d000, EntryPoint=0x0)) returned 1 [0097.152] CoTaskMemAlloc (cb=0x804) returned 0x5d7100 [0097.152] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x746a0000, lpBaseName=0x5d7100, nSize=0x800 | out: lpBaseName="System.Drawing.ni.dll") returned 0x15 [0097.152] CoTaskMemFree (pv=0x5d7100) [0097.152] CoTaskMemAlloc (cb=0x804) returned 0x5d7100 [0097.152] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x746a0000, lpFilename=0x5d7100, nSize=0x800 | out: lpFilename="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Drawing\\553c0312fdf5a5449f3649f0515e70fb\\System.Drawing.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.drawing\\553c0312fdf5a5449f3649f0515e70fb\\system.drawing.ni.dll")) returned 0x74 [0097.153] CoTaskMemFree (pv=0x5d7100) [0097.153] GetModuleInformation (in: hProcess=0x304, hModule=0x710c0000, lpmodinfo=0x22d1d50, cb=0xc | out: lpmodinfo=0x22d1d50*(lpBaseOfDll=0x710c0000, SizeOfImage=0xc58000, EntryPoint=0x0)) returned 1 [0097.153] CoTaskMemAlloc (cb=0x804) returned 0x5d7100 [0097.153] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x710c0000, lpBaseName=0x5d7100, nSize=0x800 | out: lpBaseName="System.Windows.Forms.ni.dll") returned 0x1b [0097.154] CoTaskMemFree (pv=0x5d7100) [0097.154] CoTaskMemAlloc (cb=0x804) returned 0x5d7100 [0097.154] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x710c0000, lpFilename=0x5d7100, nSize=0x800 | out: lpFilename="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Windows.Forms\\7a6894982f35a1d75ec73d447c583da2\\System.Windows.Forms.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.windows.forms\\7a6894982f35a1d75ec73d447c583da2\\system.windows.forms.ni.dll")) returned 0x80 [0097.154] CoTaskMemFree (pv=0x5d7100) [0097.154] CloseHandle (hObject=0x304) returned 1 [0097.169] GetCurrentProcessId () returned 0x9f8 [0097.169] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x9f8) returned 0x304 [0097.169] EnumProcessModules (in: hProcess=0x304, lphModule=0x23ca518, cb=0x100, lpcbNeeded=0x498850 | out: lphModule=0x23ca518, lpcbNeeded=0x498850) returned 1 [0097.170] GetModuleInformation (in: hProcess=0x304, hModule=0x310000, lpmodinfo=0x23ca658, cb=0xc | out: lpmodinfo=0x23ca658*(lpBaseOfDll=0x310000, SizeOfImage=0x3e000, EntryPoint=0x3479ce)) returned 1 [0097.170] CoTaskMemAlloc (cb=0x804) returned 0x5d7100 [0097.170] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x310000, lpBaseName=0x5d7100, nSize=0x800 | out: lpBaseName="unlikexpc.exe") returned 0xd [0097.170] CoTaskMemFree (pv=0x5d7100) [0097.170] CoTaskMemAlloc (cb=0x804) returned 0x5d7100 [0097.170] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x310000, lpFilename=0x5d7100, nSize=0x800 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\unlikexpc.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\unlikexpc.exe")) returned 0x33 [0097.170] CoTaskMemFree (pv=0x5d7100) [0097.170] GetModuleInformation (in: hProcess=0x304, hModule=0x77ab0000, lpmodinfo=0x23cc7ac, cb=0xc | out: lpmodinfo=0x23cc7ac*(lpBaseOfDll=0x77ab0000, SizeOfImage=0x180000, EntryPoint=0x0)) returned 1 [0097.170] CoTaskMemAlloc (cb=0x804) returned 0x5d7100 [0097.170] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x77ab0000, lpBaseName=0x5d7100, nSize=0x800 | out: lpBaseName="ntdll.dll") returned 0x9 [0097.171] CoTaskMemFree (pv=0x5d7100) [0097.171] CoTaskMemAlloc (cb=0x804) returned 0x5d7100 [0097.171] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x77ab0000, lpFilename=0x5d7100, nSize=0x800 | out: lpFilename="C:\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll")) returned 0x1d [0097.171] CoTaskMemFree (pv=0x5d7100) [0097.171] GetModuleInformation (in: hProcess=0x304, hModule=0x754b0000, lpmodinfo=0x23ce8b0, cb=0xc | out: lpmodinfo=0x23ce8b0*(lpBaseOfDll=0x754b0000, SizeOfImage=0x4a000, EntryPoint=0x754b2e54)) returned 1 [0097.171] CoTaskMemAlloc (cb=0x804) returned 0x5d7100 [0097.171] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x754b0000, lpBaseName=0x5d7100, nSize=0x800 | out: lpBaseName="MSCOREE.DLL") returned 0xb [0097.171] CoTaskMemFree (pv=0x5d7100) [0097.171] CoTaskMemAlloc (cb=0x804) returned 0x5d7100 [0097.171] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x754b0000, lpFilename=0x5d7100, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\MSCOREE.DLL" (normalized: "c:\\windows\\system32\\mscoree.dll")) returned 0x1f [0097.171] CoTaskMemFree (pv=0x5d7100) [0097.171] GetModuleInformation (in: hProcess=0x304, hModule=0x757c0000, lpmodinfo=0x23d09bc, cb=0xc | out: lpmodinfo=0x23d09bc*(lpBaseOfDll=0x757c0000, SizeOfImage=0x110000, EntryPoint=0x757d32d3)) returned 1 [0097.171] CoTaskMemAlloc (cb=0x804) returned 0x5d7100 [0097.171] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x757c0000, lpBaseName=0x5d7100, nSize=0x800 | out: lpBaseName="KERNEL32.dll") returned 0xc [0097.172] CoTaskMemFree (pv=0x5d7100) [0097.172] CoTaskMemAlloc (cb=0x804) returned 0x5d7100 [0097.172] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x757c0000, lpFilename=0x5d7100, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\KERNEL32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll")) returned 0x20 [0097.172] CoTaskMemFree (pv=0x5d7100) [0097.172] GetModuleInformation (in: hProcess=0x304, hModule=0x76260000, lpmodinfo=0x23d2ad0, cb=0xc | out: lpmodinfo=0x23d2ad0*(lpBaseOfDll=0x76260000, SizeOfImage=0x46000, EntryPoint=0x76267478)) returned 1 [0097.172] CoTaskMemAlloc (cb=0x804) returned 0x5d7100 [0097.172] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x76260000, lpBaseName=0x5d7100, nSize=0x800 | out: lpBaseName="KERNELBASE.dll") returned 0xe [0097.172] CoTaskMemFree (pv=0x5d7100) [0097.172] CoTaskMemAlloc (cb=0x804) returned 0x5d7100 [0097.172] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x76260000, lpFilename=0x5d7100, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\KERNELBASE.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll")) returned 0x22 [0097.172] CoTaskMemFree (pv=0x5d7100) [0097.172] GetModuleInformation (in: hProcess=0x304, hModule=0x75720000, lpmodinfo=0x23d4c18, cb=0xc | out: lpmodinfo=0x23d4c18*(lpBaseOfDll=0x75720000, SizeOfImage=0xa0000, EntryPoint=0x757349e5)) returned 1 [0097.174] CoTaskMemAlloc (cb=0x804) returned 0x5d7100 [0097.174] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75720000, lpBaseName=0x5d7100, nSize=0x800 | out: lpBaseName="ADVAPI32.dll") returned 0xc [0097.175] CoTaskMemFree (pv=0x5d7100) [0097.175] CoTaskMemAlloc (cb=0x804) returned 0x5d7100 [0097.175] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75720000, lpFilename=0x5d7100, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\ADVAPI32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll")) returned 0x20 [0097.175] CoTaskMemFree (pv=0x5d7100) [0097.175] GetModuleInformation (in: hProcess=0x304, hModule=0x75fe0000, lpmodinfo=0x21d9788, cb=0xc | out: lpmodinfo=0x21d9788*(lpBaseOfDll=0x75fe0000, SizeOfImage=0xac000, EntryPoint=0x75fea472)) returned 1 [0097.175] CoTaskMemAlloc (cb=0x804) returned 0x5d7100 [0097.175] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75fe0000, lpBaseName=0x5d7100, nSize=0x800 | out: lpBaseName="msvcrt.dll") returned 0xa [0097.175] CoTaskMemFree (pv=0x5d7100) [0097.175] CoTaskMemAlloc (cb=0x804) returned 0x5d7100 [0097.175] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75fe0000, lpFilename=0x5d7100, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll")) returned 0x1e [0097.175] CoTaskMemFree (pv=0x5d7100) [0097.176] GetModuleInformation (in: hProcess=0x304, hModule=0x761b0000, lpmodinfo=0x21db894, cb=0xc | out: lpmodinfo=0x21db894*(lpBaseOfDll=0x761b0000, SizeOfImage=0x19000, EntryPoint=0x761b4975)) returned 1 [0097.176] CoTaskMemAlloc (cb=0x804) returned 0x5d7100 [0097.176] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x761b0000, lpBaseName=0x5d7100, nSize=0x800 | out: lpBaseName="sechost.dll") returned 0xb [0097.176] CoTaskMemFree (pv=0x5d7100) [0097.176] CoTaskMemAlloc (cb=0x804) returned 0x5d7100 [0097.176] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x761b0000, lpFilename=0x5d7100, nSize=0x800 | out: lpFilename="C:\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll")) returned 0x1f [0097.176] CoTaskMemFree (pv=0x5d7100) [0097.176] GetModuleInformation (in: hProcess=0x304, hModule=0x76090000, lpmodinfo=0x21dd9a0, cb=0xc | out: lpmodinfo=0x21dd9a0*(lpBaseOfDll=0x76090000, SizeOfImage=0xf0000, EntryPoint=0x760a0569)) returned 1 [0097.176] CoTaskMemAlloc (cb=0x804) returned 0x5d7100 [0097.176] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x76090000, lpBaseName=0x5d7100, nSize=0x800 | out: lpBaseName="RPCRT4.dll") returned 0xa [0097.177] CoTaskMemFree (pv=0x5d7100) [0097.177] CoTaskMemAlloc (cb=0x804) returned 0x5d7100 [0097.177] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x76090000, lpFilename=0x5d7100, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\RPCRT4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll")) returned 0x1e [0097.177] CoTaskMemFree (pv=0x5d7100) [0097.177] GetModuleInformation (in: hProcess=0x304, hModule=0x75610000, lpmodinfo=0x21dfaf8, cb=0xc | out: lpmodinfo=0x21dfaf8*(lpBaseOfDll=0x75610000, SizeOfImage=0x60000, EntryPoint=0x7562a3b3)) returned 1 [0097.177] CoTaskMemAlloc (cb=0x804) returned 0x5d7100 [0097.177] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75610000, lpBaseName=0x5d7100, nSize=0x800 | out: lpBaseName="SspiCli.dll") returned 0xb [0097.177] CoTaskMemFree (pv=0x5d7100) [0097.177] CoTaskMemAlloc (cb=0x804) returned 0x5d7100 [0097.177] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75610000, lpFilename=0x5d7100, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\SspiCli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll")) returned 0x1f [0097.178] CoTaskMemFree (pv=0x5d7100) [0097.178] GetModuleInformation (in: hProcess=0x304, hModule=0x75600000, lpmodinfo=0x21e1c04, cb=0xc | out: lpmodinfo=0x21e1c04*(lpBaseOfDll=0x75600000, SizeOfImage=0xc000, EntryPoint=0x756010e1)) returned 1 [0097.178] CoTaskMemAlloc (cb=0x804) returned 0x5d7100 [0097.178] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75600000, lpBaseName=0x5d7100, nSize=0x800 | out: lpBaseName="CRYPTBASE.dll") returned 0xd [0097.178] CoTaskMemFree (pv=0x5d7100) [0097.178] CoTaskMemAlloc (cb=0x804) returned 0x5d7100 [0097.178] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75600000, lpFilename=0x5d7100, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\CRYPTBASE.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll")) returned 0x21 [0097.178] CoTaskMemFree (pv=0x5d7100) [0097.178] GetModuleInformation (in: hProcess=0x304, hModule=0x75430000, lpmodinfo=0x21e3d18, cb=0xc | out: lpmodinfo=0x21e3d18*(lpBaseOfDll=0x75430000, SizeOfImage=0x78000, EntryPoint=0x7543f7ba)) returned 1 [0097.179] CoTaskMemAlloc (cb=0x804) returned 0x5d7100 [0097.179] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75430000, lpBaseName=0x5d7100, nSize=0x800 | out: lpBaseName="mscoreei.dll") returned 0xc [0097.179] CoTaskMemFree (pv=0x5d7100) [0097.179] CoTaskMemAlloc (cb=0x804) returned 0x5d7100 [0097.179] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75430000, lpFilename=0x5d7100, nSize=0x800 | out: lpFilename="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscoreei.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\mscoreei.dll")) returned 0x3a [0097.179] CoTaskMemFree (pv=0x5d7100) [0097.179] GetModuleInformation (in: hProcess=0x304, hModule=0x761d0000, lpmodinfo=0x21e5e60, cb=0xc | out: lpmodinfo=0x21e5e60*(lpBaseOfDll=0x761d0000, SizeOfImage=0x57000, EntryPoint=0x761e9ba6)) returned 1 [0097.180] CoTaskMemAlloc (cb=0x804) returned 0x5d7100 [0097.180] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x761d0000, lpBaseName=0x5d7100, nSize=0x800 | out: lpBaseName="SHLWAPI.dll") returned 0xb [0097.180] CoTaskMemFree (pv=0x5d7100) [0097.180] CoTaskMemAlloc (cb=0x804) returned 0x5d7100 [0097.180] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x761d0000, lpFilename=0x5d7100, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\SHLWAPI.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll")) returned 0x1f [0097.180] CoTaskMemFree (pv=0x5d7100) [0097.180] GetModuleInformation (in: hProcess=0x304, hModule=0x766d0000, lpmodinfo=0x21e7f6c, cb=0xc | out: lpmodinfo=0x21e7f6c*(lpBaseOfDll=0x766d0000, SizeOfImage=0x90000, EntryPoint=0x766e6343)) returned 1 [0097.181] CoTaskMemAlloc (cb=0x804) returned 0x5d7100 [0097.181] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x766d0000, lpBaseName=0x5d7100, nSize=0x800 | out: lpBaseName="GDI32.dll") returned 0x9 [0097.181] CoTaskMemFree (pv=0x5d7100) [0097.181] CoTaskMemAlloc (cb=0x804) returned 0x5d7100 [0097.181] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x766d0000, lpFilename=0x5d7100, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\GDI32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll")) returned 0x1d [0097.181] CoTaskMemFree (pv=0x5d7100) [0097.181] GetModuleInformation (in: hProcess=0x304, hModule=0x775b0000, lpmodinfo=0x21ea070, cb=0xc | out: lpmodinfo=0x21ea070*(lpBaseOfDll=0x775b0000, SizeOfImage=0x100000, EntryPoint=0x775cb6ed)) returned 1 [0097.182] CoTaskMemAlloc (cb=0x804) returned 0x5d7100 [0097.182] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x775b0000, lpBaseName=0x5d7100, nSize=0x800 | out: lpBaseName="USER32.dll") returned 0xa [0097.182] CoTaskMemFree (pv=0x5d7100) [0097.182] CoTaskMemAlloc (cb=0x804) returned 0x5d7100 [0097.182] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x775b0000, lpFilename=0x5d7100, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\USER32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll")) returned 0x1e [0097.182] CoTaskMemFree (pv=0x5d7100) [0097.182] GetModuleInformation (in: hProcess=0x304, hModule=0x75a70000, lpmodinfo=0x21ec17c, cb=0xc | out: lpmodinfo=0x21ec17c*(lpBaseOfDll=0x75a70000, SizeOfImage=0xa000, EntryPoint=0x75a736a0)) returned 1 [0097.183] CoTaskMemAlloc (cb=0x804) returned 0x5d7100 [0097.183] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75a70000, lpBaseName=0x5d7100, nSize=0x800 | out: lpBaseName="LPK.dll") returned 0x7 [0097.183] CoTaskMemFree (pv=0x5d7100) [0097.183] CoTaskMemAlloc (cb=0x804) returned 0x5d7100 [0097.183] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75a70000, lpFilename=0x5d7100, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\LPK.dll" (normalized: "c:\\windows\\syswow64\\lpk.dll")) returned 0x1b [0097.183] CoTaskMemFree (pv=0x5d7100) [0097.183] GetModuleInformation (in: hProcess=0x304, hModule=0x758d0000, lpmodinfo=0x21ee278, cb=0xc | out: lpmodinfo=0x21ee278*(lpBaseOfDll=0x758d0000, SizeOfImage=0x9d000, EntryPoint=0x75903fd7)) returned 1 [0097.183] CoTaskMemAlloc (cb=0x804) returned 0x5d7100 [0097.183] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x758d0000, lpBaseName=0x5d7100, nSize=0x800 | out: lpBaseName="USP10.dll") returned 0x9 [0097.184] CoTaskMemFree (pv=0x5d7100) [0097.184] CoTaskMemAlloc (cb=0x804) returned 0x5d7100 [0097.184] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x758d0000, lpFilename=0x5d7100, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\USP10.dll" (normalized: "c:\\windows\\syswow64\\usp10.dll")) returned 0x1d [0097.184] CoTaskMemFree (pv=0x5d7100) [0097.184] GetModuleInformation (in: hProcess=0x304, hModule=0x75f80000, lpmodinfo=0x21f0408, cb=0xc | out: lpmodinfo=0x21f0408*(lpBaseOfDll=0x75f80000, SizeOfImage=0x60000, EntryPoint=0x75f9158f)) returned 1 [0097.184] CoTaskMemAlloc (cb=0x804) returned 0x5d7100 [0097.184] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75f80000, lpBaseName=0x5d7100, nSize=0x800 | out: lpBaseName="IMM32.DLL") returned 0x9 [0097.185] CoTaskMemFree (pv=0x5d7100) [0097.185] CoTaskMemAlloc (cb=0x804) returned 0x5d7100 [0097.185] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75f80000, lpFilename=0x5d7100, nSize=0x800 | out: lpFilename="C:\\Windows\\system32\\IMM32.DLL" (normalized: "c:\\windows\\system32\\imm32.dll")) returned 0x1d [0097.185] CoTaskMemFree (pv=0x5d7100) [0097.185] GetModuleInformation (in: hProcess=0x304, hModule=0x75ea0000, lpmodinfo=0x21f250c, cb=0xc | out: lpmodinfo=0x21f250c*(lpBaseOfDll=0x75ea0000, SizeOfImage=0xcc000, EntryPoint=0x75ea168b)) returned 1 [0097.185] CoTaskMemAlloc (cb=0x804) returned 0x5d7100 [0097.185] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75ea0000, lpBaseName=0x5d7100, nSize=0x800 | out: lpBaseName="MSCTF.dll") returned 0x9 [0097.186] CoTaskMemFree (pv=0x5d7100) [0097.186] CoTaskMemAlloc (cb=0x804) returned 0x5d7100 [0097.186] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75ea0000, lpFilename=0x5d7100, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\MSCTF.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll")) returned 0x1d [0097.186] CoTaskMemFree (pv=0x5d7100) [0097.186] GetModuleInformation (in: hProcess=0x304, hModule=0x75420000, lpmodinfo=0x21f4610, cb=0xc | out: lpmodinfo=0x21f4610*(lpBaseOfDll=0x75420000, SizeOfImage=0x9000, EntryPoint=0x75421220)) returned 1 [0097.186] CoTaskMemAlloc (cb=0x804) returned 0x5d7100 [0097.186] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75420000, lpBaseName=0x5d7100, nSize=0x800 | out: lpBaseName="VERSION.dll") returned 0xb [0097.187] CoTaskMemFree (pv=0x5d7100) [0097.187] CoTaskMemAlloc (cb=0x804) returned 0x5d7100 [0097.187] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75420000, lpFilename=0x5d7100, nSize=0x800 | out: lpFilename="C:\\Windows\\system32\\VERSION.dll" (normalized: "c:\\windows\\system32\\version.dll")) returned 0x1f [0097.187] CoTaskMemFree (pv=0x5d7100) [0097.187] GetModuleInformation (in: hProcess=0x304, hModule=0x74890000, lpmodinfo=0x21f671c, cb=0xc | out: lpmodinfo=0x21f671c*(lpBaseOfDll=0x74890000, SizeOfImage=0x6a8000, EntryPoint=0x749d7040)) returned 1 [0097.187] CoTaskMemAlloc (cb=0x804) returned 0x5d7100 [0097.187] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x74890000, lpBaseName=0x5d7100, nSize=0x800 | out: lpBaseName="clr.dll") returned 0x7 [0097.188] CoTaskMemFree (pv=0x5d7100) [0097.188] CoTaskMemAlloc (cb=0x804) returned 0x5d7100 [0097.188] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x74890000, lpFilename=0x5d7100, nSize=0x800 | out: lpFilename="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\clr.dll")) returned 0x35 [0097.188] CoTaskMemFree (pv=0x5d7100) [0097.188] GetModuleInformation (in: hProcess=0x304, hModule=0x75320000, lpmodinfo=0x21f884c, cb=0xc | out: lpmodinfo=0x21f884c*(lpBaseOfDll=0x75320000, SizeOfImage=0xf5000, EntryPoint=0x75374160)) returned 1 [0097.188] CoTaskMemAlloc (cb=0x804) returned 0x5d7100 [0097.188] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75320000, lpBaseName=0x5d7100, nSize=0x800 | out: lpBaseName="MSVCR120_CLR0400.dll") returned 0x14 [0097.189] CoTaskMemFree (pv=0x5d7100) [0097.189] CoTaskMemAlloc (cb=0x804) returned 0x5d7100 [0097.189] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75320000, lpFilename=0x5d7100, nSize=0x800 | out: lpFilename="C:\\Windows\\system32\\MSVCR120_CLR0400.dll" (normalized: "c:\\windows\\system32\\msvcr120_clr0400.dll")) returned 0x28 [0097.189] CoTaskMemFree (pv=0x5d7100) [0097.189] GetModuleInformation (in: hProcess=0x304, hModule=0x72440000, lpmodinfo=0x21fa980, cb=0xc | out: lpmodinfo=0x21fa980*(lpBaseOfDll=0x72440000, SizeOfImage=0x122b000, EntryPoint=0x0)) returned 1 [0097.190] CoTaskMemAlloc (cb=0x804) returned 0x5d7100 [0097.190] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x72440000, lpBaseName=0x5d7100, nSize=0x800 | out: lpBaseName="mscorlib.ni.dll") returned 0xf [0097.190] CoTaskMemFree (pv=0x5d7100) [0097.190] CoTaskMemAlloc (cb=0x804) returned 0x5d7100 [0097.190] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x72440000, lpFilename=0x5d7100, nSize=0x800 | out: lpFilename="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\b7a12c4c0032847fcc6b9c710460456f\\mscorlib.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\mscorlib\\b7a12c4c0032847fcc6b9c710460456f\\mscorlib.ni.dll")) returned 0x68 [0097.190] CoTaskMemFree (pv=0x5d7100) [0097.190] GetModuleInformation (in: hProcess=0x304, hModule=0x764e0000, lpmodinfo=0x21fcb28, cb=0xc | out: lpmodinfo=0x21fcb28*(lpBaseOfDll=0x764e0000, SizeOfImage=0x15c000, EntryPoint=0x7652ba3d)) returned 1 [0097.191] CoTaskMemAlloc (cb=0x804) returned 0x5d7100 [0097.191] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x764e0000, lpBaseName=0x5d7100, nSize=0x800 | out: lpBaseName="ole32.dll") returned 0x9 [0097.192] CoTaskMemFree (pv=0x5d7100) [0097.192] CoTaskMemAlloc (cb=0x804) returned 0x5d7100 [0097.192] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x764e0000, lpFilename=0x5d7100, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll")) returned 0x1d [0097.192] CoTaskMemFree (pv=0x5d7100) [0097.192] GetModuleInformation (in: hProcess=0x304, hModule=0x74f60000, lpmodinfo=0x21fec2c, cb=0xc | out: lpmodinfo=0x21fec2c*(lpBaseOfDll=0x74f60000, SizeOfImage=0x80000, EntryPoint=0x74f737c9)) returned 1 [0097.193] CoTaskMemAlloc (cb=0x804) returned 0x5d7100 [0097.193] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x74f60000, lpBaseName=0x5d7100, nSize=0x800 | out: lpBaseName="uxtheme.dll") returned 0xb [0097.193] CoTaskMemFree (pv=0x5d7100) [0097.193] CoTaskMemAlloc (cb=0x804) returned 0x5d7100 [0097.193] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x74f60000, lpFilename=0x5d7100, nSize=0x800 | out: lpFilename="C:\\Windows\\system32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll")) returned 0x1f [0097.193] CoTaskMemFree (pv=0x5d7100) [0097.193] GetModuleInformation (in: hProcess=0x304, hModule=0x752a0000, lpmodinfo=0x2200d38, cb=0xc | out: lpmodinfo=0x2200d38*(lpBaseOfDll=0x752a0000, SizeOfImage=0x7d000, EntryPoint=0x752a1140)) returned 1 [0097.194] CoTaskMemAlloc (cb=0x804) returned 0x5d7100 [0097.194] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x752a0000, lpBaseName=0x5d7100, nSize=0x800 | out: lpBaseName="clrjit.dll") returned 0xa [0097.194] CoTaskMemFree (pv=0x5d7100) [0097.194] CoTaskMemAlloc (cb=0x804) returned 0x5d7100 [0097.194] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x752a0000, lpFilename=0x5d7100, nSize=0x800 | out: lpFilename="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clrjit.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\clrjit.dll")) returned 0x38 [0097.195] CoTaskMemFree (pv=0x5d7100) [0097.195] GetModuleInformation (in: hProcess=0x304, hModule=0x762b0000, lpmodinfo=0x2202e78, cb=0xc | out: lpmodinfo=0x2202e78*(lpBaseOfDll=0x762b0000, SizeOfImage=0x8f000, EntryPoint=0x762b3fb1)) returned 1 [0097.195] CoTaskMemAlloc (cb=0x804) returned 0x5d7100 [0097.195] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x762b0000, lpBaseName=0x5d7100, nSize=0x800 | out: lpBaseName="OLEAUT32.dll") returned 0xc [0097.195] CoTaskMemFree (pv=0x5d7100) [0097.195] CoTaskMemAlloc (cb=0x804) returned 0x5d7100 [0097.195] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x762b0000, lpFilename=0x5d7100, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\OLEAUT32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll")) returned 0x20 [0097.196] CoTaskMemFree (pv=0x5d7100) [0097.196] GetModuleInformation (in: hProcess=0x304, hModule=0x736d0000, lpmodinfo=0x2204f8c, cb=0xc | out: lpmodinfo=0x2204f8c*(lpBaseOfDll=0x736d0000, SizeOfImage=0x9ad000, EntryPoint=0x0)) returned 1 [0097.196] CoTaskMemAlloc (cb=0x804) returned 0x5d7100 [0097.196] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x736d0000, lpBaseName=0x5d7100, nSize=0x800 | out: lpBaseName="System.ni.dll") returned 0xd [0097.197] CoTaskMemFree (pv=0x5d7100) [0097.197] CoTaskMemAlloc (cb=0x804) returned 0x5d7100 [0097.197] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x736d0000, lpFilename=0x5d7100, nSize=0x800 | out: lpFilename="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System\\500ffa28b327e171fe664023003e947e\\System.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system\\500ffa28b327e171fe664023003e947e\\system.ni.dll")) returned 0x64 [0097.197] CoTaskMemFree (pv=0x5d7100) [0097.197] GetModuleInformation (in: hProcess=0x304, hModule=0x71d20000, lpmodinfo=0x2207128, cb=0xc | out: lpmodinfo=0x2207128*(lpBaseOfDll=0x71d20000, SizeOfImage=0x716000, EntryPoint=0x0)) returned 1 [0097.197] CoTaskMemAlloc (cb=0x804) returned 0x5d7100 [0097.198] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x71d20000, lpBaseName=0x5d7100, nSize=0x800 | out: lpBaseName="System.Core.ni.dll") returned 0x12 [0097.198] CoTaskMemFree (pv=0x5d7100) [0097.198] CoTaskMemAlloc (cb=0x804) returned 0x5d7100 [0097.198] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x71d20000, lpFilename=0x5d7100, nSize=0x800 | out: lpFilename="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Core\\386fde9190d499d6645df8b90eb76242\\System.Core.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.core\\386fde9190d499d6645df8b90eb76242\\system.core.ni.dll")) returned 0x6e [0097.198] CoTaskMemFree (pv=0x5d7100) [0097.198] GetModuleInformation (in: hProcess=0x304, hModule=0x750d0000, lpmodinfo=0x22092e4, cb=0xc | out: lpmodinfo=0x22092e4*(lpBaseOfDll=0x750d0000, SizeOfImage=0x1cb000, EntryPoint=0x0)) returned 1 [0097.199] CoTaskMemAlloc (cb=0x804) returned 0x5d7100 [0097.199] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x750d0000, lpBaseName=0x5d7100, nSize=0x800 | out: lpBaseName="Microsoft.VisualBasic.ni.dll") returned 0x1c [0097.199] CoTaskMemFree (pv=0x5d7100) [0097.199] CoTaskMemAlloc (cb=0x804) returned 0x5d7100 [0097.199] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x750d0000, lpFilename=0x5d7100, nSize=0x800 | out: lpFilename="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Microsoft.V9921e851#\\cfbddeb6e93e8f421b92229b20e51233\\Microsoft.VisualBasic.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\microsoft.v9921e851#\\cfbddeb6e93e8f421b92229b20e51233\\microsoft.visualbasic.ni.dll")) returned 0x81 [0097.200] CoTaskMemFree (pv=0x5d7100) [0097.200] GetModuleInformation (in: hProcess=0x304, hModule=0x750b0000, lpmodinfo=0x220b4d8, cb=0xc | out: lpmodinfo=0x220b4d8*(lpBaseOfDll=0x750b0000, SizeOfImage=0x13000, EntryPoint=0x750b18f0)) returned 1 [0097.200] CoTaskMemAlloc (cb=0x804) returned 0x5d7100 [0097.200] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x750b0000, lpBaseName=0x5d7100, nSize=0x800 | out: lpBaseName="nlssorting.dll") returned 0xe [0097.201] CoTaskMemFree (pv=0x5d7100) [0097.201] CoTaskMemAlloc (cb=0x804) returned 0x5d7100 [0097.201] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x750b0000, lpFilename=0x5d7100, nSize=0x800 | out: lpFilename="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\nlssorting.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\nlssorting.dll")) returned 0x3c [0097.201] CoTaskMemFree (pv=0x5d7100) [0097.201] GetModuleInformation (in: hProcess=0x304, hModule=0x74870000, lpmodinfo=0x220d628, cb=0xc | out: lpmodinfo=0x220d628*(lpBaseOfDll=0x74870000, SizeOfImage=0x16000, EntryPoint=0x74872dc3)) returned 1 [0097.202] CoTaskMemAlloc (cb=0x804) returned 0x5d7100 [0097.202] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x74870000, lpBaseName=0x5d7100, nSize=0x800 | out: lpBaseName="CRYPTSP.dll") returned 0xb [0097.202] CoTaskMemFree (pv=0x5d7100) [0097.202] CoTaskMemAlloc (cb=0x804) returned 0x5d7100 [0097.202] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x74870000, lpFilename=0x5d7100, nSize=0x800 | out: lpFilename="C:\\Windows\\system32\\CRYPTSP.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll")) returned 0x1f [0097.202] CoTaskMemFree (pv=0x5d7100) [0097.203] GetModuleInformation (in: hProcess=0x304, hModule=0x74830000, lpmodinfo=0x220f734, cb=0xc | out: lpmodinfo=0x220f734*(lpBaseOfDll=0x74830000, SizeOfImage=0x3b000, EntryPoint=0x7483128d)) returned 1 [0097.203] CoTaskMemAlloc (cb=0x804) returned 0x5d7100 [0097.203] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x74830000, lpBaseName=0x5d7100, nSize=0x800 | out: lpBaseName="rsaenh.dll") returned 0xa [0097.203] CoTaskMemFree (pv=0x5d7100) [0097.203] CoTaskMemAlloc (cb=0x804) returned 0x5d7100 [0097.203] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x74830000, lpFilename=0x5d7100, nSize=0x800 | out: lpFilename="C:\\Windows\\system32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll")) returned 0x1e [0097.204] CoTaskMemFree (pv=0x5d7100) [0097.204] GetModuleInformation (in: hProcess=0x304, hModule=0x75a60000, lpmodinfo=0x221194c, cb=0xc | out: lpmodinfo=0x221194c*(lpBaseOfDll=0x75a60000, SizeOfImage=0x5000, EntryPoint=0x75a61438)) returned 1 [0097.204] CoTaskMemAlloc (cb=0x804) returned 0x5d7100 [0097.204] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75a60000, lpBaseName=0x5d7100, nSize=0x800 | out: lpBaseName="psapi.dll") returned 0x9 [0097.205] CoTaskMemFree (pv=0x5d7100) [0097.205] CoTaskMemAlloc (cb=0x804) returned 0x5d7100 [0097.205] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75a60000, lpFilename=0x5d7100, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\psapi.dll" (normalized: "c:\\windows\\syswow64\\psapi.dll")) returned 0x1d [0097.205] CoTaskMemFree (pv=0x5d7100) [0097.205] GetModuleInformation (in: hProcess=0x304, hModule=0x746a0000, lpmodinfo=0x2213a50, cb=0xc | out: lpmodinfo=0x2213a50*(lpBaseOfDll=0x746a0000, SizeOfImage=0x18d000, EntryPoint=0x0)) returned 1 [0097.206] CoTaskMemAlloc (cb=0x804) returned 0x5d7100 [0097.206] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x746a0000, lpBaseName=0x5d7100, nSize=0x800 | out: lpBaseName="System.Drawing.ni.dll") returned 0x15 [0097.207] CoTaskMemFree (pv=0x5d7100) [0097.207] CoTaskMemAlloc (cb=0x804) returned 0x5d7100 [0097.207] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x746a0000, lpFilename=0x5d7100, nSize=0x800 | out: lpFilename="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Drawing\\553c0312fdf5a5449f3649f0515e70fb\\System.Drawing.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.drawing\\553c0312fdf5a5449f3649f0515e70fb\\system.drawing.ni.dll")) returned 0x74 [0097.207] CoTaskMemFree (pv=0x5d7100) [0097.207] GetModuleInformation (in: hProcess=0x304, hModule=0x710c0000, lpmodinfo=0x2215c1c, cb=0xc | out: lpmodinfo=0x2215c1c*(lpBaseOfDll=0x710c0000, SizeOfImage=0xc58000, EntryPoint=0x0)) returned 1 [0097.208] CoTaskMemAlloc (cb=0x804) returned 0x5d7100 [0097.208] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x710c0000, lpBaseName=0x5d7100, nSize=0x800 | out: lpBaseName="System.Windows.Forms.ni.dll") returned 0x1b [0097.208] CoTaskMemFree (pv=0x5d7100) [0097.208] CoTaskMemAlloc (cb=0x804) returned 0x5d7100 [0097.208] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x710c0000, lpFilename=0x5d7100, nSize=0x800 | out: lpFilename="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Windows.Forms\\7a6894982f35a1d75ec73d447c583da2\\System.Windows.Forms.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.windows.forms\\7a6894982f35a1d75ec73d447c583da2\\system.windows.forms.ni.dll")) returned 0x80 [0097.209] CoTaskMemFree (pv=0x5d7100) [0097.209] CloseHandle (hObject=0x304) returned 1 [0097.470] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=0, lpMultiByteStr=0x23101b0, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 0 [0097.582] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="т", cchWideChar=1, lpMultiByteStr=0x4990bc, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="?:ï\x01", lpUsedDefaultChar=0x0) returned 1 [0097.582] lstrcatA (in: lpString1="", lpString2="?" | out: lpString1="?") returned="?" [0097.584] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="?", cchWideChar=1, lpMultiByteStr=0x231020c, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="?", lpUsedDefaultChar=0x0) returned 1 [0097.584] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="й", cchWideChar=1, lpMultiByteStr=0x4990bc, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="?:ï\x01?", lpUsedDefaultChar=0x0) returned 1 [0097.584] lstrcatA (in: lpString1="?", lpString2="?" | out: lpString1="??") returned="??" [0097.584] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="??", cchWideChar=2, lpMultiByteStr=0x231026c, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="??", lpUsedDefaultChar=0x0) returned 2 [0097.584] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="b", cchWideChar=1, lpMultiByteStr=0x4990bc, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="b:ï\x01??", lpUsedDefaultChar=0x0) returned 1 [0097.584] lstrcatA (in: lpString1="??", lpString2="b" | out: lpString1="??b") returned="??b" [0097.584] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="??b", cchWideChar=3, lpMultiByteStr=0x23102cc, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="??b", lpUsedDefaultChar=0x0) returned 3 [0097.584] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="р", cchWideChar=1, lpMultiByteStr=0x4990bc, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="?:ï\x01??b", lpUsedDefaultChar=0x0) returned 1 [0097.584] lstrcatA (in: lpString1="??b", lpString2="?" | out: lpString1="??b?") returned="??b?" [0097.585] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="??b?", cchWideChar=4, lpMultiByteStr=0x2310330, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="??b?", lpUsedDefaultChar=0x0) returned 4 [0097.585] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x4990bc, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="g:ï\x01??b?", lpUsedDefaultChar=0x0) returned 1 [0097.585] lstrcatA (in: lpString1="??b?", lpString2="g" | out: lpString1="??b?g") returned="??b?g" [0097.585] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="??b?g", cchWideChar=5, lpMultiByteStr=0x2310398, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="??b?g", lpUsedDefaultChar=0x0) returned 5 [0097.585] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ы", cchWideChar=1, lpMultiByteStr=0x4990bc, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x3f\x3a\xef\x01\x3f\x3f\x62\x3f\x67", lpUsedDefaultChar=0x0) returned 1 [0097.585] lstrcatA (in: lpString1="??b?g", lpString2="?" | out: lpString1="??b?g?") returned="??b?g?" [0097.585] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="??b?g?", cchWideChar=6, lpMultiByteStr=0x2310404, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="??b?g?", lpUsedDefaultChar=0x0) returned 6 [0097.585] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Т", cchWideChar=1, lpMultiByteStr=0x4990bc, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x3f\x3a\xef\x01\x3f\x3f\x62\x3f\x67\x3f", lpUsedDefaultChar=0x0) returned 1 [0097.585] lstrcatA (in: lpString1="??b?g?", lpString2="?" | out: lpString1="??b?g??") returned="??b?g??" [0097.585] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="??b?g??", cchWideChar=7, lpMultiByteStr=0x2310470, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="??b?g??", lpUsedDefaultChar=0x0) returned 7 [0097.585] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="h", cchWideChar=1, lpMultiByteStr=0x4990bc, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x68\x3a\xef\x01\x3f\x3f\x62\x3f\x67\x3f\x3f", lpUsedDefaultChar=0x0) returned 1 [0097.585] lstrcatA (in: lpString1="??b?g??", lpString2="h" | out: lpString1="??b?g??h") returned="??b?g??h" [0097.585] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="??b?g??h", cchWideChar=8, lpMultiByteStr=0x23104e0, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="??b?g??h", lpUsedDefaultChar=0x0) returned 8 [0097.585] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C", cchWideChar=1, lpMultiByteStr=0x4990bc, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x43\x3a\xef\x01\x3f\x3f\x62\x3f\x67\x3f\x3f\x68", lpUsedDefaultChar=0x0) returned 1 [0097.585] lstrcatA (in: lpString1="??b?g??h", lpString2="C" | out: lpString1="??b?g??hC") returned="??b?g??hC" [0097.585] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="??b?g??hC", cchWideChar=9, lpMultiByteStr=0x2310554, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="??b?g??hC", lpUsedDefaultChar=0x0) returned 9 [0097.585] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="H", cchWideChar=1, lpMultiByteStr=0x4990bc, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x48\x3a\xef\x01\x3f\x3f\x62\x3f\x67\x3f\x3f\x68\x43", lpUsedDefaultChar=0x0) returned 1 [0097.585] lstrcatA (in: lpString1="??b?g??hC", lpString2="H" | out: lpString1="??b?g??hCH") returned="??b?g??hCH" [0097.585] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="??b?g??hCH", cchWideChar=10, lpMultiByteStr=0x23105cc, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="??b?g??hCH", lpUsedDefaultChar=0x0) returned 10 [0097.586] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="м", cchWideChar=1, lpMultiByteStr=0x4990bc, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x3f\x3a\xef\x01\x3f\x3f\x62\x3f\x67\x3f\x3f\x68\x43\x48", lpUsedDefaultChar=0x0) returned 1 [0097.586] lstrcatA (in: lpString1="??b?g??hCH", lpString2="?" | out: lpString1="??b?g??hCH?") returned="??b?g??hCH?" [0097.586] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="??b?g??hCH?", cchWideChar=11, lpMultiByteStr=0x2310644, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="??b?g??hCH?", lpUsedDefaultChar=0x0) returned 11 [0097.586] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="С", cchWideChar=1, lpMultiByteStr=0x4990bc, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x3f\x3a\xef\x01\x3f\x3f\x62\x3f\x67\x3f\x3f\x68\x43\x48\x3f", lpUsedDefaultChar=0x0) returned 1 [0097.586] lstrcatA (in: lpString1="??b?g??hCH?", lpString2="?" | out: lpString1="??b?g??hCH??") returned="??b?g??hCH??" [0097.586] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="??b?g??hCH??", cchWideChar=12, lpMultiByteStr=0x23106c0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="??b?g??hCH??", lpUsedDefaultChar=0x0) returned 12 [0097.586] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x4990bc, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x6d\x3a\xef\x01\x3f\x3f\x62\x3f\x67\x3f\x3f\x68\x43\x48\x3f\x3f", lpUsedDefaultChar=0x0) returned 1 [0097.586] lstrcatA (in: lpString1="??b?g??hCH??", lpString2="m" | out: lpString1="??b?g??hCH??m") returned="??b?g??hCH??m" [0097.586] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="??b?g??hCH??m", cchWideChar=13, lpMultiByteStr=0x2310740, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="??b?g??hCH??m", lpUsedDefaultChar=0x0) returned 13 [0097.586] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="O", cchWideChar=1, lpMultiByteStr=0x4990bc, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x4f\x3a\xef\x01\x3f\x3f\x62\x3f\x67\x3f\x3f\x68\x43\x48\x3f\x3f\x6d", lpUsedDefaultChar=0x0) returned 1 [0097.586] lstrcatA (in: lpString1="??b?g??hCH??m", lpString2="O" | out: lpString1="??b?g??hCH??mO") returned="??b?g??hCH??mO" [0097.586] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="??b?g??hCH??mO", cchWideChar=14, lpMultiByteStr=0x23107c4, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="??b?g??hCH??mO", lpUsedDefaultChar=0x0) returned 14 [0097.586] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Й", cchWideChar=1, lpMultiByteStr=0x4990bc, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x3f\x3a\xef\x01\x3f\x3f\x62\x3f\x67\x3f\x3f\x68\x43\x48\x3f\x3f\x6d\x4f", lpUsedDefaultChar=0x0) returned 1 [0097.586] lstrcatA (in: lpString1="??b?g??hCH??mO", lpString2="?" | out: lpString1="??b?g??hCH??mO?") returned="??b?g??hCH??mO?" [0097.586] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="??b?g??hCH??mO?", cchWideChar=15, lpMultiByteStr=0x2310848, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="??b?g??hCH??mO?", lpUsedDefaultChar=0x0) returned 15 [0097.586] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Ж", cchWideChar=1, lpMultiByteStr=0x4990bc, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x3f\x3a\xef\x01\x3f\x3f\x62\x3f\x67\x3f\x3f\x68\x43\x48\x3f\x3f\x6d\x4f\x3f", lpUsedDefaultChar=0x0) returned 1 [0097.586] lstrcatA (in: lpString1="??b?g??hCH??mO?", lpString2="?" | out: lpString1="??b?g??hCH??mO??") returned="??b?g??hCH??mO??" [0097.586] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="??b?g??hCH??mO??", cchWideChar=16, lpMultiByteStr=0x23108d4, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="??b?g??hCH??mO??", lpUsedDefaultChar=0x0) returned 16 [0097.586] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="L", cchWideChar=1, lpMultiByteStr=0x4990b8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x4c\x3a\xef\x01\x3f\x3f\x62\x3f\x67\x3f\x3f\x68\x43\x48\x3f\x3f\x6d\x4f\x3f\x3f", lpUsedDefaultChar=0x0) returned 1 [0097.586] lstrcatA (in: lpString1="??b?g??hCH??mO??", lpString2="L" | out: lpString1="??b?g??hCH??mO??L") returned="??b?g??hCH??mO??L" [0097.587] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="??b?g??hCH??mO??L", cchWideChar=17, lpMultiByteStr=0x2310964, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="??b?g??hCH??mO??L", lpUsedDefaultChar=0x0) returned 17 [0097.587] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="С", cchWideChar=1, lpMultiByteStr=0x4990b8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x3f\x3a\xef\x01\x3f\x3f\x62\x3f\x67\x3f\x3f\x68\x43\x48\x3f\x3f\x6d\x4f\x3f\x3f\x4c", lpUsedDefaultChar=0x0) returned 1 [0097.587] lstrcatA (in: lpString1="??b?g??hCH??mO??L", lpString2="?" | out: lpString1="??b?g??hCH??mO??L?") returned="??b?g??hCH??mO??L?" [0097.587] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="??b?g??hCH??mO??L?", cchWideChar=18, lpMultiByteStr=0x23109fc, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="??b?g??hCH??mO??L?", lpUsedDefaultChar=0x0) returned 18 [0097.587] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x4990b8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x73\x3a\xef\x01\x3f\x3f\x62\x3f\x67\x3f\x3f\x68\x43\x48\x3f\x3f\x6d\x4f\x3f\x3f\x4c\x3f", lpUsedDefaultChar=0x0) returned 1 [0097.587] lstrcatA (in: lpString1="??b?g??hCH??mO??L?", lpString2="s" | out: lpString1="??b?g??hCH??mO??L?s") returned="??b?g??hCH??mO??L?s" [0097.587] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="??b?g??hCH??mO??L?s", cchWideChar=19, lpMultiByteStr=0x2310a94, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="??b?g??hCH??mO??L?s", lpUsedDefaultChar=0x0) returned 19 [0097.587] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Ц", cchWideChar=1, lpMultiByteStr=0x4990b8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x3f\x3a\xef\x01\x3f\x3f\x62\x3f\x67\x3f\x3f\x68\x43\x48\x3f\x3f\x6d\x4f\x3f\x3f\x4c\x3f\x73", lpUsedDefaultChar=0x0) returned 1 [0097.587] lstrcatA (in: lpString1="??b?g??hCH??mO??L?s", lpString2="?" | out: lpString1="??b?g??hCH??mO??L?s?") returned="??b?g??hCH??mO??L?s?" [0097.587] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="??b?g??hCH??mO??L?s?", cchWideChar=20, lpMultiByteStr=0x2310b34, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="??b?g??hCH??mO??L?s?", lpUsedDefaultChar=0x0) returned 20 [0097.587] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Б", cchWideChar=1, lpMultiByteStr=0x4990b4, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x3f\x3a\xef\x01\x3f\x3f\x62\x3f\x67\x3f\x3f\x68\x43\x48\x3f\x3f\x6d\x4f\x3f\x3f\x4c\x3f\x73\x3f", lpUsedDefaultChar=0x0) returned 1 [0097.587] lstrcatA (in: lpString1="??b?g??hCH??mO??L?s?", lpString2="?" | out: lpString1="??b?g??hCH??mO??L?s??") returned="??b?g??hCH??mO??L?s??" [0097.587] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="??b?g??hCH??mO??L?s??", cchWideChar=21, lpMultiByteStr=0x2310bd8, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="??b?g??hCH??mO??L?s??", lpUsedDefaultChar=0x0) returned 21 [0097.587] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="И", cchWideChar=1, lpMultiByteStr=0x4990b4, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x3f\x3a\xef\x01\x3f\x3f\x62\x3f\x67\x3f\x3f\x68\x43\x48\x3f\x3f\x6d\x4f\x3f\x3f\x4c\x3f\x73\x3f\x3f", lpUsedDefaultChar=0x0) returned 1 [0097.587] lstrcatA (in: lpString1="??b?g??hCH??mO??L?s??", lpString2="?" | out: lpString1="??b?g??hCH??mO??L?s???") returned="??b?g??hCH??mO??L?s???" [0097.587] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="??b?g??hCH??mO??L?s???", cchWideChar=22, lpMultiByteStr=0x2310c84, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="??b?g??hCH??mO??L?s???", lpUsedDefaultChar=0x0) returned 22 [0097.587] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Т", cchWideChar=1, lpMultiByteStr=0x4990b4, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x3f\x3a\xef\x01\x3f\x3f\x62\x3f\x67\x3f\x3f\x68\x43\x48\x3f\x3f\x6d\x4f\x3f\x3f\x4c\x3f\x73\x3f\x3f\x3f", lpUsedDefaultChar=0x0) returned 1 [0097.587] lstrcatA (in: lpString1="??b?g??hCH??mO??L?s???", lpString2="?" | out: lpString1="??b?g??hCH??mO??L?s????") returned="??b?g??hCH??mO??L?s????" [0097.587] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="??b?g??hCH??mO??L?s????", cchWideChar=23, lpMultiByteStr=0x2310d30, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="??b?g??hCH??mO??L?s????", lpUsedDefaultChar=0x0) returned 23 [0097.587] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ч", cchWideChar=1, lpMultiByteStr=0x4990b4, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x3f\x3a\xef\x01\x3f\x3f\x62\x3f\x67\x3f\x3f\x68\x43\x48\x3f\x3f\x6d\x4f\x3f\x3f\x4c\x3f\x73\x3f\x3f\x3f\x3f", lpUsedDefaultChar=0x0) returned 1 [0097.587] lstrcatA (in: lpString1="??b?g??hCH??mO??L?s????", lpString2="?" | out: lpString1="??b?g??hCH??mO??L?s?????") returned="??b?g??hCH??mO??L?s?????" [0097.588] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="??b?g??hCH??mO??L?s?????", cchWideChar=24, lpMultiByteStr=0x2310de4, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="??b?g??hCH??mO??L?s?????", lpUsedDefaultChar=0x0) returned 24 [0097.588] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ч", cchWideChar=1, lpMultiByteStr=0x4990b0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x3f\x3a\xef\x01\x3f\x3f\x62\x3f\x67\x3f\x3f\x68\x43\x48\x3f\x3f\x6d\x4f\x3f\x3f\x4c\x3f\x73\x3f\x3f\x3f\x3f\x3f", lpUsedDefaultChar=0x0) returned 1 [0097.588] lstrcatA (in: lpString1="??b?g??hCH??mO??L?s?????", lpString2="?" | out: lpString1="??b?g??hCH??mO??L?s??????") returned="??b?g??hCH??mO??L?s??????" [0097.588] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="??b?g??hCH??mO??L?s??????", cchWideChar=25, lpMultiByteStr=0x2310e9c, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="??b?g??hCH??mO??L?s??????", lpUsedDefaultChar=0x0) returned 25 [0097.588] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="B", cchWideChar=1, lpMultiByteStr=0x4990b0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x42\x3a\xef\x01\x3f\x3f\x62\x3f\x67\x3f\x3f\x68\x43\x48\x3f\x3f\x6d\x4f\x3f\x3f\x4c\x3f\x73\x3f\x3f\x3f\x3f\x3f\x3f", lpUsedDefaultChar=0x0) returned 1 [0097.588] lstrcatA (in: lpString1="??b?g??hCH??mO??L?s??????", lpString2="B" | out: lpString1="??b?g??hCH??mO??L?s??????B") returned="??b?g??hCH??mO??L?s??????B" [0097.588] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="??b?g??hCH??mO??L?s??????B", cchWideChar=26, lpMultiByteStr=0x2310f5c, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="??b?g??hCH??mO??L?s??????B", lpUsedDefaultChar=0x0) returned 26 [0097.588] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Г", cchWideChar=1, lpMultiByteStr=0x4990b0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x3f\x3a\xef\x01\x3f\x3f\x62\x3f\x67\x3f\x3f\x68\x43\x48\x3f\x3f\x6d\x4f\x3f\x3f\x4c\x3f\x73\x3f\x3f\x3f\x3f\x3f\x3f\x42", lpUsedDefaultChar=0x0) returned 1 [0097.588] lstrcatA (in: lpString1="??b?g??hCH??mO??L?s??????B", lpString2="?" | out: lpString1="??b?g??hCH??mO??L?s??????B?") returned="??b?g??hCH??mO??L?s??????B?" [0097.588] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="??b?g??hCH??mO??L?s??????B?", cchWideChar=27, lpMultiByteStr=0x231101c, cbMultiByte=28, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="??b?g??hCH??mO??L?s??????B?", lpUsedDefaultChar=0x0) returned 27 [0097.588] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="J", cchWideChar=1, lpMultiByteStr=0x4990b0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x4a\x3a\xef\x01\x3f\x3f\x62\x3f\x67\x3f\x3f\x68\x43\x48\x3f\x3f\x6d\x4f\x3f\x3f\x4c\x3f\x73\x3f\x3f\x3f\x3f\x3f\x3f\x42\x3f", lpUsedDefaultChar=0x0) returned 1 [0097.588] lstrcatA (in: lpString1="??b?g??hCH??mO??L?s??????B?", lpString2="J" | out: lpString1="??b?g??hCH??mO??L?s??????B?J") returned="??b?g??hCH??mO??L?s??????B?J" [0097.588] lstrcatA (in: lpString1="??b?g??hCH??mO??L?s??????B?J", lpString2="?" | out: lpString1="??b?g??hCH??mO??L?s??????B?J?") returned="??b?g??hCH??mO??L?s??????B?J?" [0097.588] lstrcatA (in: lpString1="??b?g??hCH??mO??L?s??????B?J?", lpString2="z" | out: lpString1="??b?g??hCH??mO??L?s??????B?J?z") returned="??b?g??hCH??mO??L?s??????B?J?z" [0097.588] lstrcatA (in: lpString1="??b?g??hCH??mO??L?s??????B?J?z", lpString2="j" | out: lpString1="??b?g??hCH??mO??L?s??????B?J?zj") returned="??b?g??hCH??mO??L?s??????B?J?zj" [0097.588] lstrcatA (in: lpString1="??b?g??hCH??mO??L?s??????B?J?zj", lpString2="?" | out: lpString1="??b?g??hCH??mO??L?s??????B?J?zj?") returned="??b?g??hCH??mO??L?s??????B?J?zj?" [0097.588] lstrcatA (in: lpString1="??b?g??hCH??mO??L?s??????B?J?zj?", lpString2="?" | out: lpString1="??b?g??hCH??mO??L?s??????B?J?zj??") returned="??b?g??hCH??mO??L?s??????B?J?zj??" [0097.588] lstrcatA (in: lpString1="??b?g??hCH??mO??L?s??????B?J?zj??", lpString2="?" | out: lpString1="??b?g??hCH??mO??L?s??????B?J?zj???") returned="??b?g??hCH??mO??L?s??????B?J?zj???" [0097.589] lstrcatA (in: lpString1="??b?g??hCH??mO??L?s??????B?J?zj???", lpString2="?" | out: lpString1="??b?g??hCH??mO??L?s??????B?J?zj????") returned="??b?g??hCH??mO??L?s??????B?J?zj????" [0097.589] lstrcatA (in: lpString1="??b?g??hCH??mO??L?s??????B?J?zj????", lpString2="?" | out: lpString1="??b?g??hCH??mO??L?s??????B?J?zj?????") returned="??b?g??hCH??mO??L?s??????B?J?zj?????" [0097.589] lstrcatA (in: lpString1="??b?g??hCH??mO??L?s??????B?J?zj?????", lpString2="A" | out: lpString1="??b?g??hCH??mO??L?s??????B?J?zj?????A") returned="??b?g??hCH??mO??L?s??????B?J?zj?????A" [0097.589] lstrcatA (in: lpString1="??b?g??hCH??mO??L?s??????B?J?zj?????A", lpString2="C" | out: lpString1="??b?g??hCH??mO??L?s??????B?J?zj?????AC") returned="??b?g??hCH??mO??L?s??????B?J?zj?????AC" [0097.589] lstrcatA (in: lpString1="??b?g??hCH??mO??L?s??????B?J?zj?????AC", lpString2="h" | out: lpString1="??b?g??hCH??mO??L?s??????B?J?zj?????ACh") returned="??b?g??hCH??mO??L?s??????B?J?zj?????ACh" [0097.589] lstrcatA (in: lpString1="??b?g??hCH??mO??L?s??????B?J?zj?????ACh", lpString2="?" | out: lpString1="??b?g??hCH??mO??L?s??????B?J?zj?????ACh?") returned="??b?g??hCH??mO??L?s??????B?J?zj?????ACh?" [0097.589] lstrcatA (in: lpString1="??b?g??hCH??mO??L?s??????B?J?zj?????ACh?", lpString2="?" | out: lpString1="??b?g??hCH??mO??L?s??????B?J?zj?????ACh??") returned="??b?g??hCH??mO??L?s??????B?J?zj?????ACh??" [0097.589] lstrcatA (in: lpString1="??b?g??hCH??mO??L?s??????B?J?zj?????ACh??", lpString2="?" | out: lpString1="??b?g??hCH??mO??L?s??????B?J?zj?????ACh???") returned="??b?g??hCH??mO??L?s??????B?J?zj?????ACh???" [0097.589] lstrcatA (in: lpString1="??b?g??hCH??mO??L?s??????B?J?zj?????ACh???", lpString2="V" | out: lpString1="??b?g??hCH??mO??L?s??????B?J?zj?????ACh???V") returned="??b?g??hCH??mO??L?s??????B?J?zj?????ACh???V" [0097.589] lstrcatA (in: lpString1="??b?g??hCH??mO??L?s??????B?J?zj?????ACh???V", lpString2="?" | out: lpString1="??b?g??hCH??mO??L?s??????B?J?zj?????ACh???V?") returned="??b?g??hCH??mO??L?s??????B?J?zj?????ACh???V?" [0097.589] lstrcatA (in: lpString1="??b?g??hCH??mO??L?s??????B?J?zj?????ACh???V?", lpString2="?" | out: lpString1="??b?g??hCH??mO??L?s??????B?J?zj?????ACh???V??") returned="??b?g??hCH??mO??L?s??????B?J?zj?????ACh???V??" [0097.589] lstrcatA (in: lpString1="??b?g??hCH??mO??L?s??????B?J?zj?????ACh???V??", lpString2="S" | out: lpString1="??b?g??hCH??mO??L?s??????B?J?zj?????ACh???V??S") returned="??b?g??hCH??mO??L?s??????B?J?zj?????ACh???V??S" [0097.589] lstrcatA (in: lpString1="??b?g??hCH??mO??L?s??????B?J?zj?????ACh???V??S", lpString2="?" | out: lpString1="??b?g??hCH??mO??L?s??????B?J?zj?????ACh???V??S?") returned="??b?g??hCH??mO??L?s??????B?J?zj?????ACh???V??S?" [0097.589] lstrcatA (in: lpString1="??b?g??hCH??mO??L?s??????B?J?zj?????ACh???V??S?", lpString2="d" | out: lpString1="??b?g??hCH??mO??L?s??????B?J?zj?????ACh???V??S?d") returned="??b?g??hCH??mO??L?s??????B?J?zj?????ACh???V??S?d" [0097.589] lstrcatA (in: lpString1="??b?g??hCH??mO??L?s??????B?J?zj?????ACh???V??S?d", lpString2="?" | out: lpString1="??b?g??hCH??mO??L?s??????B?J?zj?????ACh???V??S?d?") returned="??b?g??hCH??mO??L?s??????B?J?zj?????ACh???V??S?d?" [0097.589] lstrcatA (in: lpString1="??b?g??hCH??mO??L?s??????B?J?zj?????ACh???V??S?d?", lpString2="?" | out: lpString1="??b?g??hCH??mO??L?s??????B?J?zj?????ACh???V??S?d??") returned="??b?g??hCH??mO??L?s??????B?J?zj?????ACh???V??S?d??" [0097.589] lstrcatA (in: lpString1="??b?g??hCH??mO??L?s??????B?J?zj?????ACh???V??S?d??", lpString2="S" | out: lpString1="??b?g??hCH??mO??L?s??????B?J?zj?????ACh???V??S?d??S") returned="??b?g??hCH??mO??L?s??????B?J?zj?????ACh???V??S?d??S" [0097.589] lstrcatA (in: lpString1="??b?g??hCH??mO??L?s??????B?J?zj?????ACh???V??S?d??S", lpString2="?" | out: lpString1="??b?g??hCH??mO??L?s??????B?J?zj?????ACh???V??S?d??S?") returned="??b?g??hCH??mO??L?s??????B?J?zj?????ACh???V??S?d??S?" [0097.589] lstrcatA (in: lpString1="??b?g??hCH??mO??L?s??????B?J?zj?????ACh???V??S?d??S?", lpString2="?" | out: lpString1="??b?g??hCH??mO??L?s??????B?J?zj?????ACh???V??S?d??S??") returned="??b?g??hCH??mO??L?s??????B?J?zj?????ACh???V??S?d??S??" [0097.589] lstrlenA (lpString="??b?g??hCH??mO??L?s??????B?J?zj?????ACh???V??S?d??S??") returned 53 [0097.589] lstrcpynA (in: lpString1=0x49909c, lpString2="??b?g??hCH??mO??L?s??????B?J?zj?????ACh???V??S?d??S??", iMaxLength=12 | out: lpString1="??b?g??hCH?") returned="??b?g??hCH?" [0097.589] lstrlenA (lpString="??b?g??hCH?") returned 11 [0097.590] lstrcatA (in: lpString1="", lpString2="?" | out: lpString1="?") returned="?" [0097.590] lstrcatA (in: lpString1="?", lpString2="?" | out: lpString1="??") returned="??" [0097.590] lstrcatA (in: lpString1="??", lpString2="?" | out: lpString1="???") returned="???" [0097.590] lstrcatA (in: lpString1="???", lpString2="?" | out: lpString1="????") returned="????" [0097.590] lstrcatA (in: lpString1="????", lpString2="?" | out: lpString1="?????") returned="?????" [0097.590] lstrcatA (in: lpString1="?????", lpString2="A" | out: lpString1="?????A") returned="?????A" [0097.590] lstrcatA (in: lpString1="?????A", lpString2="R" | out: lpString1="?????AR") returned="?????AR" [0097.590] lstrcatA (in: lpString1="?????AR", lpString2="Q" | out: lpString1="?????ARQ") returned="?????ARQ" [0097.590] lstrcatA (in: lpString1="?????ARQ", lpString2="?" | out: lpString1="?????ARQ?") returned="?????ARQ?" [0097.590] lstrcatA (in: lpString1="?????ARQ?", lpString2="?" | out: lpString1="?????ARQ??") returned="?????ARQ??" [0097.590] lstrcatA (in: lpString1="?????ARQ??", lpString2="O" | out: lpString1="?????ARQ??O") returned="?????ARQ??O" [0097.590] lstrcatA (in: lpString1="?????ARQ??O", lpString2="?" | out: lpString1="?????ARQ??O?") returned="?????ARQ??O?" [0097.590] lstrcatA (in: lpString1="?????ARQ??O?", lpString2="?" | out: lpString1="?????ARQ??O??") returned="?????ARQ??O??" [0097.590] lstrcatA (in: lpString1="?????ARQ??O??", lpString2="?" | out: lpString1="?????ARQ??O???") returned="?????ARQ??O???" [0097.590] lstrcatA (in: lpString1="?????ARQ??O???", lpString2="?" | out: lpString1="?????ARQ??O????") returned="?????ARQ??O????" [0097.590] lstrcatA (in: lpString1="?????ARQ??O????", lpString2="?" | out: lpString1="?????ARQ??O?????") returned="?????ARQ??O?????" [0097.590] lstrcatA (in: lpString1="?????ARQ??O?????", lpString2="Q" | out: lpString1="?????ARQ??O?????Q") returned="?????ARQ??O?????Q" [0097.590] lstrcatA (in: lpString1="?????ARQ??O?????Q", lpString2="d" | out: lpString1="?????ARQ??O?????Qd") returned="?????ARQ??O?????Qd" [0097.590] lstrcatA (in: lpString1="?????ARQ??O?????Qd", lpString2="E" | out: lpString1="?????ARQ??O?????QdE") returned="?????ARQ??O?????QdE" [0097.590] lstrcatA (in: lpString1="?????ARQ??O?????QdE", lpString2="?" | out: lpString1="?????ARQ??O?????QdE?") returned="?????ARQ??O?????QdE?" [0097.590] lstrcatA (in: lpString1="?????ARQ??O?????QdE?", lpString2="r" | out: lpString1="?????ARQ??O?????QdE?r") returned="?????ARQ??O?????QdE?r" [0097.590] lstrcatA (in: lpString1="?????ARQ??O?????QdE?r", lpString2="e" | out: lpString1="?????ARQ??O?????QdE?re") returned="?????ARQ??O?????QdE?re" [0097.591] lstrcatA (in: lpString1="?????ARQ??O?????QdE?re", lpString2="G" | out: lpString1="?????ARQ??O?????QdE?reG") returned="?????ARQ??O?????QdE?reG" [0097.591] lstrcatA (in: lpString1="?????ARQ??O?????QdE?reG", lpString2="?" | out: lpString1="?????ARQ??O?????QdE?reG?") returned="?????ARQ??O?????QdE?reG?" [0097.591] lstrcatA (in: lpString1="?????ARQ??O?????QdE?reG?", lpString2="?" | out: lpString1="?????ARQ??O?????QdE?reG??") returned="?????ARQ??O?????QdE?reG??" [0097.591] lstrcatA (in: lpString1="?????ARQ??O?????QdE?reG??", lpString2="B" | out: lpString1="?????ARQ??O?????QdE?reG??B") returned="?????ARQ??O?????QdE?reG??B" [0097.591] lstrcatA (in: lpString1="?????ARQ??O?????QdE?reG??B", lpString2="?" | out: lpString1="?????ARQ??O?????QdE?reG??B?") returned="?????ARQ??O?????QdE?reG??B?" [0097.591] lstrcatA (in: lpString1="?????ARQ??O?????QdE?reG??B?", lpString2="?" | out: lpString1="?????ARQ??O?????QdE?reG??B??") returned="?????ARQ??O?????QdE?reG??B??" [0097.591] lstrcatA (in: lpString1="?????ARQ??O?????QdE?reG??B??", lpString2="G" | out: lpString1="?????ARQ??O?????QdE?reG??B??G") returned="?????ARQ??O?????QdE?reG??B??G" [0097.591] lstrcatA (in: lpString1="?????ARQ??O?????QdE?reG??B??G", lpString2="d" | out: lpString1="?????ARQ??O?????QdE?reG??B??Gd") returned="?????ARQ??O?????QdE?reG??B??Gd" [0097.591] lstrcatA (in: lpString1="?????ARQ??O?????QdE?reG??B??Gd", lpString2="?" | out: lpString1="?????ARQ??O?????QdE?reG??B??Gd?") returned="?????ARQ??O?????QdE?reG??B??Gd?" [0097.591] lstrcatA (in: lpString1="?????ARQ??O?????QdE?reG??B??Gd?", lpString2="L" | out: lpString1="?????ARQ??O?????QdE?reG??B??Gd?L") returned="?????ARQ??O?????QdE?reG??B??Gd?L" [0097.591] lstrcatA (in: lpString1="?????ARQ??O?????QdE?reG??B??Gd?L", lpString2="?" | out: lpString1="?????ARQ??O?????QdE?reG??B??Gd?L?") returned="?????ARQ??O?????QdE?reG??B??Gd?L?" [0097.591] lstrcatA (in: lpString1="?????ARQ??O?????QdE?reG??B??Gd?L?", lpString2="O" | out: lpString1="?????ARQ??O?????QdE?reG??B??Gd?L?O") returned="?????ARQ??O?????QdE?reG??B??Gd?L?O" [0097.591] lstrcatA (in: lpString1="?????ARQ??O?????QdE?reG??B??Gd?L?O", lpString2="?" | out: lpString1="?????ARQ??O?????QdE?reG??B??Gd?L?O?") returned="?????ARQ??O?????QdE?reG??B??Gd?L?O?" [0097.591] lstrcatA (in: lpString1="?????ARQ??O?????QdE?reG??B??Gd?L?O?", lpString2="?" | out: lpString1="?????ARQ??O?????QdE?reG??B??Gd?L?O??") returned="?????ARQ??O?????QdE?reG??B??Gd?L?O??" [0097.591] lstrcatA (in: lpString1="?????ARQ??O?????QdE?reG??B??Gd?L?O??", lpString2="N" | out: lpString1="?????ARQ??O?????QdE?reG??B??Gd?L?O??N") returned="?????ARQ??O?????QdE?reG??B??Gd?L?O??N" [0097.591] lstrcatA (in: lpString1="?????ARQ??O?????QdE?reG??B??Gd?L?O??N", lpString2="d" | out: lpString1="?????ARQ??O?????QdE?reG??B??Gd?L?O??Nd") returned="?????ARQ??O?????QdE?reG??B??Gd?L?O??Nd" [0097.591] lstrcatA (in: lpString1="?????ARQ??O?????QdE?reG??B??Gd?L?O??Nd", lpString2="t" | out: lpString1="?????ARQ??O?????QdE?reG??B??Gd?L?O??Ndt") returned="?????ARQ??O?????QdE?reG??B??Gd?L?O??Ndt" [0097.591] lstrcatA (in: lpString1="?????ARQ??O?????QdE?reG??B??Gd?L?O??Ndt", lpString2="?" | out: lpString1="?????ARQ??O?????QdE?reG??B??Gd?L?O??Ndt?") returned="?????ARQ??O?????QdE?reG??B??Gd?L?O??Ndt?" [0097.591] lstrcatA (in: lpString1="?????ARQ??O?????QdE?reG??B??Gd?L?O??Ndt?", lpString2="z" | out: lpString1="?????ARQ??O?????QdE?reG??B??Gd?L?O??Ndt?z") returned="?????ARQ??O?????QdE?reG??B??Gd?L?O??Ndt?z" [0097.591] lstrcatA (in: lpString1="?????ARQ??O?????QdE?reG??B??Gd?L?O??Ndt?z", lpString2="?" | out: lpString1="?????ARQ??O?????QdE?reG??B??Gd?L?O??Ndt?z?") returned="?????ARQ??O?????QdE?reG??B??Gd?L?O??Ndt?z?" [0097.591] lstrcatA (in: lpString1="?????ARQ??O?????QdE?reG??B??Gd?L?O??Ndt?z?", lpString2="?" | out: lpString1="?????ARQ??O?????QdE?reG??B??Gd?L?O??Ndt?z??") returned="?????ARQ??O?????QdE?reG??B??Gd?L?O??Ndt?z??" [0097.591] lstrcatA (in: lpString1="?????ARQ??O?????QdE?reG??B??Gd?L?O??Ndt?z??", lpString2="K" | out: lpString1="?????ARQ??O?????QdE?reG??B??Gd?L?O??Ndt?z??K") returned="?????ARQ??O?????QdE?reG??B??Gd?L?O??Ndt?z??K" [0097.592] lstrcatA (in: lpString1="?????ARQ??O?????QdE?reG??B??Gd?L?O??Ndt?z??K", lpString2="?" | out: lpString1="?????ARQ??O?????QdE?reG??B??Gd?L?O??Ndt?z??K?") returned="?????ARQ??O?????QdE?reG??B??Gd?L?O??Ndt?z??K?" [0097.592] lstrcatA (in: lpString1="?????ARQ??O?????QdE?reG??B??Gd?L?O??Ndt?z??K?", lpString2="?" | out: lpString1="?????ARQ??O?????QdE?reG??B??Gd?L?O??Ndt?z??K??") returned="?????ARQ??O?????QdE?reG??B??Gd?L?O??Ndt?z??K??" [0097.592] lstrcatA (in: lpString1="?????ARQ??O?????QdE?reG??B??Gd?L?O??Ndt?z??K??", lpString2="?" | out: lpString1="?????ARQ??O?????QdE?reG??B??Gd?L?O??Ndt?z??K???") returned="?????ARQ??O?????QdE?reG??B??Gd?L?O??Ndt?z??K???" [0097.592] lstrcatA (in: lpString1="?????ARQ??O?????QdE?reG??B??Gd?L?O??Ndt?z??K???", lpString2="G" | out: lpString1="?????ARQ??O?????QdE?reG??B??Gd?L?O??Ndt?z??K???G") returned="?????ARQ??O?????QdE?reG??B??Gd?L?O??Ndt?z??K???G" [0097.592] lstrlenA (lpString="?????ARQ??O?????QdE?reG??B??Gd?L?O??Ndt?z??K???G") returned 48 [0097.592] lstrcpynA (in: lpString1=0x4990a0, lpString2="?????ARQ??O?????QdE?reG??B??Gd?L?O??Ndt?z??K???G", iMaxLength=16 | out: lpString1="?????ARQ??O????") returned="?????ARQ??O????" [0097.592] lstrlenA (lpString="?????ARQ??O????") returned 15 [0097.592] lstrcatA (in: lpString1="", lpString2="P" | out: lpString1="P") returned="P" [0097.592] lstrcatA (in: lpString1="P", lpString2="c" | out: lpString1="Pc") returned="Pc" [0097.592] lstrcatA (in: lpString1="Pc", lpString2="?" | out: lpString1="Pc?") returned="Pc?" [0097.592] lstrcatA (in: lpString1="Pc?", lpString2="?" | out: lpString1="Pc??") returned="Pc??" [0097.592] lstrcatA (in: lpString1="Pc??", lpString2="?" | out: lpString1="Pc???") returned="Pc???" [0097.592] lstrcatA (in: lpString1="Pc???", lpString2="g" | out: lpString1="Pc???g") returned="Pc???g" [0097.592] lstrcatA (in: lpString1="Pc???g", lpString2="a" | out: lpString1="Pc???ga") returned="Pc???ga" [0097.592] lstrcatA (in: lpString1="Pc???ga", lpString2="v" | out: lpString1="Pc???gav") returned="Pc???gav" [0097.592] lstrcatA (in: lpString1="Pc???gav", lpString2="N" | out: lpString1="Pc???gavN") returned="Pc???gavN" [0097.592] lstrcatA (in: lpString1="Pc???gavN", lpString2="C" | out: lpString1="Pc???gavNC") returned="Pc???gavNC" [0097.592] lstrcatA (in: lpString1="Pc???gavNC", lpString2="?" | out: lpString1="Pc???gavNC?") returned="Pc???gavNC?" [0097.592] lstrcatA (in: lpString1="Pc???gavNC?", lpString2="?" | out: lpString1="Pc???gavNC??") returned="Pc???gavNC??" [0097.592] lstrcatA (in: lpString1="Pc???gavNC??", lpString2="x" | out: lpString1="Pc???gavNC??x") returned="Pc???gavNC??x" [0097.592] lstrlenA (lpString="Pc???gavNC??x") returned 13 [0097.593] lstrcpynA (in: lpString1=0x4990c4, lpString2="Pc???gavNC??x", iMaxLength=12 | out: lpString1="Pc???gavNC?") returned="Pc???gavNC?" [0097.593] lstrlenA (lpString="Pc???gavNC?") returned 11 [0097.593] lstrcatA (in: lpString1="", lpString2="?" | out: lpString1="?") returned="?" [0097.593] lstrcatA (in: lpString1="?", lpString2="Z" | out: lpString1="?Z") returned="?Z" [0097.593] lstrcatA (in: lpString1="?Z", lpString2="g" | out: lpString1="?Zg") returned="?Zg" [0097.593] lstrcatA (in: lpString1="?Zg", lpString2="o" | out: lpString1="?Zgo") returned="?Zgo" [0097.593] lstrcatA (in: lpString1="?Zgo", lpString2="?" | out: lpString1="?Zgo?") returned="?Zgo?" [0097.593] lstrcatA (in: lpString1="?Zgo?", lpString2="Z" | out: lpString1="?Zgo?Z") returned="?Zgo?Z" [0097.593] lstrcatA (in: lpString1="?Zgo?Z", lpString2="P" | out: lpString1="?Zgo?ZP") returned="?Zgo?ZP" [0097.593] lstrcatA (in: lpString1="?Zgo?ZP", lpString2="i" | out: lpString1="?Zgo?ZPi") returned="?Zgo?ZPi" [0097.593] lstrcatA (in: lpString1="?Zgo?ZPi", lpString2="?" | out: lpString1="?Zgo?ZPi?") returned="?Zgo?ZPi?" [0097.593] lstrcatA (in: lpString1="?Zgo?ZPi?", lpString2="t" | out: lpString1="?Zgo?ZPi?t") returned="?Zgo?ZPi?t" [0097.593] lstrcatA (in: lpString1="?Zgo?ZPi?t", lpString2="l" | out: lpString1="?Zgo?ZPi?tl") returned="?Zgo?ZPi?tl" [0097.593] lstrcatA (in: lpString1="?Zgo?ZPi?tl", lpString2="N" | out: lpString1="?Zgo?ZPi?tlN") returned="?Zgo?ZPi?tlN" [0097.593] lstrcatA (in: lpString1="?Zgo?ZPi?tlN", lpString2="?" | out: lpString1="?Zgo?ZPi?tlN?") returned="?Zgo?ZPi?tlN?" [0097.593] lstrcatA (in: lpString1="?Zgo?ZPi?tlN?", lpString2="?" | out: lpString1="?Zgo?ZPi?tlN??") returned="?Zgo?ZPi?tlN??" [0097.593] lstrcatA (in: lpString1="?Zgo?ZPi?tlN??", lpString2="L" | out: lpString1="?Zgo?ZPi?tlN??L") returned="?Zgo?ZPi?tlN??L" [0097.593] lstrcatA (in: lpString1="?Zgo?ZPi?tlN??L", lpString2="?" | out: lpString1="?Zgo?ZPi?tlN??L?") returned="?Zgo?ZPi?tlN??L?" [0097.593] lstrcatA (in: lpString1="?Zgo?ZPi?tlN??L?", lpString2="?" | out: lpString1="?Zgo?ZPi?tlN??L??") returned="?Zgo?ZPi?tlN??L??" [0097.593] lstrcatA (in: lpString1="?Zgo?ZPi?tlN??L??", lpString2="p" | out: lpString1="?Zgo?ZPi?tlN??L??p") returned="?Zgo?ZPi?tlN??L??p" [0097.593] lstrcatA (in: lpString1="?Zgo?ZPi?tlN??L??p", lpString2="?" | out: lpString1="?Zgo?ZPi?tlN??L??p?") returned="?Zgo?ZPi?tlN??L??p?" [0097.593] lstrcatA (in: lpString1="?Zgo?ZPi?tlN??L??p?", lpString2="?" | out: lpString1="?Zgo?ZPi?tlN??L??p??") returned="?Zgo?ZPi?tlN??L??p??" [0097.594] lstrcatA (in: lpString1="?Zgo?ZPi?tlN??L??p??", lpString2="W" | out: lpString1="?Zgo?ZPi?tlN??L??p??W") returned="?Zgo?ZPi?tlN??L??p??W" [0097.594] lstrcatA (in: lpString1="?Zgo?ZPi?tlN??L??p??W", lpString2="?" | out: lpString1="?Zgo?ZPi?tlN??L??p??W?") returned="?Zgo?ZPi?tlN??L??p??W?" [0097.594] lstrcatA (in: lpString1="?Zgo?ZPi?tlN??L??p??W?", lpString2="A" | out: lpString1="?Zgo?ZPi?tlN??L??p??W?A") returned="?Zgo?ZPi?tlN??L??p??W?A" [0097.594] lstrcatA (in: lpString1="?Zgo?ZPi?tlN??L??p??W?A", lpString2="r" | out: lpString1="?Zgo?ZPi?tlN??L??p??W?Ar") returned="?Zgo?ZPi?tlN??L??p??W?Ar" [0097.594] lstrcatA (in: lpString1="?Zgo?ZPi?tlN??L??p??W?Ar", lpString2="?" | out: lpString1="?Zgo?ZPi?tlN??L??p??W?Ar?") returned="?Zgo?ZPi?tlN??L??p??W?Ar?" [0097.594] lstrcatA (in: lpString1="?Zgo?ZPi?tlN??L??p??W?Ar?", lpString2="e" | out: lpString1="?Zgo?ZPi?tlN??L??p??W?Ar?e") returned="?Zgo?ZPi?tlN??L??p??W?Ar?e" [0097.594] lstrcatA (in: lpString1="?Zgo?ZPi?tlN??L??p??W?Ar?e", lpString2="?" | out: lpString1="?Zgo?ZPi?tlN??L??p??W?Ar?e?") returned="?Zgo?ZPi?tlN??L??p??W?Ar?e?" [0097.594] lstrcatA (in: lpString1="?Zgo?ZPi?tlN??L??p??W?Ar?e?", lpString2="?" | out: lpString1="?Zgo?ZPi?tlN??L??p??W?Ar?e??") returned="?Zgo?ZPi?tlN??L??p??W?Ar?e??" [0097.594] lstrcatA (in: lpString1="?Zgo?ZPi?tlN??L??p??W?Ar?e??", lpString2="K" | out: lpString1="?Zgo?ZPi?tlN??L??p??W?Ar?e??K") returned="?Zgo?ZPi?tlN??L??p??W?Ar?e??K" [0097.594] lstrcatA (in: lpString1="?Zgo?ZPi?tlN??L??p??W?Ar?e??K", lpString2="n" | out: lpString1="?Zgo?ZPi?tlN??L??p??W?Ar?e??Kn") returned="?Zgo?ZPi?tlN??L??p??W?Ar?e??Kn" [0097.594] lstrcatA (in: lpString1="?Zgo?ZPi?tlN??L??p??W?Ar?e??Kn", lpString2="?" | out: lpString1="?Zgo?ZPi?tlN??L??p??W?Ar?e??Kn?") returned="?Zgo?ZPi?tlN??L??p??W?Ar?e??Kn?" [0097.594] lstrcatA (in: lpString1="?Zgo?ZPi?tlN??L??p??W?Ar?e??Kn?", lpString2="?" | out: lpString1="?Zgo?ZPi?tlN??L??p??W?Ar?e??Kn??") returned="?Zgo?ZPi?tlN??L??p??W?Ar?e??Kn??" [0097.594] lstrcatA (in: lpString1="?Zgo?ZPi?tlN??L??p??W?Ar?e??Kn??", lpString2="G" | out: lpString1="?Zgo?ZPi?tlN??L??p??W?Ar?e??Kn??G") returned="?Zgo?ZPi?tlN??L??p??W?Ar?e??Kn??G" [0097.594] lstrcatA (in: lpString1="?Zgo?ZPi?tlN??L??p??W?Ar?e??Kn??G", lpString2="?" | out: lpString1="?Zgo?ZPi?tlN??L??p??W?Ar?e??Kn??G?") returned="?Zgo?ZPi?tlN??L??p??W?Ar?e??Kn??G?" [0097.594] lstrcatA (in: lpString1="?Zgo?ZPi?tlN??L??p??W?Ar?e??Kn??G?", lpString2="?" | out: lpString1="?Zgo?ZPi?tlN??L??p??W?Ar?e??Kn??G??") returned="?Zgo?ZPi?tlN??L??p??W?Ar?e??Kn??G??" [0097.594] lstrcatA (in: lpString1="?Zgo?ZPi?tlN??L??p??W?Ar?e??Kn??G??", lpString2="?" | out: lpString1="?Zgo?ZPi?tlN??L??p??W?Ar?e??Kn??G???") returned="?Zgo?ZPi?tlN??L??p??W?Ar?e??Kn??G???" [0097.594] lstrcatA (in: lpString1="?Zgo?ZPi?tlN??L??p??W?Ar?e??Kn??G???", lpString2="?" | out: lpString1="?Zgo?ZPi?tlN??L??p??W?Ar?e??Kn??G????") returned="?Zgo?ZPi?tlN??L??p??W?Ar?e??Kn??G????" [0097.594] lstrcatA (in: lpString1="?Zgo?ZPi?tlN??L??p??W?Ar?e??Kn??G????", lpString2="i" | out: lpString1="?Zgo?ZPi?tlN??L??p??W?Ar?e??Kn??G????i") returned="?Zgo?ZPi?tlN??L??p??W?Ar?e??Kn??G????i" [0097.594] lstrcatA (in: lpString1="?Zgo?ZPi?tlN??L??p??W?Ar?e??Kn??G????i", lpString2="?" | out: lpString1="?Zgo?ZPi?tlN??L??p??W?Ar?e??Kn??G????i?") returned="?Zgo?ZPi?tlN??L??p??W?Ar?e??Kn??G????i?" [0097.594] lstrcatA (in: lpString1="?Zgo?ZPi?tlN??L??p??W?Ar?e??Kn??G????i?", lpString2="?" | out: lpString1="?Zgo?ZPi?tlN??L??p??W?Ar?e??Kn??G????i??") returned="?Zgo?ZPi?tlN??L??p??W?Ar?e??Kn??G????i??" [0097.594] lstrcatA (in: lpString1="?Zgo?ZPi?tlN??L??p??W?Ar?e??Kn??G????i??", lpString2="z" | out: lpString1="?Zgo?ZPi?tlN??L??p??W?Ar?e??Kn??G????i??z") returned="?Zgo?ZPi?tlN??L??p??W?Ar?e??Kn??G????i??z" [0097.595] lstrcatA (in: lpString1="?Zgo?ZPi?tlN??L??p??W?Ar?e??Kn??G????i??z", lpString2="?" | out: lpString1="?Zgo?ZPi?tlN??L??p??W?Ar?e??Kn??G????i??z?") returned="?Zgo?ZPi?tlN??L??p??W?Ar?e??Kn??G????i??z?" [0097.595] lstrcatA (in: lpString1="?Zgo?ZPi?tlN??L??p??W?Ar?e??Kn??G????i??z?", lpString2="?" | out: lpString1="?Zgo?ZPi?tlN??L??p??W?Ar?e??Kn??G????i??z??") returned="?Zgo?ZPi?tlN??L??p??W?Ar?e??Kn??G????i??z??" [0097.595] lstrcatA (in: lpString1="?Zgo?ZPi?tlN??L??p??W?Ar?e??Kn??G????i??z??", lpString2="s" | out: lpString1="?Zgo?ZPi?tlN??L??p??W?Ar?e??Kn??G????i??z??s") returned="?Zgo?ZPi?tlN??L??p??W?Ar?e??Kn??G????i??z??s" [0097.595] lstrcatA (in: lpString1="?Zgo?ZPi?tlN??L??p??W?Ar?e??Kn??G????i??z??s", lpString2="?" | out: lpString1="?Zgo?ZPi?tlN??L??p??W?Ar?e??Kn??G????i??z??s?") returned="?Zgo?ZPi?tlN??L??p??W?Ar?e??Kn??G????i??z??s?" [0097.595] lstrcatA (in: lpString1="?Zgo?ZPi?tlN??L??p??W?Ar?e??Kn??G????i??z??s?", lpString2="?" | out: lpString1="?Zgo?ZPi?tlN??L??p??W?Ar?e??Kn??G????i??z??s??") returned="?Zgo?ZPi?tlN??L??p??W?Ar?e??Kn??G????i??z??s??" [0097.595] lstrcatA (in: lpString1="?Zgo?ZPi?tlN??L??p??W?Ar?e??Kn??G????i??z??s??", lpString2="?" | out: lpString1="?Zgo?ZPi?tlN??L??p??W?Ar?e??Kn??G????i??z??s???") returned="?Zgo?ZPi?tlN??L??p??W?Ar?e??Kn??G????i??z??s???" [0097.595] lstrcatA (in: lpString1="?Zgo?ZPi?tlN??L??p??W?Ar?e??Kn??G????i??z??s???", lpString2="?" | out: lpString1="?Zgo?ZPi?tlN??L??p??W?Ar?e??Kn??G????i??z??s????") returned="?Zgo?ZPi?tlN??L??p??W?Ar?e??Kn??G????i??z??s????" [0097.595] lstrcatA (in: lpString1="?Zgo?ZPi?tlN??L??p??W?Ar?e??Kn??G????i??z??s????", lpString2="?" | out: lpString1="?Zgo?ZPi?tlN??L??p??W?Ar?e??Kn??G????i??z??s?????") returned="?Zgo?ZPi?tlN??L??p??W?Ar?e??Kn??G????i??z??s?????" [0097.595] lstrcatA (in: lpString1="?Zgo?ZPi?tlN??L??p??W?Ar?e??Kn??G????i??z??s?????", lpString2="j" | out: lpString1="?Zgo?ZPi?tlN??L??p??W?Ar?e??Kn??G????i??z??s?????j") returned="?Zgo?ZPi?tlN??L??p??W?Ar?e??Kn??G????i??z??s?????j" [0097.595] lstrcatA (in: lpString1="?Zgo?ZPi?tlN??L??p??W?Ar?e??Kn??G????i??z??s?????j", lpString2="?" | out: lpString1="?Zgo?ZPi?tlN??L??p??W?Ar?e??Kn??G????i??z??s?????j?") returned="?Zgo?ZPi?tlN??L??p??W?Ar?e??Kn??G????i??z??s?????j?" [0097.595] lstrcatA (in: lpString1="?Zgo?ZPi?tlN??L??p??W?Ar?e??Kn??G????i??z??s?????j?", lpString2="?" | out: lpString1="?Zgo?ZPi?tlN??L??p??W?Ar?e??Kn??G????i??z??s?????j??") returned="?Zgo?ZPi?tlN??L??p??W?Ar?e??Kn??G????i??z??s?????j??" [0097.595] lstrcatA (in: lpString1="?Zgo?ZPi?tlN??L??p??W?Ar?e??Kn??G????i??z??s?????j??", lpString2="?" | out: lpString1="?Zgo?ZPi?tlN??L??p??W?Ar?e??Kn??G????i??z??s?????j???") returned="?Zgo?ZPi?tlN??L??p??W?Ar?e??Kn??G????i??z??s?????j???" [0097.595] lstrcatA (in: lpString1="?Zgo?ZPi?tlN??L??p??W?Ar?e??Kn??G????i??z??s?????j???", lpString2="?" | out: lpString1="?Zgo?ZPi?tlN??L??p??W?Ar?e??Kn??G????i??z??s?????j????") returned="?Zgo?ZPi?tlN??L??p??W?Ar?e??Kn??G????i??z??s?????j????" [0097.595] lstrcatA (in: lpString1="?Zgo?ZPi?tlN??L??p??W?Ar?e??Kn??G????i??z??s?????j????", lpString2="?" | out: lpString1="?Zgo?ZPi?tlN??L??p??W?Ar?e??Kn??G????i??z??s?????j?????") returned="?Zgo?ZPi?tlN??L??p??W?Ar?e??Kn??G????i??z??s?????j?????" [0097.595] lstrcatA (in: lpString1="?Zgo?ZPi?tlN??L??p??W?Ar?e??Kn??G????i??z??s?????j?????", lpString2="?" | out: lpString1="?Zgo?ZPi?tlN??L??p??W?Ar?e??Kn??G????i??z??s?????j??????") returned="?Zgo?ZPi?tlN??L??p??W?Ar?e??Kn??G????i??z??s?????j??????" [0097.595] lstrcatA (in: lpString1="?Zgo?ZPi?tlN??L??p??W?Ar?e??Kn??G????i??z??s?????j??????", lpString2="p" | out: lpString1="?Zgo?ZPi?tlN??L??p??W?Ar?e??Kn??G????i??z??s?????j??????p") returned="?Zgo?ZPi?tlN??L??p??W?Ar?e??Kn??G????i??z??s?????j??????p" [0097.595] lstrcatA (in: lpString1="?Zgo?ZPi?tlN??L??p??W?Ar?e??Kn??G????i??z??s?????j??????p", lpString2="d" | out: lpString1="?Zgo?ZPi?tlN??L??p??W?Ar?e??Kn??G????i??z??s?????j??????pd") returned="?Zgo?ZPi?tlN??L??p??W?Ar?e??Kn??G????i??z??s?????j??????pd" [0097.595] lstrcatA (in: lpString1="?Zgo?ZPi?tlN??L??p??W?Ar?e??Kn??G????i??z??s?????j??????pd", lpString2="W" | out: lpString1="?Zgo?ZPi?tlN??L??p??W?Ar?e??Kn??G????i??z??s?????j??????pdW") returned="?Zgo?ZPi?tlN??L??p??W?Ar?e??Kn??G????i??z??s?????j??????pdW" [0097.595] lstrcatA (in: lpString1="?Zgo?ZPi?tlN??L??p??W?Ar?e??Kn??G????i??z??s?????j??????pdW", lpString2="?" | out: lpString1="?Zgo?ZPi?tlN??L??p??W?Ar?e??Kn??G????i??z??s?????j??????pdW?") returned="?Zgo?ZPi?tlN??L??p??W?Ar?e??Kn??G????i??z??s?????j??????pdW?" [0097.595] lstrcatA (in: lpString1="?Zgo?ZPi?tlN??L??p??W?Ar?e??Kn??G????i??z??s?????j??????pdW?", lpString2="?" | out: lpString1="?Zgo?ZPi?tlN??L??p??W?Ar?e??Kn??G????i??z??s?????j??????pdW??") returned="?Zgo?ZPi?tlN??L??p??W?Ar?e??Kn??G????i??z??s?????j??????pdW??" [0097.595] lstrcatA (in: lpString1="?Zgo?ZPi?tlN??L??p??W?Ar?e??Kn??G????i??z??s?????j??????pdW??", lpString2="?" | out: lpString1="?Zgo?ZPi?tlN??L??p??W?Ar?e??Kn??G????i??z??s?????j??????pdW???") returned="?Zgo?ZPi?tlN??L??p??W?Ar?e??Kn??G????i??z??s?????j??????pdW???" [0097.596] lstrcatA (in: lpString1="?Zgo?ZPi?tlN??L??p??W?Ar?e??Kn??G????i??z??s?????j??????pdW???", lpString2="?" | out: lpString1="?Zgo?ZPi?tlN??L??p??W?Ar?e??Kn??G????i??z??s?????j??????pdW????") returned="?Zgo?ZPi?tlN??L??p??W?Ar?e??Kn??G????i??z??s?????j??????pdW????" [0097.596] lstrcatA (in: lpString1="?Zgo?ZPi?tlN??L??p??W?Ar?e??Kn??G????i??z??s?????j??????pdW????", lpString2="?" | out: lpString1="?Zgo?ZPi?tlN??L??p??W?Ar?e??Kn??G????i??z??s?????j??????pdW?????") returned="?Zgo?ZPi?tlN??L??p??W?Ar?e??Kn??G????i??z??s?????j??????pdW?????" [0097.596] lstrcatA (in: lpString1="?Zgo?ZPi?tlN??L??p??W?Ar?e??Kn??G????i??z??s?????j??????pdW?????", lpString2="C" | out: lpString1="?Zgo?ZPi?tlN??L??p??W?Ar?e??Kn??G????i??z??s?????j??????pdW?????C") returned="?Zgo?ZPi?tlN??L??p??W?Ar?e??Kn??G????i??z??s?????j??????pdW?????C" [0097.596] lstrcatA (in: lpString1="?Zgo?ZPi?tlN??L??p??W?Ar?e??Kn??G????i??z??s?????j??????pdW?????C", lpString2="Q" | out: lpString1="?Zgo?ZPi?tlN??L??p??W?Ar?e??Kn??G????i??z??s?????j??????pdW?????CQ") returned="?Zgo?ZPi?tlN??L??p??W?Ar?e??Kn??G????i??z??s?????j??????pdW?????CQ" [0097.596] lstrcatA (in: lpString1="?Zgo?ZPi?tlN??L??p??W?Ar?e??Kn??G????i??z??s?????j??????pdW?????CQ", lpString2="s" | out: lpString1="?Zgo?ZPi?tlN??L??p??W?Ar?e??Kn??G????i??z??s?????j??????pdW?????CQs") returned="?Zgo?ZPi?tlN??L??p??W?Ar?e??Kn??G????i??z??s?????j??????pdW?????CQs" [0097.596] lstrcatA (in: lpString1="?Zgo?ZPi?tlN??L??p??W?Ar?e??Kn??G????i??z??s?????j??????pdW?????CQs", lpString2="r" | out: lpString1="?Zgo?ZPi?tlN??L??p??W?Ar?e??Kn??G????i??z??s?????j??????pdW?????CQsr") returned="?Zgo?ZPi?tlN??L??p??W?Ar?e??Kn??G????i??z??s?????j??????pdW?????CQsr" [0097.596] lstrcatA (in: lpString1="?Zgo?ZPi?tlN??L??p??W?Ar?e??Kn??G????i??z??s?????j??????pdW?????CQsr", lpString2="?" | out: lpString1="?Zgo?ZPi?tlN??L??p??W?Ar?e??Kn??G????i??z??s?????j??????pdW?????CQsr?") returned="?Zgo?ZPi?tlN??L??p??W?Ar?e??Kn??G????i??z??s?????j??????pdW?????CQsr?" [0097.596] lstrcatA (in: lpString1="?Zgo?ZPi?tlN??L??p??W?Ar?e??Kn??G????i??z??s?????j??????pdW?????CQsr?", lpString2="?" | out: lpString1="?Zgo?ZPi?tlN??L??p??W?Ar?e??Kn??G????i??z??s?????j??????pdW?????CQsr??") returned="?Zgo?ZPi?tlN??L??p??W?Ar?e??Kn??G????i??z??s?????j??????pdW?????CQsr??" [0097.596] lstrcatA (in: lpString1="?Zgo?ZPi?tlN??L??p??W?Ar?e??Kn??G????i??z??s?????j??????pdW?????CQsr??", lpString2="?" | out: lpString1="?Zgo?ZPi?tlN??L??p??W?Ar?e??Kn??G????i??z??s?????j??????pdW?????CQsr???") returned="?Zgo?ZPi?tlN??L??p??W?Ar?e??Kn??G????i??z??s?????j??????pdW?????CQsr???" [0097.596] lstrcatA (in: lpString1="?Zgo?ZPi?tlN??L??p??W?Ar?e??Kn??G????i??z??s?????j??????pdW?????CQsr???", lpString2="?" | out: lpString1="?Zgo?ZPi?tlN??L??p??W?Ar?e??Kn??G????i??z??s?????j??????pdW?????CQsr????") returned="?Zgo?ZPi?tlN??L??p??W?Ar?e??Kn??G????i??z??s?????j??????pdW?????CQsr????" [0097.596] lstrcatA (in: lpString1="?Zgo?ZPi?tlN??L??p??W?Ar?e??Kn??G????i??z??s?????j??????pdW?????CQsr????", lpString2="?" | out: lpString1="?Zgo?ZPi?tlN??L??p??W?Ar?e??Kn??G????i??z??s?????j??????pdW?????CQsr?????") returned="?Zgo?ZPi?tlN??L??p??W?Ar?e??Kn??G????i??z??s?????j??????pdW?????CQsr?????" [0097.596] lstrcatA (in: lpString1="?Zgo?ZPi?tlN??L??p??W?Ar?e??Kn??G????i??z??s?????j??????pdW?????CQsr?????", lpString2="e" | out: lpString1="?Zgo?ZPi?tlN??L??p??W?Ar?e??Kn??G????i??z??s?????j??????pdW?????CQsr?????e") returned="?Zgo?ZPi?tlN??L??p??W?Ar?e??Kn??G????i??z??s?????j??????pdW?????CQsr?????e" [0097.596] lstrcatA (in: lpString1="?Zgo?ZPi?tlN??L??p??W?Ar?e??Kn??G????i??z??s?????j??????pdW?????CQsr?????e", lpString2="?" | out: lpString1="?Zgo?ZPi?tlN??L??p??W?Ar?e??Kn??G????i??z??s?????j??????pdW?????CQsr?????e?") returned="?Zgo?ZPi?tlN??L??p??W?Ar?e??Kn??G????i??z??s?????j??????pdW?????CQsr?????e?" [0097.596] lstrcatA (in: lpString1="?Zgo?ZPi?tlN??L??p??W?Ar?e??Kn??G????i??z??s?????j??????pdW?????CQsr?????e?", lpString2="?" | out: lpString1="?Zgo?ZPi?tlN??L??p??W?Ar?e??Kn??G????i??z??s?????j??????pdW?????CQsr?????e??") returned="?Zgo?ZPi?tlN??L??p??W?Ar?e??Kn??G????i??z??s?????j??????pdW?????CQsr?????e??" [0097.596] lstrcatA (in: lpString1="?Zgo?ZPi?tlN??L??p??W?Ar?e??Kn??G????i??z??s?????j??????pdW?????CQsr?????e??", lpString2="I" | out: lpString1="?Zgo?ZPi?tlN??L??p??W?Ar?e??Kn??G????i??z??s?????j??????pdW?????CQsr?????e??I") returned="?Zgo?ZPi?tlN??L??p??W?Ar?e??Kn??G????i??z??s?????j??????pdW?????CQsr?????e??I" [0097.596] lstrcatA (in: lpString1="?Zgo?ZPi?tlN??L??p??W?Ar?e??Kn??G????i??z??s?????j??????pdW?????CQsr?????e??I", lpString2="Q" | out: lpString1="?Zgo?ZPi?tlN??L??p??W?Ar?e??Kn??G????i??z??s?????j??????pdW?????CQsr?????e??IQ") returned="?Zgo?ZPi?tlN??L??p??W?Ar?e??Kn??G????i??z??s?????j??????pdW?????CQsr?????e??IQ" [0097.596] lstrcatA (in: lpString1="?Zgo?ZPi?tlN??L??p??W?Ar?e??Kn??G????i??z??s?????j??????pdW?????CQsr?????e??IQ", lpString2="s" | out: lpString1="?Zgo?ZPi?tlN??L??p??W?Ar?e??Kn??G????i??z??s?????j??????pdW?????CQsr?????e??IQs") returned="?Zgo?ZPi?tlN??L??p??W?Ar?e??Kn??G????i??z??s?????j??????pdW?????CQsr?????e??IQs" [0097.596] lstrcatA (in: lpString1="?Zgo?ZPi?tlN??L??p??W?Ar?e??Kn??G????i??z??s?????j??????pdW?????CQsr?????e??IQs", lpString2="a" | out: lpString1="?Zgo?ZPi?tlN??L??p??W?Ar?e??Kn??G????i??z??s?????j??????pdW?????CQsr?????e??IQsa") returned="?Zgo?ZPi?tlN??L??p??W?Ar?e??Kn??G????i??z??s?????j??????pdW?????CQsr?????e??IQsa" [0097.597] lstrcatA (in: lpString1="?Zgo?ZPi?tlN??L??p??W?Ar?e??Kn??G????i??z??s?????j??????pdW?????CQsr?????e??IQsa", lpString2="f" | out: lpString1="?Zgo?ZPi?tlN??L??p??W?Ar?e??Kn??G????i??z??s?????j??????pdW?????CQsr?????e??IQsaf") returned="?Zgo?ZPi?tlN??L??p??W?Ar?e??Kn??G????i??z??s?????j??????pdW?????CQsr?????e??IQsaf" [0097.597] lstrcatA (in: lpString1="?Zgo?ZPi?tlN??L??p??W?Ar?e??Kn??G????i??z??s?????j??????pdW?????CQsr?????e??IQsaf", lpString2="?" | out: lpString1="?Zgo?ZPi?tlN??L??p??W?Ar?e??Kn??G????i??z??s?????j??????pdW?????CQsr?????e??IQsaf?") returned="?Zgo?ZPi?tlN??L??p??W?Ar?e??Kn??G????i??z??s?????j??????pdW?????CQsr?????e??IQsaf?" [0097.597] lstrcatA (in: lpString1="?Zgo?ZPi?tlN??L??p??W?Ar?e??Kn??G????i??z??s?????j??????pdW?????CQsr?????e??IQsaf?", lpString2="J" | out: lpString1="?Zgo?ZPi?tlN??L??p??W?Ar?e??Kn??G????i??z??s?????j??????pdW?????CQsr?????e??IQsaf?J") returned="?Zgo?ZPi?tlN??L??p??W?Ar?e??Kn??G????i??z??s?????j??????pdW?????CQsr?????e??IQsaf?J" [0097.597] lstrcatA (in: lpString1="?Zgo?ZPi?tlN??L??p??W?Ar?e??Kn??G????i??z??s?????j??????pdW?????CQsr?????e??IQsaf?J", lpString2="W" | out: lpString1="?Zgo?ZPi?tlN??L??p??W?Ar?e??Kn??G????i??z??s?????j??????pdW?????CQsr?????e??IQsaf?JW") returned="?Zgo?ZPi?tlN??L??p??W?Ar?e??Kn??G????i??z??s?????j??????pdW?????CQsr?????e??IQsaf?JW" [0097.597] lstrlenA (lpString="?Zgo?ZPi?tlN??L??p??W?Ar?e??Kn??G????i??z??s?????j??????pdW?????CQsr?????e??IQsaf?JW") returned 84 [0097.597] lstrcpynA (in: lpString1=0x49907c, lpString2="?Zgo?ZPi?tlN??L??p??W?Ar?e??Kn??G????i??z??s?????j??????pdW?????CQsr?????e??IQsaf?JW", iMaxLength=57 | out: lpString1="?Zgo?ZPi?tlN??L??p??W?Ar?e??Kn??G????i??z??s?????j??????") returned="?Zgo?ZPi?tlN??L??p??W?Ar?e??Kn??G????i??z??s?????j??????" [0097.597] lstrlenA (lpString="?Zgo?ZPi?tlN??L??p??W?Ar?e??Kn??G????i??z??s?????j??????") returned 56 [0097.597] lstrcatA (in: lpString1="", lpString2="?" | out: lpString1="?") returned="?" [0097.597] lstrcatA (in: lpString1="?", lpString2="W" | out: lpString1="?W") returned="?W" [0097.597] lstrcatA (in: lpString1="?W", lpString2="?" | out: lpString1="?W?") returned="?W?" [0097.597] lstrcatA (in: lpString1="?W?", lpString2="N" | out: lpString1="?W?N") returned="?W?N" [0097.597] lstrcatA (in: lpString1="?W?N", lpString2="?" | out: lpString1="?W?N?") returned="?W?N?" [0097.597] lstrcatA (in: lpString1="?W?N?", lpString2="?" | out: lpString1="?W?N??") returned="?W?N??" [0097.597] lstrcatA (in: lpString1="?W?N??", lpString2="x" | out: lpString1="?W?N??x") returned="?W?N??x" [0097.597] lstrcatA (in: lpString1="?W?N??x", lpString2="?" | out: lpString1="?W?N??x?") returned="?W?N??x?" [0097.597] lstrcatA (in: lpString1="?W?N??x?", lpString2="?" | out: lpString1="?W?N??x??") returned="?W?N??x??" [0097.597] lstrcatA (in: lpString1="?W?N??x??", lpString2="?" | out: lpString1="?W?N??x???") returned="?W?N??x???" [0097.597] lstrcatA (in: lpString1="?W?N??x???", lpString2="?" | out: lpString1="?W?N??x????") returned="?W?N??x????" [0097.597] lstrcatA (in: lpString1="?W?N??x????", lpString2="?" | out: lpString1="?W?N??x?????") returned="?W?N??x?????" [0097.597] lstrcatA (in: lpString1="?W?N??x?????", lpString2="?" | out: lpString1="?W?N??x??????") returned="?W?N??x??????" [0097.597] lstrcatA (in: lpString1="?W?N??x??????", lpString2="?" | out: lpString1="?W?N??x???????") returned="?W?N??x???????" [0097.597] lstrcatA (in: lpString1="?W?N??x???????", lpString2="E" | out: lpString1="?W?N??x???????E") returned="?W?N??x???????E" [0097.597] lstrcatA (in: lpString1="?W?N??x???????E", lpString2="?" | out: lpString1="?W?N??x???????E?") returned="?W?N??x???????E?" [0097.598] lstrcatA (in: lpString1="?W?N??x???????E?", lpString2="W" | out: lpString1="?W?N??x???????E?W") returned="?W?N??x???????E?W" [0097.598] lstrcatA (in: lpString1="?W?N??x???????E?W", lpString2="?" | out: lpString1="?W?N??x???????E?W?") returned="?W?N??x???????E?W?" [0097.598] lstrcatA (in: lpString1="?W?N??x???????E?W?", lpString2="I" | out: lpString1="?W?N??x???????E?W?I") returned="?W?N??x???????E?W?I" [0097.598] lstrcatA (in: lpString1="?W?N??x???????E?W?I", lpString2="?" | out: lpString1="?W?N??x???????E?W?I?") returned="?W?N??x???????E?W?I?" [0097.598] lstrcatA (in: lpString1="?W?N??x???????E?W?I?", lpString2="k" | out: lpString1="?W?N??x???????E?W?I?k") returned="?W?N??x???????E?W?I?k" [0097.598] lstrcatA (in: lpString1="?W?N??x???????E?W?I?k", lpString2="?" | out: lpString1="?W?N??x???????E?W?I?k?") returned="?W?N??x???????E?W?I?k?" [0097.598] lstrcatA (in: lpString1="?W?N??x???????E?W?I?k?", lpString2="D" | out: lpString1="?W?N??x???????E?W?I?k?D") returned="?W?N??x???????E?W?I?k?D" [0097.598] lstrcatA (in: lpString1="?W?N??x???????E?W?I?k?D", lpString2="?" | out: lpString1="?W?N??x???????E?W?I?k?D?") returned="?W?N??x???????E?W?I?k?D?" [0097.598] lstrcatA (in: lpString1="?W?N??x???????E?W?I?k?D?", lpString2="w" | out: lpString1="?W?N??x???????E?W?I?k?D?w") returned="?W?N??x???????E?W?I?k?D?w" [0097.598] lstrcatA (in: lpString1="?W?N??x???????E?W?I?k?D?w", lpString2="k" | out: lpString1="?W?N??x???????E?W?I?k?D?wk") returned="?W?N??x???????E?W?I?k?D?wk" [0097.598] lstrcatA (in: lpString1="?W?N??x???????E?W?I?k?D?wk", lpString2="?" | out: lpString1="?W?N??x???????E?W?I?k?D?wk?") returned="?W?N??x???????E?W?I?k?D?wk?" [0097.598] lstrcatA (in: lpString1="?W?N??x???????E?W?I?k?D?wk?", lpString2="?" | out: lpString1="?W?N??x???????E?W?I?k?D?wk??") returned="?W?N??x???????E?W?I?k?D?wk??" [0097.598] lstrcatA (in: lpString1="?W?N??x???????E?W?I?k?D?wk??", lpString2="s" | out: lpString1="?W?N??x???????E?W?I?k?D?wk??s") returned="?W?N??x???????E?W?I?k?D?wk??s" [0097.598] lstrcatA (in: lpString1="?W?N??x???????E?W?I?k?D?wk??s", lpString2="?" | out: lpString1="?W?N??x???????E?W?I?k?D?wk??s?") returned="?W?N??x???????E?W?I?k?D?wk??s?" [0097.598] lstrcatA (in: lpString1="?W?N??x???????E?W?I?k?D?wk??s?", lpString2="s" | out: lpString1="?W?N??x???????E?W?I?k?D?wk??s?s") returned="?W?N??x???????E?W?I?k?D?wk??s?s" [0097.598] lstrcatA (in: lpString1="?W?N??x???????E?W?I?k?D?wk??s?s", lpString2="?" | out: lpString1="?W?N??x???????E?W?I?k?D?wk??s?s?") returned="?W?N??x???????E?W?I?k?D?wk??s?s?" [0097.598] lstrcatA (in: lpString1="?W?N??x???????E?W?I?k?D?wk??s?s?", lpString2="p" | out: lpString1="?W?N??x???????E?W?I?k?D?wk??s?s?p") returned="?W?N??x???????E?W?I?k?D?wk??s?s?p" [0097.598] lstrcatA (in: lpString1="?W?N??x???????E?W?I?k?D?wk??s?s?p", lpString2="?" | out: lpString1="?W?N??x???????E?W?I?k?D?wk??s?s?p?") returned="?W?N??x???????E?W?I?k?D?wk??s?s?p?" [0097.598] lstrcatA (in: lpString1="?W?N??x???????E?W?I?k?D?wk??s?s?p?", lpString2="g" | out: lpString1="?W?N??x???????E?W?I?k?D?wk??s?s?p?g") returned="?W?N??x???????E?W?I?k?D?wk??s?s?p?g" [0097.598] lstrcatA (in: lpString1="?W?N??x???????E?W?I?k?D?wk??s?s?p?g", lpString2="N" | out: lpString1="?W?N??x???????E?W?I?k?D?wk??s?s?p?gN") returned="?W?N??x???????E?W?I?k?D?wk??s?s?p?gN" [0097.598] lstrcatA (in: lpString1="?W?N??x???????E?W?I?k?D?wk??s?s?p?gN", lpString2="U" | out: lpString1="?W?N??x???????E?W?I?k?D?wk??s?s?p?gNU") returned="?W?N??x???????E?W?I?k?D?wk??s?s?p?gNU" [0097.598] lstrcatA (in: lpString1="?W?N??x???????E?W?I?k?D?wk??s?s?p?gNU", lpString2="?" | out: lpString1="?W?N??x???????E?W?I?k?D?wk??s?s?p?gNU?") returned="?W?N??x???????E?W?I?k?D?wk??s?s?p?gNU?" [0097.599] lstrcatA (in: lpString1="?W?N??x???????E?W?I?k?D?wk??s?s?p?gNU?", lpString2="?" | out: lpString1="?W?N??x???????E?W?I?k?D?wk??s?s?p?gNU??") returned="?W?N??x???????E?W?I?k?D?wk??s?s?p?gNU??" [0097.599] lstrcatA (in: lpString1="?W?N??x???????E?W?I?k?D?wk??s?s?p?gNU??", lpString2="?" | out: lpString1="?W?N??x???????E?W?I?k?D?wk??s?s?p?gNU???") returned="?W?N??x???????E?W?I?k?D?wk??s?s?p?gNU???" [0097.599] lstrcatA (in: lpString1="?W?N??x???????E?W?I?k?D?wk??s?s?p?gNU???", lpString2="?" | out: lpString1="?W?N??x???????E?W?I?k?D?wk??s?s?p?gNU????") returned="?W?N??x???????E?W?I?k?D?wk??s?s?p?gNU????" [0097.599] lstrcatA (in: lpString1="?W?N??x???????E?W?I?k?D?wk??s?s?p?gNU????", lpString2="?" | out: lpString1="?W?N??x???????E?W?I?k?D?wk??s?s?p?gNU?????") returned="?W?N??x???????E?W?I?k?D?wk??s?s?p?gNU?????" [0097.599] lstrcatA (in: lpString1="?W?N??x???????E?W?I?k?D?wk??s?s?p?gNU?????", lpString2="?" | out: lpString1="?W?N??x???????E?W?I?k?D?wk??s?s?p?gNU??????") returned="?W?N??x???????E?W?I?k?D?wk??s?s?p?gNU??????" [0097.599] lstrcatA (in: lpString1="?W?N??x???????E?W?I?k?D?wk??s?s?p?gNU??????", lpString2="M" | out: lpString1="?W?N??x???????E?W?I?k?D?wk??s?s?p?gNU??????M") returned="?W?N??x???????E?W?I?k?D?wk??s?s?p?gNU??????M" [0097.599] lstrcatA (in: lpString1="?W?N??x???????E?W?I?k?D?wk??s?s?p?gNU??????M", lpString2="?" | out: lpString1="?W?N??x???????E?W?I?k?D?wk??s?s?p?gNU??????M?") returned="?W?N??x???????E?W?I?k?D?wk??s?s?p?gNU??????M?" [0097.599] lstrcatA (in: lpString1="?W?N??x???????E?W?I?k?D?wk??s?s?p?gNU??????M?", lpString2="Z" | out: lpString1="?W?N??x???????E?W?I?k?D?wk??s?s?p?gNU??????M?Z") returned="?W?N??x???????E?W?I?k?D?wk??s?s?p?gNU??????M?Z" [0097.599] lstrcatA (in: lpString1="?W?N??x???????E?W?I?k?D?wk??s?s?p?gNU??????M?Z", lpString2="V" | out: lpString1="?W?N??x???????E?W?I?k?D?wk??s?s?p?gNU??????M?ZV") returned="?W?N??x???????E?W?I?k?D?wk??s?s?p?gNU??????M?ZV" [0097.599] lstrcatA (in: lpString1="?W?N??x???????E?W?I?k?D?wk??s?s?p?gNU??????M?ZV", lpString2="Q" | out: lpString1="?W?N??x???????E?W?I?k?D?wk??s?s?p?gNU??????M?ZVQ") returned="?W?N??x???????E?W?I?k?D?wk??s?s?p?gNU??????M?ZVQ" [0097.599] lstrcatA (in: lpString1="?W?N??x???????E?W?I?k?D?wk??s?s?p?gNU??????M?ZVQ", lpString2="?" | out: lpString1="?W?N??x???????E?W?I?k?D?wk??s?s?p?gNU??????M?ZVQ?") returned="?W?N??x???????E?W?I?k?D?wk??s?s?p?gNU??????M?ZVQ?" [0097.599] lstrcatA (in: lpString1="?W?N??x???????E?W?I?k?D?wk??s?s?p?gNU??????M?ZVQ?", lpString2="?" | out: lpString1="?W?N??x???????E?W?I?k?D?wk??s?s?p?gNU??????M?ZVQ??") returned="?W?N??x???????E?W?I?k?D?wk??s?s?p?gNU??????M?ZVQ??" [0097.599] lstrcatA (in: lpString1="?W?N??x???????E?W?I?k?D?wk??s?s?p?gNU??????M?ZVQ??", lpString2="w" | out: lpString1="?W?N??x???????E?W?I?k?D?wk??s?s?p?gNU??????M?ZVQ??w") returned="?W?N??x???????E?W?I?k?D?wk??s?s?p?gNU??????M?ZVQ??w" [0097.599] lstrlenA (lpString="?W?N??x???????E?W?I?k?D?wk??s?s?p?gNU??????M?ZVQ??w?") returned 52 [0097.599] lstrcpynA (in: lpString1=0x49909c, lpString2="?W?N??x???????E?W?I?k?D?wk??s?s?p?gNU??????M?ZVQ??w?", iMaxLength=26 | out: lpString1="?W?N??x???????E?W?I?k?D?w") returned="?W?N??x???????E?W?I?k?D?w" [0097.599] lstrlenA (lpString="?W?N??x???????E?W?I?k?D?w") returned 25 [0097.599] lstrlenA (lpString="??B?pC") returned 6 [0097.599] lstrcpynA (in: lpString1=0x4990c4, lpString2="??B?pC", iMaxLength=4 | out: lpString1="??B") returned="??B" [0097.599] lstrlenA (lpString="??B") returned 3 [0097.599] lstrlenA (lpString="?d??M?z?") returned 8 [0097.599] lstrcpynA (in: lpString1=0x4990c4, lpString2="?d??M?z?", iMaxLength=7 | out: lpString1="?d??M?") returned="?d??M?" [0097.599] lstrlenA (lpString="?d??M?") returned 6 [0097.600] lstrlenA (lpString="A??MkM?Fg?vo??up?NF????A??mR?tNvbeJ???Yv?B????U??s???nn??B?DWn?aY???ERgfzk?Y??X??L??A?F?") returned 88 [0097.600] lstrcpynA (in: lpString1=0x499078, lpString2="A??MkM?Fg?vo??up?NF????A??mR?tNvbeJ???Yv?B????U??s???nn??B?DWn?aY???ERgfzk?Y??X??L??A?F?", iMaxLength=71 | out: lpString1="A??MkM?Fg?vo??up?NF????A??mR?tNvbeJ???Yv?B????U??s???nn??B?DWn?aY???ER") returned="A??MkM?Fg?vo??up?NF????A??mR?tNvbeJ???Yv?B????U??s???nn??B?DWn?aY???ER" [0097.600] lstrlenA (lpString="A??MkM?Fg?vo??up?NF????A??mR?tNvbeJ???Yv?B????U??s???nn??B?DWn?aY???ER") returned 70 [0097.600] lstrlenA (lpString="??????????????H?V?FurW???E?G????A??Qch??k????d??????c?") returned 54 [0097.600] lstrcpynA (in: lpString1=0x49909c, lpString2="??????????????H?V?FurW???E?G????A??Qch??k????d??????c?", iMaxLength=28 | out: lpString1="??????????????H?V?FurW???E?") returned="??????????????H?V?FurW???E?" [0097.600] lstrlenA (lpString="??????????????H?V?FurW???E?") returned 27 [0097.600] lstrlenA (lpString="eNdFR?p?kXk") returned 11 [0097.600] lstrcpynA (in: lpString1=0x4990c4, lpString2="eNdFR?p?kXk", iMaxLength=2 | out: lpString1="e") returned="e" [0097.600] lstrlenA (lpString="e") returned 1 [0097.600] lstrlenA (lpString="???Pep??a?uP??Biuoofz??W????j??aO??") returned 35 [0097.600] lstrcpynA (in: lpString1=0x4990b0, lpString2="???Pep??a?uP??Biuoofz??W????j??aO??", iMaxLength=34 | out: lpString1="???Pep??a?uP??Biuoofz??W????j??aO") returned="???Pep??a?uP??Biuoofz??W????j??aO" [0097.600] lstrlenA (lpString="???Pep??a?uP??Biuoofz??W????j??aO") returned 33 [0097.600] lstrlenA (lpString="y??r?n?TS?Fdo?c") returned 15 [0097.600] lstrcpynA (in: lpString1=0x4990c4, lpString2="y??r?n?TS?Fdo?c", iMaxLength=3 | out: lpString1="y?") returned="y?" [0097.600] lstrlenA (lpString="y?") returned 2 [0097.600] lstrlenA (lpString="SSl???D?eOpMa??t?M?RrF??W??L?fGA") returned 32 [0097.600] lstrcpynA (in: lpString1=0x4990b0, lpString2="SSl???D?eOpMa??t?M?RrF??W??L?fGA", iMaxLength=28 | out: lpString1="SSl???D?eOpMa??t?M?RrF??W??") returned="SSl???D?eOpMa??t?M?RrF??W??" [0097.600] lstrlenA (lpString="SSl???D?eOpMa??t?M?RrF??W??") returned 27 [0097.601] lstrlenA (lpString="??j?ER??EITckM????O???K?a?G????Vgsk?Ate???J??UEc???iK??F?GCP??r???ouP?M???UZvBT??xD") returned 83 [0097.601] lstrcpynA (in: lpString1=0x499080, lpString2="??j?ER??EITckM????O???K?a?G????Vgsk?Ate???J??UEc???iK??F?GCP??r???ouP?M???UZvBT??xD", iMaxLength=28 | out: lpString1="??j?ER??EITckM????O???K?a?G") returned="??j?ER??EITckM????O???K?a?G" [0097.601] lstrlenA (lpString="??j?ER??EITckM????O???K?a?G") returned 27 [0097.601] lstrlenA (lpString="Oj?O?") returned 5 [0097.601] lstrcpynA (in: lpString1=0x4990c4, lpString2="Oj?O?", iMaxLength=3 | out: lpString1="Oj") returned="Oj" [0097.601] lstrlenA (lpString="Oj") returned 2 [0097.601] lstrlenA (lpString="??n?nv??xuQ???lps???C?KR???????g?O?Om???O?xiYb???Q?rgj?????NULL?ufnY?????a???S??yJ?E?????l?T?xE?f") returned 97 [0097.601] lstrcpynA (in: lpString1=0x499070, lpString2="??n?nv??xuQ???lps???C?KR???????g?O?Om???O?xiYb???Q?rgj?????NULL?ufnY?????a???S??yJ?E?????l?T?xE?f", iMaxLength=46 | out: lpString1="??n?nv??xuQ???lps???C?KR???????g?O?Om???O?xiY") returned="??n?nv??xuQ???lps???C?KR???????g?O?Om???O?xiY" [0097.601] lstrlenA (lpString="??n?nv??xuQ???lps???C?KR???????g?O?Om???O?xiY") returned 45 [0097.601] lstrlenA (lpString="???JDtt??Un?OX??kapf???a??????tP????i?I???o??UK?DZ?X?iO?B???bvl?E?x????Y?gk????F?i?l??J?D?rHg????m") returned 98 [0097.601] lstrcpynA (in: lpString1=0x499070, lpString2="???JDtt??Un?OX??kapf???a??????tP????i?I???o??UK?DZ?X?iO?B???bvl?E?x????Y?gk????F?i?l??J?D?rHg????m", iMaxLength=63 | out: lpString1="???JDtt??Un?OX??kapf???a??????tP????i?I???o??UK?DZ?X?iO?B???bv") returned="???JDtt??Un?OX??kapf???a??????tP????i?I???o??UK?DZ?X?iO?B???bv" [0097.601] lstrlenA (lpString="???JDtt??Un?OX??kapf???a??????tP????i?I???o??UK?DZ?X?iO?B???bv") returned 62 [0097.601] lstrlenA (lpString="???????BM?vB?k??w??CGcMgl?KKvY??W?d?Eku???nmz???f?mth?G?B?????Ec?Gvjy") returned 69 [0097.601] lstrcpynA (in: lpString1=0x49908c, lpString2="???????BM?vB?k??w??CGcMgl?KKvY??W?d?Eku???nmz???f?mth?G?B?????Ec?Gvjy", iMaxLength=1 | out: lpString1="") returned="" [0097.601] lstrlenA (lpString="") returned 0 [0097.601] lstrlenA (lpString="w???W??f?T?u????DEM?MsP?rK????s?J?gj??v?s??I?h??????STh?") returned 56 [0097.601] lstrcpynA (in: lpString1=0x499098, lpString2="w???W??f?T?u????DEM?MsP?rK????s?J?gj??v?s??I?h??????STh?", iMaxLength=15 | out: lpString1="w???W??f?T?u??") returned="w???W??f?T?u??" [0097.601] lstrlenA (lpString="w???W??f?T?u??") returned 14 [0097.602] lstrlenA (lpString="j?Knx????C??u???Ce???n?p?S?fHn?g?F?kh?gzMMeRsv???v?E?uZ?sOJ???gC?????J?????tv?????Jz?") returned 85 [0097.602] lstrcpynA (in: lpString1=0x49907c, lpString2="j?Knx????C??u???Ce???n?p?S?fHn?g?F?kh?gzMMeRsv???v?E?uZ?sOJ???gC?????J?????tv?????Jz?", iMaxLength=55 | out: lpString1="j?Knx????C??u???Ce???n?p?S?fHn?g?F?kh?gzMMeRsv???v?E?u") returned="j?Knx????C??u???Ce???n?p?S?fHn?g?F?kh?gzMMeRsv???v?E?u" [0097.602] lstrlenA (lpString="j?Knx????C??u???Ce???n?p?S?fHn?g?F?kh?gzMMeRsv???v?E?u") returned 54 [0097.602] lstrlenA (lpString="?u?hYv?D????e?ZL?Fd?J??S?YsQ???b??fA????????Fj?y??dAzQ?y??B?d?K????R?aC?????z????uTc??t?vo??L?") returned 94 [0097.602] lstrcpynA (in: lpString1=0x499074, lpString2="?u?hYv?D????e?ZL?Fd?J??S?YsQ???b??fA????????Fj?y??dAzQ?y??B?d?K????R?aC?????z????uTc??t?vo??L?", iMaxLength=44 | out: lpString1="?u?hYv?D????e?ZL?Fd?J??S?YsQ???b??fA???????") returned="?u?hYv?D????e?ZL?Fd?J??S?YsQ???b??fA???????" [0097.602] lstrlenA (lpString="?u?hYv?D????e?ZL?Fd?J??S?YsQ???b??fA???????") returned 43 [0097.602] lstrlenA (lpString="y??DA?KA??R?????PiKbYYVri?G?Coi?D??ddK?L?A?CZTb???GV?jB???Y??B???R?CZ") returned 69 [0097.602] lstrcpynA (in: lpString1=0x49908c, lpString2="y??DA?KA??R?????PiKbYYVri?G?Coi?D??ddK?L?A?CZTb???GV?jB???Y??B???R?CZ", iMaxLength=30 | out: lpString1="y??DA?KA??R?????PiKbYYVri?G?C") returned="y??DA?KA??R?????PiKbYYVri?G?C" [0097.602] lstrlenA (lpString="y??DA?KA??R?????PiKbYYVri?G?C") returned 29 [0097.602] lstrlenA (lpString="?Z?Oe????t???Zby???fd?ZCM?k??X?") returned 31 [0097.602] lstrcpynA (in: lpString1=0x4990b4, lpString2="?Z?Oe????t???Zby???fd?ZCM?k??X?", iMaxLength=24 | out: lpString1="?Z?Oe????t???Zby???fd?Z") returned="?Z?Oe????t???Zby???fd?Z" [0097.602] lstrlenA (lpString="?Z?Oe????t???Zby???fd?Z") returned 23 [0097.602] lstrlenA (lpString="??????x?Zt???CJ??d?mz???c?j?l?sA????Dc????wL??ITB?????????USD?") returned 62 [0097.602] lstrcpynA (in: lpString1=0x499094, lpString2="??????x?Zt???CJ??d?mz???c?j?l?sA????Dc????wL??ITB?????????USD?", iMaxLength=51 | out: lpString1="??????x?Zt???CJ??d?mz???c?j?l?sA????Dc????wL??ITB?") returned="??????x?Zt???CJ??d?mz???c?j?l?sA????Dc????wL??ITB?" [0097.602] lstrlenA (lpString="??????x?Zt???CJ??d?mz???c?j?l?sA????Dc????wL??ITB?") returned 50 [0097.602] lstrlenA (lpString="Xs??Y?YcUA?cWIm?TH?V??A?????A?ezMh?vP??uBV?k??X?d?") returned 50 [0097.602] lstrcpynA (in: lpString1=0x4990a0, lpString2="Xs??Y?YcUA?cWIm?TH?V??A?????A?ezMh?vP??uBV?k??X?d?", iMaxLength=12 | out: lpString1="Xs??Y?YcUA?") returned="Xs??Y?YcUA?" [0097.602] lstrlenA (lpString="Xs??Y?YcUA?") returned 11 [0097.603] lstrlenA (lpString="???Yh?????P??d?r?????Prz??S?V?Q?n?G?Vy??D?????wOQa??") returned 52 [0097.603] lstrcpynA (in: lpString1=0x49909c, lpString2="???Yh?????P??d?r?????Prz??S?V?Q?n?G?Vy??D?????wOQa??", iMaxLength=35 | out: lpString1="???Yh?????P??d?r?????Prz??S?V?Q?n?") returned="???Yh?????P??d?r?????Prz??S?V?Q?n?" [0097.603] lstrlenA (lpString="???Yh?????P??d?r?????Prz??S?V?Q?n?") returned 34 [0097.603] lstrlenA (lpString="??DbR?Dr?????e??d??S?QSr?r?F???pX?r??S??H?vaOv?n") returned 48 [0097.603] lstrcpynA (in: lpString1=0x4990a0, lpString2="??DbR?Dr?????e??d??S?QSr?r?F???pX?r??S??H?vaOv?n", iMaxLength=22 | out: lpString1="??DbR?Dr?????e??d??S?") returned="??DbR?Dr?????e??d??S?" [0097.603] lstrlenA (lpString="??DbR?Dr?????e??d??S?") returned 21 [0097.603] lstrlenA (lpString="?n??PPIQf?y???B?????s??RyW??????dr?vk??Vy?CK?vc???m?????E??p????fC??dE??SC??????uw??") returned 84 [0097.603] lstrcpynA (in: lpString1=0x49907c, lpString2="?n??PPIQf?y???B?????s??RyW??????dr?vk??Vy?CK?vc???m?????E??p????fC??dE??SC??????uw??", iMaxLength=23 | out: lpString1="?n??PPIQf?y???B?????s?") returned="?n??PPIQf?y???B?????s?" [0097.603] lstrlenA (lpString="?n??PPIQf?y???B?????s?") returned 22 [0097.603] lstrlenA (lpString="U???uN????TpIO????Df?zy???r???H?O??UOs") returned 38 [0097.603] lstrcpynA (in: lpString1=0x4990ac, lpString2="U???uN????TpIO????Df?zy???r???H?O??UOs", iMaxLength=16 | out: lpString1="U???uN????TpIO?") returned="U???uN????TpIO?" [0097.603] lstrlenA (lpString="U???uN????TpIO?") returned 15 [0097.603] lstrlenA (lpString="??F???KN???wCf?P?NCO??NL???") returned 27 [0097.603] lstrcpynA (in: lpString1=0x4990b8, lpString2="??F???KN???wCf?P?NCO??NL???", iMaxLength=10 | out: lpString1="??F???KN?") returned="??F???KN?" [0097.603] lstrlenA (lpString="??F???KN?") returned 9 [0097.603] lstrlenA (lpString="M??JWAruUbl???Ig???j??TK?L???pe") returned 31 [0097.603] lstrcpynA (in: lpString1=0x4990b4, lpString2="M??JWAruUbl???Ig???j??TK?L???pe", iMaxLength=6 | out: lpString1="M??JW") returned="M??JW" [0097.603] lstrlenA (lpString="M??JW") returned 5 [0097.603] lstrlenA (lpString="??????Zjd???X??c?E?S?PG??HfEnv?????B??eb?Hz???") returned 46 [0097.603] lstrcpynA (in: lpString1=0x4990a4, lpString2="??????Zjd???X??c?E?S?PG??HfEnv?????B??eb?Hz???", iMaxLength=26 | out: lpString1="??????Zjd???X??c?E?S?PG??") returned="??????Zjd???X??c?E?S?PG??" [0097.604] lstrlenA (lpString="??????Zjd???X??c?E?S?PG??") returned 25 [0097.604] lstrlenA (lpString="l????kHP???k???Te??WB?Q???k??a??aAt?n?e?o?RZJ?BR???????W?ib??????ho???uS??z???dRc???Df?z?") returned 89 [0097.604] lstrcpynA (in: lpString1=0x499078, lpString2="l????kHP???k???Te??WB?Q???k??a??aAt?n?e?o?RZJ?BR???????W?ib??????ho???uS??z???dRc???Df?z?", iMaxLength=71 | out: lpString1="l????kHP???k???Te??WB?Q???k??a??aAt?n?e?o?RZJ?BR???????W?ib??????ho???") returned="l????kHP???k???Te??WB?Q???k??a??aAt?n?e?o?RZJ?BR???????W?ib??????ho???" [0097.604] lstrlenA (lpString="l????kHP???k???Te??WB?Q???k??a??aAt?n?e?o?RZJ?BR???????W?ib??????ho???") returned 70 [0097.604] lstrlenA (lpString="d?N???EX?Jt?M?????????d??O?x??a????U?UtO??L??R?Iv") returned 49 [0097.604] lstrcpynA (in: lpString1=0x4990a0, lpString2="d?N???EX?Jt?M?????????d??O?x??a????U?UtO??L??R?Iv", iMaxLength=20 | out: lpString1="d?N???EX?Jt?M??????") returned="d?N???EX?Jt?M??????" [0097.604] lstrlenA (lpString="d?N???EX?Jt?M??????") returned 19 [0097.604] lstrlenA (lpString="c?J???G?p?eI???i?tW??ddJ???C?????z?OC") returned 37 [0097.604] lstrcpynA (in: lpString1=0x4990ac, lpString2="c?J???G?p?eI???i?tW??ddJ???C?????z?OC", iMaxLength=25 | out: lpString1="c?J???G?p?eI???i?tW??ddJ") returned="c?J???G?p?eI???i?tW??ddJ" [0097.604] lstrlenA (lpString="c?J???G?p?eI???i?tW??ddJ") returned 24 [0097.604] lstrlenA (lpString="??HJRK?YQ?Kd??aM?t?j?Ls???F?D?????kS?wS?gjQAjHhX??V?mH?a?J??y????LH??") returned 69 [0097.604] lstrcpynA (in: lpString1=0x49908c, lpString2="??HJRK?YQ?Kd??aM?t?j?Ls???F?D?????kS?wS?gjQAjHhX??V?mH?a?J??y????LH??", iMaxLength=52 | out: lpString1="??HJRK?YQ?Kd??aM?t?j?Ls???F?D?????kS?wS?gjQAjHhX??V") returned="??HJRK?YQ?Kd??aM?t?j?Ls???F?D?????kS?wS?gjQAjHhX??V" [0097.604] lstrlenA (lpString="??HJRK?YQ?Kd??aM?t?j?Ls???F?D?????kS?wS?gjQAjHhX??V") returned 51 [0097.604] lstrlenA (lpString="Sr?z??nS?G?Ev?Xsi?Zb???b????T??zB??F??????fm?F?????jP?b????Dfniz?A?E?oz") returned 71 [0097.604] lstrcpynA (in: lpString1=0x49908c, lpString2="Sr?z??nS?G?Ev?Xsi?Zb???b????T??zB??F??????fm?F?????jP?b????Dfniz?A?E?oz", iMaxLength=10 | out: lpString1="Sr?z??nS?") returned="Sr?z??nS?" [0097.604] lstrlenA (lpString="Sr?z??nS?") returned 9 [0097.604] lstrlenA (lpString="rJG?S?ky?m????y?DV?ZXN??l?B???NVCnx?g?b??x???Mn??b??j?n?V???") returned 60 [0097.605] lstrcpynA (in: lpString1=0x499094, lpString2="rJG?S?ky?m????y?DV?ZXN??l?B???NVCnx?g?b??x???Mn??b??j?n?V???", iMaxLength=23 | out: lpString1="rJG?S?ky?m????y?DV?ZXN") returned="rJG?S?ky?m????y?DV?ZXN" [0097.605] lstrlenA (lpString="rJG?S?ky?m????y?DV?ZXN") returned 22 [0097.605] lstrlenA (lpString="?F?B???MQiBQ?wu?A?????I???a?SZk?t?xL???O?X?pa??V?????Npiu?Be?nh???bh????e?TXWn?e??e???") returned 86 [0097.605] lstrcpynA (in: lpString1=0x49907c, lpString2="?F?B???MQiBQ?wu?A?????I???a?SZk?t?xL???O?X?pa??V?????Npiu?Be?nh???bh????e?TXWn?e??e???", iMaxLength=85 | out: lpString1="?F?B???MQiBQ?wu?A?????I???a?SZk?t?xL???O?X?pa??V?????Npiu?Be?nh???bh????e?TXWn?e??e?") returned="?F?B???MQiBQ?wu?A?????I???a?SZk?t?xL???O?X?pa??V?????Npiu?Be?nh???bh????e?TXWn?e??e?" [0097.605] lstrlenA (lpString="?F?B???MQiBQ?wu?A?????I???a?SZk?t?xL???O?X?pa??V?????Npiu?Be?nh???bh????e?TXWn?e??e?") returned 84 [0097.605] lstrlenA (lpString="DVJ??EY?zb?") returned 11 [0097.605] lstrcpynA (in: lpString1=0x4990c4, lpString2="DVJ??EY?zb?", iMaxLength=7 | out: lpString1="DVJ??E") returned="DVJ??E" [0097.605] lstrlenA (lpString="DVJ??E") returned 6 [0097.605] lstrlenA (lpString="???c????Cv?b") returned 12 [0097.605] lstrcpynA (in: lpString1=0x4990c4, lpString2="???c????Cv?b", iMaxLength=8 | out: lpString1="???c???") returned="???c???" [0097.605] lstrlenA (lpString="???c???") returned 7 [0097.605] lstrlenA (lpString="???HDxf?eh?u?WbalF?EuB?U????ey???Pbk????Fxz?T?gc??yDr??x????QX????hDtiW??j??TNr????PwU???") returned 89 [0097.605] lstrcpynA (in: lpString1=0x499078, lpString2="???HDxf?eh?u?WbalF?EuB?U????ey???Pbk????Fxz?T?gc??yDr??x????QX????hDtiW??j??TNr????PwU???", iMaxLength=2 | out: lpString1="?") returned="?" [0097.605] lstrlenA (lpString="?") returned 1 [0097.605] lstrlenA (lpString="j??VvrZ??k??Z??d??aBnf????Tvb?eV?tC???pC???????????f??BtgY?m?n") returned 62 [0097.605] lstrcpynA (in: lpString1=0x499094, lpString2="j??VvrZ??k??Z??d??aBnf????Tvb?eV?tC???pC???????????f??BtgY?m?n", iMaxLength=30 | out: lpString1="j??VvrZ??k??Z??d??aBnf????Tvb") returned="j??VvrZ??k??Z??d??aBnf????Tvb" [0097.605] lstrlenA (lpString="j??VvrZ??k??Z??d??aBnf????Tvb") returned 29 [0097.605] lstrlenA (lpString="?JLAk????mH???J?LLK????L?????N???RjTg???U?bm?IJA?w?f?") returned 53 [0097.605] lstrcpynA (in: lpString1=0x49909c, lpString2="?JLAk????mH???J?LLK????L?????N???RjTg???U?bm?IJA?w?f?", iMaxLength=12 | out: lpString1="?JLAk????mH") returned="?JLAk????mH" [0097.606] lstrlenA (lpString="?JLAk????mH") returned 11 [0097.606] lstrlenA (lpString="w????tJ??F??d???L???X?xDbw??CYY?U?g?W?O???k????J?Vc??EHP?g??X?PYppE??E?LGg?") returned 75 [0097.606] lstrcpynA (in: lpString1=0x499088, lpString2="w????tJ??F??d???L???X?xDbw??CYY?U?g?W?O???k????J?Vc??EHP?g??X?PYppE??E?LGg?", iMaxLength=66 | out: lpString1="w????tJ??F??d???L???X?xDbw??CYY?U?g?W?O???k????J?Vc??EHP?g??X?PYp") returned="w????tJ??F??d???L???X?xDbw??CYY?U?g?W?O???k????J?Vc??EHP?g??X?PYp" [0097.606] lstrlenA (lpString="w????tJ??F??d???L???X?xDbw??CYY?U?g?W?O???k????J?Vc??EHP?g??X?PYp") returned 65 [0097.606] lstrlenA (lpString="XTU??a??yl??fbD?pn????l????T??????C?gdSvCvb??UHce????G??d??yIV") returned 62 [0097.606] lstrcpynA (in: lpString1=0x499094, lpString2="XTU??a??yl??fbD?pn????l????T??????C?gdSvCvb??UHce????G??d??yIV", iMaxLength=19 | out: lpString1="XTU??a??yl??fbD?pn") returned="XTU??a??yl??fbD?pn" [0097.606] lstrlenA (lpString="XTU??a??yl??fbD?pn") returned 18 [0097.606] lstrlenA (lpString="????G???") returned 8 [0097.606] lstrcpynA (in: lpString1=0x4990c4, lpString2="????G???", iMaxLength=4 | out: lpString1="???") returned="???" [0097.606] lstrlenA (lpString="???") returned 3 [0097.606] lstrlenA (lpString="fN??E???og????jI????????ZCS??????XG?M?xL??eZaQ????????????W???waR?fmS?") returned 70 [0097.606] lstrcpynA (in: lpString1=0x49908c, lpString2="fN??E???og????jI????????ZCS??????XG?M?xL??eZaQ????????????W???waR?fmS?", iMaxLength=58 | out: lpString1="fN??E???og????jI????????ZCS??????XG?M?xL??eZaQ???????????") returned="fN??E???og????jI????????ZCS??????XG?M?xL??eZaQ???????????" [0097.606] lstrlenA (lpString="fN??E???og????jI????????ZCS??????XG?M?xL??eZaQ???????????") returned 57 [0097.606] lstrlenA (lpString="???Z?xC??xvZ??????BF????kaf?JW???uri?IvoN?a???tV?N?") returned 51 [0097.606] lstrcpynA (in: lpString1=0x4990a0, lpString2="???Z?xC??xvZ??????BF????kaf?JW???uri?IvoN?a???tV?N?", iMaxLength=13 | out: lpString1="???Z?xC??xvZ") returned="???Z?xC??xvZ" [0097.606] lstrlenA (lpString="???Z?xC??xvZ") returned 12 [0097.606] lstrlenA (lpString="???E?i?I?X????Xi?CH???urIi?r????cPlogy?e??VMYjg?JKz????a????J?Hb?????F???G") returned 74 [0097.606] lstrcpynA (in: lpString1=0x499088, lpString2="???E?i?I?X????Xi?CH???urIi?r????cPlogy?e??VMYjg?JKz????a????J?Hb?????F???G", iMaxLength=8 | out: lpString1="???E?i?") returned="???E?i?" [0097.607] lstrlenA (lpString="???E?i?") returned 7 [0097.607] lstrlenA (lpString="?l????D?U?JogNaa?mFm?K??brN?ug???G???X???c??Y?Q??????zrZ????") returned 60 [0097.607] lstrcpynA (in: lpString1=0x499094, lpString2="?l????D?U?JogNaa?mFm?K??brN?ug???G???X???c??Y?Q??????zrZ????", iMaxLength=8 | out: lpString1="?l????D") returned="?l????D" [0097.607] lstrlenA (lpString="?l????D") returned 7 [0097.607] lstrlenA (lpString="h?K??U?TI?GX??W?") returned 16 [0097.607] lstrcpynA (in: lpString1=0x4990c0, lpString2="h?K??U?TI?GX??W?", iMaxLength=13 | out: lpString1="h?K??U?TI?GX") returned="h?K??U?TI?GX" [0097.607] lstrlenA (lpString="h?K??U?TI?GX") returned 12 [0097.607] lstrlenA (lpString="B?y?S?Ek?O?l????d?wbmM?R????my?b?O") returned 34 [0097.607] lstrcpynA (in: lpString1=0x4990b0, lpString2="B?y?S?Ek?O?l????d?wbmM?R????my?b?O", iMaxLength=25 | out: lpString1="B?y?S?Ek?O?l????d?wbmM?R") returned="B?y?S?Ek?O?l????d?wbmM?R" [0097.607] lstrlenA (lpString="B?y?S?Ek?O?l????d?wbmM?R") returned 24 [0097.607] lstrlenA (lpString="??yH???b?Y???J??h??????S?????T?IEU?yz???Z??Za?C?U?x???f?p?By?L????YJK??YvLCd??EQv?m") returned 83 [0097.607] lstrcpynA (in: lpString1=0x499080, lpString2="??yH???b?Y???J??h??????S?????T?IEU?yz???Z??Za?C?U?x???f?p?By?L????YJK??YvLCd??EQv?m", iMaxLength=78 | out: lpString1="??yH???b?Y???J??h??????S?????T?IEU?yz???Z??Za?C?U?x???f?p?By?L????YJK??YvLCd?") returned="??yH???b?Y???J??h??????S?????T?IEU?yz???Z??Za?C?U?x???f?p?By?L????YJK??YvLCd?" [0097.607] lstrlenA (lpString="??yH???b?Y???J??h??????S?????T?IEU?yz???Z??Za?C?U?x???f?p?By?L????YJK??YvLCd?") returned 77 [0097.607] lstrlenA (lpString="?zW?MM?pewv???ufZ???zOe???n??z?????bk?G?BPZs????j??sc??RkKC?E???F?H??????p") returned 74 [0097.607] lstrcpynA (in: lpString1=0x499088, lpString2="?zW?MM?pewv???ufZ???zOe???n??z?????bk?G?BPZs????j??sc??RkKC?E???F?H??????p", iMaxLength=10 | out: lpString1="?zW?MM?pe") returned="?zW?MM?pe" [0097.607] lstrlenA (lpString="?zW?MM?pe") returned 9 [0097.607] lstrlenA (lpString="k??B??F?FiR?u??Z?????yOeuO?J?dD?GQW?b?v???GP?T?n?g??aKxd??LN???W??j??tv?F?rw??????C?????ih??") returned 92 [0097.607] lstrcpynA (in: lpString1=0x499074, lpString2="k??B??F?FiR?u??Z?????yOeuO?J?dD?GQW?b?v???GP?T?n?g??aKxd??LN???W??j??tv?F?rw??????C?????ih??", iMaxLength=40 | out: lpString1="k??B??F?FiR?u??Z?????yOeuO?J?dD?GQW?b?v") returned="k??B??F?FiR?u??Z?????yOeuO?J?dD?GQW?b?v" [0097.608] lstrlenA (lpString="k??B??F?FiR?u??Z?????yOeuO?J?dD?GQW?b?v") returned 39 [0097.608] lstrlenA (lpString="?g??h?????IgHzV?v??g???w?z?Bx?G???R?B???t???M????WY???") returned 54 [0097.608] lstrcpynA (in: lpString1=0x49909c, lpString2="?g??h?????IgHzV?v??g???w?z?Bx?G???R?B???t???M????WY???", iMaxLength=51 | out: lpString1="?g??h?????IgHzV?v??g???w?z?Bx?G???R?B???t???M????W") returned="?g??h?????IgHzV?v??g???w?z?Bx?G???R?B???t???M????W" [0097.608] lstrlenA (lpString="?g??h?????IgHzV?v??g???w?z?Bx?G???R?B???t???M????W") returned 50 [0097.608] lstrlenA (lpString="w?bE?vK?x???n??Cad???V???????i?ra???F??H??F???r??B??R?w?B") returned 57 [0097.608] lstrcpynA (in: lpString1=0x499098, lpString2="w?bE?vK?x???n??Cad???V???????i?ra???F??H??F???r??B??R?w?B", iMaxLength=18 | out: lpString1="w?bE?vK?x???n??Ca") returned="w?bE?vK?x???n??Ca" [0097.608] lstrlenA (lpString="w?bE?vK?x???n??Ca") returned 17 [0097.933] lstrlenA (lpString="??gG??H?QoIZ?v?p??????DE??P?iIrU????QVdg???J????x??B???O???f????ye???i?") returned 71 [0097.933] lstrcpynA (in: lpString1=0x49908c, lpString2="??gG??H?QoIZ?v?p??????DE??P?iIrU????QVdg???J????x??B???O???f????ye???i?", iMaxLength=27 | out: lpString1="??gG??H?QoIZ?v?p??????DE??") returned="??gG??H?QoIZ?v?p??????DE??" [0097.933] lstrlenA (lpString="??gG??H?QoIZ?v?p??????DE??") returned 26 [0097.933] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=0, lpMultiByteStr=0x21dd524, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 0 [0097.934] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Ж", cchWideChar=1, lpMultiByteStr=0x4990bc, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="?:ï\x01", lpUsedDefaultChar=0x0) returned 1 [0097.934] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="?", cchWideChar=1, lpMultiByteStr=0x21dd580, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="?", lpUsedDefaultChar=0x0) returned 1 [0097.934] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="П", cchWideChar=1, lpMultiByteStr=0x4990bc, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="?:ï\x01?", lpUsedDefaultChar=0x0) returned 1 [0097.934] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="??", cchWideChar=2, lpMultiByteStr=0x21dd5e0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="??", lpUsedDefaultChar=0x0) returned 2 [0097.934] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Т", cchWideChar=1, lpMultiByteStr=0x4990bc, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="?:ï\x01??", lpUsedDefaultChar=0x0) returned 1 [0097.934] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="???", cchWideChar=3, lpMultiByteStr=0x21dd640, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="???", lpUsedDefaultChar=0x0) returned 3 [0097.934] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="б", cchWideChar=1, lpMultiByteStr=0x4990bc, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="?:ï\x01???", lpUsedDefaultChar=0x0) returned 1 [0097.934] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="????", cchWideChar=4, lpMultiByteStr=0x21dd6a4, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="????", lpUsedDefaultChar=0x0) returned 4 [0097.934] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x4990bc, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="n:ï\x01????", lpUsedDefaultChar=0x0) returned 1 [0097.934] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="????n", cchWideChar=5, lpMultiByteStr=0x21dd70c, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="????n", lpUsedDefaultChar=0x0) returned 5 [0097.934] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="x", cchWideChar=1, lpMultiByteStr=0x4990bc, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x78\x3a\xef\x01\x3f\x3f\x3f\x3f\x6e", lpUsedDefaultChar=0x0) returned 1 [0097.934] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="????nx", cchWideChar=6, lpMultiByteStr=0x21dd778, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="????nx", lpUsedDefaultChar=0x0) returned 6 [0097.934] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="б", cchWideChar=1, lpMultiByteStr=0x4990bc, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x3f\x3a\xef\x01\x3f\x3f\x3f\x3f\x6e\x78", lpUsedDefaultChar=0x0) returned 1 [0097.934] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="????nx?", cchWideChar=7, lpMultiByteStr=0x21dd7e4, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="????nx?", lpUsedDefaultChar=0x0) returned 7 [0097.934] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="и", cchWideChar=1, lpMultiByteStr=0x4990bc, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x3f\x3a\xef\x01\x3f\x3f\x3f\x3f\x6e\x78\x3f", lpUsedDefaultChar=0x0) returned 1 [0097.934] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="????nx??", cchWideChar=8, lpMultiByteStr=0x21dd854, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="????nx??", lpUsedDefaultChar=0x0) returned 8 [0097.934] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ы", cchWideChar=1, lpMultiByteStr=0x4990bc, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x3f\x3a\xef\x01\x3f\x3f\x3f\x3f\x6e\x78\x3f\x3f", lpUsedDefaultChar=0x0) returned 1 [0097.934] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="????nx???", cchWideChar=9, lpMultiByteStr=0x21dd8c8, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="????nx???", lpUsedDefaultChar=0x0) returned 9 [0097.934] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="с", cchWideChar=1, lpMultiByteStr=0x4990bc, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x3f\x3a\xef\x01\x3f\x3f\x3f\x3f\x6e\x78\x3f\x3f\x3f", lpUsedDefaultChar=0x0) returned 1 [0097.934] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="????nx????", cchWideChar=10, lpMultiByteStr=0x21dd940, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="????nx????", lpUsedDefaultChar=0x0) returned 10 [0097.934] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="л", cchWideChar=1, lpMultiByteStr=0x4990bc, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x3f\x3a\xef\x01\x3f\x3f\x3f\x3f\x6e\x78\x3f\x3f\x3f\x3f", lpUsedDefaultChar=0x0) returned 1 [0097.934] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="????nx?????", cchWideChar=11, lpMultiByteStr=0x21dd9b8, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="????nx?????", lpUsedDefaultChar=0x0) returned 11 [0097.934] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="п", cchWideChar=1, lpMultiByteStr=0x4990bc, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x3f\x3a\xef\x01\x3f\x3f\x3f\x3f\x6e\x78\x3f\x3f\x3f\x3f\x3f", lpUsedDefaultChar=0x0) returned 1 [0097.934] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="????nx??????", cchWideChar=12, lpMultiByteStr=0x21dda34, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="????nx??????", lpUsedDefaultChar=0x0) returned 12 [0097.934] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Ь", cchWideChar=1, lpMultiByteStr=0x4990bc, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x3f\x3a\xef\x01\x3f\x3f\x3f\x3f\x6e\x78\x3f\x3f\x3f\x3f\x3f\x3f", lpUsedDefaultChar=0x0) returned 1 [0097.934] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="????nx???????", cchWideChar=13, lpMultiByteStr=0x21ddab4, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="????nx???????", lpUsedDefaultChar=0x0) returned 13 [0097.935] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="и", cchWideChar=1, lpMultiByteStr=0x4990bc, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x3f\x3a\xef\x01\x3f\x3f\x3f\x3f\x6e\x78\x3f\x3f\x3f\x3f\x3f\x3f\x3f", lpUsedDefaultChar=0x0) returned 1 [0097.935] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="????nx????????", cchWideChar=14, lpMultiByteStr=0x21ddb38, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="????nx????????", lpUsedDefaultChar=0x0) returned 14 [0097.935] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="K", cchWideChar=1, lpMultiByteStr=0x4990bc, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x4b\x3a\xef\x01\x3f\x3f\x3f\x3f\x6e\x78\x3f\x3f\x3f\x3f\x3f\x3f\x3f\x3f", lpUsedDefaultChar=0x0) returned 1 [0097.935] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="????nx????????K", cchWideChar=15, lpMultiByteStr=0x21ddbbc, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="????nx????????K", lpUsedDefaultChar=0x0) returned 15 [0097.935] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="k", cchWideChar=1, lpMultiByteStr=0x4990bc, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x6b\x3a\xef\x01\x3f\x3f\x3f\x3f\x6e\x78\x3f\x3f\x3f\x3f\x3f\x3f\x3f\x3f\x4b", lpUsedDefaultChar=0x0) returned 1 [0097.935] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="????nx????????Kk", cchWideChar=16, lpMultiByteStr=0x21ddc48, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="????nx????????Kk", lpUsedDefaultChar=0x0) returned 16 [0097.935] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="G", cchWideChar=1, lpMultiByteStr=0x4990b8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x47\x3a\xef\x01\x3f\x3f\x3f\x3f\x6e\x78\x3f\x3f\x3f\x3f\x3f\x3f\x3f\x3f\x4b\x6b", lpUsedDefaultChar=0x0) returned 1 [0097.935] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="????nx????????KkG", cchWideChar=17, lpMultiByteStr=0x21ddcd8, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="????nx????????KkG", lpUsedDefaultChar=0x0) returned 17 [0097.935] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="У", cchWideChar=1, lpMultiByteStr=0x4990b8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x3f\x3a\xef\x01\x3f\x3f\x3f\x3f\x6e\x78\x3f\x3f\x3f\x3f\x3f\x3f\x3f\x3f\x4b\x6b\x47", lpUsedDefaultChar=0x0) returned 1 [0097.935] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="????nx????????KkG?", cchWideChar=18, lpMultiByteStr=0x21ddd70, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="????nx????????KkG?", lpUsedDefaultChar=0x0) returned 18 [0097.935] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Б", cchWideChar=1, lpMultiByteStr=0x4990b8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x3f\x3a\xef\x01\x3f\x3f\x3f\x3f\x6e\x78\x3f\x3f\x3f\x3f\x3f\x3f\x3f\x3f\x4b\x6b\x47\x3f", lpUsedDefaultChar=0x0) returned 1 [0097.935] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="????nx????????KkG??", cchWideChar=19, lpMultiByteStr=0x21dde08, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="????nx????????KkG??", lpUsedDefaultChar=0x0) returned 19 [0097.935] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="с", cchWideChar=1, lpMultiByteStr=0x4990b8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x3f\x3a\xef\x01\x3f\x3f\x3f\x3f\x6e\x78\x3f\x3f\x3f\x3f\x3f\x3f\x3f\x3f\x4b\x6b\x47\x3f\x3f", lpUsedDefaultChar=0x0) returned 1 [0097.935] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="????nx????????KkG???", cchWideChar=20, lpMultiByteStr=0x21ddea8, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="????nx????????KkG???", lpUsedDefaultChar=0x0) returned 20 [0097.935] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="c", cchWideChar=1, lpMultiByteStr=0x4990b4, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x63\x3a\xef\x01\x3f\x3f\x3f\x3f\x6e\x78\x3f\x3f\x3f\x3f\x3f\x3f\x3f\x3f\x4b\x6b\x47\x3f\x3f\x3f", lpUsedDefaultChar=0x0) returned 1 [0097.935] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="????nx????????KkG???c", cchWideChar=21, lpMultiByteStr=0x21ddf4c, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="????nx????????KkG???c", lpUsedDefaultChar=0x0) returned 21 [0097.935] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x4990b4, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x65\x3a\xef\x01\x3f\x3f\x3f\x3f\x6e\x78\x3f\x3f\x3f\x3f\x3f\x3f\x3f\x3f\x4b\x6b\x47\x3f\x3f\x3f\x63", lpUsedDefaultChar=0x0) returned 1 [0097.935] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="????nx????????KkG???ce", cchWideChar=22, lpMultiByteStr=0x21ddff8, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="????nx????????KkG???ce", lpUsedDefaultChar=0x0) returned 22 [0097.935] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Г", cchWideChar=1, lpMultiByteStr=0x4990b4, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x3f\x3a\xef\x01\x3f\x3f\x3f\x3f\x6e\x78\x3f\x3f\x3f\x3f\x3f\x3f\x3f\x3f\x4b\x6b\x47\x3f\x3f\x3f\x63\x65", lpUsedDefaultChar=0x0) returned 1 [0097.935] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="????nx????????KkG???ce?", cchWideChar=23, lpMultiByteStr=0x21de0a4, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="????nx????????KkG???ce?", lpUsedDefaultChar=0x0) returned 23 [0097.935] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="S", cchWideChar=1, lpMultiByteStr=0x4990b4, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x53\x3a\xef\x01\x3f\x3f\x3f\x3f\x6e\x78\x3f\x3f\x3f\x3f\x3f\x3f\x3f\x3f\x4b\x6b\x47\x3f\x3f\x3f\x63\x65\x3f", lpUsedDefaultChar=0x0) returned 1 [0097.935] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="????nx????????KkG???ce?S", cchWideChar=24, lpMultiByteStr=0x4990e0, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="????nx????????KkG???ce?Sô>ï\x01Ë\x87]ð\x94Â\x89t@ÏI", lpUsedDefaultChar=0x0) returned 24 [0097.935] lstrlenA (lpString="????nx????????KkG???ce?S") returned 24 [0097.935] lstrcpynA (in: lpString1=0x4990b8, lpString2="????nx????????KkG???ce?S", iMaxLength=12 | out: lpString1="????nx?????") returned="????nx?????" [0097.935] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="????nx?????", cchWideChar=11, lpMultiByteStr=0x4990ec, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="????nx?????", lpUsedDefaultChar=0x0) returned 11 [0097.935] lstrlenA (lpString="????nx?????") returned 11 [0097.936] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=0, lpMultiByteStr=0x21de46c, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 0 [0097.936] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x4990bc, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="g:ï\x01", lpUsedDefaultChar=0x0) returned 1 [0097.936] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="g", cchWideChar=1, lpMultiByteStr=0x21de4c8, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="g", lpUsedDefaultChar=0x0) returned 1 [0097.936] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="с", cchWideChar=1, lpMultiByteStr=0x4990bc, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="?:ï\x01g", lpUsedDefaultChar=0x0) returned 1 [0097.936] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="g?", cchWideChar=2, lpMultiByteStr=0x21de528, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="g?", lpUsedDefaultChar=0x0) returned 2 [0097.936] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="R", cchWideChar=1, lpMultiByteStr=0x4990bc, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="R:ï\x01g?", lpUsedDefaultChar=0x0) returned 1 [0097.936] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="g?R", cchWideChar=3, lpMultiByteStr=0x21de588, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="g?R", lpUsedDefaultChar=0x0) returned 3 [0097.936] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="х", cchWideChar=1, lpMultiByteStr=0x4990bc, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="?:ï\x01g?R", lpUsedDefaultChar=0x0) returned 1 [0097.936] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="g?R?", cchWideChar=4, lpMultiByteStr=0x21de5ec, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="g?R?", lpUsedDefaultChar=0x0) returned 4 [0097.936] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Б", cchWideChar=1, lpMultiByteStr=0x4990bc, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="?:ï\x01g?R?", lpUsedDefaultChar=0x0) returned 1 [0097.936] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="g?R??", cchWideChar=5, lpMultiByteStr=0x21de654, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="g?R??", lpUsedDefaultChar=0x0) returned 5 [0097.936] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="м", cchWideChar=1, lpMultiByteStr=0x4990bc, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x3f\x3a\xef\x01\x67\x3f\x52\x3f\x3f", lpUsedDefaultChar=0x0) returned 1 [0097.936] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="g?R???", cchWideChar=6, lpMultiByteStr=0x21de6c0, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="g?R???", lpUsedDefaultChar=0x0) returned 6 [0097.936] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x4990bc, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x69\x3a\xef\x01\x67\x3f\x52\x3f\x3f\x3f", lpUsedDefaultChar=0x0) returned 1 [0097.936] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="g?R???i", cchWideChar=7, lpMultiByteStr=0x21de72c, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="g?R???i", lpUsedDefaultChar=0x0) returned 7 [0097.936] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="B", cchWideChar=1, lpMultiByteStr=0x4990bc, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x42\x3a\xef\x01\x67\x3f\x52\x3f\x3f\x3f\x69", lpUsedDefaultChar=0x0) returned 1 [0097.936] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="g?R???iB", cchWideChar=8, lpMultiByteStr=0x4990f0, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="g?R???iBô>ï\x01Ë\x87]ð\x94Â\x89t@ÏI", lpUsedDefaultChar=0x0) returned 8 [0097.936] lstrlenA (lpString="g?R???iB") returned 8 [0097.936] lstrcpynA (in: lpString1=0x4990c4, lpString2="g?R???iB", iMaxLength=5 | out: lpString1="g?R?") returned="g?R?" [0097.936] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="g?R?", cchWideChar=4, lpMultiByteStr=0x4990f4, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x67\x3f\x52\x3f\xf4\x3e\xef\x01\xcb\x87\x5d\xf0\x94\xc2\x89\x74\x40\xcf\x49", lpUsedDefaultChar=0x0) returned 4 [0097.936] lstrlenA (lpString="g?R?") returned 4 [0097.936] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=0, lpMultiByteStr=0x21de940, cbMultiByte=1, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="", lpUsedDefaultChar=0x0) returned 0 [0097.936] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="У", cchWideChar=1, lpMultiByteStr=0x4990bc, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="?:ï\x01", lpUsedDefaultChar=0x0) returned 1 [0097.936] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="?", cchWideChar=1, lpMultiByteStr=0x21de99c, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="?", lpUsedDefaultChar=0x0) returned 1 [0097.936] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Х", cchWideChar=1, lpMultiByteStr=0x4990bc, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="?:ï\x01?", lpUsedDefaultChar=0x0) returned 1 [0097.936] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="??", cchWideChar=2, lpMultiByteStr=0x21de9fc, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="??", lpUsedDefaultChar=0x0) returned 2 [0097.937] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="O", cchWideChar=1, lpMultiByteStr=0x4990bc, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="O:ï\x01??", lpUsedDefaultChar=0x0) returned 1 [0097.937] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="??O", cchWideChar=3, lpMultiByteStr=0x21dea5c, cbMultiByte=4, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="??O", lpUsedDefaultChar=0x0) returned 3 [0097.937] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="U", cchWideChar=1, lpMultiByteStr=0x4990bc, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="U:ï\x01??O", lpUsedDefaultChar=0x0) returned 1 [0097.937] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="??OU", cchWideChar=4, lpMultiByteStr=0x21deac0, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="??OU", lpUsedDefaultChar=0x0) returned 4 [0097.937] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="M", cchWideChar=1, lpMultiByteStr=0x4990bc, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="M:ï\x01??OU", lpUsedDefaultChar=0x0) returned 1 [0097.937] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="??OUM", cchWideChar=5, lpMultiByteStr=0x21deb28, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="??OUM", lpUsedDefaultChar=0x0) returned 5 [0097.937] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="M", cchWideChar=1, lpMultiByteStr=0x4990bc, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x4d\x3a\xef\x01\x3f\x3f\x4f\x55\x4d", lpUsedDefaultChar=0x0) returned 1 [0097.937] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="??OUMM", cchWideChar=6, lpMultiByteStr=0x21deb94, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="??OUMM", lpUsedDefaultChar=0x0) returned 6 [0097.937] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ш", cchWideChar=1, lpMultiByteStr=0x4990bc, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x3f\x3a\xef\x01\x3f\x3f\x4f\x55\x4d\x4d", lpUsedDefaultChar=0x0) returned 1 [0097.937] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="??OUMM?", cchWideChar=7, lpMultiByteStr=0x21dec00, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="??OUMM?", lpUsedDefaultChar=0x0) returned 7 [0097.937] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="A", cchWideChar=1, lpMultiByteStr=0x4990bc, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x41\x3a\xef\x01\x3f\x3f\x4f\x55\x4d\x4d\x3f", lpUsedDefaultChar=0x0) returned 1 [0097.937] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="??OUMM?A", cchWideChar=8, lpMultiByteStr=0x21dec70, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="??OUMM?A", lpUsedDefaultChar=0x0) returned 8 [0097.937] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="k", cchWideChar=1, lpMultiByteStr=0x4990bc, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x6b\x3a\xef\x01\x3f\x3f\x4f\x55\x4d\x4d\x3f\x41", lpUsedDefaultChar=0x0) returned 1 [0097.937] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="??OUMM?Ak", cchWideChar=9, lpMultiByteStr=0x21dece4, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="??OUMM?Ak", lpUsedDefaultChar=0x0) returned 9 [0097.937] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Ж", cchWideChar=1, lpMultiByteStr=0x4990bc, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x3f\x3a\xef\x01\x3f\x3f\x4f\x55\x4d\x4d\x3f\x41\x6b", lpUsedDefaultChar=0x0) returned 1 [0097.937] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="??OUMM?Ak?", cchWideChar=10, lpMultiByteStr=0x21ded5c, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="??OUMM?Ak?", lpUsedDefaultChar=0x0) returned 10 [0097.937] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ш", cchWideChar=1, lpMultiByteStr=0x4990bc, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x3f\x3a\xef\x01\x3f\x3f\x4f\x55\x4d\x4d\x3f\x41\x6b\x3f", lpUsedDefaultChar=0x0) returned 1 [0097.937] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="??OUMM?Ak??", cchWideChar=11, lpMultiByteStr=0x21dedd4, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="??OUMM?Ak??", lpUsedDefaultChar=0x0) returned 11 [0097.937] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="х", cchWideChar=1, lpMultiByteStr=0x4990bc, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x3f\x3a\xef\x01\x3f\x3f\x4f\x55\x4d\x4d\x3f\x41\x6b\x3f\x3f", lpUsedDefaultChar=0x0) returned 1 [0097.937] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="??OUMM?Ak???", cchWideChar=12, lpMultiByteStr=0x21dee50, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="??OUMM?Ak???", lpUsedDefaultChar=0x0) returned 12 [0097.937] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="З", cchWideChar=1, lpMultiByteStr=0x4990bc, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x3f\x3a\xef\x01\x3f\x3f\x4f\x55\x4d\x4d\x3f\x41\x6b\x3f\x3f\x3f", lpUsedDefaultChar=0x0) returned 1 [0097.937] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="??OUMM?Ak????", cchWideChar=13, lpMultiByteStr=0x21deed0, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="??OUMM?Ak????", lpUsedDefaultChar=0x0) returned 13 [0097.937] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="y", cchWideChar=1, lpMultiByteStr=0x4990bc, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x79\x3a\xef\x01\x3f\x3f\x4f\x55\x4d\x4d\x3f\x41\x6b\x3f\x3f\x3f\x3f", lpUsedDefaultChar=0x0) returned 1 [0097.937] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="??OUMM?Ak????y", cchWideChar=14, lpMultiByteStr=0x21def54, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="??OUMM?Ak????y", lpUsedDefaultChar=0x0) returned 14 [0097.937] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="i", cchWideChar=1, lpMultiByteStr=0x4990bc, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x69\x3a\xef\x01\x3f\x3f\x4f\x55\x4d\x4d\x3f\x41\x6b\x3f\x3f\x3f\x3f\x79", lpUsedDefaultChar=0x0) returned 1 [0097.938] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="??OUMM?Ak????yi", cchWideChar=15, lpMultiByteStr=0x21defd8, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="??OUMM?Ak????yi", lpUsedDefaultChar=0x0) returned 15 [0097.938] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Л", cchWideChar=1, lpMultiByteStr=0x4990bc, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x3f\x3a\xef\x01\x3f\x3f\x4f\x55\x4d\x4d\x3f\x41\x6b\x3f\x3f\x3f\x3f\x79\x69", lpUsedDefaultChar=0x0) returned 1 [0097.938] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="??OUMM?Ak????yi?", cchWideChar=16, lpMultiByteStr=0x21df064, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="??OUMM?Ak????yi?", lpUsedDefaultChar=0x0) returned 16 [0097.938] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="s", cchWideChar=1, lpMultiByteStr=0x4990b8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x73\x3a\xef\x01\x3f\x3f\x4f\x55\x4d\x4d\x3f\x41\x6b\x3f\x3f\x3f\x3f\x79\x69\x3f", lpUsedDefaultChar=0x0) returned 1 [0097.938] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="??OUMM?Ak????yi?s", cchWideChar=17, lpMultiByteStr=0x21df0f4, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="??OUMM?Ak????yi?s", lpUsedDefaultChar=0x0) returned 17 [0097.938] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="я", cchWideChar=1, lpMultiByteStr=0x4990b8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x3f\x3a\xef\x01\x3f\x3f\x4f\x55\x4d\x4d\x3f\x41\x6b\x3f\x3f\x3f\x3f\x79\x69\x3f\x73", lpUsedDefaultChar=0x0) returned 1 [0097.938] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="??OUMM?Ak????yi?s?", cchWideChar=18, lpMultiByteStr=0x21df18c, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="??OUMM?Ak????yi?s?", lpUsedDefaultChar=0x0) returned 18 [0097.938] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="v", cchWideChar=1, lpMultiByteStr=0x4990b8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x76\x3a\xef\x01\x3f\x3f\x4f\x55\x4d\x4d\x3f\x41\x6b\x3f\x3f\x3f\x3f\x79\x69\x3f\x73\x3f", lpUsedDefaultChar=0x0) returned 1 [0097.938] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="??OUMM?Ak????yi?s?v", cchWideChar=19, lpMultiByteStr=0x21df224, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="??OUMM?Ak????yi?s?v", lpUsedDefaultChar=0x0) returned 19 [0097.938] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="E", cchWideChar=1, lpMultiByteStr=0x4990b8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x45\x3a\xef\x01\x3f\x3f\x4f\x55\x4d\x4d\x3f\x41\x6b\x3f\x3f\x3f\x3f\x79\x69\x3f\x73\x3f\x76", lpUsedDefaultChar=0x0) returned 1 [0097.938] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="??OUMM?Ak????yi?s?vE", cchWideChar=20, lpMultiByteStr=0x21df2c4, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="??OUMM?Ak????yi?s?vE", lpUsedDefaultChar=0x0) returned 20 [0097.938] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="в", cchWideChar=1, lpMultiByteStr=0x4990b4, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x3f\x3a\xef\x01\x3f\x3f\x4f\x55\x4d\x4d\x3f\x41\x6b\x3f\x3f\x3f\x3f\x79\x69\x3f\x73\x3f\x76\x45", lpUsedDefaultChar=0x0) returned 1 [0097.938] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="??OUMM?Ak????yi?s?vE?", cchWideChar=21, lpMultiByteStr=0x21df368, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="??OUMM?Ak????yi?s?vE?", lpUsedDefaultChar=0x0) returned 21 [0097.938] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ъ", cchWideChar=1, lpMultiByteStr=0x4990b4, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x3f\x3a\xef\x01\x3f\x3f\x4f\x55\x4d\x4d\x3f\x41\x6b\x3f\x3f\x3f\x3f\x79\x69\x3f\x73\x3f\x76\x45\x3f", lpUsedDefaultChar=0x0) returned 1 [0097.938] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="??OUMM?Ak????yi?s?vE??", cchWideChar=22, lpMultiByteStr=0x21df414, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="??OUMM?Ak????yi?s?vE??", lpUsedDefaultChar=0x0) returned 22 [0097.938] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="а", cchWideChar=1, lpMultiByteStr=0x4990b4, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x3f\x3a\xef\x01\x3f\x3f\x4f\x55\x4d\x4d\x3f\x41\x6b\x3f\x3f\x3f\x3f\x79\x69\x3f\x73\x3f\x76\x45\x3f\x3f", lpUsedDefaultChar=0x0) returned 1 [0097.938] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="??OUMM?Ak????yi?s?vE???", cchWideChar=23, lpMultiByteStr=0x21df4c0, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="??OUMM?Ak????yi?s?vE???", lpUsedDefaultChar=0x0) returned 23 [0097.938] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Р", cchWideChar=1, lpMultiByteStr=0x4990b4, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x3f\x3a\xef\x01\x3f\x3f\x4f\x55\x4d\x4d\x3f\x41\x6b\x3f\x3f\x3f\x3f\x79\x69\x3f\x73\x3f\x76\x45\x3f\x3f\x3f", lpUsedDefaultChar=0x0) returned 1 [0097.938] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="??OUMM?Ak????yi?s?vE????", cchWideChar=24, lpMultiByteStr=0x21df574, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="??OUMM?Ak????yi?s?vE????", lpUsedDefaultChar=0x0) returned 24 [0097.938] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="V", cchWideChar=1, lpMultiByteStr=0x4990b0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x56\x3a\xef\x01\x3f\x3f\x4f\x55\x4d\x4d\x3f\x41\x6b\x3f\x3f\x3f\x3f\x79\x69\x3f\x73\x3f\x76\x45\x3f\x3f\x3f\x3f", lpUsedDefaultChar=0x0) returned 1 [0097.938] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="??OUMM?Ak????yi?s?vE????V", cchWideChar=25, lpMultiByteStr=0x21df62c, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="??OUMM?Ak????yi?s?vE????V", lpUsedDefaultChar=0x0) returned 25 [0097.938] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Т", cchWideChar=1, lpMultiByteStr=0x4990b0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x3f\x3a\xef\x01\x3f\x3f\x4f\x55\x4d\x4d\x3f\x41\x6b\x3f\x3f\x3f\x3f\x79\x69\x3f\x73\x3f\x76\x45\x3f\x3f\x3f\x3f\x56", lpUsedDefaultChar=0x0) returned 1 [0097.938] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="??OUMM?Ak????yi?s?vE????V?", cchWideChar=26, lpMultiByteStr=0x21df6ec, cbMultiByte=27, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="??OUMM?Ak????yi?s?vE????V?", lpUsedDefaultChar=0x0) returned 26 [0097.938] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="р", cchWideChar=1, lpMultiByteStr=0x4990b0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x3f\x3a\xef\x01\x3f\x3f\x4f\x55\x4d\x4d\x3f\x41\x6b\x3f\x3f\x3f\x3f\x79\x69\x3f\x73\x3f\x76\x45\x3f\x3f\x3f\x3f\x56\x3f", lpUsedDefaultChar=0x0) returned 1 [0097.938] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="??OUMM?Ak????yi?s?vE????V??", cchWideChar=27, lpMultiByteStr=0x21df7ac, cbMultiByte=28, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="??OUMM?Ak????yi?s?vE????V??", lpUsedDefaultChar=0x0) returned 27 [0097.938] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="A", cchWideChar=1, lpMultiByteStr=0x4990b0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x41\x3a\xef\x01\x3f\x3f\x4f\x55\x4d\x4d\x3f\x41\x6b\x3f\x3f\x3f\x3f\x79\x69\x3f\x73\x3f\x76\x45\x3f\x3f\x3f\x3f\x56\x3f\x3f", lpUsedDefaultChar=0x0) returned 1 [0097.939] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="??OUMM?Ak????yi?s?vE????V??A", cchWideChar=28, lpMultiByteStr=0x21df874, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="??OUMM?Ak????yi?s?vE????V??A", lpUsedDefaultChar=0x0) returned 28 [0097.939] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="х", cchWideChar=1, lpMultiByteStr=0x4990ac, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x3f\x3a\xef\x01\x3f\x3f\x4f\x55\x4d\x4d\x3f\x41\x6b\x3f\x3f\x3f\x3f\x79\x69\x3f\x73\x3f\x76\x45\x3f\x3f\x3f\x3f\x56\x3f\x3f\x41", lpUsedDefaultChar=0x0) returned 1 [0097.939] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="??OUMM?Ak????yi?s?vE????V??A?", cchWideChar=29, lpMultiByteStr=0x21df940, cbMultiByte=30, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="??OUMM?Ak????yi?s?vE????V??A?", lpUsedDefaultChar=0x0) returned 29 [0097.939] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="С", cchWideChar=1, lpMultiByteStr=0x4990ac, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x3f\x3a\xef\x01\x3f\x3f\x4f\x55\x4d\x4d\x3f\x41\x6b\x3f\x3f\x3f\x3f\x79\x69\x3f\x73\x3f\x76\x45\x3f\x3f\x3f\x3f\x56\x3f\x3f\x41\x3f", lpUsedDefaultChar=0x0) returned 1 [0097.939] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="??OUMM?Ak????yi?s?vE????V??A??", cchWideChar=30, lpMultiByteStr=0x21dfa14, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="??OUMM?Ak????yi?s?vE????V??A??", lpUsedDefaultChar=0x0) returned 30 [0097.939] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="е", cchWideChar=1, lpMultiByteStr=0x4990ac, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x3f\x3a\xef\x01\x3f\x3f\x4f\x55\x4d\x4d\x3f\x41\x6b\x3f\x3f\x3f\x3f\x79\x69\x3f\x73\x3f\x76\x45\x3f\x3f\x3f\x3f\x56\x3f\x3f\x41\x3f\x3f", lpUsedDefaultChar=0x0) returned 1 [0097.939] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="??OUMM?Ak????yi?s?vE????V??A???", cchWideChar=31, lpMultiByteStr=0x21dfae8, cbMultiByte=32, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="??OUMM?Ak????yi?s?vE????V??A???", lpUsedDefaultChar=0x0) returned 31 [0097.939] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="v", cchWideChar=1, lpMultiByteStr=0x4990ac, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x76\x3a\xef\x01\x3f\x3f\x4f\x55\x4d\x4d\x3f\x41\x6b\x3f\x3f\x3f\x3f\x79\x69\x3f\x73\x3f\x76\x45\x3f\x3f\x3f\x3f\x56\x3f\x3f\x41\x3f\x3f\x3f", lpUsedDefaultChar=0x0) returned 1 [0097.939] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="??OUMM?Ak????yi?s?vE????V??A???v", cchWideChar=32, lpMultiByteStr=0x21dfbc4, cbMultiByte=33, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="??OUMM?Ak????yi?s?vE????V??A???v", lpUsedDefaultChar=0x0) returned 32 [0097.939] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="O", cchWideChar=1, lpMultiByteStr=0x4990a8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x4f\x3a\xef\x01\x3f\x3f\x4f\x55\x4d\x4d\x3f\x41\x6b\x3f\x3f\x3f\x3f\x79\x69\x3f\x73\x3f\x76\x45\x3f\x3f\x3f\x3f\x56\x3f\x3f\x41\x3f\x3f\x3f\x76", lpUsedDefaultChar=0x0) returned 1 [0097.939] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="??OUMM?Ak????yi?s?vE????V??A???vO", cchWideChar=33, lpMultiByteStr=0x21dfca4, cbMultiByte=34, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="??OUMM?Ak????yi?s?vE????V??A???vO", lpUsedDefaultChar=0x0) returned 33 [0097.939] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="u", cchWideChar=1, lpMultiByteStr=0x4990a8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x75\x3a\xef\x01\x3f\x3f\x4f\x55\x4d\x4d\x3f\x41\x6b\x3f\x3f\x3f\x3f\x79\x69\x3f\x73\x3f\x76\x45\x3f\x3f\x3f\x3f\x56\x3f\x3f\x41\x3f\x3f\x3f\x76\x4f", lpUsedDefaultChar=0x0) returned 1 [0097.939] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="??OUMM?Ak????yi?s?vE????V??A???vOu", cchWideChar=34, lpMultiByteStr=0x21dfd8c, cbMultiByte=35, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="??OUMM?Ak????yi?s?vE????V??A???vOu", lpUsedDefaultChar=0x0) returned 34 [0097.939] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Э", cchWideChar=1, lpMultiByteStr=0x4990a8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x3f\x3a\xef\x01\x3f\x3f\x4f\x55\x4d\x4d\x3f\x41\x6b\x3f\x3f\x3f\x3f\x79\x69\x3f\x73\x3f\x76\x45\x3f\x3f\x3f\x3f\x56\x3f\x3f\x41\x3f\x3f\x3f\x76\x4f\x75", lpUsedDefaultChar=0x0) returned 1 [0097.939] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="??OUMM?Ak????yi?s?vE????V??A???vOu?", cchWideChar=35, lpMultiByteStr=0x21dfe74, cbMultiByte=36, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="??OUMM?Ak????yi?s?vE????V??A???vOu?", lpUsedDefaultChar=0x0) returned 35 [0097.939] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="J", cchWideChar=1, lpMultiByteStr=0x4990a8, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x4a\x3a\xef\x01\x3f\x3f\x4f\x55\x4d\x4d\x3f\x41\x6b\x3f\x3f\x3f\x3f\x79\x69\x3f\x73\x3f\x76\x45\x3f\x3f\x3f\x3f\x56\x3f\x3f\x41\x3f\x3f\x3f\x76\x4f\x75\x3f", lpUsedDefaultChar=0x0) returned 1 [0097.939] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="??OUMM?Ak????yi?s?vE????V??A???vOu?J", cchWideChar=36, lpMultiByteStr=0x21dff64, cbMultiByte=37, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="??OUMM?Ak????yi?s?vE????V??A???vOu?J", lpUsedDefaultChar=0x0) returned 36 [0097.939] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Й", cchWideChar=1, lpMultiByteStr=0x4990a4, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x3f\x3a\xef\x01\x3f\x3f\x4f\x55\x4d\x4d\x3f\x41\x6b\x3f\x3f\x3f\x3f\x79\x69\x3f\x73\x3f\x76\x45\x3f\x3f\x3f\x3f\x56\x3f\x3f\x41\x3f\x3f\x3f\x76\x4f\x75\x3f\x4a", lpUsedDefaultChar=0x0) returned 1 [0097.939] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="??OUMM?Ak????yi?s?vE????V??A???vOu?J?", cchWideChar=37, lpMultiByteStr=0x21e0058, cbMultiByte=38, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="??OUMM?Ak????yi?s?vE????V??A???vOu?J?", lpUsedDefaultChar=0x0) returned 37 [0097.939] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="г", cchWideChar=1, lpMultiByteStr=0x4990a4, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x3f\x3a\xef\x01\x3f\x3f\x4f\x55\x4d\x4d\x3f\x41\x6b\x3f\x3f\x3f\x3f\x79\x69\x3f\x73\x3f\x76\x45\x3f\x3f\x3f\x3f\x56\x3f\x3f\x41\x3f\x3f\x3f\x76\x4f\x75\x3f\x4a\x3f", lpUsedDefaultChar=0x0) returned 1 [0097.939] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="??OUMM?Ak????yi?s?vE????V??A???vOu?J??", cchWideChar=38, lpMultiByteStr=0x21e0154, cbMultiByte=39, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="??OUMM?Ak????yi?s?vE????V??A???vOu?J??", lpUsedDefaultChar=0x0) returned 38 [0097.939] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="О", cchWideChar=1, lpMultiByteStr=0x4990a4, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x3f\x3a\xef\x01\x3f\x3f\x4f\x55\x4d\x4d\x3f\x41\x6b\x3f\x3f\x3f\x3f\x79\x69\x3f\x73\x3f\x76\x45\x3f\x3f\x3f\x3f\x56\x3f\x3f\x41\x3f\x3f\x3f\x76\x4f\x75\x3f\x4a\x3f\x3f", lpUsedDefaultChar=0x0) returned 1 [0097.939] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="??OUMM?Ak????yi?s?vE????V??A???vOu?J???", cchWideChar=39, lpMultiByteStr=0x21e0250, cbMultiByte=40, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="??OUMM?Ak????yi?s?vE????V??A???vOu?J???", lpUsedDefaultChar=0x0) returned 39 [0097.939] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="a", cchWideChar=1, lpMultiByteStr=0x4990a4, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x61\x3a\xef\x01\x3f\x3f\x4f\x55\x4d\x4d\x3f\x41\x6b\x3f\x3f\x3f\x3f\x79\x69\x3f\x73\x3f\x76\x45\x3f\x3f\x3f\x3f\x56\x3f\x3f\x41\x3f\x3f\x3f\x76\x4f\x75\x3f\x4a\x3f\x3f\x3f", lpUsedDefaultChar=0x0) returned 1 [0097.940] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="??OUMM?Ak????yi?s?vE????V??A???vOu?J???a", cchWideChar=40, lpMultiByteStr=0x21e0354, cbMultiByte=41, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="??OUMM?Ak????yi?s?vE????V??A???vOu?J???a", lpUsedDefaultChar=0x0) returned 40 [0097.940] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ц", cchWideChar=1, lpMultiByteStr=0x4990a0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x3f\x3a\xef\x01\x3f\x3f\x4f\x55\x4d\x4d\x3f\x41\x6b\x3f\x3f\x3f\x3f\x79\x69\x3f\x73\x3f\x76\x45\x3f\x3f\x3f\x3f\x56\x3f\x3f\x41\x3f\x3f\x3f\x76\x4f\x75\x3f\x4a\x3f\x3f\x3f\x61", lpUsedDefaultChar=0x0) returned 1 [0097.940] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="??OUMM?Ak????yi?s?vE????V??A???vOu?J???a?", cchWideChar=41, lpMultiByteStr=0x21e045c, cbMultiByte=42, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="??OUMM?Ak????yi?s?vE????V??A???vOu?J???a?", lpUsedDefaultChar=0x0) returned 41 [0097.940] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="P", cchWideChar=1, lpMultiByteStr=0x4990a0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x50\x3a\xef\x01\x3f\x3f\x4f\x55\x4d\x4d\x3f\x41\x6b\x3f\x3f\x3f\x3f\x79\x69\x3f\x73\x3f\x76\x45\x3f\x3f\x3f\x3f\x56\x3f\x3f\x41\x3f\x3f\x3f\x76\x4f\x75\x3f\x4a\x3f\x3f\x3f\x61\x3f", lpUsedDefaultChar=0x0) returned 1 [0097.940] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="??OUMM?Ak????yi?s?vE????V??A???vOu?J???a?P", cchWideChar=42, lpMultiByteStr=0x21e056c, cbMultiByte=43, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="??OUMM?Ak????yi?s?vE????V??A???vOu?J???a?P", lpUsedDefaultChar=0x0) returned 42 [0097.940] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Я", cchWideChar=1, lpMultiByteStr=0x4990a0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x3f\x3a\xef\x01\x3f\x3f\x4f\x55\x4d\x4d\x3f\x41\x6b\x3f\x3f\x3f\x3f\x79\x69\x3f\x73\x3f\x76\x45\x3f\x3f\x3f\x3f\x56\x3f\x3f\x41\x3f\x3f\x3f\x76\x4f\x75\x3f\x4a\x3f\x3f\x3f\x61\x3f\x50", lpUsedDefaultChar=0x0) returned 1 [0097.940] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="??OUMM?Ak????yi?s?vE????V??A???vOu?J???a?P?", cchWideChar=43, lpMultiByteStr=0x21e067c, cbMultiByte=44, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="??OUMM?Ak????yi?s?vE????V??A???vOu?J???a?P?", lpUsedDefaultChar=0x0) returned 43 [0097.940] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="m", cchWideChar=1, lpMultiByteStr=0x4990a0, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x6d\x3a\xef\x01\x3f\x3f\x4f\x55\x4d\x4d\x3f\x41\x6b\x3f\x3f\x3f\x3f\x79\x69\x3f\x73\x3f\x76\x45\x3f\x3f\x3f\x3f\x56\x3f\x3f\x41\x3f\x3f\x3f\x76\x4f\x75\x3f\x4a\x3f\x3f\x3f\x61\x3f\x50\x3f", lpUsedDefaultChar=0x0) returned 1 [0097.940] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="??OUMM?Ak????yi?s?vE????V??A???vOu?J???a?P?m", cchWideChar=44, lpMultiByteStr=0x21e0794, cbMultiByte=45, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="??OUMM?Ak????yi?s?vE????V??A???vOu?J???a?P?m", lpUsedDefaultChar=0x0) returned 44 [0097.940] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="z", cchWideChar=1, lpMultiByteStr=0x49909c, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x7a\x3a\xef\x01\x3f\x3f\x4f\x55\x4d\x4d\x3f\x41\x6b\x3f\x3f\x3f\x3f\x79\x69\x3f\x73\x3f\x76\x45\x3f\x3f\x3f\x3f\x56\x3f\x3f\x41\x3f\x3f\x3f\x76\x4f\x75\x3f\x4a\x3f\x3f\x3f\x61\x3f\x50\x3f\x6d", lpUsedDefaultChar=0x0) returned 1 [0097.940] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="??OUMM?Ak????yi?s?vE????V??A???vOu?J???a?P?mz", cchWideChar=45, lpMultiByteStr=0x21e08b0, cbMultiByte=46, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="??OUMM?Ak????yi?s?vE????V??A???vOu?J???a?P?mz", lpUsedDefaultChar=0x0) returned 45 [0097.940] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ж", cchWideChar=1, lpMultiByteStr=0x49909c, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x3f\x3a\xef\x01\x3f\x3f\x4f\x55\x4d\x4d\x3f\x41\x6b\x3f\x3f\x3f\x3f\x79\x69\x3f\x73\x3f\x76\x45\x3f\x3f\x3f\x3f\x56\x3f\x3f\x41\x3f\x3f\x3f\x76\x4f\x75\x3f\x4a\x3f\x3f\x3f\x61\x3f\x50\x3f\x6d\x7a", lpUsedDefaultChar=0x0) returned 1 [0097.940] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="??OUMM?Ak????yi?s?vE????V??A???vOu?J???a?P?mz?", cchWideChar=46, lpMultiByteStr=0x21e09d4, cbMultiByte=47, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="??OUMM?Ak????yi?s?vE????V??A???vOu?J???a?P?mz?", lpUsedDefaultChar=0x0) returned 46 [0097.940] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Ф", cchWideChar=1, lpMultiByteStr=0x49909c, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x3f\x3a\xef\x01\x3f\x3f\x4f\x55\x4d\x4d\x3f\x41\x6b\x3f\x3f\x3f\x3f\x79\x69\x3f\x73\x3f\x76\x45\x3f\x3f\x3f\x3f\x56\x3f\x3f\x41\x3f\x3f\x3f\x76\x4f\x75\x3f\x4a\x3f\x3f\x3f\x61\x3f\x50\x3f\x6d\x7a\x3f", lpUsedDefaultChar=0x0) returned 1 [0097.940] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="??OUMM?Ak????yi?s?vE????V??A???vOu?J???a?P?mz??", cchWideChar=47, lpMultiByteStr=0x21e0af8, cbMultiByte=48, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="??OUMM?Ak????yi?s?vE????V??A???vOu?J???a?P?mz??", lpUsedDefaultChar=0x0) returned 47 [0097.940] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="С", cchWideChar=1, lpMultiByteStr=0x49909c, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x3f\x3a\xef\x01\x3f\x3f\x4f\x55\x4d\x4d\x3f\x41\x6b\x3f\x3f\x3f\x3f\x79\x69\x3f\x73\x3f\x76\x45\x3f\x3f\x3f\x3f\x56\x3f\x3f\x41\x3f\x3f\x3f\x76\x4f\x75\x3f\x4a\x3f\x3f\x3f\x61\x3f\x50\x3f\x6d\x7a\x3f\x3f", lpUsedDefaultChar=0x0) returned 1 [0097.940] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="??OUMM?Ak????yi?s?vE????V??A???vOu?J???a?P?mz???", cchWideChar=48, lpMultiByteStr=0x21e0c24, cbMultiByte=49, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="??OUMM?Ak????yi?s?vE????V??A???vOu?J???a?P?mz???", lpUsedDefaultChar=0x0) returned 48 [0097.940] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ж", cchWideChar=1, lpMultiByteStr=0x499098, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x3f\x3a\xef\x01\x3f\x3f\x4f\x55\x4d\x4d\x3f\x41\x6b\x3f\x3f\x3f\x3f\x79\x69\x3f\x73\x3f\x76\x45\x3f\x3f\x3f\x3f\x56\x3f\x3f\x41\x3f\x3f\x3f\x76\x4f\x75\x3f\x4a\x3f\x3f\x3f\x61\x3f\x50\x3f\x6d\x7a\x3f\x3f\x3f", lpUsedDefaultChar=0x0) returned 1 [0097.940] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="??OUMM?Ak????yi?s?vE????V??A???vOu?J???a?P?mz????", cchWideChar=49, lpMultiByteStr=0x21e0d54, cbMultiByte=50, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="??OUMM?Ak????yi?s?vE????V??A???vOu?J???a?P?mz????", lpUsedDefaultChar=0x0) returned 49 [0097.940] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="z", cchWideChar=1, lpMultiByteStr=0x499098, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x7a\x3a\xef\x01\x3f\x3f\x4f\x55\x4d\x4d\x3f\x41\x6b\x3f\x3f\x3f\x3f\x79\x69\x3f\x73\x3f\x76\x45\x3f\x3f\x3f\x3f\x56\x3f\x3f\x41\x3f\x3f\x3f\x76\x4f\x75\x3f\x4a\x3f\x3f\x3f\x61\x3f\x50\x3f\x6d\x7a\x3f\x3f\x3f\x3f", lpUsedDefaultChar=0x0) returned 1 [0097.940] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="??OUMM?Ak????yi?s?vE????V??A???vOu?J???a?P?mz????z", cchWideChar=50, lpMultiByteStr=0x21e0e8c, cbMultiByte=51, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="??OUMM?Ak????yi?s?vE????V??A???vOu?J???a?P?mz????z", lpUsedDefaultChar=0x0) returned 50 [0097.940] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="D", cchWideChar=1, lpMultiByteStr=0x499098, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x44\x3a\xef\x01\x3f\x3f\x4f\x55\x4d\x4d\x3f\x41\x6b\x3f\x3f\x3f\x3f\x79\x69\x3f\x73\x3f\x76\x45\x3f\x3f\x3f\x3f\x56\x3f\x3f\x41\x3f\x3f\x3f\x76\x4f\x75\x3f\x4a\x3f\x3f\x3f\x61\x3f\x50\x3f\x6d\x7a\x3f\x3f\x3f\x3f\x7a", lpUsedDefaultChar=0x0) returned 1 [0097.941] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="??OUMM?Ak????yi?s?vE????V??A???vOu?J???a?P?mz????zD", cchWideChar=51, lpMultiByteStr=0x21e0fc4, cbMultiByte=52, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="??OUMM?Ak????yi?s?vE????V??A???vOu?J???a?P?mz????zD", lpUsedDefaultChar=0x0) returned 51 [0097.941] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="e", cchWideChar=1, lpMultiByteStr=0x499098, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x65\x3a\xef\x01\x3f\x3f\x4f\x55\x4d\x4d\x3f\x41\x6b\x3f\x3f\x3f\x3f\x79\x69\x3f\x73\x3f\x76\x45\x3f\x3f\x3f\x3f\x56\x3f\x3f\x41\x3f\x3f\x3f\x76\x4f\x75\x3f\x4a\x3f\x3f\x3f\x61\x3f\x50\x3f\x6d\x7a\x3f\x3f\x3f\x3f\x7a\x44", lpUsedDefaultChar=0x0) returned 1 [0097.941] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="??OUMM?Ak????yi?s?vE????V??A???vOu?J???a?P?mz????zDe", cchWideChar=52, lpMultiByteStr=0x21e1104, cbMultiByte=53, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="??OUMM?Ak????yi?s?vE????V??A???vOu?J???a?P?mz????zDe", lpUsedDefaultChar=0x0) returned 52 [0097.941] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Ь", cchWideChar=1, lpMultiByteStr=0x499094, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x3f\x3a\xef\x01\x3f\x3f\x4f\x55\x4d\x4d\x3f\x41\x6b\x3f\x3f\x3f\x3f\x79\x69\x3f\x73\x3f\x76\x45\x3f\x3f\x3f\x3f\x56\x3f\x3f\x41\x3f\x3f\x3f\x76\x4f\x75\x3f\x4a\x3f\x3f\x3f\x61\x3f\x50\x3f\x6d\x7a\x3f\x3f\x3f\x3f\x7a\x44\x65", lpUsedDefaultChar=0x0) returned 1 [0097.941] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="??OUMM?Ak????yi?s?vE????V??A???vOu?J???a?P?mz????zDe?", cchWideChar=53, lpMultiByteStr=0x21e1248, cbMultiByte=54, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="??OUMM?Ak????yi?s?vE????V??A???vOu?J???a?P?mz????zDe?", lpUsedDefaultChar=0x0) returned 53 [0097.941] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Q", cchWideChar=1, lpMultiByteStr=0x499094, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x51\x3a\xef\x01\x3f\x3f\x4f\x55\x4d\x4d\x3f\x41\x6b\x3f\x3f\x3f\x3f\x79\x69\x3f\x73\x3f\x76\x45\x3f\x3f\x3f\x3f\x56\x3f\x3f\x41\x3f\x3f\x3f\x76\x4f\x75\x3f\x4a\x3f\x3f\x3f\x61\x3f\x50\x3f\x6d\x7a\x3f\x3f\x3f\x3f\x7a\x44\x65\x3f", lpUsedDefaultChar=0x0) returned 1 [0097.941] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="??OUMM?Ak????yi?s?vE????V??A???vOu?J???a?P?mz????zDe?Q", cchWideChar=54, lpMultiByteStr=0x21e1394, cbMultiByte=55, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="??OUMM?Ak????yi?s?vE????V??A???vOu?J???a?P?mz????zDe?Q", lpUsedDefaultChar=0x0) returned 54 [0097.941] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Z", cchWideChar=1, lpMultiByteStr=0x499094, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x5a\x3a\xef\x01\x3f\x3f\x4f\x55\x4d\x4d\x3f\x41\x6b\x3f\x3f\x3f\x3f\x79\x69\x3f\x73\x3f\x76\x45\x3f\x3f\x3f\x3f\x56\x3f\x3f\x41\x3f\x3f\x3f\x76\x4f\x75\x3f\x4a\x3f\x3f\x3f\x61\x3f\x50\x3f\x6d\x7a\x3f\x3f\x3f\x3f\x7a\x44\x65\x3f\x51", lpUsedDefaultChar=0x0) returned 1 [0097.941] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="??OUMM?Ak????yi?s?vE????V??A???vOu?J???a?P?mz????zDe?QZ", cchWideChar=55, lpMultiByteStr=0x21e14e0, cbMultiByte=56, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="??OUMM?Ak????yi?s?vE????V??A???vOu?J???a?P?mz????zDe?QZ", lpUsedDefaultChar=0x0) returned 55 [0097.941] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="f", cchWideChar=1, lpMultiByteStr=0x499094, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x66\x3a\xef\x01\x3f\x3f\x4f\x55\x4d\x4d\x3f\x41\x6b\x3f\x3f\x3f\x3f\x79\x69\x3f\x73\x3f\x76\x45\x3f\x3f\x3f\x3f\x56\x3f\x3f\x41\x3f\x3f\x3f\x76\x4f\x75\x3f\x4a\x3f\x3f\x3f\x61\x3f\x50\x3f\x6d\x7a\x3f\x3f\x3f\x3f\x7a\x44\x65\x3f\x51\x5a", lpUsedDefaultChar=0x0) returned 1 [0097.941] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="??OUMM?Ak????yi?s?vE????V??A???vOu?J???a?P?mz????zDe?QZf", cchWideChar=56, lpMultiByteStr=0x21e1634, cbMultiByte=57, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="??OUMM?Ak????yi?s?vE????V??A???vOu?J???a?P?mz????zDe?QZf", lpUsedDefaultChar=0x0) returned 56 [0097.941] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="T", cchWideChar=1, lpMultiByteStr=0x499090, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x54\x3a\xef\x01\x3f\x3f\x4f\x55\x4d\x4d\x3f\x41\x6b\x3f\x3f\x3f\x3f\x79\x69\x3f\x73\x3f\x76\x45\x3f\x3f\x3f\x3f\x56\x3f\x3f\x41\x3f\x3f\x3f\x76\x4f\x75\x3f\x4a\x3f\x3f\x3f\x61\x3f\x50\x3f\x6d\x7a\x3f\x3f\x3f\x3f\x7a\x44\x65\x3f\x51\x5a\x66", lpUsedDefaultChar=0x0) returned 1 [0097.941] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="??OUMM?Ak????yi?s?vE????V??A???vOu?J???a?P?mz????zDe?QZfT", cchWideChar=57, lpMultiByteStr=0x21e178c, cbMultiByte=58, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="??OUMM?Ak????yi?s?vE????V??A???vOu?J???a?P?mz????zDe?QZfT", lpUsedDefaultChar=0x0) returned 57 [0097.941] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="V", cchWideChar=1, lpMultiByteStr=0x499090, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x56\x3a\xef\x01\x3f\x3f\x4f\x55\x4d\x4d\x3f\x41\x6b\x3f\x3f\x3f\x3f\x79\x69\x3f\x73\x3f\x76\x45\x3f\x3f\x3f\x3f\x56\x3f\x3f\x41\x3f\x3f\x3f\x76\x4f\x75\x3f\x4a\x3f\x3f\x3f\x61\x3f\x50\x3f\x6d\x7a\x3f\x3f\x3f\x3f\x7a\x44\x65\x3f\x51\x5a\x66\x54", lpUsedDefaultChar=0x0) returned 1 [0097.941] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="??OUMM?Ak????yi?s?vE????V??A???vOu?J???a?P?mz????zDe?QZfTV", cchWideChar=58, lpMultiByteStr=0x21e18ec, cbMultiByte=59, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="??OUMM?Ak????yi?s?vE????V??A???vOu?J???a?P?mz????zDe?QZfTV", lpUsedDefaultChar=0x0) returned 58 [0097.941] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="А", cchWideChar=1, lpMultiByteStr=0x499090, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x3f\x3a\xef\x01\x3f\x3f\x4f\x55\x4d\x4d\x3f\x41\x6b\x3f\x3f\x3f\x3f\x79\x69\x3f\x73\x3f\x76\x45\x3f\x3f\x3f\x3f\x56\x3f\x3f\x41\x3f\x3f\x3f\x76\x4f\x75\x3f\x4a\x3f\x3f\x3f\x61\x3f\x50\x3f\x6d\x7a\x3f\x3f\x3f\x3f\x7a\x44\x65\x3f\x51\x5a\x66\x54\x56", lpUsedDefaultChar=0x0) returned 1 [0097.941] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="??OUMM?Ak????yi?s?vE????V??A???vOu?J???a?P?mz????zDe?QZfTV?", cchWideChar=59, lpMultiByteStr=0x21e1a4c, cbMultiByte=60, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="??OUMM?Ak????yi?s?vE????V??A???vOu?J???a?P?mz????zDe?QZfTV?", lpUsedDefaultChar=0x0) returned 59 [0097.941] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="к", cchWideChar=1, lpMultiByteStr=0x499090, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x3f\x3a\xef\x01\x3f\x3f\x4f\x55\x4d\x4d\x3f\x41\x6b\x3f\x3f\x3f\x3f\x79\x69\x3f\x73\x3f\x76\x45\x3f\x3f\x3f\x3f\x56\x3f\x3f\x41\x3f\x3f\x3f\x76\x4f\x75\x3f\x4a\x3f\x3f\x3f\x61\x3f\x50\x3f\x6d\x7a\x3f\x3f\x3f\x3f\x7a\x44\x65\x3f\x51\x5a\x66\x54\x56\x3f", lpUsedDefaultChar=0x0) returned 1 [0097.941] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="??OUMM?Ak????yi?s?vE????V??A???vOu?J???a?P?mz????zDe?QZfTV??", cchWideChar=60, lpMultiByteStr=0x21e1bb4, cbMultiByte=61, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="??OUMM?Ak????yi?s?vE????V??A???vOu?J???a?P?mz????zDe?QZfTV??", lpUsedDefaultChar=0x0) returned 60 [0097.941] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="П", cchWideChar=1, lpMultiByteStr=0x49908c, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x3f\x3a\xef\x01\x3f\x3f\x4f\x55\x4d\x4d\x3f\x41\x6b\x3f\x3f\x3f\x3f\x79\x69\x3f\x73\x3f\x76\x45\x3f\x3f\x3f\x3f\x56\x3f\x3f\x41\x3f\x3f\x3f\x76\x4f\x75\x3f\x4a\x3f\x3f\x3f\x61\x3f\x50\x3f\x6d\x7a\x3f\x3f\x3f\x3f\x7a\x44\x65\x3f\x51\x5a\x66\x54\x56\x3f\x3f", lpUsedDefaultChar=0x0) returned 1 [0097.941] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="??OUMM?Ak????yi?s?vE????V??A???vOu?J???a?P?mz????zDe?QZfTV???", cchWideChar=61, lpMultiByteStr=0x21e1d20, cbMultiByte=62, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="??OUMM?Ak????yi?s?vE????V??A???vOu?J???a?P?mz????zDe?QZfTV???", lpUsedDefaultChar=0x0) returned 61 [0097.941] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="n", cchWideChar=1, lpMultiByteStr=0x49908c, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x6e\x3a\xef\x01\x3f\x3f\x4f\x55\x4d\x4d\x3f\x41\x6b\x3f\x3f\x3f\x3f\x79\x69\x3f\x73\x3f\x76\x45\x3f\x3f\x3f\x3f\x56\x3f\x3f\x41\x3f\x3f\x3f\x76\x4f\x75\x3f\x4a\x3f\x3f\x3f\x61\x3f\x50\x3f\x6d\x7a\x3f\x3f\x3f\x3f\x7a\x44\x65\x3f\x51\x5a\x66\x54\x56\x3f\x3f\x3f", lpUsedDefaultChar=0x0) returned 1 [0097.941] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="??OUMM?Ak????yi?s?vE????V??A???vOu?J???a?P?mz????zDe?QZfTV???n", cchWideChar=62, lpMultiByteStr=0x21e1e94, cbMultiByte=63, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="??OUMM?Ak????yi?s?vE????V??A???vOu?J???a?P?mz????zDe?QZfTV???n", lpUsedDefaultChar=0x0) returned 62 [0097.942] lstrlenA (lpString="??OUMM?Ak????yi?s?vE????V??A???vOu?J???a?P?mz????zDe?QZfTV???n?nBDG?h?x??f?R?H??j?????no??fA?C") returned 94 [0097.943] lstrcpynA (in: lpString1=0x499074, lpString2="??OUMM?Ak????yi?s?vE????V??A???vOu?J???a?P?mz????zDe?QZfTV???n?nBDG?h?x??f?R?H??j?????no??fA?C", iMaxLength=21 | out: lpString1="??OUMM?Ak????yi?s?vE") returned="??OUMM?Ak????yi?s?vE" [0097.943] lstrlenA (lpString="??OUMM?Ak????yi?s?vE") returned 20 [0097.945] lstrlenA (lpString="??Yp????R?MkX??uGW?m??gIdS???J???????o????mG??Vn??o??Ck?????Sg?????VF??U") returned 72 [0097.945] lstrcpynA (in: lpString1=0x499088, lpString2="??Yp????R?MkX??uGW?m??gIdS???J???????o????mG??Vn??o??Ck?????Sg?????VF??U", iMaxLength=30 | out: lpString1="??Yp????R?MkX??uGW?m??gIdS???") returned="??Yp????R?MkX??uGW?m??gIdS???" [0097.945] lstrlenA (lpString="??Yp????R?MkX??uGW?m??gIdS???") returned 29 [0097.946] lstrlenA (lpString="?????ZTGP??W??z?sP?JaFJ?ww??a??w?Md?FL?????phI????vgUL?CV?????T?F??C?Q") returned 70 [0097.946] lstrcpynA (in: lpString1=0x49908c, lpString2="?????ZTGP??W??z?sP?JaFJ?ww??a??w?Md?FL?????phI????vgUL?CV?????T?F??C?Q", iMaxLength=16 | out: lpString1="?????ZTGP??W??z") returned="?????ZTGP??W??z" [0097.946] lstrlenA (lpString="?????ZTGP??W??z") returned 15 [0097.946] lstrlenA (lpString="???O??MThh???O???X??CXba?G?z?M??B????gG??YFj??uU?????") returned 53 [0097.946] lstrcpynA (in: lpString1=0x49909c, lpString2="???O??MThh???O???X??CXba?G?z?M??B????gG??YFj??uU?????", iMaxLength=52 | out: lpString1="???O??MThh???O???X??CXba?G?z?M??B????gG??YFj??uU???") returned="???O??MThh???O???X??CXba?G?z?M??B????gG??YFj??uU???" [0097.946] lstrlenA (lpString="???O??MThh???O???X??CXba?G?z?M??B????gG??YFj??uU???") returned 51 [0097.946] lstrlenA (lpString="??TeIU?Zhr?V?rVi?Ejiox?OM?y???M???w?s?v????") returned 43 [0097.946] lstrcpynA (in: lpString1=0x4990a8, lpString2="??TeIU?Zhr?V?rVi?Ejiox?OM?y???M???w?s?v????", iMaxLength=37 | out: lpString1="??TeIU?Zhr?V?rVi?Ejiox?OM?y???M???w?") returned="??TeIU?Zhr?V?rVi?Ejiox?OM?y???M???w?" [0097.946] lstrlenA (lpString="??TeIU?Zhr?V?rVi?Ejiox?OM?y???M???w?") returned 36 [0097.946] lstrlenA (lpString="?U????uJ?????W????Z?Rr??pikCDZ?W??h?z????n??hI???ImU?Q??B?????yd????d?Ae???u?") returned 77 [0097.946] lstrcpynA (in: lpString1=0x499084, lpString2="?U????uJ?????W????Z?Rr??pikCDZ?W??h?z????n??hI???ImU?Q??B?????yd????d?Ae???u?", iMaxLength=75 | out: lpString1="?U????uJ?????W????Z?Rr??pikCDZ?W??h?z????n??hI???ImU?Q??B?????yd????d?Ae??") returned="?U????uJ?????W????Z?Rr??pikCDZ?W??h?z????n??hI???ImU?Q??B?????yd????d?Ae??" [0097.946] lstrlenA (lpString="?U????uJ?????W????Z?Rr??pikCDZ?W??h?z????n??hI???ImU?Q??B?????yd????d?Ae??") returned 74 [0097.946] lstrlenA (lpString="Z?uc??KTWiK???szVxXP??T?bK?A?X??jg?????x???X?L????s???y?Mp") returned 58 [0097.946] lstrcpynA (in: lpString1=0x499098, lpString2="Z?uc??KTWiK???szVxXP??T?bK?A?X??jg?????x???X?L????s???y?Mp", iMaxLength=56 | out: lpString1="Z?uc??KTWiK???szVxXP??T?bK?A?X??jg?????x???X?L????s???y") returned="Z?uc??KTWiK???szVxXP??T?bK?A?X??jg?????x???X?L????s???y" [0097.946] lstrlenA (lpString="Z?uc??KTWiK???szVxXP??T?bK?A?X??jg?????x???X?L????s???y") returned 55 [0097.946] lstrlenA (lpString="???V??") returned 6 [0097.947] lstrcpynA (in: lpString1=0x4990c4, lpString2="???V??", iMaxLength=2 | out: lpString1="?") returned="?" [0097.947] lstrlenA (lpString="?") returned 1 [0097.947] lstrlenA (lpString="vQ????t?????A???p????????t???y?????W?x??yz???x???") returned 49 [0097.947] lstrcpynA (in: lpString1=0x4990a0, lpString2="vQ????t?????A???p????????t???y?????W?x??yz???x???", iMaxLength=42 | out: lpString1="vQ????t?????A???p????????t???y?????W?x??y") returned="vQ????t?????A???p????????t???y?????W?x??y" [0097.947] lstrlenA (lpString="vQ????t?????A???p????????t???y?????W?x??y") returned 41 [0097.947] lstrlenA (lpString="E???g??p??BW???rY????????e????rWdr?yi??vx??m???I???w???H???fRYY?") returned 64 [0097.947] lstrcpynA (in: lpString1=0x499090, lpString2="E???g??p??BW???rY????????e????rWdr?yi??vx??m???I???w???H???fRYY?", iMaxLength=59 | out: lpString1="E???g??p??BW???rY????????e????rWdr?yi??vx??m???I???w???H??") returned="E???g??p??BW???rY????????e????rWdr?yi??vx??m???I???w???H??" [0097.947] lstrlenA (lpString="E???g??p??BW???rY????????e????rWdr?yi??vx??m???I???w???H??") returned 58 [0097.947] lstrlenA (lpString="C???x??MH?REOM???eFDAhYm????E?OOZ??l???ckU?m?????X?????IC?b???n?Y??Z???ixlcyhu???") returned 81 [0097.947] lstrcpynA (in: lpString1=0x499080, lpString2="C???x??MH?REOM???eFDAhYm????E?OOZ??l???ckU?m?????X?????IC?b???n?Y??Z???ixlcyhu???", iMaxLength=11 | out: lpString1="C???x??MH?") returned="C???x??MH?" [0097.947] lstrlenA (lpString="C???x??MH?") returned 10 [0097.947] lstrlenA (lpString="LM?X??E?ECBpU???NRp??????lHjJ??BJu??Y????H?????f??D?WS?????MZfGX?w?") returned 67 [0097.947] lstrcpynA (in: lpString1=0x499090, lpString2="LM?X??E?ECBpU???NRp??????lHjJ??BJu??Y????H?????f??D?WS?????MZfGX?w?", iMaxLength=15 | out: lpString1="LM?X??E?ECBpU?") returned="LM?X??E?ECBpU?" [0097.947] lstrlenA (lpString="LM?X??E?ECBpU?") returned 14 [0097.947] lstrlenA (lpString="NIP??????PRlX??vuUE?So?Z?w???Y?u?J???NQ??pMjj????????KIK??H?") returned 60 [0097.947] lstrcpynA (in: lpString1=0x499094, lpString2="NIP??????PRlX??vuUE?So?Z?w???Y?u?J???NQ??pMjj????????KIK??H?", iMaxLength=17 | out: lpString1="NIP??????PRlX??v") returned="NIP??????PRlX??v" [0097.947] lstrlenA (lpString="NIP??????PRlX??v") returned 16 [0097.947] lstrlenA (lpString="?nAt?cT?iC?R?XT?i?r???W") returned 23 [0097.947] lstrcpynA (in: lpString1=0x4990bc, lpString2="?nAt?cT?iC?R?XT?i?r???W", iMaxLength=11 | out: lpString1="?nAt?cT?iC") returned="?nAt?cT?iC" [0097.947] lstrlenA (lpString="?nAt?cT?iC") returned 10 [0097.947] lstrlenA (lpString="ra????n????E??t?CCy?H?????b?????gFE?L?fAB?S?hNQL???pu??KAv????????g?S???P?DBG?Jv??yb") returned 84 [0097.947] lstrcpynA (in: lpString1=0x49907c, lpString2="ra????n????E??t?CCy?H?????b?????gFE?L?fAB?S?hNQL???pu??KAv????????g?S???P?DBG?Jv??yb", iMaxLength=12 | out: lpString1="ra????n????") returned="ra????n????" [0097.948] lstrlenA (lpString="ra????n????") returned 11 [0097.948] lstrlenA (lpString="??Wb?v???GglA?oaIY?S?or???Q??Y?ip??") returned 35 [0097.948] lstrcpynA (in: lpString1=0x4990b0, lpString2="??Wb?v???GglA?oaIY?S?or???Q??Y?ip??", iMaxLength=16 | out: lpString1="??Wb?v???GglA?o") returned="??Wb?v???GglA?o" [0097.948] lstrlenA (lpString="??Wb?v???GglA?o") returned 15 [0097.948] lstrlenA (lpString="fc????m????????????Lz??Pb?op?z?????j?gt???Iv?H?p???????k?c???kD?h") returned 65 [0097.948] lstrcpynA (in: lpString1=0x499090, lpString2="fc????m????????????Lz??Pb?op?z?????j?gt???Iv?H?p???????k?c???kD?h", iMaxLength=9 | out: lpString1="fc????m?") returned="fc????m?" [0097.948] lstrlenA (lpString="fc????m?") returned 8 [0097.948] lstrlenA (lpString="??????I?N??????FtSrj???J?h???o?X") returned 32 [0097.948] lstrcpynA (in: lpString1=0x4990b0, lpString2="??????I?N??????FtSrj???J?h???o?X", iMaxLength=22 | out: lpString1="??????I?N??????FtSrj?") returned="??????I?N??????FtSrj?" [0097.948] lstrlenA (lpString="??????I?N??????FtSrj?") returned 21 [0097.948] lstrlenA (lpString="l??xn?j???????d??h??lPY?A?vJY??R??cT???pMS?????i?????z??????Y?b?rC??Y?rab?N???LX?hX??SOX?D?h") returned 92 [0097.948] lstrcpynA (in: lpString1=0x499074, lpString2="l??xn?j???????d??h??lPY?A?vJY??R??cT???pMS?????i?????z??????Y?b?rC??Y?rab?N???LX?hX??SOX?D?h", iMaxLength=91 | out: lpString1="l??xn?j???????d??h??lPY?A?vJY??R??cT???pMS?????i?????z??????Y?b?rC??Y?rab?N???LX?hX??SOX?D") returned="l??xn?j???????d??h??lPY?A?vJY??R??cT???pMS?????i?????z??????Y?b?rC??Y?rab?N???LX?hX??SOX?D" [0097.948] lstrlenA (lpString="l??xn?j???????d??h??lPY?A?vJY??R??cT???pMS?????i?????z??????Y?b?rC??Y?rab?N???LX?hX??SOX?D") returned 90 [0097.948] lstrlenA (lpString="hr?p?t?h?ZKW??e?O??kK???g???d?a??????A??FUw??i?uA?????P????Ak?r?P?S") returned 67 [0097.948] lstrcpynA (in: lpString1=0x499090, lpString2="hr?p?t?h?ZKW??e?O??kK???g???d?a??????A??FUw??i?uA?????P????Ak?r?P?S", iMaxLength=64 | out: lpString1="hr?p?t?h?ZKW??e?O??kK???g???d?a??????A??FUw??i?uA?????P????Ak?r") returned="hr?p?t?h?ZKW??e?O??kK???g???d?a??????A??FUw??i?uA?????P????Ak?r" [0097.948] lstrlenA (lpString="hr?p?t?h?ZKW??e?O??kK???g???d?a??????A??FUw??i?uA?????P????Ak?r") returned 63 [0097.948] lstrlenA (lpString="????d???o???Ri??T?lTpHx??RUAA???f?????n??l?LAm????o?a????vD?P??DWt?Abr?XTx????HY?????b?xfE") returned 90 [0097.948] lstrcpynA (in: lpString1=0x499078, lpString2="????d???o???Ri??T?lTpHx??RUAA???f?????n??l?LAm????o?a????vD?P??DWt?Abr?XTx????HY?????b?xfE", iMaxLength=65 | out: lpString1="????d???o???Ri??T?lTpHx??RUAA???f?????n??l?LAm????o?a????vD?P??D") returned="????d???o???Ri??T?lTpHx??RUAA???f?????n??l?LAm????o?a????vD?P??D" [0097.948] lstrlenA (lpString="????d???o???Ri??T?lTpHx??RUAA???f?????n??l?LAm????o?a????vD?P??D") returned 64 [0097.948] lstrlenA (lpString="?b??kU??????T?V?zr?iK????yAHb?Oh???F") returned 36 [0097.948] lstrcpynA (in: lpString1=0x4990ac, lpString2="?b??kU??????T?V?zr?iK????yAHb?Oh???F", iMaxLength=8 | out: lpString1="?b??kU?") returned="?b??kU?" [0097.948] lstrlenA (lpString="?b??kU?") returned 7 [0097.949] lstrlenA (lpString="?wf??w??") returned 8 [0097.949] lstrcpynA (in: lpString1=0x4990c4, lpString2="?wf??w??", iMaxLength=6 | out: lpString1="?wf??") returned="?wf??" [0097.949] lstrlenA (lpString="?wf??") returned 5 [0097.949] lstrlenA (lpString="????E??f?FU?N??HBa?YL??K?sp?d??w??zX??sX??gW??Nhn?Z???Dm??Zk?Yw??Y???V") returned 70 [0097.949] lstrcpynA (in: lpString1=0x49908c, lpString2="????E??f?FU?N??HBa?YL??K?sp?d??w??zX??sX??gW??Nhn?Z???Dm??Zk?Yw??Y???V", iMaxLength=31 | out: lpString1="????E??f?FU?N??HBa?YL??K?sp?d?") returned="????E??f?FU?N??HBa?YL??K?sp?d?" [0097.949] lstrlenA (lpString="????E??f?FU?N??HBa?YL??K?sp?d?") returned 30 [0097.949] lstrlenA (lpString="I??T?e????f??oY?CAg???????????") returned 30 [0097.949] lstrcpynA (in: lpString1=0x4990b4, lpString2="I??T?e????f??oY?CAg???????????", iMaxLength=5 | out: lpString1="I??T") returned="I??T" [0097.949] lstrlenA (lpString="I??T") returned 4 [0097.949] lstrlenA (lpString="?????L????H?????wj?y?") returned 21 [0097.949] lstrcpynA (in: lpString1=0x4990bc, lpString2="?????L????H?????wj?y?", iMaxLength=12 | out: lpString1="?????L????H") returned="?????L????H" [0097.949] lstrlenA (lpString="?????L????H") returned 11 [0097.949] lstrlenA (lpString="xppF?K?EO??L?F????yA??Jru?e????c???AV?xg???y?vD?i???U?p??iI?J????????NiG???h") returned 76 [0097.949] lstrcpynA (in: lpString1=0x499084, lpString2="xppF?K?EO??L?F????yA??Jru?e????c???AV?xg???y?vD?i???U?p??iI?J????????NiG???h", iMaxLength=19 | out: lpString1="xppF?K?EO??L?F????") returned="xppF?K?EO??L?F????" [0097.949] lstrlenA (lpString="xppF?K?EO??L?F????") returned 18 [0097.949] lstrlenA (lpString="?m?p?D???F?JbS?????nX?U????Ha?QC?BXlG?yW???v??kVl?l??e?????nC???gv????B??R???a??H?bT??") returned 86 [0097.949] lstrcpynA (in: lpString1=0x49907c, lpString2="?m?p?D???F?JbS?????nX?U????Ha?QC?BXlG?yW???v??kVl?l??e?????nC???gv????B??R???a??H?bT??", iMaxLength=49 | out: lpString1="?m?p?D???F?JbS?????nX?U????Ha?QC?BXlG?yW???v??kV") returned="?m?p?D???F?JbS?????nX?U????Ha?QC?BXlG?yW???v??kV" [0097.949] lstrlenA (lpString="?m?p?D???F?JbS?????nX?U????Ha?QC?BXlG?yW???v??kV") returned 48 [0097.949] lstrlenA (lpString="mH???ky?p?xK??V?????t?n???H?kV???LCp??VK??ej??e??s??Sr?") returned 55 [0097.949] lstrcpynA (in: lpString1=0x49909c, lpString2="mH???ky?p?xK??V?????t?n???H?kV???LCp??VK??ej??e??s??Sr?", iMaxLength=20 | out: lpString1="mH???ky?p?xK??V????") returned="mH???ky?p?xK??V????" [0097.949] lstrlenA (lpString="mH???ky?p?xK??V????") returned 19 [0097.949] lstrlenA (lpString="?????t??gkFEexk?a?po????i??Z??y?Q???tWHdvB??????c?N?ochys??sXa?TdCex??V????M?vQn??mQN??y?M?A?T?f??C") returned 99 [0097.950] lstrcpynA (in: lpString1=0x499070, lpString2="?????t??gkFEexk?a?po????i??Z??y?Q???tWHdvB??????c?N?ochys??sXa?TdCex??V????M?vQn??mQN??y?M?A?T?f??C", iMaxLength=10 | out: lpString1="?????t??g") returned="?????t??g" [0097.950] lstrlenA (lpString="?????t??g") returned 9 [0097.950] lstrlenA (lpString="?z?tdP?u???K??") returned 14 [0097.950] lstrcpynA (in: lpString1=0x4990c4, lpString2="?z?tdP?u???K??", iMaxLength=7 | out: lpString1="?z?tdP") returned="?z?tdP" [0097.950] lstrlenA (lpString="?z?tdP") returned 6 [0097.950] lstrlenA (lpString="??EadUWY??J?hJi??o????yX??g?jWh????W??iP?????hLsS?U??a?") returned 55 [0097.950] lstrcpynA (in: lpString1=0x49909c, lpString2="??EadUWY??J?hJi??o????yX??g?jWh????W??iP?????hLsS?U??a?", iMaxLength=13 | out: lpString1="??EadUWY??J?") returned="??EadUWY??J?" [0097.950] lstrlenA (lpString="??EadUWY??J?") returned 12 [0097.950] lstrlenA (lpString="OzGj????????pw???mj?MMt?E???????ue?k???Rjc???dn?VZ?") returned 51 [0097.950] lstrcpynA (in: lpString1=0x4990a0, lpString2="OzGj????????pw???mj?MMt?E???????ue?k???Rjc???dn?VZ?", iMaxLength=1 | out: lpString1="") returned="" [0097.950] lstrlenA (lpString="") returned 0 [0097.950] lstrlenA (lpString="?h???w?n") returned 8 [0097.950] lstrcpynA (in: lpString1=0x4990c4, lpString2="?h???w?n", iMaxLength=6 | out: lpString1="?h???") returned="?h???" [0097.950] lstrlenA (lpString="?h???") returned 5 [0097.950] lstrlenA (lpString="oWVREW??Y?Mak?cBJ??????e??CEN?e??JkEwk??Z??W?????I??T??gSC?M??jI??????BQD?") returned 74 [0097.950] lstrcpynA (in: lpString1=0x499088, lpString2="oWVREW??Y?Mak?cBJ??????e??CEN?e??JkEwk??Z??W?????I??T??gSC?M??jI??????BQD?", iMaxLength=12 | out: lpString1="oWVREW??Y?M") returned="oWVREW??Y?M" [0097.950] lstrlenA (lpString="oWVREW??Y?M") returned 11 [0097.950] lstrlenA (lpString="S?i?Vkjl?e?r???x??N???p?b????BP???a?LEW?k?E?R?r??l?B??oF?sX?I??u?urI") returned 68 [0097.950] lstrcpynA (in: lpString1=0x49908c, lpString2="S?i?Vkjl?e?r???x??N???p?b????BP???a?LEW?k?E?R?r??l?B??oF?sX?I??u?urI", iMaxLength=35 | out: lpString1="S?i?Vkjl?e?r???x??N???p?b????BP???") returned="S?i?Vkjl?e?r???x??N???p?b????BP???" [0097.950] lstrlenA (lpString="S?i?Vkjl?e?r???x??N???p?b????BP???") returned 34 [0097.950] lstrlenA (lpString="?MZz?????y?Z???X???O?????b?b??A?Kk??m??ML??E?m??????K?????A???eh?GrV?fc?") returned 72 [0097.950] lstrcpynA (in: lpString1=0x499088, lpString2="?MZz?????y?Z???X???O?????b?b??A?Kk??m??ML??E?m??????K?????A???eh?GrV?fc?", iMaxLength=11 | out: lpString1="?MZz?????y") returned="?MZz?????y" [0097.950] lstrlenA (lpString="?MZz?????y") returned 10 [0097.951] lstrlenA (lpString="i?s??") returned 5 [0097.951] lstrcpynA (in: lpString1=0x4990c4, lpString2="i?s??", iMaxLength=1 | out: lpString1="") returned="" [0097.951] lstrlenA (lpString="") returned 0 [0097.951] lstrlenA (lpString="?Y?") returned 3 [0097.951] lstrcpynA (in: lpString1=0x4990c4, lpString2="?Y?", iMaxLength=1 | out: lpString1="") returned="" [0097.951] lstrlenA (lpString="") returned 0 [0097.951] lstrlenA (lpString="?i?????bbp?K?u?z???U?????odbpll?L?isKiT?????vH") returned 46 [0097.951] lstrcpynA (in: lpString1=0x4990a4, lpString2="?i?????bbp?K?u?z???U?????odbpll?L?isKiT?????vH", iMaxLength=23 | out: lpString1="?i?????bbp?K?u?z???U??") returned="?i?????bbp?K?u?z???U??" [0097.951] lstrlenA (lpString="?i?????bbp?K?u?z???U??") returned 22 [0097.951] lstrlenA (lpString="ONK???QUo?B") returned 11 [0097.951] lstrcpynA (in: lpString1=0x4990c4, lpString2="ONK???QUo?B", iMaxLength=4 | out: lpString1="ONK") returned="ONK" [0097.951] lstrlenA (lpString="ONK") returned 3 [0097.951] lstrlenA (lpString="????????nA?QnK??hU??????h?d??g??C?bJ??ZS??xle?e??kPylcb?a?????ta????cs?j??s?F??C?bLC???Q??U?") returned 92 [0097.951] lstrcpynA (in: lpString1=0x499074, lpString2="????????nA?QnK??hU??????h?d??g??C?bJ??ZS??xle?e??kPylcb?a?????ta????cs?j??s?F??C?bLC???Q??U?", iMaxLength=12 | out: lpString1="????????nA?") returned="????????nA?" [0097.951] lstrlenA (lpString="????????nA?") returned 11 [0097.951] lstrlenA (lpString="?a?e????Dzl?sDzS????k?YyL") returned 25 [0097.951] lstrcpynA (in: lpString1=0x4990b8, lpString2="?a?e????Dzl?sDzS????k?YyL", iMaxLength=15 | out: lpString1="?a?e????Dzl?sD") returned="?a?e????Dzl?sD" [0097.951] lstrlenA (lpString="?a?e????Dzl?sD") returned 14 [0097.951] lstrlenA (lpString="?ezr?iRY??D??a??gjb??a??hdv???S?T??k??RY?u???tP???Y?????HR???N?Yc?mj????????f?Bd?") returned 81 [0097.951] lstrcpynA (in: lpString1=0x499080, lpString2="?ezr?iRY??D??a??gjb??a??hdv???S?T??k??RY?u???tP???Y?????HR???N?Yc?mj????????f?Bd?", iMaxLength=51 | out: lpString1="?ezr?iRY??D??a??gjb??a??hdv???S?T??k??RY?u???tP???") returned="?ezr?iRY??D??a??gjb??a??hdv???S?T??k??RY?u???tP???" [0097.951] lstrlenA (lpString="?ezr?iRY??D??a??gjb??a??hdv???S?T??k??RY?u???tP???") returned 50 [0097.951] lstrlenA (lpString="??D??????X?E????z?sg???P??????EQ??Dt?Y") returned 38 [0097.951] lstrcpynA (in: lpString1=0x4990ac, lpString2="??D??????X?E????z?sg???P??????EQ??Dt?Y", iMaxLength=34 | out: lpString1="??D??????X?E????z?sg???P??????EQ?") returned="??D??????X?E????z?sg???P??????EQ?" [0097.951] lstrlenA (lpString="??D??????X?E????z?sg???P??????EQ?") returned 33 [0097.952] lstrlenA (lpString="X?l?") returned 4 [0097.952] lstrcpynA (in: lpString1=0x4990c4, lpString2="X?l?", iMaxLength=2 | out: lpString1="X") returned="X" [0097.952] lstrlenA (lpString="X") returned 1 [0097.952] lstrlenA (lpString="??g??I?t?yl???lTO?????tLC?cDk") returned 29 [0097.952] lstrcpynA (in: lpString1=0x4990b4, lpString2="??g??I?t?yl???lTO?????tLC?cDk", iMaxLength=8 | out: lpString1="??g??I?") returned="??g??I?" [0097.952] lstrlenA (lpString="??g??I?") returned 7 [0097.952] lstrlenA (lpString="?S?fbjyk?G?") returned 11 [0097.952] lstrcpynA (in: lpString1=0x4990c4, lpString2="?S?fbjyk?G?", iMaxLength=6 | out: lpString1="?S?fb") returned="?S?fb" [0097.952] lstrlenA (lpString="?S?fb") returned 5 [0097.952] lstrlenA (lpString="L?L??iK???Gkf????B?SW?ld?B?o?l??LD?R??Yih??K??????dk?????U?u?Av????????sz?v???T???s?i") returned 85 [0097.952] lstrcpynA (in: lpString1=0x49907c, lpString2="L?L??iK???Gkf????B?SW?ld?B?o?l??LD?R??Yih??K??????dk?????U?u?Av????????sz?v???T???s?i", iMaxLength=57 | out: lpString1="L?L??iK???Gkf????B?SW?ld?B?o?l??LD?R??Yih??K??????dk????") returned="L?L??iK???Gkf????B?SW?ld?B?o?l??LD?R??Yih??K??????dk????" [0097.952] lstrlenA (lpString="L?L??iK???Gkf????B?SW?ld?B?o?l??LD?R??Yih??K??????dk????") returned 56 [0097.952] lstrlenA (lpString="z???m??XC?gWl?F?e?Q??d?rb??mS?TfOp?jjO?EKYOFk?G???y?C??i??????p?be?p?b") returned 70 [0097.952] lstrcpynA (in: lpString1=0x49908c, lpString2="z???m??XC?gWl?F?e?Q??d?rb??mS?TfOp?jjO?EKYOFk?G???y?C??i??????p?be?p?b", iMaxLength=56 | out: lpString1="z???m??XC?gWl?F?e?Q??d?rb??mS?TfOp?jjO?EKYOFk?G???y?C??") returned="z???m??XC?gWl?F?e?Q??d?rb??mS?TfOp?jjO?EKYOFk?G???y?C??" [0097.952] lstrlenA (lpString="z???m??XC?gWl?F?e?Q??d?rb??mS?TfOp?jjO?EKYOFk?G???y?C??") returned 55 [0097.952] lstrlenA (lpString="G?????Q??XC???GC???OA?vFjh?Y??hD?VVtR???MFl???AX?d?Ut???????b?g?Ua?OgAl??????????j?X??O?????V???mY") returned 98 [0097.952] lstrcpynA (in: lpString1=0x499070, lpString2="G?????Q??XC???GC???OA?vFjh?Y??hD?VVtR???MFl???AX?d?Ut???????b?g?Ua?OgAl??????????j?X??O?????V???mY", iMaxLength=40 | out: lpString1="G?????Q??XC???GC???OA?vFjh?Y??hD?VVtR??") returned="G?????Q??XC???GC???OA?vFjh?Y??hD?VVtR??" [0097.952] lstrlenA (lpString="G?????Q??XC???GC???OA?vFjh?Y??hD?VVtR??") returned 39 [0097.952] lstrlenA (lpString="IB") returned 2 [0097.952] lstrcpynA (in: lpString1=0x4990c4, lpString2="IB", iMaxLength=1 | out: lpString1="") returned="" [0097.952] lstrlenA (lpString="") returned 0 [0097.952] lstrlenA (lpString="???w???iV??V?o?U?LI?gJ?") returned 23 [0097.952] lstrcpynA (in: lpString1=0x4990bc, lpString2="???w???iV??V?o?U?LI?gJ?", iMaxLength=8 | out: lpString1="???w???") returned="???w???" [0097.953] lstrlenA (lpString="???w???") returned 7 [0097.953] lstrlenA (lpString="??g?oXo?r??sNu?p?G????w????f????GjhnPU?r?s?LII???IYeh?QF???M??NpP??P?B?Q??????GU???T") returned 84 [0097.953] lstrcpynA (in: lpString1=0x49907c, lpString2="??g?oXo?r??sNu?p?G????w????f????GjhnPU?r?s?LII???IYeh?QF???M??NpP??P?B?Q??????GU???T", iMaxLength=57 | out: lpString1="??g?oXo?r??sNu?p?G????w????f????GjhnPU?r?s?LII???IYeh?QF") returned="??g?oXo?r??sNu?p?G????w????f????GjhnPU?r?s?LII???IYeh?QF" [0097.953] lstrlenA (lpString="??g?oXo?r??sNu?p?G????w????f????GjhnPU?r?s?LII???IYeh?QF") returned 56 [0097.953] lstrlenA (lpString="??H?LVY???a????p?u?z??VWl???HxX??iZjo??p?v?????m????p??mLh???GV?oL??x") returned 69 [0097.953] lstrcpynA (in: lpString1=0x49908c, lpString2="??H?LVY???a????p?u?z??VWl???HxX??iZjo??p?v?????m????p??mLh???GV?oL??x", iMaxLength=50 | out: lpString1="??H?LVY???a????p?u?z??VWl???HxX??iZjo??p?v?????m?") returned="??H?LVY???a????p?u?z??VWl???HxX??iZjo??p?v?????m?" [0097.953] lstrlenA (lpString="??H?LVY???a????p?u?z??VWl???HxX??iZjo??p?v?????m?") returned 49 [0097.953] lstrlenA (lpString="M??????????V??Eax??Ap") returned 21 [0097.953] lstrcpynA (in: lpString1=0x4990bc, lpString2="M??????????V??Eax??Ap", iMaxLength=7 | out: lpString1="M?????") returned="M?????" [0097.953] lstrlenA (lpString="M?????") returned 6 [0097.953] lstrlenA (lpString="Cz?TyT?mN?l?ZMNv?IV?pA??Cw?pWjfd??????") returned 38 [0097.953] lstrcpynA (in: lpString1=0x4990ac, lpString2="Cz?TyT?mN?l?ZMNv?IV?pA??Cw?pWjfd??????", iMaxLength=16 | out: lpString1="Cz?TyT?mN?l?ZMN") returned="Cz?TyT?mN?l?ZMN" [0097.953] lstrlenA (lpString="Cz?TyT?mN?l?ZMN") returned 15 [0097.953] lstrlenA (lpString="Fes??S?gbu?xPdBO?yI??") returned 21 [0097.953] lstrcpynA (in: lpString1=0x4990bc, lpString2="Fes??S?gbu?xPdBO?yI??", iMaxLength=6 | out: lpString1="Fes??") returned="Fes??" [0097.953] lstrlenA (lpString="Fes??") returned 5 [0097.953] lstrlenA (lpString="????T??A?????Q??g?iz?zNfS?LX?Qy?u??C???cm?Bh??a????H??f???T??G???RM?KR") returned 70 [0097.953] lstrcpynA (in: lpString1=0x49908c, lpString2="????T??A?????Q??g?iz?zNfS?LX?Qy?u??C???cm?Bh??a????H??f???T??G???RM?KR", iMaxLength=67 | out: lpString1="????T??A?????Q??g?iz?zNfS?LX?Qy?u??C???cm?Bh??a????H??f???T??G???R") returned="????T??A?????Q??g?iz?zNfS?LX?Qy?u??C???cm?Bh??a????H??f???T??G???R" [0097.953] lstrlenA (lpString="????T??A?????Q??g?iz?zNfS?LX?Qy?u??C???cm?Bh??a????H??f???T??G???R") returned 66 [0097.953] lstrlenA (lpString="???AB?????H?rz?a??IM??Z?v?LQMZ?OG??KycK?????PTWUyISkO?cpH?g?j?hKtiFBmMu?????O???Qdvzp?w") returned 87 [0097.953] lstrcpynA (in: lpString1=0x49907c, lpString2="???AB?????H?rz?a??IM??Z?v?LQMZ?OG??KycK?????PTWUyISkO?cpH?g?j?hKtiFBmMu?????O???Qdvzp?w", iMaxLength=67 | out: lpString1="???AB?????H?rz?a??IM??Z?v?LQMZ?OG??KycK?????PTWUyISkO?cpH?g?j?hKti") returned="???AB?????H?rz?a??IM??Z?v?LQMZ?OG??KycK?????PTWUyISkO?cpH?g?j?hKti" [0097.953] lstrlenA (lpString="???AB?????H?rz?a??IM??Z?v?LQMZ?OG??KycK?????PTWUyISkO?cpH?g?j?hKti") returned 66 [0097.954] lstrlenA (lpString="piZ") returned 3 [0097.954] lstrcpynA (in: lpString1=0x4990c4, lpString2="piZ", iMaxLength=2 | out: lpString1="p") returned="p" [0097.954] lstrlenA (lpString="p") returned 1 [0097.954] lstrlenA (lpString="?E??o?W????V???v?yU?PR") returned 22 [0097.954] lstrcpynA (in: lpString1=0x4990bc, lpString2="?E??o?W????V???v?yU?PR", iMaxLength=2 | out: lpString1="?") returned="?" [0097.954] lstrlenA (lpString="?") returned 1 [0097.954] lstrlenA (lpString="B??o?I?pCWeVt???sY??a?????p??QbJ??c") returned 35 [0097.954] lstrcpynA (in: lpString1=0x4990b0, lpString2="B??o?I?pCWeVt???sY??a?????p??QbJ??c", iMaxLength=9 | out: lpString1="B??o?I?p") returned="B??o?I?p" [0097.954] lstrlenA (lpString="B??o?I?p") returned 8 [0097.954] lstrlenA (lpString="???oRxGw?y?l??eY?L?NJnhlcy??SV????c?K?G?O?X?hoC???A?ob??S??n???YLc?G???Ltgj??Ftf?") returned 81 [0097.954] lstrcpynA (in: lpString1=0x499080, lpString2="???oRxGw?y?l??eY?L?NJnhlcy??SV????c?K?G?O?X?hoC???A?ob??S??n???YLc?G???Ltgj??Ftf?", iMaxLength=2 | out: lpString1="?") returned="?" [0097.954] lstrcpynA (in: lpString1=0x4990c4, lpString2="??U??W??jv?", iMaxLength=9 | out: lpString1="??U??W??") returned="??U??W??" [0097.954] lstrcpynA (in: lpString1=0x499074, lpString2="LosD????o?????????z??VG?Wp???????a????Pc??nDoEO????o??S??Us?l?t???pMy??L???rmr????DW???d????B?", iMaxLength=3 | out: lpString1="Lo") returned="Lo" [0097.954] lstrcpynA (in: lpString1=0x49908c, lpString2="?ax???hP??kO???s?n????O??Uk???????????l?d?O???eljDf?G?p??vx?NnF?yN?RR?", iMaxLength=19 | out: lpString1="?ax???hP??kO???s?n") returned="?ax???hP??kO???s?n" [0097.954] lstrcpynA (in: lpString1=0x49907c, lpString2="?u??rnT????jJ?N?????F?E??????OiG??ptemx?TMB?W?oz?M???V???c????a??YJ??C????L???Q?????DB", iMaxLength=30 | out: lpString1="?u??rnT????jJ?N?????F?E??????") returned="?u??rnT????jJ?N?????F?E??????" [0097.954] lstrcpynA (in: lpString1=0x4990b8, lpString2="m?I?C?H?f??c?V?Pzvy?FY?cus", iMaxLength=14 | out: lpString1="m?I?C?H?f??c?") returned="m?I?C?H?f??c?" [0097.954] lstrcpynA (in: lpString1=0x4990c0, lpString2="?e?Hv?Z?C???MTnU?", iMaxLength=9 | out: lpString1="?e?Hv?Z?") returned="?e?Hv?Z?" [0097.955] lstrcpynA (in: lpString1=0x4990b8, lpString2="zSS???f?Am???i?EbQ??J?Bs??", iMaxLength=18 | out: lpString1="zSS???f?Am???i?Eb") returned="zSS???f?Am???i?Eb" [0097.955] lstrcpynA (in: lpString1=0x4990c0, lpString2="e?k????BEsIxsC???", iMaxLength=4 | out: lpString1="e?k") returned="e?k" [0097.955] lstrcpynA (in: lpString1=0x499088, lpString2="Akg?L?Qjgcj?kn??yA??????b?eU?F?O?N??twK?COg?kS?n?v???V?D??????k???f??U?y?", iMaxLength=4 | out: lpString1="Akg") returned="Akg" [0097.955] lstrcpynA (in: lpString1=0x49907c, lpString2="?????X????F?Ld?P???kDWPnW???B??b???w??p?F?aL?Ehxu?Tl?G??c??f?n???jw?Q??????Vk?B??M????", iMaxLength=37 | out: lpString1="?????X????F?Ld?P???kDWPnW???B??b???w") returned="?????X????F?Ld?P???kDWPnW???B??b???w" [0097.955] lstrcpynA (in: lpString1=0x4990a8, lpString2="?lB??h????Wn??Y?D??hPTR??G???o??w??SS?j???E", iMaxLength=33 | out: lpString1="?lB??h????Wn??Y?D??hPTR??G???o??") returned="?lB??h????Wn??Y?D??hPTR??G???o??" [0097.955] lstrcpynA (in: lpString1=0x4990a0, lpString2="yVbP???h????B?????Hnl??v???c?r??k??H??hUm?jCVV?mTc", iMaxLength=30 | out: lpString1="yVbP???h????B?????Hnl??v???c?") returned="yVbP???h????B?????Hnl??v???c?" [0097.955] lstrcpynA (in: lpString1=0x4990c0, lpString2="HW?w???????zP??G??", iMaxLength=14 | out: lpString1="HW?w???????zP") returned="HW?w???????zP" [0097.955] lstrcpynA (in: lpString1=0x4990a0, lpString2="???oe??NV?D??L???I??k??RfjG?X?yGv???W??l?dj??Ga?", iMaxLength=22 | out: lpString1="???oe??NV?D??L???I??k") returned="???oe??NV?D??L???I??k" [0097.955] lstrcpynA (in: lpString1=0x49909c, lpString2="?ZGs????Uet????????xMG?u?jV?u??D??????S?????o?E??????", iMaxLength=40 | out: lpString1="?ZGs????Uet????????xMG?u?jV?u??D??????S") returned="?ZGs????Uet????????xMG?u?jV?u??D??????S" [0097.955] lstrcpynA (in: lpString1=0x4990a4, lpString2="O??gv?B???aQ?fK??H??T????n?v??iV?GW????h?fH?l?", iMaxLength=27 | out: lpString1="O??gv?B???aQ?fK??H??T????n") returned="O??gv?B???aQ?fK??H??T????n" [0097.955] lstrcpynA (in: lpString1=0x499080, lpString2="?C??nA????WW?????????b?Hwl?H???T?v????k?jAr??Q?C??????w??R?u?D??Z?FZ?l????B?xd??", iMaxLength=49 | out: lpString1="?C??nA????WW?????????b?Hwl?H???T?v????k?jAr??Q?C") returned="?C??nA????WW?????????b?Hwl?H???T?v????k?jAr??Q?C" [0097.956] lstrcpynA (in: lpString1=0x4990b8, lpString2="???xcL???sW??KR??lN?????A?", iMaxLength=11 | out: lpString1="???xcL???s") returned="???xcL???s" [0097.956] lstrcpynA (in: lpString1=0x4990c4, lpString2="M", iMaxLength=1 | out: lpString1="") returned="" [0097.960] lstrcmpiA (lpString1="??b?g??hCH?11", lpString2="?????ARQ??O????15") returned 1 [0097.960] lstrcmpiA (lpString1="?????ARQ??O????15", lpString2="Pc???gavNC?11") returned -1 [0097.960] lstrcmpiA (lpString1="Pc???gavNC?11", lpString2="?Zgo?ZPi?tlN??L??p??W?Ar?e??Kn??G????i??z??s?????j??????56") returned 1 [0097.960] lstrcmpiA (lpString1="?Zgo?ZPi?tlN??L??p??W?Ar?e??Kn??G????i??z??s?????j??????56", lpString2="?W?N??x???????E?W?I?k?D?w25") returned 1 [0097.960] lstrcmpiA (lpString1="?W?N??x???????E?W?I?k?D?w25", lpString2="??B3") returned 1 [0097.960] lstrcmpiA (lpString1="??B3", lpString2="?d??M?6") returned -1 [0097.960] lstrcmpiA (lpString1="?d??M?6", lpString2="A??MkM?Fg?vo??up?NF????A??mR?tNvbeJ???Yv?B????U??s???nn??B?DWn?aY???ER70") returned -1 [0097.960] lstrcmpiA (lpString1="A??MkM?Fg?vo??up?NF????A??mR?tNvbeJ???Yv?B????U??s???nn??B?DWn?aY???ER70", lpString2="??????????????H?V?FurW???E?27") returned 1 [0097.960] lstrcmpiA (lpString1="??????????????H?V?FurW???E?27", lpString2="e1") returned -1 [0097.960] lstrcmpiA (lpString1="e1", lpString2="???Pep??a?uP??Biuoofz??W????j??aO33") returned 1 [0097.960] lstrcmpiA (lpString1="???Pep??a?uP??Biuoofz??W????j??aO33", lpString2="y?2") returned -1 [0097.960] lstrcmpiA (lpString1="y?2", lpString2="SSl???D?eOpMa??t?M?RrF??W??27") returned 1 [0097.960] lstrcmpiA (lpString1="SSl???D?eOpMa??t?M?RrF??W??27", lpString2="??j?ER??EITckM????O???K?a?G27") returned 1 [0097.960] lstrcmpiA (lpString1="??j?ER??EITckM????O???K?a?G27", lpString2="Oj2") returned -1 [0097.960] lstrcmpiA (lpString1="Oj2", lpString2="??n?nv??xuQ???lps???C?KR???????g?O?Om???O?xiY45") returned 1 [0097.960] lstrcmpiA (lpString1="??n?nv??xuQ???lps???C?KR???????g?O?Om???O?xiY45", lpString2="???JDtt??Un?OX??kapf???a??????tP????i?I???o??UK?DZ?X?iO?B???bv62") returned 1 [0097.960] lstrcmpiA (lpString1="???JDtt??Un?OX??kapf???a??????tP????i?I???o??UK?DZ?X?iO?B???bv62", lpString2="0") returned -1 [0097.960] lstrcmpiA (lpString1="0", lpString2="w???W??f?T?u??14") returned -1 [0097.960] lstrcmpiA (lpString1="w???W??f?T?u??14", lpString2="j?Knx????C??u???Ce???n?p?S?fHn?g?F?kh?gzMMeRsv???v?E?u54") returned 1 [0097.960] lstrcmpiA (lpString1="j?Knx????C??u???Ce???n?p?S?fHn?g?F?kh?gzMMeRsv???v?E?u54", lpString2="?u?hYv?D????e?ZL?Fd?J??S?YsQ???b??fA???????43") returned 1 [0097.960] lstrcmpiA (lpString1="?u?hYv?D????e?ZL?Fd?J??S?YsQ???b??fA???????43", lpString2="y??DA?KA??R?????PiKbYYVri?G?C29") returned -1 [0097.960] lstrcmpiA (lpString1="y??DA?KA??R?????PiKbYYVri?G?C29", lpString2="?Z?Oe????t???Zby???fd?Z23") returned 1 [0097.960] lstrcmpiA (lpString1="?Z?Oe????t???Zby???fd?Z23", lpString2="??????x?Zt???CJ??d?mz???c?j?l?sA????Dc????wL??ITB?50") returned 1 [0097.960] lstrcmpiA (lpString1="??????x?Zt???CJ??d?mz???c?j?l?sA????Dc????wL??ITB?50", lpString2="Xs??Y?YcUA?11") returned -1 [0097.960] lstrcmpiA (lpString1="Xs??Y?YcUA?11", lpString2="???Yh?????P??d?r?????Prz??S?V?Q?n?34") returned 1 [0097.960] lstrcmpiA (lpString1="???Yh?????P??d?r?????Prz??S?V?Q?n?34", lpString2="??DbR?Dr?????e??d??S?21") returned -1 [0097.960] lstrcmpiA (lpString1="??DbR?Dr?????e??d??S?21", lpString2="?n??PPIQf?y???B?????s?22") returned -1 [0097.961] lstrcmpiA (lpString1="?n??PPIQf?y???B?????s?22", lpString2="U???uN????TpIO?15") returned -1 [0097.961] lstrcmpiA (lpString1="U???uN????TpIO?15", lpString2="??F???KN?9") returned 1 [0097.961] lstrcmpiA (lpString1="??F???KN?9", lpString2="M??JW5") returned -1 [0097.961] lstrcmpiA (lpString1="M??JW5", lpString2="??????Zjd???X??c?E?S?PG??25") returned 1 [0097.961] lstrcmpiA (lpString1="??????Zjd???X??c?E?S?PG??25", lpString2="l????kHP???k???Te??WB?Q???k??a??aAt?n?e?o?RZJ?BR???????W?ib??????ho???70") returned -1 [0097.961] lstrcmpiA (lpString1="l????kHP???k???Te??WB?Q???k??a??aAt?n?e?o?RZJ?BR???????W?ib??????ho???70", lpString2="d?N???EX?Jt?M??????19") returned 1 [0097.961] lstrcmpiA (lpString1="d?N???EX?Jt?M??????19", lpString2="c?J???G?p?eI???i?tW??ddJ24") returned 1 [0097.961] lstrcmpiA (lpString1="c?J???G?p?eI???i?tW??ddJ24", lpString2="??HJRK?YQ?Kd??aM?t?j?Ls???F?D?????kS?wS?gjQAjHhX??V51") returned 1 [0097.961] lstrcmpiA (lpString1="??HJRK?YQ?Kd??aM?t?j?Ls???F?D?????kS?wS?gjQAjHhX??V51", lpString2="Sr?z??nS?9") returned -1 [0097.961] lstrcmpiA (lpString1="Sr?z??nS?9", lpString2="rJG?S?ky?m????y?DV?ZXN22") returned 1 [0097.961] lstrcmpiA (lpString1="rJG?S?ky?m????y?DV?ZXN22", lpString2="?F?B???MQiBQ?wu?A?????I???a?SZk?t?xL???O?X?pa??V?????Npiu?Be?nh???bh????e?TXWn?e??e?84") returned 1 [0097.961] lstrcmpiA (lpString1="?F?B???MQiBQ?wu?A?????I???a?SZk?t?xL???O?X?pa??V?????Npiu?Be?nh???bh????e?TXWn?e??e?84", lpString2="DVJ??E6") returned -1 [0097.961] lstrcmpiA (lpString1="DVJ??E6", lpString2="???c???7") returned 1 [0097.961] lstrcmpiA (lpString1="???c???7", lpString2="?1") returned -1 [0097.961] lstrcmpiA (lpString1="?1", lpString2="j??VvrZ??k??Z??d??aBnf????Tvb29") returned -1 [0097.961] lstrcmpiA (lpString1="j??VvrZ??k??Z??d??aBnf????Tvb29", lpString2="?JLAk????mH11") returned 1 [0097.961] lstrcmpiA (lpString1="?JLAk????mH11", lpString2="w????tJ??F??d???L???X?xDbw??CYY?U?g?W?O???k????J?Vc??EHP?g??X?PYp65") returned -1 [0097.961] lstrcmpiA (lpString1="w????tJ??F??d???L???X?xDbw??CYY?U?g?W?O???k????J?Vc??EHP?g??X?PYp65", lpString2="XTU??a??yl??fbD?pn18") returned -1 [0097.961] lstrcmpiA (lpString1="XTU??a??yl??fbD?pn18", lpString2="???3") returned 1 [0097.961] lstrcmpiA (lpString1="???3", lpString2="fN??E???og????jI????????ZCS??????XG?M?xL??eZaQ???????????57") returned -1 [0097.961] lstrcmpiA (lpString1="fN??E???og????jI????????ZCS??????XG?M?xL??eZaQ???????????57", lpString2="???Z?xC??xvZ12") returned 1 [0097.961] lstrcmpiA (lpString1="???Z?xC??xvZ12", lpString2="???E?i?7") returned 1 [0097.961] lstrcmpiA (lpString1="???E?i?7", lpString2="?l????D7") returned -1 [0097.961] lstrcmpiA (lpString1="?l????D7", lpString2="h?K??U?TI?GX12") returned -1 [0097.961] lstrcmpiA (lpString1="h?K??U?TI?GX12", lpString2="B?y?S?Ek?O?l????d?wbmM?R24") returned 1 [0097.961] lstrcmpiA (lpString1="B?y?S?Ek?O?l????d?wbmM?R24", lpString2="??yH???b?Y???J??h??????S?????T?IEU?yz???Z??Za?C?U?x???f?p?By?L????YJK??YvLCd?77") returned 1 [0097.961] lstrcmpiA (lpString1="??yH???b?Y???J??h??????S?????T?IEU?yz???Z??Za?C?U?x???f?p?By?L????YJK??YvLCd?77", lpString2="?zW?MM?pe9") returned -1 [0097.961] lstrcmpiA (lpString1="?zW?MM?pe9", lpString2="k??B??F?FiR?u??Z?????yOeuO?J?dD?GQW?b?v39") returned -1 [0097.961] lstrcmpiA (lpString1="k??B??F?FiR?u??Z?????yOeuO?J?dD?GQW?b?v39", lpString2="?g??h?????IgHzV?v??g???w?z?Bx?G???R?B???t???M????W50") returned 1 [0097.961] lstrcmpiA (lpString1="?g??h?????IgHzV?v??g???w?z?Bx?G???R?B???t???M????W50", lpString2="w?bE?vK?x???n??Ca17") returned -1 [0097.961] lstrcmpiA (lpString1="w?bE?vK?x???n??Ca17", lpString2="??gG??H?QoIZ?v?p??????DE??26") returned 1 [0097.961] lstrcmpiA (lpString1="??gG??H?QoIZ?v?p??????DE??26", lpString2="????nx?????11") returned 1 [0097.961] lstrcmpiA (lpString1="????nx?????11", lpString2="g?R?4") returned -1 [0097.961] lstrcmpiA (lpString1="g?R?4", lpString2="??OUMM?Ak????yi?s?vE20") returned 1 [0097.962] lstrcmpiA (lpString1="??OUMM?Ak????yi?s?vE20", lpString2="??Yp????R?MkX??uGW?m??gIdS???29") returned -1 [0097.962] lstrcmpiA (lpString1="??Yp????R?MkX??uGW?m??gIdS???29", lpString2="?????ZTGP??W??z15") returned 1 [0097.962] lstrcmpiA (lpString1="?????ZTGP??W??z15", lpString2="???O??MThh???O???X??CXba?G?z?M??B????gG??YFj??uU???51") returned -1 [0097.962] lstrcmpiA (lpString1="???O??MThh???O???X??CXba?G?z?M??B????gG??YFj??uU???51", lpString2="??TeIU?Zhr?V?rVi?Ejiox?OM?y???M???w?36") returned -1 [0097.962] lstrcmpiA (lpString1="??TeIU?Zhr?V?rVi?Ejiox?OM?y???M???w?36", lpString2="?U????uJ?????W????Z?Rr??pikCDZ?W??h?z????n??hI???ImU?Q??B?????yd????d?Ae??74") returned -1 [0097.962] lstrcmpiA (lpString1="?U????uJ?????W????Z?Rr??pikCDZ?W??h?z????n??hI???ImU?Q??B?????yd????d?Ae??74", lpString2="Z?uc??KTWiK???szVxXP??T?bK?A?X??jg?????x???X?L????s???y55") returned -1 [0097.962] lstrcmpiA (lpString1="Z?uc??KTWiK???szVxXP??T?bK?A?X??jg?????x???X?L????s???y55", lpString2="?1") returned 1 [0097.962] lstrcmpiA (lpString1="?1", lpString2="vQ????t?????A???p????????t???y?????W?x??y41") returned -1 [0097.962] lstrcmpiA (lpString1="vQ????t?????A???p????????t???y?????W?x??y41", lpString2="E???g??p??BW???rY????????e????rWdr?yi??vx??m???I???w???H??58") returned 1 [0097.962] lstrcmpiA (lpString1="E???g??p??BW???rY????????e????rWdr?yi??vx??m???I???w???H??58", lpString2="C???x??MH?10") returned 1 [0097.962] lstrcmpiA (lpString1="C???x??MH?10", lpString2="LM?X??E?ECBpU?14") returned -1 [0097.962] lstrcmpiA (lpString1="LM?X??E?ECBpU?14", lpString2="NIP??????PRlX??v16") returned -1 [0097.962] lstrcmpiA (lpString1="NIP??????PRlX??v16", lpString2="?nAt?cT?iC10") returned 1 [0097.962] lstrcmpiA (lpString1="?nAt?cT?iC10", lpString2="ra????n????11") returned -1 [0097.962] lstrcmpiA (lpString1="ra????n????11", lpString2="??Wb?v???GglA?o15") returned 1 [0097.962] lstrcmpiA (lpString1="??Wb?v???GglA?o15", lpString2="fc????m?8") returned -1 [0097.962] lstrcmpiA (lpString1="fc????m?8", lpString2="??????I?N??????FtSrj?21") returned 1 [0097.962] lstrcmpiA (lpString1="??????I?N??????FtSrj?21", lpString2="l??xn?j???????d??h??lPY?A?vJY??R??cT???pMS?????i?????z??????Y?b?rC??Y?rab?N???LX?hX??SOX?D90") returned -1 [0097.962] lstrcmpiA (lpString1="l??xn?j???????d??h??lPY?A?vJY??R??cT???pMS?????i?????z??????Y?b?rC??Y?rab?N???LX?hX??SOX?D90", lpString2="hr?p?t?h?ZKW??e?O??kK???g???d?a??????A??FUw??i?uA?????P????Ak?r63") returned 1 [0097.962] lstrcmpiA (lpString1="hr?p?t?h?ZKW??e?O??kK???g???d?a??????A??FUw??i?uA?????P????Ak?r63", lpString2="????d???o???Ri??T?lTpHx??RUAA???f?????n??l?LAm????o?a????vD?P??D64") returned 1 [0097.962] lstrcmpiA (lpString1="????d???o???Ri??T?lTpHx??RUAA???f?????n??l?LAm????o?a????vD?P??D64", lpString2="?b??kU?7") returned -1 [0097.962] lstrcmpiA (lpString1="?b??kU?7", lpString2="?wf??5") returned -1 [0097.962] lstrcmpiA (lpString1="?wf??5", lpString2="????E??f?FU?N??HBa?YL??K?sp?d?30") returned 1 [0097.962] lstrcmpiA (lpString1="????E??f?FU?N??HBa?YL??K?sp?d?30", lpString2="I??T4") returned -1 [0097.962] lstrcmpiA (lpString1="I??T4", lpString2="?????L????H11") returned 1 [0097.962] lstrcmpiA (lpString1="?????L????H11", lpString2="xppF?K?EO??L?F????18") returned -1 [0097.962] lstrcmpiA (lpString1="xppF?K?EO??L?F????18", lpString2="?m?p?D???F?JbS?????nX?U????Ha?QC?BXlG?yW???v??kV48") returned 1 [0097.962] lstrcmpiA (lpString1="?m?p?D???F?JbS?????nX?U????Ha?QC?BXlG?yW???v??kV48", lpString2="mH???ky?p?xK??V????19") returned -1 [0097.962] lstrcmpiA (lpString1="mH???ky?p?xK??V????19", lpString2="?????t??g9") returned 1 [0097.962] lstrcmpiA (lpString1="?????t??g9", lpString2="?z?tdP6") returned -1 [0097.962] lstrcmpiA (lpString1="?z?tdP6", lpString2="??EadUWY??J?12") returned 1 [0097.962] lstrcmpiA (lpString1="??EadUWY??J?12", lpString2="0") returned -1 [0097.962] lstrcmpiA (lpString1="0", lpString2="?h???5") returned 1 [0097.962] lstrcmpiA (lpString1="?h???5", lpString2="oWVREW??Y?M11") returned -1 [0097.962] lstrcmpiA (lpString1="oWVREW??Y?M11", lpString2="S?i?Vkjl?e?r???x??N???p?b????BP???34") returned -1 [0097.963] lstrcmpiA (lpString1="S?i?Vkjl?e?r???x??N???p?b????BP???34", lpString2="?MZz?????y10") returned 1 [0097.963] lstrcmpiA (lpString1="?MZz?????y10", lpString2="0") returned -1 [0097.963] lstrcmpiA (lpString1="0", lpString2="0") returned 0 [0097.963] lstrcmpiA (lpString1="0", lpString2="?i?????bbp?K?u?z???U??22") returned 1 [0097.963] lstrcmpiA (lpString1="?i?????bbp?K?u?z???U??22", lpString2="ONK3") returned -1 [0097.963] lstrcmpiA (lpString1="ONK3", lpString2="????????nA?11") returned 1 [0097.963] lstrcmpiA (lpString1="????????nA?11", lpString2="?a?e????Dzl?sD14") returned -1 [0097.963] lstrcmpiA (lpString1="?a?e????Dzl?sD14", lpString2="?ezr?iRY??D??a??gjb??a??hdv???S?T??k??RY?u???tP???50") returned -1 [0097.963] lstrcmpiA (lpString1="?ezr?iRY??D??a??gjb??a??hdv???S?T??k??RY?u???tP???50", lpString2="??D??????X?E????z?sg???P??????EQ?33") returned 1 [0097.963] lstrcmpiA (lpString1="??D??????X?E????z?sg???P??????EQ?33", lpString2="X1") returned -1 [0097.963] lstrcmpiA (lpString1="X1", lpString2="??g??I?7") returned 1 [0097.963] lstrcmpiA (lpString1="??g??I?7", lpString2="?S?fb5") returned -1 [0097.963] lstrcmpiA (lpString1="?S?fb5", lpString2="L?L??iK???Gkf????B?SW?ld?B?o?l??LD?R??Yih??K??????dk????56") returned -1 [0097.963] lstrcmpiA (lpString1="L?L??iK???Gkf????B?SW?ld?B?o?l??LD?R??Yih??K??????dk????56", lpString2="z???m??XC?gWl?F?e?Q??d?rb??mS?TfOp?jjO?EKYOFk?G???y?C??55") returned -1 [0097.963] lstrcmpiA (lpString1="z???m??XC?gWl?F?e?Q??d?rb??mS?TfOp?jjO?EKYOFk?G???y?C??55", lpString2="G?????Q??XC???GC???OA?vFjh?Y??hD?VVtR??39") returned 1 [0097.963] lstrcmpiA (lpString1="G?????Q??XC???GC???OA?vFjh?Y??hD?VVtR??39", lpString2="0") returned 1 [0097.963] lstrcmpiA (lpString1="0", lpString2="???w???7") returned 1 [0097.963] lstrcmpiA (lpString1="???w???7", lpString2="??g?oXo?r??sNu?p?G????w????f????GjhnPU?r?s?LII???IYeh?QF56") returned -1 [0097.963] lstrcmpiA (lpString1="??g?oXo?r??sNu?p?G????w????f????GjhnPU?r?s?LII???IYeh?QF56", lpString2="??H?LVY???a????p?u?z??VWl???HxX??iZjo??p?v?????m?49") returned -1 [0097.963] lstrcmpiA (lpString1="??H?LVY???a????p?u?z??VWl???HxX??iZjo??p?v?????m?49", lpString2="M?????6") returned -1 [0097.963] lstrcmpiA (lpString1="M?????6", lpString2="Cz?TyT?mN?l?ZMN15") returned 1 [0097.963] lstrcmpiA (lpString1="Cz?TyT?mN?l?ZMN15", lpString2="Fes??5") returned -1 [0097.963] lstrcmpiA (lpString1="Fes??5", lpString2="????T??A?????Q??g?iz?zNfS?LX?Qy?u??C???cm?Bh??a????H??f???T??G???R66") returned 1 [0097.963] lstrcmpiA (lpString1="????T??A?????Q??g?iz?zNfS?LX?Qy?u??C???cm?Bh??a????H??f???T??G???R66", lpString2="???AB?????H?rz?a??IM??Z?v?LQMZ?OG??KycK?????PTWUyISkO?cpH?g?j?hKti66") returned -1 [0097.963] lstrcmpiA (lpString1="???AB?????H?rz?a??IM??Z?v?LQMZ?OG??KycK?????PTWUyISkO?cpH?g?j?hKti66", lpString2="p1") returned -1 [0097.963] lstrcmpiA (lpString1="p1", lpString2="?1") returned 1 [0097.963] lstrcmpiA (lpString1="?1", lpString2="B??o?I?p8") returned -1 [0097.963] lstrcmpiA (lpString1="B??o?I?p8", lpString2="?1") returned 1 [0097.963] lstrcmpiA (lpString1="?1", lpString2="??U??W??8") returned 1 [0097.963] lstrcmpiA (lpString1="??U??W??8", lpString2="Lo2") returned -1 [0097.963] lstrcmpiA (lpString1="Lo2", lpString2="?ax???hP??kO???s?n18") returned 1 [0097.963] lstrcmpiA (lpString1="?ax???hP??kO???s?n18", lpString2="?u??rnT????jJ?N?????F?E??????29") returned -1 [0097.963] lstrcmpiA (lpString1="?u??rnT????jJ?N?????F?E??????29", lpString2="m?I?C?H?f??c?13") returned -1 [0097.963] lstrcmpiA (lpString1="m?I?C?H?f??c?13", lpString2="?e?Hv?Z?8") returned 1 [0097.963] lstrcmpiA (lpString1="?e?Hv?Z?8", lpString2="zSS???f?Am???i?Eb17") returned -1 [0097.964] lstrcmpiA (lpString1="zSS???f?Am???i?Eb17", lpString2="e?k3") returned 1 [0097.964] lstrcmpiA (lpString1="e?k3", lpString2="Akg3") returned 1 [0097.964] lstrcmpiA (lpString1="Akg3", lpString2="?????X????F?Ld?P???kDWPnW???B??b???w36") returned 1 [0097.964] lstrcmpiA (lpString1="?????X????F?Ld?P???kDWPnW???B??b???w36", lpString2="?lB??h????Wn??Y?D??hPTR??G???o??32") returned -1 [0097.964] lstrcmpiA (lpString1="?lB??h????Wn??Y?D??hPTR??G???o??32", lpString2="yVbP???h????B?????Hnl??v???c?29") returned -1 [0097.964] lstrcmpiA (lpString1="yVbP???h????B?????Hnl??v???c?29", lpString2="HW?w???????zP13") returned 1 [0097.964] lstrcmpiA (lpString1="HW?w???????zP13", lpString2="???oe??NV?D??L???I??k21") returned 1 [0097.964] lstrcmpiA (lpString1="???oe??NV?D??L???I??k21", lpString2="?ZGs????Uet????????xMG?u?jV?u??D??????S39") returned -1 [0097.964] lstrcmpiA (lpString1="?ZGs????Uet????????xMG?u?jV?u??D??????S39", lpString2="O??gv?B???aQ?fK??H??T????n26") returned -1 [0097.964] lstrcmpiA (lpString1="O??gv?B???aQ?fK??H??T????n26", lpString2="?C??nA????WW?????????b?Hwl?H???T?v????k?jAr??Q?C48") returned 1 [0097.964] lstrcmpiA (lpString1="?C??nA????WW?????????b?Hwl?H???T?v????k?jAr??Q?C48", lpString2="???xcL???s10") returned 1 [0097.964] lstrcmpiA (lpString1="???xcL???s10", lpString2="0") returned -1 [0097.964] lstrcmpiA (lpString1="0", lpString2="0") returned 0 [0097.968] GetCurrentProcessId () returned 0x9f8 [0097.969] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x9f8) returned 0x304 [0097.969] EnumProcessModules (in: hProcess=0x304, lphModule=0x2302c00, cb=0x100, lpcbNeeded=0x497fd0 | out: lphModule=0x2302c00, lpcbNeeded=0x497fd0) returned 1 [0097.969] GetModuleInformation (in: hProcess=0x304, hModule=0x310000, lpmodinfo=0x2302d40, cb=0xc | out: lpmodinfo=0x2302d40*(lpBaseOfDll=0x310000, SizeOfImage=0x3e000, EntryPoint=0x3479ce)) returned 1 [0097.970] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0097.970] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x310000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="unlikexpc.exe") returned 0xd [0097.970] CoTaskMemFree (pv=0x5d7900) [0097.970] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0097.970] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x310000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\unlikexpc.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\unlikexpc.exe")) returned 0x33 [0097.970] CoTaskMemFree (pv=0x5d7900) [0097.970] GetModuleInformation (in: hProcess=0x304, hModule=0x77ab0000, lpmodinfo=0x2304e94, cb=0xc | out: lpmodinfo=0x2304e94*(lpBaseOfDll=0x77ab0000, SizeOfImage=0x180000, EntryPoint=0x0)) returned 1 [0097.970] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0097.970] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x77ab0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="ntdll.dll") returned 0x9 [0097.970] CoTaskMemFree (pv=0x5d7900) [0097.970] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0097.970] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x77ab0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll")) returned 0x1d [0097.970] CoTaskMemFree (pv=0x5d7900) [0097.970] GetModuleInformation (in: hProcess=0x304, hModule=0x754b0000, lpmodinfo=0x2306f98, cb=0xc | out: lpmodinfo=0x2306f98*(lpBaseOfDll=0x754b0000, SizeOfImage=0x4a000, EntryPoint=0x754b2e54)) returned 1 [0097.970] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0097.970] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x754b0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="MSCOREE.DLL") returned 0xb [0097.971] CoTaskMemFree (pv=0x5d7900) [0097.971] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0097.971] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x754b0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\MSCOREE.DLL" (normalized: "c:\\windows\\system32\\mscoree.dll")) returned 0x1f [0097.971] CoTaskMemFree (pv=0x5d7900) [0097.971] GetModuleInformation (in: hProcess=0x304, hModule=0x757c0000, lpmodinfo=0x23090a4, cb=0xc | out: lpmodinfo=0x23090a4*(lpBaseOfDll=0x757c0000, SizeOfImage=0x110000, EntryPoint=0x757d32d3)) returned 1 [0097.971] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0097.971] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x757c0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="KERNEL32.dll") returned 0xc [0097.971] CoTaskMemFree (pv=0x5d7900) [0097.971] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0097.971] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x757c0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\KERNEL32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll")) returned 0x20 [0097.971] CoTaskMemFree (pv=0x5d7900) [0097.971] GetModuleInformation (in: hProcess=0x304, hModule=0x76260000, lpmodinfo=0x230b1b8, cb=0xc | out: lpmodinfo=0x230b1b8*(lpBaseOfDll=0x76260000, SizeOfImage=0x46000, EntryPoint=0x76267478)) returned 1 [0097.971] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0097.971] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x76260000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="KERNELBASE.dll") returned 0xe [0097.971] CoTaskMemFree (pv=0x5d7900) [0097.971] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0097.972] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x76260000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\KERNELBASE.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll")) returned 0x22 [0097.972] CoTaskMemFree (pv=0x5d7900) [0097.972] GetModuleInformation (in: hProcess=0x304, hModule=0x75720000, lpmodinfo=0x230d300, cb=0xc | out: lpmodinfo=0x230d300*(lpBaseOfDll=0x75720000, SizeOfImage=0xa0000, EntryPoint=0x757349e5)) returned 1 [0097.972] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0097.972] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75720000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="ADVAPI32.dll") returned 0xc [0097.972] CoTaskMemFree (pv=0x5d7900) [0097.972] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0097.972] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75720000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\ADVAPI32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll")) returned 0x20 [0097.972] CoTaskMemFree (pv=0x5d7900) [0097.972] GetModuleInformation (in: hProcess=0x304, hModule=0x75fe0000, lpmodinfo=0x230f414, cb=0xc | out: lpmodinfo=0x230f414*(lpBaseOfDll=0x75fe0000, SizeOfImage=0xac000, EntryPoint=0x75fea472)) returned 1 [0097.972] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0097.972] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75fe0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="msvcrt.dll") returned 0xa [0097.973] CoTaskMemFree (pv=0x5d7900) [0097.973] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0097.973] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75fe0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll")) returned 0x1e [0097.973] CoTaskMemFree (pv=0x5d7900) [0097.973] GetModuleInformation (in: hProcess=0x304, hModule=0x761b0000, lpmodinfo=0x2311520, cb=0xc | out: lpmodinfo=0x2311520*(lpBaseOfDll=0x761b0000, SizeOfImage=0x19000, EntryPoint=0x761b4975)) returned 1 [0097.973] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0097.973] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x761b0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="sechost.dll") returned 0xb [0097.973] CoTaskMemFree (pv=0x5d7900) [0097.973] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0097.973] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x761b0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll")) returned 0x1f [0097.973] CoTaskMemFree (pv=0x5d7900) [0097.973] GetModuleInformation (in: hProcess=0x304, hModule=0x76090000, lpmodinfo=0x231362c, cb=0xc | out: lpmodinfo=0x231362c*(lpBaseOfDll=0x76090000, SizeOfImage=0xf0000, EntryPoint=0x760a0569)) returned 1 [0097.974] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0097.974] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x76090000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="RPCRT4.dll") returned 0xa [0097.974] CoTaskMemFree (pv=0x5d7900) [0097.974] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0097.974] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x76090000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\RPCRT4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll")) returned 0x1e [0097.974] CoTaskMemFree (pv=0x5d7900) [0097.974] GetModuleInformation (in: hProcess=0x304, hModule=0x75610000, lpmodinfo=0x2315784, cb=0xc | out: lpmodinfo=0x2315784*(lpBaseOfDll=0x75610000, SizeOfImage=0x60000, EntryPoint=0x7562a3b3)) returned 1 [0097.974] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0097.974] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75610000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="SspiCli.dll") returned 0xb [0097.974] CoTaskMemFree (pv=0x5d7900) [0097.974] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0097.974] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75610000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\SspiCli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll")) returned 0x1f [0097.975] CoTaskMemFree (pv=0x5d7900) [0097.975] GetModuleInformation (in: hProcess=0x304, hModule=0x75600000, lpmodinfo=0x2317890, cb=0xc | out: lpmodinfo=0x2317890*(lpBaseOfDll=0x75600000, SizeOfImage=0xc000, EntryPoint=0x756010e1)) returned 1 [0097.975] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0097.975] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75600000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="CRYPTBASE.dll") returned 0xd [0097.975] CoTaskMemFree (pv=0x5d7900) [0097.975] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0097.975] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75600000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\CRYPTBASE.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll")) returned 0x21 [0097.975] CoTaskMemFree (pv=0x5d7900) [0097.975] GetModuleInformation (in: hProcess=0x304, hModule=0x75430000, lpmodinfo=0x23199a4, cb=0xc | out: lpmodinfo=0x23199a4*(lpBaseOfDll=0x75430000, SizeOfImage=0x78000, EntryPoint=0x7543f7ba)) returned 1 [0097.976] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0097.976] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75430000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="mscoreei.dll") returned 0xc [0097.976] CoTaskMemFree (pv=0x5d7900) [0097.976] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0097.976] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75430000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscoreei.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\mscoreei.dll")) returned 0x3a [0097.976] CoTaskMemFree (pv=0x5d7900) [0097.976] GetModuleInformation (in: hProcess=0x304, hModule=0x761d0000, lpmodinfo=0x231baec, cb=0xc | out: lpmodinfo=0x231baec*(lpBaseOfDll=0x761d0000, SizeOfImage=0x57000, EntryPoint=0x761e9ba6)) returned 1 [0097.976] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0097.976] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x761d0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="SHLWAPI.dll") returned 0xb [0097.977] CoTaskMemFree (pv=0x5d7900) [0097.977] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0097.977] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x761d0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\SHLWAPI.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll")) returned 0x1f [0097.977] CoTaskMemFree (pv=0x5d7900) [0097.977] GetModuleInformation (in: hProcess=0x304, hModule=0x766d0000, lpmodinfo=0x231dbf8, cb=0xc | out: lpmodinfo=0x231dbf8*(lpBaseOfDll=0x766d0000, SizeOfImage=0x90000, EntryPoint=0x766e6343)) returned 1 [0097.977] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0097.977] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x766d0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="GDI32.dll") returned 0x9 [0097.977] CoTaskMemFree (pv=0x5d7900) [0097.977] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0097.977] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x766d0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\GDI32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll")) returned 0x1d [0097.978] CoTaskMemFree (pv=0x5d7900) [0097.978] GetModuleInformation (in: hProcess=0x304, hModule=0x775b0000, lpmodinfo=0x231fcfc, cb=0xc | out: lpmodinfo=0x231fcfc*(lpBaseOfDll=0x775b0000, SizeOfImage=0x100000, EntryPoint=0x775cb6ed)) returned 1 [0097.978] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0097.978] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x775b0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="USER32.dll") returned 0xa [0097.978] CoTaskMemFree (pv=0x5d7900) [0097.978] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0097.978] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x775b0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\USER32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll")) returned 0x1e [0097.978] CoTaskMemFree (pv=0x5d7900) [0097.979] GetModuleInformation (in: hProcess=0x304, hModule=0x75a70000, lpmodinfo=0x2321e08, cb=0xc | out: lpmodinfo=0x2321e08*(lpBaseOfDll=0x75a70000, SizeOfImage=0xa000, EntryPoint=0x75a736a0)) returned 1 [0097.979] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0097.979] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75a70000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="LPK.dll") returned 0x7 [0097.979] CoTaskMemFree (pv=0x5d7900) [0097.979] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0097.979] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75a70000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\LPK.dll" (normalized: "c:\\windows\\syswow64\\lpk.dll")) returned 0x1b [0097.979] CoTaskMemFree (pv=0x5d7900) [0097.979] GetModuleInformation (in: hProcess=0x304, hModule=0x758d0000, lpmodinfo=0x2323f04, cb=0xc | out: lpmodinfo=0x2323f04*(lpBaseOfDll=0x758d0000, SizeOfImage=0x9d000, EntryPoint=0x75903fd7)) returned 1 [0097.980] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0097.980] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x758d0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="USP10.dll") returned 0x9 [0097.980] CoTaskMemFree (pv=0x5d7900) [0097.980] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0097.980] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x758d0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\USP10.dll" (normalized: "c:\\windows\\syswow64\\usp10.dll")) returned 0x1d [0097.980] CoTaskMemFree (pv=0x5d7900) [0097.980] GetModuleInformation (in: hProcess=0x304, hModule=0x75f80000, lpmodinfo=0x2326094, cb=0xc | out: lpmodinfo=0x2326094*(lpBaseOfDll=0x75f80000, SizeOfImage=0x60000, EntryPoint=0x75f9158f)) returned 1 [0097.981] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0097.981] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75f80000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="IMM32.DLL") returned 0x9 [0097.981] CoTaskMemFree (pv=0x5d7900) [0097.981] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0097.981] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75f80000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\system32\\IMM32.DLL" (normalized: "c:\\windows\\system32\\imm32.dll")) returned 0x1d [0097.981] CoTaskMemFree (pv=0x5d7900) [0097.981] GetModuleInformation (in: hProcess=0x304, hModule=0x75ea0000, lpmodinfo=0x2328198, cb=0xc | out: lpmodinfo=0x2328198*(lpBaseOfDll=0x75ea0000, SizeOfImage=0xcc000, EntryPoint=0x75ea168b)) returned 1 [0097.981] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0097.981] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75ea0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="MSCTF.dll") returned 0x9 [0097.982] CoTaskMemFree (pv=0x5d7900) [0097.982] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0097.982] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75ea0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\MSCTF.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll")) returned 0x1d [0097.982] CoTaskMemFree (pv=0x5d7900) [0097.982] GetModuleInformation (in: hProcess=0x304, hModule=0x75420000, lpmodinfo=0x232a29c, cb=0xc | out: lpmodinfo=0x232a29c*(lpBaseOfDll=0x75420000, SizeOfImage=0x9000, EntryPoint=0x75421220)) returned 1 [0097.982] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0097.982] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75420000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="VERSION.dll") returned 0xb [0097.983] CoTaskMemFree (pv=0x5d7900) [0097.983] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0097.983] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75420000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\system32\\VERSION.dll" (normalized: "c:\\windows\\system32\\version.dll")) returned 0x1f [0097.983] CoTaskMemFree (pv=0x5d7900) [0097.983] GetModuleInformation (in: hProcess=0x304, hModule=0x74890000, lpmodinfo=0x232c3a8, cb=0xc | out: lpmodinfo=0x232c3a8*(lpBaseOfDll=0x74890000, SizeOfImage=0x6a8000, EntryPoint=0x749d7040)) returned 1 [0097.983] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0097.983] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x74890000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="clr.dll") returned 0x7 [0097.984] CoTaskMemFree (pv=0x5d7900) [0097.984] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0097.984] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x74890000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\clr.dll")) returned 0x35 [0097.984] CoTaskMemFree (pv=0x5d7900) [0097.984] GetModuleInformation (in: hProcess=0x304, hModule=0x75320000, lpmodinfo=0x232e4d8, cb=0xc | out: lpmodinfo=0x232e4d8*(lpBaseOfDll=0x75320000, SizeOfImage=0xf5000, EntryPoint=0x75374160)) returned 1 [0097.984] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0097.984] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75320000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="MSVCR120_CLR0400.dll") returned 0x14 [0097.985] CoTaskMemFree (pv=0x5d7900) [0097.985] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0097.985] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75320000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\system32\\MSVCR120_CLR0400.dll" (normalized: "c:\\windows\\system32\\msvcr120_clr0400.dll")) returned 0x28 [0097.985] CoTaskMemFree (pv=0x5d7900) [0097.985] GetModuleInformation (in: hProcess=0x304, hModule=0x72440000, lpmodinfo=0x233060c, cb=0xc | out: lpmodinfo=0x233060c*(lpBaseOfDll=0x72440000, SizeOfImage=0x122b000, EntryPoint=0x0)) returned 1 [0097.985] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0097.985] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x72440000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="mscorlib.ni.dll") returned 0xf [0097.986] CoTaskMemFree (pv=0x5d7900) [0097.986] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0097.986] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x72440000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\b7a12c4c0032847fcc6b9c710460456f\\mscorlib.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\mscorlib\\b7a12c4c0032847fcc6b9c710460456f\\mscorlib.ni.dll")) returned 0x68 [0097.986] CoTaskMemFree (pv=0x5d7900) [0097.986] GetModuleInformation (in: hProcess=0x304, hModule=0x764e0000, lpmodinfo=0x23327b4, cb=0xc | out: lpmodinfo=0x23327b4*(lpBaseOfDll=0x764e0000, SizeOfImage=0x15c000, EntryPoint=0x7652ba3d)) returned 1 [0097.987] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0097.987] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x764e0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="ole32.dll") returned 0x9 [0097.987] CoTaskMemFree (pv=0x5d7900) [0097.987] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0097.987] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x764e0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll")) returned 0x1d [0097.988] CoTaskMemFree (pv=0x5d7900) [0097.988] GetModuleInformation (in: hProcess=0x304, hModule=0x74f60000, lpmodinfo=0x23348b8, cb=0xc | out: lpmodinfo=0x23348b8*(lpBaseOfDll=0x74f60000, SizeOfImage=0x80000, EntryPoint=0x74f737c9)) returned 1 [0097.988] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0097.988] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x74f60000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="uxtheme.dll") returned 0xb [0097.988] CoTaskMemFree (pv=0x5d7900) [0097.988] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0097.988] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x74f60000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\system32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll")) returned 0x1f [0097.989] CoTaskMemFree (pv=0x5d7900) [0097.989] GetModuleInformation (in: hProcess=0x304, hModule=0x752a0000, lpmodinfo=0x23369c4, cb=0xc | out: lpmodinfo=0x23369c4*(lpBaseOfDll=0x752a0000, SizeOfImage=0x7d000, EntryPoint=0x752a1140)) returned 1 [0097.989] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0097.989] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x752a0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="clrjit.dll") returned 0xa [0097.989] CoTaskMemFree (pv=0x5d7900) [0097.989] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0097.989] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x752a0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clrjit.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\clrjit.dll")) returned 0x38 [0097.990] CoTaskMemFree (pv=0x5d7900) [0097.990] GetModuleInformation (in: hProcess=0x304, hModule=0x762b0000, lpmodinfo=0x2338b04, cb=0xc | out: lpmodinfo=0x2338b04*(lpBaseOfDll=0x762b0000, SizeOfImage=0x8f000, EntryPoint=0x762b3fb1)) returned 1 [0097.990] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0097.990] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x762b0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="OLEAUT32.dll") returned 0xc [0097.991] CoTaskMemFree (pv=0x5d7900) [0097.991] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0097.991] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x762b0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\OLEAUT32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll")) returned 0x20 [0097.991] CoTaskMemFree (pv=0x5d7900) [0097.991] GetModuleInformation (in: hProcess=0x304, hModule=0x736d0000, lpmodinfo=0x233ac18, cb=0xc | out: lpmodinfo=0x233ac18*(lpBaseOfDll=0x736d0000, SizeOfImage=0x9ad000, EntryPoint=0x0)) returned 1 [0097.991] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0097.991] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x736d0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="System.ni.dll") returned 0xd [0097.992] CoTaskMemFree (pv=0x5d7900) [0097.992] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0097.992] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x736d0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System\\500ffa28b327e171fe664023003e947e\\System.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system\\500ffa28b327e171fe664023003e947e\\system.ni.dll")) returned 0x64 [0097.992] CoTaskMemFree (pv=0x5d7900) [0097.992] GetModuleInformation (in: hProcess=0x304, hModule=0x71d20000, lpmodinfo=0x233cdb4, cb=0xc | out: lpmodinfo=0x233cdb4*(lpBaseOfDll=0x71d20000, SizeOfImage=0x716000, EntryPoint=0x0)) returned 1 [0097.993] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0097.993] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x71d20000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="System.Core.ni.dll") returned 0x12 [0097.993] CoTaskMemFree (pv=0x5d7900) [0097.993] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0097.993] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x71d20000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Core\\386fde9190d499d6645df8b90eb76242\\System.Core.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.core\\386fde9190d499d6645df8b90eb76242\\system.core.ni.dll")) returned 0x6e [0097.994] CoTaskMemFree (pv=0x5d7900) [0097.994] GetModuleInformation (in: hProcess=0x304, hModule=0x750d0000, lpmodinfo=0x233ef70, cb=0xc | out: lpmodinfo=0x233ef70*(lpBaseOfDll=0x750d0000, SizeOfImage=0x1cb000, EntryPoint=0x0)) returned 1 [0097.994] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0097.994] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x750d0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="Microsoft.VisualBasic.ni.dll") returned 0x1c [0097.994] CoTaskMemFree (pv=0x5d7900) [0097.994] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0097.994] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x750d0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Microsoft.V9921e851#\\cfbddeb6e93e8f421b92229b20e51233\\Microsoft.VisualBasic.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\microsoft.v9921e851#\\cfbddeb6e93e8f421b92229b20e51233\\microsoft.visualbasic.ni.dll")) returned 0x81 [0097.995] CoTaskMemFree (pv=0x5d7900) [0097.995] GetModuleInformation (in: hProcess=0x304, hModule=0x750b0000, lpmodinfo=0x2341164, cb=0xc | out: lpmodinfo=0x2341164*(lpBaseOfDll=0x750b0000, SizeOfImage=0x13000, EntryPoint=0x750b18f0)) returned 1 [0097.995] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0097.995] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x750b0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="nlssorting.dll") returned 0xe [0097.996] CoTaskMemFree (pv=0x5d7900) [0097.996] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0097.996] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x750b0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\nlssorting.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\nlssorting.dll")) returned 0x3c [0097.996] CoTaskMemFree (pv=0x5d7900) [0097.996] GetModuleInformation (in: hProcess=0x304, hModule=0x74870000, lpmodinfo=0x23432b4, cb=0xc | out: lpmodinfo=0x23432b4*(lpBaseOfDll=0x74870000, SizeOfImage=0x16000, EntryPoint=0x74872dc3)) returned 1 [0097.997] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0097.997] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x74870000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="CRYPTSP.dll") returned 0xb [0097.997] CoTaskMemFree (pv=0x5d7900) [0097.997] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0097.997] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x74870000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\system32\\CRYPTSP.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll")) returned 0x1f [0097.998] CoTaskMemFree (pv=0x5d7900) [0097.998] GetModuleInformation (in: hProcess=0x304, hModule=0x74830000, lpmodinfo=0x23453c0, cb=0xc | out: lpmodinfo=0x23453c0*(lpBaseOfDll=0x74830000, SizeOfImage=0x3b000, EntryPoint=0x7483128d)) returned 1 [0097.998] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0097.998] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x74830000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="rsaenh.dll") returned 0xa [0097.999] CoTaskMemFree (pv=0x5d7900) [0097.999] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0097.999] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x74830000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\system32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll")) returned 0x1e [0097.999] CoTaskMemFree (pv=0x5d7900) [0097.999] GetModuleInformation (in: hProcess=0x304, hModule=0x75a60000, lpmodinfo=0x23475d8, cb=0xc | out: lpmodinfo=0x23475d8*(lpBaseOfDll=0x75a60000, SizeOfImage=0x5000, EntryPoint=0x75a61438)) returned 1 [0097.999] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0097.999] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75a60000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="psapi.dll") returned 0x9 [0098.000] CoTaskMemFree (pv=0x5d7900) [0098.000] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.000] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75a60000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\psapi.dll" (normalized: "c:\\windows\\syswow64\\psapi.dll")) returned 0x1d [0098.000] CoTaskMemFree (pv=0x5d7900) [0098.000] GetModuleInformation (in: hProcess=0x304, hModule=0x746a0000, lpmodinfo=0x23496dc, cb=0xc | out: lpmodinfo=0x23496dc*(lpBaseOfDll=0x746a0000, SizeOfImage=0x18d000, EntryPoint=0x0)) returned 1 [0098.001] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.001] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x746a0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="System.Drawing.ni.dll") returned 0x15 [0098.001] CoTaskMemFree (pv=0x5d7900) [0098.001] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.001] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x746a0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Drawing\\553c0312fdf5a5449f3649f0515e70fb\\System.Drawing.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.drawing\\553c0312fdf5a5449f3649f0515e70fb\\system.drawing.ni.dll")) returned 0x74 [0098.002] CoTaskMemFree (pv=0x5d7900) [0098.002] GetModuleInformation (in: hProcess=0x304, hModule=0x710c0000, lpmodinfo=0x234b8a8, cb=0xc | out: lpmodinfo=0x234b8a8*(lpBaseOfDll=0x710c0000, SizeOfImage=0xc58000, EntryPoint=0x0)) returned 1 [0098.003] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.003] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x710c0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="System.Windows.Forms.ni.dll") returned 0x1b [0098.003] CoTaskMemFree (pv=0x5d7900) [0098.003] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.003] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x710c0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Windows.Forms\\7a6894982f35a1d75ec73d447c583da2\\System.Windows.Forms.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.windows.forms\\7a6894982f35a1d75ec73d447c583da2\\system.windows.forms.ni.dll")) returned 0x80 [0098.004] CoTaskMemFree (pv=0x5d7900) [0098.004] CloseHandle (hObject=0x304) returned 1 [0098.014] GetCurrentProcessId () returned 0x9f8 [0098.015] EnumProcessModules (in: hProcess=0x304, lphModule=0x22475fc, cb=0x100, lpcbNeeded=0x497fd0 | out: lphModule=0x22475fc, lpcbNeeded=0x497fd0) returned 1 [0098.015] GetModuleInformation (in: hProcess=0x304, hModule=0x310000, lpmodinfo=0x224773c, cb=0xc | out: lpmodinfo=0x224773c*(lpBaseOfDll=0x310000, SizeOfImage=0x3e000, EntryPoint=0x3479ce)) returned 1 [0098.015] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.015] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x310000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="unlikexpc.exe") returned 0xd [0098.015] CoTaskMemFree (pv=0x5d7900) [0098.016] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.016] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x310000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\unlikexpc.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\unlikexpc.exe")) returned 0x33 [0098.016] CoTaskMemFree (pv=0x5d7900) [0098.016] GetModuleInformation (in: hProcess=0x304, hModule=0x77ab0000, lpmodinfo=0x2249890, cb=0xc | out: lpmodinfo=0x2249890*(lpBaseOfDll=0x77ab0000, SizeOfImage=0x180000, EntryPoint=0x0)) returned 1 [0098.016] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.016] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x77ab0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="ntdll.dll") returned 0x9 [0098.016] CoTaskMemFree (pv=0x5d7900) [0098.016] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.016] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x77ab0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll")) returned 0x1d [0098.016] CoTaskMemFree (pv=0x5d7900) [0098.016] GetModuleInformation (in: hProcess=0x304, hModule=0x754b0000, lpmodinfo=0x224b994, cb=0xc | out: lpmodinfo=0x224b994*(lpBaseOfDll=0x754b0000, SizeOfImage=0x4a000, EntryPoint=0x754b2e54)) returned 1 [0098.016] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.016] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x754b0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="MSCOREE.DLL") returned 0xb [0098.016] CoTaskMemFree (pv=0x5d7900) [0098.016] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.016] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x754b0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\MSCOREE.DLL" (normalized: "c:\\windows\\system32\\mscoree.dll")) returned 0x1f [0098.017] CoTaskMemFree (pv=0x5d7900) [0098.017] GetModuleInformation (in: hProcess=0x304, hModule=0x757c0000, lpmodinfo=0x224daa0, cb=0xc | out: lpmodinfo=0x224daa0*(lpBaseOfDll=0x757c0000, SizeOfImage=0x110000, EntryPoint=0x757d32d3)) returned 1 [0098.017] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.017] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x757c0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="KERNEL32.dll") returned 0xc [0098.017] CoTaskMemFree (pv=0x5d7900) [0098.017] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.017] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x757c0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\KERNEL32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll")) returned 0x20 [0098.017] CoTaskMemFree (pv=0x5d7900) [0098.017] GetModuleInformation (in: hProcess=0x304, hModule=0x76260000, lpmodinfo=0x224fbb4, cb=0xc | out: lpmodinfo=0x224fbb4*(lpBaseOfDll=0x76260000, SizeOfImage=0x46000, EntryPoint=0x76267478)) returned 1 [0098.017] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.017] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x76260000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="KERNELBASE.dll") returned 0xe [0098.017] CoTaskMemFree (pv=0x5d7900) [0098.017] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.017] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x76260000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\KERNELBASE.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll")) returned 0x22 [0098.018] CoTaskMemFree (pv=0x5d7900) [0098.018] GetModuleInformation (in: hProcess=0x304, hModule=0x75720000, lpmodinfo=0x2251cfc, cb=0xc | out: lpmodinfo=0x2251cfc*(lpBaseOfDll=0x75720000, SizeOfImage=0xa0000, EntryPoint=0x757349e5)) returned 1 [0098.018] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.018] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75720000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="ADVAPI32.dll") returned 0xc [0098.018] CoTaskMemFree (pv=0x5d7900) [0098.018] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.018] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75720000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\ADVAPI32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll")) returned 0x20 [0098.018] CoTaskMemFree (pv=0x5d7900) [0098.018] GetModuleInformation (in: hProcess=0x304, hModule=0x75fe0000, lpmodinfo=0x2253e10, cb=0xc | out: lpmodinfo=0x2253e10*(lpBaseOfDll=0x75fe0000, SizeOfImage=0xac000, EntryPoint=0x75fea472)) returned 1 [0098.018] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.018] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75fe0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="msvcrt.dll") returned 0xa [0098.019] CoTaskMemFree (pv=0x5d7900) [0098.019] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.019] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75fe0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll")) returned 0x1e [0098.019] CoTaskMemFree (pv=0x5d7900) [0098.019] GetModuleInformation (in: hProcess=0x304, hModule=0x761b0000, lpmodinfo=0x2255f1c, cb=0xc | out: lpmodinfo=0x2255f1c*(lpBaseOfDll=0x761b0000, SizeOfImage=0x19000, EntryPoint=0x761b4975)) returned 1 [0098.019] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.019] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x761b0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="sechost.dll") returned 0xb [0098.019] CoTaskMemFree (pv=0x5d7900) [0098.019] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.019] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x761b0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll")) returned 0x1f [0098.019] CoTaskMemFree (pv=0x5d7900) [0098.019] GetModuleInformation (in: hProcess=0x304, hModule=0x76090000, lpmodinfo=0x2258028, cb=0xc | out: lpmodinfo=0x2258028*(lpBaseOfDll=0x76090000, SizeOfImage=0xf0000, EntryPoint=0x760a0569)) returned 1 [0098.020] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.020] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x76090000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="RPCRT4.dll") returned 0xa [0098.020] CoTaskMemFree (pv=0x5d7900) [0098.020] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.020] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x76090000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\RPCRT4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll")) returned 0x1e [0098.020] CoTaskMemFree (pv=0x5d7900) [0098.020] GetModuleInformation (in: hProcess=0x304, hModule=0x75610000, lpmodinfo=0x225a180, cb=0xc | out: lpmodinfo=0x225a180*(lpBaseOfDll=0x75610000, SizeOfImage=0x60000, EntryPoint=0x7562a3b3)) returned 1 [0098.020] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.020] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75610000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="SspiCli.dll") returned 0xb [0098.021] CoTaskMemFree (pv=0x5d7900) [0098.021] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.021] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75610000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\SspiCli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll")) returned 0x1f [0098.021] CoTaskMemFree (pv=0x5d7900) [0098.021] GetModuleInformation (in: hProcess=0x304, hModule=0x75600000, lpmodinfo=0x225c28c, cb=0xc | out: lpmodinfo=0x225c28c*(lpBaseOfDll=0x75600000, SizeOfImage=0xc000, EntryPoint=0x756010e1)) returned 1 [0098.021] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.021] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75600000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="CRYPTBASE.dll") returned 0xd [0098.021] CoTaskMemFree (pv=0x5d7900) [0098.021] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.021] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75600000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\CRYPTBASE.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll")) returned 0x21 [0098.021] CoTaskMemFree (pv=0x5d7900) [0098.021] GetModuleInformation (in: hProcess=0x304, hModule=0x75430000, lpmodinfo=0x225e3a0, cb=0xc | out: lpmodinfo=0x225e3a0*(lpBaseOfDll=0x75430000, SizeOfImage=0x78000, EntryPoint=0x7543f7ba)) returned 1 [0098.022] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.022] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75430000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="mscoreei.dll") returned 0xc [0098.022] CoTaskMemFree (pv=0x5d7900) [0098.022] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.022] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75430000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscoreei.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\mscoreei.dll")) returned 0x3a [0098.022] CoTaskMemFree (pv=0x5d7900) [0098.022] GetModuleInformation (in: hProcess=0x304, hModule=0x761d0000, lpmodinfo=0x22604e8, cb=0xc | out: lpmodinfo=0x22604e8*(lpBaseOfDll=0x761d0000, SizeOfImage=0x57000, EntryPoint=0x761e9ba6)) returned 1 [0098.022] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.022] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x761d0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="SHLWAPI.dll") returned 0xb [0098.023] CoTaskMemFree (pv=0x5d7900) [0098.023] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.023] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x761d0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\SHLWAPI.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll")) returned 0x1f [0098.023] CoTaskMemFree (pv=0x5d7900) [0098.023] GetModuleInformation (in: hProcess=0x304, hModule=0x766d0000, lpmodinfo=0x22625f4, cb=0xc | out: lpmodinfo=0x22625f4*(lpBaseOfDll=0x766d0000, SizeOfImage=0x90000, EntryPoint=0x766e6343)) returned 1 [0098.023] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.023] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x766d0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="GDI32.dll") returned 0x9 [0098.023] CoTaskMemFree (pv=0x5d7900) [0098.023] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.023] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x766d0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\GDI32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll")) returned 0x1d [0098.024] CoTaskMemFree (pv=0x5d7900) [0098.024] GetModuleInformation (in: hProcess=0x304, hModule=0x775b0000, lpmodinfo=0x22646f8, cb=0xc | out: lpmodinfo=0x22646f8*(lpBaseOfDll=0x775b0000, SizeOfImage=0x100000, EntryPoint=0x775cb6ed)) returned 1 [0098.024] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.024] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x775b0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="USER32.dll") returned 0xa [0098.024] CoTaskMemFree (pv=0x5d7900) [0098.024] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.024] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x775b0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\USER32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll")) returned 0x1e [0098.025] CoTaskMemFree (pv=0x5d7900) [0098.025] GetModuleInformation (in: hProcess=0x304, hModule=0x75a70000, lpmodinfo=0x2266804, cb=0xc | out: lpmodinfo=0x2266804*(lpBaseOfDll=0x75a70000, SizeOfImage=0xa000, EntryPoint=0x75a736a0)) returned 1 [0098.025] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.025] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75a70000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="LPK.dll") returned 0x7 [0098.025] CoTaskMemFree (pv=0x5d7900) [0098.025] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.025] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75a70000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\LPK.dll" (normalized: "c:\\windows\\syswow64\\lpk.dll")) returned 0x1b [0098.025] CoTaskMemFree (pv=0x5d7900) [0098.025] GetModuleInformation (in: hProcess=0x304, hModule=0x758d0000, lpmodinfo=0x2268900, cb=0xc | out: lpmodinfo=0x2268900*(lpBaseOfDll=0x758d0000, SizeOfImage=0x9d000, EntryPoint=0x75903fd7)) returned 1 [0098.026] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.026] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x758d0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="USP10.dll") returned 0x9 [0098.026] CoTaskMemFree (pv=0x5d7900) [0098.026] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.026] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x758d0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\USP10.dll" (normalized: "c:\\windows\\syswow64\\usp10.dll")) returned 0x1d [0098.026] CoTaskMemFree (pv=0x5d7900) [0098.026] GetModuleInformation (in: hProcess=0x304, hModule=0x75f80000, lpmodinfo=0x226aa90, cb=0xc | out: lpmodinfo=0x226aa90*(lpBaseOfDll=0x75f80000, SizeOfImage=0x60000, EntryPoint=0x75f9158f)) returned 1 [0098.027] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.027] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75f80000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="IMM32.DLL") returned 0x9 [0098.027] CoTaskMemFree (pv=0x5d7900) [0098.027] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.027] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75f80000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\system32\\IMM32.DLL" (normalized: "c:\\windows\\system32\\imm32.dll")) returned 0x1d [0098.027] CoTaskMemFree (pv=0x5d7900) [0098.027] GetModuleInformation (in: hProcess=0x304, hModule=0x75ea0000, lpmodinfo=0x226cb94, cb=0xc | out: lpmodinfo=0x226cb94*(lpBaseOfDll=0x75ea0000, SizeOfImage=0xcc000, EntryPoint=0x75ea168b)) returned 1 [0098.028] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.028] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75ea0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="MSCTF.dll") returned 0x9 [0098.028] CoTaskMemFree (pv=0x5d7900) [0098.028] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.028] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75ea0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\MSCTF.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll")) returned 0x1d [0098.028] CoTaskMemFree (pv=0x5d7900) [0098.028] GetModuleInformation (in: hProcess=0x304, hModule=0x75420000, lpmodinfo=0x226ec98, cb=0xc | out: lpmodinfo=0x226ec98*(lpBaseOfDll=0x75420000, SizeOfImage=0x9000, EntryPoint=0x75421220)) returned 1 [0098.028] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.029] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75420000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="VERSION.dll") returned 0xb [0098.029] CoTaskMemFree (pv=0x5d7900) [0098.029] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.029] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75420000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\system32\\VERSION.dll" (normalized: "c:\\windows\\system32\\version.dll")) returned 0x1f [0098.029] CoTaskMemFree (pv=0x5d7900) [0098.029] GetModuleInformation (in: hProcess=0x304, hModule=0x74890000, lpmodinfo=0x2270da4, cb=0xc | out: lpmodinfo=0x2270da4*(lpBaseOfDll=0x74890000, SizeOfImage=0x6a8000, EntryPoint=0x749d7040)) returned 1 [0098.030] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.030] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x74890000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="clr.dll") returned 0x7 [0098.030] CoTaskMemFree (pv=0x5d7900) [0098.030] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.030] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x74890000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\clr.dll")) returned 0x35 [0098.030] CoTaskMemFree (pv=0x5d7900) [0098.030] GetModuleInformation (in: hProcess=0x304, hModule=0x75320000, lpmodinfo=0x2272ed4, cb=0xc | out: lpmodinfo=0x2272ed4*(lpBaseOfDll=0x75320000, SizeOfImage=0xf5000, EntryPoint=0x75374160)) returned 1 [0098.031] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.031] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75320000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="MSVCR120_CLR0400.dll") returned 0x14 [0098.031] CoTaskMemFree (pv=0x5d7900) [0098.031] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.031] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75320000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\system32\\MSVCR120_CLR0400.dll" (normalized: "c:\\windows\\system32\\msvcr120_clr0400.dll")) returned 0x28 [0098.031] CoTaskMemFree (pv=0x5d7900) [0098.031] GetModuleInformation (in: hProcess=0x304, hModule=0x72440000, lpmodinfo=0x2275008, cb=0xc | out: lpmodinfo=0x2275008*(lpBaseOfDll=0x72440000, SizeOfImage=0x122b000, EntryPoint=0x0)) returned 1 [0098.032] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.032] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x72440000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="mscorlib.ni.dll") returned 0xf [0098.032] CoTaskMemFree (pv=0x5d7900) [0098.032] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.032] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x72440000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\b7a12c4c0032847fcc6b9c710460456f\\mscorlib.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\mscorlib\\b7a12c4c0032847fcc6b9c710460456f\\mscorlib.ni.dll")) returned 0x68 [0098.032] CoTaskMemFree (pv=0x5d7900) [0098.032] GetModuleInformation (in: hProcess=0x304, hModule=0x764e0000, lpmodinfo=0x22771b0, cb=0xc | out: lpmodinfo=0x22771b0*(lpBaseOfDll=0x764e0000, SizeOfImage=0x15c000, EntryPoint=0x7652ba3d)) returned 1 [0098.033] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.033] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x764e0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="ole32.dll") returned 0x9 [0098.033] CoTaskMemFree (pv=0x5d7900) [0098.033] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.033] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x764e0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll")) returned 0x1d [0098.034] CoTaskMemFree (pv=0x5d7900) [0098.034] GetModuleInformation (in: hProcess=0x304, hModule=0x74f60000, lpmodinfo=0x22792b4, cb=0xc | out: lpmodinfo=0x22792b4*(lpBaseOfDll=0x74f60000, SizeOfImage=0x80000, EntryPoint=0x74f737c9)) returned 1 [0098.034] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.034] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x74f60000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="uxtheme.dll") returned 0xb [0098.034] CoTaskMemFree (pv=0x5d7900) [0098.034] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.034] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x74f60000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\system32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll")) returned 0x1f [0098.035] CoTaskMemFree (pv=0x5d7900) [0098.035] GetModuleInformation (in: hProcess=0x304, hModule=0x752a0000, lpmodinfo=0x227b3c0, cb=0xc | out: lpmodinfo=0x227b3c0*(lpBaseOfDll=0x752a0000, SizeOfImage=0x7d000, EntryPoint=0x752a1140)) returned 1 [0098.035] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.035] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x752a0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="clrjit.dll") returned 0xa [0098.035] CoTaskMemFree (pv=0x5d7900) [0098.035] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.036] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x752a0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clrjit.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\clrjit.dll")) returned 0x38 [0098.036] CoTaskMemFree (pv=0x5d7900) [0098.036] GetModuleInformation (in: hProcess=0x304, hModule=0x762b0000, lpmodinfo=0x227d500, cb=0xc | out: lpmodinfo=0x227d500*(lpBaseOfDll=0x762b0000, SizeOfImage=0x8f000, EntryPoint=0x762b3fb1)) returned 1 [0098.037] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.037] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x762b0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="OLEAUT32.dll") returned 0xc [0098.037] CoTaskMemFree (pv=0x5d7900) [0098.037] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.037] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x762b0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\OLEAUT32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll")) returned 0x20 [0098.037] CoTaskMemFree (pv=0x5d7900) [0098.037] GetModuleInformation (in: hProcess=0x304, hModule=0x736d0000, lpmodinfo=0x227f614, cb=0xc | out: lpmodinfo=0x227f614*(lpBaseOfDll=0x736d0000, SizeOfImage=0x9ad000, EntryPoint=0x0)) returned 1 [0098.038] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.038] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x736d0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="System.ni.dll") returned 0xd [0098.038] CoTaskMemFree (pv=0x5d7900) [0098.038] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.038] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x736d0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System\\500ffa28b327e171fe664023003e947e\\System.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system\\500ffa28b327e171fe664023003e947e\\system.ni.dll")) returned 0x64 [0098.039] CoTaskMemFree (pv=0x5d7900) [0098.039] GetModuleInformation (in: hProcess=0x304, hModule=0x71d20000, lpmodinfo=0x22817b0, cb=0xc | out: lpmodinfo=0x22817b0*(lpBaseOfDll=0x71d20000, SizeOfImage=0x716000, EntryPoint=0x0)) returned 1 [0098.039] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.039] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x71d20000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="System.Core.ni.dll") returned 0x12 [0098.040] CoTaskMemFree (pv=0x5d7900) [0098.040] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.040] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x71d20000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Core\\386fde9190d499d6645df8b90eb76242\\System.Core.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.core\\386fde9190d499d6645df8b90eb76242\\system.core.ni.dll")) returned 0x6e [0098.040] CoTaskMemFree (pv=0x5d7900) [0098.040] GetModuleInformation (in: hProcess=0x304, hModule=0x750d0000, lpmodinfo=0x228396c, cb=0xc | out: lpmodinfo=0x228396c*(lpBaseOfDll=0x750d0000, SizeOfImage=0x1cb000, EntryPoint=0x0)) returned 1 [0098.040] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.040] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x750d0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="Microsoft.VisualBasic.ni.dll") returned 0x1c [0098.041] CoTaskMemFree (pv=0x5d7900) [0098.041] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.041] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x750d0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Microsoft.V9921e851#\\cfbddeb6e93e8f421b92229b20e51233\\Microsoft.VisualBasic.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\microsoft.v9921e851#\\cfbddeb6e93e8f421b92229b20e51233\\microsoft.visualbasic.ni.dll")) returned 0x81 [0098.041] CoTaskMemFree (pv=0x5d7900) [0098.041] GetModuleInformation (in: hProcess=0x304, hModule=0x750b0000, lpmodinfo=0x2285b60, cb=0xc | out: lpmodinfo=0x2285b60*(lpBaseOfDll=0x750b0000, SizeOfImage=0x13000, EntryPoint=0x750b18f0)) returned 1 [0098.042] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.042] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x750b0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="nlssorting.dll") returned 0xe [0098.042] CoTaskMemFree (pv=0x5d7900) [0098.042] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.042] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x750b0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\nlssorting.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\nlssorting.dll")) returned 0x3c [0098.043] CoTaskMemFree (pv=0x5d7900) [0098.043] GetModuleInformation (in: hProcess=0x304, hModule=0x74870000, lpmodinfo=0x2287cb0, cb=0xc | out: lpmodinfo=0x2287cb0*(lpBaseOfDll=0x74870000, SizeOfImage=0x16000, EntryPoint=0x74872dc3)) returned 1 [0098.043] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.043] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x74870000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="CRYPTSP.dll") returned 0xb [0098.044] CoTaskMemFree (pv=0x5d7900) [0098.044] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.044] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x74870000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\system32\\CRYPTSP.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll")) returned 0x1f [0098.044] CoTaskMemFree (pv=0x5d7900) [0098.044] GetModuleInformation (in: hProcess=0x304, hModule=0x74830000, lpmodinfo=0x2289dbc, cb=0xc | out: lpmodinfo=0x2289dbc*(lpBaseOfDll=0x74830000, SizeOfImage=0x3b000, EntryPoint=0x7483128d)) returned 1 [0098.045] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.045] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x74830000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="rsaenh.dll") returned 0xa [0098.045] CoTaskMemFree (pv=0x5d7900) [0098.045] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.045] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x74830000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\system32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll")) returned 0x1e [0098.046] CoTaskMemFree (pv=0x5d7900) [0098.046] GetModuleInformation (in: hProcess=0x304, hModule=0x75a60000, lpmodinfo=0x228bfd4, cb=0xc | out: lpmodinfo=0x228bfd4*(lpBaseOfDll=0x75a60000, SizeOfImage=0x5000, EntryPoint=0x75a61438)) returned 1 [0098.046] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.046] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75a60000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="psapi.dll") returned 0x9 [0098.046] CoTaskMemFree (pv=0x5d7900) [0098.046] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.046] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75a60000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\psapi.dll" (normalized: "c:\\windows\\syswow64\\psapi.dll")) returned 0x1d [0098.047] CoTaskMemFree (pv=0x5d7900) [0098.047] GetModuleInformation (in: hProcess=0x304, hModule=0x746a0000, lpmodinfo=0x228e0d8, cb=0xc | out: lpmodinfo=0x228e0d8*(lpBaseOfDll=0x746a0000, SizeOfImage=0x18d000, EntryPoint=0x0)) returned 1 [0098.047] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.047] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x746a0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="System.Drawing.ni.dll") returned 0x15 [0098.048] CoTaskMemFree (pv=0x5d7900) [0098.048] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.048] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x746a0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Drawing\\553c0312fdf5a5449f3649f0515e70fb\\System.Drawing.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.drawing\\553c0312fdf5a5449f3649f0515e70fb\\system.drawing.ni.dll")) returned 0x74 [0098.048] CoTaskMemFree (pv=0x5d7900) [0098.048] GetModuleInformation (in: hProcess=0x304, hModule=0x710c0000, lpmodinfo=0x22902a4, cb=0xc | out: lpmodinfo=0x22902a4*(lpBaseOfDll=0x710c0000, SizeOfImage=0xc58000, EntryPoint=0x0)) returned 1 [0098.049] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.049] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x710c0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="System.Windows.Forms.ni.dll") returned 0x1b [0098.050] CoTaskMemFree (pv=0x5d7900) [0098.050] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.050] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x710c0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Windows.Forms\\7a6894982f35a1d75ec73d447c583da2\\System.Windows.Forms.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.windows.forms\\7a6894982f35a1d75ec73d447c583da2\\system.windows.forms.ni.dll")) returned 0x80 [0098.050] CoTaskMemFree (pv=0x5d7900) [0098.050] CloseHandle (hObject=0x304) returned 1 [0098.052] EnumProcessModules (in: hProcess=0x304, lphModule=0x238654c, cb=0x100, lpcbNeeded=0x497fd0 | out: lphModule=0x238654c, lpcbNeeded=0x497fd0) returned 1 [0098.052] GetModuleInformation (in: hProcess=0x304, hModule=0x310000, lpmodinfo=0x238668c, cb=0xc | out: lpmodinfo=0x238668c*(lpBaseOfDll=0x310000, SizeOfImage=0x3e000, EntryPoint=0x3479ce)) returned 1 [0098.052] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.052] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x310000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="unlikexpc.exe") returned 0xd [0098.052] CoTaskMemFree (pv=0x5d7900) [0098.052] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.052] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x310000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\unlikexpc.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\unlikexpc.exe")) returned 0x33 [0098.052] CoTaskMemFree (pv=0x5d7900) [0098.052] GetModuleInformation (in: hProcess=0x304, hModule=0x77ab0000, lpmodinfo=0x23887e0, cb=0xc | out: lpmodinfo=0x23887e0*(lpBaseOfDll=0x77ab0000, SizeOfImage=0x180000, EntryPoint=0x0)) returned 1 [0098.053] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.053] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x77ab0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="ntdll.dll") returned 0x9 [0098.053] CoTaskMemFree (pv=0x5d7900) [0098.053] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.053] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x77ab0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll")) returned 0x1d [0098.053] CoTaskMemFree (pv=0x5d7900) [0098.053] GetModuleInformation (in: hProcess=0x304, hModule=0x754b0000, lpmodinfo=0x238a8e4, cb=0xc | out: lpmodinfo=0x238a8e4*(lpBaseOfDll=0x754b0000, SizeOfImage=0x4a000, EntryPoint=0x754b2e54)) returned 1 [0098.053] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.053] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x754b0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="MSCOREE.DLL") returned 0xb [0098.053] CoTaskMemFree (pv=0x5d7900) [0098.053] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.053] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x754b0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\MSCOREE.DLL" (normalized: "c:\\windows\\system32\\mscoree.dll")) returned 0x1f [0098.053] CoTaskMemFree (pv=0x5d7900) [0098.053] GetModuleInformation (in: hProcess=0x304, hModule=0x757c0000, lpmodinfo=0x238c9f0, cb=0xc | out: lpmodinfo=0x238c9f0*(lpBaseOfDll=0x757c0000, SizeOfImage=0x110000, EntryPoint=0x757d32d3)) returned 1 [0098.053] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.053] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x757c0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="KERNEL32.dll") returned 0xc [0098.054] CoTaskMemFree (pv=0x5d7900) [0098.054] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.054] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x757c0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\KERNEL32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll")) returned 0x20 [0098.054] CoTaskMemFree (pv=0x5d7900) [0098.054] GetModuleInformation (in: hProcess=0x304, hModule=0x76260000, lpmodinfo=0x238eb04, cb=0xc | out: lpmodinfo=0x238eb04*(lpBaseOfDll=0x76260000, SizeOfImage=0x46000, EntryPoint=0x76267478)) returned 1 [0098.054] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.054] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x76260000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="KERNELBASE.dll") returned 0xe [0098.054] CoTaskMemFree (pv=0x5d7900) [0098.054] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.054] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x76260000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\KERNELBASE.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll")) returned 0x22 [0098.054] CoTaskMemFree (pv=0x5d7900) [0098.054] GetModuleInformation (in: hProcess=0x304, hModule=0x75720000, lpmodinfo=0x2390c4c, cb=0xc | out: lpmodinfo=0x2390c4c*(lpBaseOfDll=0x75720000, SizeOfImage=0xa0000, EntryPoint=0x757349e5)) returned 1 [0098.054] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.054] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75720000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="ADVAPI32.dll") returned 0xc [0098.055] CoTaskMemFree (pv=0x5d7900) [0098.055] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.055] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75720000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\ADVAPI32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll")) returned 0x20 [0098.055] CoTaskMemFree (pv=0x5d7900) [0098.055] GetModuleInformation (in: hProcess=0x304, hModule=0x75fe0000, lpmodinfo=0x2392d60, cb=0xc | out: lpmodinfo=0x2392d60*(lpBaseOfDll=0x75fe0000, SizeOfImage=0xac000, EntryPoint=0x75fea472)) returned 1 [0098.055] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.055] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75fe0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="msvcrt.dll") returned 0xa [0098.055] CoTaskMemFree (pv=0x5d7900) [0098.055] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.055] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75fe0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll")) returned 0x1e [0098.055] CoTaskMemFree (pv=0x5d7900) [0098.055] GetModuleInformation (in: hProcess=0x304, hModule=0x761b0000, lpmodinfo=0x2394e6c, cb=0xc | out: lpmodinfo=0x2394e6c*(lpBaseOfDll=0x761b0000, SizeOfImage=0x19000, EntryPoint=0x761b4975)) returned 1 [0098.056] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.056] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x761b0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="sechost.dll") returned 0xb [0098.056] CoTaskMemFree (pv=0x5d7900) [0098.056] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.056] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x761b0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll")) returned 0x1f [0098.056] CoTaskMemFree (pv=0x5d7900) [0098.056] GetModuleInformation (in: hProcess=0x304, hModule=0x76090000, lpmodinfo=0x2396f78, cb=0xc | out: lpmodinfo=0x2396f78*(lpBaseOfDll=0x76090000, SizeOfImage=0xf0000, EntryPoint=0x760a0569)) returned 1 [0098.056] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.056] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x76090000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="RPCRT4.dll") returned 0xa [0098.056] CoTaskMemFree (pv=0x5d7900) [0098.056] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.056] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x76090000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\RPCRT4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll")) returned 0x1e [0098.057] CoTaskMemFree (pv=0x5d7900) [0098.057] GetModuleInformation (in: hProcess=0x304, hModule=0x75610000, lpmodinfo=0x23990d0, cb=0xc | out: lpmodinfo=0x23990d0*(lpBaseOfDll=0x75610000, SizeOfImage=0x60000, EntryPoint=0x7562a3b3)) returned 1 [0098.057] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.057] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75610000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="SspiCli.dll") returned 0xb [0098.057] CoTaskMemFree (pv=0x5d7900) [0098.057] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.057] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75610000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\SspiCli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll")) returned 0x1f [0098.057] CoTaskMemFree (pv=0x5d7900) [0098.057] GetModuleInformation (in: hProcess=0x304, hModule=0x75600000, lpmodinfo=0x239b1dc, cb=0xc | out: lpmodinfo=0x239b1dc*(lpBaseOfDll=0x75600000, SizeOfImage=0xc000, EntryPoint=0x756010e1)) returned 1 [0098.057] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.057] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75600000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="CRYPTBASE.dll") returned 0xd [0098.058] CoTaskMemFree (pv=0x5d7900) [0098.058] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.058] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75600000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\CRYPTBASE.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll")) returned 0x21 [0098.058] CoTaskMemFree (pv=0x5d7900) [0098.058] GetModuleInformation (in: hProcess=0x304, hModule=0x75430000, lpmodinfo=0x239d2f0, cb=0xc | out: lpmodinfo=0x239d2f0*(lpBaseOfDll=0x75430000, SizeOfImage=0x78000, EntryPoint=0x7543f7ba)) returned 1 [0098.058] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.058] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75430000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="mscoreei.dll") returned 0xc [0098.058] CoTaskMemFree (pv=0x5d7900) [0098.058] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.058] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75430000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscoreei.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\mscoreei.dll")) returned 0x3a [0098.059] CoTaskMemFree (pv=0x5d7900) [0098.059] GetModuleInformation (in: hProcess=0x304, hModule=0x761d0000, lpmodinfo=0x239f438, cb=0xc | out: lpmodinfo=0x239f438*(lpBaseOfDll=0x761d0000, SizeOfImage=0x57000, EntryPoint=0x761e9ba6)) returned 1 [0098.059] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.059] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x761d0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="SHLWAPI.dll") returned 0xb [0098.059] CoTaskMemFree (pv=0x5d7900) [0098.059] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.059] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x761d0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\SHLWAPI.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll")) returned 0x1f [0098.059] CoTaskMemFree (pv=0x5d7900) [0098.059] GetModuleInformation (in: hProcess=0x304, hModule=0x766d0000, lpmodinfo=0x23a1544, cb=0xc | out: lpmodinfo=0x23a1544*(lpBaseOfDll=0x766d0000, SizeOfImage=0x90000, EntryPoint=0x766e6343)) returned 1 [0098.060] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.060] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x766d0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="GDI32.dll") returned 0x9 [0098.060] CoTaskMemFree (pv=0x5d7900) [0098.060] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.060] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x766d0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\GDI32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll")) returned 0x1d [0098.060] CoTaskMemFree (pv=0x5d7900) [0098.060] GetModuleInformation (in: hProcess=0x304, hModule=0x775b0000, lpmodinfo=0x23a3648, cb=0xc | out: lpmodinfo=0x23a3648*(lpBaseOfDll=0x775b0000, SizeOfImage=0x100000, EntryPoint=0x775cb6ed)) returned 1 [0098.061] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.061] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x775b0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="USER32.dll") returned 0xa [0098.061] CoTaskMemFree (pv=0x5d7900) [0098.061] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.061] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x775b0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\USER32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll")) returned 0x1e [0098.061] CoTaskMemFree (pv=0x5d7900) [0098.061] GetModuleInformation (in: hProcess=0x304, hModule=0x75a70000, lpmodinfo=0x23a5754, cb=0xc | out: lpmodinfo=0x23a5754*(lpBaseOfDll=0x75a70000, SizeOfImage=0xa000, EntryPoint=0x75a736a0)) returned 1 [0098.061] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.061] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75a70000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="LPK.dll") returned 0x7 [0098.062] CoTaskMemFree (pv=0x5d7900) [0098.062] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.062] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75a70000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\LPK.dll" (normalized: "c:\\windows\\syswow64\\lpk.dll")) returned 0x1b [0098.062] CoTaskMemFree (pv=0x5d7900) [0098.062] GetModuleInformation (in: hProcess=0x304, hModule=0x758d0000, lpmodinfo=0x23a7850, cb=0xc | out: lpmodinfo=0x23a7850*(lpBaseOfDll=0x758d0000, SizeOfImage=0x9d000, EntryPoint=0x75903fd7)) returned 1 [0098.062] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.062] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x758d0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="USP10.dll") returned 0x9 [0098.063] CoTaskMemFree (pv=0x5d7900) [0098.063] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.063] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x758d0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\USP10.dll" (normalized: "c:\\windows\\syswow64\\usp10.dll")) returned 0x1d [0098.063] CoTaskMemFree (pv=0x5d7900) [0098.063] GetModuleInformation (in: hProcess=0x304, hModule=0x75f80000, lpmodinfo=0x23a99e0, cb=0xc | out: lpmodinfo=0x23a99e0*(lpBaseOfDll=0x75f80000, SizeOfImage=0x60000, EntryPoint=0x75f9158f)) returned 1 [0098.063] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.063] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75f80000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="IMM32.DLL") returned 0x9 [0098.063] CoTaskMemFree (pv=0x5d7900) [0098.063] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.063] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75f80000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\system32\\IMM32.DLL" (normalized: "c:\\windows\\system32\\imm32.dll")) returned 0x1d [0098.064] CoTaskMemFree (pv=0x5d7900) [0098.064] GetModuleInformation (in: hProcess=0x304, hModule=0x75ea0000, lpmodinfo=0x23abae4, cb=0xc | out: lpmodinfo=0x23abae4*(lpBaseOfDll=0x75ea0000, SizeOfImage=0xcc000, EntryPoint=0x75ea168b)) returned 1 [0098.064] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.064] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75ea0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="MSCTF.dll") returned 0x9 [0098.064] CoTaskMemFree (pv=0x5d7900) [0098.064] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.064] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75ea0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\MSCTF.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll")) returned 0x1d [0098.065] CoTaskMemFree (pv=0x5d7900) [0098.065] GetModuleInformation (in: hProcess=0x304, hModule=0x75420000, lpmodinfo=0x23adbe8, cb=0xc | out: lpmodinfo=0x23adbe8*(lpBaseOfDll=0x75420000, SizeOfImage=0x9000, EntryPoint=0x75421220)) returned 1 [0098.065] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.065] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75420000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="VERSION.dll") returned 0xb [0098.065] CoTaskMemFree (pv=0x5d7900) [0098.065] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.065] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75420000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\system32\\VERSION.dll" (normalized: "c:\\windows\\system32\\version.dll")) returned 0x1f [0098.066] CoTaskMemFree (pv=0x5d7900) [0098.066] GetModuleInformation (in: hProcess=0x304, hModule=0x74890000, lpmodinfo=0x23afcf4, cb=0xc | out: lpmodinfo=0x23afcf4*(lpBaseOfDll=0x74890000, SizeOfImage=0x6a8000, EntryPoint=0x749d7040)) returned 1 [0098.066] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.066] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x74890000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="clr.dll") returned 0x7 [0098.066] CoTaskMemFree (pv=0x5d7900) [0098.066] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.066] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x74890000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\clr.dll")) returned 0x35 [0098.067] CoTaskMemFree (pv=0x5d7900) [0098.067] GetModuleInformation (in: hProcess=0x304, hModule=0x75320000, lpmodinfo=0x23b1e24, cb=0xc | out: lpmodinfo=0x23b1e24*(lpBaseOfDll=0x75320000, SizeOfImage=0xf5000, EntryPoint=0x75374160)) returned 1 [0098.067] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.067] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75320000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="MSVCR120_CLR0400.dll") returned 0x14 [0098.067] CoTaskMemFree (pv=0x5d7900) [0098.067] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.067] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75320000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\system32\\MSVCR120_CLR0400.dll" (normalized: "c:\\windows\\system32\\msvcr120_clr0400.dll")) returned 0x28 [0098.068] CoTaskMemFree (pv=0x5d7900) [0098.068] GetModuleInformation (in: hProcess=0x304, hModule=0x72440000, lpmodinfo=0x23b3f58, cb=0xc | out: lpmodinfo=0x23b3f58*(lpBaseOfDll=0x72440000, SizeOfImage=0x122b000, EntryPoint=0x0)) returned 1 [0098.068] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.068] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x72440000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="mscorlib.ni.dll") returned 0xf [0098.069] CoTaskMemFree (pv=0x5d7900) [0098.069] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.069] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x72440000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\b7a12c4c0032847fcc6b9c710460456f\\mscorlib.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\mscorlib\\b7a12c4c0032847fcc6b9c710460456f\\mscorlib.ni.dll")) returned 0x68 [0098.069] CoTaskMemFree (pv=0x5d7900) [0098.069] GetModuleInformation (in: hProcess=0x304, hModule=0x764e0000, lpmodinfo=0x23b6100, cb=0xc | out: lpmodinfo=0x23b6100*(lpBaseOfDll=0x764e0000, SizeOfImage=0x15c000, EntryPoint=0x7652ba3d)) returned 1 [0098.069] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.069] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x764e0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="ole32.dll") returned 0x9 [0098.070] CoTaskMemFree (pv=0x5d7900) [0098.070] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.070] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x764e0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll")) returned 0x1d [0098.070] CoTaskMemFree (pv=0x5d7900) [0098.070] GetModuleInformation (in: hProcess=0x304, hModule=0x74f60000, lpmodinfo=0x23b8204, cb=0xc | out: lpmodinfo=0x23b8204*(lpBaseOfDll=0x74f60000, SizeOfImage=0x80000, EntryPoint=0x74f737c9)) returned 1 [0098.070] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.070] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x74f60000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="uxtheme.dll") returned 0xb [0098.071] CoTaskMemFree (pv=0x5d7900) [0098.071] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.071] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x74f60000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\system32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll")) returned 0x1f [0098.071] CoTaskMemFree (pv=0x5d7900) [0098.071] GetModuleInformation (in: hProcess=0x304, hModule=0x752a0000, lpmodinfo=0x23ba310, cb=0xc | out: lpmodinfo=0x23ba310*(lpBaseOfDll=0x752a0000, SizeOfImage=0x7d000, EntryPoint=0x752a1140)) returned 1 [0098.072] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.072] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x752a0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="clrjit.dll") returned 0xa [0098.072] CoTaskMemFree (pv=0x5d7900) [0098.072] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.072] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x752a0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clrjit.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\clrjit.dll")) returned 0x38 [0098.072] CoTaskMemFree (pv=0x5d7900) [0098.072] GetModuleInformation (in: hProcess=0x304, hModule=0x762b0000, lpmodinfo=0x23bc450, cb=0xc | out: lpmodinfo=0x23bc450*(lpBaseOfDll=0x762b0000, SizeOfImage=0x8f000, EntryPoint=0x762b3fb1)) returned 1 [0098.073] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.073] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x762b0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="OLEAUT32.dll") returned 0xc [0098.073] CoTaskMemFree (pv=0x5d7900) [0098.073] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.073] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x762b0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\OLEAUT32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll")) returned 0x20 [0098.074] CoTaskMemFree (pv=0x5d7900) [0098.074] GetModuleInformation (in: hProcess=0x304, hModule=0x736d0000, lpmodinfo=0x23be564, cb=0xc | out: lpmodinfo=0x23be564*(lpBaseOfDll=0x736d0000, SizeOfImage=0x9ad000, EntryPoint=0x0)) returned 1 [0098.074] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.074] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x736d0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="System.ni.dll") returned 0xd [0098.074] CoTaskMemFree (pv=0x5d7900) [0098.074] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.074] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x736d0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System\\500ffa28b327e171fe664023003e947e\\System.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system\\500ffa28b327e171fe664023003e947e\\system.ni.dll")) returned 0x64 [0098.075] CoTaskMemFree (pv=0x5d7900) [0098.075] GetModuleInformation (in: hProcess=0x304, hModule=0x71d20000, lpmodinfo=0x23c0700, cb=0xc | out: lpmodinfo=0x23c0700*(lpBaseOfDll=0x71d20000, SizeOfImage=0x716000, EntryPoint=0x0)) returned 1 [0098.075] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.075] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x71d20000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="System.Core.ni.dll") returned 0x12 [0098.076] CoTaskMemFree (pv=0x5d7900) [0098.076] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.076] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x71d20000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Core\\386fde9190d499d6645df8b90eb76242\\System.Core.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.core\\386fde9190d499d6645df8b90eb76242\\system.core.ni.dll")) returned 0x6e [0098.076] CoTaskMemFree (pv=0x5d7900) [0098.076] GetModuleInformation (in: hProcess=0x304, hModule=0x750d0000, lpmodinfo=0x23c28bc, cb=0xc | out: lpmodinfo=0x23c28bc*(lpBaseOfDll=0x750d0000, SizeOfImage=0x1cb000, EntryPoint=0x0)) returned 1 [0098.076] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.076] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x750d0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="Microsoft.VisualBasic.ni.dll") returned 0x1c [0098.077] CoTaskMemFree (pv=0x5d7900) [0098.077] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.077] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x750d0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Microsoft.V9921e851#\\cfbddeb6e93e8f421b92229b20e51233\\Microsoft.VisualBasic.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\microsoft.v9921e851#\\cfbddeb6e93e8f421b92229b20e51233\\microsoft.visualbasic.ni.dll")) returned 0x81 [0098.077] CoTaskMemFree (pv=0x5d7900) [0098.077] GetModuleInformation (in: hProcess=0x304, hModule=0x750b0000, lpmodinfo=0x23c4ab0, cb=0xc | out: lpmodinfo=0x23c4ab0*(lpBaseOfDll=0x750b0000, SizeOfImage=0x13000, EntryPoint=0x750b18f0)) returned 1 [0098.078] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.078] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x750b0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="nlssorting.dll") returned 0xe [0098.078] CoTaskMemFree (pv=0x5d7900) [0098.078] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.078] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x750b0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\nlssorting.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\nlssorting.dll")) returned 0x3c [0098.079] CoTaskMemFree (pv=0x5d7900) [0098.079] GetModuleInformation (in: hProcess=0x304, hModule=0x74870000, lpmodinfo=0x23c6c00, cb=0xc | out: lpmodinfo=0x23c6c00*(lpBaseOfDll=0x74870000, SizeOfImage=0x16000, EntryPoint=0x74872dc3)) returned 1 [0098.079] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.079] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x74870000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="CRYPTSP.dll") returned 0xb [0098.080] CoTaskMemFree (pv=0x5d7900) [0098.080] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.080] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x74870000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\system32\\CRYPTSP.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll")) returned 0x1f [0098.080] CoTaskMemFree (pv=0x5d7900) [0098.080] GetModuleInformation (in: hProcess=0x304, hModule=0x74830000, lpmodinfo=0x23c8d0c, cb=0xc | out: lpmodinfo=0x23c8d0c*(lpBaseOfDll=0x74830000, SizeOfImage=0x3b000, EntryPoint=0x7483128d)) returned 1 [0098.081] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.081] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x74830000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="rsaenh.dll") returned 0xa [0098.081] CoTaskMemFree (pv=0x5d7900) [0098.081] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.081] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x74830000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\system32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll")) returned 0x1e [0098.082] CoTaskMemFree (pv=0x5d7900) [0098.082] GetModuleInformation (in: hProcess=0x304, hModule=0x75a60000, lpmodinfo=0x23caf24, cb=0xc | out: lpmodinfo=0x23caf24*(lpBaseOfDll=0x75a60000, SizeOfImage=0x5000, EntryPoint=0x75a61438)) returned 1 [0098.082] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.082] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75a60000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="psapi.dll") returned 0x9 [0098.082] CoTaskMemFree (pv=0x5d7900) [0098.082] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.083] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75a60000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\psapi.dll" (normalized: "c:\\windows\\syswow64\\psapi.dll")) returned 0x1d [0098.083] CoTaskMemFree (pv=0x5d7900) [0098.083] GetModuleInformation (in: hProcess=0x304, hModule=0x746a0000, lpmodinfo=0x23cd028, cb=0xc | out: lpmodinfo=0x23cd028*(lpBaseOfDll=0x746a0000, SizeOfImage=0x18d000, EntryPoint=0x0)) returned 1 [0098.083] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.083] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x746a0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="System.Drawing.ni.dll") returned 0x15 [0098.084] CoTaskMemFree (pv=0x5d7900) [0098.084] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.084] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x746a0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Drawing\\553c0312fdf5a5449f3649f0515e70fb\\System.Drawing.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.drawing\\553c0312fdf5a5449f3649f0515e70fb\\system.drawing.ni.dll")) returned 0x74 [0098.084] CoTaskMemFree (pv=0x5d7900) [0098.084] GetModuleInformation (in: hProcess=0x304, hModule=0x710c0000, lpmodinfo=0x23cf1f4, cb=0xc | out: lpmodinfo=0x23cf1f4*(lpBaseOfDll=0x710c0000, SizeOfImage=0xc58000, EntryPoint=0x0)) returned 1 [0098.085] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.085] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x710c0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="System.Windows.Forms.ni.dll") returned 0x1b [0098.085] CoTaskMemFree (pv=0x5d7900) [0098.085] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.085] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x710c0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Windows.Forms\\7a6894982f35a1d75ec73d447c583da2\\System.Windows.Forms.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.windows.forms\\7a6894982f35a1d75ec73d447c583da2\\system.windows.forms.ni.dll")) returned 0x80 [0098.086] CoTaskMemFree (pv=0x5d7900) [0098.086] CloseHandle (hObject=0x304) returned 1 [0098.088] EnumProcessModules (in: hProcess=0x304, lphModule=0x22cbc48, cb=0x100, lpcbNeeded=0x497fd0 | out: lphModule=0x22cbc48, lpcbNeeded=0x497fd0) returned 1 [0098.089] GetModuleInformation (in: hProcess=0x304, hModule=0x310000, lpmodinfo=0x22cbd88, cb=0xc | out: lpmodinfo=0x22cbd88*(lpBaseOfDll=0x310000, SizeOfImage=0x3e000, EntryPoint=0x3479ce)) returned 1 [0098.089] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.089] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x310000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="unlikexpc.exe") returned 0xd [0098.089] CoTaskMemFree (pv=0x5d7900) [0098.089] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.089] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x310000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\unlikexpc.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\unlikexpc.exe")) returned 0x33 [0098.089] CoTaskMemFree (pv=0x5d7900) [0098.089] GetModuleInformation (in: hProcess=0x304, hModule=0x77ab0000, lpmodinfo=0x22cdedc, cb=0xc | out: lpmodinfo=0x22cdedc*(lpBaseOfDll=0x77ab0000, SizeOfImage=0x180000, EntryPoint=0x0)) returned 1 [0098.089] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.089] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x77ab0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="ntdll.dll") returned 0x9 [0098.089] CoTaskMemFree (pv=0x5d7900) [0098.089] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.089] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x77ab0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll")) returned 0x1d [0098.090] CoTaskMemFree (pv=0x5d7900) [0098.090] GetModuleInformation (in: hProcess=0x304, hModule=0x754b0000, lpmodinfo=0x22cffe0, cb=0xc | out: lpmodinfo=0x22cffe0*(lpBaseOfDll=0x754b0000, SizeOfImage=0x4a000, EntryPoint=0x754b2e54)) returned 1 [0098.090] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.090] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x754b0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="MSCOREE.DLL") returned 0xb [0098.090] CoTaskMemFree (pv=0x5d7900) [0098.090] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.090] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x754b0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\MSCOREE.DLL" (normalized: "c:\\windows\\system32\\mscoree.dll")) returned 0x1f [0098.090] CoTaskMemFree (pv=0x5d7900) [0098.090] GetModuleInformation (in: hProcess=0x304, hModule=0x757c0000, lpmodinfo=0x22d20ec, cb=0xc | out: lpmodinfo=0x22d20ec*(lpBaseOfDll=0x757c0000, SizeOfImage=0x110000, EntryPoint=0x757d32d3)) returned 1 [0098.090] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.090] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x757c0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="KERNEL32.dll") returned 0xc [0098.090] CoTaskMemFree (pv=0x5d7900) [0098.090] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.090] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x757c0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\KERNEL32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll")) returned 0x20 [0098.090] CoTaskMemFree (pv=0x5d7900) [0098.090] GetModuleInformation (in: hProcess=0x304, hModule=0x76260000, lpmodinfo=0x22d4200, cb=0xc | out: lpmodinfo=0x22d4200*(lpBaseOfDll=0x76260000, SizeOfImage=0x46000, EntryPoint=0x76267478)) returned 1 [0098.091] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.091] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x76260000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="KERNELBASE.dll") returned 0xe [0098.091] CoTaskMemFree (pv=0x5d7900) [0098.091] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.091] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x76260000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\KERNELBASE.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll")) returned 0x22 [0098.091] CoTaskMemFree (pv=0x5d7900) [0098.091] GetModuleInformation (in: hProcess=0x304, hModule=0x75720000, lpmodinfo=0x22d6348, cb=0xc | out: lpmodinfo=0x22d6348*(lpBaseOfDll=0x75720000, SizeOfImage=0xa0000, EntryPoint=0x757349e5)) returned 1 [0098.091] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.091] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75720000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="ADVAPI32.dll") returned 0xc [0098.091] CoTaskMemFree (pv=0x5d7900) [0098.091] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.091] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75720000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\ADVAPI32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll")) returned 0x20 [0098.091] CoTaskMemFree (pv=0x5d7900) [0098.091] GetModuleInformation (in: hProcess=0x304, hModule=0x75fe0000, lpmodinfo=0x22d845c, cb=0xc | out: lpmodinfo=0x22d845c*(lpBaseOfDll=0x75fe0000, SizeOfImage=0xac000, EntryPoint=0x75fea472)) returned 1 [0098.092] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.092] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75fe0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="msvcrt.dll") returned 0xa [0098.092] CoTaskMemFree (pv=0x5d7900) [0098.092] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.092] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75fe0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll")) returned 0x1e [0098.092] CoTaskMemFree (pv=0x5d7900) [0098.092] GetModuleInformation (in: hProcess=0x304, hModule=0x761b0000, lpmodinfo=0x22da568, cb=0xc | out: lpmodinfo=0x22da568*(lpBaseOfDll=0x761b0000, SizeOfImage=0x19000, EntryPoint=0x761b4975)) returned 1 [0098.092] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.092] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x761b0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="sechost.dll") returned 0xb [0098.092] CoTaskMemFree (pv=0x5d7900) [0098.092] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.092] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x761b0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll")) returned 0x1f [0098.093] CoTaskMemFree (pv=0x5d7900) [0098.093] GetModuleInformation (in: hProcess=0x304, hModule=0x76090000, lpmodinfo=0x22dc674, cb=0xc | out: lpmodinfo=0x22dc674*(lpBaseOfDll=0x76090000, SizeOfImage=0xf0000, EntryPoint=0x760a0569)) returned 1 [0098.093] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.093] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x76090000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="RPCRT4.dll") returned 0xa [0098.093] CoTaskMemFree (pv=0x5d7900) [0098.093] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.093] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x76090000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\RPCRT4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll")) returned 0x1e [0098.093] CoTaskMemFree (pv=0x5d7900) [0098.093] GetModuleInformation (in: hProcess=0x304, hModule=0x75610000, lpmodinfo=0x22de7cc, cb=0xc | out: lpmodinfo=0x22de7cc*(lpBaseOfDll=0x75610000, SizeOfImage=0x60000, EntryPoint=0x7562a3b3)) returned 1 [0098.093] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.093] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75610000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="SspiCli.dll") returned 0xb [0098.094] CoTaskMemFree (pv=0x5d7900) [0098.094] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.094] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75610000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\SspiCli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll")) returned 0x1f [0098.094] CoTaskMemFree (pv=0x5d7900) [0098.094] GetModuleInformation (in: hProcess=0x304, hModule=0x75600000, lpmodinfo=0x22e08d8, cb=0xc | out: lpmodinfo=0x22e08d8*(lpBaseOfDll=0x75600000, SizeOfImage=0xc000, EntryPoint=0x756010e1)) returned 1 [0098.094] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.094] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75600000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="CRYPTBASE.dll") returned 0xd [0098.094] CoTaskMemFree (pv=0x5d7900) [0098.094] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.094] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75600000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\CRYPTBASE.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll")) returned 0x21 [0098.095] CoTaskMemFree (pv=0x5d7900) [0098.095] GetModuleInformation (in: hProcess=0x304, hModule=0x75430000, lpmodinfo=0x22e29ec, cb=0xc | out: lpmodinfo=0x22e29ec*(lpBaseOfDll=0x75430000, SizeOfImage=0x78000, EntryPoint=0x7543f7ba)) returned 1 [0098.095] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.095] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75430000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="mscoreei.dll") returned 0xc [0098.095] CoTaskMemFree (pv=0x5d7900) [0098.095] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.095] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75430000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscoreei.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\mscoreei.dll")) returned 0x3a [0098.095] CoTaskMemFree (pv=0x5d7900) [0098.095] GetModuleInformation (in: hProcess=0x304, hModule=0x761d0000, lpmodinfo=0x22e4b34, cb=0xc | out: lpmodinfo=0x22e4b34*(lpBaseOfDll=0x761d0000, SizeOfImage=0x57000, EntryPoint=0x761e9ba6)) returned 1 [0098.096] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.096] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x761d0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="SHLWAPI.dll") returned 0xb [0098.096] CoTaskMemFree (pv=0x5d7900) [0098.096] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.096] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x761d0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\SHLWAPI.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll")) returned 0x1f [0098.096] CoTaskMemFree (pv=0x5d7900) [0098.096] GetModuleInformation (in: hProcess=0x304, hModule=0x766d0000, lpmodinfo=0x22e6c40, cb=0xc | out: lpmodinfo=0x22e6c40*(lpBaseOfDll=0x766d0000, SizeOfImage=0x90000, EntryPoint=0x766e6343)) returned 1 [0098.096] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.096] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x766d0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="GDI32.dll") returned 0x9 [0098.097] CoTaskMemFree (pv=0x5d7900) [0098.097] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.097] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x766d0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\GDI32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll")) returned 0x1d [0098.097] CoTaskMemFree (pv=0x5d7900) [0098.097] GetModuleInformation (in: hProcess=0x304, hModule=0x775b0000, lpmodinfo=0x22e8d44, cb=0xc | out: lpmodinfo=0x22e8d44*(lpBaseOfDll=0x775b0000, SizeOfImage=0x100000, EntryPoint=0x775cb6ed)) returned 1 [0098.097] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.097] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x775b0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="USER32.dll") returned 0xa [0098.097] CoTaskMemFree (pv=0x5d7900) [0098.097] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.097] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x775b0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\USER32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll")) returned 0x1e [0098.098] CoTaskMemFree (pv=0x5d7900) [0098.098] GetModuleInformation (in: hProcess=0x304, hModule=0x75a70000, lpmodinfo=0x22eae50, cb=0xc | out: lpmodinfo=0x22eae50*(lpBaseOfDll=0x75a70000, SizeOfImage=0xa000, EntryPoint=0x75a736a0)) returned 1 [0098.098] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.098] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75a70000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="LPK.dll") returned 0x7 [0098.098] CoTaskMemFree (pv=0x5d7900) [0098.098] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.098] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75a70000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\LPK.dll" (normalized: "c:\\windows\\syswow64\\lpk.dll")) returned 0x1b [0098.099] CoTaskMemFree (pv=0x5d7900) [0098.099] GetModuleInformation (in: hProcess=0x304, hModule=0x758d0000, lpmodinfo=0x22ecf4c, cb=0xc | out: lpmodinfo=0x22ecf4c*(lpBaseOfDll=0x758d0000, SizeOfImage=0x9d000, EntryPoint=0x75903fd7)) returned 1 [0098.099] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.099] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x758d0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="USP10.dll") returned 0x9 [0098.099] CoTaskMemFree (pv=0x5d7900) [0098.099] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x758d0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\USP10.dll" (normalized: "c:\\windows\\syswow64\\usp10.dll")) returned 0x1d [0098.100] GetModuleInformation (in: hProcess=0x304, hModule=0x75f80000, lpmodinfo=0x22ef0dc, cb=0xc | out: lpmodinfo=0x22ef0dc*(lpBaseOfDll=0x75f80000, SizeOfImage=0x60000, EntryPoint=0x75f9158f)) returned 1 [0098.100] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75f80000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="IMM32.DLL") returned 0x9 [0098.100] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75f80000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\system32\\IMM32.DLL" (normalized: "c:\\windows\\system32\\imm32.dll")) returned 0x1d [0098.100] GetModuleInformation (in: hProcess=0x304, hModule=0x75ea0000, lpmodinfo=0x22f11e0, cb=0xc | out: lpmodinfo=0x22f11e0*(lpBaseOfDll=0x75ea0000, SizeOfImage=0xcc000, EntryPoint=0x75ea168b)) returned 1 [0098.101] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75ea0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="MSCTF.dll") returned 0x9 [0098.101] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75ea0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\MSCTF.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll")) returned 0x1d [0098.101] GetModuleInformation (in: hProcess=0x304, hModule=0x75420000, lpmodinfo=0x22f32e4, cb=0xc | out: lpmodinfo=0x22f32e4*(lpBaseOfDll=0x75420000, SizeOfImage=0x9000, EntryPoint=0x75421220)) returned 1 [0098.102] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75420000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="VERSION.dll") returned 0xb [0098.102] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75420000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\system32\\VERSION.dll" (normalized: "c:\\windows\\system32\\version.dll")) returned 0x1f [0098.102] GetModuleInformation (in: hProcess=0x304, hModule=0x74890000, lpmodinfo=0x22f53f0, cb=0xc | out: lpmodinfo=0x22f53f0*(lpBaseOfDll=0x74890000, SizeOfImage=0x6a8000, EntryPoint=0x749d7040)) returned 1 [0098.102] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x74890000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="clr.dll") returned 0x7 [0098.103] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x74890000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\clr.dll")) returned 0x35 [0098.103] GetModuleInformation (in: hProcess=0x304, hModule=0x75320000, lpmodinfo=0x22f7520, cb=0xc | out: lpmodinfo=0x22f7520*(lpBaseOfDll=0x75320000, SizeOfImage=0xf5000, EntryPoint=0x75374160)) returned 1 [0098.103] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75320000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="MSVCR120_CLR0400.dll") returned 0x14 [0098.104] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75320000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\system32\\MSVCR120_CLR0400.dll" (normalized: "c:\\windows\\system32\\msvcr120_clr0400.dll")) returned 0x28 [0098.104] GetModuleInformation (in: hProcess=0x304, hModule=0x72440000, lpmodinfo=0x22f9654, cb=0xc | out: lpmodinfo=0x22f9654*(lpBaseOfDll=0x72440000, SizeOfImage=0x122b000, EntryPoint=0x0)) returned 1 [0098.104] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x72440000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="mscorlib.ni.dll") returned 0xf [0098.105] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x72440000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\b7a12c4c0032847fcc6b9c710460456f\\mscorlib.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\mscorlib\\b7a12c4c0032847fcc6b9c710460456f\\mscorlib.ni.dll")) returned 0x68 [0098.105] GetModuleInformation (in: hProcess=0x304, hModule=0x764e0000, lpmodinfo=0x22fb7fc, cb=0xc | out: lpmodinfo=0x22fb7fc*(lpBaseOfDll=0x764e0000, SizeOfImage=0x15c000, EntryPoint=0x7652ba3d)) returned 1 [0098.105] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x764e0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="ole32.dll") returned 0x9 [0098.106] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x764e0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll")) returned 0x1d [0098.106] GetModuleInformation (in: hProcess=0x304, hModule=0x74f60000, lpmodinfo=0x22fd900, cb=0xc | out: lpmodinfo=0x22fd900*(lpBaseOfDll=0x74f60000, SizeOfImage=0x80000, EntryPoint=0x74f737c9)) returned 1 [0098.106] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x74f60000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="uxtheme.dll") returned 0xb [0098.107] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x74f60000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\system32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll")) returned 0x1f [0098.107] GetModuleInformation (in: hProcess=0x304, hModule=0x752a0000, lpmodinfo=0x22ffa0c, cb=0xc | out: lpmodinfo=0x22ffa0c*(lpBaseOfDll=0x752a0000, SizeOfImage=0x7d000, EntryPoint=0x752a1140)) returned 1 [0098.108] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x752a0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="clrjit.dll") returned 0xa [0098.108] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x752a0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clrjit.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\clrjit.dll")) returned 0x38 [0098.108] GetModuleInformation (in: hProcess=0x304, hModule=0x762b0000, lpmodinfo=0x2301b4c, cb=0xc | out: lpmodinfo=0x2301b4c*(lpBaseOfDll=0x762b0000, SizeOfImage=0x8f000, EntryPoint=0x762b3fb1)) returned 1 [0098.109] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x762b0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="OLEAUT32.dll") returned 0xc [0098.109] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x762b0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\OLEAUT32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll")) returned 0x20 [0098.109] GetModuleInformation (in: hProcess=0x304, hModule=0x736d0000, lpmodinfo=0x2303c60, cb=0xc | out: lpmodinfo=0x2303c60*(lpBaseOfDll=0x736d0000, SizeOfImage=0x9ad000, EntryPoint=0x0)) returned 1 [0098.110] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x736d0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="System.ni.dll") returned 0xd [0098.110] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x736d0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System\\500ffa28b327e171fe664023003e947e\\System.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system\\500ffa28b327e171fe664023003e947e\\system.ni.dll")) returned 0x64 [0098.111] GetModuleInformation (in: hProcess=0x304, hModule=0x71d20000, lpmodinfo=0x2305dfc, cb=0xc | out: lpmodinfo=0x2305dfc*(lpBaseOfDll=0x71d20000, SizeOfImage=0x716000, EntryPoint=0x0)) returned 1 [0098.111] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x71d20000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="System.Core.ni.dll") returned 0x12 [0098.112] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x71d20000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Core\\386fde9190d499d6645df8b90eb76242\\System.Core.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.core\\386fde9190d499d6645df8b90eb76242\\system.core.ni.dll")) returned 0x6e [0098.112] GetModuleInformation (in: hProcess=0x304, hModule=0x750d0000, lpmodinfo=0x2307fb8, cb=0xc | out: lpmodinfo=0x2307fb8*(lpBaseOfDll=0x750d0000, SizeOfImage=0x1cb000, EntryPoint=0x0)) returned 1 [0098.112] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x750d0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="Microsoft.VisualBasic.ni.dll") returned 0x1c [0098.113] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x750d0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Microsoft.V9921e851#\\cfbddeb6e93e8f421b92229b20e51233\\Microsoft.VisualBasic.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\microsoft.v9921e851#\\cfbddeb6e93e8f421b92229b20e51233\\microsoft.visualbasic.ni.dll")) returned 0x81 [0098.113] GetModuleInformation (in: hProcess=0x304, hModule=0x750b0000, lpmodinfo=0x230a1ac, cb=0xc | out: lpmodinfo=0x230a1ac*(lpBaseOfDll=0x750b0000, SizeOfImage=0x13000, EntryPoint=0x750b18f0)) returned 1 [0098.114] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x750b0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="nlssorting.dll") returned 0xe [0098.114] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x750b0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\nlssorting.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\nlssorting.dll")) returned 0x3c [0098.114] GetModuleInformation (in: hProcess=0x304, hModule=0x74870000, lpmodinfo=0x230c2fc, cb=0xc | out: lpmodinfo=0x230c2fc*(lpBaseOfDll=0x74870000, SizeOfImage=0x16000, EntryPoint=0x74872dc3)) returned 1 [0098.115] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x74870000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="CRYPTSP.dll") returned 0xb [0098.115] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x74870000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\system32\\CRYPTSP.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll")) returned 0x1f [0098.116] GetModuleInformation (in: hProcess=0x304, hModule=0x74830000, lpmodinfo=0x230e408, cb=0xc | out: lpmodinfo=0x230e408*(lpBaseOfDll=0x74830000, SizeOfImage=0x3b000, EntryPoint=0x7483128d)) returned 1 [0098.116] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x74830000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="rsaenh.dll") returned 0xa [0098.117] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x74830000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\system32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll")) returned 0x1e [0098.117] GetModuleInformation (in: hProcess=0x304, hModule=0x75a60000, lpmodinfo=0x2310620, cb=0xc | out: lpmodinfo=0x2310620*(lpBaseOfDll=0x75a60000, SizeOfImage=0x5000, EntryPoint=0x75a61438)) returned 1 [0098.117] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75a60000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="psapi.dll") returned 0x9 [0098.118] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75a60000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\psapi.dll" (normalized: "c:\\windows\\syswow64\\psapi.dll")) returned 0x1d [0098.118] GetModuleInformation (in: hProcess=0x304, hModule=0x746a0000, lpmodinfo=0x2312724, cb=0xc | out: lpmodinfo=0x2312724*(lpBaseOfDll=0x746a0000, SizeOfImage=0x18d000, EntryPoint=0x0)) returned 1 [0098.119] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x746a0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="System.Drawing.ni.dll") returned 0x15 [0098.119] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x746a0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Drawing\\553c0312fdf5a5449f3649f0515e70fb\\System.Drawing.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.drawing\\553c0312fdf5a5449f3649f0515e70fb\\system.drawing.ni.dll")) returned 0x74 [0098.120] GetModuleInformation (in: hProcess=0x304, hModule=0x710c0000, lpmodinfo=0x23148f0, cb=0xc | out: lpmodinfo=0x23148f0*(lpBaseOfDll=0x710c0000, SizeOfImage=0xc58000, EntryPoint=0x0)) returned 1 [0098.120] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x710c0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="System.Windows.Forms.ni.dll") returned 0x1b [0098.121] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x710c0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Windows.Forms\\7a6894982f35a1d75ec73d447c583da2\\System.Windows.Forms.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.windows.forms\\7a6894982f35a1d75ec73d447c583da2\\system.windows.forms.ni.dll")) returned 0x80 [0098.123] lstrcpynA (in: lpString1=0x498834, lpString2="sn??????JC????NsMxm?W?s??TFDrD?UB?g??c", iMaxLength=23 | out: lpString1="sn??????JC????NsMxm?W?") returned="sn??????JC????NsMxm?W?" [0098.123] lstrcpynA (in: lpString1=0x498834, lpString2="h?dE??Q?C???k?fh?vn??t??tyK??Y?J??CY", iMaxLength=13 | out: lpString1="h?dE??Q?C???") returned="h?dE??Q?C???" [0098.123] lstrcpynA (in: lpString1=0x498810, lpString2="dX??Z?P??B?B??Nsu?m?WNajG??Yl???????fozx??Ug?j???Am?????S?L??yC????xh???X", iMaxLength=3 | out: lpString1="dX") returned="dX" [0098.123] lstrcpynA (in: lpString1=0x498848, lpString2="??n?p????n???mD?", iMaxLength=5 | out: lpString1="??n?") returned="??n?" [0098.123] lstrcpynA (in: lpString1=0x498830, lpString2="???G???DWX?wd?HQci?Q?u??pnU??Pd?n?????YIY?", iMaxLength=17 | out: lpString1="???G???DWX?wd?HQ") returned="???G???DWX?wd?HQ" [0098.123] lstrcpynA (in: lpString1=0x498814, lpString2="?F?d?E??????YF????O??d??OA???y?orJG?????R?jr?y???V??P???Ze?b??????????r", iMaxLength=8 | out: lpString1="?F?d?E?") returned="?F?d?E?" [0098.124] lstrcpynA (in: lpString1=0x498828, lpString2="a??lR????vc?i??????VTvAh?x??xZ?F?????????E??????Vu", iMaxLength=11 | out: lpString1="a??lR????v") returned="a??lR????v" [0098.124] lstrcpynA (in: lpString1=0x49884c, lpString2="R?", iMaxLength=1 | out: lpString1="") returned="" [0098.124] lstrcpynA (in: lpString1=0x49884c, lpString2="t??lN????", iMaxLength=7 | out: lpString1="t??lN?") returned="t??lN?" [0098.124] lstrcpynA (in: lpString1=0x498844, lpString2="g?rb?C?JW?hcC??m?j???", iMaxLength=10 | out: lpString1="g?rb?C?JW") returned="g?rb?C?JW" [0098.124] lstrcpynA (in: lpString1=0x498808, lpString2="m?pm???RkVbQ??XQ??C??riyL??BP??xKJ???kK?z?YL??RkYM??Rb?v?y?b???V?r?G??S?N?Oy??LXV?z", iMaxLength=72 | out: lpString1="m?pm???RkVbQ??XQ??C??riyL??BP??xKJ???kK?z?YL??RkYM??Rb?v?y?b???V?r?G??S") returned="m?pm???RkVbQ??XQ??C??riyL??BP??xKJ???kK?z?YL??RkYM??Rb?v?y?b???V?r?G??S" [0098.124] lstrcpynA (in: lpString1=0x4987fc, lpString2="x?U??Ac??????j??VhzQ???Nj????LaN?d??Tg?IR??i?u?T??????vT???m?X?R?B???oHO???zE??s?vU??F???NcB", iMaxLength=47 | out: lpString1="x?U??Ac??????j??VhzQ???Nj????LaN?d??Tg?IR??i?u") returned="x?U??Ac??????j??VhzQ???Nj????LaN?d??Tg?IR??i?u" [0098.124] lstrcpynA (in: lpString1=0x498804, lpString2="dBk?jm?M??o??re?A?P?g??????e?????gi??i??K??zU?g?VIf????c???x?????????bUR??AI??Pg?????", iMaxLength=66 | out: lpString1="dBk?jm?M??o??re?A?P?g??????e?????gi??i??K??zU?g?VIf????c???x?????") returned="dBk?jm?M??o??re?A?P?g??????e?????gi??i??K??zU?g?VIf????c???x?????" [0098.124] lstrcpynA (in: lpString1=0x498834, lpString2="?tiZ?s?UL??QB?Qe?NSN?RDU?S?b???s?Aszm?", iMaxLength=30 | out: lpString1="?tiZ?s?UL??QB?Qe?NSN?RDU?S?b?") returned="?tiZ?s?UL??QB?Qe?NSN?RDU?S?b?" [0098.124] lstrcpynA (in: lpString1=0x49884c, lpString2="?", iMaxLength=1 | out: lpString1="") returned="" [0098.124] lstrcpynA (in: lpString1=0x498830, lpString2="?Z??HbO??????nKS????g?i?w?????G???d?J???ML?", iMaxLength=20 | out: lpString1="?Z??HbO??????nKS???") returned="?Z??HbO??????nKS???" [0098.124] lstrcpynA (in: lpString1=0x498838, lpString2="PJ??BaCA?F???Z???Jzb?f???e?u?L?J", iMaxLength=31 | out: lpString1="PJ??BaCA?F???Z???Jzb?f???e?u?L") returned="PJ??BaCA?F???Z???Jzb?f???e?u?L" [0098.124] lstrcpynA (in: lpString1=0x498838, lpString2="????R?k????????fY??b??mVBH???M?L?", iMaxLength=9 | out: lpString1="????R?k?") returned="????R?k?" [0098.124] lstrcpynA (in: lpString1=0x49882c, lpString2="??w?aX?lln???sz?S?e??g????g????zP????Q?GGTYk", iMaxLength=32 | out: lpString1="??w?aX?lln???sz?S?e??g????g????") returned="??w?aX?lln???sz?S?e??g????g????" [0098.124] lstrcpynA (in: lpString1=0x498838, lpString2="????????iwVGU????????O?s??xE??T???a", iMaxLength=24 | out: lpString1="????????iwVGU????????O?") returned="????????iwVGU????????O?" [0098.124] lstrcpynA (in: lpString1=0x49882c, lpString2="??j???KoK???ok??????u???A????????E?dS?gIM???", iMaxLength=5 | out: lpString1="??j?") returned="??j?" [0098.124] lstrcpynA (in: lpString1=0x498814, lpString2="t?????Xpr???R????Y??cG?i?v?M?u?a????DW????p??jy?yDi??K??A??CB?G??BBZ??", iMaxLength=11 | out: lpString1="t?????Xpr?") returned="t?????Xpr?" [0098.124] lstrcpynA (in: lpString1=0x498804, lpString2="?IY?s?k?XC???vFzA?P????d????Isx???CRV?VRY????n?Wi??Do?Xp?z????UAWAT??s??Vim?F?h?????M", iMaxLength=72 | out: lpString1="?IY?s?k?XC???vFzA?P????d????Isx???CRV?VRY????n?Wi??Do?Xp?z????UAWAT??s?") returned="?IY?s?k?XC???vFzA?P????d????Isx???CRV?VRY????n?Wi??Do?Xp?z????UAWAT??s?" [0098.124] lstrcpynA (in: lpString1=0x498840, lpString2="D?R??I??T????M????e???hyp?", iMaxLength=12 | out: lpString1="D?R??I??T??") returned="D?R??I??T??" [0098.125] lstrcpynA (in: lpString1=0x498804, lpString2="Z?????????Mea????u?y??????Lm?t??sZD?WY?ZR?KRT??E?OpNU?F?d?b?bIR?????????pE???H???k?V?L", iMaxLength=52 | out: lpString1="Z?????????Mea????u?y??????Lm?t??sZD?WY?ZR?KRT??E?Op") returned="Z?????????Mea????u?y??????Lm?t??sZD?WY?ZR?KRT??E?Op" [0098.125] lstrcpynA (in: lpString1=0x498800, lpString2="?Joab???I????f??Jy????I??i?????I???v??y???p??????Ce??I?ha?djP?P???F???fL???v?L?u?kxl?CPH", iMaxLength=61 | out: lpString1="?Joab???I????f??Jy????I??i?????I???v??y???p??????Ce??I?ha?dj") returned="?Joab???I????f??Jy????I??i?????I???v??y???p??????Ce??I?ha?dj" [0098.125] lstrcpynA (in: lpString1=0x498800, lpString2="????XLvR??rgO??kZ????i?z?kgAU?Pr?m?sA??OvM?hhu???z??rXr?JKPTT???z??al???ez?N?Vt?Iv?geV?iv", iMaxLength=59 | out: lpString1="????XLvR??rgO??kZ????i?z?kgAU?Pr?m?sA??OvM?hhu???z??rXr?JK") returned="????XLvR??rgO??kZ????i?z?kgAU?Pr?m?sA??OvM?hhu???z??rXr?JK" [0098.125] lstrcpynA (in: lpString1=0x49881c, lpString2="?yP???hZ??HD?????m?F??oV???w???????hm????Y?Vg???jc?????????Q", iMaxLength=13 | out: lpString1="?yP???hZ??HD") returned="?yP???hZ??HD" [0098.125] lstrcpynA (in: lpString1=0x498800, lpString2="P?M?X???N?NL??Ouom?NPt?U??lSD?W???f?J?kZ??rYc?dA??lwTG?Y?z???GA?U??????fo??Hw?dJ????VW?k", iMaxLength=4 | out: lpString1="P?M") returned="P?M" [0098.125] lstrcpynA (in: lpString1=0x498844, lpString2="A??x?l???T???u??BWY?", iMaxLength=2 | out: lpString1="A") returned="A" [0098.125] lstrcpynA (in: lpString1=0x498810, lpString2="???yj??????C????????a??JP????wjtwo?a??L??u?ZT?d??Vz??f???s?Ztwh?K?C?b?l?b?", iMaxLength=8 | out: lpString1="???yj??") returned="???yj??" [0098.125] lstrcpynA (in: lpString1=0x498828, lpString2="f??uOx??V?C?X?n????or?h???TZI?w??b??????t?H?nKR??", iMaxLength=10 | out: lpString1="f??uOx??V") returned="f??uOx??V" [0098.125] lstrcpynA (in: lpString1=0x49884c, lpString2="????z?V??K??", iMaxLength=9 | out: lpString1="????z?V?") returned="????z?V?" [0098.125] lstrcpynA (in: lpString1=0x49881c, lpString2="WR???yAk?Uf???puG???LF?VPu?G??BOu?G???l?z?r???b?P??Im?E???N??", iMaxLength=59 | out: lpString1="WR???yAk?Uf???puG???LF?VPu?G??BOu?G???l?z?r???b?P??Im?E???") returned="WR???yAk?Uf???puG???LF?VPu?G??BOu?G???l?z?r???b?P??Im?E???" [0098.125] lstrcpynA (in: lpString1=0x498804, lpString2="????gkVHe??S?????yAsja???IZ?RZbkyr?nVvcHg?b?G????i??t????dw???f?K?I?PA?????n??H?P??b?Y", iMaxLength=10 | out: lpString1="????gkVHe") returned="????gkVHe" [0098.125] lstrcpynA (in: lpString1=0x498800, lpString2="mAcG?n????OAU???pp???A?g??G??d?kJZdj??H?LAl??????tbym?i??i?????N?l????T??zk?l???CLF?????Db?", iMaxLength=45 | out: lpString1="mAcG?n????OAU???pp???A?g??G??d?kJZdj??H?LAl?") returned="mAcG?n????OAU???pp???A?g??G??d?kJZdj??H?LAl?" [0098.125] lstrcpynA (in: lpString1=0x498800, lpString2="????Mu??f??Si?????UR??u?DQJ?S???rR?tBks???Q?YO???M??V?N??n?Q?fhnr?P???DMM???JpYyGB????????", iMaxLength=50 | out: lpString1="????Mu??f??Si?????UR??u?DQJ?S???rR?tBks???Q?YO???") returned="????Mu??f??Si?????UR??u?DQJ?S???rR?tBks???Q?YO???" [0098.125] lstrcpynA (in: lpString1=0x498804, lpString2="???r???p?Fg??????X???TKRUQD??x?d?????Gh?uY?X?LU???UxIx??T???zTs?Be???ifcYzB???????dr??", iMaxLength=70 | out: lpString1="???r???p?Fg??????X???TKRUQD??x?d?????Gh?uY?X?LU???UxIx??T???zTs?Be???") returned="???r???p?Fg??????X???TKRUQD??x?d?????Gh?uY?X?LU???UxIx??T???zTs?Be???" [0098.125] lstrcpynA (in: lpString1=0x498830, lpString2="?m?C??c????Dz??s?g?K?Oo???zo??bdHWN?????Mx?", iMaxLength=31 | out: lpString1="?m?C??c????Dz??s?g?K?Oo???zo??") returned="?m?C??c????Dz??s?g?K?Oo???zo??" [0098.125] lstrcpynA (in: lpString1=0x498838, lpString2="?v????Q?Fl????f?A????l??y?g??PF?lA?", iMaxLength=31 | out: lpString1="?v????Q?Fl????f?A????l??y?g??P") returned="?v????Q?Fl????f?A????l??y?g??P" [0098.126] lstrcpynA (in: lpString1=0x498828, lpString2="Qj?d??W??D??x??CKEO?j?Ify?l???Q??oS?Xub???h?h?z??", iMaxLength=44 | out: lpString1="Qj?d??W??D??x??CKEO?j?Ify?l???Q??oS?Xub???h") returned="Qj?d??W??D??x??CKEO?j?Ify?l???Q??oS?Xub???h" [0098.126] lstrcpynA (in: lpString1=0x498808, lpString2="?J??Mi????wd?cdX?eSy?ez???B?U???????????U?org?OMi?????m?n?c??YC?nI?i?X??iD???j?z??", iMaxLength=49 | out: lpString1="?J??Mi????wd?cdX?eSy?ez???B?U???????????U?org?OM") returned="?J??Mi????wd?cdX?eSy?ez???B?U???????????U?org?OM" [0098.126] lstrcpynA (in: lpString1=0x498804, lpString2="?????u??Jw?P???W????????toOe?????H???k??????r?S?c?m??Krzl??M????F???F??????Y?i?Z???AM", iMaxLength=62 | out: lpString1="?????u??Jw?P???W????????toOe?????H???k??????r?S?c?m??Krzl??M?") returned="?????u??Jw?P???W????????toOe?????H???k??????r?S?c?m??Krzl??M?" [0098.126] lstrcpynA (in: lpString1=0x498838, lpString2="GZ????z?YMy??G???xGM??dXf?k?CT?v?", iMaxLength=5 | out: lpString1="GZ??") returned="GZ??" [0098.126] lstrcpynA (in: lpString1=0x498844, lpString2="?A??VL????Ud???????Oh?", iMaxLength=16 | out: lpString1="?A??VL????Ud???") returned="?A??VL????Ud???" [0098.126] lstrcpynA (in: lpString1=0x49882c, lpString2="e??j?H??????Gh???????Cu?r?l?sB?c??K??Vv?NaW?", iMaxLength=38 | out: lpString1="e??j?H??????Gh???????Cu?r?l?sB?c??K??") returned="e??j?H??????Gh???????Cu?r?l?sB?c??K??" [0098.126] lstrcpynA (in: lpString1=0x498814, lpString2="?U???A???hggb?BbAXdK??xj????cG?rKM??N??UH?w?Po???tX????jf?F???BMUs?????", iMaxLength=50 | out: lpString1="?U???A???hggb?BbAXdK??xj????cG?rKM??N??UH?w?Po???") returned="?U???A???hggb?BbAXdK??xj????cG?rKM??N??UH?w?Po???" [0098.126] lstrcpynA (in: lpString1=0x49884c, lpString2="??", iMaxLength=1 | out: lpString1="") returned="" [0098.126] lstrcpynA (in: lpString1=0x498844, lpString2="?pl?Lg?????Y?B?G?OnA??u", iMaxLength=6 | out: lpString1="?pl?L") returned="?pl?L" [0098.126] lstrcpynA (in: lpString1=0x49884c, lpString2="????e????", iMaxLength=3 | out: lpString1="??") returned="??" [0098.126] lstrcpynA (in: lpString1=0x4987f8, lpString2="QUg?n?mC??fS?RTDr?U?y??Kb??v??paZWa??kiWG?YHHvK?U??Lmp???????r???r?Vz????y?HMkrwv??????SO???BVIS?", iMaxLength=35 | out: lpString1="QUg?n?mC??fS?RTDr?U?y??Kb??v??paZW") returned="QUg?n?mC??fS?RTDr?U?y??Kb??v??paZW" [0098.126] lstrcpynA (in: lpString1=0x498840, lpString2="?J????x??s?????fpi?l?g??j?N", iMaxLength=20 | out: lpString1="?J????x??s?????fpi?") returned="?J????x??s?????fpi?" [0098.126] lstrcpynA (in: lpString1=0x49884c, lpString2="H??Q?va?", iMaxLength=2 | out: lpString1="H") returned="H" [0098.126] lstrcpynA (in: lpString1=0x498814, lpString2="?I???On?A?x???a??gVN?wIt?EZ??f???VhJk??????B?aZ?f??yIP??w????I?nQ??N???", iMaxLength=49 | out: lpString1="?I???On?A?x???a??gVN?wIt?EZ??f???VhJk??????B?aZ?") returned="?I???On?A?x???a??gVN?wIt?EZ??f???VhJk??????B?aZ?" [0098.126] lstrcpynA (in: lpString1=0x49882c, lpString2="iW?????????x???Hvt???E?b?P?bL??CF??Wk???J?j???b", iMaxLength=35 | out: lpString1="iW?????????x???Hvt???E?b?P?bL??CF?") returned="iW?????????x???Hvt???E?b?P?bL??CF?" [0098.126] lstrcpynA (in: lpString1=0x49883c, lpString2="??X???????HM??Y??wBn?n?vmf??Ufn", iMaxLength=7 | out: lpString1="??X???") returned="??X???" [0098.126] lstrcpynA (in: lpString1=0x49884c, lpString2="??t????W?et??P", iMaxLength=10 | out: lpString1="??t????W?") returned="??t????W?" [0098.126] lstrcpynA (in: lpString1=0x498820, lpString2="z???m???eB??jN?????k?????xc?vG?????a???Mk??F?U???j??????", iMaxLength=33 | out: lpString1="z???m???eB??jN?????k?????xc?vG??") returned="z???m???eB??jN?????k?????xc?vG??" [0098.126] lstrcpynA (in: lpString1=0x49884c, lpString2="Ck??", iMaxLength=3 | out: lpString1="Ck") returned="Ck" [0098.127] lstrcpynA (in: lpString1=0x498828, lpString2="???mcO??E?Q?O??u?????X?v??twX???tXr?lG?V??m?UN??", iMaxLength=9 | out: lpString1="???mcO??") returned="???mcO??" [0098.127] lstrcpynA (in: lpString1=0x49884c, lpString2="?X?vH???", iMaxLength=2 | out: lpString1="?") returned="?" [0098.127] lstrcpynA (in: lpString1=0x49882c, lpString2="zU???W?Mz?Ebv??r?n???Vg???ZJ?gl?c?????U????Y", iMaxLength=7 | out: lpString1="zU???W") returned="zU???W" [0098.127] lstrcpynA (in: lpString1=0x49880c, lpString2="???ix???z?u????yV?eV??ns??Z??????????sM?Wt????fr????F?w???hPEsRA???Ror?Sv?c?aJP", iMaxLength=31 | out: lpString1="???ix???z?u????yV?eV??ns??Z???") returned="???ix???z?u????yV?eV??ns??Z???" [0098.127] lstrcpynA (in: lpString1=0x498804, lpString2="?w?xE??Af?kDk??KT????C?F?VR?cz???W?A?L????JHuhy???u??VOm??I?H?j?W???lm???mL?ycO?LYGvg?", iMaxLength=54 | out: lpString1="?w?xE??Af?kDk??KT????C?F?VR?cz???W?A?L????JHuhy???u??") returned="?w?xE??Af?kDk??KT????C?F?VR?cz???W?A?L????JHuhy???u??" [0098.127] lstrcpynA (in: lpString1=0x498830, lpString2="??s?P??BgN?g?Ghx??tMxOH??aT??W????L??l?CY?", iMaxLength=3 | out: lpString1="??") returned="??" [0098.127] lstrcmpiA (lpString1="sn??????JC????NsMxm?W?22", lpString2="h?dE??Q?C???12") returned 1 [0098.127] lstrcmpiA (lpString1="h?dE??Q?C???12", lpString2="dX2") returned 1 [0098.127] lstrcmpiA (lpString1="dX2", lpString2="??n?4") returned 1 [0098.127] lstrcmpiA (lpString1="??n?4", lpString2="???G???DWX?wd?HQ16") returned 1 [0098.127] lstrcmpiA (lpString1="???G???DWX?wd?HQ16", lpString2="?F?d?E?7") returned -1 [0098.128] lstrcmpiA (lpString1="?F?d?E?7", lpString2="a??lR????v10") returned -1 [0098.128] lstrcmpiA (lpString1="a??lR????v10", lpString2="0") returned 1 [0098.128] lstrcmpiA (lpString1="0", lpString2="t??lN?6") returned -1 [0098.128] lstrcmpiA (lpString1="t??lN?6", lpString2="g?rb?C?JW9") returned 1 [0098.128] lstrcmpiA (lpString1="g?rb?C?JW9", lpString2="m?pm???RkVbQ??XQ??C??riyL??BP??xKJ???kK?z?YL??RkYM??Rb?v?y?b???V?r?G??S71") returned -1 [0098.128] lstrcmpiA (lpString1="m?pm???RkVbQ??XQ??C??riyL??BP??xKJ???kK?z?YL??RkYM??Rb?v?y?b???V?r?G??S71", lpString2="x?U??Ac??????j??VhzQ???Nj????LaN?d??Tg?IR??i?u46") returned -1 [0098.128] lstrcmpiA (lpString1="x?U??Ac??????j??VhzQ???Nj????LaN?d??Tg?IR??i?u46", lpString2="dBk?jm?M??o??re?A?P?g??????e?????gi??i??K??zU?g?VIf????c???x?????65") returned 1 [0098.128] lstrcmpiA (lpString1="dBk?jm?M??o??re?A?P?g??????e?????gi??i??K??zU?g?VIf????c???x?????65", lpString2="?tiZ?s?UL??QB?Qe?NSN?RDU?S?b?29") returned 1 [0098.128] lstrcmpiA (lpString1="?tiZ?s?UL??QB?Qe?NSN?RDU?S?b?29", lpString2="0") returned -1 [0098.128] lstrcmpiA (lpString1="0", lpString2="?Z??HbO??????nKS???19") returned 1 [0098.128] lstrcmpiA (lpString1="?Z??HbO??????nKS???19", lpString2="PJ??BaCA?F???Z???Jzb?f???e?u?L30") returned -1 [0098.128] lstrcmpiA (lpString1="PJ??BaCA?F???Z???Jzb?f???e?u?L30", lpString2="????R?k?8") returned 1 [0098.128] lstrcmpiA (lpString1="????R?k?8", lpString2="??w?aX?lln???sz?S?e??g????g????31") returned -1 [0098.128] lstrcmpiA (lpString1="??w?aX?lln???sz?S?e??g????g????31", lpString2="????????iwVGU????????O?23") returned 1 [0098.128] lstrcmpiA (lpString1="????????iwVGU????????O?23", lpString2="??j?4") returned -1 [0098.128] lstrcmpiA (lpString1="??j?4", lpString2="t?????Xpr?10") returned -1 [0098.128] lstrcmpiA (lpString1="t?????Xpr?10", lpString2="?IY?s?k?XC???vFzA?P????d????Isx???CRV?VRY????n?Wi??Do?Xp?z????UAWAT??s?71") returned 1 [0098.128] lstrcmpiA (lpString1="?IY?s?k?XC???vFzA?P????d????Isx???CRV?VRY????n?Wi??Do?Xp?z????UAWAT??s?71", lpString2="D?R??I??T??11") returned -1 [0098.128] lstrcmpiA (lpString1="D?R??I??T??11", lpString2="Z?????????Mea????u?y??????Lm?t??sZD?WY?ZR?KRT??E?Op51") returned -1 [0098.128] lstrcmpiA (lpString1="Z?????????Mea????u?y??????Lm?t??sZD?WY?ZR?KRT??E?Op51", lpString2="?Joab???I????f??Jy????I??i?????I???v??y???p??????Ce??I?ha?dj60") returned 1 [0098.128] lstrcmpiA (lpString1="?Joab???I????f??Jy????I??i?????I???v??y???p??????Ce??I?ha?dj60", lpString2="????XLvR??rgO??kZ????i?z?kgAU?Pr?m?sA??OvM?hhu???z??rXr?JK58") returned 1 [0098.128] lstrcmpiA (lpString1="????XLvR??rgO??kZ????i?z?kgAU?Pr?m?sA??OvM?hhu???z??rXr?JK58", lpString2="?yP???hZ??HD12") returned -1 [0098.128] lstrcmpiA (lpString1="?yP???hZ??HD12", lpString2="P?M3") returned -1 [0098.128] lstrcmpiA (lpString1="P?M3", lpString2="A1") returned 1 [0098.128] lstrcmpiA (lpString1="A1", lpString2="???yj??7") returned 1 [0098.128] lstrcmpiA (lpString1="???yj??7", lpString2="f??uOx??V9") returned -1 [0098.128] lstrcmpiA (lpString1="f??uOx??V9", lpString2="????z?V?8") returned 1 [0098.128] lstrcmpiA (lpString1="????z?V?8", lpString2="WR???yAk?Uf???puG???LF?VPu?G??BOu?G???l?z?r???b?P??Im?E???58") returned -1 [0098.128] lstrcmpiA (lpString1="WR???yAk?Uf???puG???LF?VPu?G??BOu?G???l?z?r???b?P??Im?E???58", lpString2="????gkVHe9") returned 1 [0098.128] lstrcmpiA (lpString1="????gkVHe9", lpString2="mAcG?n????OAU???pp???A?g??G??d?kJZdj??H?LAl?44") returned -1 [0098.128] lstrcmpiA (lpString1="mAcG?n????OAU???pp???A?g??G??d?kJZdj??H?LAl?44", lpString2="????Mu??f??Si?????UR??u?DQJ?S???rR?tBks???Q?YO???49") returned 1 [0098.128] lstrcmpiA (lpString1="????Mu??f??Si?????UR??u?DQJ?S???rR?tBks???Q?YO???49", lpString2="???r???p?Fg??????X???TKRUQD??x?d?????Gh?uY?X?LU???UxIx??T???zTs?Be???69") returned -1 [0098.128] lstrcmpiA (lpString1="???r???p?Fg??????X???TKRUQD??x?d?????Gh?uY?X?LU???UxIx??T???zTs?Be???69", lpString2="?m?C??c????Dz??s?g?K?Oo???zo??30") returned -1 [0098.128] lstrcmpiA (lpString1="?m?C??c????Dz??s?g?K?Oo???zo??30", lpString2="?v????Q?Fl????f?A????l??y?g??P30") returned -1 [0098.129] lstrcmpiA (lpString1="?v????Q?Fl????f?A????l??y?g??P30", lpString2="Qj?d??W??D??x??CKEO?j?Ify?l???Q??oS?Xub???h43") returned -1 [0098.129] lstrcmpiA (lpString1="Qj?d??W??D??x??CKEO?j?Ify?l???Q??oS?Xub???h43", lpString2="?J??Mi????wd?cdX?eSy?ez???B?U???????????U?org?OM48") returned 1 [0098.129] lstrcmpiA (lpString1="?J??Mi????wd?cdX?eSy?ez???B?U???????????U?org?OM48", lpString2="?????u??Jw?P???W????????toOe?????H???k??????r?S?c?m??Krzl??M?61") returned 1 [0098.129] lstrcmpiA (lpString1="?????u??Jw?P???W????????toOe?????H???k??????r?S?c?m??Krzl??M?61", lpString2="GZ??4") returned -1 [0098.129] lstrcmpiA (lpString1="GZ??4", lpString2="?A??VL????Ud???15") returned 1 [0098.129] lstrcmpiA (lpString1="?A??VL????Ud???15", lpString2="e??j?H??????Gh???????Cu?r?l?sB?c??K??37") returned -1 [0098.129] lstrcmpiA (lpString1="e??j?H??????Gh???????Cu?r?l?sB?c??K??37", lpString2="?U???A???hggb?BbAXdK??xj????cG?rKM??N??UH?w?Po???49") returned 1 [0098.129] lstrcmpiA (lpString1="?U???A???hggb?BbAXdK??xj????cG?rKM??N??UH?w?Po???49", lpString2="0") returned -1 [0098.129] lstrcmpiA (lpString1="0", lpString2="?pl?L5") returned 1 [0098.129] lstrcmpiA (lpString1="?pl?L5", lpString2="??2") returned 1 [0098.129] lstrcmpiA (lpString1="??2", lpString2="QUg?n?mC??fS?RTDr?U?y??Kb??v??paZW34") returned -1 [0098.129] lstrcmpiA (lpString1="QUg?n?mC??fS?RTDr?U?y??Kb??v??paZW34", lpString2="?J????x??s?????fpi?19") returned 1 [0098.129] lstrcmpiA (lpString1="?J????x??s?????fpi?19", lpString2="H1") returned -1 [0098.129] lstrcmpiA (lpString1="H1", lpString2="?I???On?A?x???a??gVN?wIt?EZ??f???VhJk??????B?aZ?48") returned 1 [0098.129] lstrcmpiA (lpString1="?I???On?A?x???a??gVN?wIt?EZ??f???VhJk??????B?aZ?48", lpString2="iW?????????x???Hvt???E?b?P?bL??CF?34") returned -1 [0098.129] lstrcmpiA (lpString1="iW?????????x???Hvt???E?b?P?bL??CF?34", lpString2="??X???6") returned 1 [0098.129] lstrcmpiA (lpString1="??X???6", lpString2="??t????W?9") returned 1 [0098.129] lstrcmpiA (lpString1="??t????W?9", lpString2="z???m???eB??jN?????k?????xc?vG??32") returned -1 [0098.129] lstrcmpiA (lpString1="z???m???eB??jN?????k?????xc?vG??32", lpString2="Ck2") returned 1 [0098.129] lstrcmpiA (lpString1="Ck2", lpString2="???mcO??8") returned 1 [0098.129] lstrcmpiA (lpString1="???mcO??8", lpString2="?1") returned -1 [0098.129] lstrcmpiA (lpString1="?1", lpString2="zU???W6") returned -1 [0098.129] lstrcmpiA (lpString1="zU???W6", lpString2="???ix???z?u????yV?eV??ns??Z???30") returned 1 [0098.129] lstrcmpiA (lpString1="???ix???z?u????yV?eV??ns??Z???30", lpString2="?w?xE??Af?kDk??KT????C?F?VR?cz???W?A?L????JHuhy???u??53") returned -1 [0098.129] lstrcmpiA (lpString1="?w?xE??Af?kDk??KT????C?F?VR?cz???W?A?L????JHuhy???u??53", lpString2="??2") returned 1 [0098.129] lstrcmpiA (lpString1="??2", lpString2="??2") returned 0 [0098.129] GetThreadContext (in: hThread=0x2f8, lpContext=0x21cfeb8 | out: lpContext=0x21cfeb8*(ContextFlags=0x10002, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, FloatSave.ControlWord=0x0, FloatSave.StatusWord=0x0, FloatSave.TagWord=0x0, FloatSave.ErrorOffset=0x0, FloatSave.ErrorSelector=0x0, FloatSave.DataOffset=0x0, FloatSave.DataSelector=0x0, FloatSave.RegisterArea=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0), FloatSave.Cr0NpxState=0x0, SegGs=0x0, SegFs=0x0, SegEs=0x0, SegDs=0x0, Edi=0x0, Esi=0x0, Ebx=0x7efde000, Edx=0x0, Ecx=0x0, Eax=0x3479ce, Ebp=0x0, Eip=0x0, SegCs=0x0, EFlags=0x0, Esp=0x0, SegSs=0x0, ExtendedRegisters=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0, [192]=0x0, [193]=0x0, [194]=0x0, [195]=0x0, [196]=0x0, [197]=0x0, [198]=0x0, [199]=0x0, [200]=0x0, [201]=0x0, [202]=0x0, [203]=0x0, [204]=0x0, [205]=0x0, [206]=0x0, [207]=0x0, [208]=0x0, [209]=0x0, [210]=0x0, [211]=0x0, [212]=0x0, [213]=0x0, [214]=0x0, [215]=0x0, [216]=0x0, [217]=0x0, [218]=0x0, [219]=0x0, [220]=0x0, [221]=0x0, [222]=0x0, [223]=0x0, [224]=0x0, [225]=0x0, [226]=0x0, [227]=0x0, [228]=0x0, [229]=0x0, [230]=0x0, [231]=0x0, [232]=0x0, [233]=0x0, [234]=0x0, [235]=0x0, [236]=0x0, [237]=0x0, [238]=0x0, [239]=0x0, [240]=0x0, [241]=0x0, [242]=0x0, [243]=0x0, [244]=0x0, [245]=0x0, [246]=0x0, [247]=0x0, [248]=0x0, [249]=0x0, [250]=0x0, [251]=0x0, [252]=0x0, [253]=0x0, [254]=0x0, [255]=0x0, [256]=0x0, [257]=0x0, [258]=0x0, [259]=0x0, [260]=0x0, [261]=0x0, [262]=0x0, [263]=0x0, [264]=0x0, [265]=0x0, [266]=0x0, [267]=0x0, [268]=0x0, [269]=0x0, [270]=0x0, [271]=0x0, [272]=0x0, [273]=0x0, [274]=0x0, [275]=0x0, [276]=0x0, [277]=0x0, [278]=0x0, [279]=0x0, [280]=0x0, [281]=0x0, [282]=0x0, [283]=0x0, [284]=0x0, [285]=0x0, [286]=0x0, [287]=0x0, [288]=0x0, [289]=0x0, [290]=0x0, [291]=0x0, [292]=0x0, [293]=0x0, [294]=0x0, [295]=0x0, [296]=0x0, [297]=0x0, [298]=0x0, [299]=0x0, [300]=0x0, [301]=0x0, [302]=0x0, [303]=0x0, [304]=0x0, [305]=0x0, [306]=0x0, [307]=0x0, [308]=0x0, [309]=0x0, [310]=0x0, [311]=0x0, [312]=0x0, [313]=0x0, [314]=0x0, [315]=0x0, [316]=0x0, [317]=0x0, [318]=0x0, [319]=0x0, [320]=0x0, [321]=0x0, [322]=0x0, [323]=0x0, [324]=0x0, [325]=0x0, [326]=0x0, [327]=0x0, [328]=0x0, [329]=0x0, [330]=0x0, [331]=0x0, [332]=0x0, [333]=0x0, [334]=0x0, [335]=0x0, [336]=0x0, [337]=0x0, [338]=0x0, [339]=0x0, [340]=0x0, [341]=0x0, [342]=0x0, [343]=0x0, [344]=0x0, [345]=0x0, [346]=0x0, [347]=0x0, [348]=0x0, [349]=0x0, [350]=0x0, [351]=0x0, [352]=0x0, [353]=0x0, [354]=0x0, [355]=0x0, [356]=0x0, [357]=0x0, [358]=0x0, [359]=0x0, [360]=0x0, [361]=0x0, [362]=0x0, [363]=0x0, [364]=0x0, [365]=0x0, [366]=0x0, [367]=0x0, [368]=0x0, [369]=0x0, [370]=0x0, [371]=0x0, [372]=0x0, [373]=0x0, [374]=0x0, [375]=0x0, [376]=0x0, [377]=0x0, [378]=0x0, [379]=0x0, [380]=0x0, [381]=0x0, [382]=0x0, [383]=0x0, [384]=0x0, [385]=0x0, [386]=0x0, [387]=0x0, [388]=0x0, [389]=0x0, [390]=0x0, [391]=0x0, [392]=0x0, [393]=0x0, [394]=0x0, [395]=0x0, [396]=0x0, [397]=0x0, [398]=0x0, [399]=0x0, [400]=0x0, [401]=0x0, [402]=0x0, [403]=0x0, [404]=0x0, [405]=0x0, [406]=0x0, [407]=0x0, [408]=0x0, [409]=0x0, [410]=0x0, [411]=0x0, [412]=0x0, [413]=0x0, [414]=0x0, [415]=0x0, [416]=0x0, [417]=0x0, [418]=0x0, [419]=0x0, [420]=0x0, [421]=0x0, [422]=0x0, [423]=0x0, [424]=0x0, [425]=0x0, [426]=0x0, [427]=0x0, [428]=0x0, [429]=0x0, [430]=0x0, [431]=0x0, [432]=0x0, [433]=0x0, [434]=0x0, [435]=0x0, [436]=0x0, [437]=0x0, [438]=0x0, [439]=0x0, [440]=0x0, [441]=0x0, [442]=0x0, [443]=0x0, [444]=0x0, [445]=0x0, [446]=0x0, [447]=0x0, [448]=0x0, [449]=0x0, [450]=0x0, [451]=0x0, [452]=0x0, [453]=0x0, [454]=0x0, [455]=0x0, [456]=0x0, [457]=0x0, [458]=0x0, [459]=0x0, [460]=0x0, [461]=0x0, [462]=0x0, [463]=0x0, [464]=0x0, [465]=0x0, [466]=0x0, [467]=0x0, [468]=0x0, [469]=0x0, [470]=0x0, [471]=0x0, [472]=0x0, [473]=0x0, [474]=0x0, [475]=0x0, [476]=0x0, [477]=0x0, [478]=0x0, [479]=0x0, [480]=0x0, [481]=0x0, [482]=0x0, [483]=0x0, [484]=0x0, [485]=0x0, [486]=0x0, [487]=0x0, [488]=0x0, [489]=0x0, [490]=0x0, [491]=0x0, [492]=0x0, [493]=0x0, [494]=0x0, [495]=0x0, [496]=0x0, [497]=0x0, [498]=0x0, [499]=0x0, [500]=0x0, [501]=0x0, [502]=0x0, [503]=0x0, [504]=0x0, [505]=0x0, [506]=0x0, [507]=0x0, [508]=0x0, [509]=0x0, [510]=0x0, [511]=0x0))) returned 1 [0098.130] EnumProcessModules (in: hProcess=0x304, lphModule=0x22e1d1c, cb=0x100, lpcbNeeded=0x498850 | out: lphModule=0x22e1d1c, lpcbNeeded=0x498850) returned 1 [0098.130] GetModuleInformation (in: hProcess=0x304, hModule=0x310000, lpmodinfo=0x22e1e5c, cb=0xc | out: lpmodinfo=0x22e1e5c*(lpBaseOfDll=0x310000, SizeOfImage=0x3e000, EntryPoint=0x3479ce)) returned 1 [0098.130] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x310000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="unlikexpc.exe") returned 0xd [0098.131] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x310000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\unlikexpc.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\unlikexpc.exe")) returned 0x33 [0098.131] GetModuleInformation (in: hProcess=0x304, hModule=0x77ab0000, lpmodinfo=0x22e3fb0, cb=0xc | out: lpmodinfo=0x22e3fb0*(lpBaseOfDll=0x77ab0000, SizeOfImage=0x180000, EntryPoint=0x0)) returned 1 [0098.131] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x77ab0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="ntdll.dll") returned 0x9 [0098.131] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x77ab0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll")) returned 0x1d [0098.131] GetModuleInformation (in: hProcess=0x304, hModule=0x754b0000, lpmodinfo=0x22e60b4, cb=0xc | out: lpmodinfo=0x22e60b4*(lpBaseOfDll=0x754b0000, SizeOfImage=0x4a000, EntryPoint=0x754b2e54)) returned 1 [0098.131] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x754b0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="MSCOREE.DLL") returned 0xb [0098.131] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x754b0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\MSCOREE.DLL" (normalized: "c:\\windows\\system32\\mscoree.dll")) returned 0x1f [0098.131] GetModuleInformation (in: hProcess=0x304, hModule=0x757c0000, lpmodinfo=0x22e81c0, cb=0xc | out: lpmodinfo=0x22e81c0*(lpBaseOfDll=0x757c0000, SizeOfImage=0x110000, EntryPoint=0x757d32d3)) returned 1 [0098.131] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x757c0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="KERNEL32.dll") returned 0xc [0098.132] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x757c0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\KERNEL32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll")) returned 0x20 [0098.132] GetModuleInformation (in: hProcess=0x304, hModule=0x76260000, lpmodinfo=0x22ea2d4, cb=0xc | out: lpmodinfo=0x22ea2d4*(lpBaseOfDll=0x76260000, SizeOfImage=0x46000, EntryPoint=0x76267478)) returned 1 [0098.132] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x76260000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="KERNELBASE.dll") returned 0xe [0098.132] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x76260000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\KERNELBASE.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll")) returned 0x22 [0098.132] GetModuleInformation (in: hProcess=0x304, hModule=0x75720000, lpmodinfo=0x22ec41c, cb=0xc | out: lpmodinfo=0x22ec41c*(lpBaseOfDll=0x75720000, SizeOfImage=0xa0000, EntryPoint=0x757349e5)) returned 1 [0098.132] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75720000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="ADVAPI32.dll") returned 0xc [0098.133] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75720000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\ADVAPI32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll")) returned 0x20 [0098.133] GetModuleInformation (in: hProcess=0x304, hModule=0x75fe0000, lpmodinfo=0x22ee530, cb=0xc | out: lpmodinfo=0x22ee530*(lpBaseOfDll=0x75fe0000, SizeOfImage=0xac000, EntryPoint=0x75fea472)) returned 1 [0098.133] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75fe0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="msvcrt.dll") returned 0xa [0098.133] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75fe0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll")) returned 0x1e [0098.133] GetModuleInformation (in: hProcess=0x304, hModule=0x761b0000, lpmodinfo=0x22f063c, cb=0xc | out: lpmodinfo=0x22f063c*(lpBaseOfDll=0x761b0000, SizeOfImage=0x19000, EntryPoint=0x761b4975)) returned 1 [0098.133] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x761b0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="sechost.dll") returned 0xb [0098.134] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x761b0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll")) returned 0x1f [0098.134] GetModuleInformation (in: hProcess=0x304, hModule=0x76090000, lpmodinfo=0x22f2748, cb=0xc | out: lpmodinfo=0x22f2748*(lpBaseOfDll=0x76090000, SizeOfImage=0xf0000, EntryPoint=0x760a0569)) returned 1 [0098.134] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x76090000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="RPCRT4.dll") returned 0xa [0098.134] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x76090000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\RPCRT4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll")) returned 0x1e [0098.134] GetModuleInformation (in: hProcess=0x304, hModule=0x75610000, lpmodinfo=0x22f48a0, cb=0xc | out: lpmodinfo=0x22f48a0*(lpBaseOfDll=0x75610000, SizeOfImage=0x60000, EntryPoint=0x7562a3b3)) returned 1 [0098.134] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75610000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="SspiCli.dll") returned 0xb [0098.135] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75610000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\SspiCli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll")) returned 0x1f [0098.135] GetModuleInformation (in: hProcess=0x304, hModule=0x75600000, lpmodinfo=0x22f69ac, cb=0xc | out: lpmodinfo=0x22f69ac*(lpBaseOfDll=0x75600000, SizeOfImage=0xc000, EntryPoint=0x756010e1)) returned 1 [0098.135] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75600000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="CRYPTBASE.dll") returned 0xd [0098.135] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75600000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\CRYPTBASE.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll")) returned 0x21 [0098.135] GetModuleInformation (in: hProcess=0x304, hModule=0x75430000, lpmodinfo=0x22f8ac0, cb=0xc | out: lpmodinfo=0x22f8ac0*(lpBaseOfDll=0x75430000, SizeOfImage=0x78000, EntryPoint=0x7543f7ba)) returned 1 [0098.136] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75430000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="mscoreei.dll") returned 0xc [0098.136] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75430000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscoreei.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\mscoreei.dll")) returned 0x3a [0098.136] GetModuleInformation (in: hProcess=0x304, hModule=0x761d0000, lpmodinfo=0x22fac08, cb=0xc | out: lpmodinfo=0x22fac08*(lpBaseOfDll=0x761d0000, SizeOfImage=0x57000, EntryPoint=0x761e9ba6)) returned 1 [0098.136] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x761d0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="SHLWAPI.dll") returned 0xb [0098.137] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x761d0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\SHLWAPI.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll")) returned 0x1f [0098.137] GetModuleInformation (in: hProcess=0x304, hModule=0x766d0000, lpmodinfo=0x22fcd14, cb=0xc | out: lpmodinfo=0x22fcd14*(lpBaseOfDll=0x766d0000, SizeOfImage=0x90000, EntryPoint=0x766e6343)) returned 1 [0098.137] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x766d0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="GDI32.dll") returned 0x9 [0098.137] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x766d0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\GDI32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll")) returned 0x1d [0098.138] GetModuleInformation (in: hProcess=0x304, hModule=0x775b0000, lpmodinfo=0x22fee18, cb=0xc | out: lpmodinfo=0x22fee18*(lpBaseOfDll=0x775b0000, SizeOfImage=0x100000, EntryPoint=0x775cb6ed)) returned 1 [0098.138] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x775b0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="USER32.dll") returned 0xa [0098.138] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x775b0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\USER32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll")) returned 0x1e [0098.138] GetModuleInformation (in: hProcess=0x304, hModule=0x75a70000, lpmodinfo=0x2300f24, cb=0xc | out: lpmodinfo=0x2300f24*(lpBaseOfDll=0x75a70000, SizeOfImage=0xa000, EntryPoint=0x75a736a0)) returned 1 [0098.139] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75a70000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="LPK.dll") returned 0x7 [0098.139] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75a70000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\LPK.dll" (normalized: "c:\\windows\\syswow64\\lpk.dll")) returned 0x1b [0098.139] GetModuleInformation (in: hProcess=0x304, hModule=0x758d0000, lpmodinfo=0x2303020, cb=0xc | out: lpmodinfo=0x2303020*(lpBaseOfDll=0x758d0000, SizeOfImage=0x9d000, EntryPoint=0x75903fd7)) returned 1 [0098.139] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x758d0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="USP10.dll") returned 0x9 [0098.140] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x758d0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\USP10.dll" (normalized: "c:\\windows\\syswow64\\usp10.dll")) returned 0x1d [0098.140] GetModuleInformation (in: hProcess=0x304, hModule=0x75f80000, lpmodinfo=0x23051b0, cb=0xc | out: lpmodinfo=0x23051b0*(lpBaseOfDll=0x75f80000, SizeOfImage=0x60000, EntryPoint=0x75f9158f)) returned 1 [0098.140] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75f80000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="IMM32.DLL") returned 0x9 [0098.141] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75f80000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\system32\\IMM32.DLL" (normalized: "c:\\windows\\system32\\imm32.dll")) returned 0x1d [0098.141] GetModuleInformation (in: hProcess=0x304, hModule=0x75ea0000, lpmodinfo=0x23072b4, cb=0xc | out: lpmodinfo=0x23072b4*(lpBaseOfDll=0x75ea0000, SizeOfImage=0xcc000, EntryPoint=0x75ea168b)) returned 1 [0098.141] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75ea0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="MSCTF.dll") returned 0x9 [0098.141] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75ea0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\MSCTF.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll")) returned 0x1d [0098.142] GetModuleInformation (in: hProcess=0x304, hModule=0x75420000, lpmodinfo=0x23093b8, cb=0xc | out: lpmodinfo=0x23093b8*(lpBaseOfDll=0x75420000, SizeOfImage=0x9000, EntryPoint=0x75421220)) returned 1 [0098.142] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75420000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="VERSION.dll") returned 0xb [0098.143] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75420000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\system32\\VERSION.dll" (normalized: "c:\\windows\\system32\\version.dll")) returned 0x1f [0098.143] GetModuleInformation (in: hProcess=0x304, hModule=0x74890000, lpmodinfo=0x230b4c4, cb=0xc | out: lpmodinfo=0x230b4c4*(lpBaseOfDll=0x74890000, SizeOfImage=0x6a8000, EntryPoint=0x749d7040)) returned 1 [0098.143] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x74890000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="clr.dll") returned 0x7 [0098.143] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x74890000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\clr.dll")) returned 0x35 [0098.144] GetModuleInformation (in: hProcess=0x304, hModule=0x75320000, lpmodinfo=0x230d5f4, cb=0xc | out: lpmodinfo=0x230d5f4*(lpBaseOfDll=0x75320000, SizeOfImage=0xf5000, EntryPoint=0x75374160)) returned 1 [0098.144] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75320000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="MSVCR120_CLR0400.dll") returned 0x14 [0098.144] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75320000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\system32\\MSVCR120_CLR0400.dll" (normalized: "c:\\windows\\system32\\msvcr120_clr0400.dll")) returned 0x28 [0098.145] GetModuleInformation (in: hProcess=0x304, hModule=0x72440000, lpmodinfo=0x230f728, cb=0xc | out: lpmodinfo=0x230f728*(lpBaseOfDll=0x72440000, SizeOfImage=0x122b000, EntryPoint=0x0)) returned 1 [0098.145] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x72440000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="mscorlib.ni.dll") returned 0xf [0098.145] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x72440000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\b7a12c4c0032847fcc6b9c710460456f\\mscorlib.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\mscorlib\\b7a12c4c0032847fcc6b9c710460456f\\mscorlib.ni.dll")) returned 0x68 [0098.146] GetModuleInformation (in: hProcess=0x304, hModule=0x764e0000, lpmodinfo=0x23118d0, cb=0xc | out: lpmodinfo=0x23118d0*(lpBaseOfDll=0x764e0000, SizeOfImage=0x15c000, EntryPoint=0x7652ba3d)) returned 1 [0098.146] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x764e0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="ole32.dll") returned 0x9 [0098.146] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x764e0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll")) returned 0x1d [0098.147] GetModuleInformation (in: hProcess=0x304, hModule=0x74f60000, lpmodinfo=0x23139d4, cb=0xc | out: lpmodinfo=0x23139d4*(lpBaseOfDll=0x74f60000, SizeOfImage=0x80000, EntryPoint=0x74f737c9)) returned 1 [0098.147] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x74f60000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="uxtheme.dll") returned 0xb [0098.148] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x74f60000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\system32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll")) returned 0x1f [0098.148] GetModuleInformation (in: hProcess=0x304, hModule=0x752a0000, lpmodinfo=0x2315ae0, cb=0xc | out: lpmodinfo=0x2315ae0*(lpBaseOfDll=0x752a0000, SizeOfImage=0x7d000, EntryPoint=0x752a1140)) returned 1 [0098.148] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x752a0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="clrjit.dll") returned 0xa [0098.149] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x752a0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clrjit.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\clrjit.dll")) returned 0x38 [0098.149] GetModuleInformation (in: hProcess=0x304, hModule=0x762b0000, lpmodinfo=0x2317c20, cb=0xc | out: lpmodinfo=0x2317c20*(lpBaseOfDll=0x762b0000, SizeOfImage=0x8f000, EntryPoint=0x762b3fb1)) returned 1 [0098.149] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x762b0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="OLEAUT32.dll") returned 0xc [0098.150] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x762b0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\OLEAUT32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll")) returned 0x20 [0098.150] GetModuleInformation (in: hProcess=0x304, hModule=0x736d0000, lpmodinfo=0x2319d34, cb=0xc | out: lpmodinfo=0x2319d34*(lpBaseOfDll=0x736d0000, SizeOfImage=0x9ad000, EntryPoint=0x0)) returned 1 [0098.150] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x736d0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="System.ni.dll") returned 0xd [0098.151] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x736d0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System\\500ffa28b327e171fe664023003e947e\\System.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system\\500ffa28b327e171fe664023003e947e\\system.ni.dll")) returned 0x64 [0098.151] GetModuleInformation (in: hProcess=0x304, hModule=0x71d20000, lpmodinfo=0x231bed0, cb=0xc | out: lpmodinfo=0x231bed0*(lpBaseOfDll=0x71d20000, SizeOfImage=0x716000, EntryPoint=0x0)) returned 1 [0098.152] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x71d20000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="System.Core.ni.dll") returned 0x12 [0098.152] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x71d20000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Core\\386fde9190d499d6645df8b90eb76242\\System.Core.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.core\\386fde9190d499d6645df8b90eb76242\\system.core.ni.dll")) returned 0x6e [0098.152] GetModuleInformation (in: hProcess=0x304, hModule=0x750d0000, lpmodinfo=0x231e08c, cb=0xc | out: lpmodinfo=0x231e08c*(lpBaseOfDll=0x750d0000, SizeOfImage=0x1cb000, EntryPoint=0x0)) returned 1 [0098.153] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x750d0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="Microsoft.VisualBasic.ni.dll") returned 0x1c [0098.153] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x750d0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Microsoft.V9921e851#\\cfbddeb6e93e8f421b92229b20e51233\\Microsoft.VisualBasic.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\microsoft.v9921e851#\\cfbddeb6e93e8f421b92229b20e51233\\microsoft.visualbasic.ni.dll")) returned 0x81 [0098.154] GetModuleInformation (in: hProcess=0x304, hModule=0x750b0000, lpmodinfo=0x2320280, cb=0xc | out: lpmodinfo=0x2320280*(lpBaseOfDll=0x750b0000, SizeOfImage=0x13000, EntryPoint=0x750b18f0)) returned 1 [0098.154] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x750b0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="nlssorting.dll") returned 0xe [0098.155] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x750b0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\nlssorting.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\nlssorting.dll")) returned 0x3c [0098.155] GetModuleInformation (in: hProcess=0x304, hModule=0x74870000, lpmodinfo=0x23223d0, cb=0xc | out: lpmodinfo=0x23223d0*(lpBaseOfDll=0x74870000, SizeOfImage=0x16000, EntryPoint=0x74872dc3)) returned 1 [0098.155] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x74870000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="CRYPTSP.dll") returned 0xb [0098.156] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x74870000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\system32\\CRYPTSP.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll")) returned 0x1f [0098.156] GetModuleInformation (in: hProcess=0x304, hModule=0x74830000, lpmodinfo=0x23244dc, cb=0xc | out: lpmodinfo=0x23244dc*(lpBaseOfDll=0x74830000, SizeOfImage=0x3b000, EntryPoint=0x7483128d)) returned 1 [0098.157] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x74830000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="rsaenh.dll") returned 0xa [0098.158] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x74830000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\system32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll")) returned 0x1e [0098.158] GetModuleInformation (in: hProcess=0x304, hModule=0x75a60000, lpmodinfo=0x23266f4, cb=0xc | out: lpmodinfo=0x23266f4*(lpBaseOfDll=0x75a60000, SizeOfImage=0x5000, EntryPoint=0x75a61438)) returned 1 [0098.159] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75a60000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="psapi.dll") returned 0x9 [0098.159] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75a60000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\psapi.dll" (normalized: "c:\\windows\\syswow64\\psapi.dll")) returned 0x1d [0098.159] GetModuleInformation (in: hProcess=0x304, hModule=0x746a0000, lpmodinfo=0x23287f8, cb=0xc | out: lpmodinfo=0x23287f8*(lpBaseOfDll=0x746a0000, SizeOfImage=0x18d000, EntryPoint=0x0)) returned 1 [0098.160] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x746a0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="System.Drawing.ni.dll") returned 0x15 [0098.160] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x746a0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Drawing\\553c0312fdf5a5449f3649f0515e70fb\\System.Drawing.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.drawing\\553c0312fdf5a5449f3649f0515e70fb\\system.drawing.ni.dll")) returned 0x74 [0098.161] GetModuleInformation (in: hProcess=0x304, hModule=0x710c0000, lpmodinfo=0x232a9c4, cb=0xc | out: lpmodinfo=0x232a9c4*(lpBaseOfDll=0x710c0000, SizeOfImage=0xc58000, EntryPoint=0x0)) returned 1 [0098.161] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x710c0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="System.Windows.Forms.ni.dll") returned 0x1b [0098.162] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x710c0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Windows.Forms\\7a6894982f35a1d75ec73d447c583da2\\System.Windows.Forms.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.windows.forms\\7a6894982f35a1d75ec73d447c583da2\\system.windows.forms.ni.dll")) returned 0x80 [0098.170] EnumProcessModules (in: hProcess=0x304, lphModule=0x22203b4, cb=0x100, lpcbNeeded=0x498850 | out: lphModule=0x22203b4, lpcbNeeded=0x498850) returned 1 [0098.170] GetModuleInformation (in: hProcess=0x304, hModule=0x310000, lpmodinfo=0x22204f4, cb=0xc | out: lpmodinfo=0x22204f4*(lpBaseOfDll=0x310000, SizeOfImage=0x3e000, EntryPoint=0x3479ce)) returned 1 [0098.170] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x310000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="unlikexpc.exe") returned 0xd [0098.170] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x310000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\unlikexpc.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\unlikexpc.exe")) returned 0x33 [0098.170] GetModuleInformation (in: hProcess=0x304, hModule=0x77ab0000, lpmodinfo=0x2222648, cb=0xc | out: lpmodinfo=0x2222648*(lpBaseOfDll=0x77ab0000, SizeOfImage=0x180000, EntryPoint=0x0)) returned 1 [0098.170] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x77ab0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="ntdll.dll") returned 0x9 [0098.171] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x77ab0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll")) returned 0x1d [0098.171] GetModuleInformation (in: hProcess=0x304, hModule=0x754b0000, lpmodinfo=0x222474c, cb=0xc | out: lpmodinfo=0x222474c*(lpBaseOfDll=0x754b0000, SizeOfImage=0x4a000, EntryPoint=0x754b2e54)) returned 1 [0098.171] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x754b0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="MSCOREE.DLL") returned 0xb [0098.171] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x754b0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\MSCOREE.DLL" (normalized: "c:\\windows\\system32\\mscoree.dll")) returned 0x1f [0098.171] GetModuleInformation (in: hProcess=0x304, hModule=0x757c0000, lpmodinfo=0x2226858, cb=0xc | out: lpmodinfo=0x2226858*(lpBaseOfDll=0x757c0000, SizeOfImage=0x110000, EntryPoint=0x757d32d3)) returned 1 [0098.171] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x757c0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="KERNEL32.dll") returned 0xc [0098.171] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x757c0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\KERNEL32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll")) returned 0x20 [0098.171] GetModuleInformation (in: hProcess=0x304, hModule=0x76260000, lpmodinfo=0x222896c, cb=0xc | out: lpmodinfo=0x222896c*(lpBaseOfDll=0x76260000, SizeOfImage=0x46000, EntryPoint=0x76267478)) returned 1 [0098.172] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x76260000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="KERNELBASE.dll") returned 0xe [0098.172] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x76260000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\KERNELBASE.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll")) returned 0x22 [0098.172] GetModuleInformation (in: hProcess=0x304, hModule=0x75720000, lpmodinfo=0x222aab4, cb=0xc | out: lpmodinfo=0x222aab4*(lpBaseOfDll=0x75720000, SizeOfImage=0xa0000, EntryPoint=0x757349e5)) returned 1 [0098.172] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75720000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="ADVAPI32.dll") returned 0xc [0098.172] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75720000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\ADVAPI32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll")) returned 0x20 [0098.172] GetModuleInformation (in: hProcess=0x304, hModule=0x75fe0000, lpmodinfo=0x222cbc8, cb=0xc | out: lpmodinfo=0x222cbc8*(lpBaseOfDll=0x75fe0000, SizeOfImage=0xac000, EntryPoint=0x75fea472)) returned 1 [0098.173] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75fe0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="msvcrt.dll") returned 0xa [0098.173] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75fe0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll")) returned 0x1e [0098.173] GetModuleInformation (in: hProcess=0x304, hModule=0x761b0000, lpmodinfo=0x222ecd4, cb=0xc | out: lpmodinfo=0x222ecd4*(lpBaseOfDll=0x761b0000, SizeOfImage=0x19000, EntryPoint=0x761b4975)) returned 1 [0098.173] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x761b0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="sechost.dll") returned 0xb [0098.173] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x761b0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll")) returned 0x1f [0098.173] GetModuleInformation (in: hProcess=0x304, hModule=0x76090000, lpmodinfo=0x2230de0, cb=0xc | out: lpmodinfo=0x2230de0*(lpBaseOfDll=0x76090000, SizeOfImage=0xf0000, EntryPoint=0x760a0569)) returned 1 [0098.174] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x76090000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="RPCRT4.dll") returned 0xa [0098.174] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x76090000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\RPCRT4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll")) returned 0x1e [0098.174] GetModuleInformation (in: hProcess=0x304, hModule=0x75610000, lpmodinfo=0x2232f38, cb=0xc | out: lpmodinfo=0x2232f38*(lpBaseOfDll=0x75610000, SizeOfImage=0x60000, EntryPoint=0x7562a3b3)) returned 1 [0098.174] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75610000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="SspiCli.dll") returned 0xb [0098.175] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75610000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\SspiCli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll")) returned 0x1f [0098.175] GetModuleInformation (in: hProcess=0x304, hModule=0x75600000, lpmodinfo=0x2235044, cb=0xc | out: lpmodinfo=0x2235044*(lpBaseOfDll=0x75600000, SizeOfImage=0xc000, EntryPoint=0x756010e1)) returned 1 [0098.175] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75600000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="CRYPTBASE.dll") returned 0xd [0098.175] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75600000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\CRYPTBASE.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll")) returned 0x21 [0098.176] GetModuleInformation (in: hProcess=0x304, hModule=0x75430000, lpmodinfo=0x2237158, cb=0xc | out: lpmodinfo=0x2237158*(lpBaseOfDll=0x75430000, SizeOfImage=0x78000, EntryPoint=0x7543f7ba)) returned 1 [0098.176] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75430000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="mscoreei.dll") returned 0xc [0098.176] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75430000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscoreei.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\mscoreei.dll")) returned 0x3a [0098.176] GetModuleInformation (in: hProcess=0x304, hModule=0x761d0000, lpmodinfo=0x22392a0, cb=0xc | out: lpmodinfo=0x22392a0*(lpBaseOfDll=0x761d0000, SizeOfImage=0x57000, EntryPoint=0x761e9ba6)) returned 1 [0098.176] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x761d0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="SHLWAPI.dll") returned 0xb [0098.177] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x761d0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\SHLWAPI.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll")) returned 0x1f [0098.177] GetModuleInformation (in: hProcess=0x304, hModule=0x766d0000, lpmodinfo=0x223b3ac, cb=0xc | out: lpmodinfo=0x223b3ac*(lpBaseOfDll=0x766d0000, SizeOfImage=0x90000, EntryPoint=0x766e6343)) returned 1 [0098.177] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x766d0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="GDI32.dll") returned 0x9 [0098.177] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x766d0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\GDI32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll")) returned 0x1d [0098.178] GetModuleInformation (in: hProcess=0x304, hModule=0x775b0000, lpmodinfo=0x223d4b0, cb=0xc | out: lpmodinfo=0x223d4b0*(lpBaseOfDll=0x775b0000, SizeOfImage=0x100000, EntryPoint=0x775cb6ed)) returned 1 [0098.178] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x775b0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="USER32.dll") returned 0xa [0098.178] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x775b0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\USER32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll")) returned 0x1e [0098.178] GetModuleInformation (in: hProcess=0x304, hModule=0x75a70000, lpmodinfo=0x223f5bc, cb=0xc | out: lpmodinfo=0x223f5bc*(lpBaseOfDll=0x75a70000, SizeOfImage=0xa000, EntryPoint=0x75a736a0)) returned 1 [0098.179] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75a70000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="LPK.dll") returned 0x7 [0098.179] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75a70000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\LPK.dll" (normalized: "c:\\windows\\syswow64\\lpk.dll")) returned 0x1b [0098.179] GetModuleInformation (in: hProcess=0x304, hModule=0x758d0000, lpmodinfo=0x22416b8, cb=0xc | out: lpmodinfo=0x22416b8*(lpBaseOfDll=0x758d0000, SizeOfImage=0x9d000, EntryPoint=0x75903fd7)) returned 1 [0098.179] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x758d0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="USP10.dll") returned 0x9 [0098.180] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x758d0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\USP10.dll" (normalized: "c:\\windows\\syswow64\\usp10.dll")) returned 0x1d [0098.180] GetModuleInformation (in: hProcess=0x304, hModule=0x75f80000, lpmodinfo=0x2243848, cb=0xc | out: lpmodinfo=0x2243848*(lpBaseOfDll=0x75f80000, SizeOfImage=0x60000, EntryPoint=0x75f9158f)) returned 1 [0098.180] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75f80000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="IMM32.DLL") returned 0x9 [0098.181] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75f80000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\system32\\IMM32.DLL" (normalized: "c:\\windows\\system32\\imm32.dll")) returned 0x1d [0098.181] GetModuleInformation (in: hProcess=0x304, hModule=0x75ea0000, lpmodinfo=0x224594c, cb=0xc | out: lpmodinfo=0x224594c*(lpBaseOfDll=0x75ea0000, SizeOfImage=0xcc000, EntryPoint=0x75ea168b)) returned 1 [0098.181] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75ea0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="MSCTF.dll") returned 0x9 [0098.181] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75ea0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\MSCTF.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll")) returned 0x1d [0098.182] GetModuleInformation (in: hProcess=0x304, hModule=0x75420000, lpmodinfo=0x2247a50, cb=0xc | out: lpmodinfo=0x2247a50*(lpBaseOfDll=0x75420000, SizeOfImage=0x9000, EntryPoint=0x75421220)) returned 1 [0098.182] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75420000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="VERSION.dll") returned 0xb [0098.182] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75420000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\system32\\VERSION.dll" (normalized: "c:\\windows\\system32\\version.dll")) returned 0x1f [0098.183] GetModuleInformation (in: hProcess=0x304, hModule=0x74890000, lpmodinfo=0x2249b5c, cb=0xc | out: lpmodinfo=0x2249b5c*(lpBaseOfDll=0x74890000, SizeOfImage=0x6a8000, EntryPoint=0x749d7040)) returned 1 [0098.183] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x74890000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="clr.dll") returned 0x7 [0098.183] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x74890000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\clr.dll")) returned 0x35 [0098.184] GetModuleInformation (in: hProcess=0x304, hModule=0x75320000, lpmodinfo=0x224bc8c, cb=0xc | out: lpmodinfo=0x224bc8c*(lpBaseOfDll=0x75320000, SizeOfImage=0xf5000, EntryPoint=0x75374160)) returned 1 [0098.184] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75320000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="MSVCR120_CLR0400.dll") returned 0x14 [0098.184] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75320000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\system32\\MSVCR120_CLR0400.dll" (normalized: "c:\\windows\\system32\\msvcr120_clr0400.dll")) returned 0x28 [0098.185] GetModuleInformation (in: hProcess=0x304, hModule=0x72440000, lpmodinfo=0x224ddc0, cb=0xc | out: lpmodinfo=0x224ddc0*(lpBaseOfDll=0x72440000, SizeOfImage=0x122b000, EntryPoint=0x0)) returned 1 [0098.185] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x72440000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="mscorlib.ni.dll") returned 0xf [0098.185] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x72440000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\b7a12c4c0032847fcc6b9c710460456f\\mscorlib.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\mscorlib\\b7a12c4c0032847fcc6b9c710460456f\\mscorlib.ni.dll")) returned 0x68 [0098.186] GetModuleInformation (in: hProcess=0x304, hModule=0x764e0000, lpmodinfo=0x224ff68, cb=0xc | out: lpmodinfo=0x224ff68*(lpBaseOfDll=0x764e0000, SizeOfImage=0x15c000, EntryPoint=0x7652ba3d)) returned 1 [0098.186] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x764e0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="ole32.dll") returned 0x9 [0098.186] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x764e0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll")) returned 0x1d [0098.187] GetModuleInformation (in: hProcess=0x304, hModule=0x74f60000, lpmodinfo=0x225206c, cb=0xc | out: lpmodinfo=0x225206c*(lpBaseOfDll=0x74f60000, SizeOfImage=0x80000, EntryPoint=0x74f737c9)) returned 1 [0098.187] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x74f60000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="uxtheme.dll") returned 0xb [0098.187] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x74f60000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\system32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll")) returned 0x1f [0098.188] GetModuleInformation (in: hProcess=0x304, hModule=0x752a0000, lpmodinfo=0x2254178, cb=0xc | out: lpmodinfo=0x2254178*(lpBaseOfDll=0x752a0000, SizeOfImage=0x7d000, EntryPoint=0x752a1140)) returned 1 [0098.188] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x752a0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="clrjit.dll") returned 0xa [0098.188] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x752a0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clrjit.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\clrjit.dll")) returned 0x38 [0098.189] GetModuleInformation (in: hProcess=0x304, hModule=0x762b0000, lpmodinfo=0x22562b8, cb=0xc | out: lpmodinfo=0x22562b8*(lpBaseOfDll=0x762b0000, SizeOfImage=0x8f000, EntryPoint=0x762b3fb1)) returned 1 [0098.189] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x762b0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="OLEAUT32.dll") returned 0xc [0098.190] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x762b0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\OLEAUT32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll")) returned 0x20 [0098.190] GetModuleInformation (in: hProcess=0x304, hModule=0x736d0000, lpmodinfo=0x22583cc, cb=0xc | out: lpmodinfo=0x22583cc*(lpBaseOfDll=0x736d0000, SizeOfImage=0x9ad000, EntryPoint=0x0)) returned 1 [0098.190] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x736d0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="System.ni.dll") returned 0xd [0098.191] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x736d0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System\\500ffa28b327e171fe664023003e947e\\System.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system\\500ffa28b327e171fe664023003e947e\\system.ni.dll")) returned 0x64 [0098.191] GetModuleInformation (in: hProcess=0x304, hModule=0x71d20000, lpmodinfo=0x225a568, cb=0xc | out: lpmodinfo=0x225a568*(lpBaseOfDll=0x71d20000, SizeOfImage=0x716000, EntryPoint=0x0)) returned 1 [0098.191] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x71d20000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="System.Core.ni.dll") returned 0x12 [0098.192] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x71d20000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Core\\386fde9190d499d6645df8b90eb76242\\System.Core.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.core\\386fde9190d499d6645df8b90eb76242\\system.core.ni.dll")) returned 0x6e [0098.192] GetModuleInformation (in: hProcess=0x304, hModule=0x750d0000, lpmodinfo=0x225c724, cb=0xc | out: lpmodinfo=0x225c724*(lpBaseOfDll=0x750d0000, SizeOfImage=0x1cb000, EntryPoint=0x0)) returned 1 [0098.193] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x750d0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="Microsoft.VisualBasic.ni.dll") returned 0x1c [0098.193] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x750d0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Microsoft.V9921e851#\\cfbddeb6e93e8f421b92229b20e51233\\Microsoft.VisualBasic.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\microsoft.v9921e851#\\cfbddeb6e93e8f421b92229b20e51233\\microsoft.visualbasic.ni.dll")) returned 0x81 [0098.194] GetModuleInformation (in: hProcess=0x304, hModule=0x750b0000, lpmodinfo=0x225e918, cb=0xc | out: lpmodinfo=0x225e918*(lpBaseOfDll=0x750b0000, SizeOfImage=0x13000, EntryPoint=0x750b18f0)) returned 1 [0098.194] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x750b0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="nlssorting.dll") returned 0xe [0098.194] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x750b0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\nlssorting.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\nlssorting.dll")) returned 0x3c [0098.195] GetModuleInformation (in: hProcess=0x304, hModule=0x74870000, lpmodinfo=0x2260a68, cb=0xc | out: lpmodinfo=0x2260a68*(lpBaseOfDll=0x74870000, SizeOfImage=0x16000, EntryPoint=0x74872dc3)) returned 1 [0098.195] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x74870000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="CRYPTSP.dll") returned 0xb [0098.196] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x74870000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\system32\\CRYPTSP.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll")) returned 0x1f [0098.196] GetModuleInformation (in: hProcess=0x304, hModule=0x74830000, lpmodinfo=0x2262b74, cb=0xc | out: lpmodinfo=0x2262b74*(lpBaseOfDll=0x74830000, SizeOfImage=0x3b000, EntryPoint=0x7483128d)) returned 1 [0098.197] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x74830000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="rsaenh.dll") returned 0xa [0098.197] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x74830000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\system32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll")) returned 0x1e [0098.197] GetModuleInformation (in: hProcess=0x304, hModule=0x75a60000, lpmodinfo=0x2264d8c, cb=0xc | out: lpmodinfo=0x2264d8c*(lpBaseOfDll=0x75a60000, SizeOfImage=0x5000, EntryPoint=0x75a61438)) returned 1 [0098.198] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75a60000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="psapi.dll") returned 0x9 [0098.198] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75a60000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\psapi.dll" (normalized: "c:\\windows\\syswow64\\psapi.dll")) returned 0x1d [0098.199] GetModuleInformation (in: hProcess=0x304, hModule=0x746a0000, lpmodinfo=0x2266e90, cb=0xc | out: lpmodinfo=0x2266e90*(lpBaseOfDll=0x746a0000, SizeOfImage=0x18d000, EntryPoint=0x0)) returned 1 [0098.199] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x746a0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="System.Drawing.ni.dll") returned 0x15 [0098.200] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x746a0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Drawing\\553c0312fdf5a5449f3649f0515e70fb\\System.Drawing.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.drawing\\553c0312fdf5a5449f3649f0515e70fb\\system.drawing.ni.dll")) returned 0x74 [0098.200] GetModuleInformation (in: hProcess=0x304, hModule=0x710c0000, lpmodinfo=0x226905c, cb=0xc | out: lpmodinfo=0x226905c*(lpBaseOfDll=0x710c0000, SizeOfImage=0xc58000, EntryPoint=0x0)) returned 1 [0098.201] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x710c0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="System.Windows.Forms.ni.dll") returned 0x1b [0098.201] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x710c0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Windows.Forms\\7a6894982f35a1d75ec73d447c583da2\\System.Windows.Forms.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.windows.forms\\7a6894982f35a1d75ec73d447c583da2\\system.windows.forms.ni.dll")) returned 0x80 [0098.203] EnumProcessModules (in: hProcess=0x304, lphModule=0x235f304, cb=0x100, lpcbNeeded=0x498850 | out: lphModule=0x235f304, lpcbNeeded=0x498850) returned 1 [0098.203] GetModuleInformation (in: hProcess=0x304, hModule=0x310000, lpmodinfo=0x235f444, cb=0xc | out: lpmodinfo=0x235f444*(lpBaseOfDll=0x310000, SizeOfImage=0x3e000, EntryPoint=0x3479ce)) returned 1 [0098.203] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x310000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="unlikexpc.exe") returned 0xd [0098.203] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x310000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\unlikexpc.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\unlikexpc.exe")) returned 0x33 [0098.203] GetModuleInformation (in: hProcess=0x304, hModule=0x77ab0000, lpmodinfo=0x2361598, cb=0xc | out: lpmodinfo=0x2361598*(lpBaseOfDll=0x77ab0000, SizeOfImage=0x180000, EntryPoint=0x0)) returned 1 [0098.204] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x77ab0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="ntdll.dll") returned 0x9 [0098.204] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x77ab0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll")) returned 0x1d [0098.204] GetModuleInformation (in: hProcess=0x304, hModule=0x754b0000, lpmodinfo=0x236369c, cb=0xc | out: lpmodinfo=0x236369c*(lpBaseOfDll=0x754b0000, SizeOfImage=0x4a000, EntryPoint=0x754b2e54)) returned 1 [0098.204] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x754b0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="MSCOREE.DLL") returned 0xb [0098.204] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x754b0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\MSCOREE.DLL" (normalized: "c:\\windows\\system32\\mscoree.dll")) returned 0x1f [0098.204] GetModuleInformation (in: hProcess=0x304, hModule=0x757c0000, lpmodinfo=0x23657a8, cb=0xc | out: lpmodinfo=0x23657a8*(lpBaseOfDll=0x757c0000, SizeOfImage=0x110000, EntryPoint=0x757d32d3)) returned 1 [0098.204] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x757c0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="KERNEL32.dll") returned 0xc [0098.204] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x757c0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\KERNEL32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll")) returned 0x20 [0098.205] GetModuleInformation (in: hProcess=0x304, hModule=0x76260000, lpmodinfo=0x23678bc, cb=0xc | out: lpmodinfo=0x23678bc*(lpBaseOfDll=0x76260000, SizeOfImage=0x46000, EntryPoint=0x76267478)) returned 1 [0098.205] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x76260000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="KERNELBASE.dll") returned 0xe [0098.205] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x76260000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\KERNELBASE.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll")) returned 0x22 [0098.205] GetModuleInformation (in: hProcess=0x304, hModule=0x75720000, lpmodinfo=0x2369a04, cb=0xc | out: lpmodinfo=0x2369a04*(lpBaseOfDll=0x75720000, SizeOfImage=0xa0000, EntryPoint=0x757349e5)) returned 1 [0098.205] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75720000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="ADVAPI32.dll") returned 0xc [0098.206] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75720000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\ADVAPI32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll")) returned 0x20 [0098.206] GetModuleInformation (in: hProcess=0x304, hModule=0x75fe0000, lpmodinfo=0x236bb18, cb=0xc | out: lpmodinfo=0x236bb18*(lpBaseOfDll=0x75fe0000, SizeOfImage=0xac000, EntryPoint=0x75fea472)) returned 1 [0098.206] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75fe0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="msvcrt.dll") returned 0xa [0098.206] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75fe0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll")) returned 0x1e [0098.206] GetModuleInformation (in: hProcess=0x304, hModule=0x761b0000, lpmodinfo=0x236dc24, cb=0xc | out: lpmodinfo=0x236dc24*(lpBaseOfDll=0x761b0000, SizeOfImage=0x19000, EntryPoint=0x761b4975)) returned 1 [0098.206] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x761b0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="sechost.dll") returned 0xb [0098.207] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x761b0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll")) returned 0x1f [0098.207] GetModuleInformation (in: hProcess=0x304, hModule=0x76090000, lpmodinfo=0x236fd30, cb=0xc | out: lpmodinfo=0x236fd30*(lpBaseOfDll=0x76090000, SizeOfImage=0xf0000, EntryPoint=0x760a0569)) returned 1 [0098.207] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x76090000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="RPCRT4.dll") returned 0xa [0098.207] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x76090000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\RPCRT4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll")) returned 0x1e [0098.207] GetModuleInformation (in: hProcess=0x304, hModule=0x75610000, lpmodinfo=0x2371e88, cb=0xc | out: lpmodinfo=0x2371e88*(lpBaseOfDll=0x75610000, SizeOfImage=0x60000, EntryPoint=0x7562a3b3)) returned 1 [0098.207] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75610000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="SspiCli.dll") returned 0xb [0098.208] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75610000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\SspiCli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll")) returned 0x1f [0098.208] GetModuleInformation (in: hProcess=0x304, hModule=0x75600000, lpmodinfo=0x2373f94, cb=0xc | out: lpmodinfo=0x2373f94*(lpBaseOfDll=0x75600000, SizeOfImage=0xc000, EntryPoint=0x756010e1)) returned 1 [0098.208] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75600000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="CRYPTBASE.dll") returned 0xd [0098.208] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75600000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\CRYPTBASE.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll")) returned 0x21 [0098.208] GetModuleInformation (in: hProcess=0x304, hModule=0x75430000, lpmodinfo=0x23760a8, cb=0xc | out: lpmodinfo=0x23760a8*(lpBaseOfDll=0x75430000, SizeOfImage=0x78000, EntryPoint=0x7543f7ba)) returned 1 [0098.209] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75430000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="mscoreei.dll") returned 0xc [0098.209] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75430000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscoreei.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\mscoreei.dll")) returned 0x3a [0098.209] GetModuleInformation (in: hProcess=0x304, hModule=0x761d0000, lpmodinfo=0x23781f0, cb=0xc | out: lpmodinfo=0x23781f0*(lpBaseOfDll=0x761d0000, SizeOfImage=0x57000, EntryPoint=0x761e9ba6)) returned 1 [0098.209] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x761d0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="SHLWAPI.dll") returned 0xb [0098.210] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x761d0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\SHLWAPI.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll")) returned 0x1f [0098.210] GetModuleInformation (in: hProcess=0x304, hModule=0x766d0000, lpmodinfo=0x237a2fc, cb=0xc | out: lpmodinfo=0x237a2fc*(lpBaseOfDll=0x766d0000, SizeOfImage=0x90000, EntryPoint=0x766e6343)) returned 1 [0098.210] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x766d0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="GDI32.dll") returned 0x9 [0098.210] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x766d0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\GDI32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll")) returned 0x1d [0098.211] GetModuleInformation (in: hProcess=0x304, hModule=0x775b0000, lpmodinfo=0x237c400, cb=0xc | out: lpmodinfo=0x237c400*(lpBaseOfDll=0x775b0000, SizeOfImage=0x100000, EntryPoint=0x775cb6ed)) returned 1 [0098.211] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x775b0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="USER32.dll") returned 0xa [0098.211] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x775b0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\USER32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll")) returned 0x1e [0098.211] GetModuleInformation (in: hProcess=0x304, hModule=0x75a70000, lpmodinfo=0x237e50c, cb=0xc | out: lpmodinfo=0x237e50c*(lpBaseOfDll=0x75a70000, SizeOfImage=0xa000, EntryPoint=0x75a736a0)) returned 1 [0098.212] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75a70000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="LPK.dll") returned 0x7 [0098.212] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75a70000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\LPK.dll" (normalized: "c:\\windows\\syswow64\\lpk.dll")) returned 0x1b [0098.212] GetModuleInformation (in: hProcess=0x304, hModule=0x758d0000, lpmodinfo=0x2380608, cb=0xc | out: lpmodinfo=0x2380608*(lpBaseOfDll=0x758d0000, SizeOfImage=0x9d000, EntryPoint=0x75903fd7)) returned 1 [0098.212] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x758d0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="USP10.dll") returned 0x9 [0098.213] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x758d0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\USP10.dll" (normalized: "c:\\windows\\syswow64\\usp10.dll")) returned 0x1d [0098.213] GetModuleInformation (in: hProcess=0x304, hModule=0x75f80000, lpmodinfo=0x2382798, cb=0xc | out: lpmodinfo=0x2382798*(lpBaseOfDll=0x75f80000, SizeOfImage=0x60000, EntryPoint=0x75f9158f)) returned 1 [0098.213] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75f80000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="IMM32.DLL") returned 0x9 [0098.213] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75f80000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\system32\\IMM32.DLL" (normalized: "c:\\windows\\system32\\imm32.dll")) returned 0x1d [0098.214] GetModuleInformation (in: hProcess=0x304, hModule=0x75ea0000, lpmodinfo=0x238489c, cb=0xc | out: lpmodinfo=0x238489c*(lpBaseOfDll=0x75ea0000, SizeOfImage=0xcc000, EntryPoint=0x75ea168b)) returned 1 [0098.214] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75ea0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="MSCTF.dll") returned 0x9 [0098.214] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75ea0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\MSCTF.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll")) returned 0x1d [0098.215] GetModuleInformation (in: hProcess=0x304, hModule=0x75420000, lpmodinfo=0x23869a0, cb=0xc | out: lpmodinfo=0x23869a0*(lpBaseOfDll=0x75420000, SizeOfImage=0x9000, EntryPoint=0x75421220)) returned 1 [0098.215] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75420000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="VERSION.dll") returned 0xb [0098.215] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75420000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\system32\\VERSION.dll" (normalized: "c:\\windows\\system32\\version.dll")) returned 0x1f [0098.216] GetModuleInformation (in: hProcess=0x304, hModule=0x74890000, lpmodinfo=0x2388aac, cb=0xc | out: lpmodinfo=0x2388aac*(lpBaseOfDll=0x74890000, SizeOfImage=0x6a8000, EntryPoint=0x749d7040)) returned 1 [0098.216] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x74890000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="clr.dll") returned 0x7 [0098.216] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x74890000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\clr.dll")) returned 0x35 [0098.216] GetModuleInformation (in: hProcess=0x304, hModule=0x75320000, lpmodinfo=0x238abdc, cb=0xc | out: lpmodinfo=0x238abdc*(lpBaseOfDll=0x75320000, SizeOfImage=0xf5000, EntryPoint=0x75374160)) returned 1 [0098.217] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75320000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="MSVCR120_CLR0400.dll") returned 0x14 [0098.217] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75320000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\system32\\MSVCR120_CLR0400.dll" (normalized: "c:\\windows\\system32\\msvcr120_clr0400.dll")) returned 0x28 [0098.217] GetModuleInformation (in: hProcess=0x304, hModule=0x72440000, lpmodinfo=0x238cd10, cb=0xc | out: lpmodinfo=0x238cd10*(lpBaseOfDll=0x72440000, SizeOfImage=0x122b000, EntryPoint=0x0)) returned 1 [0098.218] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x72440000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="mscorlib.ni.dll") returned 0xf [0098.218] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x72440000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\b7a12c4c0032847fcc6b9c710460456f\\mscorlib.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\mscorlib\\b7a12c4c0032847fcc6b9c710460456f\\mscorlib.ni.dll")) returned 0x68 [0098.218] GetModuleInformation (in: hProcess=0x304, hModule=0x764e0000, lpmodinfo=0x238eeb8, cb=0xc | out: lpmodinfo=0x238eeb8*(lpBaseOfDll=0x764e0000, SizeOfImage=0x15c000, EntryPoint=0x7652ba3d)) returned 1 [0098.219] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x764e0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="ole32.dll") returned 0x9 [0098.219] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x764e0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll")) returned 0x1d [0098.219] GetModuleInformation (in: hProcess=0x304, hModule=0x74f60000, lpmodinfo=0x2390fbc, cb=0xc | out: lpmodinfo=0x2390fbc*(lpBaseOfDll=0x74f60000, SizeOfImage=0x80000, EntryPoint=0x74f737c9)) returned 1 [0098.220] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x74f60000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="uxtheme.dll") returned 0xb [0098.220] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x74f60000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\system32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll")) returned 0x1f [0098.221] GetModuleInformation (in: hProcess=0x304, hModule=0x752a0000, lpmodinfo=0x23930c8, cb=0xc | out: lpmodinfo=0x23930c8*(lpBaseOfDll=0x752a0000, SizeOfImage=0x7d000, EntryPoint=0x752a1140)) returned 1 [0098.221] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x752a0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="clrjit.dll") returned 0xa [0098.222] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x752a0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clrjit.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\clrjit.dll")) returned 0x38 [0098.222] GetModuleInformation (in: hProcess=0x304, hModule=0x762b0000, lpmodinfo=0x2395208, cb=0xc | out: lpmodinfo=0x2395208*(lpBaseOfDll=0x762b0000, SizeOfImage=0x8f000, EntryPoint=0x762b3fb1)) returned 1 [0098.222] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x762b0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="OLEAUT32.dll") returned 0xc [0098.223] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x762b0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\OLEAUT32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll")) returned 0x20 [0098.223] GetModuleInformation (in: hProcess=0x304, hModule=0x736d0000, lpmodinfo=0x239731c, cb=0xc | out: lpmodinfo=0x239731c*(lpBaseOfDll=0x736d0000, SizeOfImage=0x9ad000, EntryPoint=0x0)) returned 1 [0098.224] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x736d0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="System.ni.dll") returned 0xd [0098.224] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x736d0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System\\500ffa28b327e171fe664023003e947e\\System.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system\\500ffa28b327e171fe664023003e947e\\system.ni.dll")) returned 0x64 [0098.225] GetModuleInformation (in: hProcess=0x304, hModule=0x71d20000, lpmodinfo=0x23994b8, cb=0xc | out: lpmodinfo=0x23994b8*(lpBaseOfDll=0x71d20000, SizeOfImage=0x716000, EntryPoint=0x0)) returned 1 [0098.225] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x71d20000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="System.Core.ni.dll") returned 0x12 [0098.225] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x71d20000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Core\\386fde9190d499d6645df8b90eb76242\\System.Core.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.core\\386fde9190d499d6645df8b90eb76242\\system.core.ni.dll")) returned 0x6e [0098.226] GetModuleInformation (in: hProcess=0x304, hModule=0x750d0000, lpmodinfo=0x239b674, cb=0xc | out: lpmodinfo=0x239b674*(lpBaseOfDll=0x750d0000, SizeOfImage=0x1cb000, EntryPoint=0x0)) returned 1 [0098.226] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x750d0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="Microsoft.VisualBasic.ni.dll") returned 0x1c [0098.227] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x750d0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Microsoft.V9921e851#\\cfbddeb6e93e8f421b92229b20e51233\\Microsoft.VisualBasic.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\microsoft.v9921e851#\\cfbddeb6e93e8f421b92229b20e51233\\microsoft.visualbasic.ni.dll")) returned 0x81 [0098.227] GetModuleInformation (in: hProcess=0x304, hModule=0x750b0000, lpmodinfo=0x239d868, cb=0xc | out: lpmodinfo=0x239d868*(lpBaseOfDll=0x750b0000, SizeOfImage=0x13000, EntryPoint=0x750b18f0)) returned 1 [0098.227] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x750b0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="nlssorting.dll") returned 0xe [0098.228] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x750b0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\nlssorting.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\nlssorting.dll")) returned 0x3c [0098.228] GetModuleInformation (in: hProcess=0x304, hModule=0x74870000, lpmodinfo=0x239f9b8, cb=0xc | out: lpmodinfo=0x239f9b8*(lpBaseOfDll=0x74870000, SizeOfImage=0x16000, EntryPoint=0x74872dc3)) returned 1 [0098.229] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x74870000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="CRYPTSP.dll") returned 0xb [0098.229] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x74870000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\system32\\CRYPTSP.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll")) returned 0x1f [0098.230] GetModuleInformation (in: hProcess=0x304, hModule=0x74830000, lpmodinfo=0x23a1ac4, cb=0xc | out: lpmodinfo=0x23a1ac4*(lpBaseOfDll=0x74830000, SizeOfImage=0x3b000, EntryPoint=0x7483128d)) returned 1 [0098.230] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x74830000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="rsaenh.dll") returned 0xa [0098.230] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x74830000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\system32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll")) returned 0x1e [0098.235] lstrcpynA (in: lpString1=0x4990ac, lpString2="I???IQMk???z??R?XK????????MgYy?w?xC?", iMaxLength=8 | out: lpString1="I???IQM") returned="I???IQM" [0098.235] lstrcpynA (in: lpString1=0x4990c4, lpString2="????c?Gw???f??", iMaxLength=10 | out: lpString1="????c?Gw?") returned="????c?Gw?" [0098.235] lstrcpynA (in: lpString1=0x4990bc, lpString2="t??D??u???lF?Da???e?K??", iMaxLength=10 | out: lpString1="t??D??u??") returned="t??D??u??" [0098.235] lstrcpynA (in: lpString1=0x4990a8, lpString2="HO???Q?y?HA???MY???POrl?????UyHfKn???lBf?I", iMaxLength=12 | out: lpString1="HO???Q?y?HA") returned="HO???Q?y?HA" [0098.235] lstrcpynA (in: lpString1=0x4990c0, lpString2="uv?????QhDk??a?h", iMaxLength=12 | out: lpString1="uv?????QhDk") returned="uv?????QhDk" [0098.236] lstrcpynA (in: lpString1=0x4990bc, lpString2="??o?A?N??e??v?????S?M", iMaxLength=3 | out: lpString1="??") returned="??" [0098.236] lstrcpynA (in: lpString1=0x4990b4, lpString2="iNG?G??nB?Ig?xllmZg?n?k??b?ME?P", iMaxLength=21 | out: lpString1="iNG?G??nB?Ig?xllmZg?") returned="iNG?G??nB?Ig?xllmZg?" [0098.236] lstrcpynA (in: lpString1=0x4990b8, lpString2="ks???m???FN??x?Q???dFO??k?", iMaxLength=3 | out: lpString1="ks") returned="ks" [0098.236] lstrcpynA (in: lpString1=0x4990a8, lpString2="?NT?woL??L??Yj?nGU????????mlG?h?d??w??z???", iMaxLength=14 | out: lpString1="?NT?woL??L??Y") returned="?NT?woL??L??Y" [0098.236] lstrcpynA (in: lpString1=0x4990ac, lpString2="r?x?m?Fg?????k?Q??R???C???fs??L??????C", iMaxLength=27 | out: lpString1="r?x?m?Fg?????k?Q??R???C???") returned="r?x?m?Fg?????k?Q??R???C???" [0098.236] lstrcpynA (in: lpString1=0x499070, lpString2="???p?r??P?z??mF????EBn?y?MALEl??U?W?yX?sCpL?Dur?jS?g?v?LGNKO?ALl?W?????a???G????V?R?Q?PsA?n?r?Ls?Q", iMaxLength=11 | out: lpString1="???p?r??P?") returned="???p?r??P?" [0098.236] lstrcpynA (in: lpString1=0x4990ac, lpString2="?H??NrHQ?????to?????Gj?riaQ?????Ruy?E", iMaxLength=14 | out: lpString1="?H??NrHQ?????") returned="?H??NrHQ?????" [0098.236] lstrcpynA (in: lpString1=0x499088, lpString2="sP??P?GtEPFx?r????G?????d???xm?D??T??h?H??VPPMZr?g??d?j?H????H?r?e?u????t?", iMaxLength=68 | out: lpString1="sP??P?GtEPFx?r????G?????d???xm?D??T??h?H??VPPMZr?g??d?j?H????H?r?e?") returned="sP??P?GtEPFx?r????G?????d???xm?D??T??h?H??VPPMZr?g??d?j?H????H?r?e?" [0098.236] lstrcpynA (in: lpString1=0x499090, lpString2="??s??u??Wc???AF????Z?O?FT?Pr?f?RJ?wh?s??L??GLrn?mf?Xt?aJ??????Bg", iMaxLength=40 | out: lpString1="??s??u??Wc???AF????Z?O?FT?Pr?f?RJ?wh?s?") returned="??s??u??Wc???AF????Z?O?FT?Pr?f?RJ?wh?s?" [0098.236] lstrcpynA (in: lpString1=0x499084, lpString2="PnvJ?uw????W???M?lm???Z??Uo?H????Mne?v???P?x?S??????Q?j??n?J?EM??e?n???ZZQ?D", iMaxLength=60 | out: lpString1="PnvJ?uw????W???M?lm???Z??Uo?H????Mne?v???P?x?S??????Q?j??n?") returned="PnvJ?uw????W???M?lm???Z??Uo?H????Mne?v???P?x?S??????Q?j??n?" [0098.236] lstrcpynA (in: lpString1=0x4990bc, lpString2="Af?KfE??A?v?KXw???P???J", iMaxLength=1 | out: lpString1="") returned="" [0098.236] lstrcpynA (in: lpString1=0x4990c4, lpString2="?????r?i?", iMaxLength=3 | out: lpString1="??") returned="??" [0098.236] lstrcpynA (in: lpString1=0x499094, lpString2="O??y??r?mP???X??????k???????FjE?E??r?DX?ks??Fi??d?hFl????XGrsR?", iMaxLength=5 | out: lpString1="O??y") returned="O??y" [0098.236] lstrcpynA (in: lpString1=0x499098, lpString2="E???B?R?i?Yz??a??e??Nb?W??K??M????M??????eN??W?ge??ozrku?", iMaxLength=14 | out: lpString1="E???B?R?i?Yz?") returned="E???B?R?i?Yz?" [0098.236] lstrcpynA (in: lpString1=0x4990c0, lpString2="???W??k?Ht?Ph?V?A?E", iMaxLength=5 | out: lpString1="???W") returned="???W" [0098.237] lstrcpynA (in: lpString1=0x4990b0, lpString2="??B?HX?C?U?Qg?X????????yU?I???x?g", iMaxLength=19 | out: lpString1="??B?HX?C?U?Qg?X???") returned="??B?HX?C?U?Qg?X???" [0098.237] lstrcpynA (in: lpString1=0x4990b8, lpString2="??p??Dt??O??????????ZK?fh", iMaxLength=22 | out: lpString1="??p??Dt??O??????????Z") returned="??p??Dt??O??????????Z" [0098.237] lstrcpynA (in: lpString1=0x499090, lpString2="f???????o?????MD????Sn?I???c??????C?zdR??t??vl??v?XbQ?G???g?V???x?", iMaxLength=52 | out: lpString1="f???????o?????MD????Sn?I???c??????C?zdR??t??vl??v?X") returned="f???????o?????MD????Sn?I???c??????C?zdR??t??vl??v?X" [0098.237] lstrcpynA (in: lpString1=0x49908c, lpString2="x?M??IJ?s????vo?CA??????bFBW?IJEY????Kpi??V????N????f??????m?jn?v????A", iMaxLength=55 | out: lpString1="x?M??IJ?s????vo?CA??????bFBW?IJEY????Kpi??V????N????f?") returned="x?M??IJ?s????vo?CA??????bFBW?IJEY????Kpi??V????N????f?" [0098.237] lstrcpynA (in: lpString1=0x4990a4, lpString2="?sRV?????p??hV?ff???vV??Zw?s?W??R???TWxe??MjtA?", iMaxLength=9 | out: lpString1="?sRV????") returned="?sRV????" [0098.237] lstrcpynA (in: lpString1=0x4990bc, lpString2="?FKI?B?t???h?ES???d?", iMaxLength=17 | out: lpString1="?FKI?B?t???h?ES?") returned="?FKI?B?t???h?ES?" [0098.237] lstrcpynA (in: lpString1=0x4990ac, lpString2="A???pZ?FXt?h?HGQ?nBS??????h???DP?????a?", iMaxLength=15 | out: lpString1="A???pZ?FXt?h?H") returned="A???pZ?FXt?h?H" [0098.237] lstrcpynA (in: lpString1=0x499088, lpString2="NHv?kc?W?EK?????XTd??????K?D?RuL?e???????Z?iUMN?TQ?g????????V??Nv?e?MdF?Y", iMaxLength=45 | out: lpString1="NHv?kc?W?EK?????XTd??????K?D?RuL?e???????Z?i") returned="NHv?kc?W?EK?????XTd??????K?D?RuL?e???????Z?i" [0098.237] lstrcpynA (in: lpString1=0x4990c4, lpString2="?m??xoP", iMaxLength=5 | out: lpString1="?m??") returned="?m??" [0098.237] lstrcpynA (in: lpString1=0x499078, lpString2="u???omoW?m?UB?lz?d?m???E?V?E?X?T?h??D?Xu??????rir?V?aDl?x?D?Z??I???PX??K???s????Z?Q??cxj?", iMaxLength=3 | out: lpString1="u?") returned="u?" [0098.237] lstrcpynA (in: lpString1=0x4990bc, lpString2="????VLuj???ou?O?i?G?", iMaxLength=15 | out: lpString1="????VLuj???ou?") returned="????VLuj???ou?" [0098.237] lstrcpynA (in: lpString1=0x499094, lpString2="xPOM?DKdyx?j?v?M?V?f???A????d?B?yj?gs??XOLt??l??f?VJ????J??b", iMaxLength=25 | out: lpString1="xPOM?DKdyx?j?v?M?V?f???A") returned="xPOM?DKdyx?j?v?M?V?f???A" [0098.237] lstrcpynA (in: lpString1=0x4990c0, lpString2="??s??JH??Y?J?oC??u", iMaxLength=6 | out: lpString1="??s??") returned="??s??" [0098.237] lstrcpynA (in: lpString1=0x4990c4, lpString2="??Ua?f", iMaxLength=1 | out: lpString1="") returned="" [0098.237] lstrcpynA (in: lpString1=0x4990ac, lpString2="Z?hVo?V???CF??zO???J???????L?E??UM????", iMaxLength=25 | out: lpString1="Z?hVo?V???CF??zO???J????") returned="Z?hVo?V???CF??zO???J????" [0098.237] lstrcpynA (in: lpString1=0x499094, lpString2="?????????Q????gM???yjS??oT??J?x???c?ya???k?????C??nxS??SS???", iMaxLength=16 | out: lpString1="?????????Q????g") returned="?????????Q????g" [0098.237] lstrcpynA (in: lpString1=0x499074, lpString2="is??XDC????????B?fw?L?Lj???d?k?pu?????wbd?X?e??Fgu?lZR?i??D??Ps?T???Ce??f?????gykj??vA??b?a???", iMaxLength=31 | out: lpString1="is??XDC????????B?fw?L?Lj???d?k") returned="is??XDC????????B?fw?L?Lj???d?k" [0098.237] lstrcpynA (in: lpString1=0x499084, lpString2="F????dHky??????IX?S?M??k????F?????M??Ub?QyYgS?pkPbp???FZ?LWoz??Xs?m??t?g?BPX?", iMaxLength=54 | out: lpString1="F????dHky??????IX?S?M??k????F?????M??Ub?QyYgS?pkPbp??") returned="F????dHky??????IX?S?M??k????F?????M??Ub?QyYgS?pkPbp??" [0098.238] lstrcpynA (in: lpString1=0x499084, lpString2="?Mj?????u?juj??Q?t?P??YB?oi?????dYLc??nu?h?s?pX??c??y?Fkc???B??G????GN?u???Fbx?", iMaxLength=69 | out: lpString1="?Mj?????u?juj??Q?t?P??YB?oi?????dYLc??nu?h?s?pX??c??y?Fkc???B??G????") returned="?Mj?????u?juj??Q?t?P??YB?oi?????dYLc??nu?h?s?pX??c??y?Fkc???B??G????" [0098.238] lstrcpynA (in: lpString1=0x499078, lpString2="??P?U?W??nZ???fhih?HY???Pxw?w??kia???p??gN??Mgw?su??lw?hh?mf?I?y?E????????E?i?VcxW??n??i??", iMaxLength=29 | out: lpString1="??P?U?W??nZ???fhih?HY???Pxw?") returned="??P?U?W??nZ???fhih?HY???Pxw?" [0098.238] lstrcmpiA (lpString1="I???IQM7", lpString2="????c?Gw?9") returned 1 [0098.238] lstrcmpiA (lpString1="????c?Gw?9", lpString2="t??D??u??9") returned -1 [0098.238] lstrcmpiA (lpString1="t??D??u??9", lpString2="HO???Q?y?HA11") returned 1 [0098.238] lstrcmpiA (lpString1="HO???Q?y?HA11", lpString2="uv?????QhDk11") returned -1 [0098.238] lstrcmpiA (lpString1="uv?????QhDk11", lpString2="??2") returned 1 [0098.238] lstrcmpiA (lpString1="??2", lpString2="iNG?G??nB?Ig?xllmZg?20") returned -1 [0098.238] lstrcmpiA (lpString1="iNG?G??nB?Ig?xllmZg?20", lpString2="ks2") returned -1 [0098.238] lstrcmpiA (lpString1="ks2", lpString2="?NT?woL??L??Y13") returned 1 [0098.238] lstrcmpiA (lpString1="?NT?woL??L??Y13", lpString2="r?x?m?Fg?????k?Q??R???C???26") returned -1 [0098.239] lstrcmpiA (lpString1="r?x?m?Fg?????k?Q??R???C???26", lpString2="???p?r??P?10") returned 1 [0098.239] lstrcmpiA (lpString1="???p?r??P?10", lpString2="?H??NrHQ?????13") returned -1 [0098.239] lstrcmpiA (lpString1="?H??NrHQ?????13", lpString2="sP??P?GtEPFx?r????G?????d???xm?D??T??h?H??VPPMZr?g??d?j?H????H?r?e?67") returned -1 [0098.239] lstrcmpiA (lpString1="sP??P?GtEPFx?r????G?????d???xm?D??T??h?H??VPPMZr?g??d?j?H????H?r?e?67", lpString2="??s??u??Wc???AF????Z?O?FT?Pr?f?RJ?wh?s?39") returned 1 [0098.239] lstrcmpiA (lpString1="??s??u??Wc???AF????Z?O?FT?Pr?f?RJ?wh?s?39", lpString2="PnvJ?uw????W???M?lm???Z??Uo?H????Mne?v???P?x?S??????Q?j??n?59") returned -1 [0098.239] lstrcmpiA (lpString1="PnvJ?uw????W???M?lm???Z??Uo?H????Mne?v???P?x?S??????Q?j??n?59", lpString2="0") returned 1 [0098.239] lstrcmpiA (lpString1="0", lpString2="??2") returned 1 [0098.239] lstrcmpiA (lpString1="??2", lpString2="O??y4") returned -1 [0098.239] lstrcmpiA (lpString1="O??y4", lpString2="E???B?R?i?Yz?13") returned 1 [0098.239] lstrcmpiA (lpString1="E???B?R?i?Yz?13", lpString2="???W4") returned 1 [0098.239] lstrcmpiA (lpString1="???W4", lpString2="??B?HX?C?U?Qg?X???18") returned -1 [0098.239] lstrcmpiA (lpString1="??B?HX?C?U?Qg?X???18", lpString2="??p??Dt??O??????????Z21") returned -1 [0098.239] lstrcmpiA (lpString1="??p??Dt??O??????????Z21", lpString2="f???????o?????MD????Sn?I???c??????C?zdR??t??vl??v?X51") returned -1 [0098.239] lstrcmpiA (lpString1="f???????o?????MD????Sn?I???c??????C?zdR??t??vl??v?X51", lpString2="x?M??IJ?s????vo?CA??????bFBW?IJEY????Kpi??V????N????f?54") returned -1 [0098.239] lstrcmpiA (lpString1="x?M??IJ?s????vo?CA??????bFBW?IJEY????Kpi??V????N????f?54", lpString2="?sRV????8") returned 1 [0098.239] lstrcmpiA (lpString1="?sRV????8", lpString2="?FKI?B?t???h?ES?16") returned 1 [0098.239] lstrcmpiA (lpString1="?FKI?B?t???h?ES?16", lpString2="A???pZ?FXt?h?H14") returned -1 [0098.239] lstrcmpiA (lpString1="A???pZ?FXt?h?H14", lpString2="NHv?kc?W?EK?????XTd??????K?D?RuL?e???????Z?i44") returned -1 [0098.239] lstrcmpiA (lpString1="NHv?kc?W?EK?????XTd??????K?D?RuL?e???????Z?i44", lpString2="?m??4") returned 1 [0098.239] lstrcmpiA (lpString1="?m??4", lpString2="u?2") returned -1 [0098.239] lstrcmpiA (lpString1="u?2", lpString2="????VLuj???ou?14") returned 1 [0098.239] lstrcmpiA (lpString1="????VLuj???ou?14", lpString2="xPOM?DKdyx?j?v?M?V?f???A24") returned -1 [0098.239] lstrcmpiA (lpString1="xPOM?DKdyx?j?v?M?V?f???A24", lpString2="??s??5") returned 1 [0098.239] lstrcmpiA (lpString1="??s??5", lpString2="0") returned -1 [0098.239] lstrcmpiA (lpString1="0", lpString2="Z?hVo?V???CF??zO???J????24") returned -1 [0098.239] lstrcmpiA (lpString1="Z?hVo?V???CF??zO???J????24", lpString2="?????????Q????g15") returned 1 [0098.239] lstrcmpiA (lpString1="?????????Q????g15", lpString2="is??XDC????????B?fw?L?Lj???d?k30") returned -1 [0098.239] lstrcmpiA (lpString1="is??XDC????????B?fw?L?Lj???d?k30", lpString2="F????dHky??????IX?S?M??k????F?????M??Ub?QyYgS?pkPbp??53") returned 1 [0098.239] lstrcmpiA (lpString1="F????dHky??????IX?S?M??k????F?????M??Ub?QyYgS?pkPbp??53", lpString2="?Mj?????u?juj??Q?t?P??YB?oi?????dYLc??nu?h?s?pX??c??y?Fkc???B??G????68") returned 1 [0098.239] lstrcmpiA (lpString1="?Mj?????u?juj??Q?t?P??YB?oi?????dYLc??nu?h?s?pX??c??y?Fkc???B??G????68", lpString2="??P?U?W??nZ???fhih?HY???Pxw?28") returned 1 [0098.239] lstrcmpiA (lpString1="??P?U?W??nZ???fhih?HY???Pxw?28", lpString2="w?M?Lb?BrN??O???obyt?21") returned -1 [0098.254] ReadProcessMemory (in: hProcess=0x2fc, lpBaseAddress=0x7efde008, lpBuffer=0x231eecc, nSize=0x4, lpNumberOfBytesRead=0x231eed8 | out: lpBuffer=0x231eecc*, lpNumberOfBytesRead=0x231eed8*=0x4) returned 1 [0098.276] GetCurrentProcessId () returned 0x9f8 [0098.277] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x9f8) returned 0x304 [0098.277] EnumProcessModules (in: hProcess=0x304, lphModule=0x2327490, cb=0x100, lpcbNeeded=0x498850 | out: lphModule=0x2327490, lpcbNeeded=0x498850) returned 1 [0098.277] GetModuleInformation (in: hProcess=0x304, hModule=0x310000, lpmodinfo=0x23275d0, cb=0xc | out: lpmodinfo=0x23275d0*(lpBaseOfDll=0x310000, SizeOfImage=0x3e000, EntryPoint=0x3479ce)) returned 1 [0098.277] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.277] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x310000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="unlikexpc.exe") returned 0xd [0098.277] CoTaskMemFree (pv=0x5d7900) [0098.278] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.278] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x310000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\unlikexpc.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\unlikexpc.exe")) returned 0x33 [0098.278] CoTaskMemFree (pv=0x5d7900) [0098.278] GetModuleInformation (in: hProcess=0x304, hModule=0x77ab0000, lpmodinfo=0x2329724, cb=0xc | out: lpmodinfo=0x2329724*(lpBaseOfDll=0x77ab0000, SizeOfImage=0x180000, EntryPoint=0x0)) returned 1 [0098.278] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.278] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x77ab0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="ntdll.dll") returned 0x9 [0098.278] CoTaskMemFree (pv=0x5d7900) [0098.278] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.278] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x77ab0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll")) returned 0x1d [0098.278] CoTaskMemFree (pv=0x5d7900) [0098.278] GetModuleInformation (in: hProcess=0x304, hModule=0x754b0000, lpmodinfo=0x232b828, cb=0xc | out: lpmodinfo=0x232b828*(lpBaseOfDll=0x754b0000, SizeOfImage=0x4a000, EntryPoint=0x754b2e54)) returned 1 [0098.278] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.278] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x754b0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="MSCOREE.DLL") returned 0xb [0098.278] CoTaskMemFree (pv=0x5d7900) [0098.278] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.278] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x754b0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\MSCOREE.DLL" (normalized: "c:\\windows\\system32\\mscoree.dll")) returned 0x1f [0098.279] CoTaskMemFree (pv=0x5d7900) [0098.279] GetModuleInformation (in: hProcess=0x304, hModule=0x757c0000, lpmodinfo=0x232d934, cb=0xc | out: lpmodinfo=0x232d934*(lpBaseOfDll=0x757c0000, SizeOfImage=0x110000, EntryPoint=0x757d32d3)) returned 1 [0098.279] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.279] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x757c0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="KERNEL32.dll") returned 0xc [0098.279] CoTaskMemFree (pv=0x5d7900) [0098.279] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.279] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x757c0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\KERNEL32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll")) returned 0x20 [0098.279] CoTaskMemFree (pv=0x5d7900) [0098.279] GetModuleInformation (in: hProcess=0x304, hModule=0x76260000, lpmodinfo=0x232fa48, cb=0xc | out: lpmodinfo=0x232fa48*(lpBaseOfDll=0x76260000, SizeOfImage=0x46000, EntryPoint=0x76267478)) returned 1 [0098.279] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.279] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x76260000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="KERNELBASE.dll") returned 0xe [0098.279] CoTaskMemFree (pv=0x5d7900) [0098.279] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.280] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x76260000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\KERNELBASE.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll")) returned 0x22 [0098.280] CoTaskMemFree (pv=0x5d7900) [0098.280] GetModuleInformation (in: hProcess=0x304, hModule=0x75720000, lpmodinfo=0x2331b90, cb=0xc | out: lpmodinfo=0x2331b90*(lpBaseOfDll=0x75720000, SizeOfImage=0xa0000, EntryPoint=0x757349e5)) returned 1 [0098.280] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.280] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75720000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="ADVAPI32.dll") returned 0xc [0098.280] CoTaskMemFree (pv=0x5d7900) [0098.280] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.280] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75720000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\ADVAPI32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll")) returned 0x20 [0098.280] CoTaskMemFree (pv=0x5d7900) [0098.280] GetModuleInformation (in: hProcess=0x304, hModule=0x75fe0000, lpmodinfo=0x2333ca4, cb=0xc | out: lpmodinfo=0x2333ca4*(lpBaseOfDll=0x75fe0000, SizeOfImage=0xac000, EntryPoint=0x75fea472)) returned 1 [0098.280] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.280] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75fe0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="msvcrt.dll") returned 0xa [0098.281] CoTaskMemFree (pv=0x5d7900) [0098.281] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.281] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75fe0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll")) returned 0x1e [0098.281] CoTaskMemFree (pv=0x5d7900) [0098.281] GetModuleInformation (in: hProcess=0x304, hModule=0x761b0000, lpmodinfo=0x2335db0, cb=0xc | out: lpmodinfo=0x2335db0*(lpBaseOfDll=0x761b0000, SizeOfImage=0x19000, EntryPoint=0x761b4975)) returned 1 [0098.281] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.281] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x761b0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="sechost.dll") returned 0xb [0098.281] CoTaskMemFree (pv=0x5d7900) [0098.281] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.281] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x761b0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll")) returned 0x1f [0098.282] CoTaskMemFree (pv=0x5d7900) [0098.282] GetModuleInformation (in: hProcess=0x304, hModule=0x76090000, lpmodinfo=0x2337ebc, cb=0xc | out: lpmodinfo=0x2337ebc*(lpBaseOfDll=0x76090000, SizeOfImage=0xf0000, EntryPoint=0x760a0569)) returned 1 [0098.282] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.282] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x76090000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="RPCRT4.dll") returned 0xa [0098.282] CoTaskMemFree (pv=0x5d7900) [0098.282] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.282] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x76090000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\RPCRT4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll")) returned 0x1e [0098.282] CoTaskMemFree (pv=0x5d7900) [0098.282] GetModuleInformation (in: hProcess=0x304, hModule=0x75610000, lpmodinfo=0x233a014, cb=0xc | out: lpmodinfo=0x233a014*(lpBaseOfDll=0x75610000, SizeOfImage=0x60000, EntryPoint=0x7562a3b3)) returned 1 [0098.282] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.282] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75610000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="SspiCli.dll") returned 0xb [0098.283] CoTaskMemFree (pv=0x5d7900) [0098.283] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.283] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75610000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\SspiCli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll")) returned 0x1f [0098.283] CoTaskMemFree (pv=0x5d7900) [0098.283] GetModuleInformation (in: hProcess=0x304, hModule=0x75600000, lpmodinfo=0x233c120, cb=0xc | out: lpmodinfo=0x233c120*(lpBaseOfDll=0x75600000, SizeOfImage=0xc000, EntryPoint=0x756010e1)) returned 1 [0098.283] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.283] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75600000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="CRYPTBASE.dll") returned 0xd [0098.284] CoTaskMemFree (pv=0x5d7900) [0098.284] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.284] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75600000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\CRYPTBASE.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll")) returned 0x21 [0098.284] CoTaskMemFree (pv=0x5d7900) [0098.284] GetModuleInformation (in: hProcess=0x304, hModule=0x75430000, lpmodinfo=0x233e234, cb=0xc | out: lpmodinfo=0x233e234*(lpBaseOfDll=0x75430000, SizeOfImage=0x78000, EntryPoint=0x7543f7ba)) returned 1 [0098.284] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.284] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75430000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="mscoreei.dll") returned 0xc [0098.284] CoTaskMemFree (pv=0x5d7900) [0098.284] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.284] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75430000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscoreei.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\mscoreei.dll")) returned 0x3a [0098.285] CoTaskMemFree (pv=0x5d7900) [0098.285] GetModuleInformation (in: hProcess=0x304, hModule=0x761d0000, lpmodinfo=0x234037c, cb=0xc | out: lpmodinfo=0x234037c*(lpBaseOfDll=0x761d0000, SizeOfImage=0x57000, EntryPoint=0x761e9ba6)) returned 1 [0098.285] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.285] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x761d0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="SHLWAPI.dll") returned 0xb [0098.285] CoTaskMemFree (pv=0x5d7900) [0098.285] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.285] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x761d0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\SHLWAPI.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll")) returned 0x1f [0098.286] CoTaskMemFree (pv=0x5d7900) [0098.286] GetModuleInformation (in: hProcess=0x304, hModule=0x766d0000, lpmodinfo=0x2342488, cb=0xc | out: lpmodinfo=0x2342488*(lpBaseOfDll=0x766d0000, SizeOfImage=0x90000, EntryPoint=0x766e6343)) returned 1 [0098.286] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.286] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x766d0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="GDI32.dll") returned 0x9 [0098.286] CoTaskMemFree (pv=0x5d7900) [0098.286] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.286] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x766d0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\GDI32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll")) returned 0x1d [0098.287] CoTaskMemFree (pv=0x5d7900) [0098.287] GetModuleInformation (in: hProcess=0x304, hModule=0x775b0000, lpmodinfo=0x234458c, cb=0xc | out: lpmodinfo=0x234458c*(lpBaseOfDll=0x775b0000, SizeOfImage=0x100000, EntryPoint=0x775cb6ed)) returned 1 [0098.287] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.287] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x775b0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="USER32.dll") returned 0xa [0098.287] CoTaskMemFree (pv=0x5d7900) [0098.287] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.287] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x775b0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\USER32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll")) returned 0x1e [0098.288] CoTaskMemFree (pv=0x5d7900) [0098.288] GetModuleInformation (in: hProcess=0x304, hModule=0x75a70000, lpmodinfo=0x2346698, cb=0xc | out: lpmodinfo=0x2346698*(lpBaseOfDll=0x75a70000, SizeOfImage=0xa000, EntryPoint=0x75a736a0)) returned 1 [0098.288] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.288] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75a70000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="LPK.dll") returned 0x7 [0098.288] CoTaskMemFree (pv=0x5d7900) [0098.288] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.288] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75a70000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\LPK.dll" (normalized: "c:\\windows\\syswow64\\lpk.dll")) returned 0x1b [0098.289] CoTaskMemFree (pv=0x5d7900) [0098.289] GetModuleInformation (in: hProcess=0x304, hModule=0x758d0000, lpmodinfo=0x2348794, cb=0xc | out: lpmodinfo=0x2348794*(lpBaseOfDll=0x758d0000, SizeOfImage=0x9d000, EntryPoint=0x75903fd7)) returned 1 [0098.289] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.289] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x758d0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="USP10.dll") returned 0x9 [0098.289] CoTaskMemFree (pv=0x5d7900) [0098.289] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.289] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x758d0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\USP10.dll" (normalized: "c:\\windows\\syswow64\\usp10.dll")) returned 0x1d [0098.290] CoTaskMemFree (pv=0x5d7900) [0098.290] GetModuleInformation (in: hProcess=0x304, hModule=0x75f80000, lpmodinfo=0x234a924, cb=0xc | out: lpmodinfo=0x234a924*(lpBaseOfDll=0x75f80000, SizeOfImage=0x60000, EntryPoint=0x75f9158f)) returned 1 [0098.290] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.290] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75f80000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="IMM32.DLL") returned 0x9 [0098.290] CoTaskMemFree (pv=0x5d7900) [0098.290] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.290] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75f80000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\system32\\IMM32.DLL" (normalized: "c:\\windows\\system32\\imm32.dll")) returned 0x1d [0098.291] CoTaskMemFree (pv=0x5d7900) [0098.291] GetModuleInformation (in: hProcess=0x304, hModule=0x75ea0000, lpmodinfo=0x234ca28, cb=0xc | out: lpmodinfo=0x234ca28*(lpBaseOfDll=0x75ea0000, SizeOfImage=0xcc000, EntryPoint=0x75ea168b)) returned 1 [0098.291] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.291] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75ea0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="MSCTF.dll") returned 0x9 [0098.291] CoTaskMemFree (pv=0x5d7900) [0098.291] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.291] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75ea0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\MSCTF.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll")) returned 0x1d [0098.292] CoTaskMemFree (pv=0x5d7900) [0098.292] GetModuleInformation (in: hProcess=0x304, hModule=0x75420000, lpmodinfo=0x234eb2c, cb=0xc | out: lpmodinfo=0x234eb2c*(lpBaseOfDll=0x75420000, SizeOfImage=0x9000, EntryPoint=0x75421220)) returned 1 [0098.292] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.292] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75420000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="VERSION.dll") returned 0xb [0098.292] CoTaskMemFree (pv=0x5d7900) [0098.292] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.292] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75420000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\system32\\VERSION.dll" (normalized: "c:\\windows\\system32\\version.dll")) returned 0x1f [0098.293] CoTaskMemFree (pv=0x5d7900) [0098.293] GetModuleInformation (in: hProcess=0x304, hModule=0x74890000, lpmodinfo=0x2350c38, cb=0xc | out: lpmodinfo=0x2350c38*(lpBaseOfDll=0x74890000, SizeOfImage=0x6a8000, EntryPoint=0x749d7040)) returned 1 [0098.293] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.293] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x74890000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="clr.dll") returned 0x7 [0098.293] CoTaskMemFree (pv=0x5d7900) [0098.293] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.293] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x74890000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\clr.dll")) returned 0x35 [0098.294] CoTaskMemFree (pv=0x5d7900) [0098.294] GetModuleInformation (in: hProcess=0x304, hModule=0x75320000, lpmodinfo=0x2352d68, cb=0xc | out: lpmodinfo=0x2352d68*(lpBaseOfDll=0x75320000, SizeOfImage=0xf5000, EntryPoint=0x75374160)) returned 1 [0098.294] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.294] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75320000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="MSVCR120_CLR0400.dll") returned 0x14 [0098.294] CoTaskMemFree (pv=0x5d7900) [0098.294] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.294] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75320000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\system32\\MSVCR120_CLR0400.dll" (normalized: "c:\\windows\\system32\\msvcr120_clr0400.dll")) returned 0x28 [0098.295] CoTaskMemFree (pv=0x5d7900) [0098.295] GetModuleInformation (in: hProcess=0x304, hModule=0x72440000, lpmodinfo=0x2354e9c, cb=0xc | out: lpmodinfo=0x2354e9c*(lpBaseOfDll=0x72440000, SizeOfImage=0x122b000, EntryPoint=0x0)) returned 1 [0098.295] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.295] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x72440000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="mscorlib.ni.dll") returned 0xf [0098.296] CoTaskMemFree (pv=0x5d7900) [0098.296] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.296] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x72440000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\b7a12c4c0032847fcc6b9c710460456f\\mscorlib.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\mscorlib\\b7a12c4c0032847fcc6b9c710460456f\\mscorlib.ni.dll")) returned 0x68 [0098.296] CoTaskMemFree (pv=0x5d7900) [0098.296] GetModuleInformation (in: hProcess=0x304, hModule=0x764e0000, lpmodinfo=0x2357044, cb=0xc | out: lpmodinfo=0x2357044*(lpBaseOfDll=0x764e0000, SizeOfImage=0x15c000, EntryPoint=0x7652ba3d)) returned 1 [0098.296] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.296] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x764e0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="ole32.dll") returned 0x9 [0098.297] CoTaskMemFree (pv=0x5d7900) [0098.297] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.297] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x764e0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll")) returned 0x1d [0098.297] CoTaskMemFree (pv=0x5d7900) [0098.297] GetModuleInformation (in: hProcess=0x304, hModule=0x74f60000, lpmodinfo=0x2359148, cb=0xc | out: lpmodinfo=0x2359148*(lpBaseOfDll=0x74f60000, SizeOfImage=0x80000, EntryPoint=0x74f737c9)) returned 1 [0098.297] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.297] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x74f60000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="uxtheme.dll") returned 0xb [0098.298] CoTaskMemFree (pv=0x5d7900) [0098.298] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.298] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x74f60000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\system32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll")) returned 0x1f [0098.298] CoTaskMemFree (pv=0x5d7900) [0098.298] GetModuleInformation (in: hProcess=0x304, hModule=0x752a0000, lpmodinfo=0x235b254, cb=0xc | out: lpmodinfo=0x235b254*(lpBaseOfDll=0x752a0000, SizeOfImage=0x7d000, EntryPoint=0x752a1140)) returned 1 [0098.299] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.299] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x752a0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="clrjit.dll") returned 0xa [0098.299] CoTaskMemFree (pv=0x5d7900) [0098.299] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.299] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x752a0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clrjit.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\clrjit.dll")) returned 0x38 [0098.300] CoTaskMemFree (pv=0x5d7900) [0098.300] GetModuleInformation (in: hProcess=0x304, hModule=0x762b0000, lpmodinfo=0x235d394, cb=0xc | out: lpmodinfo=0x235d394*(lpBaseOfDll=0x762b0000, SizeOfImage=0x8f000, EntryPoint=0x762b3fb1)) returned 1 [0098.300] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.300] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x762b0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="OLEAUT32.dll") returned 0xc [0098.300] CoTaskMemFree (pv=0x5d7900) [0098.300] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.300] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x762b0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\OLEAUT32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll")) returned 0x20 [0098.301] CoTaskMemFree (pv=0x5d7900) [0098.301] GetModuleInformation (in: hProcess=0x304, hModule=0x736d0000, lpmodinfo=0x235f4a8, cb=0xc | out: lpmodinfo=0x235f4a8*(lpBaseOfDll=0x736d0000, SizeOfImage=0x9ad000, EntryPoint=0x0)) returned 1 [0098.301] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.301] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x736d0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="System.ni.dll") returned 0xd [0098.302] CoTaskMemFree (pv=0x5d7900) [0098.302] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.302] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x736d0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System\\500ffa28b327e171fe664023003e947e\\System.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system\\500ffa28b327e171fe664023003e947e\\system.ni.dll")) returned 0x64 [0098.302] CoTaskMemFree (pv=0x5d7900) [0098.302] GetModuleInformation (in: hProcess=0x304, hModule=0x71d20000, lpmodinfo=0x2361644, cb=0xc | out: lpmodinfo=0x2361644*(lpBaseOfDll=0x71d20000, SizeOfImage=0x716000, EntryPoint=0x0)) returned 1 [0098.302] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.302] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x71d20000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="System.Core.ni.dll") returned 0x12 [0098.303] CoTaskMemFree (pv=0x5d7900) [0098.303] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.303] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x71d20000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Core\\386fde9190d499d6645df8b90eb76242\\System.Core.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.core\\386fde9190d499d6645df8b90eb76242\\system.core.ni.dll")) returned 0x6e [0098.303] CoTaskMemFree (pv=0x5d7900) [0098.303] GetModuleInformation (in: hProcess=0x304, hModule=0x750d0000, lpmodinfo=0x2363800, cb=0xc | out: lpmodinfo=0x2363800*(lpBaseOfDll=0x750d0000, SizeOfImage=0x1cb000, EntryPoint=0x0)) returned 1 [0098.304] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.304] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x750d0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="Microsoft.VisualBasic.ni.dll") returned 0x1c [0098.304] CoTaskMemFree (pv=0x5d7900) [0098.304] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.304] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x750d0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Microsoft.V9921e851#\\cfbddeb6e93e8f421b92229b20e51233\\Microsoft.VisualBasic.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\microsoft.v9921e851#\\cfbddeb6e93e8f421b92229b20e51233\\microsoft.visualbasic.ni.dll")) returned 0x81 [0098.305] CoTaskMemFree (pv=0x5d7900) [0098.305] GetModuleInformation (in: hProcess=0x304, hModule=0x750b0000, lpmodinfo=0x23659f4, cb=0xc | out: lpmodinfo=0x23659f4*(lpBaseOfDll=0x750b0000, SizeOfImage=0x13000, EntryPoint=0x750b18f0)) returned 1 [0098.305] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.305] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x750b0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="nlssorting.dll") returned 0xe [0098.306] CoTaskMemFree (pv=0x5d7900) [0098.306] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.306] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x750b0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\nlssorting.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\nlssorting.dll")) returned 0x3c [0098.306] CoTaskMemFree (pv=0x5d7900) [0098.306] GetModuleInformation (in: hProcess=0x304, hModule=0x74870000, lpmodinfo=0x2367b44, cb=0xc | out: lpmodinfo=0x2367b44*(lpBaseOfDll=0x74870000, SizeOfImage=0x16000, EntryPoint=0x74872dc3)) returned 1 [0098.307] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.307] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x74870000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="CRYPTSP.dll") returned 0xb [0098.307] CoTaskMemFree (pv=0x5d7900) [0098.307] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.307] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x74870000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\system32\\CRYPTSP.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll")) returned 0x1f [0098.307] CoTaskMemFree (pv=0x5d7900) [0098.307] GetModuleInformation (in: hProcess=0x304, hModule=0x74830000, lpmodinfo=0x2369c50, cb=0xc | out: lpmodinfo=0x2369c50*(lpBaseOfDll=0x74830000, SizeOfImage=0x3b000, EntryPoint=0x7483128d)) returned 1 [0098.308] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.308] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x74830000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="rsaenh.dll") returned 0xa [0098.308] CoTaskMemFree (pv=0x5d7900) [0098.308] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.308] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x74830000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\system32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll")) returned 0x1e [0098.309] CoTaskMemFree (pv=0x5d7900) [0098.309] GetModuleInformation (in: hProcess=0x304, hModule=0x75a60000, lpmodinfo=0x236be68, cb=0xc | out: lpmodinfo=0x236be68*(lpBaseOfDll=0x75a60000, SizeOfImage=0x5000, EntryPoint=0x75a61438)) returned 1 [0098.309] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.309] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75a60000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="psapi.dll") returned 0x9 [0098.310] CoTaskMemFree (pv=0x5d7900) [0098.310] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.310] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75a60000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\psapi.dll" (normalized: "c:\\windows\\syswow64\\psapi.dll")) returned 0x1d [0098.310] CoTaskMemFree (pv=0x5d7900) [0098.310] GetModuleInformation (in: hProcess=0x304, hModule=0x746a0000, lpmodinfo=0x236df6c, cb=0xc | out: lpmodinfo=0x236df6c*(lpBaseOfDll=0x746a0000, SizeOfImage=0x18d000, EntryPoint=0x0)) returned 1 [0098.311] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.311] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x746a0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="System.Drawing.ni.dll") returned 0x15 [0098.311] CoTaskMemFree (pv=0x5d7900) [0098.311] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.311] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x746a0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Drawing\\553c0312fdf5a5449f3649f0515e70fb\\System.Drawing.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.drawing\\553c0312fdf5a5449f3649f0515e70fb\\system.drawing.ni.dll")) returned 0x74 [0098.312] CoTaskMemFree (pv=0x5d7900) [0098.312] GetModuleInformation (in: hProcess=0x304, hModule=0x710c0000, lpmodinfo=0x2370138, cb=0xc | out: lpmodinfo=0x2370138*(lpBaseOfDll=0x710c0000, SizeOfImage=0xc58000, EntryPoint=0x0)) returned 1 [0098.312] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.312] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x710c0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="System.Windows.Forms.ni.dll") returned 0x1b [0098.313] CoTaskMemFree (pv=0x5d7900) [0098.313] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.313] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x710c0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Windows.Forms\\7a6894982f35a1d75ec73d447c583da2\\System.Windows.Forms.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.windows.forms\\7a6894982f35a1d75ec73d447c583da2\\system.windows.forms.ni.dll")) returned 0x80 [0098.313] CoTaskMemFree (pv=0x5d7900) [0098.313] CloseHandle (hObject=0x304) returned 1 [0098.324] GetCurrentProcessId () returned 0x9f8 [0098.324] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x9f8) returned 0x304 [0098.324] EnumProcessModules (in: hProcess=0x304, lphModule=0x226602c, cb=0x100, lpcbNeeded=0x498850 | out: lphModule=0x226602c, lpcbNeeded=0x498850) returned 1 [0098.325] GetModuleInformation (in: hProcess=0x304, hModule=0x310000, lpmodinfo=0x226616c, cb=0xc | out: lpmodinfo=0x226616c*(lpBaseOfDll=0x310000, SizeOfImage=0x3e000, EntryPoint=0x3479ce)) returned 1 [0098.325] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.325] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x310000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="unlikexpc.exe") returned 0xd [0098.325] CoTaskMemFree (pv=0x5d7900) [0098.325] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.325] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x310000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\unlikexpc.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\unlikexpc.exe")) returned 0x33 [0098.325] CoTaskMemFree (pv=0x5d7900) [0098.325] GetModuleInformation (in: hProcess=0x304, hModule=0x77ab0000, lpmodinfo=0x22682c0, cb=0xc | out: lpmodinfo=0x22682c0*(lpBaseOfDll=0x77ab0000, SizeOfImage=0x180000, EntryPoint=0x0)) returned 1 [0098.326] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.326] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x77ab0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="ntdll.dll") returned 0x9 [0098.326] CoTaskMemFree (pv=0x5d7900) [0098.326] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.326] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x77ab0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll")) returned 0x1d [0098.326] CoTaskMemFree (pv=0x5d7900) [0098.326] GetModuleInformation (in: hProcess=0x304, hModule=0x754b0000, lpmodinfo=0x226a3c4, cb=0xc | out: lpmodinfo=0x226a3c4*(lpBaseOfDll=0x754b0000, SizeOfImage=0x4a000, EntryPoint=0x754b2e54)) returned 1 [0098.326] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.326] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x754b0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="MSCOREE.DLL") returned 0xb [0098.326] CoTaskMemFree (pv=0x5d7900) [0098.326] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.326] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x754b0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\MSCOREE.DLL" (normalized: "c:\\windows\\system32\\mscoree.dll")) returned 0x1f [0098.326] CoTaskMemFree (pv=0x5d7900) [0098.326] GetModuleInformation (in: hProcess=0x304, hModule=0x757c0000, lpmodinfo=0x226c4d0, cb=0xc | out: lpmodinfo=0x226c4d0*(lpBaseOfDll=0x757c0000, SizeOfImage=0x110000, EntryPoint=0x757d32d3)) returned 1 [0098.327] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.327] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x757c0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="KERNEL32.dll") returned 0xc [0098.327] CoTaskMemFree (pv=0x5d7900) [0098.327] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.327] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x757c0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\KERNEL32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll")) returned 0x20 [0098.327] CoTaskMemFree (pv=0x5d7900) [0098.327] GetModuleInformation (in: hProcess=0x304, hModule=0x76260000, lpmodinfo=0x226e5e4, cb=0xc | out: lpmodinfo=0x226e5e4*(lpBaseOfDll=0x76260000, SizeOfImage=0x46000, EntryPoint=0x76267478)) returned 1 [0098.327] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.327] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x76260000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="KERNELBASE.dll") returned 0xe [0098.327] CoTaskMemFree (pv=0x5d7900) [0098.327] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.327] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x76260000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\KERNELBASE.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll")) returned 0x22 [0098.327] CoTaskMemFree (pv=0x5d7900) [0098.327] GetModuleInformation (in: hProcess=0x304, hModule=0x75720000, lpmodinfo=0x227072c, cb=0xc | out: lpmodinfo=0x227072c*(lpBaseOfDll=0x75720000, SizeOfImage=0xa0000, EntryPoint=0x757349e5)) returned 1 [0098.328] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.328] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75720000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="ADVAPI32.dll") returned 0xc [0098.328] CoTaskMemFree (pv=0x5d7900) [0098.328] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.328] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75720000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\ADVAPI32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll")) returned 0x20 [0098.328] CoTaskMemFree (pv=0x5d7900) [0098.328] GetModuleInformation (in: hProcess=0x304, hModule=0x75fe0000, lpmodinfo=0x2272840, cb=0xc | out: lpmodinfo=0x2272840*(lpBaseOfDll=0x75fe0000, SizeOfImage=0xac000, EntryPoint=0x75fea472)) returned 1 [0098.328] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.328] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75fe0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="msvcrt.dll") returned 0xa [0098.328] CoTaskMemFree (pv=0x5d7900) [0098.328] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.328] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75fe0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll")) returned 0x1e [0098.329] CoTaskMemFree (pv=0x5d7900) [0098.329] GetModuleInformation (in: hProcess=0x304, hModule=0x761b0000, lpmodinfo=0x227494c, cb=0xc | out: lpmodinfo=0x227494c*(lpBaseOfDll=0x761b0000, SizeOfImage=0x19000, EntryPoint=0x761b4975)) returned 1 [0098.329] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.329] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x761b0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="sechost.dll") returned 0xb [0098.329] CoTaskMemFree (pv=0x5d7900) [0098.329] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.329] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x761b0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll")) returned 0x1f [0098.329] CoTaskMemFree (pv=0x5d7900) [0098.329] GetModuleInformation (in: hProcess=0x304, hModule=0x76090000, lpmodinfo=0x2276a58, cb=0xc | out: lpmodinfo=0x2276a58*(lpBaseOfDll=0x76090000, SizeOfImage=0xf0000, EntryPoint=0x760a0569)) returned 1 [0098.330] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.330] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x76090000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="RPCRT4.dll") returned 0xa [0098.330] CoTaskMemFree (pv=0x5d7900) [0098.330] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.330] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x76090000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\RPCRT4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll")) returned 0x1e [0098.330] CoTaskMemFree (pv=0x5d7900) [0098.330] GetModuleInformation (in: hProcess=0x304, hModule=0x75610000, lpmodinfo=0x2278bb0, cb=0xc | out: lpmodinfo=0x2278bb0*(lpBaseOfDll=0x75610000, SizeOfImage=0x60000, EntryPoint=0x7562a3b3)) returned 1 [0098.330] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.330] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75610000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="SspiCli.dll") returned 0xb [0098.331] CoTaskMemFree (pv=0x5d7900) [0098.331] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.331] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75610000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\SspiCli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll")) returned 0x1f [0098.331] CoTaskMemFree (pv=0x5d7900) [0098.331] GetModuleInformation (in: hProcess=0x304, hModule=0x75600000, lpmodinfo=0x227acbc, cb=0xc | out: lpmodinfo=0x227acbc*(lpBaseOfDll=0x75600000, SizeOfImage=0xc000, EntryPoint=0x756010e1)) returned 1 [0098.331] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.331] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75600000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="CRYPTBASE.dll") returned 0xd [0098.331] CoTaskMemFree (pv=0x5d7900) [0098.331] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.331] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75600000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\CRYPTBASE.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll")) returned 0x21 [0098.332] CoTaskMemFree (pv=0x5d7900) [0098.332] GetModuleInformation (in: hProcess=0x304, hModule=0x75430000, lpmodinfo=0x227cdd0, cb=0xc | out: lpmodinfo=0x227cdd0*(lpBaseOfDll=0x75430000, SizeOfImage=0x78000, EntryPoint=0x7543f7ba)) returned 1 [0098.332] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.332] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75430000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="mscoreei.dll") returned 0xc [0098.332] CoTaskMemFree (pv=0x5d7900) [0098.332] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.332] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75430000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscoreei.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\mscoreei.dll")) returned 0x3a [0098.332] CoTaskMemFree (pv=0x5d7900) [0098.332] GetModuleInformation (in: hProcess=0x304, hModule=0x761d0000, lpmodinfo=0x227ef18, cb=0xc | out: lpmodinfo=0x227ef18*(lpBaseOfDll=0x761d0000, SizeOfImage=0x57000, EntryPoint=0x761e9ba6)) returned 1 [0098.333] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.333] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x761d0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="SHLWAPI.dll") returned 0xb [0098.333] CoTaskMemFree (pv=0x5d7900) [0098.333] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.333] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x761d0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\SHLWAPI.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll")) returned 0x1f [0098.333] CoTaskMemFree (pv=0x5d7900) [0098.333] GetModuleInformation (in: hProcess=0x304, hModule=0x766d0000, lpmodinfo=0x2281024, cb=0xc | out: lpmodinfo=0x2281024*(lpBaseOfDll=0x766d0000, SizeOfImage=0x90000, EntryPoint=0x766e6343)) returned 1 [0098.333] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.333] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x766d0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="GDI32.dll") returned 0x9 [0098.334] CoTaskMemFree (pv=0x5d7900) [0098.334] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.334] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x766d0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\GDI32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll")) returned 0x1d [0098.334] CoTaskMemFree (pv=0x5d7900) [0098.334] GetModuleInformation (in: hProcess=0x304, hModule=0x775b0000, lpmodinfo=0x2283128, cb=0xc | out: lpmodinfo=0x2283128*(lpBaseOfDll=0x775b0000, SizeOfImage=0x100000, EntryPoint=0x775cb6ed)) returned 1 [0098.334] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.334] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x775b0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="USER32.dll") returned 0xa [0098.334] CoTaskMemFree (pv=0x5d7900) [0098.335] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.335] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x775b0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\USER32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll")) returned 0x1e [0098.335] CoTaskMemFree (pv=0x5d7900) [0098.335] GetModuleInformation (in: hProcess=0x304, hModule=0x75a70000, lpmodinfo=0x2285234, cb=0xc | out: lpmodinfo=0x2285234*(lpBaseOfDll=0x75a70000, SizeOfImage=0xa000, EntryPoint=0x75a736a0)) returned 1 [0098.335] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.335] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75a70000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="LPK.dll") returned 0x7 [0098.335] CoTaskMemFree (pv=0x5d7900) [0098.335] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.335] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75a70000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\LPK.dll" (normalized: "c:\\windows\\syswow64\\lpk.dll")) returned 0x1b [0098.336] CoTaskMemFree (pv=0x5d7900) [0098.336] GetModuleInformation (in: hProcess=0x304, hModule=0x758d0000, lpmodinfo=0x2287330, cb=0xc | out: lpmodinfo=0x2287330*(lpBaseOfDll=0x758d0000, SizeOfImage=0x9d000, EntryPoint=0x75903fd7)) returned 1 [0098.336] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.336] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x758d0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="USP10.dll") returned 0x9 [0098.336] CoTaskMemFree (pv=0x5d7900) [0098.336] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.336] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x758d0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\USP10.dll" (normalized: "c:\\windows\\syswow64\\usp10.dll")) returned 0x1d [0098.337] CoTaskMemFree (pv=0x5d7900) [0098.337] GetModuleInformation (in: hProcess=0x304, hModule=0x75f80000, lpmodinfo=0x22894c0, cb=0xc | out: lpmodinfo=0x22894c0*(lpBaseOfDll=0x75f80000, SizeOfImage=0x60000, EntryPoint=0x75f9158f)) returned 1 [0098.337] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.337] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75f80000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="IMM32.DLL") returned 0x9 [0098.337] CoTaskMemFree (pv=0x5d7900) [0098.337] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.337] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75f80000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\system32\\IMM32.DLL" (normalized: "c:\\windows\\system32\\imm32.dll")) returned 0x1d [0098.338] CoTaskMemFree (pv=0x5d7900) [0098.338] GetModuleInformation (in: hProcess=0x304, hModule=0x75ea0000, lpmodinfo=0x228b5c4, cb=0xc | out: lpmodinfo=0x228b5c4*(lpBaseOfDll=0x75ea0000, SizeOfImage=0xcc000, EntryPoint=0x75ea168b)) returned 1 [0098.338] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.338] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75ea0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="MSCTF.dll") returned 0x9 [0098.338] CoTaskMemFree (pv=0x5d7900) [0098.338] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.338] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75ea0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\MSCTF.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll")) returned 0x1d [0098.339] CoTaskMemFree (pv=0x5d7900) [0098.339] GetModuleInformation (in: hProcess=0x304, hModule=0x75420000, lpmodinfo=0x228d6c8, cb=0xc | out: lpmodinfo=0x228d6c8*(lpBaseOfDll=0x75420000, SizeOfImage=0x9000, EntryPoint=0x75421220)) returned 1 [0098.339] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.339] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75420000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="VERSION.dll") returned 0xb [0098.339] CoTaskMemFree (pv=0x5d7900) [0098.339] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.339] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75420000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\system32\\VERSION.dll" (normalized: "c:\\windows\\system32\\version.dll")) returned 0x1f [0098.340] CoTaskMemFree (pv=0x5d7900) [0098.340] GetModuleInformation (in: hProcess=0x304, hModule=0x74890000, lpmodinfo=0x228f7d4, cb=0xc | out: lpmodinfo=0x228f7d4*(lpBaseOfDll=0x74890000, SizeOfImage=0x6a8000, EntryPoint=0x749d7040)) returned 1 [0098.340] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.340] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x74890000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="clr.dll") returned 0x7 [0098.340] CoTaskMemFree (pv=0x5d7900) [0098.340] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.340] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x74890000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\clr.dll")) returned 0x35 [0098.341] CoTaskMemFree (pv=0x5d7900) [0098.341] GetModuleInformation (in: hProcess=0x304, hModule=0x75320000, lpmodinfo=0x2291904, cb=0xc | out: lpmodinfo=0x2291904*(lpBaseOfDll=0x75320000, SizeOfImage=0xf5000, EntryPoint=0x75374160)) returned 1 [0098.341] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.341] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75320000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="MSVCR120_CLR0400.dll") returned 0x14 [0098.341] CoTaskMemFree (pv=0x5d7900) [0098.341] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.341] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75320000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\system32\\MSVCR120_CLR0400.dll" (normalized: "c:\\windows\\system32\\msvcr120_clr0400.dll")) returned 0x28 [0098.342] CoTaskMemFree (pv=0x5d7900) [0098.342] GetModuleInformation (in: hProcess=0x304, hModule=0x72440000, lpmodinfo=0x2293a38, cb=0xc | out: lpmodinfo=0x2293a38*(lpBaseOfDll=0x72440000, SizeOfImage=0x122b000, EntryPoint=0x0)) returned 1 [0098.342] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.342] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x72440000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="mscorlib.ni.dll") returned 0xf [0098.343] CoTaskMemFree (pv=0x5d7900) [0098.343] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.343] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x72440000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\b7a12c4c0032847fcc6b9c710460456f\\mscorlib.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\mscorlib\\b7a12c4c0032847fcc6b9c710460456f\\mscorlib.ni.dll")) returned 0x68 [0098.343] CoTaskMemFree (pv=0x5d7900) [0098.343] GetModuleInformation (in: hProcess=0x304, hModule=0x764e0000, lpmodinfo=0x2295be0, cb=0xc | out: lpmodinfo=0x2295be0*(lpBaseOfDll=0x764e0000, SizeOfImage=0x15c000, EntryPoint=0x7652ba3d)) returned 1 [0098.343] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.343] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x764e0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="ole32.dll") returned 0x9 [0098.344] CoTaskMemFree (pv=0x5d7900) [0098.344] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.344] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x764e0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll")) returned 0x1d [0098.344] CoTaskMemFree (pv=0x5d7900) [0098.344] GetModuleInformation (in: hProcess=0x304, hModule=0x74f60000, lpmodinfo=0x2297ce4, cb=0xc | out: lpmodinfo=0x2297ce4*(lpBaseOfDll=0x74f60000, SizeOfImage=0x80000, EntryPoint=0x74f737c9)) returned 1 [0098.344] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.344] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x74f60000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="uxtheme.dll") returned 0xb [0098.345] CoTaskMemFree (pv=0x5d7900) [0098.345] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.345] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x74f60000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\system32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll")) returned 0x1f [0098.346] CoTaskMemFree (pv=0x5d7900) [0098.346] GetModuleInformation (in: hProcess=0x304, hModule=0x752a0000, lpmodinfo=0x2299df0, cb=0xc | out: lpmodinfo=0x2299df0*(lpBaseOfDll=0x752a0000, SizeOfImage=0x7d000, EntryPoint=0x752a1140)) returned 1 [0098.346] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.346] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x752a0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="clrjit.dll") returned 0xa [0098.346] CoTaskMemFree (pv=0x5d7900) [0098.346] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.346] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x752a0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clrjit.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\clrjit.dll")) returned 0x38 [0098.347] CoTaskMemFree (pv=0x5d7900) [0098.347] GetModuleInformation (in: hProcess=0x304, hModule=0x762b0000, lpmodinfo=0x229bf30, cb=0xc | out: lpmodinfo=0x229bf30*(lpBaseOfDll=0x762b0000, SizeOfImage=0x8f000, EntryPoint=0x762b3fb1)) returned 1 [0098.347] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.347] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x762b0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="OLEAUT32.dll") returned 0xc [0098.348] CoTaskMemFree (pv=0x5d7900) [0098.348] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.348] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x762b0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\OLEAUT32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll")) returned 0x20 [0098.348] CoTaskMemFree (pv=0x5d7900) [0098.348] GetModuleInformation (in: hProcess=0x304, hModule=0x736d0000, lpmodinfo=0x229e044, cb=0xc | out: lpmodinfo=0x229e044*(lpBaseOfDll=0x736d0000, SizeOfImage=0x9ad000, EntryPoint=0x0)) returned 1 [0098.348] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.348] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x736d0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="System.ni.dll") returned 0xd [0098.349] CoTaskMemFree (pv=0x5d7900) [0098.349] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.349] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x736d0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System\\500ffa28b327e171fe664023003e947e\\System.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system\\500ffa28b327e171fe664023003e947e\\system.ni.dll")) returned 0x64 [0098.349] CoTaskMemFree (pv=0x5d7900) [0098.349] GetModuleInformation (in: hProcess=0x304, hModule=0x71d20000, lpmodinfo=0x22a01e0, cb=0xc | out: lpmodinfo=0x22a01e0*(lpBaseOfDll=0x71d20000, SizeOfImage=0x716000, EntryPoint=0x0)) returned 1 [0098.350] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.350] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x71d20000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="System.Core.ni.dll") returned 0x12 [0098.350] CoTaskMemFree (pv=0x5d7900) [0098.350] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.350] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x71d20000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Core\\386fde9190d499d6645df8b90eb76242\\System.Core.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.core\\386fde9190d499d6645df8b90eb76242\\system.core.ni.dll")) returned 0x6e [0098.351] CoTaskMemFree (pv=0x5d7900) [0098.351] GetModuleInformation (in: hProcess=0x304, hModule=0x750d0000, lpmodinfo=0x22a239c, cb=0xc | out: lpmodinfo=0x22a239c*(lpBaseOfDll=0x750d0000, SizeOfImage=0x1cb000, EntryPoint=0x0)) returned 1 [0098.351] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.351] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x750d0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="Microsoft.VisualBasic.ni.dll") returned 0x1c [0098.352] CoTaskMemFree (pv=0x5d7900) [0098.352] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.352] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x750d0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Microsoft.V9921e851#\\cfbddeb6e93e8f421b92229b20e51233\\Microsoft.VisualBasic.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\microsoft.v9921e851#\\cfbddeb6e93e8f421b92229b20e51233\\microsoft.visualbasic.ni.dll")) returned 0x81 [0098.352] CoTaskMemFree (pv=0x5d7900) [0098.352] GetModuleInformation (in: hProcess=0x304, hModule=0x750b0000, lpmodinfo=0x22a4590, cb=0xc | out: lpmodinfo=0x22a4590*(lpBaseOfDll=0x750b0000, SizeOfImage=0x13000, EntryPoint=0x750b18f0)) returned 1 [0098.353] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.353] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x750b0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="nlssorting.dll") returned 0xe [0098.353] CoTaskMemFree (pv=0x5d7900) [0098.353] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.353] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x750b0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\nlssorting.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\nlssorting.dll")) returned 0x3c [0098.354] CoTaskMemFree (pv=0x5d7900) [0098.354] GetModuleInformation (in: hProcess=0x304, hModule=0x74870000, lpmodinfo=0x22a66e0, cb=0xc | out: lpmodinfo=0x22a66e0*(lpBaseOfDll=0x74870000, SizeOfImage=0x16000, EntryPoint=0x74872dc3)) returned 1 [0098.354] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.354] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x74870000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="CRYPTSP.dll") returned 0xb [0098.355] CoTaskMemFree (pv=0x5d7900) [0098.355] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.355] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x74870000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\system32\\CRYPTSP.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll")) returned 0x1f [0098.355] CoTaskMemFree (pv=0x5d7900) [0098.355] GetModuleInformation (in: hProcess=0x304, hModule=0x74830000, lpmodinfo=0x22a87ec, cb=0xc | out: lpmodinfo=0x22a87ec*(lpBaseOfDll=0x74830000, SizeOfImage=0x3b000, EntryPoint=0x7483128d)) returned 1 [0098.356] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.356] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x74830000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="rsaenh.dll") returned 0xa [0098.356] CoTaskMemFree (pv=0x5d7900) [0098.356] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.356] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x74830000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\system32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll")) returned 0x1e [0098.357] CoTaskMemFree (pv=0x5d7900) [0098.357] GetModuleInformation (in: hProcess=0x304, hModule=0x75a60000, lpmodinfo=0x22aaa04, cb=0xc | out: lpmodinfo=0x22aaa04*(lpBaseOfDll=0x75a60000, SizeOfImage=0x5000, EntryPoint=0x75a61438)) returned 1 [0098.357] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.357] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75a60000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="psapi.dll") returned 0x9 [0098.358] CoTaskMemFree (pv=0x5d7900) [0098.358] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.358] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75a60000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\psapi.dll" (normalized: "c:\\windows\\syswow64\\psapi.dll")) returned 0x1d [0098.358] CoTaskMemFree (pv=0x5d7900) [0098.358] GetModuleInformation (in: hProcess=0x304, hModule=0x746a0000, lpmodinfo=0x22acb08, cb=0xc | out: lpmodinfo=0x22acb08*(lpBaseOfDll=0x746a0000, SizeOfImage=0x18d000, EntryPoint=0x0)) returned 1 [0098.359] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.359] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x746a0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="System.Drawing.ni.dll") returned 0x15 [0098.359] CoTaskMemFree (pv=0x5d7900) [0098.359] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.359] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x746a0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Drawing\\553c0312fdf5a5449f3649f0515e70fb\\System.Drawing.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.drawing\\553c0312fdf5a5449f3649f0515e70fb\\system.drawing.ni.dll")) returned 0x74 [0098.360] CoTaskMemFree (pv=0x5d7900) [0098.360] GetModuleInformation (in: hProcess=0x304, hModule=0x710c0000, lpmodinfo=0x22aecd4, cb=0xc | out: lpmodinfo=0x22aecd4*(lpBaseOfDll=0x710c0000, SizeOfImage=0xc58000, EntryPoint=0x0)) returned 1 [0098.360] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.360] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x710c0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="System.Windows.Forms.ni.dll") returned 0x1b [0098.361] CoTaskMemFree (pv=0x5d7900) [0098.361] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.361] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x710c0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Windows.Forms\\7a6894982f35a1d75ec73d447c583da2\\System.Windows.Forms.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.windows.forms\\7a6894982f35a1d75ec73d447c583da2\\system.windows.forms.ni.dll")) returned 0x80 [0098.361] CoTaskMemFree (pv=0x5d7900) [0098.361] CloseHandle (hObject=0x304) returned 1 [0098.362] GetCurrentProcessId () returned 0x9f8 [0098.362] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x9f8) returned 0x304 [0098.362] EnumProcessModules (in: hProcess=0x304, lphModule=0x23a4f7c, cb=0x100, lpcbNeeded=0x498850 | out: lphModule=0x23a4f7c, lpcbNeeded=0x498850) returned 1 [0098.363] GetModuleInformation (in: hProcess=0x304, hModule=0x310000, lpmodinfo=0x23a50bc, cb=0xc | out: lpmodinfo=0x23a50bc*(lpBaseOfDll=0x310000, SizeOfImage=0x3e000, EntryPoint=0x3479ce)) returned 1 [0098.363] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.363] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x310000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="unlikexpc.exe") returned 0xd [0098.363] CoTaskMemFree (pv=0x5d7900) [0098.363] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.363] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x310000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\unlikexpc.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\unlikexpc.exe")) returned 0x33 [0098.363] CoTaskMemFree (pv=0x5d7900) [0098.363] GetModuleInformation (in: hProcess=0x304, hModule=0x77ab0000, lpmodinfo=0x23a7210, cb=0xc | out: lpmodinfo=0x23a7210*(lpBaseOfDll=0x77ab0000, SizeOfImage=0x180000, EntryPoint=0x0)) returned 1 [0098.363] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.363] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x77ab0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="ntdll.dll") returned 0x9 [0098.364] CoTaskMemFree (pv=0x5d7900) [0098.364] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.364] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x77ab0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll")) returned 0x1d [0098.364] CoTaskMemFree (pv=0x5d7900) [0098.364] GetModuleInformation (in: hProcess=0x304, hModule=0x754b0000, lpmodinfo=0x23a9314, cb=0xc | out: lpmodinfo=0x23a9314*(lpBaseOfDll=0x754b0000, SizeOfImage=0x4a000, EntryPoint=0x754b2e54)) returned 1 [0098.364] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.364] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x754b0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="MSCOREE.DLL") returned 0xb [0098.364] CoTaskMemFree (pv=0x5d7900) [0098.364] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.364] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x754b0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\MSCOREE.DLL" (normalized: "c:\\windows\\system32\\mscoree.dll")) returned 0x1f [0098.364] CoTaskMemFree (pv=0x5d7900) [0098.364] GetModuleInformation (in: hProcess=0x304, hModule=0x757c0000, lpmodinfo=0x23ab420, cb=0xc | out: lpmodinfo=0x23ab420*(lpBaseOfDll=0x757c0000, SizeOfImage=0x110000, EntryPoint=0x757d32d3)) returned 1 [0098.364] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.364] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x757c0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="KERNEL32.dll") returned 0xc [0098.365] CoTaskMemFree (pv=0x5d7900) [0098.365] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.365] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x757c0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\KERNEL32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll")) returned 0x20 [0098.365] CoTaskMemFree (pv=0x5d7900) [0098.365] GetModuleInformation (in: hProcess=0x304, hModule=0x76260000, lpmodinfo=0x23ad534, cb=0xc | out: lpmodinfo=0x23ad534*(lpBaseOfDll=0x76260000, SizeOfImage=0x46000, EntryPoint=0x76267478)) returned 1 [0098.365] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.365] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x76260000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="KERNELBASE.dll") returned 0xe [0098.365] CoTaskMemFree (pv=0x5d7900) [0098.365] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.365] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x76260000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\KERNELBASE.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll")) returned 0x22 [0098.365] CoTaskMemFree (pv=0x5d7900) [0098.365] GetModuleInformation (in: hProcess=0x304, hModule=0x75720000, lpmodinfo=0x23af67c, cb=0xc | out: lpmodinfo=0x23af67c*(lpBaseOfDll=0x75720000, SizeOfImage=0xa0000, EntryPoint=0x757349e5)) returned 1 [0098.365] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.365] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75720000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="ADVAPI32.dll") returned 0xc [0098.366] CoTaskMemFree (pv=0x5d7900) [0098.366] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.366] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75720000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\ADVAPI32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll")) returned 0x20 [0098.366] CoTaskMemFree (pv=0x5d7900) [0098.366] GetModuleInformation (in: hProcess=0x304, hModule=0x75fe0000, lpmodinfo=0x23b1790, cb=0xc | out: lpmodinfo=0x23b1790*(lpBaseOfDll=0x75fe0000, SizeOfImage=0xac000, EntryPoint=0x75fea472)) returned 1 [0098.366] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.366] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75fe0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="msvcrt.dll") returned 0xa [0098.366] CoTaskMemFree (pv=0x5d7900) [0098.366] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.366] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75fe0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll")) returned 0x1e [0098.366] CoTaskMemFree (pv=0x5d7900) [0098.366] GetModuleInformation (in: hProcess=0x304, hModule=0x761b0000, lpmodinfo=0x23b389c, cb=0xc | out: lpmodinfo=0x23b389c*(lpBaseOfDll=0x761b0000, SizeOfImage=0x19000, EntryPoint=0x761b4975)) returned 1 [0098.367] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.367] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x761b0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="sechost.dll") returned 0xb [0098.367] CoTaskMemFree (pv=0x5d7900) [0098.367] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.367] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x761b0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll")) returned 0x1f [0098.367] CoTaskMemFree (pv=0x5d7900) [0098.367] GetModuleInformation (in: hProcess=0x304, hModule=0x76090000, lpmodinfo=0x23b59a8, cb=0xc | out: lpmodinfo=0x23b59a8*(lpBaseOfDll=0x76090000, SizeOfImage=0xf0000, EntryPoint=0x760a0569)) returned 1 [0098.367] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.367] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x76090000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="RPCRT4.dll") returned 0xa [0098.367] CoTaskMemFree (pv=0x5d7900) [0098.367] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.367] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x76090000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\RPCRT4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll")) returned 0x1e [0098.368] CoTaskMemFree (pv=0x5d7900) [0098.368] GetModuleInformation (in: hProcess=0x304, hModule=0x75610000, lpmodinfo=0x23b7b00, cb=0xc | out: lpmodinfo=0x23b7b00*(lpBaseOfDll=0x75610000, SizeOfImage=0x60000, EntryPoint=0x7562a3b3)) returned 1 [0098.368] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.368] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75610000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="SspiCli.dll") returned 0xb [0098.368] CoTaskMemFree (pv=0x5d7900) [0098.368] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.368] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75610000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\SspiCli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll")) returned 0x1f [0098.368] CoTaskMemFree (pv=0x5d7900) [0098.368] GetModuleInformation (in: hProcess=0x304, hModule=0x75600000, lpmodinfo=0x23b9c0c, cb=0xc | out: lpmodinfo=0x23b9c0c*(lpBaseOfDll=0x75600000, SizeOfImage=0xc000, EntryPoint=0x756010e1)) returned 1 [0098.369] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.369] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75600000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="CRYPTBASE.dll") returned 0xd [0098.369] CoTaskMemFree (pv=0x5d7900) [0098.369] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.369] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75600000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\CRYPTBASE.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll")) returned 0x21 [0098.369] CoTaskMemFree (pv=0x5d7900) [0098.369] GetModuleInformation (in: hProcess=0x304, hModule=0x75430000, lpmodinfo=0x23bbd20, cb=0xc | out: lpmodinfo=0x23bbd20*(lpBaseOfDll=0x75430000, SizeOfImage=0x78000, EntryPoint=0x7543f7ba)) returned 1 [0098.369] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.369] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75430000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="mscoreei.dll") returned 0xc [0098.369] CoTaskMemFree (pv=0x5d7900) [0098.370] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.370] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75430000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscoreei.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\mscoreei.dll")) returned 0x3a [0098.370] CoTaskMemFree (pv=0x5d7900) [0098.370] GetModuleInformation (in: hProcess=0x304, hModule=0x761d0000, lpmodinfo=0x23bde68, cb=0xc | out: lpmodinfo=0x23bde68*(lpBaseOfDll=0x761d0000, SizeOfImage=0x57000, EntryPoint=0x761e9ba6)) returned 1 [0098.370] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.370] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x761d0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="SHLWAPI.dll") returned 0xb [0098.370] CoTaskMemFree (pv=0x5d7900) [0098.370] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.370] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x761d0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\SHLWAPI.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll")) returned 0x1f [0098.371] CoTaskMemFree (pv=0x5d7900) [0098.371] GetModuleInformation (in: hProcess=0x304, hModule=0x766d0000, lpmodinfo=0x23bff74, cb=0xc | out: lpmodinfo=0x23bff74*(lpBaseOfDll=0x766d0000, SizeOfImage=0x90000, EntryPoint=0x766e6343)) returned 1 [0098.371] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.371] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x766d0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="GDI32.dll") returned 0x9 [0098.371] CoTaskMemFree (pv=0x5d7900) [0098.371] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.371] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x766d0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\GDI32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll")) returned 0x1d [0098.371] CoTaskMemFree (pv=0x5d7900) [0098.371] GetModuleInformation (in: hProcess=0x304, hModule=0x775b0000, lpmodinfo=0x23c2078, cb=0xc | out: lpmodinfo=0x23c2078*(lpBaseOfDll=0x775b0000, SizeOfImage=0x100000, EntryPoint=0x775cb6ed)) returned 1 [0098.372] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.372] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x775b0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="USER32.dll") returned 0xa [0098.372] CoTaskMemFree (pv=0x5d7900) [0098.372] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.372] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x775b0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\USER32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll")) returned 0x1e [0098.372] CoTaskMemFree (pv=0x5d7900) [0098.372] GetModuleInformation (in: hProcess=0x304, hModule=0x75a70000, lpmodinfo=0x23c4184, cb=0xc | out: lpmodinfo=0x23c4184*(lpBaseOfDll=0x75a70000, SizeOfImage=0xa000, EntryPoint=0x75a736a0)) returned 1 [0098.372] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.372] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75a70000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="LPK.dll") returned 0x7 [0098.373] CoTaskMemFree (pv=0x5d7900) [0098.373] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.373] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75a70000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\LPK.dll" (normalized: "c:\\windows\\syswow64\\lpk.dll")) returned 0x1b [0098.373] CoTaskMemFree (pv=0x5d7900) [0098.373] GetModuleInformation (in: hProcess=0x304, hModule=0x758d0000, lpmodinfo=0x23c6280, cb=0xc | out: lpmodinfo=0x23c6280*(lpBaseOfDll=0x758d0000, SizeOfImage=0x9d000, EntryPoint=0x75903fd7)) returned 1 [0098.373] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.373] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x758d0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="USP10.dll") returned 0x9 [0098.374] CoTaskMemFree (pv=0x5d7900) [0098.374] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.374] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x758d0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\USP10.dll" (normalized: "c:\\windows\\syswow64\\usp10.dll")) returned 0x1d [0098.374] CoTaskMemFree (pv=0x5d7900) [0098.374] GetModuleInformation (in: hProcess=0x304, hModule=0x75f80000, lpmodinfo=0x23c8410, cb=0xc | out: lpmodinfo=0x23c8410*(lpBaseOfDll=0x75f80000, SizeOfImage=0x60000, EntryPoint=0x75f9158f)) returned 1 [0098.374] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.374] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75f80000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="IMM32.DLL") returned 0x9 [0098.374] CoTaskMemFree (pv=0x5d7900) [0098.374] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.374] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75f80000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\system32\\IMM32.DLL" (normalized: "c:\\windows\\system32\\imm32.dll")) returned 0x1d [0098.375] CoTaskMemFree (pv=0x5d7900) [0098.375] GetModuleInformation (in: hProcess=0x304, hModule=0x75ea0000, lpmodinfo=0x23ca514, cb=0xc | out: lpmodinfo=0x23ca514*(lpBaseOfDll=0x75ea0000, SizeOfImage=0xcc000, EntryPoint=0x75ea168b)) returned 1 [0098.375] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.375] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75ea0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="MSCTF.dll") returned 0x9 [0098.375] CoTaskMemFree (pv=0x5d7900) [0098.375] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.375] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75ea0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\MSCTF.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll")) returned 0x1d [0098.376] CoTaskMemFree (pv=0x5d7900) [0098.376] GetModuleInformation (in: hProcess=0x304, hModule=0x75420000, lpmodinfo=0x23cc618, cb=0xc | out: lpmodinfo=0x23cc618*(lpBaseOfDll=0x75420000, SizeOfImage=0x9000, EntryPoint=0x75421220)) returned 1 [0098.376] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.376] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75420000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="VERSION.dll") returned 0xb [0098.376] CoTaskMemFree (pv=0x5d7900) [0098.377] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.377] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75420000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\system32\\VERSION.dll" (normalized: "c:\\windows\\system32\\version.dll")) returned 0x1f [0098.377] CoTaskMemFree (pv=0x5d7900) [0098.377] GetModuleInformation (in: hProcess=0x304, hModule=0x74890000, lpmodinfo=0x23ce724, cb=0xc | out: lpmodinfo=0x23ce724*(lpBaseOfDll=0x74890000, SizeOfImage=0x6a8000, EntryPoint=0x749d7040)) returned 1 [0098.377] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.377] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x74890000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="clr.dll") returned 0x7 [0098.377] CoTaskMemFree (pv=0x5d7900) [0098.377] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.378] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x74890000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\clr.dll")) returned 0x35 [0098.378] CoTaskMemFree (pv=0x5d7900) [0098.378] GetModuleInformation (in: hProcess=0x304, hModule=0x75320000, lpmodinfo=0x23d0854, cb=0xc | out: lpmodinfo=0x23d0854*(lpBaseOfDll=0x75320000, SizeOfImage=0xf5000, EntryPoint=0x75374160)) returned 1 [0098.378] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.378] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75320000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="MSVCR120_CLR0400.dll") returned 0x14 [0098.379] CoTaskMemFree (pv=0x5d7900) [0098.379] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.379] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75320000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\system32\\MSVCR120_CLR0400.dll" (normalized: "c:\\windows\\system32\\msvcr120_clr0400.dll")) returned 0x28 [0098.379] CoTaskMemFree (pv=0x5d7900) [0098.379] GetModuleInformation (in: hProcess=0x304, hModule=0x72440000, lpmodinfo=0x23d2988, cb=0xc | out: lpmodinfo=0x23d2988*(lpBaseOfDll=0x72440000, SizeOfImage=0x122b000, EntryPoint=0x0)) returned 1 [0098.379] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.379] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x72440000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="mscorlib.ni.dll") returned 0xf [0098.380] CoTaskMemFree (pv=0x5d7900) [0098.380] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.380] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x72440000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\b7a12c4c0032847fcc6b9c710460456f\\mscorlib.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\mscorlib\\b7a12c4c0032847fcc6b9c710460456f\\mscorlib.ni.dll")) returned 0x68 [0098.380] CoTaskMemFree (pv=0x5d7900) [0098.380] GetModuleInformation (in: hProcess=0x304, hModule=0x764e0000, lpmodinfo=0x23d4b30, cb=0xc | out: lpmodinfo=0x23d4b30*(lpBaseOfDll=0x764e0000, SizeOfImage=0x15c000, EntryPoint=0x7652ba3d)) returned 1 [0098.380] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.380] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x764e0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="ole32.dll") returned 0x9 [0098.381] CoTaskMemFree (pv=0x5d7900) [0098.381] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.381] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x764e0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll")) returned 0x1d [0098.381] CoTaskMemFree (pv=0x5d7900) [0098.381] GetModuleInformation (in: hProcess=0x304, hModule=0x74f60000, lpmodinfo=0x23d6c34, cb=0xc | out: lpmodinfo=0x23d6c34*(lpBaseOfDll=0x74f60000, SizeOfImage=0x80000, EntryPoint=0x74f737c9)) returned 1 [0098.381] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.381] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x74f60000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="uxtheme.dll") returned 0xb [0098.383] CoTaskMemFree (pv=0x5d7900) [0098.383] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.383] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x74f60000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\system32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll")) returned 0x1f [0098.383] CoTaskMemFree (pv=0x5d7900) [0098.383] GetModuleInformation (in: hProcess=0x304, hModule=0x752a0000, lpmodinfo=0x21daae4, cb=0xc | out: lpmodinfo=0x21daae4*(lpBaseOfDll=0x752a0000, SizeOfImage=0x7d000, EntryPoint=0x752a1140)) returned 1 [0098.384] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.384] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x752a0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="clrjit.dll") returned 0xa [0098.384] CoTaskMemFree (pv=0x5d7900) [0098.384] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.384] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x752a0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clrjit.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\clrjit.dll")) returned 0x38 [0098.384] CoTaskMemFree (pv=0x5d7900) [0098.384] GetModuleInformation (in: hProcess=0x304, hModule=0x762b0000, lpmodinfo=0x21dcc24, cb=0xc | out: lpmodinfo=0x21dcc24*(lpBaseOfDll=0x762b0000, SizeOfImage=0x8f000, EntryPoint=0x762b3fb1)) returned 1 [0098.385] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.385] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x762b0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="OLEAUT32.dll") returned 0xc [0098.385] CoTaskMemFree (pv=0x5d7900) [0098.385] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.385] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x762b0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\OLEAUT32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll")) returned 0x20 [0098.386] CoTaskMemFree (pv=0x5d7900) [0098.386] GetModuleInformation (in: hProcess=0x304, hModule=0x736d0000, lpmodinfo=0x21ded38, cb=0xc | out: lpmodinfo=0x21ded38*(lpBaseOfDll=0x736d0000, SizeOfImage=0x9ad000, EntryPoint=0x0)) returned 1 [0098.386] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.386] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x736d0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="System.ni.dll") returned 0xd [0098.386] CoTaskMemFree (pv=0x5d7900) [0098.386] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.387] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x736d0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System\\500ffa28b327e171fe664023003e947e\\System.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system\\500ffa28b327e171fe664023003e947e\\system.ni.dll")) returned 0x64 [0098.387] CoTaskMemFree (pv=0x5d7900) [0098.387] GetModuleInformation (in: hProcess=0x304, hModule=0x71d20000, lpmodinfo=0x21e0ed4, cb=0xc | out: lpmodinfo=0x21e0ed4*(lpBaseOfDll=0x71d20000, SizeOfImage=0x716000, EntryPoint=0x0)) returned 1 [0098.387] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.387] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x71d20000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="System.Core.ni.dll") returned 0x12 [0098.388] CoTaskMemFree (pv=0x5d7900) [0098.388] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.388] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x71d20000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Core\\386fde9190d499d6645df8b90eb76242\\System.Core.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.core\\386fde9190d499d6645df8b90eb76242\\system.core.ni.dll")) returned 0x6e [0098.388] CoTaskMemFree (pv=0x5d7900) [0098.388] GetModuleInformation (in: hProcess=0x304, hModule=0x750d0000, lpmodinfo=0x21e3090, cb=0xc | out: lpmodinfo=0x21e3090*(lpBaseOfDll=0x750d0000, SizeOfImage=0x1cb000, EntryPoint=0x0)) returned 1 [0098.389] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.389] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x750d0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="Microsoft.VisualBasic.ni.dll") returned 0x1c [0098.389] CoTaskMemFree (pv=0x5d7900) [0098.389] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.389] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x750d0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Microsoft.V9921e851#\\cfbddeb6e93e8f421b92229b20e51233\\Microsoft.VisualBasic.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\microsoft.v9921e851#\\cfbddeb6e93e8f421b92229b20e51233\\microsoft.visualbasic.ni.dll")) returned 0x81 [0098.389] CoTaskMemFree (pv=0x5d7900) [0098.390] GetModuleInformation (in: hProcess=0x304, hModule=0x750b0000, lpmodinfo=0x21e5284, cb=0xc | out: lpmodinfo=0x21e5284*(lpBaseOfDll=0x750b0000, SizeOfImage=0x13000, EntryPoint=0x750b18f0)) returned 1 [0098.390] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.390] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x750b0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="nlssorting.dll") returned 0xe [0098.390] CoTaskMemFree (pv=0x5d7900) [0098.390] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.390] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x750b0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\nlssorting.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\nlssorting.dll")) returned 0x3c [0098.391] CoTaskMemFree (pv=0x5d7900) [0098.391] GetModuleInformation (in: hProcess=0x304, hModule=0x74870000, lpmodinfo=0x21e73d4, cb=0xc | out: lpmodinfo=0x21e73d4*(lpBaseOfDll=0x74870000, SizeOfImage=0x16000, EntryPoint=0x74872dc3)) returned 1 [0098.391] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.391] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x74870000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="CRYPTSP.dll") returned 0xb [0098.392] CoTaskMemFree (pv=0x5d7900) [0098.392] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.392] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x74870000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\system32\\CRYPTSP.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll")) returned 0x1f [0098.392] CoTaskMemFree (pv=0x5d7900) [0098.392] GetModuleInformation (in: hProcess=0x304, hModule=0x74830000, lpmodinfo=0x21e94e0, cb=0xc | out: lpmodinfo=0x21e94e0*(lpBaseOfDll=0x74830000, SizeOfImage=0x3b000, EntryPoint=0x7483128d)) returned 1 [0098.393] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.393] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x74830000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="rsaenh.dll") returned 0xa [0098.393] CoTaskMemFree (pv=0x5d7900) [0098.393] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.393] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x74830000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\system32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll")) returned 0x1e [0098.394] CoTaskMemFree (pv=0x5d7900) [0098.394] GetModuleInformation (in: hProcess=0x304, hModule=0x75a60000, lpmodinfo=0x21eb6f8, cb=0xc | out: lpmodinfo=0x21eb6f8*(lpBaseOfDll=0x75a60000, SizeOfImage=0x5000, EntryPoint=0x75a61438)) returned 1 [0098.394] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.394] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75a60000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="psapi.dll") returned 0x9 [0098.395] CoTaskMemFree (pv=0x5d7900) [0098.395] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.395] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75a60000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\psapi.dll" (normalized: "c:\\windows\\syswow64\\psapi.dll")) returned 0x1d [0098.395] CoTaskMemFree (pv=0x5d7900) [0098.395] GetModuleInformation (in: hProcess=0x304, hModule=0x746a0000, lpmodinfo=0x21ed7fc, cb=0xc | out: lpmodinfo=0x21ed7fc*(lpBaseOfDll=0x746a0000, SizeOfImage=0x18d000, EntryPoint=0x0)) returned 1 [0098.395] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.395] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x746a0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="System.Drawing.ni.dll") returned 0x15 [0098.396] CoTaskMemFree (pv=0x5d7900) [0098.396] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.396] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x746a0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Drawing\\553c0312fdf5a5449f3649f0515e70fb\\System.Drawing.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.drawing\\553c0312fdf5a5449f3649f0515e70fb\\system.drawing.ni.dll")) returned 0x74 [0098.396] CoTaskMemFree (pv=0x5d7900) [0098.396] GetModuleInformation (in: hProcess=0x304, hModule=0x710c0000, lpmodinfo=0x21ef9c8, cb=0xc | out: lpmodinfo=0x21ef9c8*(lpBaseOfDll=0x710c0000, SizeOfImage=0xc58000, EntryPoint=0x0)) returned 1 [0098.397] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.397] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x710c0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="System.Windows.Forms.ni.dll") returned 0x1b [0098.397] CoTaskMemFree (pv=0x5d7900) [0098.397] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.397] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x710c0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Windows.Forms\\7a6894982f35a1d75ec73d447c583da2\\System.Windows.Forms.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.windows.forms\\7a6894982f35a1d75ec73d447c583da2\\system.windows.forms.ni.dll")) returned 0x80 [0098.398] CoTaskMemFree (pv=0x5d7900) [0098.398] CloseHandle (hObject=0x304) returned 1 [0098.400] EnumProcessModules (in: hProcess=0x304, lphModule=0x22eaab0, cb=0x100, lpcbNeeded=0x498850 | out: lphModule=0x22eaab0, lpcbNeeded=0x498850) returned 1 [0098.400] GetModuleInformation (in: hProcess=0x304, hModule=0x310000, lpmodinfo=0x22eabf0, cb=0xc | out: lpmodinfo=0x22eabf0*(lpBaseOfDll=0x310000, SizeOfImage=0x3e000, EntryPoint=0x3479ce)) returned 1 [0098.400] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.400] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x310000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="unlikexpc.exe") returned 0xd [0098.400] CoTaskMemFree (pv=0x5d7900) [0098.400] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.400] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x310000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\unlikexpc.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\unlikexpc.exe")) returned 0x33 [0098.400] CoTaskMemFree (pv=0x5d7900) [0098.400] GetModuleInformation (in: hProcess=0x304, hModule=0x77ab0000, lpmodinfo=0x22ecd44, cb=0xc | out: lpmodinfo=0x22ecd44*(lpBaseOfDll=0x77ab0000, SizeOfImage=0x180000, EntryPoint=0x0)) returned 1 [0098.401] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.401] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x77ab0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="ntdll.dll") returned 0x9 [0098.401] CoTaskMemFree (pv=0x5d7900) [0098.401] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.401] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x77ab0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll")) returned 0x1d [0098.401] CoTaskMemFree (pv=0x5d7900) [0098.401] GetModuleInformation (in: hProcess=0x304, hModule=0x754b0000, lpmodinfo=0x22eee48, cb=0xc | out: lpmodinfo=0x22eee48*(lpBaseOfDll=0x754b0000, SizeOfImage=0x4a000, EntryPoint=0x754b2e54)) returned 1 [0098.401] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.401] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x754b0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="MSCOREE.DLL") returned 0xb [0098.401] CoTaskMemFree (pv=0x5d7900) [0098.401] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.401] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x754b0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\MSCOREE.DLL" (normalized: "c:\\windows\\system32\\mscoree.dll")) returned 0x1f [0098.401] CoTaskMemFree (pv=0x5d7900) [0098.401] GetModuleInformation (in: hProcess=0x304, hModule=0x757c0000, lpmodinfo=0x22f0f54, cb=0xc | out: lpmodinfo=0x22f0f54*(lpBaseOfDll=0x757c0000, SizeOfImage=0x110000, EntryPoint=0x757d32d3)) returned 1 [0098.401] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.401] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x757c0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="KERNEL32.dll") returned 0xc [0098.402] CoTaskMemFree (pv=0x5d7900) [0098.402] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.402] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x757c0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\KERNEL32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll")) returned 0x20 [0098.402] CoTaskMemFree (pv=0x5d7900) [0098.402] GetModuleInformation (in: hProcess=0x304, hModule=0x76260000, lpmodinfo=0x22f3068, cb=0xc | out: lpmodinfo=0x22f3068*(lpBaseOfDll=0x76260000, SizeOfImage=0x46000, EntryPoint=0x76267478)) returned 1 [0098.402] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.402] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x76260000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="KERNELBASE.dll") returned 0xe [0098.402] CoTaskMemFree (pv=0x5d7900) [0098.402] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.402] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x76260000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\KERNELBASE.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll")) returned 0x22 [0098.402] CoTaskMemFree (pv=0x5d7900) [0098.402] GetModuleInformation (in: hProcess=0x304, hModule=0x75720000, lpmodinfo=0x22f51b0, cb=0xc | out: lpmodinfo=0x22f51b0*(lpBaseOfDll=0x75720000, SizeOfImage=0xa0000, EntryPoint=0x757349e5)) returned 1 [0098.402] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.402] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75720000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="ADVAPI32.dll") returned 0xc [0098.403] CoTaskMemFree (pv=0x5d7900) [0098.403] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.403] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75720000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\ADVAPI32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll")) returned 0x20 [0098.403] CoTaskMemFree (pv=0x5d7900) [0098.403] GetModuleInformation (in: hProcess=0x304, hModule=0x75fe0000, lpmodinfo=0x22f72c4, cb=0xc | out: lpmodinfo=0x22f72c4*(lpBaseOfDll=0x75fe0000, SizeOfImage=0xac000, EntryPoint=0x75fea472)) returned 1 [0098.403] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.403] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75fe0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="msvcrt.dll") returned 0xa [0098.403] CoTaskMemFree (pv=0x5d7900) [0098.403] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.403] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75fe0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll")) returned 0x1e [0098.403] CoTaskMemFree (pv=0x5d7900) [0098.403] GetModuleInformation (in: hProcess=0x304, hModule=0x761b0000, lpmodinfo=0x22f93d0, cb=0xc | out: lpmodinfo=0x22f93d0*(lpBaseOfDll=0x761b0000, SizeOfImage=0x19000, EntryPoint=0x761b4975)) returned 1 [0098.404] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.404] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x761b0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="sechost.dll") returned 0xb [0098.404] CoTaskMemFree (pv=0x5d7900) [0098.404] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.404] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x761b0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll")) returned 0x1f [0098.404] CoTaskMemFree (pv=0x5d7900) [0098.404] GetModuleInformation (in: hProcess=0x304, hModule=0x76090000, lpmodinfo=0x22fb4dc, cb=0xc | out: lpmodinfo=0x22fb4dc*(lpBaseOfDll=0x76090000, SizeOfImage=0xf0000, EntryPoint=0x760a0569)) returned 1 [0098.404] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.404] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x76090000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="RPCRT4.dll") returned 0xa [0098.404] CoTaskMemFree (pv=0x5d7900) [0098.404] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.404] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x76090000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\RPCRT4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll")) returned 0x1e [0098.405] CoTaskMemFree (pv=0x5d7900) [0098.405] GetModuleInformation (in: hProcess=0x304, hModule=0x75610000, lpmodinfo=0x22fd634, cb=0xc | out: lpmodinfo=0x22fd634*(lpBaseOfDll=0x75610000, SizeOfImage=0x60000, EntryPoint=0x7562a3b3)) returned 1 [0098.405] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.405] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75610000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="SspiCli.dll") returned 0xb [0098.405] CoTaskMemFree (pv=0x5d7900) [0098.405] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.405] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75610000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\SspiCli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll")) returned 0x1f [0098.405] CoTaskMemFree (pv=0x5d7900) [0098.405] GetModuleInformation (in: hProcess=0x304, hModule=0x75600000, lpmodinfo=0x22ff740, cb=0xc | out: lpmodinfo=0x22ff740*(lpBaseOfDll=0x75600000, SizeOfImage=0xc000, EntryPoint=0x756010e1)) returned 1 [0098.405] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.406] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75600000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="CRYPTBASE.dll") returned 0xd [0098.406] CoTaskMemFree (pv=0x5d7900) [0098.406] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.406] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75600000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\CRYPTBASE.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll")) returned 0x21 [0098.406] CoTaskMemFree (pv=0x5d7900) [0098.406] GetModuleInformation (in: hProcess=0x304, hModule=0x75430000, lpmodinfo=0x2301854, cb=0xc | out: lpmodinfo=0x2301854*(lpBaseOfDll=0x75430000, SizeOfImage=0x78000, EntryPoint=0x7543f7ba)) returned 1 [0098.406] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.406] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75430000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="mscoreei.dll") returned 0xc [0098.406] CoTaskMemFree (pv=0x5d7900) [0098.406] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.406] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75430000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscoreei.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\mscoreei.dll")) returned 0x3a [0098.407] CoTaskMemFree (pv=0x5d7900) [0098.407] GetModuleInformation (in: hProcess=0x304, hModule=0x761d0000, lpmodinfo=0x230399c, cb=0xc | out: lpmodinfo=0x230399c*(lpBaseOfDll=0x761d0000, SizeOfImage=0x57000, EntryPoint=0x761e9ba6)) returned 1 [0098.407] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.407] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x761d0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="SHLWAPI.dll") returned 0xb [0098.407] CoTaskMemFree (pv=0x5d7900) [0098.407] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.407] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x761d0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\SHLWAPI.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll")) returned 0x1f [0098.408] CoTaskMemFree (pv=0x5d7900) [0098.408] GetModuleInformation (in: hProcess=0x304, hModule=0x766d0000, lpmodinfo=0x2305aa8, cb=0xc | out: lpmodinfo=0x2305aa8*(lpBaseOfDll=0x766d0000, SizeOfImage=0x90000, EntryPoint=0x766e6343)) returned 1 [0098.408] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.408] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x766d0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="GDI32.dll") returned 0x9 [0098.409] CoTaskMemFree (pv=0x5d7900) [0098.409] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.409] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x766d0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\GDI32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll")) returned 0x1d [0098.409] CoTaskMemFree (pv=0x5d7900) [0098.409] GetModuleInformation (in: hProcess=0x304, hModule=0x775b0000, lpmodinfo=0x2307bac, cb=0xc | out: lpmodinfo=0x2307bac*(lpBaseOfDll=0x775b0000, SizeOfImage=0x100000, EntryPoint=0x775cb6ed)) returned 1 [0098.409] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.409] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x775b0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="USER32.dll") returned 0xa [0098.409] CoTaskMemFree (pv=0x5d7900) [0098.409] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.409] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x775b0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\USER32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll")) returned 0x1e [0098.410] CoTaskMemFree (pv=0x5d7900) [0098.410] GetModuleInformation (in: hProcess=0x304, hModule=0x75a70000, lpmodinfo=0x2309cb8, cb=0xc | out: lpmodinfo=0x2309cb8*(lpBaseOfDll=0x75a70000, SizeOfImage=0xa000, EntryPoint=0x75a736a0)) returned 1 [0098.410] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.410] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75a70000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="LPK.dll") returned 0x7 [0098.410] CoTaskMemFree (pv=0x5d7900) [0098.410] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.410] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75a70000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\LPK.dll" (normalized: "c:\\windows\\syswow64\\lpk.dll")) returned 0x1b [0098.410] CoTaskMemFree (pv=0x5d7900) [0098.411] GetModuleInformation (in: hProcess=0x304, hModule=0x758d0000, lpmodinfo=0x230bdb4, cb=0xc | out: lpmodinfo=0x230bdb4*(lpBaseOfDll=0x758d0000, SizeOfImage=0x9d000, EntryPoint=0x75903fd7)) returned 1 [0098.411] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.411] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x758d0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="USP10.dll") returned 0x9 [0098.411] CoTaskMemFree (pv=0x5d7900) [0098.411] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x758d0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\USP10.dll" (normalized: "c:\\windows\\syswow64\\usp10.dll")) returned 0x1d [0098.411] GetModuleInformation (in: hProcess=0x304, hModule=0x75f80000, lpmodinfo=0x230df44, cb=0xc | out: lpmodinfo=0x230df44*(lpBaseOfDll=0x75f80000, SizeOfImage=0x60000, EntryPoint=0x75f9158f)) returned 1 [0098.412] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75f80000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="IMM32.DLL") returned 0x9 [0098.412] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75f80000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\system32\\IMM32.DLL" (normalized: "c:\\windows\\system32\\imm32.dll")) returned 0x1d [0098.412] GetModuleInformation (in: hProcess=0x304, hModule=0x75ea0000, lpmodinfo=0x2310048, cb=0xc | out: lpmodinfo=0x2310048*(lpBaseOfDll=0x75ea0000, SizeOfImage=0xcc000, EntryPoint=0x75ea168b)) returned 1 [0098.413] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75ea0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="MSCTF.dll") returned 0x9 [0098.413] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75ea0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\MSCTF.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll")) returned 0x1d [0098.413] GetModuleInformation (in: hProcess=0x304, hModule=0x75420000, lpmodinfo=0x231214c, cb=0xc | out: lpmodinfo=0x231214c*(lpBaseOfDll=0x75420000, SizeOfImage=0x9000, EntryPoint=0x75421220)) returned 1 [0098.413] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75420000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="VERSION.dll") returned 0xb [0098.414] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75420000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\system32\\VERSION.dll" (normalized: "c:\\windows\\system32\\version.dll")) returned 0x1f [0098.414] GetModuleInformation (in: hProcess=0x304, hModule=0x74890000, lpmodinfo=0x2314258, cb=0xc | out: lpmodinfo=0x2314258*(lpBaseOfDll=0x74890000, SizeOfImage=0x6a8000, EntryPoint=0x749d7040)) returned 1 [0098.414] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x74890000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="clr.dll") returned 0x7 [0098.415] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x74890000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\clr.dll")) returned 0x35 [0098.415] GetModuleInformation (in: hProcess=0x304, hModule=0x75320000, lpmodinfo=0x2316388, cb=0xc | out: lpmodinfo=0x2316388*(lpBaseOfDll=0x75320000, SizeOfImage=0xf5000, EntryPoint=0x75374160)) returned 1 [0098.415] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75320000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="MSVCR120_CLR0400.dll") returned 0x14 [0098.416] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75320000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\system32\\MSVCR120_CLR0400.dll" (normalized: "c:\\windows\\system32\\msvcr120_clr0400.dll")) returned 0x28 [0098.416] GetModuleInformation (in: hProcess=0x304, hModule=0x72440000, lpmodinfo=0x23184bc, cb=0xc | out: lpmodinfo=0x23184bc*(lpBaseOfDll=0x72440000, SizeOfImage=0x122b000, EntryPoint=0x0)) returned 1 [0098.417] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x72440000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="mscorlib.ni.dll") returned 0xf [0098.417] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x72440000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\b7a12c4c0032847fcc6b9c710460456f\\mscorlib.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\mscorlib\\b7a12c4c0032847fcc6b9c710460456f\\mscorlib.ni.dll")) returned 0x68 [0098.417] GetModuleInformation (in: hProcess=0x304, hModule=0x764e0000, lpmodinfo=0x231a664, cb=0xc | out: lpmodinfo=0x231a664*(lpBaseOfDll=0x764e0000, SizeOfImage=0x15c000, EntryPoint=0x7652ba3d)) returned 1 [0098.418] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x764e0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="ole32.dll") returned 0x9 [0098.418] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x764e0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll")) returned 0x1d [0098.419] GetModuleInformation (in: hProcess=0x304, hModule=0x74f60000, lpmodinfo=0x231c768, cb=0xc | out: lpmodinfo=0x231c768*(lpBaseOfDll=0x74f60000, SizeOfImage=0x80000, EntryPoint=0x74f737c9)) returned 1 [0098.419] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x74f60000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="uxtheme.dll") returned 0xb [0098.419] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x74f60000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\system32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll")) returned 0x1f [0098.420] GetModuleInformation (in: hProcess=0x304, hModule=0x752a0000, lpmodinfo=0x231e874, cb=0xc | out: lpmodinfo=0x231e874*(lpBaseOfDll=0x752a0000, SizeOfImage=0x7d000, EntryPoint=0x752a1140)) returned 1 [0098.420] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x752a0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="clrjit.dll") returned 0xa [0098.420] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x752a0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clrjit.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\clrjit.dll")) returned 0x38 [0098.421] GetModuleInformation (in: hProcess=0x304, hModule=0x762b0000, lpmodinfo=0x23209b4, cb=0xc | out: lpmodinfo=0x23209b4*(lpBaseOfDll=0x762b0000, SizeOfImage=0x8f000, EntryPoint=0x762b3fb1)) returned 1 [0098.421] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x762b0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="OLEAUT32.dll") returned 0xc [0098.422] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x762b0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\OLEAUT32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll")) returned 0x20 [0098.422] GetModuleInformation (in: hProcess=0x304, hModule=0x736d0000, lpmodinfo=0x2322ac8, cb=0xc | out: lpmodinfo=0x2322ac8*(lpBaseOfDll=0x736d0000, SizeOfImage=0x9ad000, EntryPoint=0x0)) returned 1 [0098.422] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x736d0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="System.ni.dll") returned 0xd [0098.423] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x736d0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System\\500ffa28b327e171fe664023003e947e\\System.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system\\500ffa28b327e171fe664023003e947e\\system.ni.dll")) returned 0x64 [0098.423] GetModuleInformation (in: hProcess=0x304, hModule=0x71d20000, lpmodinfo=0x2324c64, cb=0xc | out: lpmodinfo=0x2324c64*(lpBaseOfDll=0x71d20000, SizeOfImage=0x716000, EntryPoint=0x0)) returned 1 [0098.424] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x71d20000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="System.Core.ni.dll") returned 0x12 [0098.424] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x71d20000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Core\\386fde9190d499d6645df8b90eb76242\\System.Core.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.core\\386fde9190d499d6645df8b90eb76242\\system.core.ni.dll")) returned 0x6e [0098.424] GetModuleInformation (in: hProcess=0x304, hModule=0x750d0000, lpmodinfo=0x2326e20, cb=0xc | out: lpmodinfo=0x2326e20*(lpBaseOfDll=0x750d0000, SizeOfImage=0x1cb000, EntryPoint=0x0)) returned 1 [0098.425] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x750d0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="Microsoft.VisualBasic.ni.dll") returned 0x1c [0098.425] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x750d0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Microsoft.V9921e851#\\cfbddeb6e93e8f421b92229b20e51233\\Microsoft.VisualBasic.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\microsoft.v9921e851#\\cfbddeb6e93e8f421b92229b20e51233\\microsoft.visualbasic.ni.dll")) returned 0x81 [0098.426] GetModuleInformation (in: hProcess=0x304, hModule=0x750b0000, lpmodinfo=0x2329014, cb=0xc | out: lpmodinfo=0x2329014*(lpBaseOfDll=0x750b0000, SizeOfImage=0x13000, EntryPoint=0x750b18f0)) returned 1 [0098.426] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x750b0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="nlssorting.dll") returned 0xe [0098.426] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x750b0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\nlssorting.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\nlssorting.dll")) returned 0x3c [0098.427] GetModuleInformation (in: hProcess=0x304, hModule=0x74870000, lpmodinfo=0x232b164, cb=0xc | out: lpmodinfo=0x232b164*(lpBaseOfDll=0x74870000, SizeOfImage=0x16000, EntryPoint=0x74872dc3)) returned 1 [0098.427] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x74870000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="CRYPTSP.dll") returned 0xb [0098.428] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x74870000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\system32\\CRYPTSP.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll")) returned 0x1f [0098.428] GetModuleInformation (in: hProcess=0x304, hModule=0x74830000, lpmodinfo=0x232d270, cb=0xc | out: lpmodinfo=0x232d270*(lpBaseOfDll=0x74830000, SizeOfImage=0x3b000, EntryPoint=0x7483128d)) returned 1 [0098.429] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x74830000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="rsaenh.dll") returned 0xa [0098.429] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x74830000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\system32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll")) returned 0x1e [0098.429] GetModuleInformation (in: hProcess=0x304, hModule=0x75a60000, lpmodinfo=0x232f488, cb=0xc | out: lpmodinfo=0x232f488*(lpBaseOfDll=0x75a60000, SizeOfImage=0x5000, EntryPoint=0x75a61438)) returned 1 [0098.430] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75a60000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="psapi.dll") returned 0x9 [0098.430] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75a60000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\psapi.dll" (normalized: "c:\\windows\\syswow64\\psapi.dll")) returned 0x1d [0098.431] GetModuleInformation (in: hProcess=0x304, hModule=0x746a0000, lpmodinfo=0x233158c, cb=0xc | out: lpmodinfo=0x233158c*(lpBaseOfDll=0x746a0000, SizeOfImage=0x18d000, EntryPoint=0x0)) returned 1 [0098.431] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x746a0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="System.Drawing.ni.dll") returned 0x15 [0098.432] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x746a0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Drawing\\553c0312fdf5a5449f3649f0515e70fb\\System.Drawing.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.drawing\\553c0312fdf5a5449f3649f0515e70fb\\system.drawing.ni.dll")) returned 0x74 [0098.432] GetModuleInformation (in: hProcess=0x304, hModule=0x710c0000, lpmodinfo=0x2333758, cb=0xc | out: lpmodinfo=0x2333758*(lpBaseOfDll=0x710c0000, SizeOfImage=0xc58000, EntryPoint=0x0)) returned 1 [0098.433] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x710c0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="System.Windows.Forms.ni.dll") returned 0x1b [0098.433] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x710c0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Windows.Forms\\7a6894982f35a1d75ec73d447c583da2\\System.Windows.Forms.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.windows.forms\\7a6894982f35a1d75ec73d447c583da2\\system.windows.forms.ni.dll")) returned 0x80 [0098.435] lstrcatA (in: lpString1="", lpString2="x" | out: lpString1="x") returned="x" [0098.436] lstrcatA (in: lpString1="x", lpString2="?" | out: lpString1="x?") returned="x?" [0098.436] lstrcatA (in: lpString1="x?", lpString2="N" | out: lpString1="x?N") returned="x?N" [0098.436] lstrcatA (in: lpString1="x?N", lpString2="h" | out: lpString1="x?Nh") returned="x?Nh" [0098.436] lstrcatA (in: lpString1="x?Nh", lpString2="E" | out: lpString1="x?NhE") returned="x?NhE" [0098.436] lstrcatA (in: lpString1="x?NhE", lpString2="o" | out: lpString1="x?NhEo") returned="x?NhEo" [0098.436] lstrcatA (in: lpString1="x?NhEo", lpString2="?" | out: lpString1="x?NhEo?") returned="x?NhEo?" [0098.436] lstrcatA (in: lpString1="x?NhEo?", lpString2="?" | out: lpString1="x?NhEo??") returned="x?NhEo??" [0098.436] lstrcatA (in: lpString1="x?NhEo??", lpString2="Q" | out: lpString1="x?NhEo??Q") returned="x?NhEo??Q" [0098.436] lstrcatA (in: lpString1="x?NhEo??Q", lpString2="?" | out: lpString1="x?NhEo??Q?") returned="x?NhEo??Q?" [0098.436] lstrcatA (in: lpString1="x?NhEo??Q?", lpString2="P" | out: lpString1="x?NhEo??Q?P") returned="x?NhEo??Q?P" [0098.436] lstrcatA (in: lpString1="x?NhEo??Q?P", lpString2="?" | out: lpString1="x?NhEo??Q?P?") returned="x?NhEo??Q?P?" [0098.436] lstrcatA (in: lpString1="x?NhEo??Q?P?", lpString2="?" | out: lpString1="x?NhEo??Q?P??") returned="x?NhEo??Q?P??" [0098.436] lstrcatA (in: lpString1="x?NhEo??Q?P??", lpString2="G" | out: lpString1="x?NhEo??Q?P??G") returned="x?NhEo??Q?P??G" [0098.436] lstrcatA (in: lpString1="x?NhEo??Q?P??G", lpString2="?" | out: lpString1="x?NhEo??Q?P??G?") returned="x?NhEo??Q?P??G?" [0098.436] lstrcatA (in: lpString1="x?NhEo??Q?P??G?", lpString2="?" | out: lpString1="x?NhEo??Q?P??G??") returned="x?NhEo??Q?P??G??" [0098.436] lstrcatA (in: lpString1="x?NhEo??Q?P??G??", lpString2="?" | out: lpString1="x?NhEo??Q?P??G???") returned="x?NhEo??Q?P??G???" [0098.436] lstrcatA (in: lpString1="x?NhEo??Q?P??G???", lpString2="?" | out: lpString1="x?NhEo??Q?P??G????") returned="x?NhEo??Q?P??G????" [0098.436] lstrcatA (in: lpString1="x?NhEo??Q?P??G????", lpString2="?" | out: lpString1="x?NhEo??Q?P??G?????") returned="x?NhEo??Q?P??G?????" [0098.436] lstrcatA (in: lpString1="x?NhEo??Q?P??G?????", lpString2="Z" | out: lpString1="x?NhEo??Q?P??G?????Z") returned="x?NhEo??Q?P??G?????Z" [0098.436] lstrcatA (in: lpString1="x?NhEo??Q?P??G?????Z", lpString2="?" | out: lpString1="x?NhEo??Q?P??G?????Z?") returned="x?NhEo??Q?P??G?????Z?" [0098.436] lstrcatA (in: lpString1="x?NhEo??Q?P??G?????Z?", lpString2="?" | out: lpString1="x?NhEo??Q?P??G?????Z??") returned="x?NhEo??Q?P??G?????Z??" [0098.436] lstrcatA (in: lpString1="x?NhEo??Q?P??G?????Z??", lpString2="?" | out: lpString1="x?NhEo??Q?P??G?????Z???") returned="x?NhEo??Q?P??G?????Z???" [0098.436] lstrcatA (in: lpString1="x?NhEo??Q?P??G?????Z???", lpString2="g" | out: lpString1="x?NhEo??Q?P??G?????Z???g") returned="x?NhEo??Q?P??G?????Z???g" [0098.436] lstrcatA (in: lpString1="x?NhEo??Q?P??G?????Z???g", lpString2="W" | out: lpString1="x?NhEo??Q?P??G?????Z???gW") returned="x?NhEo??Q?P??G?????Z???gW" [0098.436] lstrcatA (in: lpString1="x?NhEo??Q?P??G?????Z???gW", lpString2="?" | out: lpString1="x?NhEo??Q?P??G?????Z???gW?") returned="x?NhEo??Q?P??G?????Z???gW?" [0098.436] lstrcatA (in: lpString1="x?NhEo??Q?P??G?????Z???gW?", lpString2="?" | out: lpString1="x?NhEo??Q?P??G?????Z???gW??") returned="x?NhEo??Q?P??G?????Z???gW??" [0098.436] lstrcatA (in: lpString1="x?NhEo??Q?P??G?????Z???gW??", lpString2="?" | out: lpString1="x?NhEo??Q?P??G?????Z???gW???") returned="x?NhEo??Q?P??G?????Z???gW???" [0098.436] lstrcatA (in: lpString1="x?NhEo??Q?P??G?????Z???gW???", lpString2="n" | out: lpString1="x?NhEo??Q?P??G?????Z???gW???n") returned="x?NhEo??Q?P??G?????Z???gW???n" [0098.436] lstrcatA (in: lpString1="x?NhEo??Q?P??G?????Z???gW???n", lpString2="?" | out: lpString1="x?NhEo??Q?P??G?????Z???gW???n?") returned="x?NhEo??Q?P??G?????Z???gW???n?" [0098.437] lstrcatA (in: lpString1="x?NhEo??Q?P??G?????Z???gW???n?", lpString2="a" | out: lpString1="x?NhEo??Q?P??G?????Z???gW???n?a") returned="x?NhEo??Q?P??G?????Z???gW???n?a" [0098.437] lstrcatA (in: lpString1="x?NhEo??Q?P??G?????Z???gW???n?a", lpString2="s" | out: lpString1="x?NhEo??Q?P??G?????Z???gW???n?as") returned="x?NhEo??Q?P??G?????Z???gW???n?as" [0098.437] lstrcatA (in: lpString1="x?NhEo??Q?P??G?????Z???gW???n?as", lpString2="J" | out: lpString1="x?NhEo??Q?P??G?????Z???gW???n?asJ") returned="x?NhEo??Q?P??G?????Z???gW???n?asJ" [0098.437] lstrcatA (in: lpString1="x?NhEo??Q?P??G?????Z???gW???n?asJ", lpString2="?" | out: lpString1="x?NhEo??Q?P??G?????Z???gW???n?asJ?") returned="x?NhEo??Q?P??G?????Z???gW???n?asJ?" [0098.437] lstrcatA (in: lpString1="x?NhEo??Q?P??G?????Z???gW???n?asJ?", lpString2="?" | out: lpString1="x?NhEo??Q?P??G?????Z???gW???n?asJ??") returned="x?NhEo??Q?P??G?????Z???gW???n?asJ??" [0098.437] lstrcatA (in: lpString1="x?NhEo??Q?P??G?????Z???gW???n?asJ??", lpString2="T" | out: lpString1="x?NhEo??Q?P??G?????Z???gW???n?asJ??T") returned="x?NhEo??Q?P??G?????Z???gW???n?asJ??T" [0098.437] lstrcatA (in: lpString1="x?NhEo??Q?P??G?????Z???gW???n?asJ??T", lpString2="?" | out: lpString1="x?NhEo??Q?P??G?????Z???gW???n?asJ??T?") returned="x?NhEo??Q?P??G?????Z???gW???n?asJ??T?" [0098.437] lstrcatA (in: lpString1="x?NhEo??Q?P??G?????Z???gW???n?asJ??T?", lpString2="F" | out: lpString1="x?NhEo??Q?P??G?????Z???gW???n?asJ??T?F") returned="x?NhEo??Q?P??G?????Z???gW???n?asJ??T?F" [0098.437] lstrcatA (in: lpString1="x?NhEo??Q?P??G?????Z???gW???n?asJ??T?F", lpString2="j" | out: lpString1="x?NhEo??Q?P??G?????Z???gW???n?asJ??T?Fj") returned="x?NhEo??Q?P??G?????Z???gW???n?asJ??T?Fj" [0098.437] lstrcatA (in: lpString1="x?NhEo??Q?P??G?????Z???gW???n?asJ??T?Fj", lpString2="?" | out: lpString1="x?NhEo??Q?P??G?????Z???gW???n?asJ??T?Fj?") returned="x?NhEo??Q?P??G?????Z???gW???n?asJ??T?Fj?" [0098.437] lstrcatA (in: lpString1="x?NhEo??Q?P??G?????Z???gW???n?asJ??T?Fj?", lpString2="?" | out: lpString1="x?NhEo??Q?P??G?????Z???gW???n?asJ??T?Fj??") returned="x?NhEo??Q?P??G?????Z???gW???n?asJ??T?Fj??" [0098.437] lstrcatA (in: lpString1="x?NhEo??Q?P??G?????Z???gW???n?asJ??T?Fj??", lpString2="?" | out: lpString1="x?NhEo??Q?P??G?????Z???gW???n?asJ??T?Fj???") returned="x?NhEo??Q?P??G?????Z???gW???n?asJ??T?Fj???" [0098.437] lstrcatA (in: lpString1="x?NhEo??Q?P??G?????Z???gW???n?asJ??T?Fj???", lpString2="?" | out: lpString1="x?NhEo??Q?P??G?????Z???gW???n?asJ??T?Fj????") returned="x?NhEo??Q?P??G?????Z???gW???n?asJ??T?Fj????" [0098.437] lstrcatA (in: lpString1="x?NhEo??Q?P??G?????Z???gW???n?asJ??T?Fj????", lpString2="?" | out: lpString1="x?NhEo??Q?P??G?????Z???gW???n?asJ??T?Fj?????") returned="x?NhEo??Q?P??G?????Z???gW???n?asJ??T?Fj?????" [0098.437] lstrcatA (in: lpString1="x?NhEo??Q?P??G?????Z???gW???n?asJ??T?Fj?????", lpString2="R" | out: lpString1="x?NhEo??Q?P??G?????Z???gW???n?asJ??T?Fj?????R") returned="x?NhEo??Q?P??G?????Z???gW???n?asJ??T?Fj?????R" [0098.437] lstrcatA (in: lpString1="x?NhEo??Q?P??G?????Z???gW???n?asJ??T?Fj?????R", lpString2="h" | out: lpString1="x?NhEo??Q?P??G?????Z???gW???n?asJ??T?Fj?????Rh") returned="x?NhEo??Q?P??G?????Z???gW???n?asJ??T?Fj?????Rh" [0098.437] lstrcatA (in: lpString1="x?NhEo??Q?P??G?????Z???gW???n?asJ??T?Fj?????Rh", lpString2="c" | out: lpString1="x?NhEo??Q?P??G?????Z???gW???n?asJ??T?Fj?????Rhc") returned="x?NhEo??Q?P??G?????Z???gW???n?asJ??T?Fj?????Rhc" [0098.437] lstrcatA (in: lpString1="x?NhEo??Q?P??G?????Z???gW???n?asJ??T?Fj?????Rhc", lpString2="?" | out: lpString1="x?NhEo??Q?P??G?????Z???gW???n?asJ??T?Fj?????Rhc?") returned="x?NhEo??Q?P??G?????Z???gW???n?asJ??T?Fj?????Rhc?" [0098.437] lstrcatA (in: lpString1="x?NhEo??Q?P??G?????Z???gW???n?asJ??T?Fj?????Rhc?", lpString2="?" | out: lpString1="x?NhEo??Q?P??G?????Z???gW???n?asJ??T?Fj?????Rhc??") returned="x?NhEo??Q?P??G?????Z???gW???n?asJ??T?Fj?????Rhc??" [0098.437] lstrcatA (in: lpString1="x?NhEo??Q?P??G?????Z???gW???n?asJ??T?Fj?????Rhc??", lpString2="E" | out: lpString1="x?NhEo??Q?P??G?????Z???gW???n?asJ??T?Fj?????Rhc??E") returned="x?NhEo??Q?P??G?????Z???gW???n?asJ??T?Fj?????Rhc??E" [0098.437] lstrcatA (in: lpString1="x?NhEo??Q?P??G?????Z???gW???n?asJ??T?Fj?????Rhc??E", lpString2="l" | out: lpString1="x?NhEo??Q?P??G?????Z???gW???n?asJ??T?Fj?????Rhc??El") returned="x?NhEo??Q?P??G?????Z???gW???n?asJ??T?Fj?????Rhc??El" [0098.437] lstrcatA (in: lpString1="x?NhEo??Q?P??G?????Z???gW???n?asJ??T?Fj?????Rhc??El", lpString2="?" | out: lpString1="x?NhEo??Q?P??G?????Z???gW???n?asJ??T?Fj?????Rhc??El?") returned="x?NhEo??Q?P??G?????Z???gW???n?asJ??T?Fj?????Rhc??El?" [0098.437] lstrcatA (in: lpString1="x?NhEo??Q?P??G?????Z???gW???n?asJ??T?Fj?????Rhc??El?", lpString2="J" | out: lpString1="x?NhEo??Q?P??G?????Z???gW???n?asJ??T?Fj?????Rhc??El?J") returned="x?NhEo??Q?P??G?????Z???gW???n?asJ??T?Fj?????Rhc??El?J" [0098.437] lstrcatA (in: lpString1="x?NhEo??Q?P??G?????Z???gW???n?asJ??T?Fj?????Rhc??El?J", lpString2="w" | out: lpString1="x?NhEo??Q?P??G?????Z???gW???n?asJ??T?Fj?????Rhc??El?Jw") returned="x?NhEo??Q?P??G?????Z???gW???n?asJ??T?Fj?????Rhc??El?Jw" [0098.437] lstrcatA (in: lpString1="x?NhEo??Q?P??G?????Z???gW???n?asJ??T?Fj?????Rhc??El?Jw", lpString2="?" | out: lpString1="x?NhEo??Q?P??G?????Z???gW???n?asJ??T?Fj?????Rhc??El?Jw?") returned="x?NhEo??Q?P??G?????Z???gW???n?asJ??T?Fj?????Rhc??El?Jw?" [0098.437] lstrcatA (in: lpString1="x?NhEo??Q?P??G?????Z???gW???n?asJ??T?Fj?????Rhc??El?Jw?", lpString2="?" | out: lpString1="x?NhEo??Q?P??G?????Z???gW???n?asJ??T?Fj?????Rhc??El?Jw??") returned="x?NhEo??Q?P??G?????Z???gW???n?asJ??T?Fj?????Rhc??El?Jw??" [0098.437] lstrcatA (in: lpString1="x?NhEo??Q?P??G?????Z???gW???n?asJ??T?Fj?????Rhc??El?Jw??", lpString2="h" | out: lpString1="x?NhEo??Q?P??G?????Z???gW???n?asJ??T?Fj?????Rhc??El?Jw??h") returned="x?NhEo??Q?P??G?????Z???gW???n?asJ??T?Fj?????Rhc??El?Jw??h" [0098.437] lstrcatA (in: lpString1="x?NhEo??Q?P??G?????Z???gW???n?asJ??T?Fj?????Rhc??El?Jw??h", lpString2="S" | out: lpString1="x?NhEo??Q?P??G?????Z???gW???n?asJ??T?Fj?????Rhc??El?Jw??hS") returned="x?NhEo??Q?P??G?????Z???gW???n?asJ??T?Fj?????Rhc??El?Jw??hS" [0098.438] lstrcatA (in: lpString1="x?NhEo??Q?P??G?????Z???gW???n?asJ??T?Fj?????Rhc??El?Jw??hS", lpString2="?" | out: lpString1="x?NhEo??Q?P??G?????Z???gW???n?asJ??T?Fj?????Rhc??El?Jw??hS?") returned="x?NhEo??Q?P??G?????Z???gW???n?asJ??T?Fj?????Rhc??El?Jw??hS?" [0098.438] lstrcatA (in: lpString1="x?NhEo??Q?P??G?????Z???gW???n?asJ??T?Fj?????Rhc??El?Jw??hS?", lpString2="?" | out: lpString1="x?NhEo??Q?P??G?????Z???gW???n?asJ??T?Fj?????Rhc??El?Jw??hS??") returned="x?NhEo??Q?P??G?????Z???gW???n?asJ??T?Fj?????Rhc??El?Jw??hS??" [0098.438] lstrcatA (in: lpString1="x?NhEo??Q?P??G?????Z???gW???n?asJ??T?Fj?????Rhc??El?Jw??hS??", lpString2="?" | out: lpString1="x?NhEo??Q?P??G?????Z???gW???n?asJ??T?Fj?????Rhc??El?Jw??hS???") returned="x?NhEo??Q?P??G?????Z???gW???n?asJ??T?Fj?????Rhc??El?Jw??hS???" [0098.438] lstrcatA (in: lpString1="x?NhEo??Q?P??G?????Z???gW???n?asJ??T?Fj?????Rhc??El?Jw??hS???", lpString2="?" | out: lpString1="x?NhEo??Q?P??G?????Z???gW???n?asJ??T?Fj?????Rhc??El?Jw??hS????") returned="x?NhEo??Q?P??G?????Z???gW???n?asJ??T?Fj?????Rhc??El?Jw??hS????" [0098.438] lstrcatA (in: lpString1="x?NhEo??Q?P??G?????Z???gW???n?asJ??T?Fj?????Rhc??El?Jw??hS????", lpString2="?" | out: lpString1="x?NhEo??Q?P??G?????Z???gW???n?asJ??T?Fj?????Rhc??El?Jw??hS?????") returned="x?NhEo??Q?P??G?????Z???gW???n?asJ??T?Fj?????Rhc??El?Jw??hS?????" [0098.438] lstrcatA (in: lpString1="x?NhEo??Q?P??G?????Z???gW???n?asJ??T?Fj?????Rhc??El?Jw??hS?????", lpString2="?" | out: lpString1="x?NhEo??Q?P??G?????Z???gW???n?asJ??T?Fj?????Rhc??El?Jw??hS??????") returned="x?NhEo??Q?P??G?????Z???gW???n?asJ??T?Fj?????Rhc??El?Jw??hS??????" [0098.438] lstrcatA (in: lpString1="x?NhEo??Q?P??G?????Z???gW???n?asJ??T?Fj?????Rhc??El?Jw??hS??????", lpString2="?" | out: lpString1="x?NhEo??Q?P??G?????Z???gW???n?asJ??T?Fj?????Rhc??El?Jw??hS???????") returned="x?NhEo??Q?P??G?????Z???gW???n?asJ??T?Fj?????Rhc??El?Jw??hS???????" [0098.438] lstrcatA (in: lpString1="x?NhEo??Q?P??G?????Z???gW???n?asJ??T?Fj?????Rhc??El?Jw??hS???????", lpString2="n" | out: lpString1="x?NhEo??Q?P??G?????Z???gW???n?asJ??T?Fj?????Rhc??El?Jw??hS???????n") returned="x?NhEo??Q?P??G?????Z???gW???n?asJ??T?Fj?????Rhc??El?Jw??hS???????n" [0098.438] lstrcatA (in: lpString1="x?NhEo??Q?P??G?????Z???gW???n?asJ??T?Fj?????Rhc??El?Jw??hS???????n", lpString2="C" | out: lpString1="x?NhEo??Q?P??G?????Z???gW???n?asJ??T?Fj?????Rhc??El?Jw??hS???????nC") returned="x?NhEo??Q?P??G?????Z???gW???n?asJ??T?Fj?????Rhc??El?Jw??hS???????nC" [0098.438] lstrcatA (in: lpString1="x?NhEo??Q?P??G?????Z???gW???n?asJ??T?Fj?????Rhc??El?Jw??hS???????nC", lpString2="?" | out: lpString1="x?NhEo??Q?P??G?????Z???gW???n?asJ??T?Fj?????Rhc??El?Jw??hS???????nC?") returned="x?NhEo??Q?P??G?????Z???gW???n?asJ??T?Fj?????Rhc??El?Jw??hS???????nC?" [0098.438] lstrcatA (in: lpString1="x?NhEo??Q?P??G?????Z???gW???n?asJ??T?Fj?????Rhc??El?Jw??hS???????nC?", lpString2="?" | out: lpString1="x?NhEo??Q?P??G?????Z???gW???n?asJ??T?Fj?????Rhc??El?Jw??hS???????nC??") returned="x?NhEo??Q?P??G?????Z???gW???n?asJ??T?Fj?????Rhc??El?Jw??hS???????nC??" [0098.438] lstrcatA (in: lpString1="x?NhEo??Q?P??G?????Z???gW???n?asJ??T?Fj?????Rhc??El?Jw??hS???????nC??", lpString2="S" | out: lpString1="x?NhEo??Q?P??G?????Z???gW???n?asJ??T?Fj?????Rhc??El?Jw??hS???????nC??S") returned="x?NhEo??Q?P??G?????Z???gW???n?asJ??T?Fj?????Rhc??El?Jw??hS???????nC??S" [0098.438] lstrcatA (in: lpString1="x?NhEo??Q?P??G?????Z???gW???n?asJ??T?Fj?????Rhc??El?Jw??hS???????nC??S", lpString2="?" | out: lpString1="x?NhEo??Q?P??G?????Z???gW???n?asJ??T?Fj?????Rhc??El?Jw??hS???????nC??S?") returned="x?NhEo??Q?P??G?????Z???gW???n?asJ??T?Fj?????Rhc??El?Jw??hS???????nC??S?" [0098.438] lstrcatA (in: lpString1="x?NhEo??Q?P??G?????Z???gW???n?asJ??T?Fj?????Rhc??El?Jw??hS???????nC??S?", lpString2="?" | out: lpString1="x?NhEo??Q?P??G?????Z???gW???n?asJ??T?Fj?????Rhc??El?Jw??hS???????nC??S??") returned="x?NhEo??Q?P??G?????Z???gW???n?asJ??T?Fj?????Rhc??El?Jw??hS???????nC??S??" [0098.438] lstrcatA (in: lpString1="x?NhEo??Q?P??G?????Z???gW???n?asJ??T?Fj?????Rhc??El?Jw??hS???????nC??S??", lpString2="?" | out: lpString1="x?NhEo??Q?P??G?????Z???gW???n?asJ??T?Fj?????Rhc??El?Jw??hS???????nC??S???") returned="x?NhEo??Q?P??G?????Z???gW???n?asJ??T?Fj?????Rhc??El?Jw??hS???????nC??S???" [0098.438] lstrcatA (in: lpString1="x?NhEo??Q?P??G?????Z???gW???n?asJ??T?Fj?????Rhc??El?Jw??hS???????nC??S???", lpString2="j" | out: lpString1="x?NhEo??Q?P??G?????Z???gW???n?asJ??T?Fj?????Rhc??El?Jw??hS???????nC??S???j") returned="x?NhEo??Q?P??G?????Z???gW???n?asJ??T?Fj?????Rhc??El?Jw??hS???????nC??S???j" [0098.438] lstrcatA (in: lpString1="x?NhEo??Q?P??G?????Z???gW???n?asJ??T?Fj?????Rhc??El?Jw??hS???????nC??S???j", lpString2="?" | out: lpString1="x?NhEo??Q?P??G?????Z???gW???n?asJ??T?Fj?????Rhc??El?Jw??hS???????nC??S???j?") returned="x?NhEo??Q?P??G?????Z???gW???n?asJ??T?Fj?????Rhc??El?Jw??hS???????nC??S???j?" [0098.438] lstrcatA (in: lpString1="x?NhEo??Q?P??G?????Z???gW???n?asJ??T?Fj?????Rhc??El?Jw??hS???????nC??S???j?", lpString2="P" | out: lpString1="x?NhEo??Q?P??G?????Z???gW???n?asJ??T?Fj?????Rhc??El?Jw??hS???????nC??S???j?P") returned="x?NhEo??Q?P??G?????Z???gW???n?asJ??T?Fj?????Rhc??El?Jw??hS???????nC??S???j?P" [0098.438] lstrcatA (in: lpString1="x?NhEo??Q?P??G?????Z???gW???n?asJ??T?Fj?????Rhc??El?Jw??hS???????nC??S???j?P", lpString2="?" | out: lpString1="x?NhEo??Q?P??G?????Z???gW???n?asJ??T?Fj?????Rhc??El?Jw??hS???????nC??S???j?P?") returned="x?NhEo??Q?P??G?????Z???gW???n?asJ??T?Fj?????Rhc??El?Jw??hS???????nC??S???j?P?" [0098.438] lstrcatA (in: lpString1="x?NhEo??Q?P??G?????Z???gW???n?asJ??T?Fj?????Rhc??El?Jw??hS???????nC??S???j?P?", lpString2="a" | out: lpString1="x?NhEo??Q?P??G?????Z???gW???n?asJ??T?Fj?????Rhc??El?Jw??hS???????nC??S???j?P?a") returned="x?NhEo??Q?P??G?????Z???gW???n?asJ??T?Fj?????Rhc??El?Jw??hS???????nC??S???j?P?a" [0098.438] lstrcatA (in: lpString1="x?NhEo??Q?P??G?????Z???gW???n?asJ??T?Fj?????Rhc??El?Jw??hS???????nC??S???j?P?a", lpString2="?" | out: lpString1="x?NhEo??Q?P??G?????Z???gW???n?asJ??T?Fj?????Rhc??El?Jw??hS???????nC??S???j?P?a?") returned="x?NhEo??Q?P??G?????Z???gW???n?asJ??T?Fj?????Rhc??El?Jw??hS???????nC??S???j?P?a?" [0098.438] lstrcatA (in: lpString1="x?NhEo??Q?P??G?????Z???gW???n?asJ??T?Fj?????Rhc??El?Jw??hS???????nC??S???j?P?a?", lpString2="d" | out: lpString1="x?NhEo??Q?P??G?????Z???gW???n?asJ??T?Fj?????Rhc??El?Jw??hS???????nC??S???j?P?a?d") returned="x?NhEo??Q?P??G?????Z???gW???n?asJ??T?Fj?????Rhc??El?Jw??hS???????nC??S???j?P?a?d" [0098.438] lstrcatA (in: lpString1="x?NhEo??Q?P??G?????Z???gW???n?asJ??T?Fj?????Rhc??El?Jw??hS???????nC??S???j?P?a?d", lpString2="X" | out: lpString1="x?NhEo??Q?P??G?????Z???gW???n?asJ??T?Fj?????Rhc??El?Jw??hS???????nC??S???j?P?a?dX") returned="x?NhEo??Q?P??G?????Z???gW???n?asJ??T?Fj?????Rhc??El?Jw??hS???????nC??S???j?P?a?dX" [0098.438] lstrcatA (in: lpString1="x?NhEo??Q?P??G?????Z???gW???n?asJ??T?Fj?????Rhc??El?Jw??hS???????nC??S???j?P?a?dX", lpString2="?" | out: lpString1="x?NhEo??Q?P??G?????Z???gW???n?asJ??T?Fj?????Rhc??El?Jw??hS???????nC??S???j?P?a?dX?") returned="x?NhEo??Q?P??G?????Z???gW???n?asJ??T?Fj?????Rhc??El?Jw??hS???????nC??S???j?P?a?dX?" [0098.438] lstrcatA (in: lpString1="x?NhEo??Q?P??G?????Z???gW???n?asJ??T?Fj?????Rhc??El?Jw??hS???????nC??S???j?P?a?dX?", lpString2="h" | out: lpString1="x?NhEo??Q?P??G?????Z???gW???n?asJ??T?Fj?????Rhc??El?Jw??hS???????nC??S???j?P?a?dX?h") returned="x?NhEo??Q?P??G?????Z???gW???n?asJ??T?Fj?????Rhc??El?Jw??hS???????nC??S???j?P?a?dX?h" [0098.438] lstrcatA (in: lpString1="x?NhEo??Q?P??G?????Z???gW???n?asJ??T?Fj?????Rhc??El?Jw??hS???????nC??S???j?P?a?dX?h", lpString2="?" | out: lpString1="x?NhEo??Q?P??G?????Z???gW???n?asJ??T?Fj?????Rhc??El?Jw??hS???????nC??S???j?P?a?dX?h?") returned="x?NhEo??Q?P??G?????Z???gW???n?asJ??T?Fj?????Rhc??El?Jw??hS???????nC??S???j?P?a?dX?h?" [0098.438] lstrcatA (in: lpString1="x?NhEo??Q?P??G?????Z???gW???n?asJ??T?Fj?????Rhc??El?Jw??hS???????nC??S???j?P?a?dX?h?", lpString2="J" | out: lpString1="x?NhEo??Q?P??G?????Z???gW???n?asJ??T?Fj?????Rhc??El?Jw??hS???????nC??S???j?P?a?dX?h?J") returned="x?NhEo??Q?P??G?????Z???gW???n?asJ??T?Fj?????Rhc??El?Jw??hS???????nC??S???j?P?a?dX?h?J" [0098.438] lstrcatA (in: lpString1="x?NhEo??Q?P??G?????Z???gW???n?asJ??T?Fj?????Rhc??El?Jw??hS???????nC??S???j?P?a?dX?h?J", lpString2="?" | out: lpString1="x?NhEo??Q?P??G?????Z???gW???n?asJ??T?Fj?????Rhc??El?Jw??hS???????nC??S???j?P?a?dX?h?J?") returned="x?NhEo??Q?P??G?????Z???gW???n?asJ??T?Fj?????Rhc??El?Jw??hS???????nC??S???j?P?a?dX?h?J?" [0098.439] lstrcatA (in: lpString1="x?NhEo??Q?P??G?????Z???gW???n?asJ??T?Fj?????Rhc??El?Jw??hS???????nC??S???j?P?a?dX?h?J?", lpString2="?" | out: lpString1="x?NhEo??Q?P??G?????Z???gW???n?asJ??T?Fj?????Rhc??El?Jw??hS???????nC??S???j?P?a?dX?h?J??") returned="x?NhEo??Q?P??G?????Z???gW???n?asJ??T?Fj?????Rhc??El?Jw??hS???????nC??S???j?P?a?dX?h?J??" [0098.439] lstrcatA (in: lpString1="x?NhEo??Q?P??G?????Z???gW???n?asJ??T?Fj?????Rhc??El?Jw??hS???????nC??S???j?P?a?dX?h?J??", lpString2="H" | out: lpString1="x?NhEo??Q?P??G?????Z???gW???n?asJ??T?Fj?????Rhc??El?Jw??hS???????nC??S???j?P?a?dX?h?J??H") returned="x?NhEo??Q?P??G?????Z???gW???n?asJ??T?Fj?????Rhc??El?Jw??hS???????nC??S???j?P?a?dX?h?J??H" [0098.439] lstrcatA (in: lpString1="x?NhEo??Q?P??G?????Z???gW???n?asJ??T?Fj?????Rhc??El?Jw??hS???????nC??S???j?P?a?dX?h?J??H", lpString2="w" | out: lpString1="x?NhEo??Q?P??G?????Z???gW???n?asJ??T?Fj?????Rhc??El?Jw??hS???????nC??S???j?P?a?dX?h?J??Hw") returned="x?NhEo??Q?P??G?????Z???gW???n?asJ??T?Fj?????Rhc??El?Jw??hS???????nC??S???j?P?a?dX?h?J??Hw" [0098.439] lstrcatA (in: lpString1="x?NhEo??Q?P??G?????Z???gW???n?asJ??T?Fj?????Rhc??El?Jw??hS???????nC??S???j?P?a?dX?h?J??Hw", lpString2="?" | out: lpString1="x?NhEo??Q?P??G?????Z???gW???n?asJ??T?Fj?????Rhc??El?Jw??hS???????nC??S???j?P?a?dX?h?J??Hw?") returned="x?NhEo??Q?P??G?????Z???gW???n?asJ??T?Fj?????Rhc??El?Jw??hS???????nC??S???j?P?a?dX?h?J??Hw?" [0098.439] lstrcatA (in: lpString1="x?NhEo??Q?P??G?????Z???gW???n?asJ??T?Fj?????Rhc??El?Jw??hS???????nC??S???j?P?a?dX?h?J??Hw?", lpString2="j" | out: lpString1="x?NhEo??Q?P??G?????Z???gW???n?asJ??T?Fj?????Rhc??El?Jw??hS???????nC??S???j?P?a?dX?h?J??Hw?j") returned="x?NhEo??Q?P??G?????Z???gW???n?asJ??T?Fj?????Rhc??El?Jw??hS???????nC??S???j?P?a?dX?h?J??Hw?j" [0098.439] lstrcatA (in: lpString1="x?NhEo??Q?P??G?????Z???gW???n?asJ??T?Fj?????Rhc??El?Jw??hS???????nC??S???j?P?a?dX?h?J??Hw?j", lpString2="?" | out: lpString1="x?NhEo??Q?P??G?????Z???gW???n?asJ??T?Fj?????Rhc??El?Jw??hS???????nC??S???j?P?a?dX?h?J??Hw?j?") returned="x?NhEo??Q?P??G?????Z???gW???n?asJ??T?Fj?????Rhc??El?Jw??hS???????nC??S???j?P?a?dX?h?J??Hw?j?" [0098.439] lstrlenA (lpString="x?NhEo??Q?P??G?????Z???gW???n?asJ??T?Fj?????Rhc??El?Jw??hS???????nC??S???j?P?a?dX?h?J??Hw?j?") returned 92 [0098.439] lstrcpynA (in: lpString1=0x499074, lpString2="x?NhEo??Q?P??G?????Z???gW???n?asJ??T?Fj?????Rhc??El?Jw??hS???????nC??S???j?P?a?dX?h?J??Hw?j?", iMaxLength=40 | out: lpString1="x?NhEo??Q?P??G?????Z???gW???n?asJ??T?Fj") returned="x?NhEo??Q?P??G?????Z???gW???n?asJ??T?Fj" [0098.439] lstrlenA (lpString="x?NhEo??Q?P??G?????Z???gW???n?asJ??T?Fj") returned 39 [0098.439] lstrcatA (in: lpString1="", lpString2="?" | out: lpString1="?") returned="?" [0098.439] lstrcatA (in: lpString1="?", lpString2="?" | out: lpString1="??") returned="??" [0098.439] lstrcatA (in: lpString1="??", lpString2="?" | out: lpString1="???") returned="???" [0098.439] lstrcatA (in: lpString1="???", lpString2="y" | out: lpString1="???y") returned="???y" [0098.439] lstrcatA (in: lpString1="???y", lpString2="?" | out: lpString1="???y?") returned="???y?" [0098.439] lstrcatA (in: lpString1="???y?", lpString2="Y" | out: lpString1="???y?Y") returned="???y?Y" [0098.439] lstrcatA (in: lpString1="???y?Y", lpString2="i" | out: lpString1="???y?Yi") returned="???y?Yi" [0098.439] lstrcatA (in: lpString1="???y?Yi", lpString2="l" | out: lpString1="???y?Yil") returned="???y?Yil" [0098.439] lstrcatA (in: lpString1="???y?Yil", lpString2="?" | out: lpString1="???y?Yil?") returned="???y?Yil?" [0098.439] lstrcatA (in: lpString1="???y?Yil?", lpString2="?" | out: lpString1="???y?Yil??") returned="???y?Yil??" [0098.439] lstrcatA (in: lpString1="???y?Yil??", lpString2="?" | out: lpString1="???y?Yil???") returned="???y?Yil???" [0098.439] lstrcatA (in: lpString1="???y?Yil???", lpString2="Q" | out: lpString1="???y?Yil???Q") returned="???y?Yil???Q" [0098.439] lstrcatA (in: lpString1="???y?Yil???Q", lpString2="C" | out: lpString1="???y?Yil???QC") returned="???y?Yil???QC" [0098.439] lstrcatA (in: lpString1="???y?Yil???QC", lpString2="?" | out: lpString1="???y?Yil???QC?") returned="???y?Yil???QC?" [0098.439] lstrcatA (in: lpString1="???y?Yil???QC?", lpString2="?" | out: lpString1="???y?Yil???QC??") returned="???y?Yil???QC??" [0098.439] lstrcatA (in: lpString1="???y?Yil???QC??", lpString2="u" | out: lpString1="???y?Yil???QC??u") returned="???y?Yil???QC??u" [0098.440] lstrcatA (in: lpString1="???y?Yil???QC??u", lpString2="?" | out: lpString1="???y?Yil???QC??u?") returned="???y?Yil???QC??u?" [0098.440] lstrcatA (in: lpString1="???y?Yil???QC??u?", lpString2="?" | out: lpString1="???y?Yil???QC??u??") returned="???y?Yil???QC??u??" [0098.440] lstrcatA (in: lpString1="???y?Yil???QC??u??", lpString2="Y" | out: lpString1="???y?Yil???QC??u??Y") returned="???y?Yil???QC??u??Y" [0098.440] lstrcatA (in: lpString1="???y?Yil???QC??u??Y", lpString2="?" | out: lpString1="???y?Yil???QC??u??Y?") returned="???y?Yil???QC??u??Y?" [0098.440] lstrcatA (in: lpString1="???y?Yil???QC??u??Y?", lpString2="?" | out: lpString1="???y?Yil???QC??u??Y??") returned="???y?Yil???QC??u??Y??" [0098.440] lstrcatA (in: lpString1="???y?Yil???QC??u??Y??", lpString2="?" | out: lpString1="???y?Yil???QC??u??Y???") returned="???y?Yil???QC??u??Y???" [0098.440] lstrcatA (in: lpString1="???y?Yil???QC??u??Y???", lpString2="H" | out: lpString1="???y?Yil???QC??u??Y???H") returned="???y?Yil???QC??u??Y???H" [0098.440] lstrcatA (in: lpString1="???y?Yil???QC??u??Y???H", lpString2="I" | out: lpString1="???y?Yil???QC??u??Y???HI") returned="???y?Yil???QC??u??Y???HI" [0098.440] lstrcatA (in: lpString1="???y?Yil???QC??u??Y???HI", lpString2="?" | out: lpString1="???y?Yil???QC??u??Y???HI?") returned="???y?Yil???QC??u??Y???HI?" [0098.440] lstrcatA (in: lpString1="???y?Yil???QC??u??Y???HI?", lpString2="u" | out: lpString1="???y?Yil???QC??u??Y???HI?u") returned="???y?Yil???QC??u??Y???HI?u" [0098.440] lstrcatA (in: lpString1="???y?Yil???QC??u??Y???HI?u", lpString2="?" | out: lpString1="???y?Yil???QC??u??Y???HI?u?") returned="???y?Yil???QC??u??Y???HI?u?" [0098.440] lstrcatA (in: lpString1="???y?Yil???QC??u??Y???HI?u?", lpString2="?" | out: lpString1="???y?Yil???QC??u??Y???HI?u??") returned="???y?Yil???QC??u??Y???HI?u??" [0098.440] lstrcatA (in: lpString1="???y?Yil???QC??u??Y???HI?u??", lpString2="v" | out: lpString1="???y?Yil???QC??u??Y???HI?u??v") returned="???y?Yil???QC??u??Y???HI?u??v" [0098.440] lstrcatA (in: lpString1="???y?Yil???QC??u??Y???HI?u??v", lpString2="?" | out: lpString1="???y?Yil???QC??u??Y???HI?u??v?") returned="???y?Yil???QC??u??Y???HI?u??v?" [0098.440] lstrcatA (in: lpString1="???y?Yil???QC??u??Y???HI?u??v?", lpString2="g" | out: lpString1="???y?Yil???QC??u??Y???HI?u??v?g") returned="???y?Yil???QC??u??Y???HI?u??v?g" [0098.440] lstrcatA (in: lpString1="???y?Yil???QC??u??Y???HI?u??v?g", lpString2="L" | out: lpString1="???y?Yil???QC??u??Y???HI?u??v?gL") returned="???y?Yil???QC??u??Y???HI?u??v?gL" [0098.440] lstrcatA (in: lpString1="???y?Yil???QC??u??Y???HI?u??v?gL", lpString2="z" | out: lpString1="???y?Yil???QC??u??Y???HI?u??v?gLz") returned="???y?Yil???QC??u??Y???HI?u??v?gLz" [0098.440] lstrcatA (in: lpString1="???y?Yil???QC??u??Y???HI?u??v?gLz", lpString2="?" | out: lpString1="???y?Yil???QC??u??Y???HI?u??v?gLz?") returned="???y?Yil???QC??u??Y???HI?u??v?gLz?" [0098.440] lstrcatA (in: lpString1="???y?Yil???QC??u??Y???HI?u??v?gLz?", lpString2="N" | out: lpString1="???y?Yil???QC??u??Y???HI?u??v?gLz?N") returned="???y?Yil???QC??u??Y???HI?u??v?gLz?N" [0098.440] lstrcatA (in: lpString1="???y?Yil???QC??u??Y???HI?u??v?gLz?N", lpString2="?" | out: lpString1="???y?Yil???QC??u??Y???HI?u??v?gLz?N?") returned="???y?Yil???QC??u??Y???HI?u??v?gLz?N?" [0098.440] lstrcatA (in: lpString1="???y?Yil???QC??u??Y???HI?u??v?gLz?N?", lpString2="X" | out: lpString1="???y?Yil???QC??u??Y???HI?u??v?gLz?N?X") returned="???y?Yil???QC??u??Y???HI?u??v?gLz?N?X" [0098.440] lstrcatA (in: lpString1="???y?Yil???QC??u??Y???HI?u??v?gLz?N?X", lpString2="?" | out: lpString1="???y?Yil???QC??u??Y???HI?u??v?gLz?N?X?") returned="???y?Yil???QC??u??Y???HI?u??v?gLz?N?X?" [0098.440] lstrcatA (in: lpString1="???y?Yil???QC??u??Y???HI?u??v?gLz?N?X?", lpString2="L" | out: lpString1="???y?Yil???QC??u??Y???HI?u??v?gLz?N?X?L") returned="???y?Yil???QC??u??Y???HI?u??v?gLz?N?X?L" [0098.440] lstrcatA (in: lpString1="???y?Yil???QC??u??Y???HI?u??v?gLz?N?X?L", lpString2="j" | out: lpString1="???y?Yil???QC??u??Y???HI?u??v?gLz?N?X?Lj") returned="???y?Yil???QC??u??Y???HI?u??v?gLz?N?X?Lj" [0098.440] lstrcatA (in: lpString1="???y?Yil???QC??u??Y???HI?u??v?gLz?N?X?Lj", lpString2="?" | out: lpString1="???y?Yil???QC??u??Y???HI?u??v?gLz?N?X?Lj?") returned="???y?Yil???QC??u??Y???HI?u??v?gLz?N?X?Lj?" [0098.440] lstrcatA (in: lpString1="???y?Yil???QC??u??Y???HI?u??v?gLz?N?X?Lj?", lpString2="?" | out: lpString1="???y?Yil???QC??u??Y???HI?u??v?gLz?N?X?Lj??") returned="???y?Yil???QC??u??Y???HI?u??v?gLz?N?X?Lj??" [0098.440] lstrcatA (in: lpString1="???y?Yil???QC??u??Y???HI?u??v?gLz?N?X?Lj??", lpString2="U" | out: lpString1="???y?Yil???QC??u??Y???HI?u??v?gLz?N?X?Lj??U") returned="???y?Yil???QC??u??Y???HI?u??v?gLz?N?X?Lj??U" [0098.440] lstrcatA (in: lpString1="???y?Yil???QC??u??Y???HI?u??v?gLz?N?X?Lj??U", lpString2="?" | out: lpString1="???y?Yil???QC??u??Y???HI?u??v?gLz?N?X?Lj??U?") returned="???y?Yil???QC??u??Y???HI?u??v?gLz?N?X?Lj??U?" [0098.440] lstrcatA (in: lpString1="???y?Yil???QC??u??Y???HI?u??v?gLz?N?X?Lj??U?", lpString2="w" | out: lpString1="???y?Yil???QC??u??Y???HI?u??v?gLz?N?X?Lj??U?w") returned="???y?Yil???QC??u??Y???HI?u??v?gLz?N?X?Lj??U?w" [0098.440] lstrcatA (in: lpString1="???y?Yil???QC??u??Y???HI?u??v?gLz?N?X?Lj??U?w", lpString2="?" | out: lpString1="???y?Yil???QC??u??Y???HI?u??v?gLz?N?X?Lj??U?w?") returned="???y?Yil???QC??u??Y???HI?u??v?gLz?N?X?Lj??U?w?" [0098.441] lstrcatA (in: lpString1="???y?Yil???QC??u??Y???HI?u??v?gLz?N?X?Lj??U?w?", lpString2="?" | out: lpString1="???y?Yil???QC??u??Y???HI?u??v?gLz?N?X?Lj??U?w??") returned="???y?Yil???QC??u??Y???HI?u??v?gLz?N?X?Lj??U?w??" [0098.441] lstrcatA (in: lpString1="???y?Yil???QC??u??Y???HI?u??v?gLz?N?X?Lj??U?w??", lpString2="G" | out: lpString1="???y?Yil???QC??u??Y???HI?u??v?gLz?N?X?Lj??U?w??G") returned="???y?Yil???QC??u??Y???HI?u??v?gLz?N?X?Lj??U?w??G" [0098.441] lstrcatA (in: lpString1="???y?Yil???QC??u??Y???HI?u??v?gLz?N?X?Lj??U?w??G", lpString2="x" | out: lpString1="???y?Yil???QC??u??Y???HI?u??v?gLz?N?X?Lj??U?w??Gx") returned="???y?Yil???QC??u??Y???HI?u??v?gLz?N?X?Lj??U?w??Gx" [0098.441] lstrcatA (in: lpString1="???y?Yil???QC??u??Y???HI?u??v?gLz?N?X?Lj??U?w??Gx", lpString2="s" | out: lpString1="???y?Yil???QC??u??Y???HI?u??v?gLz?N?X?Lj??U?w??Gxs") returned="???y?Yil???QC??u??Y???HI?u??v?gLz?N?X?Lj??U?w??Gxs" [0098.441] lstrcatA (in: lpString1="???y?Yil???QC??u??Y???HI?u??v?gLz?N?X?Lj??U?w??Gxs", lpString2="Q" | out: lpString1="???y?Yil???QC??u??Y???HI?u??v?gLz?N?X?Lj??U?w??GxsQ") returned="???y?Yil???QC??u??Y???HI?u??v?gLz?N?X?Lj??U?w??GxsQ" [0098.441] lstrcatA (in: lpString1="???y?Yil???QC??u??Y???HI?u??v?gLz?N?X?Lj??U?w??GxsQ", lpString2="?" | out: lpString1="???y?Yil???QC??u??Y???HI?u??v?gLz?N?X?Lj??U?w??GxsQ?") returned="???y?Yil???QC??u??Y???HI?u??v?gLz?N?X?Lj??U?w??GxsQ?" [0098.441] lstrcatA (in: lpString1="???y?Yil???QC??u??Y???HI?u??v?gLz?N?X?Lj??U?w??GxsQ?", lpString2="b" | out: lpString1="???y?Yil???QC??u??Y???HI?u??v?gLz?N?X?Lj??U?w??GxsQ?b") returned="???y?Yil???QC??u??Y???HI?u??v?gLz?N?X?Lj??U?w??GxsQ?b" [0098.441] lstrcatA (in: lpString1="???y?Yil???QC??u??Y???HI?u??v?gLz?N?X?Lj??U?w??GxsQ?b", lpString2="d" | out: lpString1="???y?Yil???QC??u??Y???HI?u??v?gLz?N?X?Lj??U?w??GxsQ?bd") returned="???y?Yil???QC??u??Y???HI?u??v?gLz?N?X?Lj??U?w??GxsQ?bd" [0098.441] lstrcatA (in: lpString1="???y?Yil???QC??u??Y???HI?u??v?gLz?N?X?Lj??U?w??GxsQ?bd", lpString2="w" | out: lpString1="???y?Yil???QC??u??Y???HI?u??v?gLz?N?X?Lj??U?w??GxsQ?bdw") returned="???y?Yil???QC??u??Y???HI?u??v?gLz?N?X?Lj??U?w??GxsQ?bdw" [0098.441] lstrcatA (in: lpString1="???y?Yil???QC??u??Y???HI?u??v?gLz?N?X?Lj??U?w??GxsQ?bdw", lpString2="y" | out: lpString1="???y?Yil???QC??u??Y???HI?u??v?gLz?N?X?Lj??U?w??GxsQ?bdwy") returned="???y?Yil???QC??u??Y???HI?u??v?gLz?N?X?Lj??U?w??GxsQ?bdwy" [0098.441] lstrcatA (in: lpString1="???y?Yil???QC??u??Y???HI?u??v?gLz?N?X?Lj??U?w??GxsQ?bdwy", lpString2="?" | out: lpString1="???y?Yil???QC??u??Y???HI?u??v?gLz?N?X?Lj??U?w??GxsQ?bdwy?") returned="???y?Yil???QC??u??Y???HI?u??v?gLz?N?X?Lj??U?w??GxsQ?bdwy?" [0098.441] lstrcatA (in: lpString1="???y?Yil???QC??u??Y???HI?u??v?gLz?N?X?Lj??U?w??GxsQ?bdwy?", lpString2="C" | out: lpString1="???y?Yil???QC??u??Y???HI?u??v?gLz?N?X?Lj??U?w??GxsQ?bdwy?C") returned="???y?Yil???QC??u??Y???HI?u??v?gLz?N?X?Lj??U?w??GxsQ?bdwy?C" [0098.441] lstrcatA (in: lpString1="???y?Yil???QC??u??Y???HI?u??v?gLz?N?X?Lj??U?w??GxsQ?bdwy?C", lpString2="?" | out: lpString1="???y?Yil???QC??u??Y???HI?u??v?gLz?N?X?Lj??U?w??GxsQ?bdwy?C?") returned="???y?Yil???QC??u??Y???HI?u??v?gLz?N?X?Lj??U?w??GxsQ?bdwy?C?" [0098.441] lstrcatA (in: lpString1="???y?Yil???QC??u??Y???HI?u??v?gLz?N?X?Lj??U?w??GxsQ?bdwy?C?", lpString2="?" | out: lpString1="???y?Yil???QC??u??Y???HI?u??v?gLz?N?X?Lj??U?w??GxsQ?bdwy?C??") returned="???y?Yil???QC??u??Y???HI?u??v?gLz?N?X?Lj??U?w??GxsQ?bdwy?C??" [0098.441] lstrcatA (in: lpString1="???y?Yil???QC??u??Y???HI?u??v?gLz?N?X?Lj??U?w??GxsQ?bdwy?C??", lpString2="H" | out: lpString1="???y?Yil???QC??u??Y???HI?u??v?gLz?N?X?Lj??U?w??GxsQ?bdwy?C??H") returned="???y?Yil???QC??u??Y???HI?u??v?gLz?N?X?Lj??U?w??GxsQ?bdwy?C??H" [0098.441] lstrcatA (in: lpString1="???y?Yil???QC??u??Y???HI?u??v?gLz?N?X?Lj??U?w??GxsQ?bdwy?C??H", lpString2="b" | out: lpString1="???y?Yil???QC??u??Y???HI?u??v?gLz?N?X?Lj??U?w??GxsQ?bdwy?C??Hb") returned="???y?Yil???QC??u??Y???HI?u??v?gLz?N?X?Lj??U?w??GxsQ?bdwy?C??Hb" [0098.441] lstrcatA (in: lpString1="???y?Yil???QC??u??Y???HI?u??v?gLz?N?X?Lj??U?w??GxsQ?bdwy?C??Hb", lpString2="?" | out: lpString1="???y?Yil???QC??u??Y???HI?u??v?gLz?N?X?Lj??U?w??GxsQ?bdwy?C??Hb?") returned="???y?Yil???QC??u??Y???HI?u??v?gLz?N?X?Lj??U?w??GxsQ?bdwy?C??Hb?" [0098.441] lstrcatA (in: lpString1="???y?Yil???QC??u??Y???HI?u??v?gLz?N?X?Lj??U?w??GxsQ?bdwy?C??Hb?", lpString2="?" | out: lpString1="???y?Yil???QC??u??Y???HI?u??v?gLz?N?X?Lj??U?w??GxsQ?bdwy?C??Hb??") returned="???y?Yil???QC??u??Y???HI?u??v?gLz?N?X?Lj??U?w??GxsQ?bdwy?C??Hb??" [0098.441] lstrcatA (in: lpString1="???y?Yil???QC??u??Y???HI?u??v?gLz?N?X?Lj??U?w??GxsQ?bdwy?C??Hb??", lpString2="?" | out: lpString1="???y?Yil???QC??u??Y???HI?u??v?gLz?N?X?Lj??U?w??GxsQ?bdwy?C??Hb???") returned="???y?Yil???QC??u??Y???HI?u??v?gLz?N?X?Lj??U?w??GxsQ?bdwy?C??Hb???" [0098.441] lstrcatA (in: lpString1="???y?Yil???QC??u??Y???HI?u??v?gLz?N?X?Lj??U?w??GxsQ?bdwy?C??Hb???", lpString2="E" | out: lpString1="???y?Yil???QC??u??Y???HI?u??v?gLz?N?X?Lj??U?w??GxsQ?bdwy?C??Hb???E") returned="???y?Yil???QC??u??Y???HI?u??v?gLz?N?X?Lj??U?w??GxsQ?bdwy?C??Hb???E" [0098.441] lstrcatA (in: lpString1="???y?Yil???QC??u??Y???HI?u??v?gLz?N?X?Lj??U?w??GxsQ?bdwy?C??Hb???E", lpString2="o" | out: lpString1="???y?Yil???QC??u??Y???HI?u??v?gLz?N?X?Lj??U?w??GxsQ?bdwy?C??Hb???Eo") returned="???y?Yil???QC??u??Y???HI?u??v?gLz?N?X?Lj??U?w??GxsQ?bdwy?C??Hb???Eo" [0098.441] lstrcatA (in: lpString1="???y?Yil???QC??u??Y???HI?u??v?gLz?N?X?Lj??U?w??GxsQ?bdwy?C??Hb???Eo", lpString2="?" | out: lpString1="???y?Yil???QC??u??Y???HI?u??v?gLz?N?X?Lj??U?w??GxsQ?bdwy?C??Hb???Eo?") returned="???y?Yil???QC??u??Y???HI?u??v?gLz?N?X?Lj??U?w??GxsQ?bdwy?C??Hb???Eo?" [0098.441] lstrcatA (in: lpString1="???y?Yil???QC??u??Y???HI?u??v?gLz?N?X?Lj??U?w??GxsQ?bdwy?C??Hb???Eo?", lpString2="W" | out: lpString1="???y?Yil???QC??u??Y???HI?u??v?gLz?N?X?Lj??U?w??GxsQ?bdwy?C??Hb???Eo?W") returned="???y?Yil???QC??u??Y???HI?u??v?gLz?N?X?Lj??U?w??GxsQ?bdwy?C??Hb???Eo?W" [0098.441] lstrcatA (in: lpString1="???y?Yil???QC??u??Y???HI?u??v?gLz?N?X?Lj??U?w??GxsQ?bdwy?C??Hb???Eo?W", lpString2="?" | out: lpString1="???y?Yil???QC??u??Y???HI?u??v?gLz?N?X?Lj??U?w??GxsQ?bdwy?C??Hb???Eo?W?") returned="???y?Yil???QC??u??Y???HI?u??v?gLz?N?X?Lj??U?w??GxsQ?bdwy?C??Hb???Eo?W?" [0098.441] lstrcatA (in: lpString1="???y?Yil???QC??u??Y???HI?u??v?gLz?N?X?Lj??U?w??GxsQ?bdwy?C??Hb???Eo?W?", lpString2="?" | out: lpString1="???y?Yil???QC??u??Y???HI?u??v?gLz?N?X?Lj??U?w??GxsQ?bdwy?C??Hb???Eo?W??") returned="???y?Yil???QC??u??Y???HI?u??v?gLz?N?X?Lj??U?w??GxsQ?bdwy?C??Hb???Eo?W??" [0098.441] lstrcatA (in: lpString1="???y?Yil???QC??u??Y???HI?u??v?gLz?N?X?Lj??U?w??GxsQ?bdwy?C??Hb???Eo?W??", lpString2="?" | out: lpString1="???y?Yil???QC??u??Y???HI?u??v?gLz?N?X?Lj??U?w??GxsQ?bdwy?C??Hb???Eo?W???") returned="???y?Yil???QC??u??Y???HI?u??v?gLz?N?X?Lj??U?w??GxsQ?bdwy?C??Hb???Eo?W???" [0098.441] lstrcatA (in: lpString1="???y?Yil???QC??u??Y???HI?u??v?gLz?N?X?Lj??U?w??GxsQ?bdwy?C??Hb???Eo?W???", lpString2="V" | out: lpString1="???y?Yil???QC??u??Y???HI?u??v?gLz?N?X?Lj??U?w??GxsQ?bdwy?C??Hb???Eo?W???V") returned="???y?Yil???QC??u??Y???HI?u??v?gLz?N?X?Lj??U?w??GxsQ?bdwy?C??Hb???Eo?W???V" [0098.441] lstrcatA (in: lpString1="???y?Yil???QC??u??Y???HI?u??v?gLz?N?X?Lj??U?w??GxsQ?bdwy?C??Hb???Eo?W???V", lpString2="h" | out: lpString1="???y?Yil???QC??u??Y???HI?u??v?gLz?N?X?Lj??U?w??GxsQ?bdwy?C??Hb???Eo?W???Vh") returned="???y?Yil???QC??u??Y???HI?u??v?gLz?N?X?Lj??U?w??GxsQ?bdwy?C??Hb???Eo?W???Vh" [0098.441] lstrcatA (in: lpString1="???y?Yil???QC??u??Y???HI?u??v?gLz?N?X?Lj??U?w??GxsQ?bdwy?C??Hb???Eo?W???Vh", lpString2="T" | out: lpString1="???y?Yil???QC??u??Y???HI?u??v?gLz?N?X?Lj??U?w??GxsQ?bdwy?C??Hb???Eo?W???VhT") returned="???y?Yil???QC??u??Y???HI?u??v?gLz?N?X?Lj??U?w??GxsQ?bdwy?C??Hb???Eo?W???VhT" [0098.442] lstrcatA (in: lpString1="???y?Yil???QC??u??Y???HI?u??v?gLz?N?X?Lj??U?w??GxsQ?bdwy?C??Hb???Eo?W???VhT", lpString2="?" | out: lpString1="???y?Yil???QC??u??Y???HI?u??v?gLz?N?X?Lj??U?w??GxsQ?bdwy?C??Hb???Eo?W???VhT?") returned="???y?Yil???QC??u??Y???HI?u??v?gLz?N?X?Lj??U?w??GxsQ?bdwy?C??Hb???Eo?W???VhT?" [0098.442] lstrcatA (in: lpString1="???y?Yil???QC??u??Y???HI?u??v?gLz?N?X?Lj??U?w??GxsQ?bdwy?C??Hb???Eo?W???VhT?", lpString2="?" | out: lpString1="???y?Yil???QC??u??Y???HI?u??v?gLz?N?X?Lj??U?w??GxsQ?bdwy?C??Hb???Eo?W???VhT??") returned="???y?Yil???QC??u??Y???HI?u??v?gLz?N?X?Lj??U?w??GxsQ?bdwy?C??Hb???Eo?W???VhT??" [0098.442] lstrcatA (in: lpString1="???y?Yil???QC??u??Y???HI?u??v?gLz?N?X?Lj??U?w??GxsQ?bdwy?C??Hb???Eo?W???VhT??", lpString2="?" | out: lpString1="???y?Yil???QC??u??Y???HI?u??v?gLz?N?X?Lj??U?w??GxsQ?bdwy?C??Hb???Eo?W???VhT???") returned="???y?Yil???QC??u??Y???HI?u??v?gLz?N?X?Lj??U?w??GxsQ?bdwy?C??Hb???Eo?W???VhT???" [0098.442] lstrcatA (in: lpString1="???y?Yil???QC??u??Y???HI?u??v?gLz?N?X?Lj??U?w??GxsQ?bdwy?C??Hb???Eo?W???VhT???", lpString2="I" | out: lpString1="???y?Yil???QC??u??Y???HI?u??v?gLz?N?X?Lj??U?w??GxsQ?bdwy?C??Hb???Eo?W???VhT???I") returned="???y?Yil???QC??u??Y???HI?u??v?gLz?N?X?Lj??U?w??GxsQ?bdwy?C??Hb???Eo?W???VhT???I" [0098.442] lstrcatA (in: lpString1="???y?Yil???QC??u??Y???HI?u??v?gLz?N?X?Lj??U?w??GxsQ?bdwy?C??Hb???Eo?W???VhT???I", lpString2="?" | out: lpString1="???y?Yil???QC??u??Y???HI?u??v?gLz?N?X?Lj??U?w??GxsQ?bdwy?C??Hb???Eo?W???VhT???I?") returned="???y?Yil???QC??u??Y???HI?u??v?gLz?N?X?Lj??U?w??GxsQ?bdwy?C??Hb???Eo?W???VhT???I?" [0098.442] lstrcatA (in: lpString1="???y?Yil???QC??u??Y???HI?u??v?gLz?N?X?Lj??U?w??GxsQ?bdwy?C??Hb???Eo?W???VhT???I?", lpString2="d" | out: lpString1="???y?Yil???QC??u??Y???HI?u??v?gLz?N?X?Lj??U?w??GxsQ?bdwy?C??Hb???Eo?W???VhT???I?d") returned="???y?Yil???QC??u??Y???HI?u??v?gLz?N?X?Lj??U?w??GxsQ?bdwy?C??Hb???Eo?W???VhT???I?d" [0098.442] lstrcatA (in: lpString1="???y?Yil???QC??u??Y???HI?u??v?gLz?N?X?Lj??U?w??GxsQ?bdwy?C??Hb???Eo?W???VhT???I?d", lpString2="?" | out: lpString1="???y?Yil???QC??u??Y???HI?u??v?gLz?N?X?Lj??U?w??GxsQ?bdwy?C??Hb???Eo?W???VhT???I?d?") returned="???y?Yil???QC??u??Y???HI?u??v?gLz?N?X?Lj??U?w??GxsQ?bdwy?C??Hb???Eo?W???VhT???I?d?" [0098.442] lstrcatA (in: lpString1="???y?Yil???QC??u??Y???HI?u??v?gLz?N?X?Lj??U?w??GxsQ?bdwy?C??Hb???Eo?W???VhT???I?d?", lpString2="?" | out: lpString1="???y?Yil???QC??u??Y???HI?u??v?gLz?N?X?Lj??U?w??GxsQ?bdwy?C??Hb???Eo?W???VhT???I?d??") returned="???y?Yil???QC??u??Y???HI?u??v?gLz?N?X?Lj??U?w??GxsQ?bdwy?C??Hb???Eo?W???VhT???I?d??" [0098.442] lstrlenA (lpString="???y?Yil???QC??u??Y???HI?u??v?gLz?N?X?Lj??U?w??GxsQ?bdwy?C??Hb???Eo?W???VhT???I?d??") returned 83 [0098.442] lstrcpynA (in: lpString1=0x499080, lpString2="???y?Yil???QC??u??Y???HI?u??v?gLz?N?X?Lj??U?w??GxsQ?bdwy?C??Hb???Eo?W???VhT???I?d??", iMaxLength=8 | out: lpString1="???y?Yi") returned="???y?Yi" [0098.442] lstrlenA (lpString="???y?Yi") returned 7 [0098.442] lstrcatA (in: lpString1="", lpString2="i" | out: lpString1="i") returned="i" [0098.442] lstrcatA (in: lpString1="i", lpString2="?" | out: lpString1="i?") returned="i?" [0098.442] lstrcatA (in: lpString1="i?", lpString2="X" | out: lpString1="i?X") returned="i?X" [0098.442] lstrcatA (in: lpString1="i?X", lpString2="B" | out: lpString1="i?XB") returned="i?XB" [0098.442] lstrcatA (in: lpString1="i?XB", lpString2="?" | out: lpString1="i?XB?") returned="i?XB?" [0098.442] lstrcatA (in: lpString1="i?XB?", lpString2="T" | out: lpString1="i?XB?T") returned="i?XB?T" [0098.442] lstrcatA (in: lpString1="i?XB?T", lpString2="?" | out: lpString1="i?XB?T?") returned="i?XB?T?" [0098.442] lstrcatA (in: lpString1="i?XB?T?", lpString2="?" | out: lpString1="i?XB?T??") returned="i?XB?T??" [0098.442] lstrcatA (in: lpString1="i?XB?T??", lpString2="B" | out: lpString1="i?XB?T??B") returned="i?XB?T??B" [0098.442] lstrcatA (in: lpString1="i?XB?T??B", lpString2="w" | out: lpString1="i?XB?T??Bw") returned="i?XB?T??Bw" [0098.442] lstrcatA (in: lpString1="i?XB?T??Bw", lpString2="?" | out: lpString1="i?XB?T??Bw?") returned="i?XB?T??Bw?" [0098.442] lstrcatA (in: lpString1="i?XB?T??Bw?", lpString2="O" | out: lpString1="i?XB?T??Bw?O") returned="i?XB?T??Bw?O" [0098.442] lstrcatA (in: lpString1="i?XB?T??Bw?O", lpString2="?" | out: lpString1="i?XB?T??Bw?O?") returned="i?XB?T??Bw?O?" [0098.442] lstrcatA (in: lpString1="i?XB?T??Bw?O?", lpString2="?" | out: lpString1="i?XB?T??Bw?O??") returned="i?XB?T??Bw?O??" [0098.442] lstrcatA (in: lpString1="i?XB?T??Bw?O??", lpString2="A" | out: lpString1="i?XB?T??Bw?O??A") returned="i?XB?T??Bw?O??A" [0098.442] lstrcatA (in: lpString1="i?XB?T??Bw?O??A", lpString2="g" | out: lpString1="i?XB?T??Bw?O??Ag") returned="i?XB?T??Bw?O??Ag" [0098.442] lstrcatA (in: lpString1="i?XB?T??Bw?O??Ag", lpString2="V" | out: lpString1="i?XB?T??Bw?O??AgV") returned="i?XB?T??Bw?O??AgV" [0098.442] lstrcatA (in: lpString1="i?XB?T??Bw?O??AgV", lpString2="M" | out: lpString1="i?XB?T??Bw?O??AgVM") returned="i?XB?T??Bw?O??AgVM" [0098.442] lstrlenA (lpString="i?XB?T??Bw?O??AgVM") returned 18 [0098.442] lstrcpynA (in: lpString1=0x4990c0, lpString2="i?XB?T??Bw?O??AgVM", iMaxLength=11 | out: lpString1="i?XB?T??Bw") returned="i?XB?T??Bw" [0098.443] lstrlenA (lpString="i?XB?T??Bw") returned 10 [0098.443] lstrcatA (in: lpString1="", lpString2="k" | out: lpString1="k") returned="k" [0098.443] lstrcatA (in: lpString1="k", lpString2="?" | out: lpString1="k?") returned="k?" [0098.443] lstrcatA (in: lpString1="k?", lpString2="?" | out: lpString1="k??") returned="k??" [0098.443] lstrcatA (in: lpString1="k??", lpString2="h" | out: lpString1="k??h") returned="k??h" [0098.443] lstrcatA (in: lpString1="k??h", lpString2="?" | out: lpString1="k??h?") returned="k??h?" [0098.443] lstrcatA (in: lpString1="k??h?", lpString2="?" | out: lpString1="k??h??") returned="k??h??" [0098.443] lstrcatA (in: lpString1="k??h??", lpString2="?" | out: lpString1="k??h???") returned="k??h???" [0098.443] lstrcatA (in: lpString1="k??h???", lpString2="?" | out: lpString1="k??h????") returned="k??h????" [0098.443] lstrcatA (in: lpString1="k??h????", lpString2="?" | out: lpString1="k??h?????") returned="k??h?????" [0098.443] lstrcatA (in: lpString1="k??h?????", lpString2="k" | out: lpString1="k??h?????k") returned="k??h?????k" [0098.443] lstrcatA (in: lpString1="k??h?????k", lpString2="?" | out: lpString1="k??h?????k?") returned="k??h?????k?" [0098.443] lstrcatA (in: lpString1="k??h?????k?", lpString2="o" | out: lpString1="k??h?????k?o") returned="k??h?????k?o" [0098.443] lstrcatA (in: lpString1="k??h?????k?o", lpString2="w" | out: lpString1="k??h?????k?ow") returned="k??h?????k?ow" [0098.443] lstrcatA (in: lpString1="k??h?????k?ow", lpString2="?" | out: lpString1="k??h?????k?ow?") returned="k??h?????k?ow?" [0098.443] lstrcatA (in: lpString1="k??h?????k?ow?", lpString2="?" | out: lpString1="k??h?????k?ow??") returned="k??h?????k?ow??" [0098.443] lstrcatA (in: lpString1="k??h?????k?ow??", lpString2="F" | out: lpString1="k??h?????k?ow??F") returned="k??h?????k?ow??F" [0098.443] lstrcatA (in: lpString1="k??h?????k?ow??F", lpString2="?" | out: lpString1="k??h?????k?ow??F?") returned="k??h?????k?ow??F?" [0098.443] lstrcatA (in: lpString1="k??h?????k?ow??F?", lpString2="J" | out: lpString1="k??h?????k?ow??F?J") returned="k??h?????k?ow??F?J" [0098.443] lstrcatA (in: lpString1="k??h?????k?ow??F?J", lpString2="?" | out: lpString1="k??h?????k?ow??F?J?") returned="k??h?????k?ow??F?J?" [0098.443] lstrcatA (in: lpString1="k??h?????k?ow??F?J?", lpString2="G" | out: lpString1="k??h?????k?ow??F?J?G") returned="k??h?????k?ow??F?J?G" [0098.443] lstrcatA (in: lpString1="k??h?????k?ow??F?J?G", lpString2="?" | out: lpString1="k??h?????k?ow??F?J?G?") returned="k??h?????k?ow??F?J?G?" [0098.443] lstrcatA (in: lpString1="k??h?????k?ow??F?J?G?", lpString2="?" | out: lpString1="k??h?????k?ow??F?J?G??") returned="k??h?????k?ow??F?J?G??" [0098.443] lstrcatA (in: lpString1="k??h?????k?ow??F?J?G??", lpString2="s" | out: lpString1="k??h?????k?ow??F?J?G??s") returned="k??h?????k?ow??F?J?G??s" [0098.443] lstrcatA (in: lpString1="k??h?????k?ow??F?J?G??s", lpString2="P" | out: lpString1="k??h?????k?ow??F?J?G??sP") returned="k??h?????k?ow??F?J?G??sP" [0098.443] lstrcatA (in: lpString1="k??h?????k?ow??F?J?G??sP", lpString2="?" | out: lpString1="k??h?????k?ow??F?J?G??sP?") returned="k??h?????k?ow??F?J?G??sP?" [0098.443] lstrcatA (in: lpString1="k??h?????k?ow??F?J?G??sP?", lpString2="?" | out: lpString1="k??h?????k?ow??F?J?G??sP??") returned="k??h?????k?ow??F?J?G??sP??" [0098.443] lstrcatA (in: lpString1="k??h?????k?ow??F?J?G??sP??", lpString2="?" | out: lpString1="k??h?????k?ow??F?J?G??sP???") returned="k??h?????k?ow??F?J?G??sP???" [0098.443] lstrcatA (in: lpString1="k??h?????k?ow??F?J?G??sP???", lpString2="M" | out: lpString1="k??h?????k?ow??F?J?G??sP???M") returned="k??h?????k?ow??F?J?G??sP???M" [0098.443] lstrcatA (in: lpString1="k??h?????k?ow??F?J?G??sP???M", lpString2="O" | out: lpString1="k??h?????k?ow??F?J?G??sP???MO") returned="k??h?????k?ow??F?J?G??sP???MO" [0098.444] lstrcatA (in: lpString1="k??h?????k?ow??F?J?G??sP???MO", lpString2="?" | out: lpString1="k??h?????k?ow??F?J?G??sP???MO?") returned="k??h?????k?ow??F?J?G??sP???MO?" [0098.444] lstrcatA (in: lpString1="k??h?????k?ow??F?J?G??sP???MO?", lpString2="i" | out: lpString1="k??h?????k?ow??F?J?G??sP???MO?i") returned="k??h?????k?ow??F?J?G??sP???MO?i" [0098.444] lstrcatA (in: lpString1="k??h?????k?ow??F?J?G??sP???MO?i", lpString2="T" | out: lpString1="k??h?????k?ow??F?J?G??sP???MO?iT") returned="k??h?????k?ow??F?J?G??sP???MO?iT" [0098.444] lstrcatA (in: lpString1="k??h?????k?ow??F?J?G??sP???MO?iT", lpString2="f" | out: lpString1="k??h?????k?ow??F?J?G??sP???MO?iTf") returned="k??h?????k?ow??F?J?G??sP???MO?iTf" [0098.444] lstrcatA (in: lpString1="k??h?????k?ow??F?J?G??sP???MO?iTf", lpString2="m" | out: lpString1="k??h?????k?ow??F?J?G??sP???MO?iTfm") returned="k??h?????k?ow??F?J?G??sP???MO?iTfm" [0098.444] lstrcatA (in: lpString1="k??h?????k?ow??F?J?G??sP???MO?iTfm", lpString2="?" | out: lpString1="k??h?????k?ow??F?J?G??sP???MO?iTfm?") returned="k??h?????k?ow??F?J?G??sP???MO?iTfm?" [0098.444] lstrcatA (in: lpString1="k??h?????k?ow??F?J?G??sP???MO?iTfm?", lpString2="?" | out: lpString1="k??h?????k?ow??F?J?G??sP???MO?iTfm??") returned="k??h?????k?ow??F?J?G??sP???MO?iTfm??" [0098.444] lstrcatA (in: lpString1="k??h?????k?ow??F?J?G??sP???MO?iTfm??", lpString2="?" | out: lpString1="k??h?????k?ow??F?J?G??sP???MO?iTfm???") returned="k??h?????k?ow??F?J?G??sP???MO?iTfm???" [0098.444] lstrcatA (in: lpString1="k??h?????k?ow??F?J?G??sP???MO?iTfm???", lpString2="?" | out: lpString1="k??h?????k?ow??F?J?G??sP???MO?iTfm????") returned="k??h?????k?ow??F?J?G??sP???MO?iTfm????" [0098.444] lstrcatA (in: lpString1="k??h?????k?ow??F?J?G??sP???MO?iTfm????", lpString2="?" | out: lpString1="k??h?????k?ow??F?J?G??sP???MO?iTfm?????") returned="k??h?????k?ow??F?J?G??sP???MO?iTfm?????" [0098.444] lstrcatA (in: lpString1="k??h?????k?ow??F?J?G??sP???MO?iTfm?????", lpString2="l" | out: lpString1="k??h?????k?ow??F?J?G??sP???MO?iTfm?????l") returned="k??h?????k?ow??F?J?G??sP???MO?iTfm?????l" [0098.444] lstrcatA (in: lpString1="k??h?????k?ow??F?J?G??sP???MO?iTfm?????l", lpString2="?" | out: lpString1="k??h?????k?ow??F?J?G??sP???MO?iTfm?????l?") returned="k??h?????k?ow??F?J?G??sP???MO?iTfm?????l?" [0098.444] lstrcatA (in: lpString1="k??h?????k?ow??F?J?G??sP???MO?iTfm?????l?", lpString2="?" | out: lpString1="k??h?????k?ow??F?J?G??sP???MO?iTfm?????l??") returned="k??h?????k?ow??F?J?G??sP???MO?iTfm?????l??" [0098.444] lstrcatA (in: lpString1="k??h?????k?ow??F?J?G??sP???MO?iTfm?????l??", lpString2="h" | out: lpString1="k??h?????k?ow??F?J?G??sP???MO?iTfm?????l??h") returned="k??h?????k?ow??F?J?G??sP???MO?iTfm?????l??h" [0098.444] lstrcatA (in: lpString1="k??h?????k?ow??F?J?G??sP???MO?iTfm?????l??h", lpString2="S" | out: lpString1="k??h?????k?ow??F?J?G??sP???MO?iTfm?????l??hS") returned="k??h?????k?ow??F?J?G??sP???MO?iTfm?????l??hS" [0098.444] lstrcatA (in: lpString1="k??h?????k?ow??F?J?G??sP???MO?iTfm?????l??hS", lpString2="P" | out: lpString1="k??h?????k?ow??F?J?G??sP???MO?iTfm?????l??hSP") returned="k??h?????k?ow??F?J?G??sP???MO?iTfm?????l??hSP" [0098.444] lstrcatA (in: lpString1="k??h?????k?ow??F?J?G??sP???MO?iTfm?????l??hSP", lpString2="?" | out: lpString1="k??h?????k?ow??F?J?G??sP???MO?iTfm?????l??hSP?") returned="k??h?????k?ow??F?J?G??sP???MO?iTfm?????l??hSP?" [0098.444] lstrcatA (in: lpString1="k??h?????k?ow??F?J?G??sP???MO?iTfm?????l??hSP?", lpString2="?" | out: lpString1="k??h?????k?ow??F?J?G??sP???MO?iTfm?????l??hSP??") returned="k??h?????k?ow??F?J?G??sP???MO?iTfm?????l??hSP??" [0098.444] lstrcatA (in: lpString1="k??h?????k?ow??F?J?G??sP???MO?iTfm?????l??hSP??", lpString2="M" | out: lpString1="k??h?????k?ow??F?J?G??sP???MO?iTfm?????l??hSP??M") returned="k??h?????k?ow??F?J?G??sP???MO?iTfm?????l??hSP??M" [0098.444] lstrcatA (in: lpString1="k??h?????k?ow??F?J?G??sP???MO?iTfm?????l??hSP??M", lpString2="I" | out: lpString1="k??h?????k?ow??F?J?G??sP???MO?iTfm?????l??hSP??MI") returned="k??h?????k?ow??F?J?G??sP???MO?iTfm?????l??hSP??MI" [0098.444] lstrcatA (in: lpString1="k??h?????k?ow??F?J?G??sP???MO?iTfm?????l??hSP??MI", lpString2="p" | out: lpString1="k??h?????k?ow??F?J?G??sP???MO?iTfm?????l??hSP??MIp") returned="k??h?????k?ow??F?J?G??sP???MO?iTfm?????l??hSP??MIp" [0098.444] lstrcatA (in: lpString1="k??h?????k?ow??F?J?G??sP???MO?iTfm?????l??hSP??MIp", lpString2="?" | out: lpString1="k??h?????k?ow??F?J?G??sP???MO?iTfm?????l??hSP??MIp?") returned="k??h?????k?ow??F?J?G??sP???MO?iTfm?????l??hSP??MIp?" [0098.444] lstrcatA (in: lpString1="k??h?????k?ow??F?J?G??sP???MO?iTfm?????l??hSP??MIp?", lpString2="R" | out: lpString1="k??h?????k?ow??F?J?G??sP???MO?iTfm?????l??hSP??MIp?R") returned="k??h?????k?ow??F?J?G??sP???MO?iTfm?????l??hSP??MIp?R" [0098.444] lstrcatA (in: lpString1="k??h?????k?ow??F?J?G??sP???MO?iTfm?????l??hSP??MIp?R", lpString2="?" | out: lpString1="k??h?????k?ow??F?J?G??sP???MO?iTfm?????l??hSP??MIp?R?") returned="k??h?????k?ow??F?J?G??sP???MO?iTfm?????l??hSP??MIp?R?" [0098.444] lstrcatA (in: lpString1="k??h?????k?ow??F?J?G??sP???MO?iTfm?????l??hSP??MIp?R?", lpString2="?" | out: lpString1="k??h?????k?ow??F?J?G??sP???MO?iTfm?????l??hSP??MIp?R??") returned="k??h?????k?ow??F?J?G??sP???MO?iTfm?????l??hSP??MIp?R??" [0098.444] lstrcatA (in: lpString1="k??h?????k?ow??F?J?G??sP???MO?iTfm?????l??hSP??MIp?R??", lpString2="w" | out: lpString1="k??h?????k?ow??F?J?G??sP???MO?iTfm?????l??hSP??MIp?R??w") returned="k??h?????k?ow??F?J?G??sP???MO?iTfm?????l??hSP??MIp?R??w" [0098.444] lstrcatA (in: lpString1="k??h?????k?ow??F?J?G??sP???MO?iTfm?????l??hSP??MIp?R??w", lpString2="P" | out: lpString1="k??h?????k?ow??F?J?G??sP???MO?iTfm?????l??hSP??MIp?R??wP") returned="k??h?????k?ow??F?J?G??sP???MO?iTfm?????l??hSP??MIp?R??wP" [0098.444] lstrlenA (lpString="k??h?????k?ow??F?J?G??sP???MO?iTfm?????l??hSP??MIp?R??wPX??g?HnQs???T?????J?????iJzm") returned 84 [0098.444] lstrcpynA (in: lpString1=0x49907c, lpString2="k??h?????k?ow??F?J?G??sP???MO?iTfm?????l??hSP??MIp?R??wPX??g?HnQs???T?????J?????iJzm", iMaxLength=73 | out: lpString1="k??h?????k?ow??F?J?G??sP???MO?iTfm?????l??hSP??MIp?R??wPX??g?HnQs???T???") returned="k??h?????k?ow??F?J?G??sP???MO?iTfm?????l??hSP??MIp?R??wPX??g?HnQs???T???" [0098.445] lstrlenA (lpString="k??h?????k?ow??F?J?G??sP???MO?iTfm?????l??hSP??MIp?R??wPX??g?HnQs???T???") returned 72 [0098.445] lstrlenA (lpString="nS??T?L???W???cHb???Kf????iCv?HIe???Vf") returned 38 [0098.445] lstrcpynA (in: lpString1=0x4990ac, lpString2="nS??T?L???W???cHb???Kf????iCv?HIe???Vf", iMaxLength=20 | out: lpString1="nS??T?L???W???cHb??") returned="nS??T?L???W???cHb??" [0098.445] lstrlenA (lpString="nS??T?L???W???cHb??") returned 19 [0098.445] lstrlenA (lpString="c??NoVc?e?I?ed??s????????coR?s?F????pR??WL???Y??v?rp?nY?Y???G???B??Kx???") returned 72 [0098.445] lstrcpynA (in: lpString1=0x499088, lpString2="c??NoVc?e?I?ed??s????????coR?s?F????pR??WL???Y??v?rp?nY?Y???G???B??Kx???", iMaxLength=52 | out: lpString1="c??NoVc?e?I?ed??s????????coR?s?F????pR??WL???Y??v?r") returned="c??NoVc?e?I?ed??s????????coR?s?F????pR??WL???Y??v?r" [0098.445] lstrlenA (lpString="c??NoVc?e?I?ed??s????????coR?s?F????pR??WL???Y??v?r") returned 51 [0098.445] lstrlenA (lpString="?p?U??oB") returned 8 [0098.445] lstrcpynA (in: lpString1=0x4990c4, lpString2="?p?U??oB", iMaxLength=1 | out: lpString1="") returned="" [0098.445] lstrlenA (lpString="") returned 0 [0098.445] lstrlenA (lpString="Z???J?PP?iiiFvSb?cH??b?v??T????tDF???G???M??r??MT???t?lv?A???") returned 61 [0098.445] lstrcpynA (in: lpString1=0x499094, lpString2="Z???J?PP?iiiFvSb?cH??b?v??T????tDF???G???M??r??MT???t?lv?A???", iMaxLength=32 | out: lpString1="Z???J?PP?iiiFvSb?cH??b?v??T????") returned="Z???J?PP?iiiFvSb?cH??b?v??T????" [0098.445] lstrlenA (lpString="Z???J?PP?iiiFvSb?cH??b?v??T????") returned 31 [0098.445] lstrlenA (lpString="r??n??H??Kr?wx??????") returned 20 [0098.445] lstrcpynA (in: lpString1=0x4990bc, lpString2="r??n??H??Kr?wx??????", iMaxLength=19 | out: lpString1="r??n??H??Kr?wx????") returned="r??n??H??Kr?wx????" [0098.445] lstrlenA (lpString="r??n??H??Kr?wx????") returned 18 [0098.445] lstrlenA (lpString="??v??U????wz?W?zZv?") returned 19 [0098.445] lstrcpynA (in: lpString1=0x4990c0, lpString2="??v??U????wz?W?zZv?", iMaxLength=7 | out: lpString1="??v??U") returned="??v??U" [0098.445] lstrlenA (lpString="??v??U") returned 6 [0098.445] lstrlenA (lpString="jfa?e?HWrh?V????mLrh?x?????D??TiWfuZ????lT?tj????QG?fNY??Kvg?r????v???D?X??Yv?") returned 78 [0098.445] lstrcpynA (in: lpString1=0x499084, lpString2="jfa?e?HWrh?V????mLrh?x?????D??TiWfuZ????lT?tj????QG?fNY??Kvg?r????v???D?X??Yv?", iMaxLength=46 | out: lpString1="jfa?e?HWrh?V????mLrh?x?????D??TiWfuZ????lT?tj") returned="jfa?e?HWrh?V????mLrh?x?????D??TiWfuZ????lT?tj" [0098.445] lstrlenA (lpString="jfa?e?HWrh?V????mLrh?x?????D??TiWfuZ????lT?tj") returned 45 [0098.445] lstrlenA (lpString="??fI???a?UA??h?CzK?W") returned 20 [0098.445] lstrcpynA (in: lpString1=0x4990bc, lpString2="??fI???a?UA??h?CzK?W", iMaxLength=4 | out: lpString1="??f") returned="??f" [0098.445] lstrlenA (lpString="??f") returned 3 [0098.445] lstrlenA (lpString="???w???VsVW????Z?Z?uC?????Zml?r????AH?P??????????EM???Qyg?????") returned 62 [0098.445] lstrcpynA (in: lpString1=0x499094, lpString2="???w???VsVW????Z?Z?uC?????Zml?r????AH?P??????????EM???Qyg?????", iMaxLength=16 | out: lpString1="???w???VsVW????") returned="???w???VsVW????" [0098.446] lstrlenA (lpString="???w???VsVW????") returned 15 [0098.446] lstrlenA (lpString="Q???y?s???????????HEU?T?v?APO???kC???ib???I?Uj??l") returned 49 [0098.446] lstrcpynA (in: lpString1=0x4990a0, lpString2="Q???y?s???????????HEU?T?v?APO???kC???ib???I?Uj??l", iMaxLength=38 | out: lpString1="Q???y?s???????????HEU?T?v?APO???kC???") returned="Q???y?s???????????HEU?T?v?APO???kC???" [0098.446] lstrlenA (lpString="Q???y?s???????????HEU?T?v?APO???kC???") returned 37 [0098.446] lstrlenA (lpString="lmZ?nAI??B??I????f???????CijAl?eP??vPW?????D???OijT?P?a???c?TlD??????L???????b??V?pc?????L??u") returned 93 [0098.446] lstrcpynA (in: lpString1=0x499074, lpString2="lmZ?nAI??B??I????f???????CijAl?eP??vPW?????D???OijT?P?a???c?TlD??????L???????b??V?pc?????L??u", iMaxLength=64 | out: lpString1="lmZ?nAI??B??I????f???????CijAl?eP??vPW?????D???OijT?P?a???c?TlD") returned="lmZ?nAI??B??I????f???????CijAl?eP??vPW?????D???OijT?P?a???c?TlD" [0098.446] lstrlenA (lpString="lmZ?nAI??B??I????f???????CijAl?eP??vPW?????D???OijT?P?a???c?TlD") returned 63 [0098.446] lstrlenA (lpString="YBrPT????iM?a????X?pl?p??Y??d??Ly?J??ZlAX?A?U?ZXw??O?") returned 53 [0098.446] lstrcpynA (in: lpString1=0x49909c, lpString2="YBrPT????iM?a????X?pl?p??Y??d??Ly?J??ZlAX?A?U?ZXw??O?", iMaxLength=36 | out: lpString1="YBrPT????iM?a????X?pl?p??Y??d??Ly?J") returned="YBrPT????iM?a????X?pl?p??Y??d??Ly?J" [0098.446] lstrlenA (lpString="YBrPT????iM?a????X?pl?p??Y??d??Ly?J") returned 35 [0098.446] lstrlenA (lpString="gC?????go????ifEc??MP?y?p??p?LHp?M") returned 34 [0098.446] lstrcpynA (in: lpString1=0x4990b0, lpString2="gC?????go????ifEc??MP?y?p??p?LHp?M", iMaxLength=26 | out: lpString1="gC?????go????ifEc??MP?y?p") returned="gC?????go????ifEc??MP?y?p" [0098.446] lstrlenA (lpString="gC?????go????ifEc??MP?y?p") returned 25 [0098.446] lstrlenA (lpString="?hF?mp??O?Mu?w?au?Kg??????B??UOha") returned 33 [0098.446] lstrcpynA (in: lpString1=0x4990b0, lpString2="?hF?mp??O?Mu?w?au?Kg??????B??UOha", iMaxLength=28 | out: lpString1="?hF?mp??O?Mu?w?au?Kg??????B") returned="?hF?mp??O?Mu?w?au?Kg??????B" [0098.446] lstrlenA (lpString="?hF?mp??O?Mu?w?au?Kg??????B") returned 27 [0098.446] lstrlenA (lpString="?N?gP?f???G") returned 11 [0098.446] lstrcpynA (in: lpString1=0x4990c4, lpString2="?N?gP?f???G", iMaxLength=3 | out: lpString1="?N") returned="?N" [0098.446] lstrlenA (lpString="?N") returned 2 [0098.446] lstrlenA (lpString="?uV?QMc??m?exS???V?CuX??F?U?g") returned 29 [0098.446] lstrcpynA (in: lpString1=0x4990b4, lpString2="?uV?QMc??m?exS???V?CuX??F?U?g", iMaxLength=3 | out: lpString1="?u") returned="?u" [0098.446] lstrlenA (lpString="?u") returned 2 [0098.446] lstrlenA (lpString="e?tMVn???D?P??A??N???WQu?GBxOV???jz????mA?lpsS???Y???Q??O??o??x??wSM???a???iak????nt??V?") returned 88 [0098.446] lstrcpynA (in: lpString1=0x499078, lpString2="e?tMVn???D?P??A??N???WQu?GBxOV???jz????mA?lpsS???Y???Q??O??o??x??wSM???a???iak????nt??V?", iMaxLength=22 | out: lpString1="e?tMVn???D?P??A??N???") returned="e?tMVn???D?P??A??N???" [0098.446] lstrlenA (lpString="e?tMVn???D?P??A??N???") returned 21 [0098.446] lstrlenA (lpString="?MN???SawDa??N?????krx?mOj????bZ??n?v?IB???T????b?eC?L???m??p??Mj???WR?p?USl?Q???h?i????????l?G") returned 95 [0098.447] lstrcpynA (in: lpString1=0x499074, lpString2="?MN???SawDa??N?????krx?mOj????bZ??n?v?IB???T????b?eC?L???m??p??Mj???WR?p?USl?Q???h?i????????l?G", iMaxLength=32 | out: lpString1="?MN???SawDa??N?????krx?mOj????b") returned="?MN???SawDa??N?????krx?mOj????b" [0098.447] lstrlenA (lpString="?MN???SawDa??N?????krx?mOj????b") returned 31 [0098.447] lstrlenA (lpString="?T?E????Bi?e?") returned 13 [0098.447] lstrcpynA (in: lpString1=0x4990c4, lpString2="?T?E????Bi?e?", iMaxLength=6 | out: lpString1="?T?E?") returned="?T?E?" [0098.447] lstrlenA (lpString="?T?E?") returned 5 [0098.447] lstrlenA (lpString="?M?G??y?????????d?Oo??Q??I?r???b?C??j??L??nge??peH????ikQIX?FrE?W?m????Sg??L?d?w??wjk???GJ??Zd") returned 94 [0098.447] lstrcpynA (in: lpString1=0x499074, lpString2="?M?G??y?????????d?Oo??Q??I?r???b?C??j??L??nge??peH????ikQIX?FrE?W?m????Sg??L?d?w??wjk???GJ??Zd", iMaxLength=4 | out: lpString1="?M?") returned="?M?" [0098.447] lstrlenA (lpString="?M?") returned 3 [0098.447] lstrlenA (lpString="?I???v?SM?V??g?X??rd?PnVvh") returned 26 [0098.447] lstrcpynA (in: lpString1=0x4990b8, lpString2="?I???v?SM?V??g?X??rd?PnVvh", iMaxLength=3 | out: lpString1="?I") returned="?I" [0098.447] lstrlenA (lpString="?I") returned 2 [0098.447] lstrlenA (lpString="??") returned 2 [0098.447] lstrcpynA (in: lpString1=0x4990c4, lpString2="??", iMaxLength=1 | out: lpString1="") returned="" [0098.447] lstrlenA (lpString="") returned 0 [0098.447] lstrlenA (lpString="U???A???Z???z?cx?c??pA??alZV???C") returned 32 [0098.447] lstrcpynA (in: lpString1=0x4990b0, lpString2="U???A???Z???z?cx?c??pA??alZV???C", iMaxLength=29 | out: lpString1="U???A???Z???z?cx?c??pA??alZV") returned="U???A???Z???z?cx?c??pA??alZV" [0098.447] lstrlenA (lpString="U???A???Z???z?cx?c??pA??alZV") returned 28 [0098.447] lstrlenA (lpString="?n???Nt?V?") returned 10 [0098.447] lstrcpynA (in: lpString1=0x4990c4, lpString2="?n???Nt?V?", iMaxLength=5 | out: lpString1="?n??") returned="?n??" [0098.447] lstrlenA (lpString="?n??") returned 4 [0098.447] lstrlenA (lpString="X???E?uC?z?a??pA???acFZ???ITo????za??Ojlu??????g?d??o??o?S????Gl?????V?") returned 71 [0098.447] lstrcpynA (in: lpString1=0x49908c, lpString2="X???E?uC?z?a??pA???acFZ???ITo????za??Ojlu??????g?d??o??o?S????Gl?????V?", iMaxLength=29 | out: lpString1="X???E?uC?z?a??pA???acFZ???IT") returned="X???E?uC?z?a??pA???acFZ???IT" [0098.447] lstrlenA (lpString="X???E?uC?z?a??pA???acFZ???IT") returned 28 [0098.447] lstrlenA (lpString="????") returned 4 [0098.447] lstrcpynA (in: lpString1=0x4990c4, lpString2="????", iMaxLength=1 | out: lpString1="") returned="" [0098.447] lstrlenA (lpString="") returned 0 [0098.447] lstrlenA (lpString="???Z??ehP???REAd?m?OtCXpG??b?L????ZL???f?IX?fT?H??C?F???Z?yd??J??p?T????????eM?s") returned 80 [0098.447] lstrcpynA (in: lpString1=0x499080, lpString2="???Z??ehP???REAd?m?OtCXpG??b?L????ZL???f?IX?fT?H??C?F???Z?yd??J??p?T????????eM?s", iMaxLength=74 | out: lpString1="???Z??ehP???REAd?m?OtCXpG??b?L????ZL???f?IX?fT?H??C?F???Z?yd??J??p?T?????") returned="???Z??ehP???REAd?m?OtCXpG??b?L????ZL???f?IX?fT?H??C?F???Z?yd??J??p?T?????" [0098.447] lstrlenA (lpString="???Z??ehP???REAd?m?OtCXpG??b?L????ZL???f?IX?fT?H??C?F???Z?yd??J??p?T?????") returned 73 [0098.448] lstrlenA (lpString="??j?Q?????X") returned 11 [0098.448] lstrcpynA (in: lpString1=0x4990c4, lpString2="??j?Q?????X", iMaxLength=10 | out: lpString1="??j?Q????") returned="??j?Q????" [0098.448] lstrlenA (lpString="??j?Q????") returned 9 [0098.448] lstrlenA (lpString="tP???x?D?Cr????cjcT???Ayt") returned 25 [0098.448] lstrcpynA (in: lpString1=0x4990b8, lpString2="tP???x?D?Cr????cjcT???Ayt", iMaxLength=23 | out: lpString1="tP???x?D?Cr????cjcT???") returned="tP???x?D?Cr????cjcT???" [0098.448] lstrlenA (lpString="tP???x?D?Cr????cjcT???") returned 22 [0098.448] lstrlenA (lpString="I???b??Xpr????RbIu??CY???Ms????MhLL?ne??x?ilS?E?i??????e?lw?????J?JbdS?UP???n?Jon??????Z?JYiw?g") returned 95 [0098.448] lstrcpynA (in: lpString1=0x499074, lpString2="I???b??Xpr????RbIu??CY???Ms????MhLL?ne??x?ilS?E?i??????e?lw?????J?JbdS?UP???n?Jon??????Z?JYiw?g", iMaxLength=37 | out: lpString1="I???b??Xpr????RbIu??CY???Ms????MhLL?") returned="I???b??Xpr????RbIu??CY???Ms????MhLL?" [0098.448] lstrlenA (lpString="I???b??Xpr????RbIu??CY???Ms????MhLL?") returned 36 [0098.448] lstrlenA (lpString="?dyH?????O??????b?E????K?i?YP?o?????xIb?Rl?d??UYoM????b?h????mAdWbigR?Z??M?ME??") returned 79 [0098.448] lstrcpynA (in: lpString1=0x499084, lpString2="?dyH?????O??????b?E????K?i?YP?o?????xIb?Rl?d??UYoM????b?h????mAdWbigR?Z??M?ME??", iMaxLength=16 | out: lpString1="?dyH?????O?????") returned="?dyH?????O?????" [0098.448] lstrlenA (lpString="?dyH?????O?????") returned 15 [0098.448] lstrlenA (lpString="???an???????y?????le") returned 20 [0098.448] lstrcpynA (in: lpString1=0x4990bc, lpString2="???an???????y?????le", iMaxLength=2 | out: lpString1="?") returned="?" [0098.448] lstrlenA (lpString="?") returned 1 [0098.448] lstrlenA (lpString="n???RvV?Ee?b?f???h?Ej????e????d????O???AT??rXLz???V?x???Pz?EV?U???PoW?????????bO?bi?Ej?j") returned 88 [0098.448] lstrcpynA (in: lpString1=0x499078, lpString2="n???RvV?Ee?b?f???h?Ej????e????d????O???AT??rXLz???V?x???Pz?EV?U???PoW?????????bO?bi?Ej?j", iMaxLength=78 | out: lpString1="n???RvV?Ee?b?f???h?Ej????e????d????O???AT??rXLz???V?x???Pz?EV?U???PoW????????") returned="n???RvV?Ee?b?f???h?Ej????e????d????O???AT??rXLz???V?x???Pz?EV?U???PoW????????" [0098.448] lstrlenA (lpString="n???RvV?Ee?b?f???h?Ej????e????d????O???AT??rXLz???V?x???Pz?EV?U???PoW????????") returned 77 [0098.448] lstrlenA (lpString="?H??Gpg?pdHav?N??E????Zm?JF?wxcr???v?Mc??Mm????M?yH?NU?I?????F???D?VcE?Gi?R?") returned 76 [0098.448] lstrcpynA (in: lpString1=0x499084, lpString2="?H??Gpg?pdHav?N??E????Zm?JF?wxcr???v?Mc??Mm????M?yH?NU?I?????F???D?VcE?Gi?R?", iMaxLength=38 | out: lpString1="?H??Gpg?pdHav?N??E????Zm?JF?wxcr???v?") returned="?H??Gpg?pdHav?N??E????Zm?JF?wxcr???v?" [0098.448] lstrlenA (lpString="?H??Gpg?pdHav?N??E????Zm?JF?wxcr???v?") returned 37 [0098.448] lstrlenA (lpString="??p????P?FW??bpj?P???SY?he??rI?SDnJ?Y?dX?n??w????g?b??mA?????hU????H") returned 68 [0098.448] lstrcpynA (in: lpString1=0x49908c, lpString2="??p????P?FW??bpj?P???SY?he??rI?SDnJ?Y?dX?n??w????g?b??mA?????hU????H", iMaxLength=57 | out: lpString1="??p????P?FW??bpj?P???SY?he??rI?SDnJ?Y?dX?n??w????g?b??mA") returned="??p????P?FW??bpj?P???SY?he??rI?SDnJ?Y?dX?n??w????g?b??mA" [0098.448] lstrlenA (lpString="??p????P?FW??bpj?P???SY?he??rI?SDnJ?Y?dX?n??w????g?b??mA") returned 56 [0098.449] lstrlenA (lpString="nM?Y?B?bW???M????un??P????OsUNt?E??Ji??ml??m?JE?XxH?tQ???xFdjJ???????zNu???A?Ru??D?daE?rw") returned 89 [0098.449] lstrcpynA (in: lpString1=0x499078, lpString2="nM?Y?B?bW???M????un??P????OsUNt?E??Ji??ml??m?JE?XxH?tQ???xFdjJ???????zNu???A?Ru??D?daE?rw", iMaxLength=9 | out: lpString1="nM?Y?B?b") returned="nM?Y?B?b" [0098.449] lstrlenA (lpString="nM?Y?B?b") returned 8 [0098.449] lstrlenA (lpString="Ha???????JW?Pvy??z?h???????Y?????MR?????Z????J?u?OL?????Uj?ui") returned 61 [0098.449] lstrcpynA (in: lpString1=0x499094, lpString2="Ha???????JW?Pvy??z?h???????Y?????MR?????Z????J?u?OL?????Uj?ui", iMaxLength=24 | out: lpString1="Ha???????JW?Pvy??z?h???") returned="Ha???????JW?Pvy??z?h???" [0098.449] lstrlenA (lpString="Ha???????JW?Pvy??z?h???") returned 23 [0098.449] lstrlenA (lpString="?n??hriv?????v??V?Hf?k???????????drz?d?YD??e??M??f???kAPBY???ZYS?pU?xOtAns??????b?n?yY") returned 86 [0098.449] lstrcpynA (in: lpString1=0x49907c, lpString2="?n??hriv?????v??V?Hf?k???????????drz?d?YD??e??M??f???kAPBY???ZYS?pU?xOtAns??????b?n?yY", iMaxLength=11 | out: lpString1="?n??hriv??") returned="?n??hriv??" [0098.449] lstrlenA (lpString="?n??hriv??") returned 10 [0098.449] lstrlenA (lpString="???????DY????xaG??J?????P?v?I??????K?WU?Sc?????y????rO?su????uy????S???I") returned 72 [0098.449] lstrcpynA (in: lpString1=0x499088, lpString2="???????DY????xaG??J?????P?v?I??????K?WU?Sc?????y????rO?su????uy????S???I", iMaxLength=24 | out: lpString1="???????DY????xaG??J????") returned="???????DY????xaG??J????" [0098.449] lstrlenA (lpString="???????DY????xaG??J????") returned 23 [0098.449] lstrlenA (lpString="l?W??l???N????Du?IfUj?????Btt?v?fP?QC?t?G?u??s?lL??uX??B?IiB??") returned 62 [0098.449] lstrcpynA (in: lpString1=0x499094, lpString2="l?W??l???N????Du?IfUj?????Btt?v?fP?QC?t?G?u??s?lL??uX??B?IiB??", iMaxLength=34 | out: lpString1="l?W??l???N????Du?IfUj?????Btt?v?f") returned="l?W??l???N????Du?IfUj?????Btt?v?f" [0098.449] lstrlenA (lpString="l?W??l???N????Du?IfUj?????Btt?v?f") returned 33 [0098.449] lstrlenA (lpString="?E?f??T????Lw??Y?V?jgb??Tg??????E???") returned 36 [0098.449] lstrcpynA (in: lpString1=0x4990ac, lpString2="?E?f??T????Lw??Y?V?jgb??Tg??????E???", iMaxLength=23 | out: lpString1="?E?f??T????Lw??Y?V?jgb") returned="?E?f??T????Lw??Y?V?jgb" [0098.449] lstrlenA (lpString="?E?f??T????Lw??Y?V?jgb") returned 22 [0098.449] lstrlenA (lpString="??") returned 2 [0098.449] lstrcpynA (in: lpString1=0x4990c4, lpString2="??", iMaxLength=1 | out: lpString1="") returned="" [0098.449] lstrlenA (lpString="") returned 0 [0098.449] lstrlenA (lpString="IC??rj?fEGB??????Y??jBfn?Z??GWme???C?V??OjGnh?VMhkR?r???P?") returned 58 [0098.449] lstrcpynA (in: lpString1=0x499098, lpString2="IC??rj?fEGB??????Y??jBfn?Z??GWme???C?V??OjGnh?VMhkR?r???P?", iMaxLength=48 | out: lpString1="IC??rj?fEGB??????Y??jBfn?Z??GWme???C?V??OjGnh?V") returned="IC??rj?fEGB??????Y??jBfn?Z??GWme???C?V??OjGnh?V" [0098.449] lstrlenA (lpString="IC??rj?fEGB??????Y??jBfn?Z??GWme???C?V??OjGnh?V") returned 47 [0098.449] lstrlenA (lpString="?ejCWc???W?e?wa?p??e?b????Q?f??ep?KDo?CE??MrdwI??ZX???k?r?CG??LE???i???G??Y?") returned 76 [0098.449] lstrcpynA (in: lpString1=0x499084, lpString2="?ejCWc???W?e?wa?p??e?b????Q?f??ep?KDo?CE??MrdwI??ZX???k?r?CG??LE???i???G??Y?", iMaxLength=58 | out: lpString1="?ejCWc???W?e?wa?p??e?b????Q?f??ep?KDo?CE??MrdwI??ZX???k?r") returned="?ejCWc???W?e?wa?p??e?b????Q?f??ep?KDo?CE??MrdwI??ZX???k?r" [0098.450] lstrlenA (lpString="?ejCWc???W?e?wa?p??e?b????Q?f??ep?KDo?CE??MrdwI??ZX???k?r") returned 57 [0098.450] lstrlenA (lpString="??v?p?GXL?ANSoIrTbL?oQ?t?uR?Vx?iRV?x??x?Y???MCt??R?????Z?lzr?B?m?Rv?Ff??r?W????kr??zME?G?GnL?lL????") returned 99 [0098.450] lstrcpynA (in: lpString1=0x499070, lpString2="??v?p?GXL?ANSoIrTbL?oQ?t?uR?Vx?iRV?x??x?Y???MCt??R?????Z?lzr?B?m?Rv?Ff??r?W????kr??zME?G?GnL?lL????", iMaxLength=19 | out: lpString1="??v?p?GXL?ANSoIrTb") returned="??v?p?GXL?ANSoIrTb" [0098.450] lstrlenA (lpString="??v?p?GXL?ANSoIrTb") returned 18 [0098.450] lstrlenA (lpString="G?j?d?V???e????????") returned 19 [0098.450] lstrcpynA (in: lpString1=0x4990c0, lpString2="G?j?d?V???e????????", iMaxLength=8 | out: lpString1="G?j?d?V") returned="G?j?d?V" [0098.450] lstrlenA (lpString="G?j?d?V") returned 7 [0098.450] lstrlenA (lpString="a?fZ?sjX???") returned 11 [0098.450] lstrcpynA (in: lpString1=0x4990c4, lpString2="a?fZ?sjX???", iMaxLength=2 | out: lpString1="a") returned="a" [0098.450] lstrlenA (lpString="a") returned 1 [0098.450] lstrlenA (lpString="J?o?n??l????aCL?bM?i??I???xssR?B?pBxK??O????QXi??mG??ReJX??H?XiGoSQe?") returned 69 [0098.450] lstrcpynA (in: lpString1=0x49908c, lpString2="J?o?n??l????aCL?bM?i??I???xssR?B?pBxK??O????QXi??mG??ReJX??H?XiGoSQe?", iMaxLength=15 | out: lpString1="J?o?n??l????aC") returned="J?o?n??l????aC" [0098.450] lstrlenA (lpString="J?o?n??l????aC") returned 14 [0098.450] lstrlenA (lpString="J????WH?c???k?Qoi???G?n?xN?cywG???L?u??LV???cM??w??N??C?RPSGDx?xn?ImOBevzL") returned 74 [0098.450] lstrcpynA (in: lpString1=0x499088, lpString2="J????WH?c???k?Qoi???G?n?xN?cywG???L?u??LV???cM??w??N??C?RPSGDx?xn?ImOBevzL", iMaxLength=22 | out: lpString1="J????WH?c???k?Qoi???G") returned="J????WH?c???k?Qoi???G" [0098.450] lstrlenA (lpString="J????WH?c???k?Qoi???G") returned 21 [0098.450] lstrlenA (lpString="???Tcsa?F??????YuR?O?bl?H???Uc??????") returned 36 [0098.450] lstrcpynA (in: lpString1=0x4990ac, lpString2="???Tcsa?F??????YuR?O?bl?H???Uc??????", iMaxLength=30 | out: lpString1="???Tcsa?F??????YuR?O?bl?H???U") returned="???Tcsa?F??????YuR?O?bl?H???U" [0098.450] lstrlenA (lpString="???Tcsa?F??????YuR?O?bl?H???U") returned 29 [0098.450] lstrlenA (lpString="aO?????Y??Fie??I????lG?l??j???N?RgnH??y???gL????c?etzC???????nF??H?") returned 67 [0098.450] lstrcpynA (in: lpString1=0x499090, lpString2="aO?????Y??Fie??I????lG?l??j???N?RgnH??y???gL????c?etzC???????nF??H?", iMaxLength=60 | out: lpString1="aO?????Y??Fie??I????lG?l??j???N?RgnH??y???gL????c?etzC?????") returned="aO?????Y??Fie??I????lG?l??j???N?RgnH??y???gL????c?etzC?????" [0098.450] lstrlenA (lpString="aO?????Y??Fie??I????lG?l??j???N?RgnH??y???gL????c?etzC?????") returned 59 [0098.450] lstrlenA (lpString="o?v??WTPPH??Z?C?????y?OQ?G?????????Y??y?CnVXw???i??PQ??Y??Hj?F??????rj?A??") returned 74 [0098.450] lstrcpynA (in: lpString1=0x499088, lpString2="o?v??WTPPH??Z?C?????y?OQ?G?????????Y??y?CnVXw???i??PQ??Y??Hj?F??????rj?A??", iMaxLength=22 | out: lpString1="o?v??WTPPH??Z?C?????y") returned="o?v??WTPPH??Z?C?????y" [0098.450] lstrlenA (lpString="o?v??WTPPH??Z?C?????y") returned 21 [0098.451] lstrlenA (lpString="m?Z????Z?xd??wv??oX???iK?????YJ??????????U???HF?h?nW??x??rg?YQ???W?QR?l???H????A???pijBNCe") returned 90 [0098.451] lstrcpynA (in: lpString1=0x499078, lpString2="m?Z????Z?xd??wv??oX???iK?????YJ??????????U???HF?h?nW??x??rg?YQ???W?QR?l???H????A???pijBNCe", iMaxLength=72 | out: lpString1="m?Z????Z?xd??wv??oX???iK?????YJ??????????U???HF?h?nW??x??rg?YQ???W?QR?l") returned="m?Z????Z?xd??wv??oX???iK?????YJ??????????U???HF?h?nW??x??rg?YQ???W?QR?l" [0098.451] lstrlenA (lpString="m?Z????Z?xd??wv??oX???iK?????YJ??????????U???HF?h?nW??x??rg?YQ???W?QR?l") returned 71 [0098.451] lstrlenA (lpString="?L?S?T?g???M??d?ovj?HC??V??J?W?N?o???H????Yu????F????") returned 53 [0098.451] lstrcpynA (in: lpString1=0x49909c, lpString2="?L?S?T?g???M??d?ovj?HC??V??J?W?N?o???H????Yu????F????", iMaxLength=4 | out: lpString1="?L?") returned="?L?" [0098.451] lstrlenA (lpString="?L?") returned 3 [0098.451] lstrlenA (lpString="u?e?nPJ?p???g??S?o?j???xIrgIW????I???x?c?C?p??m?EPawOyuuf?xccaBR??x?s") returned 69 [0098.451] lstrcpynA (in: lpString1=0x49908c, lpString2="u?e?nPJ?p???g??S?o?j???xIrgIW????I???x?c?C?p??m?EPawOyuuf?xccaBR??x?s", iMaxLength=19 | out: lpString1="u?e?nPJ?p???g??S?o") returned="u?e?nPJ?p???g??S?o" [0098.451] lstrlenA (lpString="u?e?nPJ?p???g??S?o") returned 18 [0098.451] lstrlenA (lpString="?WE??W??Py?????W?Fe?J???TJYCL?????????X??K?y???oM?H?") returned 52 [0098.451] lstrcpynA (in: lpString1=0x49909c, lpString2="?WE??W??Py?????W?Fe?J???TJYCL?????????X??K?y???oM?H?", iMaxLength=23 | out: lpString1="?WE??W??Py?????W?Fe?J?") returned="?WE??W??Py?????W?Fe?J?" [0098.451] lstrlenA (lpString="?WE??W??Py?????W?Fe?J?") returned 22 [0098.451] lstrlenA (lpString="XREH?AN?pseHe?Vv?X??h????b??ZyZXD?V?Ay?k?A?Z??i?vz?u?z??????G?ct??rh??") returned 70 [0098.451] lstrcpynA (in: lpString1=0x49908c, lpString2="XREH?AN?pseHe?Vv?X??h????b??ZyZXD?V?Ay?k?A?Z??i?vz?u?z??????G?ct??rh??", iMaxLength=61 | out: lpString1="XREH?AN?pseHe?Vv?X??h????b??ZyZXD?V?Ay?k?A?Z??i?vz?u?z??????") returned="XREH?AN?pseHe?Vv?X??h????b??ZyZXD?V?Ay?k?A?Z??i?vz?u?z??????" [0098.451] lstrlenA (lpString="XREH?AN?pseHe?Vv?X??h????b??ZyZXD?V?Ay?k?A?Z??i?vz?u?z??????") returned 60 [0098.451] lstrlenA (lpString="i??fU?k??QuF?xP???c??Ih??????FIsPVf???n") returned 39 [0098.451] lstrcpynA (in: lpString1=0x4990ac, lpString2="i??fU?k??QuF?xP???c??Ih??????FIsPVf???n", iMaxLength=35 | out: lpString1="i??fU?k??QuF?xP???c??Ih??????FIsPV") returned="i??fU?k??QuF?xP???c??Ih??????FIsPV" [0098.451] lstrlenA (lpString="i??fU?k??QuF?xP???c??Ih??????FIsPV") returned 34 [0098.451] lstrlenA (lpString="??Kt???") returned 7 [0098.451] lstrcpynA (in: lpString1=0x4990c4, lpString2="??Kt???", iMaxLength=1 | out: lpString1="") returned="" [0098.451] lstrlenA (lpString="") returned 0 [0098.451] lstrlenA (lpString="????BC?m?T??yci?tx?YR?mx?A??dOOWKV?Fa?Q??VM?rtF??O??M??????f??fz????H??k?????Cl??????B??") returned 88 [0098.451] lstrcpynA (in: lpString1=0x499078, lpString2="????BC?m?T??yci?tx?YR?mx?A??dOOWKV?Fa?Q??VM?rtF??O??M??????f??fz????H??k?????Cl??????B??", iMaxLength=69 | out: lpString1="????BC?m?T??yci?tx?YR?mx?A??dOOWKV?Fa?Q??VM?rtF??O??M??????f??fz????") returned="????BC?m?T??yci?tx?YR?mx?A??dOOWKV?Fa?Q??VM?rtF??O??M??????f??fz????" [0098.451] lstrlenA (lpString="????BC?m?T??yci?tx?YR?mx?A??dOOWKV?Fa?Q??VM?rtF??O??M??????f??fz????") returned 68 [0098.451] lstrlenA (lpString="x?NhEo??Q?P??G?????Z???gW???n?asJ??T?Fj39") returned 41 [0098.451] lstrlenA (lpString="???y?Yi7") returned 8 [0098.451] lstrlenA (lpString="i?XB?T??Bw10") returned 12 [0098.451] lstrlenA (lpString="k??h?????k?ow??F?J?G??sP???MO?iTfm?????l??hSP??MIp?R??wPX??g?HnQs???T???72") returned 74 [0098.452] lstrlenA (lpString="nS??T?L???W???cHb??19") returned 21 [0098.452] lstrlenA (lpString="c??NoVc?e?I?ed??s????????coR?s?F????pR??WL???Y??v?r51") returned 53 [0098.452] lstrlenA (lpString="0") returned 1 [0098.452] lstrlenA (lpString="Z???J?PP?iiiFvSb?cH??b?v??T????31") returned 33 [0098.452] lstrlenA (lpString="r??n??H??Kr?wx????18") returned 20 [0098.452] lstrlenA (lpString="??v??U6") returned 7 [0098.452] lstrlenA (lpString="jfa?e?HWrh?V????mLrh?x?????D??TiWfuZ????lT?tj45") returned 47 [0098.452] lstrlenA (lpString="??f3") returned 4 [0098.452] lstrlenA (lpString="???w???VsVW????15") returned 17 [0098.452] lstrlenA (lpString="Q???y?s???????????HEU?T?v?APO???kC???37") returned 39 [0098.452] lstrlenA (lpString="lmZ?nAI??B??I????f???????CijAl?eP??vPW?????D???OijT?P?a???c?TlD63") returned 65 [0098.452] lstrlenA (lpString="YBrPT????iM?a????X?pl?p??Y??d??Ly?J35") returned 37 [0098.452] lstrlenA (lpString="gC?????go????ifEc??MP?y?p25") returned 27 [0098.452] lstrlenA (lpString="?hF?mp??O?Mu?w?au?Kg??????B27") returned 29 [0098.452] lstrlenA (lpString="?N2") returned 3 [0098.452] lstrlenA (lpString="?u2") returned 3 [0098.452] lstrlenA (lpString="e?tMVn???D?P??A??N???21") returned 23 [0098.452] lstrlenA (lpString="?MN???SawDa??N?????krx?mOj????b31") returned 33 [0098.452] lstrlenA (lpString="?T?E?5") returned 6 [0098.452] lstrlenA (lpString="?M?3") returned 4 [0098.452] lstrlenA (lpString="?I2") returned 3 [0098.452] lstrlenA (lpString="0") returned 1 [0098.452] lstrlenA (lpString="U???A???Z???z?cx?c??pA??alZV28") returned 30 [0098.452] lstrlenA (lpString="?n??4") returned 5 [0098.452] lstrlenA (lpString="X???E?uC?z?a??pA???acFZ???IT28") returned 30 [0098.452] lstrlenA (lpString="0") returned 1 [0098.452] lstrlenA (lpString="???Z??ehP???REAd?m?OtCXpG??b?L????ZL???f?IX?fT?H??C?F???Z?yd??J??p?T?????73") returned 75 [0098.452] lstrlenA (lpString="??j?Q????9") returned 10 [0098.452] lstrlenA (lpString="tP???x?D?Cr????cjcT???22") returned 24 [0098.452] lstrlenA (lpString="I???b??Xpr????RbIu??CY???Ms????MhLL?36") returned 38 [0098.452] lstrlenA (lpString="?dyH?????O?????15") returned 17 [0098.452] lstrlenA (lpString="?1") returned 2 [0098.452] lstrlenA (lpString="n???RvV?Ee?b?f???h?Ej????e????d????O???AT??rXLz???V?x???Pz?EV?U???PoW????????77") returned 79 [0098.452] lstrlenA (lpString="?H??Gpg?pdHav?N??E????Zm?JF?wxcr???v?37") returned 39 [0098.452] lstrlenA (lpString="??p????P?FW??bpj?P???SY?he??rI?SDnJ?Y?dX?n??w????g?b??mA56") returned 58 [0098.452] lstrlenA (lpString="nM?Y?B?b8") returned 9 [0098.453] lstrlenA (lpString="Ha???????JW?Pvy??z?h???23") returned 25 [0098.453] lstrlenA (lpString="?n??hriv??10") returned 12 [0098.453] lstrlenA (lpString="???????DY????xaG??J????23") returned 25 [0098.453] lstrlenA (lpString="l?W??l???N????Du?IfUj?????Btt?v?f33") returned 35 [0098.453] lstrlenA (lpString="?E?f??T????Lw??Y?V?jgb22") returned 24 [0098.453] lstrlenA (lpString="0") returned 1 [0098.453] lstrlenA (lpString="IC??rj?fEGB??????Y??jBfn?Z??GWme???C?V??OjGnh?V47") returned 49 [0098.453] lstrlenA (lpString="?ejCWc???W?e?wa?p??e?b????Q?f??ep?KDo?CE??MrdwI??ZX???k?r57") returned 59 [0098.453] lstrlenA (lpString="??v?p?GXL?ANSoIrTb18") returned 20 [0098.453] lstrlenA (lpString="G?j?d?V7") returned 8 [0098.453] lstrlenA (lpString="a1") returned 2 [0098.453] lstrlenA (lpString="J?o?n??l????aC14") returned 16 [0098.453] lstrlenA (lpString="J????WH?c???k?Qoi???G21") returned 23 [0098.453] lstrlenA (lpString="???Tcsa?F??????YuR?O?bl?H???U29") returned 31 [0098.453] lstrlenA (lpString="aO?????Y??Fie??I????lG?l??j???N?RgnH??y???gL????c?etzC?????59") returned 61 [0098.453] lstrlenA (lpString="o?v??WTPPH??Z?C?????y21") returned 23 [0098.453] lstrlenA (lpString="m?Z????Z?xd??wv??oX???iK?????YJ??????????U???HF?h?nW??x??rg?YQ???W?QR?l71") returned 73 [0098.453] lstrlenA (lpString="?L?3") returned 4 [0098.453] lstrlenA (lpString="u?e?nPJ?p???g??S?o18") returned 20 [0098.453] lstrlenA (lpString="?WE??W??Py?????W?Fe?J?22") returned 24 [0098.453] lstrlenA (lpString="XREH?AN?pseHe?Vv?X??h????b??ZyZXD?V?Ay?k?A?Z??i?vz?u?z??????60") returned 62 [0098.453] lstrlenA (lpString="i??fU?k??QuF?xP???c??Ih??????FIsPV34") returned 36 [0098.453] lstrlenA (lpString="0") returned 1 [0098.453] lstrlenA (lpString="????BC?m?T??yci?tx?YR?mx?A??dOOWKV?Fa?Q??VM?rtF??O??M??????f??fz????68") returned 70 [0098.453] lstrlenA (lpString="41") returned 2 [0098.453] lstrlenA (lpString="41") returned 2 [0098.453] lstrlenA (lpString="74") returned 2 [0098.453] lstrlenA (lpString="74") returned 2 [0098.453] lstrlenA (lpString="74") returned 2 [0098.453] lstrlenA (lpString="74") returned 2 [0098.453] lstrlenA (lpString="74") returned 2 [0098.453] lstrlenA (lpString="74") returned 2 [0098.453] lstrlenA (lpString="74") returned 2 [0098.453] lstrlenA (lpString="74") returned 2 [0098.453] lstrlenA (lpString="74") returned 2 [0098.453] lstrlenA (lpString="74") returned 2 [0098.453] lstrlenA (lpString="74") returned 2 [0098.454] lstrlenA (lpString="74") returned 2 [0098.454] lstrlenA (lpString="74") returned 2 [0098.454] lstrlenA (lpString="74") returned 2 [0098.454] lstrlenA (lpString="74") returned 2 [0098.454] lstrlenA (lpString="74") returned 2 [0098.454] lstrlenA (lpString="74") returned 2 [0098.454] lstrlenA (lpString="74") returned 2 [0098.454] lstrlenA (lpString="74") returned 2 [0098.454] lstrlenA (lpString="74") returned 2 [0098.454] lstrlenA (lpString="74") returned 2 [0098.454] lstrlenA (lpString="74") returned 2 [0098.454] lstrlenA (lpString="74") returned 2 [0098.454] lstrlenA (lpString="74") returned 2 [0098.454] lstrlenA (lpString="74") returned 2 [0098.454] lstrlenA (lpString="74") returned 2 [0098.454] lstrlenA (lpString="75") returned 2 [0098.454] lstrlenA (lpString="75") returned 2 [0098.454] lstrlenA (lpString="75") returned 2 [0098.454] lstrlenA (lpString="75") returned 2 [0098.454] lstrlenA (lpString="75") returned 2 [0098.454] lstrlenA (lpString="79") returned 2 [0098.454] lstrlenA (lpString="79") returned 2 [0098.454] lstrlenA (lpString="79") returned 2 [0098.454] lstrlenA (lpString="79") returned 2 [0098.454] lstrlenA (lpString="79") returned 2 [0098.454] lstrlenA (lpString="79") returned 2 [0098.455] lstrlenA (lpString="79") returned 2 [0098.455] lstrlenA (lpString="79") returned 2 [0098.455] lstrlenA (lpString="79") returned 2 [0098.455] lstrlenA (lpString="79") returned 2 [0098.455] lstrlenA (lpString="79") returned 2 [0098.455] lstrlenA (lpString="79") returned 2 [0098.455] lstrlenA (lpString="79") returned 2 [0098.455] lstrlenA (lpString="79") returned 2 [0098.455] lstrlenA (lpString="79") returned 2 [0098.455] lstrlenA (lpString="79") returned 2 [0098.455] lstrlenA (lpString="79") returned 2 [0098.455] lstrlenA (lpString="79") returned 2 [0098.455] lstrlenA (lpString="79") returned 2 [0098.455] lstrlenA (lpString="79") returned 2 [0098.455] lstrlenA (lpString="79") returned 2 [0098.455] lstrlenA (lpString="79") returned 2 [0098.455] lstrlenA (lpString="79") returned 2 [0098.455] lstrlenA (lpString="79") returned 2 [0098.455] lstrcmpiA (lpString1="x?NhEo??Q?P??G?????Z???gW???n?asJ??T?Fj39", lpString2="???y?Yi7") returned 1 [0098.455] lstrcmpiA (lpString1="???y?Yi7", lpString2="i?XB?T??Bw10") returned -1 [0098.455] lstrcmpiA (lpString1="i?XB?T??Bw10", lpString2="k??h?????k?ow??F?J?G??sP???MO?iTfm?????l??hSP??MIp?R??wPX??g?HnQs???T???72") returned -1 [0098.455] lstrcmpiA (lpString1="k??h?????k?ow??F?J?G??sP???MO?iTfm?????l??hSP??MIp?R??wPX??g?HnQs???T???72", lpString2="nS??T?L???W???cHb??19") returned -1 [0098.455] lstrcmpiA (lpString1="nS??T?L???W???cHb??19", lpString2="c??NoVc?e?I?ed??s????????coR?s?F????pR??WL???Y??v?r51") returned 1 [0098.455] lstrcmpiA (lpString1="c??NoVc?e?I?ed??s????????coR?s?F????pR??WL???Y??v?r51", lpString2="0") returned 1 [0098.455] lstrcmpiA (lpString1="0", lpString2="Z???J?PP?iiiFvSb?cH??b?v??T????31") returned -1 [0098.456] lstrcmpiA (lpString1="Z???J?PP?iiiFvSb?cH??b?v??T????31", lpString2="r??n??H??Kr?wx????18") returned 1 [0098.456] lstrcmpiA (lpString1="r??n??H??Kr?wx????18", lpString2="??v??U6") returned 1 [0098.456] lstrcmpiA (lpString1="??v??U6", lpString2="jfa?e?HWrh?V????mLrh?x?????D??TiWfuZ????lT?tj45") returned -1 [0098.456] lstrcmpiA (lpString1="jfa?e?HWrh?V????mLrh?x?????D??TiWfuZ????lT?tj45", lpString2="??f3") returned 1 [0098.456] lstrcmpiA (lpString1="??f3", lpString2="???w???VsVW????15") returned 1 [0098.456] lstrcmpiA (lpString1="???w???VsVW????15", lpString2="Q???y?s???????????HEU?T?v?APO???kC???37") returned -1 [0098.456] lstrcmpiA (lpString1="Q???y?s???????????HEU?T?v?APO???kC???37", lpString2="lmZ?nAI??B??I????f???????CijAl?eP??vPW?????D???OijT?P?a???c?TlD63") returned 1 [0098.456] lstrcmpiA (lpString1="lmZ?nAI??B??I????f???????CijAl?eP??vPW?????D???OijT?P?a???c?TlD63", lpString2="YBrPT????iM?a????X?pl?p??Y??d??Ly?J35") returned -1 [0098.456] lstrcmpiA (lpString1="YBrPT????iM?a????X?pl?p??Y??d??Ly?J35", lpString2="gC?????go????ifEc??MP?y?p25") returned 1 [0098.456] lstrcmpiA (lpString1="gC?????go????ifEc??MP?y?p25", lpString2="?hF?mp??O?Mu?w?au?Kg??????B27") returned 1 [0098.456] lstrcmpiA (lpString1="?hF?mp??O?Mu?w?au?Kg??????B27", lpString2="?N2") returned -1 [0098.456] lstrcmpiA (lpString1="?N2", lpString2="?u2") returned -1 [0098.456] lstrcmpiA (lpString1="?u2", lpString2="e?tMVn???D?P??A??N???21") returned -1 [0098.456] lstrcmpiA (lpString1="e?tMVn???D?P??A??N???21", lpString2="?MN???SawDa??N?????krx?mOj????b31") returned 1 [0098.456] lstrcmpiA (lpString1="?MN???SawDa??N?????krx?mOj????b31", lpString2="?T?E?5") returned -1 [0098.456] lstrcmpiA (lpString1="?T?E?5", lpString2="?M?3") returned 1 [0098.456] lstrcmpiA (lpString1="?M?3", lpString2="?I2") returned 1 [0098.456] lstrcmpiA (lpString1="?I2", lpString2="0") returned -1 [0098.456] lstrcmpiA (lpString1="0", lpString2="U???A???Z???z?cx?c??pA??alZV28") returned -1 [0098.456] lstrcmpiA (lpString1="U???A???Z???z?cx?c??pA??alZV28", lpString2="?n??4") returned 1 [0098.456] lstrcmpiA (lpString1="?n??4", lpString2="X???E?uC?z?a??pA???acFZ???IT28") returned -1 [0098.456] lstrcmpiA (lpString1="X???E?uC?z?a??pA???acFZ???IT28", lpString2="0") returned 1 [0098.456] lstrcmpiA (lpString1="0", lpString2="???Z??ehP???REAd?m?OtCXpG??b?L????ZL???f?IX?fT?H??C?F???Z?yd??J??p?T?????73") returned 1 [0098.456] lstrcmpiA (lpString1="???Z??ehP???REAd?m?OtCXpG??b?L????ZL???f?IX?fT?H??C?F???Z?yd??J??p?T?????73", lpString2="??j?Q????9") returned -1 [0098.456] lstrcmpiA (lpString1="??j?Q????9", lpString2="tP???x?D?Cr????cjcT???22") returned -1 [0098.456] lstrcmpiA (lpString1="tP???x?D?Cr????cjcT???22", lpString2="I???b??Xpr????RbIu??CY???Ms????MhLL?36") returned 1 [0098.456] lstrcmpiA (lpString1="I???b??Xpr????RbIu??CY???Ms????MhLL?36", lpString2="?dyH?????O?????15") returned 1 [0098.456] lstrcmpiA (lpString1="?dyH?????O?????15", lpString2="?1") returned 1 [0098.456] lstrcmpiA (lpString1="?1", lpString2="n???RvV?Ee?b?f???h?Ej????e????d????O???AT??rXLz???V?x???Pz?EV?U???PoW????????77") returned -1 [0098.456] lstrcmpiA (lpString1="n???RvV?Ee?b?f???h?Ej????e????d????O???AT??rXLz???V?x???Pz?EV?U???PoW????????77", lpString2="?H??Gpg?pdHav?N??E????Zm?JF?wxcr???v?37") returned 1 [0098.456] lstrcmpiA (lpString1="?H??Gpg?pdHav?N??E????Zm?JF?wxcr???v?37", lpString2="??p????P?FW??bpj?P???SY?he??rI?SDnJ?Y?dX?n??w????g?b??mA56") returned 1 [0098.456] lstrcmpiA (lpString1="??p????P?FW??bpj?P???SY?he??rI?SDnJ?Y?dX?n??w????g?b??mA56", lpString2="nM?Y?B?b8") returned -1 [0098.456] lstrcmpiA (lpString1="nM?Y?B?b8", lpString2="Ha???????JW?Pvy??z?h???23") returned 1 [0098.457] lstrcmpiA (lpString1="Ha???????JW?Pvy??z?h???23", lpString2="?n??hriv??10") returned 1 [0098.457] lstrcmpiA (lpString1="?n??hriv??10", lpString2="???????DY????xaG??J????23") returned 1 [0098.457] lstrcmpiA (lpString1="???????DY????xaG??J????23", lpString2="l?W??l???N????Du?IfUj?????Btt?v?f33") returned -1 [0098.457] lstrcmpiA (lpString1="l?W??l???N????Du?IfUj?????Btt?v?f33", lpString2="?E?f??T????Lw??Y?V?jgb22") returned 1 [0098.457] lstrcmpiA (lpString1="?E?f??T????Lw??Y?V?jgb22", lpString2="0") returned -1 [0098.457] lstrcmpiA (lpString1="0", lpString2="IC??rj?fEGB??????Y??jBfn?Z??GWme???C?V??OjGnh?V47") returned -1 [0098.457] lstrcmpiA (lpString1="IC??rj?fEGB??????Y??jBfn?Z??GWme???C?V??OjGnh?V47", lpString2="?ejCWc???W?e?wa?p??e?b????Q?f??ep?KDo?CE??MrdwI??ZX???k?r57") returned 1 [0098.457] lstrcmpiA (lpString1="?ejCWc???W?e?wa?p??e?b????Q?f??ep?KDo?CE??MrdwI??ZX???k?r57", lpString2="??v?p?GXL?ANSoIrTb18") returned 1 [0098.457] lstrcmpiA (lpString1="??v?p?GXL?ANSoIrTb18", lpString2="G?j?d?V7") returned -1 [0098.457] lstrcmpiA (lpString1="G?j?d?V7", lpString2="a1") returned 1 [0098.457] lstrcmpiA (lpString1="a1", lpString2="J?o?n??l????aC14") returned -1 [0098.457] lstrcmpiA (lpString1="J?o?n??l????aC14", lpString2="J????WH?c???k?Qoi???G21") returned 1 [0098.457] lstrcmpiA (lpString1="J????WH?c???k?Qoi???G21", lpString2="???Tcsa?F??????YuR?O?bl?H???U29") returned 1 [0098.457] lstrcmpiA (lpString1="???Tcsa?F??????YuR?O?bl?H???U29", lpString2="aO?????Y??Fie??I????lG?l??j???N?RgnH??y???gL????c?etzC?????59") returned -1 [0098.457] lstrcmpiA (lpString1="aO?????Y??Fie??I????lG?l??j???N?RgnH??y???gL????c?etzC?????59", lpString2="o?v??WTPPH??Z?C?????y21") returned -1 [0098.457] lstrcmpiA (lpString1="o?v??WTPPH??Z?C?????y21", lpString2="m?Z????Z?xd??wv??oX???iK?????YJ??????????U???HF?h?nW??x??rg?YQ???W?QR?l71") returned 1 [0098.457] lstrcmpiA (lpString1="m?Z????Z?xd??wv??oX???iK?????YJ??????????U???HF?h?nW??x??rg?YQ???W?QR?l71", lpString2="?L?3") returned 1 [0098.457] lstrcmpiA (lpString1="?L?3", lpString2="u?e?nPJ?p???g??S?o18") returned -1 [0098.457] lstrcmpiA (lpString1="u?e?nPJ?p???g??S?o18", lpString2="?WE??W??Py?????W?Fe?J?22") returned 1 [0098.457] lstrcmpiA (lpString1="?WE??W??Py?????W?Fe?J?22", lpString2="XREH?AN?pseHe?Vv?X??h????b??ZyZXD?V?Ay?k?A?Z??i?vz?u?z??????60") returned -1 [0098.457] lstrcmpiA (lpString1="XREH?AN?pseHe?Vv?X??h????b??ZyZXD?V?Ay?k?A?Z??i?vz?u?z??????60", lpString2="i??fU?k??QuF?xP???c??Ih??????FIsPV34") returned 1 [0098.457] lstrcmpiA (lpString1="i??fU?k??QuF?xP???c??Ih??????FIsPV34", lpString2="0") returned 1 [0098.457] lstrcmpiA (lpString1="0", lpString2="????BC?m?T??yci?tx?YR?mx?A??dOOWKV?Fa?Q??VM?rtF??O??M??????f??fz????68") returned 1 [0098.457] lstrcmpiA (lpString1="????BC?m?T??yci?tx?YR?mx?A??dOOWKV?Fa?Q??VM?rtF??O??M??????f??fz????68", lpString2="????BC?m?T??yci?tx?YR?mx?A??dOOWKV?Fa?Q??VM?rtF??O??M??????f??fz????68") returned 0 [0098.458] EnumProcessModules (in: hProcess=0x304, lphModule=0x23134a0, cb=0x100, lpcbNeeded=0x497fd0 | out: lphModule=0x23134a0, lpcbNeeded=0x497fd0) returned 1 [0098.458] GetModuleInformation (in: hProcess=0x304, hModule=0x310000, lpmodinfo=0x23135e0, cb=0xc | out: lpmodinfo=0x23135e0*(lpBaseOfDll=0x310000, SizeOfImage=0x3e000, EntryPoint=0x3479ce)) returned 1 [0098.458] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x310000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="unlikexpc.exe") returned 0xd [0098.458] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x310000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\unlikexpc.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\unlikexpc.exe")) returned 0x33 [0098.458] GetModuleInformation (in: hProcess=0x304, hModule=0x77ab0000, lpmodinfo=0x2315734, cb=0xc | out: lpmodinfo=0x2315734*(lpBaseOfDll=0x77ab0000, SizeOfImage=0x180000, EntryPoint=0x0)) returned 1 [0098.458] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x77ab0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="ntdll.dll") returned 0x9 [0098.459] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x77ab0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll")) returned 0x1d [0098.459] GetModuleInformation (in: hProcess=0x304, hModule=0x754b0000, lpmodinfo=0x2317838, cb=0xc | out: lpmodinfo=0x2317838*(lpBaseOfDll=0x754b0000, SizeOfImage=0x4a000, EntryPoint=0x754b2e54)) returned 1 [0098.459] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x754b0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="MSCOREE.DLL") returned 0xb [0098.459] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x754b0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\MSCOREE.DLL" (normalized: "c:\\windows\\system32\\mscoree.dll")) returned 0x1f [0098.459] GetModuleInformation (in: hProcess=0x304, hModule=0x757c0000, lpmodinfo=0x2319944, cb=0xc | out: lpmodinfo=0x2319944*(lpBaseOfDll=0x757c0000, SizeOfImage=0x110000, EntryPoint=0x757d32d3)) returned 1 [0098.459] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x757c0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="KERNEL32.dll") returned 0xc [0098.459] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x757c0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\KERNEL32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll")) returned 0x20 [0098.459] GetModuleInformation (in: hProcess=0x304, hModule=0x76260000, lpmodinfo=0x231ba58, cb=0xc | out: lpmodinfo=0x231ba58*(lpBaseOfDll=0x76260000, SizeOfImage=0x46000, EntryPoint=0x76267478)) returned 1 [0098.460] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x76260000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="KERNELBASE.dll") returned 0xe [0098.460] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x76260000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\KERNELBASE.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll")) returned 0x22 [0098.460] GetModuleInformation (in: hProcess=0x304, hModule=0x75720000, lpmodinfo=0x231dba0, cb=0xc | out: lpmodinfo=0x231dba0*(lpBaseOfDll=0x75720000, SizeOfImage=0xa0000, EntryPoint=0x757349e5)) returned 1 [0098.460] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75720000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="ADVAPI32.dll") returned 0xc [0098.460] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75720000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\ADVAPI32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll")) returned 0x20 [0098.460] GetModuleInformation (in: hProcess=0x304, hModule=0x75fe0000, lpmodinfo=0x231fcb4, cb=0xc | out: lpmodinfo=0x231fcb4*(lpBaseOfDll=0x75fe0000, SizeOfImage=0xac000, EntryPoint=0x75fea472)) returned 1 [0098.461] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75fe0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="msvcrt.dll") returned 0xa [0098.461] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75fe0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll")) returned 0x1e [0098.461] GetModuleInformation (in: hProcess=0x304, hModule=0x761b0000, lpmodinfo=0x2321dc0, cb=0xc | out: lpmodinfo=0x2321dc0*(lpBaseOfDll=0x761b0000, SizeOfImage=0x19000, EntryPoint=0x761b4975)) returned 1 [0098.461] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x761b0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="sechost.dll") returned 0xb [0098.461] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x761b0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll")) returned 0x1f [0098.461] GetModuleInformation (in: hProcess=0x304, hModule=0x76090000, lpmodinfo=0x2323ecc, cb=0xc | out: lpmodinfo=0x2323ecc*(lpBaseOfDll=0x76090000, SizeOfImage=0xf0000, EntryPoint=0x760a0569)) returned 1 [0098.462] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x76090000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="RPCRT4.dll") returned 0xa [0098.462] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x76090000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\RPCRT4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll")) returned 0x1e [0098.462] GetModuleInformation (in: hProcess=0x304, hModule=0x75610000, lpmodinfo=0x2326024, cb=0xc | out: lpmodinfo=0x2326024*(lpBaseOfDll=0x75610000, SizeOfImage=0x60000, EntryPoint=0x7562a3b3)) returned 1 [0098.462] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75610000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="SspiCli.dll") returned 0xb [0098.462] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75610000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\SspiCli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll")) returned 0x1f [0098.463] GetModuleInformation (in: hProcess=0x304, hModule=0x75600000, lpmodinfo=0x2328130, cb=0xc | out: lpmodinfo=0x2328130*(lpBaseOfDll=0x75600000, SizeOfImage=0xc000, EntryPoint=0x756010e1)) returned 1 [0098.463] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75600000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="CRYPTBASE.dll") returned 0xd [0098.463] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75600000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\CRYPTBASE.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll")) returned 0x21 [0098.463] GetModuleInformation (in: hProcess=0x304, hModule=0x75430000, lpmodinfo=0x232a244, cb=0xc | out: lpmodinfo=0x232a244*(lpBaseOfDll=0x75430000, SizeOfImage=0x78000, EntryPoint=0x7543f7ba)) returned 1 [0098.463] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75430000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="mscoreei.dll") returned 0xc [0098.464] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75430000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscoreei.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\mscoreei.dll")) returned 0x3a [0098.464] GetModuleInformation (in: hProcess=0x304, hModule=0x761d0000, lpmodinfo=0x232c38c, cb=0xc | out: lpmodinfo=0x232c38c*(lpBaseOfDll=0x761d0000, SizeOfImage=0x57000, EntryPoint=0x761e9ba6)) returned 1 [0098.464] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x761d0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="SHLWAPI.dll") returned 0xb [0098.464] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x761d0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\SHLWAPI.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll")) returned 0x1f [0098.465] GetModuleInformation (in: hProcess=0x304, hModule=0x766d0000, lpmodinfo=0x232e498, cb=0xc | out: lpmodinfo=0x232e498*(lpBaseOfDll=0x766d0000, SizeOfImage=0x90000, EntryPoint=0x766e6343)) returned 1 [0098.465] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x766d0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="GDI32.dll") returned 0x9 [0098.465] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x766d0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\GDI32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll")) returned 0x1d [0098.465] GetModuleInformation (in: hProcess=0x304, hModule=0x775b0000, lpmodinfo=0x233059c, cb=0xc | out: lpmodinfo=0x233059c*(lpBaseOfDll=0x775b0000, SizeOfImage=0x100000, EntryPoint=0x775cb6ed)) returned 1 [0098.466] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x775b0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="USER32.dll") returned 0xa [0098.466] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x775b0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\USER32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll")) returned 0x1e [0098.466] GetModuleInformation (in: hProcess=0x304, hModule=0x75a70000, lpmodinfo=0x23326a8, cb=0xc | out: lpmodinfo=0x23326a8*(lpBaseOfDll=0x75a70000, SizeOfImage=0xa000, EntryPoint=0x75a736a0)) returned 1 [0098.466] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75a70000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="LPK.dll") returned 0x7 [0098.467] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75a70000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\LPK.dll" (normalized: "c:\\windows\\syswow64\\lpk.dll")) returned 0x1b [0098.467] GetModuleInformation (in: hProcess=0x304, hModule=0x758d0000, lpmodinfo=0x23347a4, cb=0xc | out: lpmodinfo=0x23347a4*(lpBaseOfDll=0x758d0000, SizeOfImage=0x9d000, EntryPoint=0x75903fd7)) returned 1 [0098.467] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x758d0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="USP10.dll") returned 0x9 [0098.467] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x758d0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\USP10.dll" (normalized: "c:\\windows\\syswow64\\usp10.dll")) returned 0x1d [0098.468] GetModuleInformation (in: hProcess=0x304, hModule=0x75f80000, lpmodinfo=0x2336934, cb=0xc | out: lpmodinfo=0x2336934*(lpBaseOfDll=0x75f80000, SizeOfImage=0x60000, EntryPoint=0x75f9158f)) returned 1 [0098.468] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75f80000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="IMM32.DLL") returned 0x9 [0098.468] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75f80000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\system32\\IMM32.DLL" (normalized: "c:\\windows\\system32\\imm32.dll")) returned 0x1d [0098.468] GetModuleInformation (in: hProcess=0x304, hModule=0x75ea0000, lpmodinfo=0x2338a38, cb=0xc | out: lpmodinfo=0x2338a38*(lpBaseOfDll=0x75ea0000, SizeOfImage=0xcc000, EntryPoint=0x75ea168b)) returned 1 [0098.469] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75ea0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="MSCTF.dll") returned 0x9 [0098.469] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75ea0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\MSCTF.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll")) returned 0x1d [0098.469] GetModuleInformation (in: hProcess=0x304, hModule=0x75420000, lpmodinfo=0x233ab3c, cb=0xc | out: lpmodinfo=0x233ab3c*(lpBaseOfDll=0x75420000, SizeOfImage=0x9000, EntryPoint=0x75421220)) returned 1 [0098.470] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75420000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="VERSION.dll") returned 0xb [0098.470] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75420000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\system32\\VERSION.dll" (normalized: "c:\\windows\\system32\\version.dll")) returned 0x1f [0098.470] GetModuleInformation (in: hProcess=0x304, hModule=0x74890000, lpmodinfo=0x233cc48, cb=0xc | out: lpmodinfo=0x233cc48*(lpBaseOfDll=0x74890000, SizeOfImage=0x6a8000, EntryPoint=0x749d7040)) returned 1 [0098.471] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x74890000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="clr.dll") returned 0x7 [0098.471] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x74890000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\clr.dll")) returned 0x35 [0098.471] GetModuleInformation (in: hProcess=0x304, hModule=0x75320000, lpmodinfo=0x233ed78, cb=0xc | out: lpmodinfo=0x233ed78*(lpBaseOfDll=0x75320000, SizeOfImage=0xf5000, EntryPoint=0x75374160)) returned 1 [0098.472] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75320000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="MSVCR120_CLR0400.dll") returned 0x14 [0098.472] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75320000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\system32\\MSVCR120_CLR0400.dll" (normalized: "c:\\windows\\system32\\msvcr120_clr0400.dll")) returned 0x28 [0098.472] GetModuleInformation (in: hProcess=0x304, hModule=0x72440000, lpmodinfo=0x2340eac, cb=0xc | out: lpmodinfo=0x2340eac*(lpBaseOfDll=0x72440000, SizeOfImage=0x122b000, EntryPoint=0x0)) returned 1 [0098.473] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x72440000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="mscorlib.ni.dll") returned 0xf [0098.473] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x72440000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\b7a12c4c0032847fcc6b9c710460456f\\mscorlib.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\mscorlib\\b7a12c4c0032847fcc6b9c710460456f\\mscorlib.ni.dll")) returned 0x68 [0098.473] GetModuleInformation (in: hProcess=0x304, hModule=0x764e0000, lpmodinfo=0x2343054, cb=0xc | out: lpmodinfo=0x2343054*(lpBaseOfDll=0x764e0000, SizeOfImage=0x15c000, EntryPoint=0x7652ba3d)) returned 1 [0098.474] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x764e0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="ole32.dll") returned 0x9 [0098.474] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x764e0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll")) returned 0x1d [0098.474] GetModuleInformation (in: hProcess=0x304, hModule=0x74f60000, lpmodinfo=0x2345158, cb=0xc | out: lpmodinfo=0x2345158*(lpBaseOfDll=0x74f60000, SizeOfImage=0x80000, EntryPoint=0x74f737c9)) returned 1 [0098.475] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x74f60000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="uxtheme.dll") returned 0xb [0098.475] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x74f60000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\system32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll")) returned 0x1f [0098.476] GetModuleInformation (in: hProcess=0x304, hModule=0x752a0000, lpmodinfo=0x2347264, cb=0xc | out: lpmodinfo=0x2347264*(lpBaseOfDll=0x752a0000, SizeOfImage=0x7d000, EntryPoint=0x752a1140)) returned 1 [0098.476] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x752a0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="clrjit.dll") returned 0xa [0098.476] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x752a0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clrjit.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\clrjit.dll")) returned 0x38 [0098.477] GetModuleInformation (in: hProcess=0x304, hModule=0x762b0000, lpmodinfo=0x23493a4, cb=0xc | out: lpmodinfo=0x23493a4*(lpBaseOfDll=0x762b0000, SizeOfImage=0x8f000, EntryPoint=0x762b3fb1)) returned 1 [0098.477] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x762b0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="OLEAUT32.dll") returned 0xc [0098.477] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x762b0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\OLEAUT32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll")) returned 0x20 [0098.478] GetModuleInformation (in: hProcess=0x304, hModule=0x736d0000, lpmodinfo=0x234b4b8, cb=0xc | out: lpmodinfo=0x234b4b8*(lpBaseOfDll=0x736d0000, SizeOfImage=0x9ad000, EntryPoint=0x0)) returned 1 [0098.478] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x736d0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="System.ni.dll") returned 0xd [0098.479] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x736d0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System\\500ffa28b327e171fe664023003e947e\\System.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system\\500ffa28b327e171fe664023003e947e\\system.ni.dll")) returned 0x64 [0098.479] GetModuleInformation (in: hProcess=0x304, hModule=0x71d20000, lpmodinfo=0x234d654, cb=0xc | out: lpmodinfo=0x234d654*(lpBaseOfDll=0x71d20000, SizeOfImage=0x716000, EntryPoint=0x0)) returned 1 [0098.479] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x71d20000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="System.Core.ni.dll") returned 0x12 [0098.480] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x71d20000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Core\\386fde9190d499d6645df8b90eb76242\\System.Core.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.core\\386fde9190d499d6645df8b90eb76242\\system.core.ni.dll")) returned 0x6e [0098.480] GetModuleInformation (in: hProcess=0x304, hModule=0x750d0000, lpmodinfo=0x234f810, cb=0xc | out: lpmodinfo=0x234f810*(lpBaseOfDll=0x750d0000, SizeOfImage=0x1cb000, EntryPoint=0x0)) returned 1 [0098.481] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x750d0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="Microsoft.VisualBasic.ni.dll") returned 0x1c [0098.481] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x750d0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Microsoft.V9921e851#\\cfbddeb6e93e8f421b92229b20e51233\\Microsoft.VisualBasic.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\microsoft.v9921e851#\\cfbddeb6e93e8f421b92229b20e51233\\microsoft.visualbasic.ni.dll")) returned 0x81 [0098.482] GetModuleInformation (in: hProcess=0x304, hModule=0x750b0000, lpmodinfo=0x2351a04, cb=0xc | out: lpmodinfo=0x2351a04*(lpBaseOfDll=0x750b0000, SizeOfImage=0x13000, EntryPoint=0x750b18f0)) returned 1 [0098.482] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x750b0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="nlssorting.dll") returned 0xe [0098.483] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x750b0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\nlssorting.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\nlssorting.dll")) returned 0x3c [0098.483] GetModuleInformation (in: hProcess=0x304, hModule=0x74870000, lpmodinfo=0x2353b54, cb=0xc | out: lpmodinfo=0x2353b54*(lpBaseOfDll=0x74870000, SizeOfImage=0x16000, EntryPoint=0x74872dc3)) returned 1 [0098.484] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x74870000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="CRYPTSP.dll") returned 0xb [0098.484] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x74870000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\system32\\CRYPTSP.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll")) returned 0x1f [0098.484] GetModuleInformation (in: hProcess=0x304, hModule=0x74830000, lpmodinfo=0x2355c60, cb=0xc | out: lpmodinfo=0x2355c60*(lpBaseOfDll=0x74830000, SizeOfImage=0x3b000, EntryPoint=0x7483128d)) returned 1 [0098.485] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x74830000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="rsaenh.dll") returned 0xa [0098.485] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x74830000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\system32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll")) returned 0x1e [0098.486] GetModuleInformation (in: hProcess=0x304, hModule=0x75a60000, lpmodinfo=0x2357e78, cb=0xc | out: lpmodinfo=0x2357e78*(lpBaseOfDll=0x75a60000, SizeOfImage=0x5000, EntryPoint=0x75a61438)) returned 1 [0098.486] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75a60000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="psapi.dll") returned 0x9 [0098.487] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75a60000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\psapi.dll" (normalized: "c:\\windows\\syswow64\\psapi.dll")) returned 0x1d [0098.487] GetModuleInformation (in: hProcess=0x304, hModule=0x746a0000, lpmodinfo=0x2359f7c, cb=0xc | out: lpmodinfo=0x2359f7c*(lpBaseOfDll=0x746a0000, SizeOfImage=0x18d000, EntryPoint=0x0)) returned 1 [0098.488] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x746a0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="System.Drawing.ni.dll") returned 0x15 [0098.488] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x746a0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Drawing\\553c0312fdf5a5449f3649f0515e70fb\\System.Drawing.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.drawing\\553c0312fdf5a5449f3649f0515e70fb\\system.drawing.ni.dll")) returned 0x74 [0098.489] GetModuleInformation (in: hProcess=0x304, hModule=0x710c0000, lpmodinfo=0x235c148, cb=0xc | out: lpmodinfo=0x235c148*(lpBaseOfDll=0x710c0000, SizeOfImage=0xc58000, EntryPoint=0x0)) returned 1 [0098.489] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x710c0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="System.Windows.Forms.ni.dll") returned 0x1b [0098.490] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x710c0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Windows.Forms\\7a6894982f35a1d75ec73d447c583da2\\System.Windows.Forms.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.windows.forms\\7a6894982f35a1d75ec73d447c583da2\\system.windows.forms.ni.dll")) returned 0x80 [0098.492] EnumProcessModules (in: hProcess=0x304, lphModule=0x2256828, cb=0x100, lpcbNeeded=0x497fd0 | out: lphModule=0x2256828, lpcbNeeded=0x497fd0) returned 1 [0098.493] GetModuleInformation (in: hProcess=0x304, hModule=0x310000, lpmodinfo=0x2256968, cb=0xc | out: lpmodinfo=0x2256968*(lpBaseOfDll=0x310000, SizeOfImage=0x3e000, EntryPoint=0x3479ce)) returned 1 [0098.493] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x310000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="unlikexpc.exe") returned 0xd [0098.493] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x310000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\unlikexpc.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\unlikexpc.exe")) returned 0x33 [0098.493] GetModuleInformation (in: hProcess=0x304, hModule=0x77ab0000, lpmodinfo=0x2258abc, cb=0xc | out: lpmodinfo=0x2258abc*(lpBaseOfDll=0x77ab0000, SizeOfImage=0x180000, EntryPoint=0x0)) returned 1 [0098.493] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x77ab0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="ntdll.dll") returned 0x9 [0098.493] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x77ab0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll")) returned 0x1d [0098.493] GetModuleInformation (in: hProcess=0x304, hModule=0x754b0000, lpmodinfo=0x225abc0, cb=0xc | out: lpmodinfo=0x225abc0*(lpBaseOfDll=0x754b0000, SizeOfImage=0x4a000, EntryPoint=0x754b2e54)) returned 1 [0098.493] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x754b0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="MSCOREE.DLL") returned 0xb [0098.494] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x754b0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\MSCOREE.DLL" (normalized: "c:\\windows\\system32\\mscoree.dll")) returned 0x1f [0098.494] GetModuleInformation (in: hProcess=0x304, hModule=0x757c0000, lpmodinfo=0x225cccc, cb=0xc | out: lpmodinfo=0x225cccc*(lpBaseOfDll=0x757c0000, SizeOfImage=0x110000, EntryPoint=0x757d32d3)) returned 1 [0098.494] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x757c0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="KERNEL32.dll") returned 0xc [0098.494] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x757c0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\KERNEL32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll")) returned 0x20 [0098.494] GetModuleInformation (in: hProcess=0x304, hModule=0x76260000, lpmodinfo=0x225ede0, cb=0xc | out: lpmodinfo=0x225ede0*(lpBaseOfDll=0x76260000, SizeOfImage=0x46000, EntryPoint=0x76267478)) returned 1 [0098.494] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x76260000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="KERNELBASE.dll") returned 0xe [0098.494] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x76260000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\KERNELBASE.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll")) returned 0x22 [0098.495] GetModuleInformation (in: hProcess=0x304, hModule=0x75720000, lpmodinfo=0x2260f28, cb=0xc | out: lpmodinfo=0x2260f28*(lpBaseOfDll=0x75720000, SizeOfImage=0xa0000, EntryPoint=0x757349e5)) returned 1 [0098.495] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75720000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="ADVAPI32.dll") returned 0xc [0098.495] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75720000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\ADVAPI32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll")) returned 0x20 [0098.495] GetModuleInformation (in: hProcess=0x304, hModule=0x75fe0000, lpmodinfo=0x226303c, cb=0xc | out: lpmodinfo=0x226303c*(lpBaseOfDll=0x75fe0000, SizeOfImage=0xac000, EntryPoint=0x75fea472)) returned 1 [0098.495] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75fe0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="msvcrt.dll") returned 0xa [0098.495] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75fe0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll")) returned 0x1e [0098.496] GetModuleInformation (in: hProcess=0x304, hModule=0x761b0000, lpmodinfo=0x2265148, cb=0xc | out: lpmodinfo=0x2265148*(lpBaseOfDll=0x761b0000, SizeOfImage=0x19000, EntryPoint=0x761b4975)) returned 1 [0098.496] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x761b0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="sechost.dll") returned 0xb [0098.496] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x761b0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll")) returned 0x1f [0098.496] GetModuleInformation (in: hProcess=0x304, hModule=0x76090000, lpmodinfo=0x2267254, cb=0xc | out: lpmodinfo=0x2267254*(lpBaseOfDll=0x76090000, SizeOfImage=0xf0000, EntryPoint=0x760a0569)) returned 1 [0098.496] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x76090000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="RPCRT4.dll") returned 0xa [0098.496] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x76090000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\RPCRT4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll")) returned 0x1e [0098.497] GetModuleInformation (in: hProcess=0x304, hModule=0x75610000, lpmodinfo=0x22693ac, cb=0xc | out: lpmodinfo=0x22693ac*(lpBaseOfDll=0x75610000, SizeOfImage=0x60000, EntryPoint=0x7562a3b3)) returned 1 [0098.497] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75610000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="SspiCli.dll") returned 0xb [0098.497] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75610000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\SspiCli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll")) returned 0x1f [0098.497] GetModuleInformation (in: hProcess=0x304, hModule=0x75600000, lpmodinfo=0x226b4b8, cb=0xc | out: lpmodinfo=0x226b4b8*(lpBaseOfDll=0x75600000, SizeOfImage=0xc000, EntryPoint=0x756010e1)) returned 1 [0098.497] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75600000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="CRYPTBASE.dll") returned 0xd [0098.498] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75600000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\CRYPTBASE.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll")) returned 0x21 [0098.498] GetModuleInformation (in: hProcess=0x304, hModule=0x75430000, lpmodinfo=0x226d5cc, cb=0xc | out: lpmodinfo=0x226d5cc*(lpBaseOfDll=0x75430000, SizeOfImage=0x78000, EntryPoint=0x7543f7ba)) returned 1 [0098.498] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75430000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="mscoreei.dll") returned 0xc [0098.498] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75430000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscoreei.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\mscoreei.dll")) returned 0x3a [0098.499] GetModuleInformation (in: hProcess=0x304, hModule=0x761d0000, lpmodinfo=0x226f714, cb=0xc | out: lpmodinfo=0x226f714*(lpBaseOfDll=0x761d0000, SizeOfImage=0x57000, EntryPoint=0x761e9ba6)) returned 1 [0098.499] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x761d0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="SHLWAPI.dll") returned 0xb [0098.499] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x761d0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\SHLWAPI.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll")) returned 0x1f [0098.499] GetModuleInformation (in: hProcess=0x304, hModule=0x766d0000, lpmodinfo=0x2271820, cb=0xc | out: lpmodinfo=0x2271820*(lpBaseOfDll=0x766d0000, SizeOfImage=0x90000, EntryPoint=0x766e6343)) returned 1 [0098.499] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x766d0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="GDI32.dll") returned 0x9 [0098.500] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x766d0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\GDI32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll")) returned 0x1d [0098.500] GetModuleInformation (in: hProcess=0x304, hModule=0x775b0000, lpmodinfo=0x2273924, cb=0xc | out: lpmodinfo=0x2273924*(lpBaseOfDll=0x775b0000, SizeOfImage=0x100000, EntryPoint=0x775cb6ed)) returned 1 [0098.500] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x775b0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="USER32.dll") returned 0xa [0098.500] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x775b0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\USER32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll")) returned 0x1e [0098.501] GetModuleInformation (in: hProcess=0x304, hModule=0x75a70000, lpmodinfo=0x2275a30, cb=0xc | out: lpmodinfo=0x2275a30*(lpBaseOfDll=0x75a70000, SizeOfImage=0xa000, EntryPoint=0x75a736a0)) returned 1 [0098.501] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75a70000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="LPK.dll") returned 0x7 [0098.501] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75a70000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\LPK.dll" (normalized: "c:\\windows\\syswow64\\lpk.dll")) returned 0x1b [0098.502] GetModuleInformation (in: hProcess=0x304, hModule=0x758d0000, lpmodinfo=0x2277b2c, cb=0xc | out: lpmodinfo=0x2277b2c*(lpBaseOfDll=0x758d0000, SizeOfImage=0x9d000, EntryPoint=0x75903fd7)) returned 1 [0098.502] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x758d0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="USP10.dll") returned 0x9 [0098.502] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x758d0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\USP10.dll" (normalized: "c:\\windows\\syswow64\\usp10.dll")) returned 0x1d [0098.502] GetModuleInformation (in: hProcess=0x304, hModule=0x75f80000, lpmodinfo=0x2279cbc, cb=0xc | out: lpmodinfo=0x2279cbc*(lpBaseOfDll=0x75f80000, SizeOfImage=0x60000, EntryPoint=0x75f9158f)) returned 1 [0098.503] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75f80000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="IMM32.DLL") returned 0x9 [0098.503] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75f80000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\system32\\IMM32.DLL" (normalized: "c:\\windows\\system32\\imm32.dll")) returned 0x1d [0098.503] GetModuleInformation (in: hProcess=0x304, hModule=0x75ea0000, lpmodinfo=0x227bdc0, cb=0xc | out: lpmodinfo=0x227bdc0*(lpBaseOfDll=0x75ea0000, SizeOfImage=0xcc000, EntryPoint=0x75ea168b)) returned 1 [0098.504] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75ea0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="MSCTF.dll") returned 0x9 [0098.504] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75ea0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\MSCTF.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll")) returned 0x1d [0098.504] GetModuleInformation (in: hProcess=0x304, hModule=0x75420000, lpmodinfo=0x227dec4, cb=0xc | out: lpmodinfo=0x227dec4*(lpBaseOfDll=0x75420000, SizeOfImage=0x9000, EntryPoint=0x75421220)) returned 1 [0098.505] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75420000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="VERSION.dll") returned 0xb [0098.505] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75420000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\system32\\VERSION.dll" (normalized: "c:\\windows\\system32\\version.dll")) returned 0x1f [0098.505] GetModuleInformation (in: hProcess=0x304, hModule=0x74890000, lpmodinfo=0x227ffd0, cb=0xc | out: lpmodinfo=0x227ffd0*(lpBaseOfDll=0x74890000, SizeOfImage=0x6a8000, EntryPoint=0x749d7040)) returned 1 [0098.505] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x74890000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="clr.dll") returned 0x7 [0098.506] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x74890000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\clr.dll")) returned 0x35 [0098.506] GetModuleInformation (in: hProcess=0x304, hModule=0x75320000, lpmodinfo=0x2282100, cb=0xc | out: lpmodinfo=0x2282100*(lpBaseOfDll=0x75320000, SizeOfImage=0xf5000, EntryPoint=0x75374160)) returned 1 [0098.506] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75320000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="MSVCR120_CLR0400.dll") returned 0x14 [0098.507] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75320000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\system32\\MSVCR120_CLR0400.dll" (normalized: "c:\\windows\\system32\\msvcr120_clr0400.dll")) returned 0x28 [0098.507] GetModuleInformation (in: hProcess=0x304, hModule=0x72440000, lpmodinfo=0x2284234, cb=0xc | out: lpmodinfo=0x2284234*(lpBaseOfDll=0x72440000, SizeOfImage=0x122b000, EntryPoint=0x0)) returned 1 [0098.507] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x72440000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="mscorlib.ni.dll") returned 0xf [0098.508] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x72440000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\b7a12c4c0032847fcc6b9c710460456f\\mscorlib.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\mscorlib\\b7a12c4c0032847fcc6b9c710460456f\\mscorlib.ni.dll")) returned 0x68 [0098.508] GetModuleInformation (in: hProcess=0x304, hModule=0x764e0000, lpmodinfo=0x22863dc, cb=0xc | out: lpmodinfo=0x22863dc*(lpBaseOfDll=0x764e0000, SizeOfImage=0x15c000, EntryPoint=0x7652ba3d)) returned 1 [0098.508] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x764e0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="ole32.dll") returned 0x9 [0098.509] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x764e0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll")) returned 0x1d [0098.509] GetModuleInformation (in: hProcess=0x304, hModule=0x74f60000, lpmodinfo=0x22884e0, cb=0xc | out: lpmodinfo=0x22884e0*(lpBaseOfDll=0x74f60000, SizeOfImage=0x80000, EntryPoint=0x74f737c9)) returned 1 [0098.509] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x74f60000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="uxtheme.dll") returned 0xb [0098.510] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x74f60000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\system32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll")) returned 0x1f [0098.510] GetModuleInformation (in: hProcess=0x304, hModule=0x752a0000, lpmodinfo=0x228a5ec, cb=0xc | out: lpmodinfo=0x228a5ec*(lpBaseOfDll=0x752a0000, SizeOfImage=0x7d000, EntryPoint=0x752a1140)) returned 1 [0098.511] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x752a0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="clrjit.dll") returned 0xa [0098.511] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x752a0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clrjit.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\clrjit.dll")) returned 0x38 [0098.511] GetModuleInformation (in: hProcess=0x304, hModule=0x762b0000, lpmodinfo=0x228c72c, cb=0xc | out: lpmodinfo=0x228c72c*(lpBaseOfDll=0x762b0000, SizeOfImage=0x8f000, EntryPoint=0x762b3fb1)) returned 1 [0098.512] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x762b0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="OLEAUT32.dll") returned 0xc [0098.512] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x762b0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\OLEAUT32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll")) returned 0x20 [0098.512] GetModuleInformation (in: hProcess=0x304, hModule=0x736d0000, lpmodinfo=0x228e840, cb=0xc | out: lpmodinfo=0x228e840*(lpBaseOfDll=0x736d0000, SizeOfImage=0x9ad000, EntryPoint=0x0)) returned 1 [0098.513] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x736d0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="System.ni.dll") returned 0xd [0098.513] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x736d0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System\\500ffa28b327e171fe664023003e947e\\System.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system\\500ffa28b327e171fe664023003e947e\\system.ni.dll")) returned 0x64 [0098.514] GetModuleInformation (in: hProcess=0x304, hModule=0x71d20000, lpmodinfo=0x22909dc, cb=0xc | out: lpmodinfo=0x22909dc*(lpBaseOfDll=0x71d20000, SizeOfImage=0x716000, EntryPoint=0x0)) returned 1 [0098.514] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x71d20000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="System.Core.ni.dll") returned 0x12 [0098.514] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x71d20000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Core\\386fde9190d499d6645df8b90eb76242\\System.Core.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.core\\386fde9190d499d6645df8b90eb76242\\system.core.ni.dll")) returned 0x6e [0098.515] GetModuleInformation (in: hProcess=0x304, hModule=0x750d0000, lpmodinfo=0x2292b98, cb=0xc | out: lpmodinfo=0x2292b98*(lpBaseOfDll=0x750d0000, SizeOfImage=0x1cb000, EntryPoint=0x0)) returned 1 [0098.515] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x750d0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="Microsoft.VisualBasic.ni.dll") returned 0x1c [0098.516] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x750d0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Microsoft.V9921e851#\\cfbddeb6e93e8f421b92229b20e51233\\Microsoft.VisualBasic.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\microsoft.v9921e851#\\cfbddeb6e93e8f421b92229b20e51233\\microsoft.visualbasic.ni.dll")) returned 0x81 [0098.516] GetModuleInformation (in: hProcess=0x304, hModule=0x750b0000, lpmodinfo=0x2294d8c, cb=0xc | out: lpmodinfo=0x2294d8c*(lpBaseOfDll=0x750b0000, SizeOfImage=0x13000, EntryPoint=0x750b18f0)) returned 1 [0098.516] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x750b0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="nlssorting.dll") returned 0xe [0098.517] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x750b0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\nlssorting.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\nlssorting.dll")) returned 0x3c [0098.517] GetModuleInformation (in: hProcess=0x304, hModule=0x74870000, lpmodinfo=0x2296edc, cb=0xc | out: lpmodinfo=0x2296edc*(lpBaseOfDll=0x74870000, SizeOfImage=0x16000, EntryPoint=0x74872dc3)) returned 1 [0098.518] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x74870000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="CRYPTSP.dll") returned 0xb [0098.518] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x74870000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\system32\\CRYPTSP.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll")) returned 0x1f [0098.519] GetModuleInformation (in: hProcess=0x304, hModule=0x74830000, lpmodinfo=0x2298fe8, cb=0xc | out: lpmodinfo=0x2298fe8*(lpBaseOfDll=0x74830000, SizeOfImage=0x3b000, EntryPoint=0x7483128d)) returned 1 [0098.519] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x74830000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="rsaenh.dll") returned 0xa [0098.519] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x74830000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\system32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll")) returned 0x1e [0098.520] GetModuleInformation (in: hProcess=0x304, hModule=0x75a60000, lpmodinfo=0x229b200, cb=0xc | out: lpmodinfo=0x229b200*(lpBaseOfDll=0x75a60000, SizeOfImage=0x5000, EntryPoint=0x75a61438)) returned 1 [0098.520] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75a60000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="psapi.dll") returned 0x9 [0098.521] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75a60000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\psapi.dll" (normalized: "c:\\windows\\syswow64\\psapi.dll")) returned 0x1d [0098.521] GetModuleInformation (in: hProcess=0x304, hModule=0x746a0000, lpmodinfo=0x229d304, cb=0xc | out: lpmodinfo=0x229d304*(lpBaseOfDll=0x746a0000, SizeOfImage=0x18d000, EntryPoint=0x0)) returned 1 [0098.522] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x746a0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="System.Drawing.ni.dll") returned 0x15 [0098.522] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x746a0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Drawing\\553c0312fdf5a5449f3649f0515e70fb\\System.Drawing.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.drawing\\553c0312fdf5a5449f3649f0515e70fb\\system.drawing.ni.dll")) returned 0x74 [0098.523] GetModuleInformation (in: hProcess=0x304, hModule=0x710c0000, lpmodinfo=0x229f4d0, cb=0xc | out: lpmodinfo=0x229f4d0*(lpBaseOfDll=0x710c0000, SizeOfImage=0xc58000, EntryPoint=0x0)) returned 1 [0098.523] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x710c0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="System.Windows.Forms.ni.dll") returned 0x1b [0098.524] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x710c0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Windows.Forms\\7a6894982f35a1d75ec73d447c583da2\\System.Windows.Forms.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.windows.forms\\7a6894982f35a1d75ec73d447c583da2\\system.windows.forms.ni.dll")) returned 0x80 [0098.525] EnumProcessModules (in: hProcess=0x304, lphModule=0x2395778, cb=0x100, lpcbNeeded=0x497fd0 | out: lphModule=0x2395778, lpcbNeeded=0x497fd0) returned 1 [0098.526] GetModuleInformation (in: hProcess=0x304, hModule=0x310000, lpmodinfo=0x23958b8, cb=0xc | out: lpmodinfo=0x23958b8*(lpBaseOfDll=0x310000, SizeOfImage=0x3e000, EntryPoint=0x3479ce)) returned 1 [0098.526] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x310000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="unlikexpc.exe") returned 0xd [0098.526] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x310000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\unlikexpc.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\unlikexpc.exe")) returned 0x33 [0098.526] GetModuleInformation (in: hProcess=0x304, hModule=0x77ab0000, lpmodinfo=0x2397a0c, cb=0xc | out: lpmodinfo=0x2397a0c*(lpBaseOfDll=0x77ab0000, SizeOfImage=0x180000, EntryPoint=0x0)) returned 1 [0098.526] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x77ab0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="ntdll.dll") returned 0x9 [0098.526] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x77ab0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll")) returned 0x1d [0098.526] GetModuleInformation (in: hProcess=0x304, hModule=0x754b0000, lpmodinfo=0x2399b10, cb=0xc | out: lpmodinfo=0x2399b10*(lpBaseOfDll=0x754b0000, SizeOfImage=0x4a000, EntryPoint=0x754b2e54)) returned 1 [0098.526] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x754b0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="MSCOREE.DLL") returned 0xb [0098.527] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x754b0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\MSCOREE.DLL" (normalized: "c:\\windows\\system32\\mscoree.dll")) returned 0x1f [0098.527] GetModuleInformation (in: hProcess=0x304, hModule=0x757c0000, lpmodinfo=0x239bc1c, cb=0xc | out: lpmodinfo=0x239bc1c*(lpBaseOfDll=0x757c0000, SizeOfImage=0x110000, EntryPoint=0x757d32d3)) returned 1 [0098.527] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x757c0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="KERNEL32.dll") returned 0xc [0098.527] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x757c0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\KERNEL32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll")) returned 0x20 [0098.527] GetModuleInformation (in: hProcess=0x304, hModule=0x76260000, lpmodinfo=0x239dd30, cb=0xc | out: lpmodinfo=0x239dd30*(lpBaseOfDll=0x76260000, SizeOfImage=0x46000, EntryPoint=0x76267478)) returned 1 [0098.527] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x76260000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="KERNELBASE.dll") returned 0xe [0098.527] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x76260000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\KERNELBASE.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll")) returned 0x22 [0098.528] GetModuleInformation (in: hProcess=0x304, hModule=0x75720000, lpmodinfo=0x239fe78, cb=0xc | out: lpmodinfo=0x239fe78*(lpBaseOfDll=0x75720000, SizeOfImage=0xa0000, EntryPoint=0x757349e5)) returned 1 [0098.528] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75720000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="ADVAPI32.dll") returned 0xc [0098.528] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75720000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\ADVAPI32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll")) returned 0x20 [0098.528] GetModuleInformation (in: hProcess=0x304, hModule=0x75fe0000, lpmodinfo=0x23a1f8c, cb=0xc | out: lpmodinfo=0x23a1f8c*(lpBaseOfDll=0x75fe0000, SizeOfImage=0xac000, EntryPoint=0x75fea472)) returned 1 [0098.528] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75fe0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="msvcrt.dll") returned 0xa [0098.528] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75fe0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll")) returned 0x1e [0098.529] GetModuleInformation (in: hProcess=0x304, hModule=0x761b0000, lpmodinfo=0x23a4098, cb=0xc | out: lpmodinfo=0x23a4098*(lpBaseOfDll=0x761b0000, SizeOfImage=0x19000, EntryPoint=0x761b4975)) returned 1 [0098.529] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x761b0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="sechost.dll") returned 0xb [0098.529] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x761b0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll")) returned 0x1f [0098.529] GetModuleInformation (in: hProcess=0x304, hModule=0x76090000, lpmodinfo=0x23a61a4, cb=0xc | out: lpmodinfo=0x23a61a4*(lpBaseOfDll=0x76090000, SizeOfImage=0xf0000, EntryPoint=0x760a0569)) returned 1 [0098.529] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x76090000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="RPCRT4.dll") returned 0xa [0098.529] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x76090000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\RPCRT4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll")) returned 0x1e [0098.530] GetModuleInformation (in: hProcess=0x304, hModule=0x75610000, lpmodinfo=0x23a82fc, cb=0xc | out: lpmodinfo=0x23a82fc*(lpBaseOfDll=0x75610000, SizeOfImage=0x60000, EntryPoint=0x7562a3b3)) returned 1 [0098.530] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75610000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="SspiCli.dll") returned 0xb [0098.530] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75610000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\SspiCli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll")) returned 0x1f [0098.530] GetModuleInformation (in: hProcess=0x304, hModule=0x75600000, lpmodinfo=0x23aa408, cb=0xc | out: lpmodinfo=0x23aa408*(lpBaseOfDll=0x75600000, SizeOfImage=0xc000, EntryPoint=0x756010e1)) returned 1 [0098.530] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75600000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="CRYPTBASE.dll") returned 0xd [0098.531] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75600000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\CRYPTBASE.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll")) returned 0x21 [0098.531] GetModuleInformation (in: hProcess=0x304, hModule=0x75430000, lpmodinfo=0x23ac51c, cb=0xc | out: lpmodinfo=0x23ac51c*(lpBaseOfDll=0x75430000, SizeOfImage=0x78000, EntryPoint=0x7543f7ba)) returned 1 [0098.531] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75430000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="mscoreei.dll") returned 0xc [0098.531] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75430000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscoreei.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\mscoreei.dll")) returned 0x3a [0098.531] GetModuleInformation (in: hProcess=0x304, hModule=0x761d0000, lpmodinfo=0x23ae664, cb=0xc | out: lpmodinfo=0x23ae664*(lpBaseOfDll=0x761d0000, SizeOfImage=0x57000, EntryPoint=0x761e9ba6)) returned 1 [0098.532] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x761d0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="SHLWAPI.dll") returned 0xb [0098.532] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x761d0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\SHLWAPI.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll")) returned 0x1f [0098.532] GetModuleInformation (in: hProcess=0x304, hModule=0x766d0000, lpmodinfo=0x23b0770, cb=0xc | out: lpmodinfo=0x23b0770*(lpBaseOfDll=0x766d0000, SizeOfImage=0x90000, EntryPoint=0x766e6343)) returned 1 [0098.533] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x766d0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="GDI32.dll") returned 0x9 [0098.533] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x766d0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\GDI32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll")) returned 0x1d [0098.533] GetModuleInformation (in: hProcess=0x304, hModule=0x775b0000, lpmodinfo=0x23b2874, cb=0xc | out: lpmodinfo=0x23b2874*(lpBaseOfDll=0x775b0000, SizeOfImage=0x100000, EntryPoint=0x775cb6ed)) returned 1 [0098.533] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x775b0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="USER32.dll") returned 0xa [0098.534] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x775b0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\USER32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll")) returned 0x1e [0098.534] GetModuleInformation (in: hProcess=0x304, hModule=0x75a70000, lpmodinfo=0x23b4980, cb=0xc | out: lpmodinfo=0x23b4980*(lpBaseOfDll=0x75a70000, SizeOfImage=0xa000, EntryPoint=0x75a736a0)) returned 1 [0098.534] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75a70000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="LPK.dll") returned 0x7 [0098.534] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75a70000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\LPK.dll" (normalized: "c:\\windows\\syswow64\\lpk.dll")) returned 0x1b [0098.535] GetModuleInformation (in: hProcess=0x304, hModule=0x758d0000, lpmodinfo=0x23b6a7c, cb=0xc | out: lpmodinfo=0x23b6a7c*(lpBaseOfDll=0x758d0000, SizeOfImage=0x9d000, EntryPoint=0x75903fd7)) returned 1 [0098.535] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x758d0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="USP10.dll") returned 0x9 [0098.535] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x758d0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\USP10.dll" (normalized: "c:\\windows\\syswow64\\usp10.dll")) returned 0x1d [0098.535] GetModuleInformation (in: hProcess=0x304, hModule=0x75f80000, lpmodinfo=0x23b8c0c, cb=0xc | out: lpmodinfo=0x23b8c0c*(lpBaseOfDll=0x75f80000, SizeOfImage=0x60000, EntryPoint=0x75f9158f)) returned 1 [0098.536] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75f80000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="IMM32.DLL") returned 0x9 [0098.536] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75f80000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\system32\\IMM32.DLL" (normalized: "c:\\windows\\system32\\imm32.dll")) returned 0x1d [0098.536] GetModuleInformation (in: hProcess=0x304, hModule=0x75ea0000, lpmodinfo=0x23bad10, cb=0xc | out: lpmodinfo=0x23bad10*(lpBaseOfDll=0x75ea0000, SizeOfImage=0xcc000, EntryPoint=0x75ea168b)) returned 1 [0098.537] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75ea0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="MSCTF.dll") returned 0x9 [0098.537] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75ea0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\MSCTF.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll")) returned 0x1d [0098.537] GetModuleInformation (in: hProcess=0x304, hModule=0x75420000, lpmodinfo=0x23bce14, cb=0xc | out: lpmodinfo=0x23bce14*(lpBaseOfDll=0x75420000, SizeOfImage=0x9000, EntryPoint=0x75421220)) returned 1 [0098.537] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75420000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="VERSION.dll") returned 0xb [0098.538] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75420000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\system32\\VERSION.dll" (normalized: "c:\\windows\\system32\\version.dll")) returned 0x1f [0098.538] GetModuleInformation (in: hProcess=0x304, hModule=0x74890000, lpmodinfo=0x23bef20, cb=0xc | out: lpmodinfo=0x23bef20*(lpBaseOfDll=0x74890000, SizeOfImage=0x6a8000, EntryPoint=0x749d7040)) returned 1 [0098.538] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x74890000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="clr.dll") returned 0x7 [0098.539] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x74890000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\clr.dll")) returned 0x35 [0098.539] GetModuleInformation (in: hProcess=0x304, hModule=0x75320000, lpmodinfo=0x23c1050, cb=0xc | out: lpmodinfo=0x23c1050*(lpBaseOfDll=0x75320000, SizeOfImage=0xf5000, EntryPoint=0x75374160)) returned 1 [0098.539] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75320000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="MSVCR120_CLR0400.dll") returned 0x14 [0098.540] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75320000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\system32\\MSVCR120_CLR0400.dll" (normalized: "c:\\windows\\system32\\msvcr120_clr0400.dll")) returned 0x28 [0098.540] GetModuleInformation (in: hProcess=0x304, hModule=0x72440000, lpmodinfo=0x23c3184, cb=0xc | out: lpmodinfo=0x23c3184*(lpBaseOfDll=0x72440000, SizeOfImage=0x122b000, EntryPoint=0x0)) returned 1 [0098.540] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x72440000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="mscorlib.ni.dll") returned 0xf [0098.541] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x72440000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\b7a12c4c0032847fcc6b9c710460456f\\mscorlib.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\mscorlib\\b7a12c4c0032847fcc6b9c710460456f\\mscorlib.ni.dll")) returned 0x68 [0098.541] GetModuleInformation (in: hProcess=0x304, hModule=0x764e0000, lpmodinfo=0x23c532c, cb=0xc | out: lpmodinfo=0x23c532c*(lpBaseOfDll=0x764e0000, SizeOfImage=0x15c000, EntryPoint=0x7652ba3d)) returned 1 [0098.541] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x764e0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="ole32.dll") returned 0x9 [0098.542] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x764e0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll")) returned 0x1d [0098.542] GetModuleInformation (in: hProcess=0x304, hModule=0x74f60000, lpmodinfo=0x23c7430, cb=0xc | out: lpmodinfo=0x23c7430*(lpBaseOfDll=0x74f60000, SizeOfImage=0x80000, EntryPoint=0x74f737c9)) returned 1 [0098.542] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x74f60000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="uxtheme.dll") returned 0xb [0098.543] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x74f60000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\system32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll")) returned 0x1f [0098.543] GetModuleInformation (in: hProcess=0x304, hModule=0x752a0000, lpmodinfo=0x23c953c, cb=0xc | out: lpmodinfo=0x23c953c*(lpBaseOfDll=0x752a0000, SizeOfImage=0x7d000, EntryPoint=0x752a1140)) returned 1 [0098.543] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x752a0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="clrjit.dll") returned 0xa [0098.544] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x752a0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clrjit.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\clrjit.dll")) returned 0x38 [0098.544] GetModuleInformation (in: hProcess=0x304, hModule=0x762b0000, lpmodinfo=0x23cb67c, cb=0xc | out: lpmodinfo=0x23cb67c*(lpBaseOfDll=0x762b0000, SizeOfImage=0x8f000, EntryPoint=0x762b3fb1)) returned 1 [0098.545] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x762b0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="OLEAUT32.dll") returned 0xc [0098.545] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x762b0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\OLEAUT32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll")) returned 0x20 [0098.545] GetModuleInformation (in: hProcess=0x304, hModule=0x736d0000, lpmodinfo=0x23cd790, cb=0xc | out: lpmodinfo=0x23cd790*(lpBaseOfDll=0x736d0000, SizeOfImage=0x9ad000, EntryPoint=0x0)) returned 1 [0098.546] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x736d0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="System.ni.dll") returned 0xd [0098.546] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x736d0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System\\500ffa28b327e171fe664023003e947e\\System.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system\\500ffa28b327e171fe664023003e947e\\system.ni.dll")) returned 0x64 [0098.547] GetModuleInformation (in: hProcess=0x304, hModule=0x71d20000, lpmodinfo=0x23cf92c, cb=0xc | out: lpmodinfo=0x23cf92c*(lpBaseOfDll=0x71d20000, SizeOfImage=0x716000, EntryPoint=0x0)) returned 1 [0098.547] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x71d20000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="System.Core.ni.dll") returned 0x12 [0098.548] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x71d20000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Core\\386fde9190d499d6645df8b90eb76242\\System.Core.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.core\\386fde9190d499d6645df8b90eb76242\\system.core.ni.dll")) returned 0x6e [0098.576] GetModuleInformation (in: hProcess=0x304, hModule=0x750d0000, lpmodinfo=0x23d1ae8, cb=0xc | out: lpmodinfo=0x23d1ae8*(lpBaseOfDll=0x750d0000, SizeOfImage=0x1cb000, EntryPoint=0x0)) returned 1 [0098.576] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x750d0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="Microsoft.VisualBasic.ni.dll") returned 0x1c [0098.576] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x750d0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Microsoft.V9921e851#\\cfbddeb6e93e8f421b92229b20e51233\\Microsoft.VisualBasic.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\microsoft.v9921e851#\\cfbddeb6e93e8f421b92229b20e51233\\microsoft.visualbasic.ni.dll")) returned 0x81 [0098.577] GetModuleInformation (in: hProcess=0x304, hModule=0x750b0000, lpmodinfo=0x23d3cdc, cb=0xc | out: lpmodinfo=0x23d3cdc*(lpBaseOfDll=0x750b0000, SizeOfImage=0x13000, EntryPoint=0x750b18f0)) returned 1 [0098.577] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x750b0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="nlssorting.dll") returned 0xe [0098.578] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x750b0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\nlssorting.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\nlssorting.dll")) returned 0x3c [0098.578] GetModuleInformation (in: hProcess=0x304, hModule=0x74870000, lpmodinfo=0x23d5e2c, cb=0xc | out: lpmodinfo=0x23d5e2c*(lpBaseOfDll=0x74870000, SizeOfImage=0x16000, EntryPoint=0x74872dc3)) returned 1 [0098.579] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x74870000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="CRYPTSP.dll") returned 0xb [0098.579] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x74870000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\system32\\CRYPTSP.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll")) returned 0x1f [0098.580] GetModuleInformation (in: hProcess=0x304, hModule=0x74830000, lpmodinfo=0x23d7f38, cb=0xc | out: lpmodinfo=0x23d7f38*(lpBaseOfDll=0x74830000, SizeOfImage=0x3b000, EntryPoint=0x7483128d)) returned 1 [0098.580] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x74830000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="rsaenh.dll") returned 0xa [0098.580] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x74830000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\system32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll")) returned 0x1e [0098.586] lstrcpynA (in: lpString1=0x498814, lpString2="ms??jF??l???p?lRfLX?Dr??HW?E???w????????yS??S?V????R?WKbjVd???????sG?", iMaxLength=40 | out: lpString1="ms??jF??l???p?lRfLX?Dr??HW?E???w???????") returned="ms??jF??l???p?lRfLX?Dr??HW?E???w???????" [0098.586] lstrcpynA (in: lpString1=0x498828, lpString2="??el?j??k?Rp?V?J?MI??kB?Dw??o?e?D?p?JykUSa????Xh?", iMaxLength=48 | out: lpString1="??el?j??k?Rp?V?J?MI??kB?Dw??o?e?D?p?JykUSa????X") returned="??el?j??k?Rp?V?J?MI??kB?Dw??o?e?D?p?JykUSa????X" [0098.586] lstrcpynA (in: lpString1=0x498840, lpString2="X?LbB??HA???R??G?w?Pw???Mf?", iMaxLength=16 | out: lpString1="X?LbB??HA???R??") returned="X?LbB??HA???R??" [0098.586] lstrcpynA (in: lpString1=0x49884c, lpString2="a???T?B?", iMaxLength=2 | out: lpString1="a") returned="a" [0098.586] lstrcpynA (in: lpString1=0x49884c, lpString2="F?", iMaxLength=1 | out: lpString1="") returned="" [0098.586] lstrcpynA (in: lpString1=0x498820, lpString2="?????Y????S?K?D????????oFja???a?jy??sRt?r????E?E??S???rj??", iMaxLength=29 | out: lpString1="?????Y????S?K?D????????oFja?") returned="?????Y????S?K?D????????oFja?" [0098.586] lstrcpynA (in: lpString1=0x498830, lpString2="tl?N?F???G?i?????dH???G?xEr??x?DI????vX?N?p", iMaxLength=41 | out: lpString1="tl?N?F???G?i?????dH???G?xEr??x?DI????vX?") returned="tl?N?F???G?i?????dH???G?xEr??x?DI????vX?" [0098.587] lstrcpynA (in: lpString1=0x49884c, lpString2="gJu?CJG?h?", iMaxLength=2 | out: lpString1="g") returned="g" [0098.587] lstrcpynA (in: lpString1=0x498838, lpString2="pSB?X?mYu?T??V??K??k?L??F???????", iMaxLength=25 | out: lpString1="pSB?X?mYu?T??V??K??k?L??") returned="pSB?X?mYu?T??V??K??k?L??" [0098.587] lstrcpynA (in: lpString1=0x498824, lpString2="?K????SlQ????OM???B???YB?I?jaF??iVxwd?UuiF???wQm?mcD?", iMaxLength=35 | out: lpString1="?K????SlQ????OM???B???YB?I?jaF??iV") returned="?K????SlQ????OM???B???YB?I?jaF??iV" [0098.587] lstrcpynA (in: lpString1=0x49884c, lpString2="pi?dvo????P", iMaxLength=2 | out: lpString1="p") returned="p" [0098.587] lstrcpynA (in: lpString1=0x49884c, lpString2="vL??T???i???", iMaxLength=2 | out: lpString1="v") returned="v" [0098.587] lstrcpynA (in: lpString1=0x498830, lpString2="?R?t????U???j?dt?ojFeb??lE???b?v????????", iMaxLength=17 | out: lpString1="?R?t????U???j?dt") returned="?R?t????U???j?dt" [0098.587] lstrcpynA (in: lpString1=0x498818, lpString2="?f?hM?la??Z??B?FjZFp??z?GQ?R???E???u?Vg?y???aiOf?nLuMl?d?r?Qj????l?", iMaxLength=39 | out: lpString1="?f?hM?la??Z??B?FjZFp??z?GQ?R???E???u?V") returned="?f?hM?la??Z??B?FjZFp??z?GQ?R???E???u?V" [0098.587] lstrcpynA (in: lpString1=0x49880c, lpString2="?YNyb?W?O?L?DE???z?f????jd?h???X?V??wg?x?M?O?TQ??H?Bg?TsK??std??Q????s???NXdk?", iMaxLength=2 | out: lpString1="?") returned="?" [0098.587] lstrcpynA (in: lpString1=0x498838, lpString2="v??IUyz?CGm?k???p?JAw??i??Dz???r", iMaxLength=7 | out: lpString1="v??IUy") returned="v??IUy" [0098.587] lstrcpynA (in: lpString1=0x49884c, lpString2="o????e??", iMaxLength=4 | out: lpString1="o??") returned="o??" [0098.587] lstrcpynA (in: lpString1=0x49880c, lpString2="S??T??AFe?Z??w???bFM???hy???xf??V???WZ??C?oZ?kk?Xy?I??d??CmwrDz?d?zxzkCA??yf?W", iMaxLength=45 | out: lpString1="S??T??AFe?Z??w???bFM???hy???xf??V???WZ??C?oZ") returned="S??T??AFe?Z??w???bFM???hy???xf??V???WZ??C?oZ" [0098.587] lstrcpynA (in: lpString1=0x498808, lpString2="?jJOT??W??c??pNzIa???R?????????A?m?r??Q?????jbd??????CQG???A??Tt???XHC???LT??iAX?", iMaxLength=68 | out: lpString1="?jJOT??W??c??pNzIa???R?????????A?m?r??Q?????jbd??????CQG???A??Tt???") returned="?jJOT??W??c??pNzIa???R?????????A?m?r??Q?????jbd??????CQG???A??Tt???" [0098.587] lstrcpynA (in: lpString1=0x498818, lpString2="GZQ?L??d??Y???UD??U????l????A??k?K???V???L????O?yolEy?b??pV?ar???g", iMaxLength=59 | out: lpString1="GZQ?L??d??Y???UD??U????l????A??k?K???V???L????O?yolEy?b??p") returned="GZQ?L??d??Y???UD??U????l????A??k?K???V???L????O?yolEy?b??p" [0098.588] lstrcpynA (in: lpString1=0x49880c, lpString2="?I?C?s??z?P??EA?flx???wc??????ab?RZ????fw????d??kEe???zfI????nJO?d?S?Mp?Bo???c?", iMaxLength=55 | out: lpString1="?I?C?s??z?P??EA?flx???wc??????ab?RZ????fw????d??kEe???") returned="?I?C?s??z?P??EA?flx???wc??????ab?RZ????fw????d??kEe???" [0098.588] lstrcpynA (in: lpString1=0x498838, lpString2="X?DU?sU?jt?????AZ?k??z?D?uK?d??M???", iMaxLength=15 | out: lpString1="X?DU?sU?jt????") returned="X?DU?sU?jt????" [0098.588] lstrcpynA (in: lpString1=0x498800, lpString2="W???M??jOt?PiHF?WSwB????JhJh??vj???f?Qd?Z?aBE??akQ?hcCV??H?SYGb????S?Q?emPy??XT?YI???o?zDXG", iMaxLength=46 | out: lpString1="W???M??jOt?PiHF?WSwB????JhJh??vj???f?Qd?Z?aBE") returned="W???M??jOt?PiHF?WSwB????JhJh??vj???f?Qd?Z?aBE" [0098.588] lstrcpynA (in: lpString1=0x49882c, lpString2="u?S??????????J??Ld?i?J??????u?YKN???D??z??oI", iMaxLength=4 | out: lpString1="u?S") returned="u?S" [0098.588] lstrcpynA (in: lpString1=0x49880c, lpString2="???C????RH??l??ycH?tL???G?DDOc????????C?ZP??tyevorf??yB??CoMCjXo?z?KuihS???pA??", iMaxLength=24 | out: lpString1="???C????RH??l??ycH?tL??") returned="???C????RH??l??ycH?tL??" [0098.588] lstrcpynA (in: lpString1=0x498840, lpString2="Ypk??J?????PR????u?je????X", iMaxLength=9 | out: lpString1="Ypk??J??") returned="Ypk??J??" [0098.588] lstrcpynA (in: lpString1=0x498804, lpString2="??Y?h?FmSeg?????Zc?d?T??RJIHtIe?x?yttK??l???r?OU??wx?On?pU????vy??D???NrCx?r?W??pe??U?l", iMaxLength=77 | out: lpString1="??Y?h?FmSeg?????Zc?d?T??RJIHtIe?x?yttK??l???r?OU??wx?On?pU????vy??D???NrCx?r") returned="??Y?h?FmSeg?????Zc?d?T??RJIHtIe?x?yttK??l???r?OU??wx?On?pU????vy??D???NrCx?r" [0098.588] lstrcpynA (in: lpString1=0x4987fc, lpString2="??e?x????cA??e??GGc??O???M??lOM????UZP????V??Q??Ip??T?g??Dc????U????F?Lu??gE?D???y?a??OH?mVogi?", iMaxLength=87 | out: lpString1="??e?x????cA??e??GGc??O???M??lOM????UZP????V??Q??Ip??T?g??Dc????U????F?Lu??gE?D???y?a??") returned="??e?x????cA??e??GGc??O???M??lOM????UZP????V??Q??Ip??T?g??Dc????U????F?Lu??gE?D???y?a??" [0098.588] lstrcpynA (in: lpString1=0x498808, lpString2="?H?W?????????C???MX?????hPA???bg???g???Z????????Va???G????dUZ???Y??y??ie?eo?????B?", iMaxLength=42 | out: lpString1="?H?W?????????C???MX?????hPA???bg???g???Z?") returned="?H?W?????????C???MX?????hPA???bg???g???Z?" [0098.588] lstrcpynA (in: lpString1=0x498814, lpString2="XX?VIu??w?M??W??b?r???Iu?n????Au??KM?oPeP?ez??e?????Cz??g??alg?T?XTi?GD", iMaxLength=10 | out: lpString1="XX?VIu??w") returned="XX?VIu??w" [0098.589] lstrcpynA (in: lpString1=0x498820, lpString2="a?g??bl?YO?????DtGQ?vs??s???KTSzX???????wE?????EcrO?AlL??", iMaxLength=31 | out: lpString1="a?g??bl?YO?????DtGQ?vs??s???KT") returned="a?g??bl?YO?????DtGQ?vs??s???KT" [0098.589] lstrcpynA (in: lpString1=0x498840, lpString2="U?w??R?z?FgNF?????G???G?", iMaxLength=13 | out: lpString1="U?w??R?z?FgN") returned="U?w??R?z?FgN" [0098.589] lstrcpynA (in: lpString1=0x498844, lpString2="?u???????????a??cJ?PNB", iMaxLength=4 | out: lpString1="?u?") returned="?u?" [0098.589] lstrcpynA (in: lpString1=0x498840, lpString2="??zy??w???????gQu?s?d?W??z?", iMaxLength=25 | out: lpString1="??zy??w???????gQu?s?d?W?") returned="??zy??w???????gQu?s?d?W?" [0098.589] lstrcpynA (in: lpString1=0x498800, lpString2="?D?hx?????a?????OvnLG?Ix?F?RO?o?E?KGm????UcGetV?U???????yPQ?oWEbBzHiMx??E??o??l?????hAHLm", iMaxLength=63 | out: lpString1="?D?hx?????a?????OvnLG?Ix?F?RO?o?E?KGm????UcGetV?U???????yPQ?oW") returned="?D?hx?????a?????OvnLG?Ix?F?RO?o?E?KGm????UcGetV?U???????yPQ?oW" [0098.589] lstrcpynA (in: lpString1=0x498838, lpString2="f?Gy????JCfe??ri??dlJ?VTMpg??????Z", iMaxLength=5 | out: lpString1="f?Gy") returned="f?Gy" [0098.589] lstrcpynA (in: lpString1=0x49884c, lpString2="?rP", iMaxLength=1 | out: lpString1="") returned="" [0098.589] lstrcpynA (in: lpString1=0x498804, lpString2="?R?DS??n??bxa???u???E??Zi??Pa?xHzZ??S??hw??V??ZN?mT?u??F?CY?YBh???e??a??yZ???p?Tnt????P", iMaxLength=52 | out: lpString1="?R?DS??n??bxa???u???E??Zi??Pa?xHzZ??S??hw??V??ZN?mT") returned="?R?DS??n??bxa???u???E??Zi??Pa?xHzZ??S??hw??V??ZN?mT" [0098.589] lstrcpynA (in: lpString1=0x49884c, lpString2="?Q????", iMaxLength=5 | out: lpString1="?Q??") returned="?Q??" [0098.589] lstrcpynA (in: lpString1=0x49880c, lpString2="????????i???e?W?TAh?V??t?Gf?ay??K????k?Q????J?nZ??U???K???kHHh?r?Q??e?agV???Tw?", iMaxLength=49 | out: lpString1="????????i???e?W?TAh?V??t?Gf?ay??K????k?Q????J?nZ") returned="????????i???e?W?TAh?V??t?Gf?ay??K????k?Q????J?nZ" [0098.589] lstrcpynA (in: lpString1=0x498800, lpString2="C?z??d??l???????kL?L??zc???????Q?QCR?Q??Q??g?yL??A?E?G????BxMS?z?FEP?B???ml??yS?U????O?IR?", iMaxLength=58 | out: lpString1="C?z??d??l???????kL?L??zc???????Q?QCR?Q??Q??g?yL??A?E?G???") returned="C?z??d??l???????kL?L??zc???????Q?QCR?Q??Q??g?yL??A?E?G???" [0098.589] lstrcpynA (in: lpString1=0x49881c, lpString2="w?l????aHlX??Tbrl?????BA?c??u??ghwnE??Z??v??k???aQ?ph??X??d?", iMaxLength=56 | out: lpString1="w?l????aHlX??Tbrl?????BA?c??u??ghwnE??Z??v??k???aQ?ph??") returned="w?l????aHlX??Tbrl?????BA?c??u??ghwnE??Z??v??k???aQ?ph??" [0098.590] lstrcpynA (in: lpString1=0x49882c, lpString2="KI??u?WYc?k?k?x??d??N??mP???????lwK?VtMh?v?T?wR", iMaxLength=38 | out: lpString1="KI??u?WYc?k?k?x??d??N??mP???????lwK?V") returned="KI??u?WYc?k?k?x??d??N??mP???????lwK?V" [0098.590] lstrcpynA (in: lpString1=0x4987fc, lpString2="??Qy?OTDEnU?TeW?kSAZ????R??MO??U??e?????l?b????E??f?K??cmX????y?Y??I?U?c??W???d?c???????????c?", iMaxLength=2 | out: lpString1="?") returned="?" [0098.590] lstrcpynA (in: lpString1=0x498824, lpString2="???HRY???????ZOT?i?nm?sC?z?a????k?zL??R?w??Y??hHE?x?N", iMaxLength=24 | out: lpString1="???HRY???????ZOT?i?nm?s") returned="???HRY???????ZOT?i?nm?s" [0098.590] lstrcpynA (in: lpString1=0x49881c, lpString2="F?a???d????Q????Ub?Q???tx?p?????S??mx?R??GdZGjD?SzlY?????u????c", iMaxLength=21 | out: lpString1="F?a???d????Q????Ub?Q") returned="F?a???d????Q????Ub?Q" [0098.590] lstrcpynA (in: lpString1=0x498800, lpString2="x???L?a??C??y??I?AB?????gFF??z??xQz????A??ANUJ?XRQ?tCbQmJc?u?G?F????Jk?o?fV??nv???????z???g", iMaxLength=45 | out: lpString1="x???L?a??C??y??I?AB?????gFF??z??xQz????A??AN") returned="x???L?a??C??y??I?AB?????gFF??z??xQz????A??AN" [0098.590] lstrcpynA (in: lpString1=0x498814, lpString2="mg??L??tf???P?B?l??E??e?????Vrgp?Cb??C??f?ZjyR?v?L??Q?tKdm??O??a??????", iMaxLength=62 | out: lpString1="mg??L??tf???P?B?l??E??e?????Vrgp?Cb??C??f?ZjyR?v?L??Q?tKdm??O") returned="mg??L??tf???P?B?l??E??e?????Vrgp?Cb??C??f?ZjyR?v?L??Q?tKdm??O" [0098.590] lstrcpynA (in: lpString1=0x498804, lpString2="h??????HEyo??PK????c?WOA???????mFKKU?Q?Y????e??X??kMR?E??kRhd??Z??U??s?K?WB???P??k???", iMaxLength=4 | out: lpString1="h??") returned="h??" [0098.590] lstrcpynA (in: lpString1=0x49884c, lpString2="????Kx?vTrx?h?", iMaxLength=6 | out: lpString1="????K") returned="????K" [0098.590] lstrcpynA (in: lpString1=0x498828, lpString2="r??S???k???????G?IzX?o??F?hf??et?????li??QmZO??I", iMaxLength=33 | out: lpString1="r??S???k???????G?IzX?o??F?hf??et") returned="r??S???k???????G?IzX?o??F?hf??et" [0098.590] lstrcpynA (in: lpString1=0x49884c, lpString2="?Z??wo?o?COU???", iMaxLength=14 | out: lpString1="?Z??wo?o?COU?") returned="?Z??wo?o?COU?" [0098.590] lstrcpynA (in: lpString1=0x49880c, lpString2="AQR?L?vb?x?Vp??J?????c?vi???B??H?w??V??g??m???m???WU?BYjWo???T?????p???ax????", iMaxLength=8 | out: lpString1="AQR?L?v") returned="AQR?L?v" [0098.591] lstrcpynA (in: lpString1=0x498814, lpString2="HH??ICd???H?im?dEIZdk???kdp??xj??????CDs?DCR??g?K????????KBvF?hX???D??R", iMaxLength=59 | out: lpString1="HH??ICd???H?im?dEIZdk???kdp??xj??????CDs?DCR??g?K????????K") returned="HH??ICd???H?im?dEIZdk???kdp??xj??????CDs?DCR??g?K????????K" [0098.591] lstrcpynA (in: lpString1=0x49883c, lpString2="?nX???Vga?D??z?v??k?vbe??????O?", iMaxLength=26 | out: lpString1="?nX???Vga?D??z?v??k?vbe??") returned="?nX???Vga?D??z?v??k?vbe??" [0098.591] lstrcpynA (in: lpString1=0x498810, lpString2="?SV?b??u?E??z??????h?b???bBV???vnVI?ob???lo?m??hW?rud?jF???w?pTL??????????N", iMaxLength=35 | out: lpString1="?SV?b??u?E??z??????h?b???bBV???vnV") returned="?SV?b??u?E??z??????h?b???bBV???vnV" [0098.591] lstrcpynA (in: lpString1=0x498810, lpString2="??OvU?Bs?I?T?I?G?????v????KxXs?bH???n???H????HfL?J????f?????cR??????J?j???", iMaxLength=24 | out: lpString1="??OvU?Bs?I?T?I?G?????v?") returned="??OvU?Bs?I?T?I?G?????v?" [0098.591] lstrcpynA (in: lpString1=0x498830, lpString2="?U??EyIf???g??D??f?C???We?Qp??U??T?O?ce?A?", iMaxLength=1 | out: lpString1="") returned="" [0098.591] lstrcpynA (in: lpString1=0x498840, lpString2="??CVnmD??r?????m?z?????y?", iMaxLength=12 | out: lpString1="??CVnmD??r?") returned="??CVnmD??r?" [0098.591] lstrcpynA (in: lpString1=0x49884c, lpString2="J?P?????WL", iMaxLength=1 | out: lpString1="") returned="" [0098.591] lstrcpynA (in: lpString1=0x498814, lpString2="??ObQ?dt????biK??gc?bj??muY?R?N??????U?AwDu?St??P????k?????x???uW?pLT?", iMaxLength=14 | out: lpString1="??ObQ?dt????b") returned="??ObQ?dt????b" [0098.591] lstrcpynA (in: lpString1=0x498804, lpString2="??a?nc??E?k???Sg??O?????B??xR?Lv?????a????Sf??c?ijv?x?jWFa??QF??P???o???h?t?jNs??VffS?r", iMaxLength=14 | out: lpString1="??a?nc??E?k??") returned="??a?nc??E?k??" [0098.591] lstrcpynA (in: lpString1=0x49883c, lpString2="??e?FI????O?K??L??nd???s?QVNN?", iMaxLength=19 | out: lpString1="??e?FI????O?K??L??") returned="??e?FI????O?K??L??" [0098.591] lstrcpynA (in: lpString1=0x498830, lpString2="w?f?????k?x?????F?UhZ????g?kLeA?????U???", iMaxLength=22 | out: lpString1="w?f?????k?x?????F?UhZ") returned="w?f?????k?x?????F?UhZ" [0098.591] lstrcpynA (in: lpString1=0x49884c, lpString2="???", iMaxLength=2 | out: lpString1="?") returned="?" [0098.591] lstrcpynA (in: lpString1=0x49881c, lpString2="?k?e?tvf??VEjMOO???Q????d??w???Z?VS???k?a?Q?ji?????o??ulBh??", iMaxLength=12 | out: lpString1="?k?e?tvf??V") returned="?k?e?tvf??V" [0098.592] lstrcpynA (in: lpString1=0x4987fc, lpString2="?t??g?H??bk????y?TZG????JzS?iG???U?dY??oQ?F??x????????r??yJ?E??Z?WXGuH???She??cb??kv??h?R??W???", iMaxLength=65 | out: lpString1="?t??g?H??bk????y?TZG????JzS?iG???U?dY??oQ?F??x????????r??yJ?E??Z") returned="?t??g?H??bk????y?TZG????JzS?iG???U?dY??oQ?F??x????????r??yJ?E??Z" [0098.592] lstrcpynA (in: lpString1=0x49884c, lpString2="G", iMaxLength=1 | out: lpString1="") returned="" [0098.592] lstrcpynA (in: lpString1=0x498838, lpString2="d?k??e???zDXZ??id?dg??HI?M????BM", iMaxLength=14 | out: lpString1="d?k??e???zDXZ") returned="d?k??e???zDXZ" [0098.592] lstrcpynA (in: lpString1=0x498818, lpString2="???E??K?cNP?p?EesP?????Iz??r?????W??????c?dokT???CGhE?l???p?QG?P?", iMaxLength=47 | out: lpString1="???E??K?cNP?p?EesP?????Iz??r?????W??????c?dokT") returned="???E??K?cNP?p?EesP?????Iz??r?????W??????c?dokT" [0098.592] lstrcpynA (in: lpString1=0x498834, lpString2="?cW??L???k?L?BD??D?p??b?o??x??Vk???Q", iMaxLength=4 | out: lpString1="?cW") returned="?cW" [0098.592] lstrcpynA (in: lpString1=0x498848, lpString2="????cnX?X??Xx?Kt", iMaxLength=15 | out: lpString1="????cnX?X??Xx?") returned="????cnX?X??Xx?" [0098.592] lstrcpynA (in: lpString1=0x49883c, lpString2="?M?A???Y?dNJ???k????k??u?e??n", iMaxLength=23 | out: lpString1="?M?A???Y?dNJ???k????k?") returned="?M?A???Y?dNJ???k????k?" [0098.592] lstrcpynA (in: lpString1=0x498800, lpString2="j?d???V?hSODY?LWQuU??k???F???i?????cNY??vKe???????????z??N?ku??p?N???n???D?Hjybv?vvxpa??", iMaxLength=28 | out: lpString1="j?d???V?hSODY?LWQuU??k???F?") returned="j?d???V?hSODY?LWQuU??k???F?" [0098.592] lstrcpynA (in: lpString1=0x49884c, lpString2="O", iMaxLength=1 | out: lpString1="") returned="" [0098.592] lstrcpynA (in: lpString1=0x498810, lpString2="?suz??X?tv?x???W??????B????w??bBs?b?lt?J?Su?R???T???yfE??????ZoJ?mpz??a?", iMaxLength=57 | out: lpString1="?suz??X?tv?x???W??????B????w??bBs?b?lt?J?Su?R???T???yfE?") returned="?suz??X?tv?x???W??????B????w??bBs?b?lt?J?Su?R???T???yfE?" [0098.592] lstrcpynA (in: lpString1=0x498848, lpString2="??O????rzGZ?CTI??", iMaxLength=5 | out: lpString1="??O?") returned="??O?" [0098.592] lstrcpynA (in: lpString1=0x498840, lpString2="??t?HOU??i??o?km????yn??s", iMaxLength=19 | out: lpString1="??t?HOU??i??o?km??") returned="??t?HOU??i??o?km??" [0098.593] lstrcpynA (in: lpString1=0x498830, lpString2="Y?uY?Y?Tk???DXO??FYkM????n?Tn????Y???cl????", iMaxLength=38 | out: lpString1="Y?uY?Y?Tk???DXO??FYkM????n?Tn????Y???") returned="Y?uY?Y?Tk???DXO??FYkM????n?Tn????Y???" [0098.593] lstrcpynA (in: lpString1=0x498814, lpString2="?H??Nk????????Ki?e??o??JJc???m?E????Qiz?rUe???M?l?y??Y????bR???Y?A?mg??", iMaxLength=33 | out: lpString1="?H??Nk????????Ki?e??o??JJc???m?E") returned="?H??Nk????????Ki?e??o??JJc???m?E" [0098.593] lstrcpynA (in: lpString1=0x498804, lpString2="???B?????ct?D??A???ls?????Q??o?e?Z?w?v?????a???KGzQ????tke???????rO?w??BJCz???lpx?????o", iMaxLength=50 | out: lpString1="???B?????ct?D??A???ls?????Q??o?e?Z?w?v?????a???KG") returned="???B?????ct?D??A???ls?????Q??o?e?Z?w?v?????a???KG" [0098.593] lstrcpynA (in: lpString1=0x498804, lpString2="?C??b?X??Y?K???E??zv?????DU????Fv?or?V???vK????yi???M?Z???F?X????Sc?B??h?v?O??RxNE??N?", iMaxLength=77 | out: lpString1="?C??b?X??Y?K???E??zv?????DU????Fv?or?V???vK????yi???M?Z???F?X????Sc?B??h?v?O") returned="?C??b?X??Y?K???E??zv?????DU????Fv?or?V???vK????yi???M?Z???F?X????Sc?B??h?v?O" [0098.593] lstrcpynA (in: lpString1=0x49883c, lpString2="F?as??J?UbAm?UYXaR?sT??zMzd?X?B", iMaxLength=20 | out: lpString1="F?as??J?UbAm?UYXaR?") returned="F?as??J?UbAm?UYXaR?" [0098.593] lstrcpynA (in: lpString1=0x49882c, lpString2="?y??????i?Q?G?y???Bi?L??V??l???u???JB??xPz?A", iMaxLength=10 | out: lpString1="?y??????i") returned="?y??????i" [0098.593] lstrcpynA (in: lpString1=0x498840, lpString2="J????i?hgwnK??eOcxd???Ke?T", iMaxLength=19 | out: lpString1="J????i?hgwnK??eOcx") returned="J????i?hgwnK??eOcx" [0098.593] lstrcpynA (in: lpString1=0x49881c, lpString2="???v????S???EVN???kWhuMTK???R?P?T??D?IeYO????RM??n?RR??XM??fT", iMaxLength=14 | out: lpString1="???v????S???E") returned="???v????S???E" [0098.593] lstrcpynA (in: lpString1=0x498848, lpString2="NL??ftC????b??gE", iMaxLength=8 | out: lpString1="NL??ftC") returned="NL??ftC" [0098.593] lstrcpynA (in: lpString1=0x498800, lpString2="iY?tz????wour?j??f?xz?K??n?????uX?fx???mk?????xS?R?B???O??v?T??tIe?dL?gwBYtWc??TySL?FPG?x?U", iMaxLength=76 | out: lpString1="iY?tz????wour?j??f?xz?K??n?????uX?fx???mk?????xS?R?B???O??v?T??tIe?dL?gwBYt") returned="iY?tz????wour?j??f?xz?K??n?????uX?fx???mk?????xS?R?B???O??v?T??tIe?dL?gwBYt" [0098.593] lstrcpynA (in: lpString1=0x4987f8, lpString2="cz????o??h?wM??fCa????D???j???U??P?o???S?L?S?O????????t????c?jL??yAk????f????e????O?????UYE?A???", iMaxLength=1 | out: lpString1="") returned="" [0098.594] lstrcpynA (in: lpString1=0x49880c, lpString2="???vWK????????VH??uDkB??m?vAsh???h?e?d????y??B?XZz???j??????cF????Y?nX?????m", iMaxLength=29 | out: lpString1="???vWK????????VH??uDkB??m?vA") returned="???vWK????????VH??uDkB??m?vA" [0098.594] lstrcpynA (in: lpString1=0x49880c, lpString2="????jptV?kg?hdI?yS??l?b??E?Y?Vv??c?XV?????FiI???A?cov?????K????s?Oa???hs?t?P?j?", iMaxLength=59 | out: lpString1="????jptV?kg?hdI?yS??l?b??E?Y?Vv??c?XV?????FiI???A?cov?????") returned="????jptV?kg?hdI?yS??l?b??E?Y?Vv??c?XV?????FiI???A?cov?????" [0098.594] lstrcpynA (in: lpString1=0x4987fc, lpString2="?Wg?t??????JdgRd???DB?aDz?GY?Q?U??????uC?a??u??cXt?r????l??ob?GT?V?OkXYF?U?Fl?I?Hz?B??FEYe?ux?n", iMaxLength=27 | out: lpString1="?Wg?t??????JdgRd???DB?aDz?") returned="?Wg?t??????JdgRd???DB?aDz?" [0098.594] lstrcpynA (in: lpString1=0x498820, lpString2="?wDyw?ZF??n?????t???JpBrh?Qx?pA?????th??gY?Konf?vUx???n?", iMaxLength=32 | out: lpString1="?wDyw?ZF??n?????t???JpBrh?Qx?pA") returned="?wDyw?ZF??n?????t???JpBrh?Qx?pA" [0098.594] lstrcpynA (in: lpString1=0x49883c, lpString2="?Q????u??????Y?sCi?????N???h?a?", iMaxLength=22 | out: lpString1="?Q????u??????Y?sCi???") returned="?Q????u??????Y?sCi???" [0098.594] lstrcpynA (in: lpString1=0x49884c, lpString2="??p??z????Y?", iMaxLength=6 | out: lpString1="??p??") returned="??p??" [0098.594] lstrcpynA (in: lpString1=0x498848, lpString2="?H???En?????????", iMaxLength=3 | out: lpString1="?H") returned="?H" [0098.594] lstrcpynA (in: lpString1=0x49882c, lpString2="FR??peI???Eg??ZLW?Y?NZ??E??g???XI??U?Q???KuD??", iMaxLength=6 | out: lpString1="FR??p") returned="FR??p" [0098.594] lstrcpynA (in: lpString1=0x498820, lpString2="?P?ot?X??Jgzvo???rff?evB?oF?iN?y?ah??Q???w?O??v????d?auMf", iMaxLength=27 | out: lpString1="?P?ot?X??Jgzvo???rff?evB?o") returned="?P?ot?X??Jgzvo???rff?evB?o" [0098.594] lstrcpynA (in: lpString1=0x49881c, lpString2="??d?aEd?QG?CWW?A????H?D??O?y??y??Tem????auDXK????hm??sY???O?C", iMaxLength=4 | out: lpString1="??d") returned="??d" [0098.594] lstrcpynA (in: lpString1=0x49883c, lpString2="???mA?ZoG?P??a?????EIZ??j??W?l", iMaxLength=1 | out: lpString1="") returned="" [0098.594] lstrcpynA (in: lpString1=0x49884c, lpString2="????mB??gO", iMaxLength=9 | out: lpString1="????mB??") returned="????mB??" [0098.595] lstrcpynA (in: lpString1=0x498820, lpString2="?rB???rKc?a??lQv??f???WGPjV?YUy?nX????awpE??????????f?a?", iMaxLength=44 | out: lpString1="?rB???rKc?a??lQv??f???WGPjV?YUy?nX????awpE?") returned="?rB???rKc?a??lQv??f???WGPjV?YUy?nX????awpE?" [0098.595] lstrcpynA (in: lpString1=0x498820, lpString2="jMd??xJJBX?ANd?Ep?????fF????Aay?m???j??XOPRp?mee???jO?fXD", iMaxLength=44 | out: lpString1="jMd??xJJBX?ANd?Ep?????fF????Aay?m???j??XOPR") returned="jMd??xJJBX?ANd?Ep?????fF????Aay?m???j??XOPR" [0098.595] lstrcpynA (in: lpString1=0x498834, lpString2="?uFJ?s?WjfbrXHx?y????????H?C?AJ?Ot?T", iMaxLength=33 | out: lpString1="?uFJ?s?WjfbrXHx?y????????H?C?AJ?") returned="?uFJ?s?WjfbrXHx?y????????H?C?AJ?" [0098.595] lstrcpynA (in: lpString1=0x49884c, lpString2="d???Lf?R??O?", iMaxLength=7 | out: lpString1="d???Lf") returned="d???Lf" [0098.595] lstrcpynA (in: lpString1=0x498840, lpString2="???????????K???SmB?e??h??H", iMaxLength=12 | out: lpString1="???????????") returned="???????????" [0098.595] lstrcpynA (in: lpString1=0x49882c, lpString2="h??v?sYb??t???Z?GtD??cO??????hux?IHn??E?ur????", iMaxLength=34 | out: lpString1="h??v?sYb??t???Z?GtD??cO??????hux?") returned="h??v?sYb??t???Z?GtD??cO??????hux?" [0098.595] lstrcpynA (in: lpString1=0x4987fc, lpString2="eMRu??E???Z?b???l??c??????ZX??f?Eog????X?weBdM?OJg?y?WSX?Cjf??Dp??KhZ??XbzQ??J???dt??o?e?????", iMaxLength=38 | out: lpString1="eMRu??E???Z?b???l??c??????ZX??f?Eog??") returned="eMRu??E???Z?b???l??c??????ZX??f?Eog??" [0098.595] lstrcpynA (in: lpString1=0x498814, lpString2="??vo??McI??e??O??Y???d?dJK??B??Dd????Vjb?I?mP?i????jJA??ia?FW???ic??", iMaxLength=8 | out: lpString1="??vo??M") returned="??vo??M" [0098.595] lstrcpynA (in: lpString1=0x498840, lpString2="jUQ?VN?JS?P?????f??????g", iMaxLength=13 | out: lpString1="jUQ?VN?JS?P?") returned="jUQ?VN?JS?P?" [0098.595] lstrcpynA (in: lpString1=0x49884c, lpString2="aI?t???aaEB?", iMaxLength=4 | out: lpString1="aI?") returned="aI?" [0098.595] lstrcpynA (in: lpString1=0x498828, lpString2="xv?Xmg?Iy??DAdyEU?Iy?U?i????C?vJ???H???????jb???bcH", iMaxLength=31 | out: lpString1="xv?Xmg?Iy??DAdyEU?Iy?U?i????C?") returned="xv?Xmg?Iy??DAdyEU?Iy?U?i????C?" [0098.596] lstrcpynA (in: lpString1=0x49881c, lpString2="?L??FC??iMx??l????SVGI???d??W??A??u??t??????rk???Z????Y????W?", iMaxLength=7 | out: lpString1="?L??FC") returned="?L??FC" [0098.596] lstrcpynA (in: lpString1=0x498804, lpString2="??wd?e?n???H???c?c????Y?MY?UG??y??zN???KJ????T???i????gA?N??tn?????z?BRbX?Ng?I?v?eKIj?", iMaxLength=20 | out: lpString1="??wd?e?n???H???c?c?") returned="??wd?e?n???H???c?c?" [0098.596] lstrcpynA (in: lpString1=0x498804, lpString2="??iSGl?kh?V?I????Fnw?z???e???iX???M?jahIGBz???????T???d?y?CDAvBp?Ng?uiN?m??Dw???I?fl?", iMaxLength=43 | out: lpString1="??iSGl?kh?V?I????Fnw?z???e???iX???M?jahIGB") returned="??iSGl?kh?V?I????Fnw?z???e???iX???M?jahIGB" [0098.596] lstrcpynA (in: lpString1=0x498810, lpString2="??????z?aBG?I?Bj???u?????yJpYIohL?NF??C??D?tKpwf?r??????h?n??a??HQ??CaYr", iMaxLength=20 | out: lpString1="??????z?aBG?I?Bj???") returned="??????z?aBG?I?Bj???" [0098.596] lstrcpynA (in: lpString1=0x49882c, lpString2="???XyRZRIR????mc??FC?g?l????????j???b??J???f?", iMaxLength=36 | out: lpString1="???XyRZRIR????mc??FC?g?l????????j??") returned="???XyRZRIR????mc??FC?g?l????????j??" [0098.596] lstrcpynA (in: lpString1=0x498804, lpString2="a???k???H?????A???Y???????h??????????Y??f??wj???nV?T?rEd???N?vS?t??i????????k??l?jXl??l", iMaxLength=79 | out: lpString1="a???k???H?????A???Y???????h??????????Y??f??wj???nV?T?rEd???N?vS?t??i????????k?") returned="a???k???H?????A???Y???????h??????????Y??f??wj???nV?T?rEd???N?vS?t??i????????k?" [0098.596] lstrcpynA (in: lpString1=0x498804, lpString2="m????L??QQ?zB?U??XO???H???zc????R???????l???????C?R?n??OC?Hjm????P??s??R???hJB??????", iMaxLength=43 | out: lpString1="m????L??QQ?zB?U??XO???H???zc????R???????l?") returned="m????L??QQ?zB?U??XO???H???zc????R???????l?" [0098.596] lstrcpynA (in: lpString1=0x49881c, lpString2="eYZpA?GFFfC?i?B?sw??????W?D?y??J?I??s??hZ??Tri?SE???G??QGC??R?O", iMaxLength=37 | out: lpString1="eYZpA?GFFfC?i?B?sw??????W?D?y??J?I??") returned="eYZpA?GFFfC?i?B?sw??????W?D?y??J?I??" [0098.596] lstrcpynA (in: lpString1=0x498814, lpString2="?t???o?sFw??cbwSbkNrp?R???L??vms?J?O?ez????Q?N?KE?sM?r?A?gl????k????V", iMaxLength=49 | out: lpString1="?t???o?sFw??cbwSbkNrp?R???L??vms?J?O?ez????Q?N?K") returned="?t???o?sFw??cbwSbkNrp?R???L??vms?J?O?ez????Q?N?K" [0098.597] lstrcpynA (in: lpString1=0x4987f8, lpString2="?ZI?r?Tke?hs?J?????????OFNdM????????DS?A???vKirmto?mlD?W??????OigFcS?DBl?Q?rp??IV?C?eA????iF?x?an?", iMaxLength=8 | out: lpString1="?ZI?r?T") returned="?ZI?r?T" [0098.597] lstrcpynA (in: lpString1=0x498814, lpString2="??????JMl?aJv?V?y???DaUa????????V?Y?kW??W?KsTA?????UHIL?M?P?A???Bn????", iMaxLength=26 | out: lpString1="??????JMl?aJv?V?y???DaUa?") returned="??????JMl?aJv?V?y???DaUa?" [0098.597] lstrcpynA (in: lpString1=0x4987f8, lpString2="J??c?x??mj?Y?jD?T???C????uJ?b?S?AL???T?jSMT??l??k????y???y???p?T?d?km???????????K?JL???U?S????DR?", iMaxLength=1 | out: lpString1="") returned="" [0098.597] lstrcpynA (in: lpString1=0x498848, lpString2="??B???sB?fXb?BY?O?I", iMaxLength=4 | out: lpString1="??B") returned="??B" [0098.597] lstrcpynA (in: lpString1=0x498800, lpString2="?zE??Jv??gF????u???vnK???o??RX??v???mt?oN??p??S????V?z????ZC??EZ???R????x?????h??????d?tw?", iMaxLength=14 | out: lpString1="?zE??Jv??gF??") returned="?zE??Jv??gF??" [0098.597] lstrcpynA (in: lpString1=0x498844, lpString2="E?KW???oUy?hEoCd?pF??u", iMaxLength=1 | out: lpString1="") returned="" [0098.597] lstrcpynA (in: lpString1=0x498828, lpString2="c?R??s???tW?yA??????????waVv?v?????F??N?bO?K?Ftr??", iMaxLength=27 | out: lpString1="c?R??s???tW?yA??????????wa") returned="c?R??s???tW?yA??????????wa" [0098.597] lstrcpynA (in: lpString1=0x49884c, lpString2="???F????ZH", iMaxLength=3 | out: lpString1="??") returned="??" [0098.597] lstrcpynA (in: lpString1=0x49884c, lpString2="????n?L", iMaxLength=4 | out: lpString1="???") returned="???" [0098.597] lstrcpynA (in: lpString1=0x49884c, lpString2="?uX??", iMaxLength=3 | out: lpString1="?u") returned="?u" [0098.597] lstrcpynA (in: lpString1=0x49882c, lpString2="DoG???d??zuAK?H?d?cs?p??O??It??w????AL?P????n", iMaxLength=33 | out: lpString1="DoG???d??zuAK?H?d?cs?p??O??It??w") returned="DoG???d??zuAK?H?d?cs?p??O??It??w" [0098.597] lstrcpynA (in: lpString1=0x49884c, lpString2="???j?", iMaxLength=3 | out: lpString1="??") returned="??" [0098.598] lstrcpynA (in: lpString1=0x49881c, lpString2="vtV?Ng?yB?Q?????I?V????CEhO??A??u?v??????xAN?PX?cTO???a?Ke?P?", iMaxLength=44 | out: lpString1="vtV?Ng?yB?Q?????I?V????CEhO??A??u?v??????xA") returned="vtV?Ng?yB?Q?????I?V????CEhO??A??u?v??????xA" [0098.600] lstrcmpiA (lpString1="ms??jF??l???p?lRfLX?Dr??HW?E???w???????39", lpString2="??el?j??k?Rp?V?J?MI??kB?Dw??o?e?D?p?JykUSa????X47") returned 1 [0098.600] lstrcmpiA (lpString1="??el?j??k?Rp?V?J?MI??kB?Dw??o?e?D?p?JykUSa????X47", lpString2="X?LbB??HA???R??15") returned -1 [0098.600] lstrcmpiA (lpString1="X?LbB??HA???R??15", lpString2="a1") returned 1 [0098.600] lstrcmpiA (lpString1="a1", lpString2="0") returned 1 [0098.600] lstrcmpiA (lpString1="0", lpString2="?????Y????S?K?D????????oFja?28") returned 1 [0098.600] lstrcmpiA (lpString1="?????Y????S?K?D????????oFja?28", lpString2="tl?N?F???G?i?????dH???G?xEr??x?DI????vX?40") returned -1 [0098.600] lstrcmpiA (lpString1="tl?N?F???G?i?????dH???G?xEr??x?DI????vX?40", lpString2="g1") returned 1 [0098.600] lstrcmpiA (lpString1="g1", lpString2="pSB?X?mYu?T??V??K??k?L??24") returned -1 [0098.600] lstrcmpiA (lpString1="pSB?X?mYu?T??V??K??k?L??24", lpString2="?K????SlQ????OM???B???YB?I?jaF??iV34") returned 1 [0098.600] lstrcmpiA (lpString1="?K????SlQ????OM???B???YB?I?jaF??iV34", lpString2="p1") returned -1 [0098.600] lstrcmpiA (lpString1="p1", lpString2="v1") returned -1 [0098.600] lstrcmpiA (lpString1="v1", lpString2="?R?t????U???j?dt16") returned 1 [0098.600] lstrcmpiA (lpString1="?R?t????U???j?dt16", lpString2="?f?hM?la??Z??B?FjZFp??z?GQ?R???E???u?V38") returned 1 [0098.600] lstrcmpiA (lpString1="?f?hM?la??Z??B?FjZFp??z?GQ?R???E???u?V38", lpString2="?1") returned 1 [0098.600] lstrcmpiA (lpString1="?1", lpString2="v??IUy6") returned -1 [0098.600] lstrcmpiA (lpString1="v??IUy6", lpString2="o??3") returned 1 [0098.600] lstrcmpiA (lpString1="o??3", lpString2="S??T??AFe?Z??w???bFM???hy???xf??V???WZ??C?oZ44") returned -1 [0098.600] lstrcmpiA (lpString1="S??T??AFe?Z??w???bFM???hy???xf??V???WZ??C?oZ44", lpString2="?jJOT??W??c??pNzIa???R?????????A?m?r??Q?????jbd??????CQG???A??Tt???67") returned 1 [0098.600] lstrcmpiA (lpString1="?jJOT??W??c??pNzIa???R?????????A?m?r??Q?????jbd??????CQG???A??Tt???67", lpString2="GZQ?L??d??Y???UD??U????l????A??k?K???V???L????O?yolEy?b??p58") returned -1 [0098.601] lstrcmpiA (lpString1="GZQ?L??d??Y???UD??U????l????A??k?K???V???L????O?yolEy?b??p58", lpString2="?I?C?s??z?P??EA?flx???wc??????ab?RZ????fw????d??kEe???54") returned 1 [0098.601] lstrcmpiA (lpString1="?I?C?s??z?P??EA?flx???wc??????ab?RZ????fw????d??kEe???54", lpString2="X?DU?sU?jt????14") returned -1 [0098.601] lstrcmpiA (lpString1="X?DU?sU?jt????14", lpString2="W???M??jOt?PiHF?WSwB????JhJh??vj???f?Qd?Z?aBE45") returned 1 [0098.601] lstrcmpiA (lpString1="W???M??jOt?PiHF?WSwB????JhJh??vj???f?Qd?Z?aBE45", lpString2="u?S3") returned 1 [0098.601] lstrcmpiA (lpString1="u?S3", lpString2="???C????RH??l??ycH?tL??23") returned 1 [0098.601] lstrcmpiA (lpString1="???C????RH??l??ycH?tL??23", lpString2="Ypk??J??8") returned -1 [0098.601] lstrcmpiA (lpString1="Ypk??J??8", lpString2="??Y?h?FmSeg?????Zc?d?T??RJIHtIe?x?yttK??l???r?OU??wx?On?pU????vy??D???NrCx?r76") returned 1 [0098.601] lstrcmpiA (lpString1="??Y?h?FmSeg?????Zc?d?T??RJIHtIe?x?yttK??l???r?OU??wx?On?pU????vy??D???NrCx?r76", lpString2="??e?x????cA??e??GGc??O???M??lOM????UZP????V??Q??Ip??T?g??Dc????U????F?Lu??gE?D???y?a??86") returned 1 [0098.601] lstrcmpiA (lpString1="??e?x????cA??e??GGc??O???M??lOM????UZP????V??Q??Ip??T?g??Dc????U????F?Lu??gE?D???y?a??86", lpString2="?H?W?????????C???MX?????hPA???bg???g???Z?41") returned -1 [0098.601] lstrcmpiA (lpString1="?H?W?????????C???MX?????hPA???bg???g???Z?41", lpString2="XX?VIu??w9") returned -1 [0098.601] lstrcmpiA (lpString1="XX?VIu??w9", lpString2="a?g??bl?YO?????DtGQ?vs??s???KT30") returned 1 [0098.601] lstrcmpiA (lpString1="a?g??bl?YO?????DtGQ?vs??s???KT30", lpString2="U?w??R?z?FgN12") returned -1 [0098.601] lstrcmpiA (lpString1="U?w??R?z?FgN12", lpString2="?u?3") returned 1 [0098.601] lstrcmpiA (lpString1="?u?3", lpString2="??zy??w???????gQu?s?d?W?24") returned 1 [0098.601] lstrcmpiA (lpString1="??zy??w???????gQu?s?d?W?24", lpString2="?D?hx?????a?????OvnLG?Ix?F?RO?o?E?KGm????UcGetV?U???????yPQ?oW62") returned -1 [0098.601] lstrcmpiA (lpString1="?D?hx?????a?????OvnLG?Ix?F?RO?o?E?KGm????UcGetV?U???????yPQ?oW62", lpString2="f?Gy4") returned -1 [0098.601] lstrcmpiA (lpString1="f?Gy4", lpString2="0") returned 1 [0098.601] lstrcmpiA (lpString1="0", lpString2="?R?DS??n??bxa???u???E??Zi??Pa?xHzZ??S??hw??V??ZN?mT51") returned 1 [0098.601] lstrcmpiA (lpString1="?R?DS??n??bxa???u???E??Zi??Pa?xHzZ??S??hw??V??ZN?mT51", lpString2="?Q??4") returned 1 [0098.601] lstrcmpiA (lpString1="?Q??4", lpString2="????????i???e?W?TAh?V??t?Gf?ay??K????k?Q????J?nZ48") returned 1 [0098.601] lstrcmpiA (lpString1="????????i???e?W?TAh?V??t?Gf?ay??K????k?Q????J?nZ48", lpString2="C?z??d??l???????kL?L??zc???????Q?QCR?Q??Q??g?yL??A?E?G???57") returned -1 [0098.601] lstrcmpiA (lpString1="C?z??d??l???????kL?L??zc???????Q?QCR?Q??Q??g?yL??A?E?G???57", lpString2="w?l????aHlX??Tbrl?????BA?c??u??ghwnE??Z??v??k???aQ?ph??55") returned -1 [0098.601] lstrcmpiA (lpString1="w?l????aHlX??Tbrl?????BA?c??u??ghwnE??Z??v??k???aQ?ph??55", lpString2="KI??u?WYc?k?k?x??d??N??mP???????lwK?V37") returned 1 [0098.602] lstrcmpiA (lpString1="KI??u?WYc?k?k?x??d??N??mP???????lwK?V37", lpString2="?1") returned 1 [0098.602] lstrcmpiA (lpString1="?1", lpString2="???HRY???????ZOT?i?nm?s23") returned 1 [0098.602] lstrcmpiA (lpString1="???HRY???????ZOT?i?nm?s23", lpString2="F?a???d????Q????Ub?Q20") returned -1 [0098.602] lstrcmpiA (lpString1="F?a???d????Q????Ub?Q20", lpString2="x???L?a??C??y??I?AB?????gFF??z??xQz????A??AN44") returned -1 [0098.602] lstrcmpiA (lpString1="x???L?a??C??y??I?AB?????gFF??z??xQz????A??AN44", lpString2="mg??L??tf???P?B?l??E??e?????Vrgp?Cb??C??f?ZjyR?v?L??Q?tKdm??O61") returned 1 [0098.602] lstrcmpiA (lpString1="mg??L??tf???P?B?l??E??e?????Vrgp?Cb??C??f?ZjyR?v?L??Q?tKdm??O61", lpString2="h??3") returned 1 [0098.602] lstrcmpiA (lpString1="h??3", lpString2="????K5") returned 1 [0098.602] lstrcmpiA (lpString1="????K5", lpString2="r??S???k???????G?IzX?o??F?hf??et32") returned -1 [0098.602] lstrcmpiA (lpString1="r??S???k???????G?IzX?o??F?hf??et32", lpString2="?Z??wo?o?COU?13") returned 1 [0098.602] lstrcmpiA (lpString1="?Z??wo?o?COU?13", lpString2="AQR?L?v7") returned -1 [0098.602] lstrcmpiA (lpString1="AQR?L?v7", lpString2="HH??ICd???H?im?dEIZdk???kdp??xj??????CDs?DCR??g?K????????K58") returned -1 [0098.602] lstrcmpiA (lpString1="HH??ICd???H?im?dEIZdk???kdp??xj??????CDs?DCR??g?K????????K58", lpString2="?nX???Vga?D??z?v??k?vbe??25") returned 1 [0098.602] lstrcmpiA (lpString1="?nX???Vga?D??z?v??k?vbe??25", lpString2="?SV?b??u?E??z??????h?b???bBV???vnV34") returned -1 [0098.602] lstrcmpiA (lpString1="?SV?b??u?E??z??????h?b???bBV???vnV34", lpString2="??OvU?Bs?I?T?I?G?????v?23") returned 1 [0098.602] lstrcmpiA (lpString1="??OvU?Bs?I?T?I?G?????v?23", lpString2="0") returned -1 [0098.602] lstrcmpiA (lpString1="0", lpString2="??CVnmD??r?11") returned 1 [0098.602] lstrcmpiA (lpString1="??CVnmD??r?11", lpString2="0") returned -1 [0098.602] lstrcmpiA (lpString1="0", lpString2="??ObQ?dt????b13") returned 1 [0098.602] lstrcmpiA (lpString1="??ObQ?dt????b13", lpString2="??a?nc??E?k??13") returned 1 [0098.602] lstrcmpiA (lpString1="??a?nc??E?k??13", lpString2="??e?FI????O?K??L??18") returned -1 [0098.602] lstrcmpiA (lpString1="??e?FI????O?K??L??18", lpString2="w?f?????k?x?????F?UhZ21") returned -1 [0098.602] lstrcmpiA (lpString1="w?f?????k?x?????F?UhZ21", lpString2="?1") returned 1 [0098.602] lstrcmpiA (lpString1="?1", lpString2="?k?e?tvf??V11") returned -1 [0098.602] lstrcmpiA (lpString1="?k?e?tvf??V11", lpString2="?t??g?H??bk????y?TZG????JzS?iG???U?dY??oQ?F??x????????r??yJ?E??Z64") returned -1 [0098.602] lstrcmpiA (lpString1="?t??g?H??bk????y?TZG????JzS?iG???U?dY??oQ?F??x????????r??yJ?E??Z64", lpString2="0") returned -1 [0098.603] lstrcmpiA (lpString1="0", lpString2="d?k??e???zDXZ13") returned -1 [0098.603] lstrcmpiA (lpString1="d?k??e???zDXZ13", lpString2="???E??K?cNP?p?EesP?????Iz??r?????W??????c?dokT46") returned 1 [0098.603] lstrcmpiA (lpString1="???E??K?cNP?p?EesP?????Iz??r?????W??????c?dokT46", lpString2="?cW3") returned -1 [0098.603] lstrcmpiA (lpString1="?cW3", lpString2="????cnX?X??Xx?14") returned 1 [0098.603] lstrcmpiA (lpString1="????cnX?X??Xx?14", lpString2="?M?A???Y?dNJ???k????k?22") returned -1 [0098.603] lstrcmpiA (lpString1="?M?A???Y?dNJ???k????k?22", lpString2="j?d???V?hSODY?LWQuU??k???F?27") returned -1 [0098.603] lstrcmpiA (lpString1="j?d???V?hSODY?LWQuU??k???F?27", lpString2="0") returned 1 [0098.603] lstrcmpiA (lpString1="0", lpString2="?suz??X?tv?x???W??????B????w??bBs?b?lt?J?Su?R???T???yfE?56") returned 1 [0098.603] lstrcmpiA (lpString1="?suz??X?tv?x???W??????B????w??bBs?b?lt?J?Su?R???T???yfE?56", lpString2="??O?4") returned 1 [0098.603] lstrcmpiA (lpString1="??O?4", lpString2="??t?HOU??i??o?km??18") returned -1 [0098.603] lstrcmpiA (lpString1="??t?HOU??i??o?km??18", lpString2="Y?uY?Y?Tk???DXO??FYkM????n?Tn????Y???37") returned -1 [0098.603] lstrcmpiA (lpString1="Y?uY?Y?Tk???DXO??FYkM????n?Tn????Y???37", lpString2="?H??Nk????????Ki?e??o??JJc???m?E32") returned 1 [0098.603] lstrcmpiA (lpString1="?H??Nk????????Ki?e??o??JJc???m?E32", lpString2="???B?????ct?D??A???ls?????Q??o?e?Z?w?v?????a???KG49") returned 1 [0098.603] lstrcmpiA (lpString1="???B?????ct?D??A???ls?????Q??o?e?Z?w?v?????a???KG49", lpString2="?C??b?X??Y?K???E??zv?????DU????Fv?or?V???vK????yi???M?Z???F?X????Sc?B??h?v?O76") returned -1 [0098.603] lstrcmpiA (lpString1="?C??b?X??Y?K???E??zv?????DU????Fv?or?V???vK????yi???M?Z???F?X????Sc?B??h?v?O76", lpString2="F?as??J?UbAm?UYXaR?19") returned -1 [0098.603] lstrcmpiA (lpString1="F?as??J?UbAm?UYXaR?19", lpString2="?y??????i9") returned 1 [0098.603] lstrcmpiA (lpString1="?y??????i9", lpString2="J????i?hgwnK??eOcx18") returned -1 [0098.603] lstrcmpiA (lpString1="J????i?hgwnK??eOcx18", lpString2="???v????S???E13") returned 1 [0098.603] lstrcmpiA (lpString1="???v????S???E13", lpString2="NL??ftC7") returned -1 [0098.603] lstrcmpiA (lpString1="NL??ftC7", lpString2="iY?tz????wour?j??f?xz?K??n?????uX?fx???mk?????xS?R?B???O??v?T??tIe?dL?gwBYt75") returned 1 [0098.603] lstrcmpiA (lpString1="iY?tz????wour?j??f?xz?K??n?????uX?fx???mk?????xS?R?B???O??v?T??tIe?dL?gwBYt75", lpString2="0") returned 1 [0098.603] lstrcmpiA (lpString1="0", lpString2="???vWK????????VH??uDkB??m?vA28") returned 1 [0098.603] lstrcmpiA (lpString1="???vWK????????VH??uDkB??m?vA28", lpString2="????jptV?kg?hdI?yS??l?b??E?Y?Vv??c?XV?????FiI???A?cov?????58") returned 1 [0098.603] lstrcmpiA (lpString1="????jptV?kg?hdI?yS??l?b??E?Y?Vv??c?XV?????FiI???A?cov?????58", lpString2="?Wg?t??????JdgRd???DB?aDz?26") returned -1 [0098.604] lstrcmpiA (lpString1="?Wg?t??????JdgRd???DB?aDz?26", lpString2="?wDyw?ZF??n?????t???JpBrh?Qx?pA31") returned 1 [0098.604] lstrcmpiA (lpString1="?wDyw?ZF??n?????t???JpBrh?Qx?pA31", lpString2="?Q????u??????Y?sCi???21") returned 1 [0098.604] lstrcmpiA (lpString1="?Q????u??????Y?sCi???21", lpString2="??p??5") returned 1 [0098.604] lstrcmpiA (lpString1="??p??5", lpString2="?H2") returned -1 [0098.604] lstrcmpiA (lpString1="?H2", lpString2="FR??p5") returned -1 [0098.604] lstrcmpiA (lpString1="FR??p5", lpString2="?P?ot?X??Jgzvo???rff?evB?o26") returned 1 [0098.604] lstrcmpiA (lpString1="?P?ot?X??Jgzvo???rff?evB?o26", lpString2="??d3") returned 1 [0098.604] lstrcmpiA (lpString1="??d3", lpString2="0") returned -1 [0098.604] lstrcmpiA (lpString1="0", lpString2="????mB??8") returned 1 [0098.604] lstrcmpiA (lpString1="????mB??8", lpString2="?rB???rKc?a??lQv??f???WGPjV?YUy?nX????awpE?43") returned -1 [0098.604] lstrcmpiA (lpString1="?rB???rKc?a??lQv??f???WGPjV?YUy?nX????awpE?43", lpString2="jMd??xJJBX?ANd?Ep?????fF????Aay?m???j??XOPR43") returned -1 [0098.604] lstrcmpiA (lpString1="jMd??xJJBX?ANd?Ep?????fF????Aay?m???j??XOPR43", lpString2="?uFJ?s?WjfbrXHx?y????????H?C?AJ?32") returned 1 [0098.604] lstrcmpiA (lpString1="?uFJ?s?WjfbrXHx?y????????H?C?AJ?32", lpString2="d???Lf6") returned -1 [0098.604] lstrcmpiA (lpString1="d???Lf6", lpString2="???????????11") returned 1 [0098.604] lstrcmpiA (lpString1="???????????11", lpString2="h??v?sYb??t???Z?GtD??cO??????hux?33") returned -1 [0098.604] lstrcmpiA (lpString1="h??v?sYb??t???Z?GtD??cO??????hux?33", lpString2="eMRu??E???Z?b???l??c??????ZX??f?Eog??37") returned 1 [0098.604] lstrcmpiA (lpString1="eMRu??E???Z?b???l??c??????ZX??f?Eog??37", lpString2="??vo??M7") returned 1 [0098.604] lstrcmpiA (lpString1="??vo??M7", lpString2="jUQ?VN?JS?P?12") returned -1 [0098.604] lstrcmpiA (lpString1="jUQ?VN?JS?P?12", lpString2="aI?3") returned 1 [0098.604] lstrcmpiA (lpString1="aI?3", lpString2="xv?Xmg?Iy??DAdyEU?Iy?U?i????C?30") returned -1 [0098.604] lstrcmpiA (lpString1="xv?Xmg?Iy??DAdyEU?Iy?U?i????C?30", lpString2="?L??FC6") returned 1 [0098.604] lstrcmpiA (lpString1="?L??FC6", lpString2="??wd?e?n???H???c?c?19") returned 1 [0098.604] lstrcmpiA (lpString1="??wd?e?n???H???c?c?19", lpString2="??iSGl?kh?V?I????Fnw?z???e???iX???M?jahIGB42") returned 1 [0098.604] lstrcmpiA (lpString1="??iSGl?kh?V?I????Fnw?z???e???iX???M?jahIGB42", lpString2="??????z?aBG?I?Bj???19") returned 1 [0098.605] lstrcmpiA (lpString1="??????z?aBG?I?Bj???19", lpString2="???XyRZRIR????mc??FC?g?l????????j??35") returned -1 [0098.605] lstrcmpiA (lpString1="???XyRZRIR????mc??FC?g?l????????j??35", lpString2="a???k???H?????A???Y???????h??????????Y??f??wj???nV?T?rEd???N?vS?t??i????????k?78") returned -1 [0098.605] lstrcmpiA (lpString1="a???k???H?????A???Y???????h??????????Y??f??wj???nV?T?rEd???N?vS?t??i????????k?78", lpString2="m????L??QQ?zB?U??XO???H???zc????R???????l?42") returned -1 [0098.605] lstrcmpiA (lpString1="m????L??QQ?zB?U??XO???H???zc????R???????l?42", lpString2="eYZpA?GFFfC?i?B?sw??????W?D?y??J?I??36") returned 1 [0098.605] lstrcmpiA (lpString1="eYZpA?GFFfC?i?B?sw??????W?D?y??J?I??36", lpString2="?t???o?sFw??cbwSbkNrp?R???L??vms?J?O?ez????Q?N?K48") returned 1 [0098.605] lstrcmpiA (lpString1="?t???o?sFw??cbwSbkNrp?R???L??vms?J?O?ez????Q?N?K48", lpString2="?ZI?r?T7") returned -1 [0098.605] lstrcmpiA (lpString1="?ZI?r?T7", lpString2="??????JMl?aJv?V?y???DaUa?25") returned 1 [0098.605] lstrcmpiA (lpString1="??????JMl?aJv?V?y???DaUa?25", lpString2="0") returned -1 [0098.605] lstrcmpiA (lpString1="0", lpString2="??B3") returned 1 [0098.605] lstrcmpiA (lpString1="??B3", lpString2="?zE??Jv??gF??13") returned -1 [0098.605] lstrcmpiA (lpString1="?zE??Jv??gF??13", lpString2="0") returned -1 [0098.605] lstrcmpiA (lpString1="0", lpString2="c?R??s???tW?yA??????????wa26") returned -1 [0098.605] lstrcmpiA (lpString1="c?R??s???tW?yA??????????wa26", lpString2="??2") returned 1 [0098.605] lstrcmpiA (lpString1="??2", lpString2="???3") returned 1 [0098.605] lstrcmpiA (lpString1="???3", lpString2="?u2") returned -1 [0098.605] lstrcmpiA (lpString1="?u2", lpString2="DoG???d??zuAK?H?d?cs?p??O??It??w32") returned -1 [0098.605] lstrcmpiA (lpString1="DoG???d??zuAK?H?d?cs?p??O??It??w32", lpString2="??2") returned 1 [0098.605] lstrcmpiA (lpString1="??2", lpString2="vtV?Ng?yB?Q?????I?V????CEhO??A??u?v??????xA43") returned -1 [0098.605] lstrcmpiA (lpString1="vtV?Ng?yB?Q?????I?V????CEhO??A??u?v??????xA43", lpString2="vtV?Ng?yB?Q?????I?V????CEhO??A??u?v??????xA43") returned 0 [0098.606] VirtualAllocEx (hProcess=0x2fc, lpAddress=0x400000, dwSize=0x19000, flAllocationType=0x3000, flProtect=0x40) returned 0x400000 [0098.606] WriteProcessMemory (in: hProcess=0x2fc, lpBaseAddress=0x400000, lpBuffer=0x31294b0*, nSize=0x400, lpNumberOfBytesWritten=0x49b5b0 | out: lpBuffer=0x31294b0*, lpNumberOfBytesWritten=0x49b5b0*=0x400) returned 1 [0098.831] WriteProcessMemory (in: hProcess=0x2fc, lpBaseAddress=0x401000, lpBuffer=0x21d5274*, nSize=0x9e00, lpNumberOfBytesWritten=0x49b5b0 | out: lpBuffer=0x21d5274*, lpNumberOfBytesWritten=0x49b5b0*=0x9e00) returned 1 [0098.832] WriteProcessMemory (in: hProcess=0x2fc, lpBaseAddress=0x40b000, lpBuffer=0x22e0d24*, nSize=0x2800, lpNumberOfBytesWritten=0x49b5b0 | out: lpBuffer=0x22e0d24*, lpNumberOfBytesWritten=0x49b5b0*=0x2800) returned 1 [0098.832] WriteProcessMemory (in: hProcess=0x2fc, lpBaseAddress=0x40e000, lpBuffer=0x22e8eac*, nSize=0xa800, lpNumberOfBytesWritten=0x49b5b0 | out: lpBuffer=0x22e8eac*, lpNumberOfBytesWritten=0x49b5b0*=0xa800) returned 1 [0098.834] WriteProcessMemory (in: hProcess=0x2fc, lpBaseAddress=0x7efde008, lpBuffer=0x22f51fc*, nSize=0x4, lpNumberOfBytesWritten=0x49b5b0 | out: lpBuffer=0x22f51fc*, lpNumberOfBytesWritten=0x49b5b0*=0x4) returned 1 [0098.835] GetCurrentProcessId () returned 0x9f8 [0098.835] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x9f8) returned 0x304 [0098.835] EnumProcessModules (in: hProcess=0x304, lphModule=0x22faa60, cb=0x100, lpcbNeeded=0x498850 | out: lphModule=0x22faa60, lpcbNeeded=0x498850) returned 1 [0098.835] GetModuleInformation (in: hProcess=0x304, hModule=0x310000, lpmodinfo=0x22faba0, cb=0xc | out: lpmodinfo=0x22faba0*(lpBaseOfDll=0x310000, SizeOfImage=0x3e000, EntryPoint=0x3479ce)) returned 1 [0098.835] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.835] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x310000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="unlikexpc.exe") returned 0xd [0098.836] CoTaskMemFree (pv=0x5d7900) [0098.836] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.836] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x310000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\unlikexpc.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\unlikexpc.exe")) returned 0x33 [0098.836] CoTaskMemFree (pv=0x5d7900) [0098.836] GetModuleInformation (in: hProcess=0x304, hModule=0x77ab0000, lpmodinfo=0x22fccf4, cb=0xc | out: lpmodinfo=0x22fccf4*(lpBaseOfDll=0x77ab0000, SizeOfImage=0x180000, EntryPoint=0x0)) returned 1 [0098.836] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.836] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x77ab0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="ntdll.dll") returned 0x9 [0098.836] CoTaskMemFree (pv=0x5d7900) [0098.836] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.836] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x77ab0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll")) returned 0x1d [0098.836] CoTaskMemFree (pv=0x5d7900) [0098.836] GetModuleInformation (in: hProcess=0x304, hModule=0x754b0000, lpmodinfo=0x22fedf8, cb=0xc | out: lpmodinfo=0x22fedf8*(lpBaseOfDll=0x754b0000, SizeOfImage=0x4a000, EntryPoint=0x754b2e54)) returned 1 [0098.836] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.836] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x754b0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="MSCOREE.DLL") returned 0xb [0098.837] CoTaskMemFree (pv=0x5d7900) [0098.837] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.837] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x754b0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\MSCOREE.DLL" (normalized: "c:\\windows\\system32\\mscoree.dll")) returned 0x1f [0098.837] CoTaskMemFree (pv=0x5d7900) [0098.837] GetModuleInformation (in: hProcess=0x304, hModule=0x757c0000, lpmodinfo=0x2300f04, cb=0xc | out: lpmodinfo=0x2300f04*(lpBaseOfDll=0x757c0000, SizeOfImage=0x110000, EntryPoint=0x757d32d3)) returned 1 [0098.837] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.837] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x757c0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="KERNEL32.dll") returned 0xc [0098.837] CoTaskMemFree (pv=0x5d7900) [0098.837] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.837] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x757c0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\KERNEL32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll")) returned 0x20 [0098.837] CoTaskMemFree (pv=0x5d7900) [0098.837] GetModuleInformation (in: hProcess=0x304, hModule=0x76260000, lpmodinfo=0x2303018, cb=0xc | out: lpmodinfo=0x2303018*(lpBaseOfDll=0x76260000, SizeOfImage=0x46000, EntryPoint=0x76267478)) returned 1 [0098.837] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.837] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x76260000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="KERNELBASE.dll") returned 0xe [0098.838] CoTaskMemFree (pv=0x5d7900) [0098.838] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.838] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x76260000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\KERNELBASE.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll")) returned 0x22 [0098.838] CoTaskMemFree (pv=0x5d7900) [0098.838] GetModuleInformation (in: hProcess=0x304, hModule=0x75720000, lpmodinfo=0x2305160, cb=0xc | out: lpmodinfo=0x2305160*(lpBaseOfDll=0x75720000, SizeOfImage=0xa0000, EntryPoint=0x757349e5)) returned 1 [0098.838] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.838] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75720000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="ADVAPI32.dll") returned 0xc [0098.838] CoTaskMemFree (pv=0x5d7900) [0098.838] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.838] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75720000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\ADVAPI32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll")) returned 0x20 [0098.838] CoTaskMemFree (pv=0x5d7900) [0098.838] GetModuleInformation (in: hProcess=0x304, hModule=0x75fe0000, lpmodinfo=0x2307274, cb=0xc | out: lpmodinfo=0x2307274*(lpBaseOfDll=0x75fe0000, SizeOfImage=0xac000, EntryPoint=0x75fea472)) returned 1 [0098.838] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.838] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75fe0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="msvcrt.dll") returned 0xa [0098.839] CoTaskMemFree (pv=0x5d7900) [0098.839] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.839] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75fe0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll")) returned 0x1e [0098.839] CoTaskMemFree (pv=0x5d7900) [0098.839] GetModuleInformation (in: hProcess=0x304, hModule=0x761b0000, lpmodinfo=0x2309380, cb=0xc | out: lpmodinfo=0x2309380*(lpBaseOfDll=0x761b0000, SizeOfImage=0x19000, EntryPoint=0x761b4975)) returned 1 [0098.839] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.839] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x761b0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="sechost.dll") returned 0xb [0098.839] CoTaskMemFree (pv=0x5d7900) [0098.839] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.839] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x761b0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll")) returned 0x1f [0098.840] CoTaskMemFree (pv=0x5d7900) [0098.840] GetModuleInformation (in: hProcess=0x304, hModule=0x76090000, lpmodinfo=0x230b48c, cb=0xc | out: lpmodinfo=0x230b48c*(lpBaseOfDll=0x76090000, SizeOfImage=0xf0000, EntryPoint=0x760a0569)) returned 1 [0098.840] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.840] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x76090000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="RPCRT4.dll") returned 0xa [0098.840] CoTaskMemFree (pv=0x5d7900) [0098.840] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.840] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x76090000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\RPCRT4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll")) returned 0x1e [0098.840] CoTaskMemFree (pv=0x5d7900) [0098.840] GetModuleInformation (in: hProcess=0x304, hModule=0x75610000, lpmodinfo=0x230d5e4, cb=0xc | out: lpmodinfo=0x230d5e4*(lpBaseOfDll=0x75610000, SizeOfImage=0x60000, EntryPoint=0x7562a3b3)) returned 1 [0098.840] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.840] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75610000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="SspiCli.dll") returned 0xb [0098.841] CoTaskMemFree (pv=0x5d7900) [0098.841] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.841] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75610000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\SspiCli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll")) returned 0x1f [0098.841] CoTaskMemFree (pv=0x5d7900) [0098.841] GetModuleInformation (in: hProcess=0x304, hModule=0x75600000, lpmodinfo=0x230f6f0, cb=0xc | out: lpmodinfo=0x230f6f0*(lpBaseOfDll=0x75600000, SizeOfImage=0xc000, EntryPoint=0x756010e1)) returned 1 [0098.841] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.841] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75600000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="CRYPTBASE.dll") returned 0xd [0098.841] CoTaskMemFree (pv=0x5d7900) [0098.841] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.841] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75600000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\CRYPTBASE.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll")) returned 0x21 [0098.842] CoTaskMemFree (pv=0x5d7900) [0098.842] GetModuleInformation (in: hProcess=0x304, hModule=0x75430000, lpmodinfo=0x2311804, cb=0xc | out: lpmodinfo=0x2311804*(lpBaseOfDll=0x75430000, SizeOfImage=0x78000, EntryPoint=0x7543f7ba)) returned 1 [0098.842] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.842] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75430000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="mscoreei.dll") returned 0xc [0098.842] CoTaskMemFree (pv=0x5d7900) [0098.842] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.842] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75430000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscoreei.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\mscoreei.dll")) returned 0x3a [0098.842] CoTaskMemFree (pv=0x5d7900) [0098.842] GetModuleInformation (in: hProcess=0x304, hModule=0x761d0000, lpmodinfo=0x231394c, cb=0xc | out: lpmodinfo=0x231394c*(lpBaseOfDll=0x761d0000, SizeOfImage=0x57000, EntryPoint=0x761e9ba6)) returned 1 [0098.843] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.843] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x761d0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="SHLWAPI.dll") returned 0xb [0098.843] CoTaskMemFree (pv=0x5d7900) [0098.843] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.843] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x761d0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\SHLWAPI.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll")) returned 0x1f [0098.843] CoTaskMemFree (pv=0x5d7900) [0098.843] GetModuleInformation (in: hProcess=0x304, hModule=0x766d0000, lpmodinfo=0x2315a58, cb=0xc | out: lpmodinfo=0x2315a58*(lpBaseOfDll=0x766d0000, SizeOfImage=0x90000, EntryPoint=0x766e6343)) returned 1 [0098.843] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.843] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x766d0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="GDI32.dll") returned 0x9 [0098.844] CoTaskMemFree (pv=0x5d7900) [0098.844] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.844] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x766d0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\GDI32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll")) returned 0x1d [0098.844] CoTaskMemFree (pv=0x5d7900) [0098.844] GetModuleInformation (in: hProcess=0x304, hModule=0x775b0000, lpmodinfo=0x2317b5c, cb=0xc | out: lpmodinfo=0x2317b5c*(lpBaseOfDll=0x775b0000, SizeOfImage=0x100000, EntryPoint=0x775cb6ed)) returned 1 [0098.845] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.845] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x775b0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="USER32.dll") returned 0xa [0098.845] CoTaskMemFree (pv=0x5d7900) [0098.845] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.845] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x775b0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\USER32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll")) returned 0x1e [0098.845] CoTaskMemFree (pv=0x5d7900) [0098.845] GetModuleInformation (in: hProcess=0x304, hModule=0x75a70000, lpmodinfo=0x2319c68, cb=0xc | out: lpmodinfo=0x2319c68*(lpBaseOfDll=0x75a70000, SizeOfImage=0xa000, EntryPoint=0x75a736a0)) returned 1 [0098.845] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.845] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75a70000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="LPK.dll") returned 0x7 [0098.846] CoTaskMemFree (pv=0x5d7900) [0098.846] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.846] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75a70000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\LPK.dll" (normalized: "c:\\windows\\syswow64\\lpk.dll")) returned 0x1b [0098.846] CoTaskMemFree (pv=0x5d7900) [0098.846] GetModuleInformation (in: hProcess=0x304, hModule=0x758d0000, lpmodinfo=0x231bd64, cb=0xc | out: lpmodinfo=0x231bd64*(lpBaseOfDll=0x758d0000, SizeOfImage=0x9d000, EntryPoint=0x75903fd7)) returned 1 [0098.846] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.846] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x758d0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="USP10.dll") returned 0x9 [0098.847] CoTaskMemFree (pv=0x5d7900) [0098.847] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.847] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x758d0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\USP10.dll" (normalized: "c:\\windows\\syswow64\\usp10.dll")) returned 0x1d [0098.847] CoTaskMemFree (pv=0x5d7900) [0098.847] GetModuleInformation (in: hProcess=0x304, hModule=0x75f80000, lpmodinfo=0x231def4, cb=0xc | out: lpmodinfo=0x231def4*(lpBaseOfDll=0x75f80000, SizeOfImage=0x60000, EntryPoint=0x75f9158f)) returned 1 [0098.847] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.847] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75f80000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="IMM32.DLL") returned 0x9 [0098.847] CoTaskMemFree (pv=0x5d7900) [0098.848] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.848] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75f80000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\system32\\IMM32.DLL" (normalized: "c:\\windows\\system32\\imm32.dll")) returned 0x1d [0098.848] CoTaskMemFree (pv=0x5d7900) [0098.848] GetModuleInformation (in: hProcess=0x304, hModule=0x75ea0000, lpmodinfo=0x231fff8, cb=0xc | out: lpmodinfo=0x231fff8*(lpBaseOfDll=0x75ea0000, SizeOfImage=0xcc000, EntryPoint=0x75ea168b)) returned 1 [0098.848] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.848] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75ea0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="MSCTF.dll") returned 0x9 [0098.848] CoTaskMemFree (pv=0x5d7900) [0098.848] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.848] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75ea0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\MSCTF.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll")) returned 0x1d [0098.849] CoTaskMemFree (pv=0x5d7900) [0098.849] GetModuleInformation (in: hProcess=0x304, hModule=0x75420000, lpmodinfo=0x23220fc, cb=0xc | out: lpmodinfo=0x23220fc*(lpBaseOfDll=0x75420000, SizeOfImage=0x9000, EntryPoint=0x75421220)) returned 1 [0098.849] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.849] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75420000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="VERSION.dll") returned 0xb [0098.849] CoTaskMemFree (pv=0x5d7900) [0098.849] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.849] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75420000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\system32\\VERSION.dll" (normalized: "c:\\windows\\system32\\version.dll")) returned 0x1f [0098.850] CoTaskMemFree (pv=0x5d7900) [0098.850] GetModuleInformation (in: hProcess=0x304, hModule=0x74890000, lpmodinfo=0x2324208, cb=0xc | out: lpmodinfo=0x2324208*(lpBaseOfDll=0x74890000, SizeOfImage=0x6a8000, EntryPoint=0x749d7040)) returned 1 [0098.850] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.850] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x74890000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="clr.dll") returned 0x7 [0098.850] CoTaskMemFree (pv=0x5d7900) [0098.850] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.851] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x74890000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\clr.dll")) returned 0x35 [0098.851] CoTaskMemFree (pv=0x5d7900) [0098.851] GetModuleInformation (in: hProcess=0x304, hModule=0x75320000, lpmodinfo=0x2326338, cb=0xc | out: lpmodinfo=0x2326338*(lpBaseOfDll=0x75320000, SizeOfImage=0xf5000, EntryPoint=0x75374160)) returned 1 [0098.851] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.851] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75320000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="MSVCR120_CLR0400.dll") returned 0x14 [0098.852] CoTaskMemFree (pv=0x5d7900) [0098.852] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.852] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75320000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\system32\\MSVCR120_CLR0400.dll" (normalized: "c:\\windows\\system32\\msvcr120_clr0400.dll")) returned 0x28 [0098.852] CoTaskMemFree (pv=0x5d7900) [0098.852] GetModuleInformation (in: hProcess=0x304, hModule=0x72440000, lpmodinfo=0x232846c, cb=0xc | out: lpmodinfo=0x232846c*(lpBaseOfDll=0x72440000, SizeOfImage=0x122b000, EntryPoint=0x0)) returned 1 [0098.852] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.852] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x72440000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="mscorlib.ni.dll") returned 0xf [0098.853] CoTaskMemFree (pv=0x5d7900) [0098.853] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.853] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x72440000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\b7a12c4c0032847fcc6b9c710460456f\\mscorlib.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\mscorlib\\b7a12c4c0032847fcc6b9c710460456f\\mscorlib.ni.dll")) returned 0x68 [0098.853] CoTaskMemFree (pv=0x5d7900) [0098.853] GetModuleInformation (in: hProcess=0x304, hModule=0x764e0000, lpmodinfo=0x232a614, cb=0xc | out: lpmodinfo=0x232a614*(lpBaseOfDll=0x764e0000, SizeOfImage=0x15c000, EntryPoint=0x7652ba3d)) returned 1 [0098.853] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.853] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x764e0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="ole32.dll") returned 0x9 [0098.854] CoTaskMemFree (pv=0x5d7900) [0098.854] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.854] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x764e0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll")) returned 0x1d [0098.854] CoTaskMemFree (pv=0x5d7900) [0098.854] GetModuleInformation (in: hProcess=0x304, hModule=0x74f60000, lpmodinfo=0x232c718, cb=0xc | out: lpmodinfo=0x232c718*(lpBaseOfDll=0x74f60000, SizeOfImage=0x80000, EntryPoint=0x74f737c9)) returned 1 [0098.855] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.855] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x74f60000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="uxtheme.dll") returned 0xb [0098.855] CoTaskMemFree (pv=0x5d7900) [0098.855] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.855] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x74f60000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\system32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll")) returned 0x1f [0098.855] CoTaskMemFree (pv=0x5d7900) [0098.855] GetModuleInformation (in: hProcess=0x304, hModule=0x752a0000, lpmodinfo=0x232e824, cb=0xc | out: lpmodinfo=0x232e824*(lpBaseOfDll=0x752a0000, SizeOfImage=0x7d000, EntryPoint=0x752a1140)) returned 1 [0098.856] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.856] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x752a0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="clrjit.dll") returned 0xa [0098.856] CoTaskMemFree (pv=0x5d7900) [0098.856] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.856] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x752a0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clrjit.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\clrjit.dll")) returned 0x38 [0098.857] CoTaskMemFree (pv=0x5d7900) [0098.857] GetModuleInformation (in: hProcess=0x304, hModule=0x762b0000, lpmodinfo=0x2330964, cb=0xc | out: lpmodinfo=0x2330964*(lpBaseOfDll=0x762b0000, SizeOfImage=0x8f000, EntryPoint=0x762b3fb1)) returned 1 [0098.857] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.857] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x762b0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="OLEAUT32.dll") returned 0xc [0098.857] CoTaskMemFree (pv=0x5d7900) [0098.857] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.857] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x762b0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\OLEAUT32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll")) returned 0x20 [0098.858] CoTaskMemFree (pv=0x5d7900) [0098.858] GetModuleInformation (in: hProcess=0x304, hModule=0x736d0000, lpmodinfo=0x2332a78, cb=0xc | out: lpmodinfo=0x2332a78*(lpBaseOfDll=0x736d0000, SizeOfImage=0x9ad000, EntryPoint=0x0)) returned 1 [0098.858] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.858] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x736d0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="System.ni.dll") returned 0xd [0098.859] CoTaskMemFree (pv=0x5d7900) [0098.859] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.859] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x736d0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System\\500ffa28b327e171fe664023003e947e\\System.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system\\500ffa28b327e171fe664023003e947e\\system.ni.dll")) returned 0x64 [0098.859] CoTaskMemFree (pv=0x5d7900) [0098.859] GetModuleInformation (in: hProcess=0x304, hModule=0x71d20000, lpmodinfo=0x2334c14, cb=0xc | out: lpmodinfo=0x2334c14*(lpBaseOfDll=0x71d20000, SizeOfImage=0x716000, EntryPoint=0x0)) returned 1 [0098.860] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.860] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x71d20000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="System.Core.ni.dll") returned 0x12 [0098.860] CoTaskMemFree (pv=0x5d7900) [0098.860] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.860] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x71d20000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Core\\386fde9190d499d6645df8b90eb76242\\System.Core.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.core\\386fde9190d499d6645df8b90eb76242\\system.core.ni.dll")) returned 0x6e [0098.860] CoTaskMemFree (pv=0x5d7900) [0098.860] GetModuleInformation (in: hProcess=0x304, hModule=0x750d0000, lpmodinfo=0x2336dd0, cb=0xc | out: lpmodinfo=0x2336dd0*(lpBaseOfDll=0x750d0000, SizeOfImage=0x1cb000, EntryPoint=0x0)) returned 1 [0098.861] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.861] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x750d0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="Microsoft.VisualBasic.ni.dll") returned 0x1c [0098.861] CoTaskMemFree (pv=0x5d7900) [0098.861] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.861] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x750d0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Microsoft.V9921e851#\\cfbddeb6e93e8f421b92229b20e51233\\Microsoft.VisualBasic.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\microsoft.v9921e851#\\cfbddeb6e93e8f421b92229b20e51233\\microsoft.visualbasic.ni.dll")) returned 0x81 [0098.862] CoTaskMemFree (pv=0x5d7900) [0098.862] GetModuleInformation (in: hProcess=0x304, hModule=0x750b0000, lpmodinfo=0x2338fc4, cb=0xc | out: lpmodinfo=0x2338fc4*(lpBaseOfDll=0x750b0000, SizeOfImage=0x13000, EntryPoint=0x750b18f0)) returned 1 [0098.862] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.862] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x750b0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="nlssorting.dll") returned 0xe [0098.863] CoTaskMemFree (pv=0x5d7900) [0098.863] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.863] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x750b0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\nlssorting.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\nlssorting.dll")) returned 0x3c [0098.863] CoTaskMemFree (pv=0x5d7900) [0098.863] GetModuleInformation (in: hProcess=0x304, hModule=0x74870000, lpmodinfo=0x233b114, cb=0xc | out: lpmodinfo=0x233b114*(lpBaseOfDll=0x74870000, SizeOfImage=0x16000, EntryPoint=0x74872dc3)) returned 1 [0098.864] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.864] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x74870000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="CRYPTSP.dll") returned 0xb [0098.864] CoTaskMemFree (pv=0x5d7900) [0098.864] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.864] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x74870000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\system32\\CRYPTSP.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll")) returned 0x1f [0098.865] CoTaskMemFree (pv=0x5d7900) [0098.865] GetModuleInformation (in: hProcess=0x304, hModule=0x74830000, lpmodinfo=0x233d220, cb=0xc | out: lpmodinfo=0x233d220*(lpBaseOfDll=0x74830000, SizeOfImage=0x3b000, EntryPoint=0x7483128d)) returned 1 [0098.865] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.865] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x74830000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="rsaenh.dll") returned 0xa [0098.865] CoTaskMemFree (pv=0x5d7900) [0098.865] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.865] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x74830000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\system32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll")) returned 0x1e [0098.866] CoTaskMemFree (pv=0x5d7900) [0098.866] GetModuleInformation (in: hProcess=0x304, hModule=0x75a60000, lpmodinfo=0x233f438, cb=0xc | out: lpmodinfo=0x233f438*(lpBaseOfDll=0x75a60000, SizeOfImage=0x5000, EntryPoint=0x75a61438)) returned 1 [0098.866] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.866] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75a60000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="psapi.dll") returned 0x9 [0098.867] CoTaskMemFree (pv=0x5d7900) [0098.867] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.867] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75a60000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\psapi.dll" (normalized: "c:\\windows\\syswow64\\psapi.dll")) returned 0x1d [0098.867] CoTaskMemFree (pv=0x5d7900) [0098.867] GetModuleInformation (in: hProcess=0x304, hModule=0x746a0000, lpmodinfo=0x234153c, cb=0xc | out: lpmodinfo=0x234153c*(lpBaseOfDll=0x746a0000, SizeOfImage=0x18d000, EntryPoint=0x0)) returned 1 [0098.868] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.868] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x746a0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="System.Drawing.ni.dll") returned 0x15 [0098.868] CoTaskMemFree (pv=0x5d7900) [0098.868] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.868] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x746a0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Drawing\\553c0312fdf5a5449f3649f0515e70fb\\System.Drawing.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.drawing\\553c0312fdf5a5449f3649f0515e70fb\\system.drawing.ni.dll")) returned 0x74 [0098.869] CoTaskMemFree (pv=0x5d7900) [0098.869] GetModuleInformation (in: hProcess=0x304, hModule=0x710c0000, lpmodinfo=0x2343708, cb=0xc | out: lpmodinfo=0x2343708*(lpBaseOfDll=0x710c0000, SizeOfImage=0xc58000, EntryPoint=0x0)) returned 1 [0098.869] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.869] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x710c0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="System.Windows.Forms.ni.dll") returned 0x1b [0098.870] CoTaskMemFree (pv=0x5d7900) [0098.870] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.870] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x710c0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Windows.Forms\\7a6894982f35a1d75ec73d447c583da2\\System.Windows.Forms.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.windows.forms\\7a6894982f35a1d75ec73d447c583da2\\system.windows.forms.ni.dll")) returned 0x80 [0098.870] CoTaskMemFree (pv=0x5d7900) [0098.870] CloseHandle (hObject=0x304) returned 1 [0098.877] GetCurrentProcessId () returned 0x9f8 [0098.877] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x9f8) returned 0x304 [0098.877] EnumProcessModules (in: hProcess=0x304, lphModule=0x223fe8c, cb=0x100, lpcbNeeded=0x498850 | out: lphModule=0x223fe8c, lpcbNeeded=0x498850) returned 1 [0098.878] GetModuleInformation (in: hProcess=0x304, hModule=0x310000, lpmodinfo=0x223ffcc, cb=0xc | out: lpmodinfo=0x223ffcc*(lpBaseOfDll=0x310000, SizeOfImage=0x3e000, EntryPoint=0x3479ce)) returned 1 [0098.878] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.878] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x310000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="unlikexpc.exe") returned 0xd [0098.878] CoTaskMemFree (pv=0x5d7900) [0098.878] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.878] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x310000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\unlikexpc.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\unlikexpc.exe")) returned 0x33 [0098.878] CoTaskMemFree (pv=0x5d7900) [0098.878] GetModuleInformation (in: hProcess=0x304, hModule=0x77ab0000, lpmodinfo=0x2242120, cb=0xc | out: lpmodinfo=0x2242120*(lpBaseOfDll=0x77ab0000, SizeOfImage=0x180000, EntryPoint=0x0)) returned 1 [0098.878] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.878] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x77ab0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="ntdll.dll") returned 0x9 [0098.878] CoTaskMemFree (pv=0x5d7900) [0098.878] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.878] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x77ab0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll")) returned 0x1d [0098.878] CoTaskMemFree (pv=0x5d7900) [0098.878] GetModuleInformation (in: hProcess=0x304, hModule=0x754b0000, lpmodinfo=0x2244224, cb=0xc | out: lpmodinfo=0x2244224*(lpBaseOfDll=0x754b0000, SizeOfImage=0x4a000, EntryPoint=0x754b2e54)) returned 1 [0098.879] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.879] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x754b0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="MSCOREE.DLL") returned 0xb [0098.879] CoTaskMemFree (pv=0x5d7900) [0098.879] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.879] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x754b0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\MSCOREE.DLL" (normalized: "c:\\windows\\system32\\mscoree.dll")) returned 0x1f [0098.879] CoTaskMemFree (pv=0x5d7900) [0098.879] GetModuleInformation (in: hProcess=0x304, hModule=0x757c0000, lpmodinfo=0x2246330, cb=0xc | out: lpmodinfo=0x2246330*(lpBaseOfDll=0x757c0000, SizeOfImage=0x110000, EntryPoint=0x757d32d3)) returned 1 [0098.879] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.879] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x757c0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="KERNEL32.dll") returned 0xc [0098.879] CoTaskMemFree (pv=0x5d7900) [0098.879] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.879] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x757c0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\KERNEL32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll")) returned 0x20 [0098.879] CoTaskMemFree (pv=0x5d7900) [0098.879] GetModuleInformation (in: hProcess=0x304, hModule=0x76260000, lpmodinfo=0x2248444, cb=0xc | out: lpmodinfo=0x2248444*(lpBaseOfDll=0x76260000, SizeOfImage=0x46000, EntryPoint=0x76267478)) returned 1 [0098.880] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.880] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x76260000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="KERNELBASE.dll") returned 0xe [0098.880] CoTaskMemFree (pv=0x5d7900) [0098.880] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.880] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x76260000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\KERNELBASE.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll")) returned 0x22 [0098.880] CoTaskMemFree (pv=0x5d7900) [0098.880] GetModuleInformation (in: hProcess=0x304, hModule=0x75720000, lpmodinfo=0x224a58c, cb=0xc | out: lpmodinfo=0x224a58c*(lpBaseOfDll=0x75720000, SizeOfImage=0xa0000, EntryPoint=0x757349e5)) returned 1 [0098.880] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.880] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75720000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="ADVAPI32.dll") returned 0xc [0098.880] CoTaskMemFree (pv=0x5d7900) [0098.880] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.880] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75720000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\ADVAPI32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll")) returned 0x20 [0098.881] CoTaskMemFree (pv=0x5d7900) [0098.881] GetModuleInformation (in: hProcess=0x304, hModule=0x75fe0000, lpmodinfo=0x224c6a0, cb=0xc | out: lpmodinfo=0x224c6a0*(lpBaseOfDll=0x75fe0000, SizeOfImage=0xac000, EntryPoint=0x75fea472)) returned 1 [0098.881] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.881] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75fe0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="msvcrt.dll") returned 0xa [0098.881] CoTaskMemFree (pv=0x5d7900) [0098.881] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.881] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75fe0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll")) returned 0x1e [0098.881] CoTaskMemFree (pv=0x5d7900) [0098.881] GetModuleInformation (in: hProcess=0x304, hModule=0x761b0000, lpmodinfo=0x224e7ac, cb=0xc | out: lpmodinfo=0x224e7ac*(lpBaseOfDll=0x761b0000, SizeOfImage=0x19000, EntryPoint=0x761b4975)) returned 1 [0098.881] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.881] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x761b0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="sechost.dll") returned 0xb [0098.882] CoTaskMemFree (pv=0x5d7900) [0098.882] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.882] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x761b0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll")) returned 0x1f [0098.882] CoTaskMemFree (pv=0x5d7900) [0098.882] GetModuleInformation (in: hProcess=0x304, hModule=0x76090000, lpmodinfo=0x22508b8, cb=0xc | out: lpmodinfo=0x22508b8*(lpBaseOfDll=0x76090000, SizeOfImage=0xf0000, EntryPoint=0x760a0569)) returned 1 [0098.882] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.882] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x76090000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="RPCRT4.dll") returned 0xa [0098.882] CoTaskMemFree (pv=0x5d7900) [0098.882] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.882] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x76090000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\RPCRT4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll")) returned 0x1e [0098.882] CoTaskMemFree (pv=0x5d7900) [0098.882] GetModuleInformation (in: hProcess=0x304, hModule=0x75610000, lpmodinfo=0x2252a10, cb=0xc | out: lpmodinfo=0x2252a10*(lpBaseOfDll=0x75610000, SizeOfImage=0x60000, EntryPoint=0x7562a3b3)) returned 1 [0098.883] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.883] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75610000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="SspiCli.dll") returned 0xb [0098.883] CoTaskMemFree (pv=0x5d7900) [0098.883] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.883] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75610000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\SspiCli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll")) returned 0x1f [0098.883] CoTaskMemFree (pv=0x5d7900) [0098.883] GetModuleInformation (in: hProcess=0x304, hModule=0x75600000, lpmodinfo=0x2254b1c, cb=0xc | out: lpmodinfo=0x2254b1c*(lpBaseOfDll=0x75600000, SizeOfImage=0xc000, EntryPoint=0x756010e1)) returned 1 [0098.883] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.883] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75600000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="CRYPTBASE.dll") returned 0xd [0098.884] CoTaskMemFree (pv=0x5d7900) [0098.884] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.884] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75600000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\CRYPTBASE.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll")) returned 0x21 [0098.884] CoTaskMemFree (pv=0x5d7900) [0098.884] GetModuleInformation (in: hProcess=0x304, hModule=0x75430000, lpmodinfo=0x2256c30, cb=0xc | out: lpmodinfo=0x2256c30*(lpBaseOfDll=0x75430000, SizeOfImage=0x78000, EntryPoint=0x7543f7ba)) returned 1 [0098.884] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.884] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75430000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="mscoreei.dll") returned 0xc [0098.884] CoTaskMemFree (pv=0x5d7900) [0098.884] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.884] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75430000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscoreei.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\mscoreei.dll")) returned 0x3a [0098.885] CoTaskMemFree (pv=0x5d7900) [0098.885] GetModuleInformation (in: hProcess=0x304, hModule=0x761d0000, lpmodinfo=0x2258d78, cb=0xc | out: lpmodinfo=0x2258d78*(lpBaseOfDll=0x761d0000, SizeOfImage=0x57000, EntryPoint=0x761e9ba6)) returned 1 [0098.885] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.885] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x761d0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="SHLWAPI.dll") returned 0xb [0098.885] CoTaskMemFree (pv=0x5d7900) [0098.885] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.885] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x761d0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\SHLWAPI.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll")) returned 0x1f [0098.885] CoTaskMemFree (pv=0x5d7900) [0098.885] GetModuleInformation (in: hProcess=0x304, hModule=0x766d0000, lpmodinfo=0x225ae84, cb=0xc | out: lpmodinfo=0x225ae84*(lpBaseOfDll=0x766d0000, SizeOfImage=0x90000, EntryPoint=0x766e6343)) returned 1 [0098.886] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.886] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x766d0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="GDI32.dll") returned 0x9 [0098.886] CoTaskMemFree (pv=0x5d7900) [0098.886] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.886] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x766d0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\GDI32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll")) returned 0x1d [0098.886] CoTaskMemFree (pv=0x5d7900) [0098.886] GetModuleInformation (in: hProcess=0x304, hModule=0x775b0000, lpmodinfo=0x225cf88, cb=0xc | out: lpmodinfo=0x225cf88*(lpBaseOfDll=0x775b0000, SizeOfImage=0x100000, EntryPoint=0x775cb6ed)) returned 1 [0098.886] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.887] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x775b0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="USER32.dll") returned 0xa [0098.887] CoTaskMemFree (pv=0x5d7900) [0098.887] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.887] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x775b0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\USER32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll")) returned 0x1e [0098.887] CoTaskMemFree (pv=0x5d7900) [0098.887] GetModuleInformation (in: hProcess=0x304, hModule=0x75a70000, lpmodinfo=0x225f094, cb=0xc | out: lpmodinfo=0x225f094*(lpBaseOfDll=0x75a70000, SizeOfImage=0xa000, EntryPoint=0x75a736a0)) returned 1 [0098.887] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.887] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75a70000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="LPK.dll") returned 0x7 [0098.888] CoTaskMemFree (pv=0x5d7900) [0098.888] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.888] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75a70000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\LPK.dll" (normalized: "c:\\windows\\syswow64\\lpk.dll")) returned 0x1b [0098.888] CoTaskMemFree (pv=0x5d7900) [0098.888] GetModuleInformation (in: hProcess=0x304, hModule=0x758d0000, lpmodinfo=0x2261190, cb=0xc | out: lpmodinfo=0x2261190*(lpBaseOfDll=0x758d0000, SizeOfImage=0x9d000, EntryPoint=0x75903fd7)) returned 1 [0098.888] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.888] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x758d0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="USP10.dll") returned 0x9 [0098.889] CoTaskMemFree (pv=0x5d7900) [0098.889] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.889] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x758d0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\USP10.dll" (normalized: "c:\\windows\\syswow64\\usp10.dll")) returned 0x1d [0098.889] CoTaskMemFree (pv=0x5d7900) [0098.889] GetModuleInformation (in: hProcess=0x304, hModule=0x75f80000, lpmodinfo=0x2263320, cb=0xc | out: lpmodinfo=0x2263320*(lpBaseOfDll=0x75f80000, SizeOfImage=0x60000, EntryPoint=0x75f9158f)) returned 1 [0098.889] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.889] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75f80000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="IMM32.DLL") returned 0x9 [0098.889] CoTaskMemFree (pv=0x5d7900) [0098.890] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.890] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75f80000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\system32\\IMM32.DLL" (normalized: "c:\\windows\\system32\\imm32.dll")) returned 0x1d [0098.890] CoTaskMemFree (pv=0x5d7900) [0098.890] GetModuleInformation (in: hProcess=0x304, hModule=0x75ea0000, lpmodinfo=0x2265424, cb=0xc | out: lpmodinfo=0x2265424*(lpBaseOfDll=0x75ea0000, SizeOfImage=0xcc000, EntryPoint=0x75ea168b)) returned 1 [0098.890] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.890] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75ea0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="MSCTF.dll") returned 0x9 [0098.890] CoTaskMemFree (pv=0x5d7900) [0098.890] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.891] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75ea0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\MSCTF.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll")) returned 0x1d [0098.891] CoTaskMemFree (pv=0x5d7900) [0098.891] GetModuleInformation (in: hProcess=0x304, hModule=0x75420000, lpmodinfo=0x2267528, cb=0xc | out: lpmodinfo=0x2267528*(lpBaseOfDll=0x75420000, SizeOfImage=0x9000, EntryPoint=0x75421220)) returned 1 [0098.891] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.891] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75420000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="VERSION.dll") returned 0xb [0098.892] CoTaskMemFree (pv=0x5d7900) [0098.892] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.892] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75420000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\system32\\VERSION.dll" (normalized: "c:\\windows\\system32\\version.dll")) returned 0x1f [0098.892] CoTaskMemFree (pv=0x5d7900) [0098.892] GetModuleInformation (in: hProcess=0x304, hModule=0x74890000, lpmodinfo=0x2269634, cb=0xc | out: lpmodinfo=0x2269634*(lpBaseOfDll=0x74890000, SizeOfImage=0x6a8000, EntryPoint=0x749d7040)) returned 1 [0098.892] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.892] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x74890000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="clr.dll") returned 0x7 [0098.893] CoTaskMemFree (pv=0x5d7900) [0098.893] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.893] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x74890000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\clr.dll")) returned 0x35 [0098.893] CoTaskMemFree (pv=0x5d7900) [0098.893] GetModuleInformation (in: hProcess=0x304, hModule=0x75320000, lpmodinfo=0x226b764, cb=0xc | out: lpmodinfo=0x226b764*(lpBaseOfDll=0x75320000, SizeOfImage=0xf5000, EntryPoint=0x75374160)) returned 1 [0098.893] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.893] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75320000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="MSVCR120_CLR0400.dll") returned 0x14 [0098.894] CoTaskMemFree (pv=0x5d7900) [0098.894] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.894] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75320000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\system32\\MSVCR120_CLR0400.dll" (normalized: "c:\\windows\\system32\\msvcr120_clr0400.dll")) returned 0x28 [0098.894] CoTaskMemFree (pv=0x5d7900) [0098.894] GetModuleInformation (in: hProcess=0x304, hModule=0x72440000, lpmodinfo=0x226d898, cb=0xc | out: lpmodinfo=0x226d898*(lpBaseOfDll=0x72440000, SizeOfImage=0x122b000, EntryPoint=0x0)) returned 1 [0098.894] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.894] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x72440000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="mscorlib.ni.dll") returned 0xf [0098.895] CoTaskMemFree (pv=0x5d7900) [0098.895] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.895] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x72440000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\b7a12c4c0032847fcc6b9c710460456f\\mscorlib.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\mscorlib\\b7a12c4c0032847fcc6b9c710460456f\\mscorlib.ni.dll")) returned 0x68 [0098.895] CoTaskMemFree (pv=0x5d7900) [0098.895] GetModuleInformation (in: hProcess=0x304, hModule=0x764e0000, lpmodinfo=0x226fa40, cb=0xc | out: lpmodinfo=0x226fa40*(lpBaseOfDll=0x764e0000, SizeOfImage=0x15c000, EntryPoint=0x7652ba3d)) returned 1 [0098.895] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.896] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x764e0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="ole32.dll") returned 0x9 [0098.896] CoTaskMemFree (pv=0x5d7900) [0098.896] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.896] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x764e0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll")) returned 0x1d [0098.896] CoTaskMemFree (pv=0x5d7900) [0098.896] GetModuleInformation (in: hProcess=0x304, hModule=0x74f60000, lpmodinfo=0x2271b44, cb=0xc | out: lpmodinfo=0x2271b44*(lpBaseOfDll=0x74f60000, SizeOfImage=0x80000, EntryPoint=0x74f737c9)) returned 1 [0098.897] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.897] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x74f60000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="uxtheme.dll") returned 0xb [0098.897] CoTaskMemFree (pv=0x5d7900) [0098.897] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.897] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x74f60000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\system32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll")) returned 0x1f [0098.897] CoTaskMemFree (pv=0x5d7900) [0098.897] GetModuleInformation (in: hProcess=0x304, hModule=0x752a0000, lpmodinfo=0x2273c50, cb=0xc | out: lpmodinfo=0x2273c50*(lpBaseOfDll=0x752a0000, SizeOfImage=0x7d000, EntryPoint=0x752a1140)) returned 1 [0098.898] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.898] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x752a0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="clrjit.dll") returned 0xa [0098.898] CoTaskMemFree (pv=0x5d7900) [0098.898] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.898] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x752a0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clrjit.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\clrjit.dll")) returned 0x38 [0098.899] CoTaskMemFree (pv=0x5d7900) [0098.899] GetModuleInformation (in: hProcess=0x304, hModule=0x762b0000, lpmodinfo=0x2275d90, cb=0xc | out: lpmodinfo=0x2275d90*(lpBaseOfDll=0x762b0000, SizeOfImage=0x8f000, EntryPoint=0x762b3fb1)) returned 1 [0098.899] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.899] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x762b0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="OLEAUT32.dll") returned 0xc [0098.899] CoTaskMemFree (pv=0x5d7900) [0098.899] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.899] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x762b0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\OLEAUT32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll")) returned 0x20 [0098.900] CoTaskMemFree (pv=0x5d7900) [0098.900] GetModuleInformation (in: hProcess=0x304, hModule=0x736d0000, lpmodinfo=0x2277ea4, cb=0xc | out: lpmodinfo=0x2277ea4*(lpBaseOfDll=0x736d0000, SizeOfImage=0x9ad000, EntryPoint=0x0)) returned 1 [0098.900] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.900] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x736d0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="System.ni.dll") returned 0xd [0098.901] CoTaskMemFree (pv=0x5d7900) [0098.901] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.901] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x736d0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System\\500ffa28b327e171fe664023003e947e\\System.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system\\500ffa28b327e171fe664023003e947e\\system.ni.dll")) returned 0x64 [0098.901] CoTaskMemFree (pv=0x5d7900) [0098.901] GetModuleInformation (in: hProcess=0x304, hModule=0x71d20000, lpmodinfo=0x227a040, cb=0xc | out: lpmodinfo=0x227a040*(lpBaseOfDll=0x71d20000, SizeOfImage=0x716000, EntryPoint=0x0)) returned 1 [0098.902] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.902] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x71d20000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="System.Core.ni.dll") returned 0x12 [0098.902] CoTaskMemFree (pv=0x5d7900) [0098.902] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.902] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x71d20000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Core\\386fde9190d499d6645df8b90eb76242\\System.Core.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.core\\386fde9190d499d6645df8b90eb76242\\system.core.ni.dll")) returned 0x6e [0098.902] CoTaskMemFree (pv=0x5d7900) [0098.902] GetModuleInformation (in: hProcess=0x304, hModule=0x750d0000, lpmodinfo=0x227c1fc, cb=0xc | out: lpmodinfo=0x227c1fc*(lpBaseOfDll=0x750d0000, SizeOfImage=0x1cb000, EntryPoint=0x0)) returned 1 [0098.903] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.903] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x750d0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="Microsoft.VisualBasic.ni.dll") returned 0x1c [0098.903] CoTaskMemFree (pv=0x5d7900) [0098.903] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.903] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x750d0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Microsoft.V9921e851#\\cfbddeb6e93e8f421b92229b20e51233\\Microsoft.VisualBasic.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\microsoft.v9921e851#\\cfbddeb6e93e8f421b92229b20e51233\\microsoft.visualbasic.ni.dll")) returned 0x81 [0098.904] CoTaskMemFree (pv=0x5d7900) [0098.904] GetModuleInformation (in: hProcess=0x304, hModule=0x750b0000, lpmodinfo=0x227e3f0, cb=0xc | out: lpmodinfo=0x227e3f0*(lpBaseOfDll=0x750b0000, SizeOfImage=0x13000, EntryPoint=0x750b18f0)) returned 1 [0098.904] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.904] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x750b0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="nlssorting.dll") returned 0xe [0098.905] CoTaskMemFree (pv=0x5d7900) [0098.905] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.905] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x750b0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\nlssorting.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\nlssorting.dll")) returned 0x3c [0098.905] CoTaskMemFree (pv=0x5d7900) [0098.905] GetModuleInformation (in: hProcess=0x304, hModule=0x74870000, lpmodinfo=0x2280540, cb=0xc | out: lpmodinfo=0x2280540*(lpBaseOfDll=0x74870000, SizeOfImage=0x16000, EntryPoint=0x74872dc3)) returned 1 [0098.906] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.906] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x74870000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="CRYPTSP.dll") returned 0xb [0098.906] CoTaskMemFree (pv=0x5d7900) [0098.906] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.906] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x74870000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\system32\\CRYPTSP.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll")) returned 0x1f [0098.907] CoTaskMemFree (pv=0x5d7900) [0098.907] GetModuleInformation (in: hProcess=0x304, hModule=0x74830000, lpmodinfo=0x228264c, cb=0xc | out: lpmodinfo=0x228264c*(lpBaseOfDll=0x74830000, SizeOfImage=0x3b000, EntryPoint=0x7483128d)) returned 1 [0098.907] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.907] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x74830000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="rsaenh.dll") returned 0xa [0098.908] CoTaskMemFree (pv=0x5d7900) [0098.908] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.908] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x74830000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\system32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll")) returned 0x1e [0098.908] CoTaskMemFree (pv=0x5d7900) [0098.908] GetModuleInformation (in: hProcess=0x304, hModule=0x75a60000, lpmodinfo=0x2284864, cb=0xc | out: lpmodinfo=0x2284864*(lpBaseOfDll=0x75a60000, SizeOfImage=0x5000, EntryPoint=0x75a61438)) returned 1 [0098.909] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.909] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75a60000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="psapi.dll") returned 0x9 [0098.909] CoTaskMemFree (pv=0x5d7900) [0098.909] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.909] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75a60000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\psapi.dll" (normalized: "c:\\windows\\syswow64\\psapi.dll")) returned 0x1d [0098.910] CoTaskMemFree (pv=0x5d7900) [0098.910] GetModuleInformation (in: hProcess=0x304, hModule=0x746a0000, lpmodinfo=0x2286968, cb=0xc | out: lpmodinfo=0x2286968*(lpBaseOfDll=0x746a0000, SizeOfImage=0x18d000, EntryPoint=0x0)) returned 1 [0098.910] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.910] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x746a0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="System.Drawing.ni.dll") returned 0x15 [0098.911] CoTaskMemFree (pv=0x5d7900) [0098.911] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.911] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x746a0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Drawing\\553c0312fdf5a5449f3649f0515e70fb\\System.Drawing.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.drawing\\553c0312fdf5a5449f3649f0515e70fb\\system.drawing.ni.dll")) returned 0x74 [0098.911] CoTaskMemFree (pv=0x5d7900) [0098.911] GetModuleInformation (in: hProcess=0x304, hModule=0x710c0000, lpmodinfo=0x2288b34, cb=0xc | out: lpmodinfo=0x2288b34*(lpBaseOfDll=0x710c0000, SizeOfImage=0xc58000, EntryPoint=0x0)) returned 1 [0098.912] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.912] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x710c0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="System.Windows.Forms.ni.dll") returned 0x1b [0098.912] CoTaskMemFree (pv=0x5d7900) [0098.912] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.912] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x710c0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Windows.Forms\\7a6894982f35a1d75ec73d447c583da2\\System.Windows.Forms.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.windows.forms\\7a6894982f35a1d75ec73d447c583da2\\system.windows.forms.ni.dll")) returned 0x80 [0098.913] CoTaskMemFree (pv=0x5d7900) [0098.913] CloseHandle (hObject=0x304) returned 1 [0098.914] GetCurrentProcessId () returned 0x9f8 [0098.914] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x9f8) returned 0x304 [0098.914] EnumProcessModules (in: hProcess=0x304, lphModule=0x237eddc, cb=0x100, lpcbNeeded=0x498850 | out: lphModule=0x237eddc, lpcbNeeded=0x498850) returned 1 [0098.914] GetModuleInformation (in: hProcess=0x304, hModule=0x310000, lpmodinfo=0x237ef1c, cb=0xc | out: lpmodinfo=0x237ef1c*(lpBaseOfDll=0x310000, SizeOfImage=0x3e000, EntryPoint=0x3479ce)) returned 1 [0098.914] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.914] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x310000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="unlikexpc.exe") returned 0xd [0098.915] CoTaskMemFree (pv=0x5d7900) [0098.915] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.915] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x310000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\unlikexpc.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\unlikexpc.exe")) returned 0x33 [0098.915] CoTaskMemFree (pv=0x5d7900) [0098.915] GetModuleInformation (in: hProcess=0x304, hModule=0x77ab0000, lpmodinfo=0x2381070, cb=0xc | out: lpmodinfo=0x2381070*(lpBaseOfDll=0x77ab0000, SizeOfImage=0x180000, EntryPoint=0x0)) returned 1 [0098.915] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.915] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x77ab0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="ntdll.dll") returned 0x9 [0098.915] CoTaskMemFree (pv=0x5d7900) [0098.915] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.915] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x77ab0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll")) returned 0x1d [0098.915] CoTaskMemFree (pv=0x5d7900) [0098.915] GetModuleInformation (in: hProcess=0x304, hModule=0x754b0000, lpmodinfo=0x2383174, cb=0xc | out: lpmodinfo=0x2383174*(lpBaseOfDll=0x754b0000, SizeOfImage=0x4a000, EntryPoint=0x754b2e54)) returned 1 [0098.915] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.915] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x754b0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="MSCOREE.DLL") returned 0xb [0098.915] CoTaskMemFree (pv=0x5d7900) [0098.915] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.915] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x754b0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\MSCOREE.DLL" (normalized: "c:\\windows\\system32\\mscoree.dll")) returned 0x1f [0098.916] CoTaskMemFree (pv=0x5d7900) [0098.916] GetModuleInformation (in: hProcess=0x304, hModule=0x757c0000, lpmodinfo=0x2385280, cb=0xc | out: lpmodinfo=0x2385280*(lpBaseOfDll=0x757c0000, SizeOfImage=0x110000, EntryPoint=0x757d32d3)) returned 1 [0098.916] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.916] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x757c0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="KERNEL32.dll") returned 0xc [0098.916] CoTaskMemFree (pv=0x5d7900) [0098.916] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.916] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x757c0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\KERNEL32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll")) returned 0x20 [0098.916] CoTaskMemFree (pv=0x5d7900) [0098.916] GetModuleInformation (in: hProcess=0x304, hModule=0x76260000, lpmodinfo=0x2387394, cb=0xc | out: lpmodinfo=0x2387394*(lpBaseOfDll=0x76260000, SizeOfImage=0x46000, EntryPoint=0x76267478)) returned 1 [0098.916] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.916] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x76260000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="KERNELBASE.dll") returned 0xe [0098.916] CoTaskMemFree (pv=0x5d7900) [0098.916] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.917] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x76260000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\KERNELBASE.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll")) returned 0x22 [0098.917] CoTaskMemFree (pv=0x5d7900) [0098.917] GetModuleInformation (in: hProcess=0x304, hModule=0x75720000, lpmodinfo=0x23894dc, cb=0xc | out: lpmodinfo=0x23894dc*(lpBaseOfDll=0x75720000, SizeOfImage=0xa0000, EntryPoint=0x757349e5)) returned 1 [0098.917] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.917] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75720000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="ADVAPI32.dll") returned 0xc [0098.917] CoTaskMemFree (pv=0x5d7900) [0098.917] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.917] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75720000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\ADVAPI32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll")) returned 0x20 [0098.917] CoTaskMemFree (pv=0x5d7900) [0098.917] GetModuleInformation (in: hProcess=0x304, hModule=0x75fe0000, lpmodinfo=0x238b5f0, cb=0xc | out: lpmodinfo=0x238b5f0*(lpBaseOfDll=0x75fe0000, SizeOfImage=0xac000, EntryPoint=0x75fea472)) returned 1 [0098.917] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.917] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75fe0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="msvcrt.dll") returned 0xa [0098.918] CoTaskMemFree (pv=0x5d7900) [0098.918] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.918] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75fe0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll")) returned 0x1e [0098.918] CoTaskMemFree (pv=0x5d7900) [0098.918] GetModuleInformation (in: hProcess=0x304, hModule=0x761b0000, lpmodinfo=0x238d6fc, cb=0xc | out: lpmodinfo=0x238d6fc*(lpBaseOfDll=0x761b0000, SizeOfImage=0x19000, EntryPoint=0x761b4975)) returned 1 [0098.918] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.918] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x761b0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="sechost.dll") returned 0xb [0098.918] CoTaskMemFree (pv=0x5d7900) [0098.918] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.918] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x761b0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll")) returned 0x1f [0098.918] CoTaskMemFree (pv=0x5d7900) [0098.918] GetModuleInformation (in: hProcess=0x304, hModule=0x76090000, lpmodinfo=0x238f808, cb=0xc | out: lpmodinfo=0x238f808*(lpBaseOfDll=0x76090000, SizeOfImage=0xf0000, EntryPoint=0x760a0569)) returned 1 [0098.919] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.919] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x76090000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="RPCRT4.dll") returned 0xa [0098.919] CoTaskMemFree (pv=0x5d7900) [0098.919] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.919] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x76090000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\RPCRT4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll")) returned 0x1e [0098.919] CoTaskMemFree (pv=0x5d7900) [0098.919] GetModuleInformation (in: hProcess=0x304, hModule=0x75610000, lpmodinfo=0x2391960, cb=0xc | out: lpmodinfo=0x2391960*(lpBaseOfDll=0x75610000, SizeOfImage=0x60000, EntryPoint=0x7562a3b3)) returned 1 [0098.919] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.919] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75610000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="SspiCli.dll") returned 0xb [0098.920] CoTaskMemFree (pv=0x5d7900) [0098.920] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.920] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75610000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\SspiCli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll")) returned 0x1f [0098.920] CoTaskMemFree (pv=0x5d7900) [0098.920] GetModuleInformation (in: hProcess=0x304, hModule=0x75600000, lpmodinfo=0x2393a6c, cb=0xc | out: lpmodinfo=0x2393a6c*(lpBaseOfDll=0x75600000, SizeOfImage=0xc000, EntryPoint=0x756010e1)) returned 1 [0098.920] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.920] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75600000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="CRYPTBASE.dll") returned 0xd [0098.920] CoTaskMemFree (pv=0x5d7900) [0098.920] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.920] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75600000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\CRYPTBASE.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll")) returned 0x21 [0098.920] CoTaskMemFree (pv=0x5d7900) [0098.921] GetModuleInformation (in: hProcess=0x304, hModule=0x75430000, lpmodinfo=0x2395b80, cb=0xc | out: lpmodinfo=0x2395b80*(lpBaseOfDll=0x75430000, SizeOfImage=0x78000, EntryPoint=0x7543f7ba)) returned 1 [0098.921] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.921] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75430000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="mscoreei.dll") returned 0xc [0098.921] CoTaskMemFree (pv=0x5d7900) [0098.921] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.921] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75430000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscoreei.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\mscoreei.dll")) returned 0x3a [0098.921] CoTaskMemFree (pv=0x5d7900) [0098.921] GetModuleInformation (in: hProcess=0x304, hModule=0x761d0000, lpmodinfo=0x2397cc8, cb=0xc | out: lpmodinfo=0x2397cc8*(lpBaseOfDll=0x761d0000, SizeOfImage=0x57000, EntryPoint=0x761e9ba6)) returned 1 [0098.922] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.922] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x761d0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="SHLWAPI.dll") returned 0xb [0098.922] CoTaskMemFree (pv=0x5d7900) [0098.922] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.922] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x761d0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\SHLWAPI.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll")) returned 0x1f [0098.922] CoTaskMemFree (pv=0x5d7900) [0098.922] GetModuleInformation (in: hProcess=0x304, hModule=0x766d0000, lpmodinfo=0x2399dd4, cb=0xc | out: lpmodinfo=0x2399dd4*(lpBaseOfDll=0x766d0000, SizeOfImage=0x90000, EntryPoint=0x766e6343)) returned 1 [0098.922] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.922] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x766d0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="GDI32.dll") returned 0x9 [0098.923] CoTaskMemFree (pv=0x5d7900) [0098.923] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.923] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x766d0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\GDI32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll")) returned 0x1d [0098.923] CoTaskMemFree (pv=0x5d7900) [0098.923] GetModuleInformation (in: hProcess=0x304, hModule=0x775b0000, lpmodinfo=0x239bed8, cb=0xc | out: lpmodinfo=0x239bed8*(lpBaseOfDll=0x775b0000, SizeOfImage=0x100000, EntryPoint=0x775cb6ed)) returned 1 [0098.923] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.923] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x775b0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="USER32.dll") returned 0xa [0098.923] CoTaskMemFree (pv=0x5d7900) [0098.923] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.923] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x775b0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\USER32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll")) returned 0x1e [0098.924] CoTaskMemFree (pv=0x5d7900) [0098.924] GetModuleInformation (in: hProcess=0x304, hModule=0x75a70000, lpmodinfo=0x239dfe4, cb=0xc | out: lpmodinfo=0x239dfe4*(lpBaseOfDll=0x75a70000, SizeOfImage=0xa000, EntryPoint=0x75a736a0)) returned 1 [0098.924] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.924] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75a70000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="LPK.dll") returned 0x7 [0098.924] CoTaskMemFree (pv=0x5d7900) [0098.924] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.924] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75a70000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\LPK.dll" (normalized: "c:\\windows\\syswow64\\lpk.dll")) returned 0x1b [0098.925] CoTaskMemFree (pv=0x5d7900) [0098.925] GetModuleInformation (in: hProcess=0x304, hModule=0x758d0000, lpmodinfo=0x23a00e0, cb=0xc | out: lpmodinfo=0x23a00e0*(lpBaseOfDll=0x758d0000, SizeOfImage=0x9d000, EntryPoint=0x75903fd7)) returned 1 [0098.925] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.925] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x758d0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="USP10.dll") returned 0x9 [0098.925] CoTaskMemFree (pv=0x5d7900) [0098.925] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.925] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x758d0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\USP10.dll" (normalized: "c:\\windows\\syswow64\\usp10.dll")) returned 0x1d [0098.925] CoTaskMemFree (pv=0x5d7900) [0098.925] GetModuleInformation (in: hProcess=0x304, hModule=0x75f80000, lpmodinfo=0x23a2270, cb=0xc | out: lpmodinfo=0x23a2270*(lpBaseOfDll=0x75f80000, SizeOfImage=0x60000, EntryPoint=0x75f9158f)) returned 1 [0098.926] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.926] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75f80000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="IMM32.DLL") returned 0x9 [0098.926] CoTaskMemFree (pv=0x5d7900) [0098.926] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.926] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75f80000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\system32\\IMM32.DLL" (normalized: "c:\\windows\\system32\\imm32.dll")) returned 0x1d [0098.926] CoTaskMemFree (pv=0x5d7900) [0098.926] GetModuleInformation (in: hProcess=0x304, hModule=0x75ea0000, lpmodinfo=0x23a4374, cb=0xc | out: lpmodinfo=0x23a4374*(lpBaseOfDll=0x75ea0000, SizeOfImage=0xcc000, EntryPoint=0x75ea168b)) returned 1 [0098.927] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.927] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75ea0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="MSCTF.dll") returned 0x9 [0098.927] CoTaskMemFree (pv=0x5d7900) [0098.927] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.927] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75ea0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\MSCTF.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll")) returned 0x1d [0098.927] CoTaskMemFree (pv=0x5d7900) [0098.927] GetModuleInformation (in: hProcess=0x304, hModule=0x75420000, lpmodinfo=0x23a6478, cb=0xc | out: lpmodinfo=0x23a6478*(lpBaseOfDll=0x75420000, SizeOfImage=0x9000, EntryPoint=0x75421220)) returned 1 [0098.928] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.928] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75420000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="VERSION.dll") returned 0xb [0098.928] CoTaskMemFree (pv=0x5d7900) [0098.928] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.928] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75420000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\system32\\VERSION.dll" (normalized: "c:\\windows\\system32\\version.dll")) returned 0x1f [0098.928] CoTaskMemFree (pv=0x5d7900) [0098.928] GetModuleInformation (in: hProcess=0x304, hModule=0x74890000, lpmodinfo=0x23a8584, cb=0xc | out: lpmodinfo=0x23a8584*(lpBaseOfDll=0x74890000, SizeOfImage=0x6a8000, EntryPoint=0x749d7040)) returned 1 [0098.929] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.929] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x74890000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="clr.dll") returned 0x7 [0098.929] CoTaskMemFree (pv=0x5d7900) [0098.929] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.929] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x74890000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\clr.dll")) returned 0x35 [0098.929] CoTaskMemFree (pv=0x5d7900) [0098.929] GetModuleInformation (in: hProcess=0x304, hModule=0x75320000, lpmodinfo=0x23aa6b4, cb=0xc | out: lpmodinfo=0x23aa6b4*(lpBaseOfDll=0x75320000, SizeOfImage=0xf5000, EntryPoint=0x75374160)) returned 1 [0098.930] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.930] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75320000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="MSVCR120_CLR0400.dll") returned 0x14 [0098.930] CoTaskMemFree (pv=0x5d7900) [0098.930] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.930] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75320000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\system32\\MSVCR120_CLR0400.dll" (normalized: "c:\\windows\\system32\\msvcr120_clr0400.dll")) returned 0x28 [0098.930] CoTaskMemFree (pv=0x5d7900) [0098.930] GetModuleInformation (in: hProcess=0x304, hModule=0x72440000, lpmodinfo=0x23ac7e8, cb=0xc | out: lpmodinfo=0x23ac7e8*(lpBaseOfDll=0x72440000, SizeOfImage=0x122b000, EntryPoint=0x0)) returned 1 [0098.931] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.931] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x72440000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="mscorlib.ni.dll") returned 0xf [0098.931] CoTaskMemFree (pv=0x5d7900) [0098.931] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.931] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x72440000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\b7a12c4c0032847fcc6b9c710460456f\\mscorlib.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\mscorlib\\b7a12c4c0032847fcc6b9c710460456f\\mscorlib.ni.dll")) returned 0x68 [0098.932] CoTaskMemFree (pv=0x5d7900) [0098.932] GetModuleInformation (in: hProcess=0x304, hModule=0x764e0000, lpmodinfo=0x23ae990, cb=0xc | out: lpmodinfo=0x23ae990*(lpBaseOfDll=0x764e0000, SizeOfImage=0x15c000, EntryPoint=0x7652ba3d)) returned 1 [0098.932] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.932] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x764e0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="ole32.dll") returned 0x9 [0098.932] CoTaskMemFree (pv=0x5d7900) [0098.932] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.932] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x764e0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll")) returned 0x1d [0098.933] CoTaskMemFree (pv=0x5d7900) [0098.933] GetModuleInformation (in: hProcess=0x304, hModule=0x74f60000, lpmodinfo=0x23b0a94, cb=0xc | out: lpmodinfo=0x23b0a94*(lpBaseOfDll=0x74f60000, SizeOfImage=0x80000, EntryPoint=0x74f737c9)) returned 1 [0098.933] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.933] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x74f60000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="uxtheme.dll") returned 0xb [0098.934] CoTaskMemFree (pv=0x5d7900) [0098.934] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.934] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x74f60000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\system32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll")) returned 0x1f [0098.934] CoTaskMemFree (pv=0x5d7900) [0098.934] GetModuleInformation (in: hProcess=0x304, hModule=0x752a0000, lpmodinfo=0x23b2ba0, cb=0xc | out: lpmodinfo=0x23b2ba0*(lpBaseOfDll=0x752a0000, SizeOfImage=0x7d000, EntryPoint=0x752a1140)) returned 1 [0098.934] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.934] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x752a0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="clrjit.dll") returned 0xa [0098.935] CoTaskMemFree (pv=0x5d7900) [0098.935] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.935] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x752a0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clrjit.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\clrjit.dll")) returned 0x38 [0098.935] CoTaskMemFree (pv=0x5d7900) [0098.935] GetModuleInformation (in: hProcess=0x304, hModule=0x762b0000, lpmodinfo=0x23b4ce0, cb=0xc | out: lpmodinfo=0x23b4ce0*(lpBaseOfDll=0x762b0000, SizeOfImage=0x8f000, EntryPoint=0x762b3fb1)) returned 1 [0098.936] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.936] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x762b0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="OLEAUT32.dll") returned 0xc [0098.936] CoTaskMemFree (pv=0x5d7900) [0098.936] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.936] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x762b0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\OLEAUT32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll")) returned 0x20 [0098.937] CoTaskMemFree (pv=0x5d7900) [0098.937] GetModuleInformation (in: hProcess=0x304, hModule=0x736d0000, lpmodinfo=0x23b6df4, cb=0xc | out: lpmodinfo=0x23b6df4*(lpBaseOfDll=0x736d0000, SizeOfImage=0x9ad000, EntryPoint=0x0)) returned 1 [0098.937] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.937] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x736d0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="System.ni.dll") returned 0xd [0098.938] CoTaskMemFree (pv=0x5d7900) [0098.938] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.938] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x736d0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System\\500ffa28b327e171fe664023003e947e\\System.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system\\500ffa28b327e171fe664023003e947e\\system.ni.dll")) returned 0x64 [0098.938] CoTaskMemFree (pv=0x5d7900) [0098.939] GetModuleInformation (in: hProcess=0x304, hModule=0x71d20000, lpmodinfo=0x23b8f90, cb=0xc | out: lpmodinfo=0x23b8f90*(lpBaseOfDll=0x71d20000, SizeOfImage=0x716000, EntryPoint=0x0)) returned 1 [0098.939] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.939] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x71d20000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="System.Core.ni.dll") returned 0x12 [0098.940] CoTaskMemFree (pv=0x5d7900) [0098.940] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.940] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x71d20000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Core\\386fde9190d499d6645df8b90eb76242\\System.Core.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.core\\386fde9190d499d6645df8b90eb76242\\system.core.ni.dll")) returned 0x6e [0098.940] CoTaskMemFree (pv=0x5d7900) [0098.940] GetModuleInformation (in: hProcess=0x304, hModule=0x750d0000, lpmodinfo=0x23bb14c, cb=0xc | out: lpmodinfo=0x23bb14c*(lpBaseOfDll=0x750d0000, SizeOfImage=0x1cb000, EntryPoint=0x0)) returned 1 [0098.941] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.941] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x750d0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="Microsoft.VisualBasic.ni.dll") returned 0x1c [0098.941] CoTaskMemFree (pv=0x5d7900) [0098.941] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.941] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x750d0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Microsoft.V9921e851#\\cfbddeb6e93e8f421b92229b20e51233\\Microsoft.VisualBasic.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\microsoft.v9921e851#\\cfbddeb6e93e8f421b92229b20e51233\\microsoft.visualbasic.ni.dll")) returned 0x81 [0098.942] CoTaskMemFree (pv=0x5d7900) [0098.942] GetModuleInformation (in: hProcess=0x304, hModule=0x750b0000, lpmodinfo=0x23bd340, cb=0xc | out: lpmodinfo=0x23bd340*(lpBaseOfDll=0x750b0000, SizeOfImage=0x13000, EntryPoint=0x750b18f0)) returned 1 [0098.942] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.942] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x750b0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="nlssorting.dll") returned 0xe [0098.943] CoTaskMemFree (pv=0x5d7900) [0098.943] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.943] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x750b0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\nlssorting.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\nlssorting.dll")) returned 0x3c [0098.943] CoTaskMemFree (pv=0x5d7900) [0098.943] GetModuleInformation (in: hProcess=0x304, hModule=0x74870000, lpmodinfo=0x23bf490, cb=0xc | out: lpmodinfo=0x23bf490*(lpBaseOfDll=0x74870000, SizeOfImage=0x16000, EntryPoint=0x74872dc3)) returned 1 [0098.943] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.944] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x74870000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="CRYPTSP.dll") returned 0xb [0098.944] CoTaskMemFree (pv=0x5d7900) [0098.944] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.944] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x74870000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\system32\\CRYPTSP.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll")) returned 0x1f [0098.944] CoTaskMemFree (pv=0x5d7900) [0098.944] GetModuleInformation (in: hProcess=0x304, hModule=0x74830000, lpmodinfo=0x23c159c, cb=0xc | out: lpmodinfo=0x23c159c*(lpBaseOfDll=0x74830000, SizeOfImage=0x3b000, EntryPoint=0x7483128d)) returned 1 [0098.945] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.945] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x74830000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="rsaenh.dll") returned 0xa [0098.945] CoTaskMemFree (pv=0x5d7900) [0098.945] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.945] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x74830000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\system32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll")) returned 0x1e [0098.946] CoTaskMemFree (pv=0x5d7900) [0098.946] GetModuleInformation (in: hProcess=0x304, hModule=0x75a60000, lpmodinfo=0x23c37b4, cb=0xc | out: lpmodinfo=0x23c37b4*(lpBaseOfDll=0x75a60000, SizeOfImage=0x5000, EntryPoint=0x75a61438)) returned 1 [0098.946] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.946] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75a60000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="psapi.dll") returned 0x9 [0098.947] CoTaskMemFree (pv=0x5d7900) [0098.947] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.947] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75a60000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\psapi.dll" (normalized: "c:\\windows\\syswow64\\psapi.dll")) returned 0x1d [0098.947] CoTaskMemFree (pv=0x5d7900) [0098.947] GetModuleInformation (in: hProcess=0x304, hModule=0x746a0000, lpmodinfo=0x23c58b8, cb=0xc | out: lpmodinfo=0x23c58b8*(lpBaseOfDll=0x746a0000, SizeOfImage=0x18d000, EntryPoint=0x0)) returned 1 [0098.948] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.948] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x746a0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="System.Drawing.ni.dll") returned 0x15 [0098.948] CoTaskMemFree (pv=0x5d7900) [0098.948] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.948] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x746a0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Drawing\\553c0312fdf5a5449f3649f0515e70fb\\System.Drawing.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.drawing\\553c0312fdf5a5449f3649f0515e70fb\\system.drawing.ni.dll")) returned 0x74 [0098.949] CoTaskMemFree (pv=0x5d7900) [0098.949] GetModuleInformation (in: hProcess=0x304, hModule=0x710c0000, lpmodinfo=0x23c7a84, cb=0xc | out: lpmodinfo=0x23c7a84*(lpBaseOfDll=0x710c0000, SizeOfImage=0xc58000, EntryPoint=0x0)) returned 1 [0098.949] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.949] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x710c0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="System.Windows.Forms.ni.dll") returned 0x1b [0098.950] CoTaskMemFree (pv=0x5d7900) [0098.950] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.950] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x710c0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Windows.Forms\\7a6894982f35a1d75ec73d447c583da2\\System.Windows.Forms.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.windows.forms\\7a6894982f35a1d75ec73d447c583da2\\system.windows.forms.ni.dll")) returned 0x80 [0098.950] CoTaskMemFree (pv=0x5d7900) [0098.950] CloseHandle (hObject=0x304) returned 1 [0098.953] EnumProcessModules (in: hProcess=0x304, lphModule=0x22c4648, cb=0x100, lpcbNeeded=0x498850 | out: lphModule=0x22c4648, lpcbNeeded=0x498850) returned 1 [0098.954] GetModuleInformation (in: hProcess=0x304, hModule=0x310000, lpmodinfo=0x22c4788, cb=0xc | out: lpmodinfo=0x22c4788*(lpBaseOfDll=0x310000, SizeOfImage=0x3e000, EntryPoint=0x3479ce)) returned 1 [0098.954] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.954] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x310000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="unlikexpc.exe") returned 0xd [0098.954] CoTaskMemFree (pv=0x5d7900) [0098.954] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.954] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x310000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\unlikexpc.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\unlikexpc.exe")) returned 0x33 [0098.954] CoTaskMemFree (pv=0x5d7900) [0098.954] GetModuleInformation (in: hProcess=0x304, hModule=0x77ab0000, lpmodinfo=0x22c68dc, cb=0xc | out: lpmodinfo=0x22c68dc*(lpBaseOfDll=0x77ab0000, SizeOfImage=0x180000, EntryPoint=0x0)) returned 1 [0098.954] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.954] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x77ab0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="ntdll.dll") returned 0x9 [0098.954] CoTaskMemFree (pv=0x5d7900) [0098.954] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.955] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x77ab0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll")) returned 0x1d [0098.955] CoTaskMemFree (pv=0x5d7900) [0098.955] GetModuleInformation (in: hProcess=0x304, hModule=0x754b0000, lpmodinfo=0x22c89e0, cb=0xc | out: lpmodinfo=0x22c89e0*(lpBaseOfDll=0x754b0000, SizeOfImage=0x4a000, EntryPoint=0x754b2e54)) returned 1 [0098.955] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.955] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x754b0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="MSCOREE.DLL") returned 0xb [0098.955] CoTaskMemFree (pv=0x5d7900) [0098.955] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.955] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x754b0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\MSCOREE.DLL" (normalized: "c:\\windows\\system32\\mscoree.dll")) returned 0x1f [0098.955] CoTaskMemFree (pv=0x5d7900) [0098.955] GetModuleInformation (in: hProcess=0x304, hModule=0x757c0000, lpmodinfo=0x22caaec, cb=0xc | out: lpmodinfo=0x22caaec*(lpBaseOfDll=0x757c0000, SizeOfImage=0x110000, EntryPoint=0x757d32d3)) returned 1 [0098.955] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.955] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x757c0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="KERNEL32.dll") returned 0xc [0098.955] CoTaskMemFree (pv=0x5d7900) [0098.955] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.955] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x757c0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\KERNEL32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll")) returned 0x20 [0098.956] CoTaskMemFree (pv=0x5d7900) [0098.956] GetModuleInformation (in: hProcess=0x304, hModule=0x76260000, lpmodinfo=0x22ccc00, cb=0xc | out: lpmodinfo=0x22ccc00*(lpBaseOfDll=0x76260000, SizeOfImage=0x46000, EntryPoint=0x76267478)) returned 1 [0098.956] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.956] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x76260000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="KERNELBASE.dll") returned 0xe [0098.956] CoTaskMemFree (pv=0x5d7900) [0098.956] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.956] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x76260000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\KERNELBASE.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll")) returned 0x22 [0098.956] CoTaskMemFree (pv=0x5d7900) [0098.956] GetModuleInformation (in: hProcess=0x304, hModule=0x75720000, lpmodinfo=0x22ced48, cb=0xc | out: lpmodinfo=0x22ced48*(lpBaseOfDll=0x75720000, SizeOfImage=0xa0000, EntryPoint=0x757349e5)) returned 1 [0098.956] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.956] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75720000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="ADVAPI32.dll") returned 0xc [0098.956] CoTaskMemFree (pv=0x5d7900) [0098.956] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.956] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75720000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\ADVAPI32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll")) returned 0x20 [0098.957] CoTaskMemFree (pv=0x5d7900) [0098.957] GetModuleInformation (in: hProcess=0x304, hModule=0x75fe0000, lpmodinfo=0x22d0e5c, cb=0xc | out: lpmodinfo=0x22d0e5c*(lpBaseOfDll=0x75fe0000, SizeOfImage=0xac000, EntryPoint=0x75fea472)) returned 1 [0098.957] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.957] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75fe0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="msvcrt.dll") returned 0xa [0098.957] CoTaskMemFree (pv=0x5d7900) [0098.957] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.957] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75fe0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll")) returned 0x1e [0098.957] CoTaskMemFree (pv=0x5d7900) [0098.957] GetModuleInformation (in: hProcess=0x304, hModule=0x761b0000, lpmodinfo=0x22d2f68, cb=0xc | out: lpmodinfo=0x22d2f68*(lpBaseOfDll=0x761b0000, SizeOfImage=0x19000, EntryPoint=0x761b4975)) returned 1 [0098.957] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.957] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x761b0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="sechost.dll") returned 0xb [0098.958] CoTaskMemFree (pv=0x5d7900) [0098.958] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.958] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x761b0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll")) returned 0x1f [0098.958] CoTaskMemFree (pv=0x5d7900) [0098.958] GetModuleInformation (in: hProcess=0x304, hModule=0x76090000, lpmodinfo=0x22d5074, cb=0xc | out: lpmodinfo=0x22d5074*(lpBaseOfDll=0x76090000, SizeOfImage=0xf0000, EntryPoint=0x760a0569)) returned 1 [0098.958] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.958] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x76090000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="RPCRT4.dll") returned 0xa [0098.958] CoTaskMemFree (pv=0x5d7900) [0098.958] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.958] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x76090000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\RPCRT4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll")) returned 0x1e [0098.958] CoTaskMemFree (pv=0x5d7900) [0098.958] GetModuleInformation (in: hProcess=0x304, hModule=0x75610000, lpmodinfo=0x22d71cc, cb=0xc | out: lpmodinfo=0x22d71cc*(lpBaseOfDll=0x75610000, SizeOfImage=0x60000, EntryPoint=0x7562a3b3)) returned 1 [0098.959] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.959] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75610000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="SspiCli.dll") returned 0xb [0098.959] CoTaskMemFree (pv=0x5d7900) [0098.959] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.959] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75610000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\SspiCli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll")) returned 0x1f [0098.959] CoTaskMemFree (pv=0x5d7900) [0098.959] GetModuleInformation (in: hProcess=0x304, hModule=0x75600000, lpmodinfo=0x22d92d8, cb=0xc | out: lpmodinfo=0x22d92d8*(lpBaseOfDll=0x75600000, SizeOfImage=0xc000, EntryPoint=0x756010e1)) returned 1 [0098.959] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.959] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75600000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="CRYPTBASE.dll") returned 0xd [0098.959] CoTaskMemFree (pv=0x5d7900) [0098.960] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.960] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75600000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\CRYPTBASE.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll")) returned 0x21 [0098.960] CoTaskMemFree (pv=0x5d7900) [0098.960] GetModuleInformation (in: hProcess=0x304, hModule=0x75430000, lpmodinfo=0x22db3ec, cb=0xc | out: lpmodinfo=0x22db3ec*(lpBaseOfDll=0x75430000, SizeOfImage=0x78000, EntryPoint=0x7543f7ba)) returned 1 [0098.960] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.960] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75430000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="mscoreei.dll") returned 0xc [0098.960] CoTaskMemFree (pv=0x5d7900) [0098.960] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.960] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75430000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscoreei.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\mscoreei.dll")) returned 0x3a [0098.960] CoTaskMemFree (pv=0x5d7900) [0098.961] GetModuleInformation (in: hProcess=0x304, hModule=0x761d0000, lpmodinfo=0x22dd534, cb=0xc | out: lpmodinfo=0x22dd534*(lpBaseOfDll=0x761d0000, SizeOfImage=0x57000, EntryPoint=0x761e9ba6)) returned 1 [0098.961] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.961] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x761d0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="SHLWAPI.dll") returned 0xb [0098.961] CoTaskMemFree (pv=0x5d7900) [0098.961] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.961] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x761d0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\SHLWAPI.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll")) returned 0x1f [0098.961] CoTaskMemFree (pv=0x5d7900) [0098.961] GetModuleInformation (in: hProcess=0x304, hModule=0x766d0000, lpmodinfo=0x22df640, cb=0xc | out: lpmodinfo=0x22df640*(lpBaseOfDll=0x766d0000, SizeOfImage=0x90000, EntryPoint=0x766e6343)) returned 1 [0098.961] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.962] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x766d0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="GDI32.dll") returned 0x9 [0098.962] CoTaskMemFree (pv=0x5d7900) [0098.962] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.962] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x766d0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\GDI32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll")) returned 0x1d [0098.962] CoTaskMemFree (pv=0x5d7900) [0098.962] GetModuleInformation (in: hProcess=0x304, hModule=0x775b0000, lpmodinfo=0x22e1744, cb=0xc | out: lpmodinfo=0x22e1744*(lpBaseOfDll=0x775b0000, SizeOfImage=0x100000, EntryPoint=0x775cb6ed)) returned 1 [0098.962] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.962] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x775b0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="USER32.dll") returned 0xa [0098.963] CoTaskMemFree (pv=0x5d7900) [0098.963] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.963] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x775b0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\USER32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll")) returned 0x1e [0098.963] CoTaskMemFree (pv=0x5d7900) [0098.963] GetModuleInformation (in: hProcess=0x304, hModule=0x75a70000, lpmodinfo=0x22e3850, cb=0xc | out: lpmodinfo=0x22e3850*(lpBaseOfDll=0x75a70000, SizeOfImage=0xa000, EntryPoint=0x75a736a0)) returned 1 [0098.963] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.963] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75a70000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="LPK.dll") returned 0x7 [0098.963] CoTaskMemFree (pv=0x5d7900) [0098.963] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.963] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75a70000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\LPK.dll" (normalized: "c:\\windows\\syswow64\\lpk.dll")) returned 0x1b [0098.964] CoTaskMemFree (pv=0x5d7900) [0098.964] GetModuleInformation (in: hProcess=0x304, hModule=0x758d0000, lpmodinfo=0x22e594c, cb=0xc | out: lpmodinfo=0x22e594c*(lpBaseOfDll=0x758d0000, SizeOfImage=0x9d000, EntryPoint=0x75903fd7)) returned 1 [0098.964] CoTaskMemAlloc (cb=0x804) returned 0x5d7900 [0098.964] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x758d0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="USP10.dll") returned 0x9 [0098.964] CoTaskMemFree (pv=0x5d7900) [0098.964] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x758d0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\USP10.dll" (normalized: "c:\\windows\\syswow64\\usp10.dll")) returned 0x1d [0098.965] GetModuleInformation (in: hProcess=0x304, hModule=0x75f80000, lpmodinfo=0x22e7adc, cb=0xc | out: lpmodinfo=0x22e7adc*(lpBaseOfDll=0x75f80000, SizeOfImage=0x60000, EntryPoint=0x75f9158f)) returned 1 [0098.965] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75f80000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="IMM32.DLL") returned 0x9 [0098.965] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75f80000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\system32\\IMM32.DLL" (normalized: "c:\\windows\\system32\\imm32.dll")) returned 0x1d [0098.966] GetModuleInformation (in: hProcess=0x304, hModule=0x75ea0000, lpmodinfo=0x22e9be0, cb=0xc | out: lpmodinfo=0x22e9be0*(lpBaseOfDll=0x75ea0000, SizeOfImage=0xcc000, EntryPoint=0x75ea168b)) returned 1 [0098.966] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75ea0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="MSCTF.dll") returned 0x9 [0098.966] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75ea0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\MSCTF.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll")) returned 0x1d [0098.966] GetModuleInformation (in: hProcess=0x304, hModule=0x75420000, lpmodinfo=0x22ebce4, cb=0xc | out: lpmodinfo=0x22ebce4*(lpBaseOfDll=0x75420000, SizeOfImage=0x9000, EntryPoint=0x75421220)) returned 1 [0098.967] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75420000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="VERSION.dll") returned 0xb [0098.967] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75420000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\system32\\VERSION.dll" (normalized: "c:\\windows\\system32\\version.dll")) returned 0x1f [0098.967] GetModuleInformation (in: hProcess=0x304, hModule=0x74890000, lpmodinfo=0x22eddf0, cb=0xc | out: lpmodinfo=0x22eddf0*(lpBaseOfDll=0x74890000, SizeOfImage=0x6a8000, EntryPoint=0x749d7040)) returned 1 [0098.968] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x74890000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="clr.dll") returned 0x7 [0098.968] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x74890000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\clr.dll")) returned 0x35 [0098.968] GetModuleInformation (in: hProcess=0x304, hModule=0x75320000, lpmodinfo=0x22eff20, cb=0xc | out: lpmodinfo=0x22eff20*(lpBaseOfDll=0x75320000, SizeOfImage=0xf5000, EntryPoint=0x75374160)) returned 1 [0098.969] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75320000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="MSVCR120_CLR0400.dll") returned 0x14 [0098.969] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75320000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\system32\\MSVCR120_CLR0400.dll" (normalized: "c:\\windows\\system32\\msvcr120_clr0400.dll")) returned 0x28 [0098.969] GetModuleInformation (in: hProcess=0x304, hModule=0x72440000, lpmodinfo=0x22f2054, cb=0xc | out: lpmodinfo=0x22f2054*(lpBaseOfDll=0x72440000, SizeOfImage=0x122b000, EntryPoint=0x0)) returned 1 [0098.970] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x72440000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="mscorlib.ni.dll") returned 0xf [0098.970] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x72440000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\b7a12c4c0032847fcc6b9c710460456f\\mscorlib.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\mscorlib\\b7a12c4c0032847fcc6b9c710460456f\\mscorlib.ni.dll")) returned 0x68 [0098.970] GetModuleInformation (in: hProcess=0x304, hModule=0x764e0000, lpmodinfo=0x22f41fc, cb=0xc | out: lpmodinfo=0x22f41fc*(lpBaseOfDll=0x764e0000, SizeOfImage=0x15c000, EntryPoint=0x7652ba3d)) returned 1 [0098.971] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x764e0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="ole32.dll") returned 0x9 [0098.971] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x764e0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll")) returned 0x1d [0098.971] GetModuleInformation (in: hProcess=0x304, hModule=0x74f60000, lpmodinfo=0x22f6300, cb=0xc | out: lpmodinfo=0x22f6300*(lpBaseOfDll=0x74f60000, SizeOfImage=0x80000, EntryPoint=0x74f737c9)) returned 1 [0098.972] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x74f60000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="uxtheme.dll") returned 0xb [0098.972] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x74f60000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\system32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll")) returned 0x1f [0098.972] GetModuleInformation (in: hProcess=0x304, hModule=0x752a0000, lpmodinfo=0x22f840c, cb=0xc | out: lpmodinfo=0x22f840c*(lpBaseOfDll=0x752a0000, SizeOfImage=0x7d000, EntryPoint=0x752a1140)) returned 1 [0098.973] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x752a0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="clrjit.dll") returned 0xa [0098.973] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x752a0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clrjit.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\clrjit.dll")) returned 0x38 [0098.974] GetModuleInformation (in: hProcess=0x304, hModule=0x762b0000, lpmodinfo=0x22fa54c, cb=0xc | out: lpmodinfo=0x22fa54c*(lpBaseOfDll=0x762b0000, SizeOfImage=0x8f000, EntryPoint=0x762b3fb1)) returned 1 [0098.974] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x762b0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="OLEAUT32.dll") returned 0xc [0098.974] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x762b0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\OLEAUT32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll")) returned 0x20 [0098.975] GetModuleInformation (in: hProcess=0x304, hModule=0x736d0000, lpmodinfo=0x22fc660, cb=0xc | out: lpmodinfo=0x22fc660*(lpBaseOfDll=0x736d0000, SizeOfImage=0x9ad000, EntryPoint=0x0)) returned 1 [0098.975] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x736d0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="System.ni.dll") returned 0xd [0098.975] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x736d0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System\\500ffa28b327e171fe664023003e947e\\System.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system\\500ffa28b327e171fe664023003e947e\\system.ni.dll")) returned 0x64 [0098.976] GetModuleInformation (in: hProcess=0x304, hModule=0x71d20000, lpmodinfo=0x22fe7fc, cb=0xc | out: lpmodinfo=0x22fe7fc*(lpBaseOfDll=0x71d20000, SizeOfImage=0x716000, EntryPoint=0x0)) returned 1 [0098.976] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x71d20000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="System.Core.ni.dll") returned 0x12 [0098.977] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x71d20000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Core\\386fde9190d499d6645df8b90eb76242\\System.Core.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.core\\386fde9190d499d6645df8b90eb76242\\system.core.ni.dll")) returned 0x6e [0098.977] GetModuleInformation (in: hProcess=0x304, hModule=0x750d0000, lpmodinfo=0x23009b8, cb=0xc | out: lpmodinfo=0x23009b8*(lpBaseOfDll=0x750d0000, SizeOfImage=0x1cb000, EntryPoint=0x0)) returned 1 [0098.977] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x750d0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="Microsoft.VisualBasic.ni.dll") returned 0x1c [0098.978] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x750d0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Microsoft.V9921e851#\\cfbddeb6e93e8f421b92229b20e51233\\Microsoft.VisualBasic.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\microsoft.v9921e851#\\cfbddeb6e93e8f421b92229b20e51233\\microsoft.visualbasic.ni.dll")) returned 0x81 [0098.978] GetModuleInformation (in: hProcess=0x304, hModule=0x750b0000, lpmodinfo=0x2302bac, cb=0xc | out: lpmodinfo=0x2302bac*(lpBaseOfDll=0x750b0000, SizeOfImage=0x13000, EntryPoint=0x750b18f0)) returned 1 [0098.979] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x750b0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="nlssorting.dll") returned 0xe [0098.979] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x750b0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\nlssorting.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\nlssorting.dll")) returned 0x3c [0098.979] GetModuleInformation (in: hProcess=0x304, hModule=0x74870000, lpmodinfo=0x2304cfc, cb=0xc | out: lpmodinfo=0x2304cfc*(lpBaseOfDll=0x74870000, SizeOfImage=0x16000, EntryPoint=0x74872dc3)) returned 1 [0098.980] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x74870000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="CRYPTSP.dll") returned 0xb [0098.980] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x74870000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\system32\\CRYPTSP.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll")) returned 0x1f [0098.981] GetModuleInformation (in: hProcess=0x304, hModule=0x74830000, lpmodinfo=0x2306e08, cb=0xc | out: lpmodinfo=0x2306e08*(lpBaseOfDll=0x74830000, SizeOfImage=0x3b000, EntryPoint=0x7483128d)) returned 1 [0098.981] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x74830000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="rsaenh.dll") returned 0xa [0098.982] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x74830000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\system32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll")) returned 0x1e [0098.982] GetModuleInformation (in: hProcess=0x304, hModule=0x75a60000, lpmodinfo=0x2309020, cb=0xc | out: lpmodinfo=0x2309020*(lpBaseOfDll=0x75a60000, SizeOfImage=0x5000, EntryPoint=0x75a61438)) returned 1 [0098.982] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75a60000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="psapi.dll") returned 0x9 [0098.983] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75a60000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\psapi.dll" (normalized: "c:\\windows\\syswow64\\psapi.dll")) returned 0x1d [0098.983] GetModuleInformation (in: hProcess=0x304, hModule=0x746a0000, lpmodinfo=0x230b124, cb=0xc | out: lpmodinfo=0x230b124*(lpBaseOfDll=0x746a0000, SizeOfImage=0x18d000, EntryPoint=0x0)) returned 1 [0098.984] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x746a0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="System.Drawing.ni.dll") returned 0x15 [0098.984] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x746a0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Drawing\\553c0312fdf5a5449f3649f0515e70fb\\System.Drawing.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.drawing\\553c0312fdf5a5449f3649f0515e70fb\\system.drawing.ni.dll")) returned 0x74 [0098.985] GetModuleInformation (in: hProcess=0x304, hModule=0x710c0000, lpmodinfo=0x230d2f0, cb=0xc | out: lpmodinfo=0x230d2f0*(lpBaseOfDll=0x710c0000, SizeOfImage=0xc58000, EntryPoint=0x0)) returned 1 [0098.985] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x710c0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="System.Windows.Forms.ni.dll") returned 0x1b [0098.986] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x710c0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Windows.Forms\\7a6894982f35a1d75ec73d447c583da2\\System.Windows.Forms.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.windows.forms\\7a6894982f35a1d75ec73d447c583da2\\system.windows.forms.ni.dll")) returned 0x80 [0098.988] lstrcatA (in: lpString1="", lpString2="w" | out: lpString1="w") returned="w" [0098.988] lstrcatA (in: lpString1="w", lpString2="?" | out: lpString1="w?") returned="w?" [0098.988] lstrcatA (in: lpString1="w?", lpString2="x" | out: lpString1="w?x") returned="w?x" [0098.988] lstrcatA (in: lpString1="w?x", lpString2="T" | out: lpString1="w?xT") returned="w?xT" [0098.988] lstrcatA (in: lpString1="w?xT", lpString2="u" | out: lpString1="w?xTu") returned="w?xTu" [0098.988] lstrcatA (in: lpString1="w?xTu", lpString2="e" | out: lpString1="w?xTue") returned="w?xTue" [0098.988] lstrcatA (in: lpString1="w?xTue", lpString2="a" | out: lpString1="w?xTuea") returned="w?xTuea" [0098.988] lstrcatA (in: lpString1="w?xTuea", lpString2="E" | out: lpString1="w?xTueaE") returned="w?xTueaE" [0098.988] lstrcatA (in: lpString1="w?xTueaE", lpString2="Y" | out: lpString1="w?xTueaEY") returned="w?xTueaEY" [0098.988] lstrcatA (in: lpString1="w?xTueaEY", lpString2="?" | out: lpString1="w?xTueaEY?") returned="w?xTueaEY?" [0098.989] lstrcatA (in: lpString1="w?xTueaEY?", lpString2="?" | out: lpString1="w?xTueaEY??") returned="w?xTueaEY??" [0098.989] lstrcatA (in: lpString1="w?xTueaEY??", lpString2="l" | out: lpString1="w?xTueaEY??l") returned="w?xTueaEY??l" [0098.989] lstrcatA (in: lpString1="w?xTueaEY??l", lpString2="Y" | out: lpString1="w?xTueaEY??lY") returned="w?xTueaEY??lY" [0098.989] lstrcatA (in: lpString1="w?xTueaEY??lY", lpString2="S" | out: lpString1="w?xTueaEY??lYS") returned="w?xTueaEY??lYS" [0098.989] lstrcatA (in: lpString1="w?xTueaEY??lYS", lpString2="?" | out: lpString1="w?xTueaEY??lYS?") returned="w?xTueaEY??lYS?" [0098.989] lstrcatA (in: lpString1="w?xTueaEY??lYS?", lpString2="?" | out: lpString1="w?xTueaEY??lYS??") returned="w?xTueaEY??lYS??" [0098.989] lstrcatA (in: lpString1="w?xTueaEY??lYS??", lpString2="d" | out: lpString1="w?xTueaEY??lYS??d") returned="w?xTueaEY??lYS??d" [0098.989] lstrcatA (in: lpString1="w?xTueaEY??lYS??d", lpString2="?" | out: lpString1="w?xTueaEY??lYS??d?") returned="w?xTueaEY??lYS??d?" [0098.989] lstrcatA (in: lpString1="w?xTueaEY??lYS??d?", lpString2="G" | out: lpString1="w?xTueaEY??lYS??d?G") returned="w?xTueaEY??lYS??d?G" [0098.989] lstrcatA (in: lpString1="w?xTueaEY??lYS??d?G", lpString2="Y" | out: lpString1="w?xTueaEY??lYS??d?GY") returned="w?xTueaEY??lYS??d?GY" [0098.989] lstrcatA (in: lpString1="w?xTueaEY??lYS??d?GY", lpString2="?" | out: lpString1="w?xTueaEY??lYS??d?GY?") returned="w?xTueaEY??lYS??d?GY?" [0098.989] lstrcatA (in: lpString1="w?xTueaEY??lYS??d?GY?", lpString2="?" | out: lpString1="w?xTueaEY??lYS??d?GY??") returned="w?xTueaEY??lYS??d?GY??" [0098.989] lstrcatA (in: lpString1="w?xTueaEY??lYS??d?GY??", lpString2="?" | out: lpString1="w?xTueaEY??lYS??d?GY???") returned="w?xTueaEY??lYS??d?GY???" [0098.989] lstrcatA (in: lpString1="w?xTueaEY??lYS??d?GY???", lpString2="?" | out: lpString1="w?xTueaEY??lYS??d?GY????") returned="w?xTueaEY??lYS??d?GY????" [0098.989] lstrcatA (in: lpString1="w?xTueaEY??lYS??d?GY????", lpString2="B" | out: lpString1="w?xTueaEY??lYS??d?GY????B") returned="w?xTueaEY??lYS??d?GY????B" [0098.989] lstrcatA (in: lpString1="w?xTueaEY??lYS??d?GY????B", lpString2="?" | out: lpString1="w?xTueaEY??lYS??d?GY????B?") returned="w?xTueaEY??lYS??d?GY????B?" [0098.989] lstrcatA (in: lpString1="w?xTueaEY??lYS??d?GY????B?", lpString2="?" | out: lpString1="w?xTueaEY??lYS??d?GY????B??") returned="w?xTueaEY??lYS??d?GY????B??" [0098.989] lstrcatA (in: lpString1="w?xTueaEY??lYS??d?GY????B??", lpString2="m" | out: lpString1="w?xTueaEY??lYS??d?GY????B??m") returned="w?xTueaEY??lYS??d?GY????B??m" [0098.989] lstrcatA (in: lpString1="w?xTueaEY??lYS??d?GY????B??m", lpString2="?" | out: lpString1="w?xTueaEY??lYS??d?GY????B??m?") returned="w?xTueaEY??lYS??d?GY????B??m?" [0098.989] lstrcatA (in: lpString1="w?xTueaEY??lYS??d?GY????B??m?", lpString2="?" | out: lpString1="w?xTueaEY??lYS??d?GY????B??m??") returned="w?xTueaEY??lYS??d?GY????B??m??" [0098.989] lstrcatA (in: lpString1="w?xTueaEY??lYS??d?GY????B??m??", lpString2="a" | out: lpString1="w?xTueaEY??lYS??d?GY????B??m??a") returned="w?xTueaEY??lYS??d?GY????B??m??a" [0098.989] lstrcatA (in: lpString1="w?xTueaEY??lYS??d?GY????B??m??a", lpString2="v" | out: lpString1="w?xTueaEY??lYS??d?GY????B??m??av") returned="w?xTueaEY??lYS??d?GY????B??m??av" [0098.989] lstrcatA (in: lpString1="w?xTueaEY??lYS??d?GY????B??m??av", lpString2="?" | out: lpString1="w?xTueaEY??lYS??d?GY????B??m??av?") returned="w?xTueaEY??lYS??d?GY????B??m??av?" [0098.989] lstrcatA (in: lpString1="w?xTueaEY??lYS??d?GY????B??m??av?", lpString2="D" | out: lpString1="w?xTueaEY??lYS??d?GY????B??m??av?D") returned="w?xTueaEY??lYS??d?GY????B??m??av?D" [0098.989] lstrcatA (in: lpString1="w?xTueaEY??lYS??d?GY????B??m??av?D", lpString2="s" | out: lpString1="w?xTueaEY??lYS??d?GY????B??m??av?Ds") returned="w?xTueaEY??lYS??d?GY????B??m??av?Ds" [0098.989] lstrcatA (in: lpString1="w?xTueaEY??lYS??d?GY????B??m??av?Ds", lpString2="Y" | out: lpString1="w?xTueaEY??lYS??d?GY????B??m??av?DsY") returned="w?xTueaEY??lYS??d?GY????B??m??av?DsY" [0098.989] lstrcatA (in: lpString1="w?xTueaEY??lYS??d?GY????B??m??av?DsY", lpString2="Q" | out: lpString1="w?xTueaEY??lYS??d?GY????B??m??av?DsYQ") returned="w?xTueaEY??lYS??d?GY????B??m??av?DsYQ" [0098.989] lstrcatA (in: lpString1="w?xTueaEY??lYS??d?GY????B??m??av?DsYQ", lpString2="M" | out: lpString1="w?xTueaEY??lYS??d?GY????B??m??av?DsYQM") returned="w?xTueaEY??lYS??d?GY????B??m??av?DsYQM" [0098.989] lstrcatA (in: lpString1="w?xTueaEY??lYS??d?GY????B??m??av?DsYQM", lpString2="?" | out: lpString1="w?xTueaEY??lYS??d?GY????B??m??av?DsYQM?") returned="w?xTueaEY??lYS??d?GY????B??m??av?DsYQM?" [0098.989] lstrcatA (in: lpString1="w?xTueaEY??lYS??d?GY????B??m??av?DsYQM?", lpString2="?" | out: lpString1="w?xTueaEY??lYS??d?GY????B??m??av?DsYQM??") returned="w?xTueaEY??lYS??d?GY????B??m??av?DsYQM??" [0098.990] lstrcatA (in: lpString1="w?xTueaEY??lYS??d?GY????B??m??av?DsYQM??", lpString2="F" | out: lpString1="w?xTueaEY??lYS??d?GY????B??m??av?DsYQM??F") returned="w?xTueaEY??lYS??d?GY????B??m??av?DsYQM??F" [0098.990] lstrcatA (in: lpString1="w?xTueaEY??lYS??d?GY????B??m??av?DsYQM??F", lpString2="T" | out: lpString1="w?xTueaEY??lYS??d?GY????B??m??av?DsYQM??FT") returned="w?xTueaEY??lYS??d?GY????B??m??av?DsYQM??FT" [0098.990] lstrcatA (in: lpString1="w?xTueaEY??lYS??d?GY????B??m??av?DsYQM??FT", lpString2="?" | out: lpString1="w?xTueaEY??lYS??d?GY????B??m??av?DsYQM??FT?") returned="w?xTueaEY??lYS??d?GY????B??m??av?DsYQM??FT?" [0098.990] lstrcatA (in: lpString1="w?xTueaEY??lYS??d?GY????B??m??av?DsYQM??FT?", lpString2="?" | out: lpString1="w?xTueaEY??lYS??d?GY????B??m??av?DsYQM??FT??") returned="w?xTueaEY??lYS??d?GY????B??m??av?DsYQM??FT??" [0098.990] lstrcatA (in: lpString1="w?xTueaEY??lYS??d?GY????B??m??av?DsYQM??FT??", lpString2="?" | out: lpString1="w?xTueaEY??lYS??d?GY????B??m??av?DsYQM??FT???") returned="w?xTueaEY??lYS??d?GY????B??m??av?DsYQM??FT???" [0098.990] lstrcatA (in: lpString1="w?xTueaEY??lYS??d?GY????B??m??av?DsYQM??FT???", lpString2="?" | out: lpString1="w?xTueaEY??lYS??d?GY????B??m??av?DsYQM??FT????") returned="w?xTueaEY??lYS??d?GY????B??m??av?DsYQM??FT????" [0098.990] lstrcatA (in: lpString1="w?xTueaEY??lYS??d?GY????B??m??av?DsYQM??FT????", lpString2="p" | out: lpString1="w?xTueaEY??lYS??d?GY????B??m??av?DsYQM??FT????p") returned="w?xTueaEY??lYS??d?GY????B??m??av?DsYQM??FT????p" [0098.990] lstrcatA (in: lpString1="w?xTueaEY??lYS??d?GY????B??m??av?DsYQM??FT????p", lpString2="g" | out: lpString1="w?xTueaEY??lYS??d?GY????B??m??av?DsYQM??FT????pg") returned="w?xTueaEY??lYS??d?GY????B??m??av?DsYQM??FT????pg" [0098.990] lstrcatA (in: lpString1="w?xTueaEY??lYS??d?GY????B??m??av?DsYQM??FT????pg", lpString2="?" | out: lpString1="w?xTueaEY??lYS??d?GY????B??m??av?DsYQM??FT????pg?") returned="w?xTueaEY??lYS??d?GY????B??m??av?DsYQM??FT????pg?" [0098.990] lstrcatA (in: lpString1="w?xTueaEY??lYS??d?GY????B??m??av?DsYQM??FT????pg?", lpString2="?" | out: lpString1="w?xTueaEY??lYS??d?GY????B??m??av?DsYQM??FT????pg??") returned="w?xTueaEY??lYS??d?GY????B??m??av?DsYQM??FT????pg??" [0098.990] lstrcatA (in: lpString1="w?xTueaEY??lYS??d?GY????B??m??av?DsYQM??FT????pg??", lpString2="?" | out: lpString1="w?xTueaEY??lYS??d?GY????B??m??av?DsYQM??FT????pg???") returned="w?xTueaEY??lYS??d?GY????B??m??av?DsYQM??FT????pg???" [0098.990] lstrcatA (in: lpString1="w?xTueaEY??lYS??d?GY????B??m??av?DsYQM??FT????pg???", lpString2="?" | out: lpString1="w?xTueaEY??lYS??d?GY????B??m??av?DsYQM??FT????pg????") returned="w?xTueaEY??lYS??d?GY????B??m??av?DsYQM??FT????pg????" [0098.990] lstrcatA (in: lpString1="w?xTueaEY??lYS??d?GY????B??m??av?DsYQM??FT????pg????", lpString2="?" | out: lpString1="w?xTueaEY??lYS??d?GY????B??m??av?DsYQM??FT????pg?????") returned="w?xTueaEY??lYS??d?GY????B??m??av?DsYQM??FT????pg?????" [0098.990] lstrcatA (in: lpString1="w?xTueaEY??lYS??d?GY????B??m??av?DsYQM??FT????pg?????", lpString2="?" | out: lpString1="w?xTueaEY??lYS??d?GY????B??m??av?DsYQM??FT????pg??????") returned="w?xTueaEY??lYS??d?GY????B??m??av?DsYQM??FT????pg??????" [0098.990] lstrcatA (in: lpString1="w?xTueaEY??lYS??d?GY????B??m??av?DsYQM??FT????pg??????", lpString2="?" | out: lpString1="w?xTueaEY??lYS??d?GY????B??m??av?DsYQM??FT????pg???????") returned="w?xTueaEY??lYS??d?GY????B??m??av?DsYQM??FT????pg???????" [0098.990] lstrcatA (in: lpString1="w?xTueaEY??lYS??d?GY????B??m??av?DsYQM??FT????pg???????", lpString2="k" | out: lpString1="w?xTueaEY??lYS??d?GY????B??m??av?DsYQM??FT????pg???????k") returned="w?xTueaEY??lYS??d?GY????B??m??av?DsYQM??FT????pg???????k" [0098.990] lstrcatA (in: lpString1="w?xTueaEY??lYS??d?GY????B??m??av?DsYQM??FT????pg???????k", lpString2="w" | out: lpString1="w?xTueaEY??lYS??d?GY????B??m??av?DsYQM??FT????pg???????kw") returned="w?xTueaEY??lYS??d?GY????B??m??av?DsYQM??FT????pg???????kw" [0098.990] lstrcatA (in: lpString1="w?xTueaEY??lYS??d?GY????B??m??av?DsYQM??FT????pg???????kw", lpString2="?" | out: lpString1="w?xTueaEY??lYS??d?GY????B??m??av?DsYQM??FT????pg???????kw?") returned="w?xTueaEY??lYS??d?GY????B??m??av?DsYQM??FT????pg???????kw?" [0098.990] lstrcatA (in: lpString1="w?xTueaEY??lYS??d?GY????B??m??av?DsYQM??FT????pg???????kw?", lpString2="?" | out: lpString1="w?xTueaEY??lYS??d?GY????B??m??av?DsYQM??FT????pg???????kw??") returned="w?xTueaEY??lYS??d?GY????B??m??av?DsYQM??FT????pg???????kw??" [0098.990] lstrcatA (in: lpString1="w?xTueaEY??lYS??d?GY????B??m??av?DsYQM??FT????pg???????kw??", lpString2="T" | out: lpString1="w?xTueaEY??lYS??d?GY????B??m??av?DsYQM??FT????pg???????kw??T") returned="w?xTueaEY??lYS??d?GY????B??m??av?DsYQM??FT????pg???????kw??T" [0098.990] lstrcatA (in: lpString1="w?xTueaEY??lYS??d?GY????B??m??av?DsYQM??FT????pg???????kw??T", lpString2="Y" | out: lpString1="w?xTueaEY??lYS??d?GY????B??m??av?DsYQM??FT????pg???????kw??TY") returned="w?xTueaEY??lYS??d?GY????B??m??av?DsYQM??FT????pg???????kw??TY" [0098.990] lstrcatA (in: lpString1="w?xTueaEY??lYS??d?GY????B??m??av?DsYQM??FT????pg???????kw??TY", lpString2="?" | out: lpString1="w?xTueaEY??lYS??d?GY????B??m??av?DsYQM??FT????pg???????kw??TY?") returned="w?xTueaEY??lYS??d?GY????B??m??av?DsYQM??FT????pg???????kw??TY?" [0098.990] lstrcatA (in: lpString1="w?xTueaEY??lYS??d?GY????B??m??av?DsYQM??FT????pg???????kw??TY?", lpString2="?" | out: lpString1="w?xTueaEY??lYS??d?GY????B??m??av?DsYQM??FT????pg???????kw??TY??") returned="w?xTueaEY??lYS??d?GY????B??m??av?DsYQM??FT????pg???????kw??TY??" [0098.990] lstrcatA (in: lpString1="w?xTueaEY??lYS??d?GY????B??m??av?DsYQM??FT????pg???????kw??TY??", lpString2="?" | out: lpString1="w?xTueaEY??lYS??d?GY????B??m??av?DsYQM??FT????pg???????kw??TY???") returned="w?xTueaEY??lYS??d?GY????B??m??av?DsYQM??FT????pg???????kw??TY???" [0098.990] lstrcatA (in: lpString1="w?xTueaEY??lYS??d?GY????B??m??av?DsYQM??FT????pg???????kw??TY???", lpString2="?" | out: lpString1="w?xTueaEY??lYS??d?GY????B??m??av?DsYQM??FT????pg???????kw??TY????") returned="w?xTueaEY??lYS??d?GY????B??m??av?DsYQM??FT????pg???????kw??TY????" [0098.990] lstrcatA (in: lpString1="w?xTueaEY??lYS??d?GY????B??m??av?DsYQM??FT????pg???????kw??TY????", lpString2="?" | out: lpString1="w?xTueaEY??lYS??d?GY????B??m??av?DsYQM??FT????pg???????kw??TY?????") returned="w?xTueaEY??lYS??d?GY????B??m??av?DsYQM??FT????pg???????kw??TY?????" [0098.990] lstrcatA (in: lpString1="w?xTueaEY??lYS??d?GY????B??m??av?DsYQM??FT????pg???????kw??TY?????", lpString2="?" | out: lpString1="w?xTueaEY??lYS??d?GY????B??m??av?DsYQM??FT????pg???????kw??TY??????") returned="w?xTueaEY??lYS??d?GY????B??m??av?DsYQM??FT????pg???????kw??TY??????" [0098.990] lstrcatA (in: lpString1="w?xTueaEY??lYS??d?GY????B??m??av?DsYQM??FT????pg???????kw??TY??????", lpString2="?" | out: lpString1="w?xTueaEY??lYS??d?GY????B??m??av?DsYQM??FT????pg???????kw??TY???????") returned="w?xTueaEY??lYS??d?GY????B??m??av?DsYQM??FT????pg???????kw??TY???????" [0098.991] lstrcatA (in: lpString1="w?xTueaEY??lYS??d?GY????B??m??av?DsYQM??FT????pg???????kw??TY???????", lpString2="W" | out: lpString1="w?xTueaEY??lYS??d?GY????B??m??av?DsYQM??FT????pg???????kw??TY???????W") returned="w?xTueaEY??lYS??d?GY????B??m??av?DsYQM??FT????pg???????kw??TY???????W" [0098.991] lstrcatA (in: lpString1="w?xTueaEY??lYS??d?GY????B??m??av?DsYQM??FT????pg???????kw??TY???????W", lpString2="?" | out: lpString1="w?xTueaEY??lYS??d?GY????B??m??av?DsYQM??FT????pg???????kw??TY???????W?") returned="w?xTueaEY??lYS??d?GY????B??m??av?DsYQM??FT????pg???????kw??TY???????W?" [0098.991] lstrcatA (in: lpString1="w?xTueaEY??lYS??d?GY????B??m??av?DsYQM??FT????pg???????kw??TY???????W?", lpString2="?" | out: lpString1="w?xTueaEY??lYS??d?GY????B??m??av?DsYQM??FT????pg???????kw??TY???????W??") returned="w?xTueaEY??lYS??d?GY????B??m??av?DsYQM??FT????pg???????kw??TY???????W??" [0098.991] lstrcatA (in: lpString1="w?xTueaEY??lYS??d?GY????B??m??av?DsYQM??FT????pg???????kw??TY???????W??", lpString2="?" | out: lpString1="w?xTueaEY??lYS??d?GY????B??m??av?DsYQM??FT????pg???????kw??TY???????W???") returned="w?xTueaEY??lYS??d?GY????B??m??av?DsYQM??FT????pg???????kw??TY???????W???" [0098.991] lstrcatA (in: lpString1="w?xTueaEY??lYS??d?GY????B??m??av?DsYQM??FT????pg???????kw??TY???????W???", lpString2="w" | out: lpString1="w?xTueaEY??lYS??d?GY????B??m??av?DsYQM??FT????pg???????kw??TY???????W???w") returned="w?xTueaEY??lYS??d?GY????B??m??av?DsYQM??FT????pg???????kw??TY???????W???w" [0098.991] lstrcatA (in: lpString1="w?xTueaEY??lYS??d?GY????B??m??av?DsYQM??FT????pg???????kw??TY???????W???w", lpString2="?" | out: lpString1="w?xTueaEY??lYS??d?GY????B??m??av?DsYQM??FT????pg???????kw??TY???????W???w?") returned="w?xTueaEY??lYS??d?GY????B??m??av?DsYQM??FT????pg???????kw??TY???????W???w?" [0098.991] lstrcatA (in: lpString1="w?xTueaEY??lYS??d?GY????B??m??av?DsYQM??FT????pg???????kw??TY???????W???w?", lpString2="?" | out: lpString1="w?xTueaEY??lYS??d?GY????B??m??av?DsYQM??FT????pg???????kw??TY???????W???w??") returned="w?xTueaEY??lYS??d?GY????B??m??av?DsYQM??FT????pg???????kw??TY???????W???w??" [0098.991] lstrcatA (in: lpString1="w?xTueaEY??lYS??d?GY????B??m??av?DsYQM??FT????pg???????kw??TY???????W???w??", lpString2="?" | out: lpString1="w?xTueaEY??lYS??d?GY????B??m??av?DsYQM??FT????pg???????kw??TY???????W???w???") returned="w?xTueaEY??lYS??d?GY????B??m??av?DsYQM??FT????pg???????kw??TY???????W???w???" [0098.991] lstrcatA (in: lpString1="w?xTueaEY??lYS??d?GY????B??m??av?DsYQM??FT????pg???????kw??TY???????W???w???", lpString2="?" | out: lpString1="w?xTueaEY??lYS??d?GY????B??m??av?DsYQM??FT????pg???????kw??TY???????W???w????") returned="w?xTueaEY??lYS??d?GY????B??m??av?DsYQM??FT????pg???????kw??TY???????W???w????" [0098.991] lstrcatA (in: lpString1="w?xTueaEY??lYS??d?GY????B??m??av?DsYQM??FT????pg???????kw??TY???????W???w????", lpString2="E" | out: lpString1="w?xTueaEY??lYS??d?GY????B??m??av?DsYQM??FT????pg???????kw??TY???????W???w????E") returned="w?xTueaEY??lYS??d?GY????B??m??av?DsYQM??FT????pg???????kw??TY???????W???w????E" [0098.991] lstrcatA (in: lpString1="w?xTueaEY??lYS??d?GY????B??m??av?DsYQM??FT????pg???????kw??TY???????W???w????E", lpString2="j" | out: lpString1="w?xTueaEY??lYS??d?GY????B??m??av?DsYQM??FT????pg???????kw??TY???????W???w????Ej") returned="w?xTueaEY??lYS??d?GY????B??m??av?DsYQM??FT????pg???????kw??TY???????W???w????Ej" [0098.991] lstrcatA (in: lpString1="w?xTueaEY??lYS??d?GY????B??m??av?DsYQM??FT????pg???????kw??TY???????W???w????Ej", lpString2="?" | out: lpString1="w?xTueaEY??lYS??d?GY????B??m??av?DsYQM??FT????pg???????kw??TY???????W???w????Ej?") returned="w?xTueaEY??lYS??d?GY????B??m??av?DsYQM??FT????pg???????kw??TY???????W???w????Ej?" [0098.991] lstrcatA (in: lpString1="w?xTueaEY??lYS??d?GY????B??m??av?DsYQM??FT????pg???????kw??TY???????W???w????Ej?", lpString2="?" | out: lpString1="w?xTueaEY??lYS??d?GY????B??m??av?DsYQM??FT????pg???????kw??TY???????W???w????Ej??") returned="w?xTueaEY??lYS??d?GY????B??m??av?DsYQM??FT????pg???????kw??TY???????W???w????Ej??" [0098.991] lstrcatA (in: lpString1="w?xTueaEY??lYS??d?GY????B??m??av?DsYQM??FT????pg???????kw??TY???????W???w????Ej??", lpString2="?" | out: lpString1="w?xTueaEY??lYS??d?GY????B??m??av?DsYQM??FT????pg???????kw??TY???????W???w????Ej???") returned="w?xTueaEY??lYS??d?GY????B??m??av?DsYQM??FT????pg???????kw??TY???????W???w????Ej???" [0098.991] lstrlenA (lpString="w?xTueaEY??lYS??d?GY????B??m??av?DsYQM??FT????pg???????kw??TY???????W???w????Ej???") returned 82 [0098.991] lstrcpynA (in: lpString1=0x499080, lpString2="w?xTueaEY??lYS??d?GY????B??m??av?DsYQM??FT????pg???????kw??TY???????W???w????Ej???", iMaxLength=37 | out: lpString1="w?xTueaEY??lYS??d?GY????B??m??av?DsY") returned="w?xTueaEY??lYS??d?GY????B??m??av?DsY" [0098.991] lstrlenA (lpString="w?xTueaEY??lYS??d?GY????B??m??av?DsY") returned 36 [0098.991] lstrcatA (in: lpString1="", lpString2="P" | out: lpString1="P") returned="P" [0098.991] lstrcatA (in: lpString1="P", lpString2="?" | out: lpString1="P?") returned="P?" [0098.991] lstrcatA (in: lpString1="P?", lpString2="M" | out: lpString1="P?M") returned="P?M" [0098.991] lstrcatA (in: lpString1="P?M", lpString2="?" | out: lpString1="P?M?") returned="P?M?" [0098.991] lstrcatA (in: lpString1="P?M?", lpString2="Y" | out: lpString1="P?M?Y") returned="P?M?Y" [0098.991] lstrcatA (in: lpString1="P?M?Y", lpString2="?" | out: lpString1="P?M?Y?") returned="P?M?Y?" [0098.991] lstrcatA (in: lpString1="P?M?Y?", lpString2="?" | out: lpString1="P?M?Y??") returned="P?M?Y??" [0098.991] lstrcatA (in: lpString1="P?M?Y??", lpString2="D" | out: lpString1="P?M?Y??D") returned="P?M?Y??D" [0098.991] lstrcatA (in: lpString1="P?M?Y??D", lpString2="C" | out: lpString1="P?M?Y??DC") returned="P?M?Y??DC" [0098.991] lstrcatA (in: lpString1="P?M?Y??DC", lpString2="?" | out: lpString1="P?M?Y??DC?") returned="P?M?Y??DC?" [0098.991] lstrcatA (in: lpString1="P?M?Y??DC?", lpString2="?" | out: lpString1="P?M?Y??DC??") returned="P?M?Y??DC??" [0098.991] lstrcatA (in: lpString1="P?M?Y??DC??", lpString2="m" | out: lpString1="P?M?Y??DC??m") returned="P?M?Y??DC??m" [0098.991] lstrcatA (in: lpString1="P?M?Y??DC??m", lpString2="?" | out: lpString1="P?M?Y??DC??m?") returned="P?M?Y??DC??m?" [0098.992] lstrlenA (lpString="P?M?Y??DC??m?") returned 13 [0098.992] lstrcpynA (in: lpString1=0x4990c4, lpString2="P?M?Y??DC??m?", iMaxLength=12 | out: lpString1="P?M?Y??DC??") returned="P?M?Y??DC??" [0098.992] lstrlenA (lpString="P?M?Y??DC??") returned 11 [0098.992] lstrcatA (in: lpString1="", lpString2="n" | out: lpString1="n") returned="n" [0098.992] lstrcatA (in: lpString1="n", lpString2="?" | out: lpString1="n?") returned="n?" [0098.992] lstrcatA (in: lpString1="n?", lpString2="?" | out: lpString1="n??") returned="n??" [0098.992] lstrcatA (in: lpString1="n??", lpString2="?" | out: lpString1="n???") returned="n???" [0098.992] lstrcatA (in: lpString1="n???", lpString2="m" | out: lpString1="n???m") returned="n???m" [0098.992] lstrcatA (in: lpString1="n???m", lpString2="?" | out: lpString1="n???m?") returned="n???m?" [0098.992] lstrcatA (in: lpString1="n???m?", lpString2="b" | out: lpString1="n???m?b") returned="n???m?b" [0098.992] lstrcatA (in: lpString1="n???m?b", lpString2="Q" | out: lpString1="n???m?bQ") returned="n???m?bQ" [0098.992] lstrcatA (in: lpString1="n???m?bQ", lpString2="?" | out: lpString1="n???m?bQ?") returned="n???m?bQ?" [0098.992] lstrcatA (in: lpString1="n???m?bQ?", lpString2="?" | out: lpString1="n???m?bQ??") returned="n???m?bQ??" [0098.992] lstrcatA (in: lpString1="n???m?bQ??", lpString2="H" | out: lpString1="n???m?bQ??H") returned="n???m?bQ??H" [0098.992] lstrcatA (in: lpString1="n???m?bQ??H", lpString2="?" | out: lpString1="n???m?bQ??H?") returned="n???m?bQ??H?" [0098.992] lstrcatA (in: lpString1="n???m?bQ??H?", lpString2="?" | out: lpString1="n???m?bQ??H??") returned="n???m?bQ??H??" [0098.992] lstrcatA (in: lpString1="n???m?bQ??H??", lpString2="B" | out: lpString1="n???m?bQ??H??B") returned="n???m?bQ??H??B" [0098.992] lstrcatA (in: lpString1="n???m?bQ??H??B", lpString2="C" | out: lpString1="n???m?bQ??H??BC") returned="n???m?bQ??H??BC" [0098.992] lstrcatA (in: lpString1="n???m?bQ??H??BC", lpString2="?" | out: lpString1="n???m?bQ??H??BC?") returned="n???m?bQ??H??BC?" [0098.992] lstrcatA (in: lpString1="n???m?bQ??H??BC?", lpString2="?" | out: lpString1="n???m?bQ??H??BC??") returned="n???m?bQ??H??BC??" [0098.992] lstrcatA (in: lpString1="n???m?bQ??H??BC??", lpString2="x" | out: lpString1="n???m?bQ??H??BC??x") returned="n???m?bQ??H??BC??x" [0098.992] lstrcatA (in: lpString1="n???m?bQ??H??BC??x", lpString2="?" | out: lpString1="n???m?bQ??H??BC??x?") returned="n???m?bQ??H??BC??x?" [0098.992] lstrcatA (in: lpString1="n???m?bQ??H??BC??x?", lpString2="?" | out: lpString1="n???m?bQ??H??BC??x??") returned="n???m?bQ??H??BC??x??" [0098.992] lstrcatA (in: lpString1="n???m?bQ??H??BC??x??", lpString2="I" | out: lpString1="n???m?bQ??H??BC??x??I") returned="n???m?bQ??H??BC??x??I" [0098.992] lstrcatA (in: lpString1="n???m?bQ??H??BC??x??I", lpString2="P" | out: lpString1="n???m?bQ??H??BC??x??IP") returned="n???m?bQ??H??BC??x??IP" [0098.992] lstrcatA (in: lpString1="n???m?bQ??H??BC??x??IP", lpString2="d" | out: lpString1="n???m?bQ??H??BC??x??IPd") returned="n???m?bQ??H??BC??x??IPd" [0098.992] lstrcatA (in: lpString1="n???m?bQ??H??BC??x??IPd", lpString2="o" | out: lpString1="n???m?bQ??H??BC??x??IPdo") returned="n???m?bQ??H??BC??x??IPdo" [0098.992] lstrcatA (in: lpString1="n???m?bQ??H??BC??x??IPdo", lpString2="?" | out: lpString1="n???m?bQ??H??BC??x??IPdo?") returned="n???m?bQ??H??BC??x??IPdo?" [0098.992] lstrcatA (in: lpString1="n???m?bQ??H??BC??x??IPdo?", lpString2="U" | out: lpString1="n???m?bQ??H??BC??x??IPdo?U") returned="n???m?bQ??H??BC??x??IPdo?U" [0098.992] lstrcatA (in: lpString1="n???m?bQ??H??BC??x??IPdo?U", lpString2="?" | out: lpString1="n???m?bQ??H??BC??x??IPdo?U?") returned="n???m?bQ??H??BC??x??IPdo?U?" [0098.993] lstrcatA (in: lpString1="n???m?bQ??H??BC??x??IPdo?U?", lpString2="?" | out: lpString1="n???m?bQ??H??BC??x??IPdo?U??") returned="n???m?bQ??H??BC??x??IPdo?U??" [0098.993] lstrcatA (in: lpString1="n???m?bQ??H??BC??x??IPdo?U??", lpString2="?" | out: lpString1="n???m?bQ??H??BC??x??IPdo?U???") returned="n???m?bQ??H??BC??x??IPdo?U???" [0098.993] lstrcatA (in: lpString1="n???m?bQ??H??BC??x??IPdo?U???", lpString2="C" | out: lpString1="n???m?bQ??H??BC??x??IPdo?U???C") returned="n???m?bQ??H??BC??x??IPdo?U???C" [0098.993] lstrcatA (in: lpString1="n???m?bQ??H??BC??x??IPdo?U???C", lpString2="k" | out: lpString1="n???m?bQ??H??BC??x??IPdo?U???Ck") returned="n???m?bQ??H??BC??x??IPdo?U???Ck" [0098.993] lstrcatA (in: lpString1="n???m?bQ??H??BC??x??IPdo?U???Ck", lpString2="f" | out: lpString1="n???m?bQ??H??BC??x??IPdo?U???Ckf") returned="n???m?bQ??H??BC??x??IPdo?U???Ckf" [0098.993] lstrcatA (in: lpString1="n???m?bQ??H??BC??x??IPdo?U???Ckf", lpString2="?" | out: lpString1="n???m?bQ??H??BC??x??IPdo?U???Ckf?") returned="n???m?bQ??H??BC??x??IPdo?U???Ckf?" [0098.993] lstrcatA (in: lpString1="n???m?bQ??H??BC??x??IPdo?U???Ckf?", lpString2="?" | out: lpString1="n???m?bQ??H??BC??x??IPdo?U???Ckf??") returned="n???m?bQ??H??BC??x??IPdo?U???Ckf??" [0098.993] lstrcatA (in: lpString1="n???m?bQ??H??BC??x??IPdo?U???Ckf??", lpString2="E" | out: lpString1="n???m?bQ??H??BC??x??IPdo?U???Ckf??E") returned="n???m?bQ??H??BC??x??IPdo?U???Ckf??E" [0098.993] lstrcatA (in: lpString1="n???m?bQ??H??BC??x??IPdo?U???Ckf??E", lpString2="J" | out: lpString1="n???m?bQ??H??BC??x??IPdo?U???Ckf??EJ") returned="n???m?bQ??H??BC??x??IPdo?U???Ckf??EJ" [0098.993] lstrcatA (in: lpString1="n???m?bQ??H??BC??x??IPdo?U???Ckf??EJ", lpString2="t" | out: lpString1="n???m?bQ??H??BC??x??IPdo?U???Ckf??EJt") returned="n???m?bQ??H??BC??x??IPdo?U???Ckf??EJt" [0098.993] lstrcatA (in: lpString1="n???m?bQ??H??BC??x??IPdo?U???Ckf??EJt", lpString2="x" | out: lpString1="n???m?bQ??H??BC??x??IPdo?U???Ckf??EJtx") returned="n???m?bQ??H??BC??x??IPdo?U???Ckf??EJtx" [0098.993] lstrcatA (in: lpString1="n???m?bQ??H??BC??x??IPdo?U???Ckf??EJtx", lpString2="a" | out: lpString1="n???m?bQ??H??BC??x??IPdo?U???Ckf??EJtxa") returned="n???m?bQ??H??BC??x??IPdo?U???Ckf??EJtxa" [0098.993] lstrcatA (in: lpString1="n???m?bQ??H??BC??x??IPdo?U???Ckf??EJtxa", lpString2="p" | out: lpString1="n???m?bQ??H??BC??x??IPdo?U???Ckf??EJtxap") returned="n???m?bQ??H??BC??x??IPdo?U???Ckf??EJtxap" [0098.993] lstrcatA (in: lpString1="n???m?bQ??H??BC??x??IPdo?U???Ckf??EJtxap", lpString2="R" | out: lpString1="n???m?bQ??H??BC??x??IPdo?U???Ckf??EJtxapR") returned="n???m?bQ??H??BC??x??IPdo?U???Ckf??EJtxapR" [0098.993] lstrcatA (in: lpString1="n???m?bQ??H??BC??x??IPdo?U???Ckf??EJtxapR", lpString2="?" | out: lpString1="n???m?bQ??H??BC??x??IPdo?U???Ckf??EJtxapR?") returned="n???m?bQ??H??BC??x??IPdo?U???Ckf??EJtxapR?" [0098.993] lstrcatA (in: lpString1="n???m?bQ??H??BC??x??IPdo?U???Ckf??EJtxapR?", lpString2="?" | out: lpString1="n???m?bQ??H??BC??x??IPdo?U???Ckf??EJtxapR??") returned="n???m?bQ??H??BC??x??IPdo?U???Ckf??EJtxapR??" [0098.993] lstrcatA (in: lpString1="n???m?bQ??H??BC??x??IPdo?U???Ckf??EJtxapR??", lpString2="b" | out: lpString1="n???m?bQ??H??BC??x??IPdo?U???Ckf??EJtxapR??b") returned="n???m?bQ??H??BC??x??IPdo?U???Ckf??EJtxapR??b" [0098.993] lstrcatA (in: lpString1="n???m?bQ??H??BC??x??IPdo?U???Ckf??EJtxapR??b", lpString2="R" | out: lpString1="n???m?bQ??H??BC??x??IPdo?U???Ckf??EJtxapR??bR") returned="n???m?bQ??H??BC??x??IPdo?U???Ckf??EJtxapR??bR" [0098.993] lstrcatA (in: lpString1="n???m?bQ??H??BC??x??IPdo?U???Ckf??EJtxapR??bR", lpString2="?" | out: lpString1="n???m?bQ??H??BC??x??IPdo?U???Ckf??EJtxapR??bR?") returned="n???m?bQ??H??BC??x??IPdo?U???Ckf??EJtxapR??bR?" [0098.993] lstrcatA (in: lpString1="n???m?bQ??H??BC??x??IPdo?U???Ckf??EJtxapR??bR?", lpString2="?" | out: lpString1="n???m?bQ??H??BC??x??IPdo?U???Ckf??EJtxapR??bR??") returned="n???m?bQ??H??BC??x??IPdo?U???Ckf??EJtxapR??bR??" [0098.993] lstrcatA (in: lpString1="n???m?bQ??H??BC??x??IPdo?U???Ckf??EJtxapR??bR??", lpString2="t" | out: lpString1="n???m?bQ??H??BC??x??IPdo?U???Ckf??EJtxapR??bR??t") returned="n???m?bQ??H??BC??x??IPdo?U???Ckf??EJtxapR??bR??t" [0098.993] lstrcatA (in: lpString1="n???m?bQ??H??BC??x??IPdo?U???Ckf??EJtxapR??bR??t", lpString2="P" | out: lpString1="n???m?bQ??H??BC??x??IPdo?U???Ckf??EJtxapR??bR??tP") returned="n???m?bQ??H??BC??x??IPdo?U???Ckf??EJtxapR??bR??tP" [0098.993] lstrcatA (in: lpString1="n???m?bQ??H??BC??x??IPdo?U???Ckf??EJtxapR??bR??tP", lpString2="?" | out: lpString1="n???m?bQ??H??BC??x??IPdo?U???Ckf??EJtxapR??bR??tP?") returned="n???m?bQ??H??BC??x??IPdo?U???Ckf??EJtxapR??bR??tP?" [0098.993] lstrcatA (in: lpString1="n???m?bQ??H??BC??x??IPdo?U???Ckf??EJtxapR??bR??tP?", lpString2="I" | out: lpString1="n???m?bQ??H??BC??x??IPdo?U???Ckf??EJtxapR??bR??tP?I") returned="n???m?bQ??H??BC??x??IPdo?U???Ckf??EJtxapR??bR??tP?I" [0098.993] lstrcatA (in: lpString1="n???m?bQ??H??BC??x??IPdo?U???Ckf??EJtxapR??bR??tP?I", lpString2="?" | out: lpString1="n???m?bQ??H??BC??x??IPdo?U???Ckf??EJtxapR??bR??tP?I?") returned="n???m?bQ??H??BC??x??IPdo?U???Ckf??EJtxapR??bR??tP?I?" [0098.993] lstrcatA (in: lpString1="n???m?bQ??H??BC??x??IPdo?U???Ckf??EJtxapR??bR??tP?I?", lpString2="?" | out: lpString1="n???m?bQ??H??BC??x??IPdo?U???Ckf??EJtxapR??bR??tP?I??") returned="n???m?bQ??H??BC??x??IPdo?U???Ckf??EJtxapR??bR??tP?I??" [0098.993] lstrcatA (in: lpString1="n???m?bQ??H??BC??x??IPdo?U???Ckf??EJtxapR??bR??tP?I??", lpString2="?" | out: lpString1="n???m?bQ??H??BC??x??IPdo?U???Ckf??EJtxapR??bR??tP?I???") returned="n???m?bQ??H??BC??x??IPdo?U???Ckf??EJtxapR??bR??tP?I???" [0098.994] lstrcatA (in: lpString1="n???m?bQ??H??BC??x??IPdo?U???Ckf??EJtxapR??bR??tP?I???", lpString2="?" | out: lpString1="n???m?bQ??H??BC??x??IPdo?U???Ckf??EJtxapR??bR??tP?I????") returned="n???m?bQ??H??BC??x??IPdo?U???Ckf??EJtxapR??bR??tP?I????" [0098.994] lstrcatA (in: lpString1="n???m?bQ??H??BC??x??IPdo?U???Ckf??EJtxapR??bR??tP?I????", lpString2="?" | out: lpString1="n???m?bQ??H??BC??x??IPdo?U???Ckf??EJtxapR??bR??tP?I?????") returned="n???m?bQ??H??BC??x??IPdo?U???Ckf??EJtxapR??bR??tP?I?????" [0098.994] lstrcatA (in: lpString1="n???m?bQ??H??BC??x??IPdo?U???Ckf??EJtxapR??bR??tP?I?????", lpString2="?" | out: lpString1="n???m?bQ??H??BC??x??IPdo?U???Ckf??EJtxapR??bR??tP?I??????") returned="n???m?bQ??H??BC??x??IPdo?U???Ckf??EJtxapR??bR??tP?I??????" [0098.994] lstrcatA (in: lpString1="n???m?bQ??H??BC??x??IPdo?U???Ckf??EJtxapR??bR??tP?I??????", lpString2="?" | out: lpString1="n???m?bQ??H??BC??x??IPdo?U???Ckf??EJtxapR??bR??tP?I???????") returned="n???m?bQ??H??BC??x??IPdo?U???Ckf??EJtxapR??bR??tP?I???????" [0098.994] lstrcatA (in: lpString1="n???m?bQ??H??BC??x??IPdo?U???Ckf??EJtxapR??bR??tP?I???????", lpString2="Y" | out: lpString1="n???m?bQ??H??BC??x??IPdo?U???Ckf??EJtxapR??bR??tP?I???????Y") returned="n???m?bQ??H??BC??x??IPdo?U???Ckf??EJtxapR??bR??tP?I???????Y" [0098.994] lstrcatA (in: lpString1="n???m?bQ??H??BC??x??IPdo?U???Ckf??EJtxapR??bR??tP?I???????Y", lpString2="?" | out: lpString1="n???m?bQ??H??BC??x??IPdo?U???Ckf??EJtxapR??bR??tP?I???????Y?") returned="n???m?bQ??H??BC??x??IPdo?U???Ckf??EJtxapR??bR??tP?I???????Y?" [0098.994] lstrcatA (in: lpString1="n???m?bQ??H??BC??x??IPdo?U???Ckf??EJtxapR??bR??tP?I???????Y?", lpString2="D" | out: lpString1="n???m?bQ??H??BC??x??IPdo?U???Ckf??EJtxapR??bR??tP?I???????Y?D") returned="n???m?bQ??H??BC??x??IPdo?U???Ckf??EJtxapR??bR??tP?I???????Y?D" [0098.994] lstrcatA (in: lpString1="n???m?bQ??H??BC??x??IPdo?U???Ckf??EJtxapR??bR??tP?I???????Y?D", lpString2="Q" | out: lpString1="n???m?bQ??H??BC??x??IPdo?U???Ckf??EJtxapR??bR??tP?I???????Y?DQ") returned="n???m?bQ??H??BC??x??IPdo?U???Ckf??EJtxapR??bR??tP?I???????Y?DQ" [0098.994] lstrcatA (in: lpString1="n???m?bQ??H??BC??x??IPdo?U???Ckf??EJtxapR??bR??tP?I???????Y?DQ", lpString2="?" | out: lpString1="n???m?bQ??H??BC??x??IPdo?U???Ckf??EJtxapR??bR??tP?I???????Y?DQ?") returned="n???m?bQ??H??BC??x??IPdo?U???Ckf??EJtxapR??bR??tP?I???????Y?DQ?" [0098.994] lstrcatA (in: lpString1="n???m?bQ??H??BC??x??IPdo?U???Ckf??EJtxapR??bR??tP?I???????Y?DQ?", lpString2="J" | out: lpString1="n???m?bQ??H??BC??x??IPdo?U???Ckf??EJtxapR??bR??tP?I???????Y?DQ?J") returned="n???m?bQ??H??BC??x??IPdo?U???Ckf??EJtxapR??bR??tP?I???????Y?DQ?J" [0098.994] lstrcatA (in: lpString1="n???m?bQ??H??BC??x??IPdo?U???Ckf??EJtxapR??bR??tP?I???????Y?DQ?J", lpString2="P" | out: lpString1="n???m?bQ??H??BC??x??IPdo?U???Ckf??EJtxapR??bR??tP?I???????Y?DQ?JP") returned="n???m?bQ??H??BC??x??IPdo?U???Ckf??EJtxapR??bR??tP?I???????Y?DQ?JP" [0098.994] lstrcatA (in: lpString1="n???m?bQ??H??BC??x??IPdo?U???Ckf??EJtxapR??bR??tP?I???????Y?DQ?JP", lpString2="R" | out: lpString1="n???m?bQ??H??BC??x??IPdo?U???Ckf??EJtxapR??bR??tP?I???????Y?DQ?JPR") returned="n???m?bQ??H??BC??x??IPdo?U???Ckf??EJtxapR??bR??tP?I???????Y?DQ?JPR" [0098.994] lstrcatA (in: lpString1="n???m?bQ??H??BC??x??IPdo?U???Ckf??EJtxapR??bR??tP?I???????Y?DQ?JPR", lpString2="?" | out: lpString1="n???m?bQ??H??BC??x??IPdo?U???Ckf??EJtxapR??bR??tP?I???????Y?DQ?JPR?") returned="n???m?bQ??H??BC??x??IPdo?U???Ckf??EJtxapR??bR??tP?I???????Y?DQ?JPR?" [0098.994] lstrcatA (in: lpString1="n???m?bQ??H??BC??x??IPdo?U???Ckf??EJtxapR??bR??tP?I???????Y?DQ?JPR?", lpString2="?" | out: lpString1="n???m?bQ??H??BC??x??IPdo?U???Ckf??EJtxapR??bR??tP?I???????Y?DQ?JPR??") returned="n???m?bQ??H??BC??x??IPdo?U???Ckf??EJtxapR??bR??tP?I???????Y?DQ?JPR??" [0098.994] lstrcatA (in: lpString1="n???m?bQ??H??BC??x??IPdo?U???Ckf??EJtxapR??bR??tP?I???????Y?DQ?JPR??", lpString2="v" | out: lpString1="n???m?bQ??H??BC??x??IPdo?U???Ckf??EJtxapR??bR??tP?I???????Y?DQ?JPR??v") returned="n???m?bQ??H??BC??x??IPdo?U???Ckf??EJtxapR??bR??tP?I???????Y?DQ?JPR??v" [0098.994] lstrcatA (in: lpString1="n???m?bQ??H??BC??x??IPdo?U???Ckf??EJtxapR??bR??tP?I???????Y?DQ?JPR??v", lpString2="u" | out: lpString1="n???m?bQ??H??BC??x??IPdo?U???Ckf??EJtxapR??bR??tP?I???????Y?DQ?JPR??vu") returned="n???m?bQ??H??BC??x??IPdo?U???Ckf??EJtxapR??bR??tP?I???????Y?DQ?JPR??vu" [0098.994] lstrcatA (in: lpString1="n???m?bQ??H??BC??x??IPdo?U???Ckf??EJtxapR??bR??tP?I???????Y?DQ?JPR??vu", lpString2="?" | out: lpString1="n???m?bQ??H??BC??x??IPdo?U???Ckf??EJtxapR??bR??tP?I???????Y?DQ?JPR??vu?") returned="n???m?bQ??H??BC??x??IPdo?U???Ckf??EJtxapR??bR??tP?I???????Y?DQ?JPR??vu?" [0098.994] lstrcatA (in: lpString1="n???m?bQ??H??BC??x??IPdo?U???Ckf??EJtxapR??bR??tP?I???????Y?DQ?JPR??vu?", lpString2="L" | out: lpString1="n???m?bQ??H??BC??x??IPdo?U???Ckf??EJtxapR??bR??tP?I???????Y?DQ?JPR??vu?L") returned="n???m?bQ??H??BC??x??IPdo?U???Ckf??EJtxapR??bR??tP?I???????Y?DQ?JPR??vu?L" [0098.994] lstrcatA (in: lpString1="n???m?bQ??H??BC??x??IPdo?U???Ckf??EJtxapR??bR??tP?I???????Y?DQ?JPR??vu?L", lpString2="a" | out: lpString1="n???m?bQ??H??BC??x??IPdo?U???Ckf??EJtxapR??bR??tP?I???????Y?DQ?JPR??vu?La") returned="n???m?bQ??H??BC??x??IPdo?U???Ckf??EJtxapR??bR??tP?I???????Y?DQ?JPR??vu?La" [0098.994] lstrcatA (in: lpString1="n???m?bQ??H??BC??x??IPdo?U???Ckf??EJtxapR??bR??tP?I???????Y?DQ?JPR??vu?La", lpString2="?" | out: lpString1="n???m?bQ??H??BC??x??IPdo?U???Ckf??EJtxapR??bR??tP?I???????Y?DQ?JPR??vu?La?") returned="n???m?bQ??H??BC??x??IPdo?U???Ckf??EJtxapR??bR??tP?I???????Y?DQ?JPR??vu?La?" [0098.994] lstrcatA (in: lpString1="n???m?bQ??H??BC??x??IPdo?U???Ckf??EJtxapR??bR??tP?I???????Y?DQ?JPR??vu?La?", lpString2="T" | out: lpString1="n???m?bQ??H??BC??x??IPdo?U???Ckf??EJtxapR??bR??tP?I???????Y?DQ?JPR??vu?La?T") returned="n???m?bQ??H??BC??x??IPdo?U???Ckf??EJtxapR??bR??tP?I???????Y?DQ?JPR??vu?La?T" [0098.994] lstrcatA (in: lpString1="n???m?bQ??H??BC??x??IPdo?U???Ckf??EJtxapR??bR??tP?I???????Y?DQ?JPR??vu?La?T", lpString2="?" | out: lpString1="n???m?bQ??H??BC??x??IPdo?U???Ckf??EJtxapR??bR??tP?I???????Y?DQ?JPR??vu?La?T?") returned="n???m?bQ??H??BC??x??IPdo?U???Ckf??EJtxapR??bR??tP?I???????Y?DQ?JPR??vu?La?T?" [0098.994] lstrcatA (in: lpString1="n???m?bQ??H??BC??x??IPdo?U???Ckf??EJtxapR??bR??tP?I???????Y?DQ?JPR??vu?La?T?", lpString2="?" | out: lpString1="n???m?bQ??H??BC??x??IPdo?U???Ckf??EJtxapR??bR??tP?I???????Y?DQ?JPR??vu?La?T??") returned="n???m?bQ??H??BC??x??IPdo?U???Ckf??EJtxapR??bR??tP?I???????Y?DQ?JPR??vu?La?T??" [0098.994] lstrcatA (in: lpString1="n???m?bQ??H??BC??x??IPdo?U???Ckf??EJtxapR??bR??tP?I???????Y?DQ?JPR??vu?La?T??", lpString2="?" | out: lpString1="n???m?bQ??H??BC??x??IPdo?U???Ckf??EJtxapR??bR??tP?I???????Y?DQ?JPR??vu?La?T???") returned="n???m?bQ??H??BC??x??IPdo?U???Ckf??EJtxapR??bR??tP?I???????Y?DQ?JPR??vu?La?T???" [0098.994] lstrcatA (in: lpString1="n???m?bQ??H??BC??x??IPdo?U???Ckf??EJtxapR??bR??tP?I???????Y?DQ?JPR??vu?La?T???", lpString2="?" | out: lpString1="n???m?bQ??H??BC??x??IPdo?U???Ckf??EJtxapR??bR??tP?I???????Y?DQ?JPR??vu?La?T????") returned="n???m?bQ??H??BC??x??IPdo?U???Ckf??EJtxapR??bR??tP?I???????Y?DQ?JPR??vu?La?T????" [0098.994] lstrcatA (in: lpString1="n???m?bQ??H??BC??x??IPdo?U???Ckf??EJtxapR??bR??tP?I???????Y?DQ?JPR??vu?La?T????", lpString2="?" | out: lpString1="n???m?bQ??H??BC??x??IPdo?U???Ckf??EJtxapR??bR??tP?I???????Y?DQ?JPR??vu?La?T?????") returned="n???m?bQ??H??BC??x??IPdo?U???Ckf??EJtxapR??bR??tP?I???????Y?DQ?JPR??vu?La?T?????" [0098.994] lstrcatA (in: lpString1="n???m?bQ??H??BC??x??IPdo?U???Ckf??EJtxapR??bR??tP?I???????Y?DQ?JPR??vu?La?T?????", lpString2="?" | out: lpString1="n???m?bQ??H??BC??x??IPdo?U???Ckf??EJtxapR??bR??tP?I???????Y?DQ?JPR??vu?La?T??????") returned="n???m?bQ??H??BC??x??IPdo?U???Ckf??EJtxapR??bR??tP?I???????Y?DQ?JPR??vu?La?T??????" [0098.994] lstrcatA (in: lpString1="n???m?bQ??H??BC??x??IPdo?U???Ckf??EJtxapR??bR??tP?I???????Y?DQ?JPR??vu?La?T??????", lpString2="M" | out: lpString1="n???m?bQ??H??BC??x??IPdo?U???Ckf??EJtxapR??bR??tP?I???????Y?DQ?JPR??vu?La?T??????M") returned="n???m?bQ??H??BC??x??IPdo?U???Ckf??EJtxapR??bR??tP?I???????Y?DQ?JPR??vu?La?T??????M" [0098.994] lstrcatA (in: lpString1="n???m?bQ??H??BC??x??IPdo?U???Ckf??EJtxapR??bR??tP?I???????Y?DQ?JPR??vu?La?T??????M", lpString2="?" | out: lpString1="n???m?bQ??H??BC??x??IPdo?U???Ckf??EJtxapR??bR??tP?I???????Y?DQ?JPR??vu?La?T??????M?") returned="n???m?bQ??H??BC??x??IPdo?U???Ckf??EJtxapR??bR??tP?I???????Y?DQ?JPR??vu?La?T??????M?" [0098.995] lstrcatA (in: lpString1="n???m?bQ??H??BC??x??IPdo?U???Ckf??EJtxapR??bR??tP?I???????Y?DQ?JPR??vu?La?T??????M?", lpString2="Y" | out: lpString1="n???m?bQ??H??BC??x??IPdo?U???Ckf??EJtxapR??bR??tP?I???????Y?DQ?JPR??vu?La?T??????M?Y") returned="n???m?bQ??H??BC??x??IPdo?U???Ckf??EJtxapR??bR??tP?I???????Y?DQ?JPR??vu?La?T??????M?Y" [0098.995] lstrcatA (in: lpString1="n???m?bQ??H??BC??x??IPdo?U???Ckf??EJtxapR??bR??tP?I???????Y?DQ?JPR??vu?La?T??????M?Y", lpString2="g" | out: lpString1="n???m?bQ??H??BC??x??IPdo?U???Ckf??EJtxapR??bR??tP?I???????Y?DQ?JPR??vu?La?T??????M?Yg") returned="n???m?bQ??H??BC??x??IPdo?U???Ckf??EJtxapR??bR??tP?I???????Y?DQ?JPR??vu?La?T??????M?Yg" [0098.995] lstrcatA (in: lpString1="n???m?bQ??H??BC??x??IPdo?U???Ckf??EJtxapR??bR??tP?I???????Y?DQ?JPR??vu?La?T??????M?Yg", lpString2="D" | out: lpString1="n???m?bQ??H??BC??x??IPdo?U???Ckf??EJtxapR??bR??tP?I???????Y?DQ?JPR??vu?La?T??????M?YgD") returned="n???m?bQ??H??BC??x??IPdo?U???Ckf??EJtxapR??bR??tP?I???????Y?DQ?JPR??vu?La?T??????M?YgD" [0098.995] lstrcatA (in: lpString1="n???m?bQ??H??BC??x??IPdo?U???Ckf??EJtxapR??bR??tP?I???????Y?DQ?JPR??vu?La?T??????M?YgD", lpString2="V" | out: lpString1="n???m?bQ??H??BC??x??IPdo?U???Ckf??EJtxapR??bR??tP?I???????Y?DQ?JPR??vu?La?T??????M?YgDV") returned="n???m?bQ??H??BC??x??IPdo?U???Ckf??EJtxapR??bR??tP?I???????Y?DQ?JPR??vu?La?T??????M?YgDV" [0098.995] lstrcatA (in: lpString1="n???m?bQ??H??BC??x??IPdo?U???Ckf??EJtxapR??bR??tP?I???????Y?DQ?JPR??vu?La?T??????M?YgDV", lpString2="?" | out: lpString1="n???m?bQ??H??BC??x??IPdo?U???Ckf??EJtxapR??bR??tP?I???????Y?DQ?JPR??vu?La?T??????M?YgDV?") returned="n???m?bQ??H??BC??x??IPdo?U???Ckf??EJtxapR??bR??tP?I???????Y?DQ?JPR??vu?La?T??????M?YgDV?" [0098.995] lstrlenA (lpString="n???m?bQ??H??BC??x??IPdo?U???Ckf??EJtxapR??bR??tP?I???????Y?DQ?JPR??vu?La?T??????M?YgDV?") returned 88 [0098.995] lstrcpynA (in: lpString1=0x499078, lpString2="n???m?bQ??H??BC??x??IPdo?U???Ckf??EJtxapR??bR??tP?I???????Y?DQ?JPR??vu?La?T??????M?YgDV?", iMaxLength=12 | out: lpString1="n???m?bQ??H") returned="n???m?bQ??H" [0098.995] lstrlenA (lpString="n???m?bQ??H") returned 11 [0098.995] lstrcatA (in: lpString1="", lpString2="?" | out: lpString1="?") returned="?" [0098.995] lstrcatA (in: lpString1="?", lpString2="k" | out: lpString1="?k") returned="?k" [0098.995] lstrcatA (in: lpString1="?k", lpString2="?" | out: lpString1="?k?") returned="?k?" [0098.995] lstrcatA (in: lpString1="?k?", lpString2="r" | out: lpString1="?k?r") returned="?k?r" [0098.995] lstrcatA (in: lpString1="?k?r", lpString2="Q" | out: lpString1="?k?rQ") returned="?k?rQ" [0098.995] lstrcatA (in: lpString1="?k?rQ", lpString2="k" | out: lpString1="?k?rQk") returned="?k?rQk" [0098.995] lstrcatA (in: lpString1="?k?rQk", lpString2="?" | out: lpString1="?k?rQk?") returned="?k?rQk?" [0098.995] lstrcatA (in: lpString1="?k?rQk?", lpString2="?" | out: lpString1="?k?rQk??") returned="?k?rQk??" [0098.995] lstrcatA (in: lpString1="?k?rQk??", lpString2="?" | out: lpString1="?k?rQk???") returned="?k?rQk???" [0098.995] lstrcatA (in: lpString1="?k?rQk???", lpString2="?" | out: lpString1="?k?rQk????") returned="?k?rQk????" [0098.995] lstrcatA (in: lpString1="?k?rQk????", lpString2="?" | out: lpString1="?k?rQk?????") returned="?k?rQk?????" [0098.995] lstrcatA (in: lpString1="?k?rQk?????", lpString2="T" | out: lpString1="?k?rQk?????T") returned="?k?rQk?????T" [0098.995] lstrcatA (in: lpString1="?k?rQk?????T", lpString2="?" | out: lpString1="?k?rQk?????T?") returned="?k?rQk?????T?" [0098.995] lstrcatA (in: lpString1="?k?rQk?????T?", lpString2="?" | out: lpString1="?k?rQk?????T??") returned="?k?rQk?????T??" [0098.995] lstrcatA (in: lpString1="?k?rQk?????T??", lpString2="?" | out: lpString1="?k?rQk?????T???") returned="?k?rQk?????T???" [0098.995] lstrcatA (in: lpString1="?k?rQk?????T???", lpString2="a" | out: lpString1="?k?rQk?????T???a") returned="?k?rQk?????T???a" [0098.995] lstrcatA (in: lpString1="?k?rQk?????T???a", lpString2="L" | out: lpString1="?k?rQk?????T???aL") returned="?k?rQk?????T???aL" [0098.995] lstrcatA (in: lpString1="?k?rQk?????T???aL", lpString2="i" | out: lpString1="?k?rQk?????T???aLi") returned="?k?rQk?????T???aLi" [0098.995] lstrlenA (lpString="?k?rQk?????T???aLi") returned 18 [0098.995] lstrcpynA (in: lpString1=0x4990c0, lpString2="?k?rQk?????T???aLi", iMaxLength=2 | out: lpString1="?") returned="?" [0098.995] lstrlenA (lpString="?") returned 1 [0098.995] lstrcatA (in: lpString1="", lpString2="N" | out: lpString1="N") returned="N" [0098.996] lstrcatA (in: lpString1="N", lpString2="?" | out: lpString1="N?") returned="N?" [0098.996] lstrcatA (in: lpString1="N?", lpString2="?" | out: lpString1="N??") returned="N??" [0098.996] lstrcatA (in: lpString1="N??", lpString2="E" | out: lpString1="N??E") returned="N??E" [0098.996] lstrcatA (in: lpString1="N??E", lpString2="E" | out: lpString1="N??EE") returned="N??EE" [0098.996] lstrcatA (in: lpString1="N??EE", lpString2="?" | out: lpString1="N??EE?") returned="N??EE?" [0098.996] lstrcatA (in: lpString1="N??EE?", lpString2="?" | out: lpString1="N??EE??") returned="N??EE??" [0098.996] lstrcatA (in: lpString1="N??EE??", lpString2="r" | out: lpString1="N??EE??r") returned="N??EE??r" [0098.996] lstrcatA (in: lpString1="N??EE??r", lpString2="?" | out: lpString1="N??EE??r?") returned="N??EE??r?" [0098.996] lstrcatA (in: lpString1="N??EE??r?", lpString2="?" | out: lpString1="N??EE??r??") returned="N??EE??r??" [0098.996] lstrcatA (in: lpString1="N??EE??r??", lpString2="L" | out: lpString1="N??EE??r??L") returned="N??EE??r??L" [0098.996] lstrcatA (in: lpString1="N??EE??r??L", lpString2="?" | out: lpString1="N??EE??r??L?") returned="N??EE??r??L?" [0098.996] lstrcatA (in: lpString1="N??EE??r??L?", lpString2="?" | out: lpString1="N??EE??r??L??") returned="N??EE??r??L??" [0098.996] lstrcatA (in: lpString1="N??EE??r??L??", lpString2="?" | out: lpString1="N??EE??r??L???") returned="N??EE??r??L???" [0098.996] lstrcatA (in: lpString1="N??EE??r??L???", lpString2="?" | out: lpString1="N??EE??r??L????") returned="N??EE??r??L????" [0098.996] lstrcatA (in: lpString1="N??EE??r??L????", lpString2="W" | out: lpString1="N??EE??r??L????W") returned="N??EE??r??L????W" [0098.996] lstrcatA (in: lpString1="N??EE??r??L????W", lpString2="D" | out: lpString1="N??EE??r??L????WD") returned="N??EE??r??L????WD" [0098.996] lstrcatA (in: lpString1="N??EE??r??L????WD", lpString2="?" | out: lpString1="N??EE??r??L????WD?") returned="N??EE??r??L????WD?" [0098.996] lstrcatA (in: lpString1="N??EE??r??L????WD?", lpString2="w" | out: lpString1="N??EE??r??L????WD?w") returned="N??EE??r??L????WD?w" [0098.996] lstrcatA (in: lpString1="N??EE??r??L????WD?w", lpString2="?" | out: lpString1="N??EE??r??L????WD?w?") returned="N??EE??r??L????WD?w?" [0098.996] lstrcatA (in: lpString1="N??EE??r??L????WD?w?", lpString2="p" | out: lpString1="N??EE??r??L????WD?w?p") returned="N??EE??r??L????WD?w?p" [0098.996] lstrcatA (in: lpString1="N??EE??r??L????WD?w?p", lpString2="?" | out: lpString1="N??EE??r??L????WD?w?p?") returned="N??EE??r??L????WD?w?p?" [0098.996] lstrcatA (in: lpString1="N??EE??r??L????WD?w?p?", lpString2="?" | out: lpString1="N??EE??r??L????WD?w?p??") returned="N??EE??r??L????WD?w?p??" [0098.996] lstrcatA (in: lpString1="N??EE??r??L????WD?w?p??", lpString2="V" | out: lpString1="N??EE??r??L????WD?w?p??V") returned="N??EE??r??L????WD?w?p??V" [0098.996] lstrcatA (in: lpString1="N??EE??r??L????WD?w?p??V", lpString2="?" | out: lpString1="N??EE??r??L????WD?w?p??V?") returned="N??EE??r??L????WD?w?p??V?" [0098.996] lstrcatA (in: lpString1="N??EE??r??L????WD?w?p??V?", lpString2="m" | out: lpString1="N??EE??r??L????WD?w?p??V?m") returned="N??EE??r??L????WD?w?p??V?m" [0098.996] lstrcatA (in: lpString1="N??EE??r??L????WD?w?p??V?m", lpString2="?" | out: lpString1="N??EE??r??L????WD?w?p??V?m?") returned="N??EE??r??L????WD?w?p??V?m?" [0098.996] lstrcatA (in: lpString1="N??EE??r??L????WD?w?p??V?m?", lpString2="D" | out: lpString1="N??EE??r??L????WD?w?p??V?m?D") returned="N??EE??r??L????WD?w?p??V?m?D" [0098.996] lstrcatA (in: lpString1="N??EE??r??L????WD?w?p??V?m?D", lpString2="?" | out: lpString1="N??EE??r??L????WD?w?p??V?m?D?") returned="N??EE??r??L????WD?w?p??V?m?D?" [0098.997] lstrcatA (in: lpString1="N??EE??r??L????WD?w?p??V?m?D?", lpString2="p" | out: lpString1="N??EE??r??L????WD?w?p??V?m?D?p") returned="N??EE??r??L????WD?w?p??V?m?D?p" [0098.997] lstrcatA (in: lpString1="N??EE??r??L????WD?w?p??V?m?D?p", lpString2="m" | out: lpString1="N??EE??r??L????WD?w?p??V?m?D?pm") returned="N??EE??r??L????WD?w?p??V?m?D?pm" [0098.997] lstrcatA (in: lpString1="N??EE??r??L????WD?w?p??V?m?D?pm", lpString2="?" | out: lpString1="N??EE??r??L????WD?w?p??V?m?D?pm?") returned="N??EE??r??L????WD?w?p??V?m?D?pm?" [0098.997] lstrcatA (in: lpString1="N??EE??r??L????WD?w?p??V?m?D?pm?", lpString2="k" | out: lpString1="N??EE??r??L????WD?w?p??V?m?D?pm?k") returned="N??EE??r??L????WD?w?p??V?m?D?pm?k" [0098.997] lstrcatA (in: lpString1="N??EE??r??L????WD?w?p??V?m?D?pm?k", lpString2="?" | out: lpString1="N??EE??r??L????WD?w?p??V?m?D?pm?k?") returned="N??EE??r??L????WD?w?p??V?m?D?pm?k?" [0098.997] lstrcatA (in: lpString1="N??EE??r??L????WD?w?p??V?m?D?pm?k?", lpString2="?" | out: lpString1="N??EE??r??L????WD?w?p??V?m?D?pm?k??") returned="N??EE??r??L????WD?w?p??V?m?D?pm?k??" [0098.997] lstrcatA (in: lpString1="N??EE??r??L????WD?w?p??V?m?D?pm?k??", lpString2="?" | out: lpString1="N??EE??r??L????WD?w?p??V?m?D?pm?k???") returned="N??EE??r??L????WD?w?p??V?m?D?pm?k???" [0098.997] lstrlenA (lpString="N??EE??r??L????WD?w?p??V?m?D?pm?k???") returned 36 [0098.997] lstrcpynA (in: lpString1=0x4990ac, lpString2="N??EE??r??L????WD?w?p??V?m?D?pm?k???", iMaxLength=17 | out: lpString1="N??EE??r??L????W") returned="N??EE??r??L????W" [0098.997] lstrlenA (lpString="N??EE??r??L????W") returned 16 [0098.997] lstrcatA (in: lpString1="", lpString2="z" | out: lpString1="z") returned="z" [0098.997] lstrcatA (in: lpString1="z", lpString2="?" | out: lpString1="z?") returned="z?" [0098.997] lstrcatA (in: lpString1="z?", lpString2="s" | out: lpString1="z?s") returned="z?s" [0098.997] lstrcatA (in: lpString1="z?s", lpString2="?" | out: lpString1="z?s?") returned="z?s?" [0098.997] lstrcatA (in: lpString1="z?s?", lpString2="?" | out: lpString1="z?s??") returned="z?s??" [0098.997] lstrcatA (in: lpString1="z?s??", lpString2="z" | out: lpString1="z?s??z") returned="z?s??z" [0098.997] lstrcatA (in: lpString1="z?s??z", lpString2="M" | out: lpString1="z?s??zM") returned="z?s??zM" [0098.997] lstrcatA (in: lpString1="z?s??zM", lpString2="?" | out: lpString1="z?s??zM?") returned="z?s??zM?" [0098.997] lstrcatA (in: lpString1="z?s??zM?", lpString2="Q" | out: lpString1="z?s??zM?Q") returned="z?s??zM?Q" [0098.997] lstrcatA (in: lpString1="z?s??zM?Q", lpString2="k" | out: lpString1="z?s??zM?Qk") returned="z?s??zM?Qk" [0098.997] lstrcatA (in: lpString1="z?s??zM?Qk", lpString2="?" | out: lpString1="z?s??zM?Qk?") returned="z?s??zM?Qk?" [0098.997] lstrcatA (in: lpString1="z?s??zM?Qk?", lpString2="?" | out: lpString1="z?s??zM?Qk??") returned="z?s??zM?Qk??" [0098.997] lstrlenA (lpString="z?s??zM?Qk???nI?Ph?tZ?????V?Ee?G?a?U???Z??dVH?g?Y??GO???GCHX???nZZ???wQ??AY?VuG?K??A?Vu??r?l") returned 92 [0098.997] lstrcpynA (in: lpString1=0x499074, lpString2="z?s??zM?Qk???nI?Ph?tZ?????V?Ee?G?a?U???Z??dVH?g?Y??GO???GCHX???nZZ???wQ??AY?VuG?K??A?Vu??r?l", iMaxLength=23 | out: lpString1="z?s??zM?Qk???nI?Ph?tZ?") returned="z?s??zM?Qk???nI?Ph?tZ?" [0098.997] lstrlenA (lpString="z?s??zM?Qk???nI?Ph?tZ?") returned 22 [0098.997] lstrlenA (lpString="E?r?uNZT??????WOi?tY?R??F?") returned 26 [0098.997] lstrcpynA (in: lpString1=0x4990b8, lpString2="E?r?uNZT??????WOi?tY?R??F?", iMaxLength=4 | out: lpString1="E?r") returned="E?r" [0098.997] lstrlenA (lpString="E?r") returned 3 [0098.997] lstrlenA (lpString="???wH?t") returned 7 [0098.998] lstrcpynA (in: lpString1=0x4990c4, lpString2="???wH?t", iMaxLength=3 | out: lpString1="??") returned="??" [0098.998] lstrlenA (lpString="??") returned 2 [0098.998] lstrlenA (lpString="C???oU???") returned 9 [0098.998] lstrcpynA (in: lpString1=0x4990c4, lpString2="C???oU???", iMaxLength=1 | out: lpString1="") returned="" [0098.998] lstrlenA (lpString="") returned 0 [0098.998] lstrlenA (lpString="X?ly?QI?v?ZOA???T??sc??jSU???B??HA?KJ") returned 37 [0098.998] lstrcpynA (in: lpString1=0x4990ac, lpString2="X?ly?QI?v?ZOA???T??sc??jSU???B??HA?KJ", iMaxLength=36 | out: lpString1="X?ly?QI?v?ZOA???T??sc??jSU???B??HA?") returned="X?ly?QI?v?ZOA???T??sc??jSU???B??HA?" [0098.998] lstrlenA (lpString="X?ly?QI?v?ZOA???T??sc??jSU???B??HA?") returned 35 [0098.998] lstrlenA (lpString="QQ?QJ??wpZVleb?Fr?J??j????w?QHU?wN?E???????t??Ff?tGYL??a?A?B????g?") returned 66 [0098.998] lstrcpynA (in: lpString1=0x499090, lpString2="QQ?QJ??wpZVleb?Fr?J??j????w?QHU?wN?E???????t??Ff?tGYL??a?A?B????g?", iMaxLength=10 | out: lpString1="QQ?QJ??wp") returned="QQ?QJ??wp" [0098.998] lstrlenA (lpString="QQ?QJ??wp") returned 9 [0098.998] lstrlenA (lpString="?f???c??sc??Dvew?i???JX??v???dL???KW??l???mF??J??f?dpJ?P?Wp?C?????eK???") returned 71 [0098.998] lstrcpynA (in: lpString1=0x49908c, lpString2="?f???c??sc??Dvew?i???JX??v???dL???KW??l???mF??J??f?dpJ?P?Wp?C?????eK???", iMaxLength=2 | out: lpString1="?") returned="?" [0098.998] lstrlenA (lpString="?") returned 1 [0098.998] lstrlenA (lpString="ilo???cR?bI??tp?Y??Gp?Q????") returned 27 [0098.998] lstrcpynA (in: lpString1=0x4990b8, lpString2="ilo???cR?bI??tp?Y??Gp?Q????", iMaxLength=21 | out: lpString1="ilo???cR?bI??tp?Y??G") returned="ilo???cR?bI??tp?Y??G" [0098.998] lstrlenA (lpString="ilo???cR?bI??tp?Y??G") returned 20 [0098.998] lstrlenA (lpString="bSs?l??z?QIr??c?F?TR?KVbl???p?CDnSsJBz???P?h??Vw?F?t?HA????Qd?a?????M?pc?K?U?IVI??w?xL?") returned 87 [0098.998] lstrcpynA (in: lpString1=0x49907c, lpString2="bSs?l??z?QIr??c?F?TR?KVbl???p?CDnSsJBz???P?h??Vw?F?t?HA????Qd?a?????M?pc?K?U?IVI??w?xL?", iMaxLength=73 | out: lpString1="bSs?l??z?QIr??c?F?TR?KVbl???p?CDnSsJBz???P?h??Vw?F?t?HA????Qd?a?????M?pc") returned="bSs?l??z?QIr??c?F?TR?KVbl???p?CDnSsJBz???P?h??Vw?F?t?HA????Qd?a?????M?pc" [0098.998] lstrlenA (lpString="bSs?l??z?QIr??c?F?TR?KVbl???p?CDnSsJBz???P?h??Vw?F?t?HA????Qd?a?????M?pc") returned 72 [0098.998] lstrlenA (lpString="?M??um?A?i???T?mP?tv??M???G?MP??xK??f?Bo???Q?") returned 45 [0098.998] lstrcpynA (in: lpString1=0x4990a4, lpString2="?M??um?A?i???T?mP?tv??M???G?MP??xK??f?Bo???Q?", iMaxLength=43 | out: lpString1="?M??um?A?i???T?mP?tv??M???G?MP??xK??f?Bo??") returned="?M??um?A?i???T?mP?tv??M???G?MP??xK??f?Bo??" [0098.998] lstrlenA (lpString="?M??um?A?i???T?mP?tv??M???G?MP??xK??f?Bo??") returned 42 [0098.998] lstrlenA (lpString="zJ??p?uwwmF????a?X???d???G??mf???sI?w?s???fKsb?fujk????i??e?ck????w??") returned 69 [0098.998] lstrcpynA (in: lpString1=0x49908c, lpString2="zJ??p?uwwmF????a?X???d???G??mf???sI?w?s???fKsb?fujk????i??e?ck????w??", iMaxLength=41 | out: lpString1="zJ??p?uwwmF????a?X???d???G??mf???sI?w?s?") returned="zJ??p?uwwmF????a?X???d???G??mf???sI?w?s?" [0098.998] lstrlenA (lpString="zJ??p?uwwmF????a?X???d???G??mf???sI?w?s?") returned 40 [0098.998] lstrlenA (lpString="ume?GK????p?tQdkQP??JKJ?n?Nb???") returned 31 [0098.999] lstrcpynA (in: lpString1=0x4990b4, lpString2="ume?GK????p?tQdkQP??JKJ?n?Nb???", iMaxLength=2 | out: lpString1="u") returned="u" [0098.999] lstrlenA (lpString="u") returned 1 [0098.999] lstrlenA (lpString="??oPlEE?I??????JO?????p?????wXe????nz?GEg") returned 41 [0098.999] lstrcpynA (in: lpString1=0x4990a8, lpString2="??oPlEE?I??????JO?????p?????wXe????nz?GEg", iMaxLength=29 | out: lpString1="??oPlEE?I??????JO?????p?????") returned="??oPlEE?I??????JO?????p?????" [0098.999] lstrlenA (lpString="??oPlEE?I??????JO?????p?????") returned 28 [0098.999] lstrlenA (lpString="l?Ovxx??A???Y?m?????c??H?b") returned 26 [0098.999] lstrcpynA (in: lpString1=0x4990b8, lpString2="l?Ovxx??A???Y?m?????c??H?b", iMaxLength=8 | out: lpString1="l?Ovxx?") returned="l?Ovxx?" [0098.999] lstrlenA (lpString="l?Ovxx?") returned 7 [0098.999] lstrlenA (lpString="??????OJ?W?u?a?F?Pj?Mav?aDG????Q????r?RTKD??lhL??QA?g?X??S?h?H??HD??A?Szi?nfO?K???M") returned 83 [0098.999] lstrcpynA (in: lpString1=0x499080, lpString2="??????OJ?W?u?a?F?Pj?Mav?aDG????Q????r?RTKD??lhL??QA?g?X??S?h?H??HD??A?Szi?nfO?K???M", iMaxLength=34 | out: lpString1="??????OJ?W?u?a?F?Pj?Mav?aDG????Q?") returned="??????OJ?W?u?a?F?Pj?Mav?aDG????Q?" [0098.999] lstrlenA (lpString="??????OJ?W?u?a?F?Pj?Mav?aDG????Q?") returned 33 [0098.999] lstrlenA (lpString="?a?F?Ig?r??") returned 11 [0098.999] lstrcpynA (in: lpString1=0x4990c4, lpString2="?a?F?Ig?r??", iMaxLength=4 | out: lpString1="?a?") returned="?a?" [0098.999] lstrlenA (lpString="?a?") returned 3 [0098.999] lstrlenA (lpString="E??k?E?I?i??c??Dn?Q??V????Wc?JW?X???????") returned 40 [0098.999] lstrcpynA (in: lpString1=0x4990a8, lpString2="E??k?E?I?i??c??Dn?Q??V????Wc?JW?X???????", iMaxLength=15 | out: lpString1="E??k?E?I?i??c?") returned="E??k?E?I?i??c?" [0098.999] lstrlenA (lpString="E??k?E?I?i??c?") returned 14 [0098.999] lstrlenA (lpString="????fY???????OU?wU?Q?Cd?Yi??") returned 28 [0098.999] lstrcpynA (in: lpString1=0x4990b4, lpString2="????fY???????OU?wU?Q?Cd?Yi??", iMaxLength=14 | out: lpString1="????fY???????") returned="????fY???????" [0098.999] lstrlenA (lpString="????fY???????") returned 13 [0098.999] lstrlenA (lpString="sS?a?CpR?") returned 9 [0098.999] lstrcpynA (in: lpString1=0x4990c4, lpString2="sS?a?CpR?", iMaxLength=4 | out: lpString1="sS?") returned="sS?" [0098.999] lstrlenA (lpString="sS?") returned 3 [0098.999] lstrlenA (lpString="??mR") returned 4 [0098.999] lstrcpynA (in: lpString1=0x4990c4, lpString2="??mR", iMaxLength=3 | out: lpString1="??") returned="??" [0098.999] lstrlenA (lpString="??") returned 2 [0098.999] lstrlenA (lpString="s?H?") returned 4 [0098.999] lstrcpynA (in: lpString1=0x4990c4, lpString2="s?H?", iMaxLength=1 | out: lpString1="") returned="" [0098.999] lstrlenA (lpString="") returned 0 [0099.000] lstrlenA (lpString="tSRMN??Nbw?b??M????x????Uu???Z??r??p?j??Q?u?T") returned 45 [0099.000] lstrcpynA (in: lpString1=0x4990a4, lpString2="tSRMN??Nbw?b??M????x????Uu???Z??r??p?j??Q?u?T", iMaxLength=40 | out: lpString1="tSRMN??Nbw?b??M????x????Uu???Z??r??p?j?") returned="tSRMN??Nbw?b??M????x????Uu???Z??r??p?j?" [0099.000] lstrlenA (lpString="tSRMN??Nbw?b??M????x????Uu???Z??r??p?j?") returned 39 [0099.000] lstrlenA (lpString="?") returned 1 [0099.000] lstrcpynA (in: lpString1=0x4990c4, lpString2="?", iMaxLength=1 | out: lpString1="") returned="" [0099.000] lstrlenA (lpString="") returned 0 [0099.000] lstrlenA (lpString="????xL????S?c??J?L????X?EK????n??j?rS??WEN?E??????f????yvz???T?P?F?u??u?C?D??l?????m?CTH") returned 88 [0099.000] lstrcpynA (in: lpString1=0x499078, lpString2="????xL????S?c??J?L????X?EK????n??j?rS??WEN?E??????f????yvz???T?P?F?u??u?C?D??l?????m?CTH", iMaxLength=18 | out: lpString1="????xL????S?c??J?") returned="????xL????S?c??J?" [0099.000] lstrlenA (lpString="????xL????S?c??J?") returned 17 [0099.000] lstrlenA (lpString="VcL????P??i??YX?") returned 16 [0099.000] lstrcpynA (in: lpString1=0x4990c0, lpString2="VcL????P??i??YX?", iMaxLength=3 | out: lpString1="Vc") returned="Vc" [0099.000] lstrlenA (lpString="Vc") returned 2 [0099.000] lstrlenA (lpString="b?kl") returned 4 [0099.000] lstrcpynA (in: lpString1=0x4990c4, lpString2="b?kl", iMaxLength=1 | out: lpString1="") returned="" [0099.000] lstrlenA (lpString="") returned 0 [0099.000] lstrlenA (lpString="a???g?NWZHrK??x??L?E") returned 20 [0099.000] lstrcpynA (in: lpString1=0x4990bc, lpString2="a???g?NWZHrK??x??L?E", iMaxLength=1 | out: lpString1="") returned="" [0099.000] lstrlenA (lpString="") returned 0 [0099.000] lstrlenA (lpString="????tQ????Q??m???z??X????c??f?c?JprS??bz?R?oMbkM??V??MZsUNe????EY???vj?t?Cglk?") returned 78 [0099.000] lstrcpynA (in: lpString1=0x499084, lpString2="????tQ????Q??m???z??X????c??f?c?JprS??bz?R?oMbkM??V??MZsUNe????EY???vj?t?Cglk?", iMaxLength=8 | out: lpString1="????tQ?") returned="????tQ?" [0099.000] lstrlenA (lpString="????tQ?") returned 7 [0099.000] lstrlenA (lpString="enjFt??") returned 7 [0099.000] lstrcpynA (in: lpString1=0x4990c4, lpString2="enjFt??", iMaxLength=6 | out: lpString1="enjFt") returned="enjFt" [0099.001] lstrlenA (lpString="enjFt") returned 5 [0099.001] lstrlenA (lpString="GM??G???ZR?gL?GDE??F?????d?B?pYsIE??b???f???Wa??????Wzv??cdR???S???kTLh?kkQ?c?") returned 78 [0099.001] lstrcpynA (in: lpString1=0x499084, lpString2="GM??G???ZR?gL?GDE??F?????d?B?pYsIE??b???f???Wa??????Wzv??cdR???S???kTLh?kkQ?c?", iMaxLength=40 | out: lpString1="GM??G???ZR?gL?GDE??F?????d?B?pYsIE??b??") returned="GM??G???ZR?gL?GDE??F?????d?B?pYsIE??b??" [0099.001] lstrlenA (lpString="GM??G???ZR?gL?GDE??F?????d?B?pYsIE??b??") returned 39 [0099.001] lstrlenA (lpString="?s?U?gudbe?????D??R?bA???s?MG????K??????slcgx?D??") returned 49 [0099.001] lstrcpynA (in: lpString1=0x4990a0, lpString2="?s?U?gudbe?????D??R?bA???s?MG????K??????slcgx?D??", iMaxLength=41 | out: lpString1="?s?U?gudbe?????D??R?bA???s?MG????K??????") returned="?s?U?gudbe?????D??R?bA???s?MG????K??????" [0099.001] lstrlenA (lpString="?s?U?gudbe?????D??R?bA???s?MG????K??????") returned 40 [0099.001] lstrlenA (lpString="?OB??M?c??IG???") returned 15 [0099.001] lstrcpynA (in: lpString1=0x4990c4, lpString2="?OB??M?c??IG???", iMaxLength=10 | out: lpString1="?OB??M?c?") returned="?OB??M?c?" [0099.001] lstrlenA (lpString="?OB??M?c?") returned 9 [0099.001] lstrlenA (lpString="???yhH?E?T???") returned 13 [0099.001] lstrcpynA (in: lpString1=0x4990c4, lpString2="???yhH?E?T???", iMaxLength=9 | out: lpString1="???yhH?E") returned="???yhH?E" [0099.001] lstrlenA (lpString="???yhH?E") returned 8 [0099.001] lstrlenA (lpString="Vc?Yo??Z") returned 8 [0099.001] lstrcpynA (in: lpString1=0x4990c4, lpString2="Vc?Yo??Z", iMaxLength=7 | out: lpString1="Vc?Yo?") returned="Vc?Yo?" [0099.001] lstrlenA (lpString="Vc?Yo?") returned 6 [0099.001] lstrlenA (lpString="???m?R?bROYnb???UZ?m?JO????wu?Q?QO?UrU?????h??oo??g?kv?????u??k?o???f???XxT??xad??X???Mt?K?X???") returned 95 [0099.001] lstrcpynA (in: lpString1=0x499074, lpString2="???m?R?bROYnb???UZ?m?JO????wu?Q?QO?UrU?????h??oo??g?kv?????u??k?o???f???XxT??xad??X???Mt?K?X???", iMaxLength=34 | out: lpString1="???m?R?bROYnb???UZ?m?JO????wu?Q?Q") returned="???m?R?bROYnb???UZ?m?JO????wu?Q?Q" [0099.001] lstrlenA (lpString="???m?R?bROYnb???UZ?m?JO????wu?Q?Q") returned 33 [0099.001] lstrlenA (lpString="W?l???") returned 6 [0099.001] lstrcpynA (in: lpString1=0x4990c4, lpString2="W?l???", iMaxLength=1 | out: lpString1="") returned="" [0099.001] lstrlenA (lpString="") returned 0 [0099.001] lstrlenA (lpString="e???GTwn?oJR?g?p?x?P??Af?B????B??d?Xi????lEx???yW?w???yL?V???L??????GGe???M?XjV???X?????iX??z") returned 93 [0099.001] lstrcpynA (in: lpString1=0x499074, lpString2="e???GTwn?oJR?g?p?x?P??Af?B????B??d?Xi????lEx???yW?w???yL?V???L??????GGe???M?XjV???X?????iX??z", iMaxLength=52 | out: lpString1="e???GTwn?oJR?g?p?x?P??Af?B????B??d?Xi????lEx???yW?w") returned="e???GTwn?oJR?g?p?x?P??Af?B????B??d?Xi????lEx???yW?w" [0099.001] lstrlenA (lpString="e???GTwn?oJR?g?p?x?P??Af?B????B??d?Xi????lEx???yW?w") returned 51 [0099.001] lstrlenA (lpString="???n????PT?WI????Wt?v?c?????K?h??J?????") returned 39 [0099.001] lstrcpynA (in: lpString1=0x4990ac, lpString2="???n????PT?WI????Wt?v?c?????K?h??J?????", iMaxLength=35 | out: lpString1="???n????PT?WI????Wt?v?c?????K?h??J") returned="???n????PT?WI????Wt?v?c?????K?h??J" [0099.001] lstrlenA (lpString="???n????PT?WI????Wt?v?c?????K?h??J") returned 34 [0099.002] lstrlenA (lpString="m???Bc?FFr?nrHyma?Y??jmU?m??zVj?????Br?M?m???z?Y???kEn?p?I?nTkc??e?fZ") returned 69 [0099.002] lstrcpynA (in: lpString1=0x49908c, lpString2="m???Bc?FFr?nrHyma?Y??jmU?m??zVj?????Br?M?m???z?Y???kEn?p?I?nTkc??e?fZ", iMaxLength=10 | out: lpString1="m???Bc?FF") returned="m???Bc?FF" [0099.002] lstrlenA (lpString="m???Bc?FF") returned 9 [0099.002] lstrlenA (lpString="???H?????u???RI??jjxAc?t") returned 24 [0099.002] lstrcpynA (in: lpString1=0x4990b8, lpString2="???H?????u???RI??jjxAc?t", iMaxLength=20 | out: lpString1="???H?????u???RI??jj") returned="???H?????u???RI??jj" [0099.002] lstrlenA (lpString="???H?????u???RI??jj") returned 19 [0099.002] lstrlenA (lpString="??S???CNX?W?p??s?E??Nj?e????v???KD???irs???z") returned 44 [0099.002] lstrcpynA (in: lpString1=0x4990a4, lpString2="??S???CNX?W?p??s?E??Nj?e????v???KD???irs???z", iMaxLength=39 | out: lpString1="??S???CNX?W?p??s?E??Nj?e????v???KD???i") returned="??S???CNX?W?p??s?E??Nj?e????v???KD???i" [0099.002] lstrlenA (lpString="??S???CNX?W?p??s?E??Nj?e????v???KD???i") returned 38 [0099.002] lstrlenA (lpString="??????e?ZP????E?E?d???HCQ????Df??Ho?????AGZNiRga???C?G??kx") returned 58 [0099.002] lstrcpynA (in: lpString1=0x499098, lpString2="??????e?ZP????E?E?d???HCQ????Df??Ho?????AGZNiRga???C?G??kx", iMaxLength=23 | out: lpString1="??????e?ZP????E?E?d???") returned="??????e?ZP????E?E?d???" [0099.002] lstrlenA (lpString="??????e?ZP????E?E?d???") returned 22 [0099.002] lstrlenA (lpString="?ibe?????L?VM?M?G?????C?B??A??????CDEuU?Zo?") returned 43 [0099.002] lstrcpynA (in: lpString1=0x4990a8, lpString2="?ibe?????L?VM?M?G?????C?B??A??????CDEuU?Zo?", iMaxLength=23 | out: lpString1="?ibe?????L?VM?M?G?????") returned="?ibe?????L?VM?M?G?????" [0099.002] lstrlenA (lpString="?ibe?????L?VM?M?G?????") returned 22 [0099.002] lstrlenA (lpString="jAQ?BM??s?????L?x????kg?P?v??d??Y??wD?uIyBS?????eo????G?b???TM????D?BL?Q??Nj?M???????Qx?n?") returned 90 [0099.002] lstrcpynA (in: lpString1=0x499078, lpString2="jAQ?BM??s?????L?x????kg?P?v??d??Y??wD?uIyBS?????eo????G?b???TM????D?BL?Q??Nj?M???????Qx?n?", iMaxLength=72 | out: lpString1="jAQ?BM??s?????L?x????kg?P?v??d??Y??wD?uIyBS?????eo????G?b???TM????D?BL?") returned="jAQ?BM??s?????L?x????kg?P?v??d??Y??wD?uIyBS?????eo????G?b???TM????D?BL?" [0099.002] lstrlenA (lpString="jAQ?BM??s?????L?x????kg?P?v??d??Y??wD?uIyBS?????eo????G?b???TM????D?BL?") returned 71 [0099.002] lstrlenA (lpString="t??D?Ej?f?XJ?jTmx?????????G??????") returned 33 [0099.002] lstrcpynA (in: lpString1=0x4990b0, lpString2="t??D?Ej?f?XJ?jTmx?????????G??????", iMaxLength=17 | out: lpString1="t??D?Ej?f?XJ?jTm") returned="t??D?Ej?f?XJ?jTm" [0099.002] lstrlenA (lpString="t??D?Ej?f?XJ?jTm") returned 16 [0099.002] lstrlenA (lpString="????z???lMyD?Lul??B?x?S?XeW") returned 27 [0099.002] lstrcpynA (in: lpString1=0x4990b8, lpString2="????z???lMyD?Lul??B?x?S?XeW", iMaxLength=2 | out: lpString1="?") returned="?" [0099.002] lstrlenA (lpString="?") returned 1 [0099.002] lstrlenA (lpString="?M??b???ozTShAV????r?nbd?E") returned 26 [0099.002] lstrcpynA (in: lpString1=0x4990b8, lpString2="?M??b???ozTShAV????r?nbd?E", iMaxLength=20 | out: lpString1="?M??b???ozTShAV????") returned="?M??b???ozTShAV????" [0099.002] lstrlenA (lpString="?M??b???ozTShAV????") returned 19 [0099.003] lstrlenA (lpString="???c??u??n??H???v??E????OOE?t?z") returned 31 [0099.003] lstrcpynA (in: lpString1=0x4990b4, lpString2="???c??u??n??H???v??E????OOE?t?z", iMaxLength=19 | out: lpString1="???c??u??n??H???v?") returned="???c??u??n??H???v?" [0099.003] lstrlenA (lpString="???c??u??n??H???v?") returned 18 [0099.003] lstrlenA (lpString="A????????Qt??cdubH??Wxt?R?b??ux??o??R???") returned 40 [0099.003] lstrcpynA (in: lpString1=0x4990a8, lpString2="A????????Qt??cdubH??Wxt?R?b??ux??o??R???", iMaxLength=36 | out: lpString1="A????????Qt??cdubH??Wxt?R?b??ux??o?") returned="A????????Qt??cdubH??Wxt?R?b??ux??o?" [0099.003] lstrlenA (lpString="A????????Qt??cdubH??Wxt?R?b??ux??o?") returned 35 [0099.003] lstrlenA (lpString="TM?????I?xxk?u???h??u?T??O?K?C?J?") returned 33 [0099.003] lstrcpynA (in: lpString1=0x4990b0, lpString2="TM?????I?xxk?u???h??u?T??O?K?C?J?", iMaxLength=23 | out: lpString1="TM?????I?xxk?u???h??u?") returned="TM?????I?xxk?u???h??u?" [0099.003] lstrlenA (lpString="TM?????I?xxk?u???h??u?") returned 22 [0099.003] lstrlenA (lpString="???p??N??sbA??") returned 14 [0099.003] lstrcpynA (in: lpString1=0x4990c4, lpString2="???p??N??sbA??", iMaxLength=11 | out: lpString1="???p??N??s") returned="???p??N??s" [0099.003] lstrlenA (lpString="???p??N??s") returned 10 [0099.003] lstrlenA (lpString="?v?s?d?Ll??meV??wX?Cz???gn?o") returned 28 [0099.003] lstrcpynA (in: lpString1=0x4990b4, lpString2="?v?s?d?Ll??meV??wX?Cz???gn?o", iMaxLength=10 | out: lpString1="?v?s?d?Ll") returned="?v?s?d?Ll" [0099.003] lstrlenA (lpString="?v?s?d?Ll") returned 9 [0099.003] lstrlenA (lpString="xV??PMd?????aRp????XHHgyH") returned 25 [0099.003] lstrcpynA (in: lpString1=0x4990b8, lpString2="xV??PMd?????aRp????XHHgyH", iMaxLength=2 | out: lpString1="x") returned="x" [0099.003] lstrlenA (lpString="x") returned 1 [0099.003] lstrlenA (lpString="?t???u??s??O???????h???????O?YR??V??tH?n?P?JXd?N?") returned 49 [0099.003] lstrcpynA (in: lpString1=0x4990a0, lpString2="?t???u??s??O???????h???????O?YR??V??tH?n?P?JXd?N?", iMaxLength=7 | out: lpString1="?t???u") returned="?t???u" [0099.003] lstrlenA (lpString="?t???u") returned 6 [0099.003] lstrlenA (lpString="A?o?Rs?WP??") returned 11 [0099.003] lstrcpynA (in: lpString1=0x4990c4, lpString2="A?o?Rs?WP??", iMaxLength=2 | out: lpString1="A") returned="A" [0099.003] lstrlenA (lpString="A") returned 1 [0099.003] lstrlenA (lpString="?x??x????vpCVL????KH????Y??x??zA?t?PU?bM?haAc") returned 45 [0099.003] lstrcpynA (in: lpString1=0x4990a4, lpString2="?x??x????vpCVL????KH????Y??x??zA?t?PU?bM?haAc", iMaxLength=30 | out: lpString1="?x??x????vpCVL????KH????Y??x?") returned="?x??x????vpCVL????KH????Y??x?" [0099.003] lstrlenA (lpString="?x??x????vpCVL????KH????Y??x?") returned 29 [0099.003] lstrlenA (lpString="?yS?U?fvaUS???Sr??L?????????????h?????vFGfb???cD") returned 48 [0099.003] lstrcpynA (in: lpString1=0x4990a0, lpString2="?yS?U?fvaUS???Sr??L?????????????h?????vFGfb???cD", iMaxLength=37 | out: lpString1="?yS?U?fvaUS???Sr??L?????????????h???") returned="?yS?U?fvaUS???Sr??L?????????????h???" [0099.003] lstrlenA (lpString="?yS?U?fvaUS???Sr??L?????????????h???") returned 36 [0099.004] lstrlenA (lpString="???Gx???pA????????cc?u?VIm?c?AtCb??m???m??Tt???zvXBadW??S?i???i?UdI??HyFW?") returned 74 [0099.004] lstrcpynA (in: lpString1=0x499088, lpString2="???Gx???pA????????cc?u?VIm?c?AtCb??m???m??Tt???zvXBadW??S?i???i?UdI??HyFW?", iMaxLength=29 | out: lpString1="???Gx???pA????????cc?u?VIm?c") returned="???Gx???pA????????cc?u?VIm?c" [0099.004] lstrlenA (lpString="???Gx???pA????????cc?u?VIm?c") returned 28 [0099.004] lstrlenA (lpString="??Y??h??P????n??Xc????Bdz?Hs?j??y????z???D?Swd?????m?P?O") returned 56 [0099.004] lstrcpynA (in: lpString1=0x499098, lpString2="??Y??h??P????n??Xc????Bdz?Hs?j??y????z???D?Swd?????m?P?O", iMaxLength=9 | out: lpString1="??Y??h??") returned="??Y??h??" [0099.004] lstrlenA (lpString="??Y??h??") returned 8 [0099.004] lstrlenA (lpString="??dzh??k?r?W???") returned 15 [0099.004] lstrcpynA (in: lpString1=0x4990c4, lpString2="??dzh??k?r?W???", iMaxLength=6 | out: lpString1="??dzh") returned="??dzh" [0099.004] lstrlenA (lpString="??dzh") returned 5 [0099.004] lstrlenA (lpString="iL?Tg??U?") returned 9 [0099.004] lstrcpynA (in: lpString1=0x4990c4, lpString2="iL?Tg??U?", iMaxLength=8 | out: lpString1="iL?Tg??") returned="iL?Tg??" [0099.004] lstrlenA (lpString="iL?Tg??") returned 7 [0099.004] lstrlenA (lpString="??ksQ?bwRSK??G???L?upN?Y?????hbr?I?p??no?a?okMnW?Dy??") returned 53 [0099.004] lstrcpynA (in: lpString1=0x49909c, lpString2="??ksQ?bwRSK??G???L?upN?Y?????hbr?I?p??no?a?okMnW?Dy??", iMaxLength=16 | out: lpString1="??ksQ?bwRSK??G?") returned="??ksQ?bwRSK??G?" [0099.004] lstrlenA (lpString="??ksQ?bwRSK??G?") returned 15 [0099.004] lstrlenA (lpString="??Ei?IhgGh????vc?j???gd?J?Xa?zX?SK???wm????S??K??ZGl???????z?y?v???W?Q") returned 70 [0099.004] lstrcpynA (in: lpString1=0x49908c, lpString2="??Ei?IhgGh????vc?j???gd?J?Xa?zX?SK???wm????S??K??ZGl???????z?y?v???W?Q", iMaxLength=15 | out: lpString1="??Ei?IhgGh????") returned="??Ei?IhgGh????" [0099.004] lstrlenA (lpString="??Ei?IhgGh????") returned 14 [0099.004] lstrlenA (lpString="??S?Q?z?WR?EL?K???Ai") returned 20 [0099.004] lstrcpynA (in: lpString1=0x4990bc, lpString2="??S?Q?z?WR?EL?K???Ai", iMaxLength=18 | out: lpString1="??S?Q?z?WR?EL?K??") returned="??S?Q?z?WR?EL?K??" [0099.004] lstrlenA (lpString="??S?Q?z?WR?EL?K??") returned 17 [0099.004] lstrlenA (lpString="???ky?c?WT?WM?E??J?EK?N?????n?IUA?n??r??p?whwkV?U?i??QRsDmOu?") returned 61 [0099.004] lstrcpynA (in: lpString1=0x499094, lpString2="???ky?c?WT?WM?E??J?EK?N?????n?IUA?n??r??p?whwkV?U?i??QRsDmOu?", iMaxLength=29 | out: lpString1="???ky?c?WT?WM?E??J?EK?N?????") returned="???ky?c?WT?WM?E??J?EK?N?????" [0099.004] lstrlenA (lpString="???ky?c?WT?WM?E??J?EK?N?????") returned 28 [0099.004] lstrlenA (lpString="V???????nzK?A????B???Ns?gj??N??K?l?W?X??a??i??r???ii??E??UG?hR???w?lc??????i?t??fYl???Bs??CXu???Q") returned 97 [0099.004] lstrcpynA (in: lpString1=0x499070, lpString2="V???????nzK?A????B???Ns?gj??N??K?l?W?X??a??i??r???ii??E??UG?hR???w?lc??????i?t??fYl???Bs??CXu???Q", iMaxLength=12 | out: lpString1="V???????nzK") returned="V???????nzK" [0099.005] lstrlenA (lpString="V???????nzK") returned 11 [0099.005] lstrlenA (lpString="?Us??h??cn?????s??r??E?a?BpN??????E?oXyV?U?X??nD???W?Or??eozi??G?R?dO?rs??g??") returned 77 [0099.005] lstrcpynA (in: lpString1=0x499084, lpString2="?Us??h??cn?????s??r??E?a?BpN??????E?oXyV?U?X??nD???W?Or??eozi??G?R?dO?rs??g??", iMaxLength=14 | out: lpString1="?Us??h??cn???") returned="?Us??h??cn???" [0099.005] lstrlenA (lpString="?Us??h??cn???") returned 13 [0099.005] lstrlenA (lpString="??zsMpB??PiD?J?JZ?J?ft") returned 22 [0099.005] lstrcpynA (in: lpString1=0x4990bc, lpString2="??zsMpB??PiD?J?JZ?J?ft", iMaxLength=18 | out: lpString1="??zsMpB??PiD?J?JZ") returned="??zsMpB??PiD?J?JZ" [0099.005] lstrlenA (lpString="??zsMpB??PiD?J?JZ") returned 17 [0099.005] lstrlenA (lpString="?x?h??Y?A??Tdc?Z?????RvfgDdaf????oQRz") returned 37 [0099.005] lstrcpynA (in: lpString1=0x4990ac, lpString2="?x?h??Y?A??Tdc?Z?????RvfgDdaf????oQRz", iMaxLength=18 | out: lpString1="?x?h??Y?A??Tdc?Z?") returned="?x?h??Y?A??Tdc?Z?" [0099.005] lstrlenA (lpString="?x?h??Y?A??Tdc?Z?") returned 17 [0099.005] lstrlenA (lpString="?ik?j?v") returned 7 [0099.005] lstrcpynA (in: lpString1=0x4990c4, lpString2="?ik?j?v", iMaxLength=1 | out: lpString1="") returned="" [0099.005] lstrlenA (lpString="") returned 0 [0099.005] lstrlenA (lpString="??X??MevMc???A?y?AQb???uvu") returned 26 [0099.005] lstrcpynA (in: lpString1=0x4990b8, lpString2="??X??MevMc???A?y?AQb???uvu", iMaxLength=13 | out: lpString1="??X??MevMc??") returned="??X??MevMc??" [0099.005] lstrlenA (lpString="??X??MevMc??") returned 12 [0099.005] lstrlenA (lpString="?ZJ?????Y???o?s?TPD?Q??z?OvGB??t??Y?QW?RKHu??xZ????n???o?nzCKDbD?M????Rr?aG???MS?LL?k?Z??b?") returned 91 [0099.005] lstrcpynA (in: lpString1=0x499078, lpString2="?ZJ?????Y???o?s?TPD?Q??z?OvGB??t??Y?QW?RKHu??xZ????n???o?nzCKDbD?M????Rr?aG???MS?LL?k?Z??b?", iMaxLength=2 | out: lpString1="?") returned="?" [0099.005] lstrlenA (lpString="?") returned 1 [0099.005] lstrlenA (lpString="yz??Ic?vD??????U???????ciiE?NaW??nA?pIljibuQLn?Re??RQ??a???Q?j?RE?yJnfb??????Y??E???N??") returned 87 [0099.005] lstrcpynA (in: lpString1=0x49907c, lpString2="yz??Ic?vD??????U???????ciiE?NaW??nA?pIljibuQLn?Re??RQ??a???Q?j?RE?yJnfb??????Y??E???N??", iMaxLength=68 | out: lpString1="yz??Ic?vD??????U???????ciiE?NaW??nA?pIljibuQLn?Re??RQ??a???Q?j?RE?y") returned="yz??Ic?vD??????U???????ciiE?NaW??nA?pIljibuQLn?Re??RQ??a???Q?j?RE?y" [0099.005] lstrlenA (lpString="yz??Ic?vD??????U???????ciiE?NaW??nA?pIljibuQLn?Re??RQ??a???Q?j?RE?y") returned 67 [0099.005] lstrlenA (lpString="???v?") returned 5 [0099.005] lstrcpynA (in: lpString1=0x4990c4, lpString2="???v?", iMaxLength=2 | out: lpString1="?") returned="?" [0099.005] lstrlenA (lpString="?") returned 1 [0099.005] lstrlenA (lpString="z?y??t??RdcX????ME?RpYy?i?????GdIW?????XJW?Qy????E?n????B") returned 57 [0099.005] lstrcpynA (in: lpString1=0x499098, lpString2="z?y??t??RdcX????ME?RpYy?i?????GdIW?????XJW?Qy????E?n????B", iMaxLength=4 | out: lpString1="z?y") returned="z?y" [0099.005] lstrlenA (lpString="z?y") returned 3 [0099.006] lstrlenA (lpString="????") returned 4 [0099.006] lstrcpynA (in: lpString1=0x4990c4, lpString2="????", iMaxLength=1 | out: lpString1="") returned="" [0099.006] lstrlenA (lpString="") returned 0 [0099.006] lstrlenA (lpString="m???B?????") returned 10 [0099.006] lstrcpynA (in: lpString1=0x4990c4, lpString2="m???B?????", iMaxLength=4 | out: lpString1="m??") returned="m??" [0099.006] lstrlenA (lpString="m??") returned 3 [0099.006] lstrlenA (lpString="Oijf???J???JVT????Y??E?????z?gMv?b??????P?f??o???J???NeuQX??a??????m?z????") returned 74 [0099.006] lstrcpynA (in: lpString1=0x499088, lpString2="Oijf???J???JVT????Y??E?????z?gMv?b??????P?f??o???J???NeuQX??a??????m?z????", iMaxLength=33 | out: lpString1="Oijf???J???JVT????Y??E?????z?gMv") returned="Oijf???J???JVT????Y??E?????z?gMv" [0099.006] lstrlenA (lpString="Oijf???J???JVT????Y??E?????z?gMv") returned 32 [0099.006] lstrlenA (lpString="??KiREk???c?MQ") returned 14 [0099.006] lstrcpynA (in: lpString1=0x4990c4, lpString2="??KiREk???c?MQ", iMaxLength=6 | out: lpString1="??KiR") returned="??KiR" [0099.006] lstrlenA (lpString="??KiR") returned 5 [0099.006] lstrlenA (lpString="dFvQ?Tt????j?k?aCtDrZ????tt????d???????ft??k?M?y?H?C??U??RY?Qfy???") returned 66 [0099.006] lstrcpynA (in: lpString1=0x499090, lpString2="dFvQ?Tt????j?k?aCtDrZ????tt????d???????ft??k?M?y?H?C??U??RY?Qfy???", iMaxLength=25 | out: lpString1="dFvQ?Tt????j?k?aCtDrZ???") returned="dFvQ?Tt????j?k?aCtDrZ???" [0099.006] lstrlenA (lpString="dFvQ?Tt????j?k?aCtDrZ???") returned 24 [0099.006] lstrlenA (lpString="h?dm????R??") returned 11 [0099.006] lstrcpynA (in: lpString1=0x4990c4, lpString2="h?dm????R??", iMaxLength=10 | out: lpString1="h?dm????R") returned="h?dm????R" [0099.006] lstrlenA (lpString="h?dm????R") returned 9 [0099.006] lstrlenA (lpString="k?a?bd??L??????oT??QbAD?K?mw??W??fPQO?cwBg?Do???G?SF?k??ELjV???Z?w??X??????p???") returned 79 [0099.006] lstrcpynA (in: lpString1=0x499084, lpString2="k?a?bd??L??????oT??QbAD?K?mw??W??fPQO?cwBg?Do???G?SF?k??ELjV???Z?w??X??????p???", iMaxLength=73 | out: lpString1="k?a?bd??L??????oT??QbAD?K?mw??W??fPQO?cwBg?Do???G?SF?k??ELjV???Z?w??X???") returned="k?a?bd??L??????oT??QbAD?K?mw??W??fPQO?cwBg?Do???G?SF?k??ELjV???Z?w??X???" [0099.006] lstrlenA (lpString="k?a?bd??L??????oT??QbAD?K?mw??W??fPQO?cwBg?Do???G?SF?k??ELjV???Z?w??X???") returned 72 [0099.006] lstrlenA (lpString="O??J???????h?HF?o?UZ?????G?RE?n??y????Ub??????a?RD?U?y???iBc?Q?xJl") returned 66 [0099.006] lstrcpynA (in: lpString1=0x499090, lpString2="O??J???????h?HF?o?UZ?????G?RE?n??y????Ub??????a?RD?U?y???iBc?Q?xJl", iMaxLength=44 | out: lpString1="O??J???????h?HF?o?UZ?????G?RE?n??y????Ub???") returned="O??J???????h?HF?o?UZ?????G?RE?n??y????Ub???" [0099.006] lstrlenA (lpString="O??J???????h?HF?o?UZ?????G?RE?n??y????Ub???") returned 43 [0099.006] lstrlenA (lpString="?BZp????fMT?w?c?aVu???msb??????X??Cl???w?h???bm??NoT?w?mnO??i") returned 61 [0099.006] lstrcpynA (in: lpString1=0x499094, lpString2="?BZp????fMT?w?c?aVu???msb??????X??Cl???w?h???bm??NoT?w?mnO??i", iMaxLength=9 | out: lpString1="?BZp????") returned="?BZp????" [0099.006] lstrlenA (lpString="?BZp????") returned 8 [0099.006] lstrlenA (lpString="??K?tu??ys??Wcw?s?b?????b???????BKuR?D?Z?N??h??g?R?M?eygg?As?") returned 61 [0099.007] lstrcpynA (in: lpString1=0x499094, lpString2="??K?tu??ys??Wcw?s?b?????b???????BKuR?D?Z?N??h??g?R?M?eygg?As?", iMaxLength=3 | out: lpString1="??") returned="??" [0099.007] lstrlenA (lpString="??") returned 2 [0099.007] lstrlenA (lpString="?F?h?????okk????????n?CD?hAr??XM??Cjf?g?b?z???") returned 46 [0099.007] lstrcpynA (in: lpString1=0x4990a4, lpString2="?F?h?????okk????????n?CD?hAr??XM??Cjf?g?b?z???", iMaxLength=9 | out: lpString1="?F?h????") returned="?F?h????" [0099.007] lstrlenA (lpString="?F?h????") returned 8 [0099.007] lstrlenA (lpString="?GCfT???n?F??") returned 13 [0099.007] lstrcpynA (in: lpString1=0x4990c4, lpString2="?GCfT???n?F??", iMaxLength=11 | out: lpString1="?GCfT???n?") returned="?GCfT???n?" [0099.007] lstrlenA (lpString="?GCfT???n?") returned 10 [0099.007] lstrlenA (lpString="?P?????????N???M??itCn?n???U??IIvH???Y??BS???fR??Af???QT?XI?s?F") returned 63 [0099.007] lstrcpynA (in: lpString1=0x499094, lpString2="?P?????????N???M??itCn?n???U??IIvH???Y??BS???fR??Af???QT?XI?s?F", iMaxLength=41 | out: lpString1="?P?????????N???M??itCn?n???U??IIvH???Y??") returned="?P?????????N???M??itCn?n???U??IIvH???Y??" [0099.007] lstrlenA (lpString="?P?????????N???M??itCn?n???U??IIvH???Y??") returned 40 [0099.007] lstrlenA (lpString="?n????O?s??????Bk?L??h???") returned 25 [0099.007] lstrcpynA (in: lpString1=0x4990b8, lpString2="?n????O?s??????Bk?L??h???", iMaxLength=24 | out: lpString1="?n????O?s??????Bk?L??h?") returned="?n????O?s??????Bk?L??h?" [0099.007] lstrlenA (lpString="?n????O?s??????Bk?L??h?") returned 23 [0099.007] lstrlenA (lpString="?sFI??????VDph????xPIv?x????w?????fJ????P?Pg?GB??g?z?LN?xz?gc???g??br?Fb") returned 72 [0099.007] lstrcpynA (in: lpString1=0x499088, lpString2="?sFI??????VDph????xPIv?x????w?????fJ????P?Pg?GB??g?z?LN?xz?gc???g??br?Fb", iMaxLength=17 | out: lpString1="?sFI??????VDph??") returned="?sFI??????VDph??" [0099.007] lstrlenA (lpString="?sFI??????VDph??") returned 16 [0099.007] lstrlenA (lpString="??nxS?o??GkE?AvA?????DwO?W?Q???AL??K?????rt?????Tt????n????s??fnV???X?Ja?e??PW?") returned 79 [0099.007] lstrcpynA (in: lpString1=0x499084, lpString2="??nxS?o??GkE?AvA?????DwO?W?Q???AL??K?????rt?????Tt????n????s??fnV???X?Ja?e??PW?", iMaxLength=13 | out: lpString1="??nxS?o??GkE") returned="??nxS?o??GkE" [0099.007] lstrlenA (lpString="??nxS?o??GkE") returned 12 [0099.007] lstrlenA (lpString="?Wv??MH?tp?b???H???S??Ni???T?zK?E?H?Wd?JuEDw??????u????s?hxU?dw??f????h???UnGBp?????g?yPLYcd???") returned 95 [0099.007] lstrcpynA (in: lpString1=0x499074, lpString2="?Wv??MH?tp?b???H???S??Ni???T?zK?E?H?Wd?JuEDw??????u????s?hxU?dw??f????h???UnGBp?????g?yPLYcd???", iMaxLength=89 | out: lpString1="?Wv??MH?tp?b???H???S??Ni???T?zK?E?H?Wd?JuEDw??????u????s?hxU?dw??f????h???UnGBp?????g?yP") returned="?Wv??MH?tp?b???H???S??Ni???T?zK?E?H?Wd?JuEDw??????u????s?hxU?dw??f????h???UnGBp?????g?yP" [0099.007] lstrlenA (lpString="?Wv??MH?tp?b???H???S??Ni???T?zK?E?H?Wd?JuEDw??????u????s?hxU?dw??f????h???UnGBp?????g?yP") returned 88 [0099.007] lstrlenA (lpString="??ea??????A?LiV??SS??p??P?r??eD") returned 31 [0099.007] lstrcpynA (in: lpString1=0x4990b4, lpString2="??ea??????A?LiV??SS??p??P?r??eD", iMaxLength=30 | out: lpString1="??ea??????A?LiV??SS??p??P?r??") returned="??ea??????A?LiV??SS??p??P?r??" [0099.007] lstrlenA (lpString="??ea??????A?LiV??SS??p??P?r??") returned 29 [0099.008] lstrlenA (lpString="???z???u?p??y?o????B") returned 20 [0099.008] lstrcpynA (in: lpString1=0x4990bc, lpString2="???z???u?p??y?o????B", iMaxLength=16 | out: lpString1="???z???u?p??y?o") returned="???z???u?p??y?o" [0099.008] lstrlenA (lpString="???z???u?p??y?o") returned 15 [0099.008] lstrlenA (lpString="?????HF?T????zLd?rt????j?T?iv?X?mjmm?tpU???ced??????x?wo?????U???????xW????gF?") returned 78 [0099.008] lstrcpynA (in: lpString1=0x499084, lpString2="?????HF?T????zLd?rt????j?T?iv?X?mjmm?tpU???ced??????x?wo?????U???????xW????gF?", iMaxLength=9 | out: lpString1="?????HF?") returned="?????HF?" [0099.008] lstrlenA (lpString="?????HF?") returned 8 [0099.008] lstrlenA (lpString="??W??Ojk?nuJ?????nGd?JK") returned 23 [0099.008] lstrcpynA (in: lpString1=0x4990bc, lpString2="??W??Ojk?nuJ?????nGd?JK", iMaxLength=12 | out: lpString1="??W??Ojk?nu") returned="??W??Ojk?nu" [0099.008] lstrlenA (lpString="??W??Ojk?nu") returned 11 [0099.008] lstrlenA (lpString="????xDB?aF?I??") returned 14 [0099.008] lstrcpynA (in: lpString1=0x4990c4, lpString2="????xDB?aF?I??", iMaxLength=11 | out: lpString1="????xDB?aF") returned="????xDB?aF" [0099.008] lstrlenA (lpString="????xDB?aF") returned 10 [0099.008] lstrlenA (lpString="?hAgJa??P?xm??flRB???tb?????????G?EO??J???t????ucPLLbK????n?n??????e??D?i?tvw?ku????sF?") returned 87 [0099.008] lstrcpynA (in: lpString1=0x49907c, lpString2="?hAgJa??P?xm??flRB???tb?????????G?EO??J???t????ucPLLbK????n?n??????e??D?i?tvw?ku????sF?", iMaxLength=85 | out: lpString1="?hAgJa??P?xm??flRB???tb?????????G?EO??J???t????ucPLLbK????n?n??????e??D?i?tvw?ku????") returned="?hAgJa??P?xm??flRB???tb?????????G?EO??J???t????ucPLLbK????n?n??????e??D?i?tvw?ku????" [0099.008] lstrlenA (lpString="?hAgJa??P?xm??flRB???tb?????????G?EO??J???t????ucPLLbK????n?n??????e??D?i?tvw?ku????") returned 84 [0099.008] lstrlenA (lpString="W????fn?i???J??D?G????l?KYw??i?G??s?") returned 36 [0099.008] lstrcpynA (in: lpString1=0x4990ac, lpString2="W????fn?i???J??D?G????l?KYw??i?G??s?", iMaxLength=15 | out: lpString1="W????fn?i???J?") returned="W????fn?i???J?" [0099.008] lstrlenA (lpString="W????fn?i???J?") returned 14 [0099.008] lstrlenA (lpString="??auHGL?") returned 8 [0099.008] lstrcpynA (in: lpString1=0x4990c4, lpString2="??auHGL?", iMaxLength=2 | out: lpString1="?") returned="?" [0099.008] lstrlenA (lpString="?") returned 1 [0099.008] lstrlenA (lpString="?j??C?IKf?o?fP??????????KfZt?X??jR???A???r?G?a?i???EsX?jXQVP?R??") returned 64 [0099.008] lstrcpynA (in: lpString1=0x499090, lpString2="?j??C?IKf?o?fP??????????KfZt?X??jR???A???r?G?a?i???EsX?jXQVP?R??", iMaxLength=59 | out: lpString1="?j??C?IKf?o?fP??????????KfZt?X??jR???A???r?G?a?i???EsX?jXQ") returned="?j??C?IKf?o?fP??????????KfZt?X??jR???A???r?G?a?i???EsX?jXQ" [0099.008] lstrlenA (lpString="?j??C?IKf?o?fP??????????KfZt?X??jR???A???r?G?a?i???EsX?jXQ") returned 58 [0099.008] lstrlenA (lpString="??H?NC???C?IzFDV?P???FFD?W???RVImaW?hl????K?Whjc?pu??hA??t?bCSL???paf?O???j??Hs?d???b?") returned 86 [0099.009] lstrcpynA (in: lpString1=0x49907c, lpString2="??H?NC???C?IzFDV?P???FFD?W???RVImaW?hl????K?Whjc?pu??hA??t?bCSL???paf?O???j??Hs?d???b?", iMaxLength=36 | out: lpString1="??H?NC???C?IzFDV?P???FFD?W???RVImaW") returned="??H?NC???C?IzFDV?P???FFD?W???RVImaW" [0099.009] lstrlenA (lpString="??H?NC???C?IzFDV?P???FFD?W???RVImaW") returned 35 [0099.009] lstrlenA (lpString="Rs??IIX???iupV??j????m??d???DnO?SJYby???ZgH??u?k???NsEWyl???????Wp??l??RVk") returned 74 [0099.009] lstrcpynA (in: lpString1=0x499088, lpString2="Rs??IIX???iupV??j????m??d???DnO?SJYby???ZgH??u?k???NsEWyl???????Wp??l??RVk", iMaxLength=12 | out: lpString1="Rs??IIX???i") returned="Rs??IIX???i" [0099.009] lstrlenA (lpString="Rs??IIX???i") returned 11 [0099.009] lstrlenA (lpString="bu??E????ahQu?Z?F???G?Sr?slCr?a?x?K??") returned 37 [0099.009] lstrcpynA (in: lpString1=0x4990ac, lpString2="bu??E????ahQu?Z?F???G?Sr?slCr?a?x?K??", iMaxLength=33 | out: lpString1="bu??E????ahQu?Z?F???G?Sr?slCr?a?") returned="bu??E????ahQu?Z?F???G?Sr?slCr?a?" [0099.009] lstrlenA (lpString="bu??E????ahQu?Z?F???G?Sr?slCr?a?") returned 32 [0099.009] lstrlenA (lpString="Jv????y???R?Pt????l?l???") returned 24 [0099.009] lstrcpynA (in: lpString1=0x4990b8, lpString2="Jv????y???R?Pt????l?l???", iMaxLength=7 | out: lpString1="Jv????") returned="Jv????" [0099.009] lstrlenA (lpString="Jv????") returned 6 [0099.009] lstrlenA (lpString="?oN??D???M") returned 10 [0099.009] lstrcpynA (in: lpString1=0x4990c4, lpString2="?oN??D???M", iMaxLength=1 | out: lpString1="") returned="" [0099.009] lstrlenA (lpString="") returned 0 [0099.009] lstrlenA (lpString="?k?u????wUaGa?T?P?U???L?u?igaX??X?G?lRv?Inil?CE?v?kvYc?") returned 55 [0099.009] lstrcpynA (in: lpString1=0x49909c, lpString2="?k?u????wUaGa?T?P?U???L?u?igaX??X?G?lRv?Inil?CE?v?kvYc?", iMaxLength=3 | out: lpString1="?k") returned="?k" [0099.009] lstrlenA (lpString="?k") returned 2 [0099.009] lstrlenA (lpString="?????????x??u????ZW?????sRLGm?Or?RO?????g??P??s??????IJzf??JDh??????X?ox???c?OW?z???g????h??wsg??UV") returned 99 [0099.009] lstrcpynA (in: lpString1=0x499070, lpString2="?????????x??u????ZW?????sRLGm?Or?RO?????g??P??s??????IJzf??JDh??????X?ox???c?OW?z???g????h??wsg??UV", iMaxLength=25 | out: lpString1="?????????x??u????ZW?????") returned="?????????x??u????ZW?????" [0099.009] lstrlenA (lpString="?????????x??u????ZW?????") returned 24 [0099.009] lstrlenA (lpString="?????Ncv??") returned 10 [0099.009] lstrcpynA (in: lpString1=0x4990c4, lpString2="?????Ncv??", iMaxLength=9 | out: lpString1="?????Ncv") returned="?????Ncv" [0099.009] lstrlenA (lpString="?????Ncv") returned 8 [0099.009] lstrlenA (lpString="yKT?e?YbWx??????????WEV??c???Pu") returned 31 [0099.009] lstrcpynA (in: lpString1=0x4990b4, lpString2="yKT?e?YbWx??????????WEV??c???Pu", iMaxLength=27 | out: lpString1="yKT?e?YbWx??????????WEV??c") returned="yKT?e?YbWx??????????WEV??c" [0099.009] lstrlenA (lpString="yKT?e?YbWx??????????WEV??c") returned 26 [0099.010] lstrlenA (lpString="?zI?K?XQ??p?????QS?p??HW?nDO?g?wc????????r?y????????w????uex?fOB?pZ??") returned 69 [0099.010] lstrcpynA (in: lpString1=0x49908c, lpString2="?zI?K?XQ??p?????QS?p??HW?nDO?g?wc????????r?y????????w????uex?fOB?pZ??", iMaxLength=16 | out: lpString1="?zI?K?XQ??p????") returned="?zI?K?XQ??p????" [0099.010] lstrlenA (lpString="?zI?K?XQ??p????") returned 15 [0099.010] lstrlenA (lpString="?E?aS?Wm?ScOZ???????F????j?We?????PLg???????fh?p?f?Dm??T?u?c?wna?I???v?wClaL???D?") returned 81 [0099.010] lstrcpynA (in: lpString1=0x499080, lpString2="?E?aS?Wm?ScOZ???????F????j?We?????PLg???????fh?p?f?Dm??T?u?c?wna?I???v?wClaL???D?", iMaxLength=42 | out: lpString1="?E?aS?Wm?ScOZ???????F????j?We?????PLg????") returned="?E?aS?Wm?ScOZ???????F????j?We?????PLg????" [0099.010] lstrlenA (lpString="?E?aS?Wm?ScOZ???????F????j?We?????PLg????") returned 41 [0099.010] lstrlenA (lpString="B?wUy?pQS????n?S?L?J??oXf??NP???Ojz??J?S??s?P?T??e?k??k???z?A???pc?BuQ???D?t?Nd?v??O?A?????nbiw") returned 95 [0099.010] lstrcpynA (in: lpString1=0x499074, lpString2="B?wUy?pQS????n?S?L?J??oXf??NP???Ojz??J?S??s?P?T??e?k??k???z?A???pc?BuQ???D?t?Nd?v??O?A?????nbiw", iMaxLength=3 | out: lpString1="B?") returned="B?" [0099.010] lstrlenA (lpString="B?") returned 2 [0099.010] lstrlenA (lpString="gz????nVM?f?v??C?w???G?NZWAD?D?x???DHho???X????????rWM?") returned 55 [0099.010] lstrcpynA (in: lpString1=0x49909c, lpString2="gz????nVM?f?v??C?w???G?NZWAD?D?x???DHho???X????????rWM?", iMaxLength=42 | out: lpString1="gz????nVM?f?v??C?w???G?NZWAD?D?x???DHho??") returned="gz????nVM?f?v??C?w???G?NZWAD?D?x???DHho??" [0099.010] lstrlenA (lpString="gz????nVM?f?v??C?w???G?NZWAD?D?x???DHho??") returned 41 [0099.010] lstrlenA (lpString="Gv??gn?cA?HiK??T????CB??r???usm") returned 31 [0099.010] lstrcpynA (in: lpString1=0x4990b4, lpString2="Gv??gn?cA?HiK??T????CB??r???usm", iMaxLength=27 | out: lpString1="Gv??gn?cA?HiK??T????CB??r?") returned="Gv??gn?cA?HiK??T????CB??r?" [0099.010] lstrlenA (lpString="Gv??gn?cA?HiK??T????CB??r?") returned 26 [0099.010] lstrlenA (lpString="??kI????xx?jaZc???????i?P??jQS?d?WW???z?????B????vZIf??y?B?d??I?????l?x") returned 71 [0099.010] lstrcpynA (in: lpString1=0x49908c, lpString2="??kI????xx?jaZc???????i?P??jQS?d?WW???z?????B????vZIf??y?B?d??I?????l?x", iMaxLength=11 | out: lpString1="??kI????xx") returned="??kI????xx" [0099.010] lstrlenA (lpString="??kI????xx") returned 10 [0099.010] lstrlenA (lpString="wgVP?rMYt?v??Mv?S?i??????s?CxrW") returned 31 [0099.010] lstrcpynA (in: lpString1=0x4990b4, lpString2="wgVP?rMYt?v??Mv?S?i??????s?CxrW", iMaxLength=26 | out: lpString1="wgVP?rMYt?v??Mv?S?i??????") returned="wgVP?rMYt?v??Mv?S?i??????" [0099.010] lstrlenA (lpString="wgVP?rMYt?v??Mv?S?i??????") returned 25 [0099.010] lstrlenA (lpString="?PgHa?CR????V????Z?ZK??K?Syse?Hfy?Y?nF?x?X?NVlOMTx??SQVC?????AEQzC?????hCZ???y") returned 78 [0099.010] lstrcpynA (in: lpString1=0x499084, lpString2="?PgHa?CR????V????Z?ZK??K?Syse?Hfy?Y?nF?x?X?NVlOMTx??SQVC?????AEQzC?????hCZ???y", iMaxLength=74 | out: lpString1="?PgHa?CR????V????Z?ZK??K?Syse?Hfy?Y?nF?x?X?NVlOMTx??SQVC?????AEQzC?????hC") returned="?PgHa?CR????V????Z?ZK??K?Syse?Hfy?Y?nF?x?X?NVlOMTx??SQVC?????AEQzC?????hC" [0099.011] lstrlenA (lpString="?PgHa?CR????V????Z?ZK??K?Syse?Hfy?Y?nF?x?X?NVlOMTx??SQVC?????AEQzC?????hC") returned 73 [0099.011] lstrlenA (lpString="??????R????m?mz?UeR?????y?HM???M???XOT?a???v?b???X??h??ySO???") returned 61 [0099.011] lstrcpynA (in: lpString1=0x499094, lpString2="??????R????m?mz?UeR?????y?HM???M???XOT?a???v?b???X??h??ySO???", iMaxLength=49 | out: lpString1="??????R????m?mz?UeR?????y?HM???M???XOT?a???v?b??") returned="??????R????m?mz?UeR?????y?HM???M???XOT?a???v?b??" [0099.011] lstrlenA (lpString="??????R????m?mz?UeR?????y?HM???M???XOT?a???v?b??") returned 48 [0099.011] lstrlenA (lpString="p????lrCxe??Ft?T??zt?SW?NpwX??????????iE?????u?Tr??bk???E?S?l???SJt") returned 67 [0099.011] lstrcpynA (in: lpString1=0x499090, lpString2="p????lrCxe??Ft?T??zt?SW?NpwX??????????iE?????u?Tr??bk???E?S?l???SJt", iMaxLength=54 | out: lpString1="p????lrCxe??Ft?T??zt?SW?NpwX??????????iE?????u?Tr??bk") returned="p????lrCxe??Ft?T??zt?SW?NpwX??????????iE?????u?Tr??bk" [0099.011] lstrcpynA (in: lpString1=0x4990a4, lpString2="???OOH?eLs?Kg??Xk?????Ksg?Vx?ez??z??W??C????V", iMaxLength=12 | out: lpString1="???OOH?eLs?") returned="???OOH?eLs?" [0099.011] lstrcpynA (in: lpString1=0x499080, lpString2="??j???Qb?xB??CK??????x?kK?y????D?K?htiR???CJg?????M?????Y?G???BlAdmm?E??WDxN?Yr?", iMaxLength=6 | out: lpString1="??j??") returned="??j??" [0099.011] lstrcpynA (in: lpString1=0x4990c4, lpString2="Ea??N??t??j", iMaxLength=2 | out: lpString1="E") returned="E" [0099.011] lstrcpynA (in: lpString1=0x4990c4, lpString2="rT??D", iMaxLength=4 | out: lpString1="rT?") returned="rT?" [0099.011] lstrcpynA (in: lpString1=0x4990b8, lpString2="??yw?????A?WKI??L?n?brC?mw?", iMaxLength=10 | out: lpString1="??yw?????") returned="??yw?????" [0099.011] lstrcpynA (in: lpString1=0x4990b0, lpString2="???S???iY?m??G???????S?p?s????Qy??", iMaxLength=7 | out: lpString1="???S??") returned="???S??" [0099.011] lstrcpynA (in: lpString1=0x499070, lpString2="?z?????K?xZG??k??C?X??Ypa??x??lh?wp?MaLYsWCHX?h?????a?Tw????????rY??L?HKtHP?M???G?U?QJyE?o??G?ZI", iMaxLength=70 | out: lpString1="?z?????K?xZG??k??C?X??Ypa??x??lh?wp?MaLYsWCHX?h?????a?Tw????????rY??L") returned="?z?????K?xZG??k??C?X??Ypa??x??lh?wp?MaLYsWCHX?h?????a?Tw????????rY??L" [0099.011] lstrcpynA (in: lpString1=0x4990c4, lpString2="y?ZG?l??m????I", iMaxLength=2 | out: lpString1="y") returned="y" [0099.011] lstrcpynA (in: lpString1=0x499098, lpString2="??WH?S?Jrh?e????V???Ip?At???mo???l?????p?Th??br?NE?RU?P?o?S", iMaxLength=55 | out: lpString1="??WH?S?Jrh?e????V???Ip?At???mo???l?????p?Th??br?NE?RU?") returned="??WH?S?Jrh?e????V???Ip?At???mo???l?????p?Th??br?NE?RU?" [0099.011] lstrcpynA (in: lpString1=0x4990c4, lpString2="?H?Y?T???F??t??", iMaxLength=8 | out: lpString1="?H?Y?T?") returned="?H?Y?T?" [0099.011] lstrcpynA (in: lpString1=0x499078, lpString2="T?b?Ql?p??K?RYfzOO?VF??j??hU?fL????z??Rf?cU?J?On???T????Zi??r?K????SF?X?u??zY??c??H?Mg?BK", iMaxLength=19 | out: lpString1="T?b?Ql?p??K?RYfzOO") returned="T?b?Ql?p??K?RYfzOO" [0099.011] lstrcpynA (in: lpString1=0x4990bc, lpString2="?ac??u?s???Zbnp?C?MIM", iMaxLength=1 | out: lpString1="") returned="" [0099.011] lstrcpynA (in: lpString1=0x4990a4, lpString2="o?AQ?hz?YI??H??Os?uL?R?????GB????J??x?r?????F", iMaxLength=18 | out: lpString1="o?AQ?hz?YI??H??Os") returned="o?AQ?hz?YI??H??Os" [0099.011] lstrcpynA (in: lpString1=0x49909c, lpString2="?G?i???????K?Y??????DhQ?O??S?xj???NBv?dM??JcyL?MMJ??olQ", iMaxLength=47 | out: lpString1="?G?i???????K?Y??????DhQ?O??S?xj???NBv?dM??JcyL") returned="?G?i???????K?Y??????DhQ?O??S?xj???NBv?dM??JcyL" [0099.012] lstrcpynA (in: lpString1=0x499084, lpString2="Is????p?t?oK?M??F?uB??Z???U????Adz?HJB??????K??B?Q?dp??????uUW??U?U??b??yV?g", iMaxLength=47 | out: lpString1="Is????p?t?oK?M??F?uB??Z???U????Adz?HJB??????K?") returned="Is????p?t?oK?M??F?uB??Z???U????Adz?HJB??????K?" [0099.012] lstrcpynA (in: lpString1=0x499090, lpString2="??DV??WMAg????H???F??o?D??o?b?a?jAnB??????K???MKi?Yj????yw??X?R?", iMaxLength=3 | out: lpString1="??") returned="??" [0099.012] lstrcpynA (in: lpString1=0x4990c0, lpString2="???S??p??A???????", iMaxLength=16 | out: lpString1="???S??p??A?????") returned="???S??p??A?????" [0099.012] lstrcpynA (in: lpString1=0x4990a8, lpString2="BL??pV?????RU?h??B??rs?Q?x???daIG?u????f", iMaxLength=5 | out: lpString1="BL??") returned="BL??" [0099.012] lstrcpynA (in: lpString1=0x499080, lpString2="??Y??????MLD?????w??L??????Z????v?EC???n????X??T??Xf?m???????k????k?MCw???g???dj???", iMaxLength=6 | out: lpString1="??Y??") returned="??Y??" [0099.012] lstrcpynA (in: lpString1=0x4990bc, lpString2="?M??j???N?ic??z?G????", iMaxLength=2 | out: lpString1="?") returned="?" [0099.012] lstrcpynA (in: lpString1=0x499090, lpString2="??W???Yl?zP?????e?e??K???OH??A??ps?kH??k?rIB?k?????C?w?PY?rmDVzkU?", iMaxLength=39 | out: lpString1="??W???Yl?zP?????e?e??K???OH??A??ps?kH?") returned="??W???Yl?zP?????e?e??K???OH??A??ps?kH?" [0099.012] lstrcpynA (in: lpString1=0x499088, lpString2="?D????sj????kDB?voEc?????L?kkK?j??s???sinhoU??Y???P?Dm???ii????On?ukW??M", iMaxLength=70 | out: lpString1="?D????sj????kDB?voEc?????L?kkK?j??s???sinhoU??Y???P?Dm???ii????On?ukW") returned="?D????sj????kDB?voEc?????L?kkK?j??s???sinhoU??Y???P?Dm???ii????On?ukW" [0099.012] lstrcpynA (in: lpString1=0x499088, lpString2="?Xd?gtBHoe?Ezz????jYj?ok?g?????kRaJY?oV???Qv???p?I?By???D?Q?N?Vn???p????kR?", iMaxLength=37 | out: lpString1="?Xd?gtBHoe?Ezz????jYj?ok?g?????kRaJY") returned="?Xd?gtBHoe?Ezz????jYj?ok?g?????kRaJY" [0099.012] lstrcpynA (in: lpString1=0x4990a0, lpString2="?j???gjf????w?B??Wr?w??US?fU??gR??Y????aD???E???", iMaxLength=34 | out: lpString1="?j???gjf????w?B??Wr?w??US?fU??gR?") returned="?j???gjf????w?B??Wr?w??US?fU??gR?" [0099.013] lstrcmpiA (lpString1="w?xTueaEY??lYS??d?GY????B??m??av?DsY36", lpString2="P?M?Y??DC??11") returned 1 [0099.013] lstrcmpiA (lpString1="P?M?Y??DC??11", lpString2="n???m?bQ??H11") returned 1 [0099.013] lstrcmpiA (lpString1="n???m?bQ??H11", lpString2="?1") returned 1 [0099.013] lstrcmpiA (lpString1="?1", lpString2="N??EE??r??L????W16") returned -1 [0099.013] lstrcmpiA (lpString1="N??EE??r??L????W16", lpString2="z?s??zM?Qk???nI?Ph?tZ?22") returned -1 [0099.013] lstrcmpiA (lpString1="z?s??zM?Qk???nI?Ph?tZ?22", lpString2="E?r3") returned 1 [0099.013] lstrcmpiA (lpString1="E?r3", lpString2="??2") returned 1 [0099.013] lstrcmpiA (lpString1="??2", lpString2="0") returned -1 [0099.013] lstrcmpiA (lpString1="0", lpString2="X?ly?QI?v?ZOA???T??sc??jSU???B??HA?35") returned -1 [0099.013] lstrcmpiA (lpString1="X?ly?QI?v?ZOA???T??sc??jSU???B??HA?35", lpString2="QQ?QJ??wp9") returned 1 [0099.013] lstrcmpiA (lpString1="QQ?QJ??wp9", lpString2="?1") returned 1 [0099.013] lstrcmpiA (lpString1="?1", lpString2="ilo???cR?bI??tp?Y??G20") returned -1 [0099.013] lstrcmpiA (lpString1="ilo???cR?bI??tp?Y??G20", lpString2="bSs?l??z?QIr??c?F?TR?KVbl???p?CDnSsJBz???P?h??Vw?F?t?HA????Qd?a?????M?pc72") returned 1 [0099.013] lstrcmpiA (lpString1="bSs?l??z?QIr??c?F?TR?KVbl???p?CDnSsJBz???P?h??Vw?F?t?HA????Qd?a?????M?pc72", lpString2="?M??um?A?i???T?mP?tv??M???G?MP??xK??f?Bo??42") returned 1 [0099.014] lstrcmpiA (lpString1="?M??um?A?i???T?mP?tv??M???G?MP??xK??f?Bo??42", lpString2="zJ??p?uwwmF????a?X???d???G??mf???sI?w?s?40") returned -1 [0099.014] lstrcmpiA (lpString1="zJ??p?uwwmF????a?X???d???G??mf???sI?w?s?40", lpString2="u1") returned 1 [0099.014] lstrcmpiA (lpString1="u1", lpString2="??oPlEE?I??????JO?????p?????28") returned 1 [0099.014] lstrcmpiA (lpString1="??oPlEE?I??????JO?????p?????28", lpString2="l?Ovxx?7") returned -1 [0099.014] lstrcmpiA (lpString1="l?Ovxx?7", lpString2="??????OJ?W?u?a?F?Pj?Mav?aDG????Q?33") returned 1 [0099.014] lstrcmpiA (lpString1="??????OJ?W?u?a?F?Pj?Mav?aDG????Q?33", lpString2="?a?3") returned -1 [0099.014] lstrcmpiA (lpString1="?a?3", lpString2="E??k?E?I?i??c?14") returned -1 [0099.014] lstrcmpiA (lpString1="E??k?E?I?i??c?14", lpString2="????fY???????13") returned 1 [0099.014] lstrcmpiA (lpString1="????fY???????13", lpString2="sS?3") returned -1 [0099.014] lstrcmpiA (lpString1="sS?3", lpString2="??2") returned 1 [0099.014] lstrcmpiA (lpString1="??2", lpString2="0") returned -1 [0099.014] lstrcmpiA (lpString1="0", lpString2="tSRMN??Nbw?b??M????x????Uu???Z??r??p?j?39") returned -1 [0099.014] lstrcmpiA (lpString1="tSRMN??Nbw?b??M????x????Uu???Z??r??p?j?39", lpString2="0") returned 1 [0099.014] lstrcmpiA (lpString1="0", lpString2="????xL????S?c??J?17") returned 1 [0099.014] lstrcmpiA (lpString1="????xL????S?c??J?17", lpString2="Vc2") returned -1 [0099.014] lstrcmpiA (lpString1="Vc2", lpString2="0") returned 1 [0099.014] lstrcmpiA (lpString1="0", lpString2="0") returned 0 [0099.014] lstrcmpiA (lpString1="0", lpString2="????tQ?7") returned 1 [0099.014] lstrcmpiA (lpString1="????tQ?7", lpString2="enjFt5") returned -1 [0099.014] lstrcmpiA (lpString1="enjFt5", lpString2="GM??G???ZR?gL?GDE??F?????d?B?pYsIE??b??39") returned -1 [0099.014] lstrcmpiA (lpString1="GM??G???ZR?gL?GDE??F?????d?B?pYsIE??b??39", lpString2="?s?U?gudbe?????D??R?bA???s?MG????K??????40") returned 1 [0099.014] lstrcmpiA (lpString1="?s?U?gudbe?????D??R?bA???s?MG????K??????40", lpString2="?OB??M?c?9") returned 1 [0099.014] lstrcmpiA (lpString1="?OB??M?c?9", lpString2="???yhH?E8") returned 1 [0099.014] lstrcmpiA (lpString1="???yhH?E8", lpString2="Vc?Yo?6") returned -1 [0099.014] lstrcmpiA (lpString1="Vc?Yo?6", lpString2="???m?R?bROYnb???UZ?m?JO????wu?Q?Q33") returned 1 [0099.014] lstrcmpiA (lpString1="???m?R?bROYnb???UZ?m?JO????wu?Q?Q33", lpString2="0") returned -1 [0099.014] lstrcmpiA (lpString1="0", lpString2="e???GTwn?oJR?g?p?x?P??Af?B????B??d?Xi????lEx???yW?w51") returned -1 [0099.014] lstrcmpiA (lpString1="e???GTwn?oJR?g?p?x?P??Af?B????B??d?Xi????lEx???yW?w51", lpString2="???n????PT?WI????Wt?v?c?????K?h??J34") returned 1 [0099.014] lstrcmpiA (lpString1="???n????PT?WI????Wt?v?c?????K?h??J34", lpString2="m???Bc?FF9") returned -1 [0099.014] lstrcmpiA (lpString1="m???Bc?FF9", lpString2="???H?????u???RI??jj19") returned 1 [0099.014] lstrcmpiA (lpString1="???H?????u???RI??jj19", lpString2="??S???CNX?W?p??s?E??Nj?e????v???KD???i38") returned -1 [0099.014] lstrcmpiA (lpString1="??S???CNX?W?p??s?E??Nj?e????v???KD???i38", lpString2="??????e?ZP????E?E?d???22") returned 1 [0099.014] lstrcmpiA (lpString1="??????e?ZP????E?E?d???22", lpString2="?ibe?????L?VM?M?G?????22") returned -1 [0099.015] lstrcmpiA (lpString1="?ibe?????L?VM?M?G?????22", lpString2="jAQ?BM??s?????L?x????kg?P?v??d??Y??wD?uIyBS?????eo????G?b???TM????D?BL?71") returned -1 [0099.015] lstrcmpiA (lpString1="jAQ?BM??s?????L?x????kg?P?v??d??Y??wD?uIyBS?????eo????G?b???TM????D?BL?71", lpString2="t??D?Ej?f?XJ?jTm16") returned -1 [0099.015] lstrcmpiA (lpString1="t??D?Ej?f?XJ?jTm16", lpString2="?1") returned 1 [0099.015] lstrcmpiA (lpString1="?1", lpString2="?M??b???ozTShAV????19") returned -1 [0099.015] lstrcmpiA (lpString1="?M??b???ozTShAV????19", lpString2="???c??u??n??H???v?18") returned 1 [0099.015] lstrcmpiA (lpString1="???c??u??n??H???v?18", lpString2="A????????Qt??cdubH??Wxt?R?b??ux??o?35") returned -1 [0099.015] lstrcmpiA (lpString1="A????????Qt??cdubH??Wxt?R?b??ux??o?35", lpString2="TM?????I?xxk?u???h??u?22") returned -1 [0099.015] lstrcmpiA (lpString1="TM?????I?xxk?u???h??u?22", lpString2="???p??N??s10") returned 1 [0099.015] lstrcmpiA (lpString1="???p??N??s10", lpString2="?v?s?d?Ll9") returned -1 [0099.015] lstrcmpiA (lpString1="?v?s?d?Ll9", lpString2="x1") returned -1 [0099.015] lstrcmpiA (lpString1="x1", lpString2="?t???u6") returned 1 [0099.015] lstrcmpiA (lpString1="?t???u6", lpString2="A1") returned -1 [0099.015] lstrcmpiA (lpString1="A1", lpString2="?x??x????vpCVL????KH????Y??x?29") returned 1 [0099.015] lstrcmpiA (lpString1="?x??x????vpCVL????KH????Y??x?29", lpString2="?yS?U?fvaUS???Sr??L?????????????h???36") returned -1 [0099.015] lstrcmpiA (lpString1="?yS?U?fvaUS???Sr??L?????????????h???36", lpString2="???Gx???pA????????cc?u?VIm?c28") returned 1 [0099.015] lstrcmpiA (lpString1="???Gx???pA????????cc?u?VIm?c28", lpString2="??Y??h??8") returned -1 [0099.015] lstrcmpiA (lpString1="??Y??h??8", lpString2="??dzh5") returned 1 [0099.015] lstrcmpiA (lpString1="??dzh5", lpString2="iL?Tg??7") returned -1 [0099.015] lstrcmpiA (lpString1="iL?Tg??7", lpString2="??ksQ?bwRSK??G?15") returned 1 [0099.015] lstrcmpiA (lpString1="??ksQ?bwRSK??G?15", lpString2="??Ei?IhgGh????14") returned 1 [0099.015] lstrcmpiA (lpString1="??Ei?IhgGh????14", lpString2="??S?Q?z?WR?EL?K??17") returned -1 [0099.015] lstrcmpiA (lpString1="??S?Q?z?WR?EL?K??17", lpString2="???ky?c?WT?WM?E??J?EK?N?????28") returned 1 [0099.015] lstrcmpiA (lpString1="???ky?c?WT?WM?E??J?EK?N?????28", lpString2="V???????nzK11") returned -1 [0099.015] lstrcmpiA (lpString1="V???????nzK11", lpString2="?Us??h??cn???13") returned 1 [0099.015] lstrcmpiA (lpString1="?Us??h??cn???13", lpString2="??zsMpB??PiD?J?JZ17") returned 1 [0099.015] lstrcmpiA (lpString1="??zsMpB??PiD?J?JZ17", lpString2="?x?h??Y?A??Tdc?Z?17") returned -1 [0099.015] lstrcmpiA (lpString1="?x?h??Y?A??Tdc?Z?17", lpString2="0") returned -1 [0099.015] lstrcmpiA (lpString1="0", lpString2="??X??MevMc??12") returned 1 [0099.015] lstrcmpiA (lpString1="??X??MevMc??12", lpString2="?1") returned -1 [0099.015] lstrcmpiA (lpString1="?1", lpString2="yz??Ic?vD??????U???????ciiE?NaW??nA?pIljibuQLn?Re??RQ??a???Q?j?RE?y67") returned -1 [0099.015] lstrcmpiA (lpString1="yz??Ic?vD??????U???????ciiE?NaW??nA?pIljibuQLn?Re??RQ??a???Q?j?RE?y67", lpString2="?1") returned 1 [0099.015] lstrcmpiA (lpString1="?1", lpString2="z?y3") returned -1 [0099.015] lstrcmpiA (lpString1="z?y3", lpString2="0") returned 1 [0099.016] lstrcmpiA (lpString1="0", lpString2="m??3") returned -1 [0099.016] lstrcmpiA (lpString1="m??3", lpString2="Oijf???J???JVT????Y??E?????z?gMv32") returned -1 [0099.016] lstrcmpiA (lpString1="Oijf???J???JVT????Y??E?????z?gMv32", lpString2="??KiR5") returned 1 [0099.016] lstrcmpiA (lpString1="??KiR5", lpString2="dFvQ?Tt????j?k?aCtDrZ???24") returned -1 [0099.016] lstrcmpiA (lpString1="dFvQ?Tt????j?k?aCtDrZ???24", lpString2="h?dm????R9") returned -1 [0099.016] lstrcmpiA (lpString1="h?dm????R9", lpString2="k?a?bd??L??????oT??QbAD?K?mw??W??fPQO?cwBg?Do???G?SF?k??ELjV???Z?w??X???72") returned -1 [0099.016] lstrcmpiA (lpString1="k?a?bd??L??????oT??QbAD?K?mw??W??fPQO?cwBg?Do???G?SF?k??ELjV???Z?w??X???72", lpString2="O??J???????h?HF?o?UZ?????G?RE?n??y????Ub???43") returned -1 [0099.016] lstrcmpiA (lpString1="O??J???????h?HF?o?UZ?????G?RE?n??y????Ub???43", lpString2="?BZp????8") returned 1 [0099.016] lstrcmpiA (lpString1="?BZp????8", lpString2="??2") returned 1 [0099.016] lstrcmpiA (lpString1="??2", lpString2="?F?h????8") returned -1 [0099.016] lstrcmpiA (lpString1="?F?h????8", lpString2="?GCfT???n?10") returned -1 [0099.016] lstrcmpiA (lpString1="?GCfT???n?10", lpString2="?P?????????N???M??itCn?n???U??IIvH???Y??40") returned -1 [0099.016] lstrcmpiA (lpString1="?P?????????N???M??itCn?n???U??IIvH???Y??40", lpString2="?n????O?s??????Bk?L??h?23") returned 1 [0099.016] lstrcmpiA (lpString1="?n????O?s??????Bk?L??h?23", lpString2="?sFI??????VDph??16") returned -1 [0099.016] lstrcmpiA (lpString1="?sFI??????VDph??16", lpString2="??nxS?o??GkE12") returned 1 [0099.016] lstrcmpiA (lpString1="??nxS?o??GkE12", lpString2="?Wv??MH?tp?b???H???S??Ni???T?zK?E?H?Wd?JuEDw??????u????s?hxU?dw??f????h???UnGBp?????g?yP88") returned -1 [0099.016] lstrcmpiA (lpString1="?Wv??MH?tp?b???H???S??Ni???T?zK?E?H?Wd?JuEDw??????u????s?hxU?dw??f????h???UnGBp?????g?yP88", lpString2="??ea??????A?LiV??SS??p??P?r??29") returned 1 [0099.016] lstrcmpiA (lpString1="??ea??????A?LiV??SS??p??P?r??29", lpString2="???z???u?p??y?o15") returned 1 [0099.016] lstrcmpiA (lpString1="???z???u?p??y?o15", lpString2="?????HF?8") returned 1 [0099.016] lstrcmpiA (lpString1="?????HF?8", lpString2="??W??Ojk?nu11") returned -1 [0099.016] lstrcmpiA (lpString1="??W??Ojk?nu11", lpString2="????xDB?aF10") returned 1 [0099.016] lstrcmpiA (lpString1="????xDB?aF10", lpString2="?hAgJa??P?xm??flRB???tb?????????G?EO??J???t????ucPLLbK????n?n??????e??D?i?tvw?ku????84") returned -1 [0099.016] lstrcmpiA (lpString1="?hAgJa??P?xm??flRB???tb?????????G?EO??J???t????ucPLLbK????n?n??????e??D?i?tvw?ku????84", lpString2="W????fn?i???J?14") returned -1 [0099.016] lstrcmpiA (lpString1="W????fn?i???J?14", lpString2="?1") returned 1 [0099.016] lstrcmpiA (lpString1="?1", lpString2="?j??C?IKf?o?fP??????????KfZt?X??jR???A???r?G?a?i???EsX?jXQ58") returned -1 [0099.016] lstrcmpiA (lpString1="?j??C?IKf?o?fP??????????KfZt?X??jR???A???r?G?a?i???EsX?jXQ58", lpString2="??H?NC???C?IzFDV?P???FFD?W???RVImaW35") returned 1 [0099.017] lstrcmpiA (lpString1="??H?NC???C?IzFDV?P???FFD?W???RVImaW35", lpString2="Rs??IIX???i11") returned -1 [0099.017] lstrcmpiA (lpString1="Rs??IIX???i11", lpString2="bu??E????ahQu?Z?F???G?Sr?slCr?a?32") returned 1 [0099.017] lstrcmpiA (lpString1="bu??E????ahQu?Z?F???G?Sr?slCr?a?32", lpString2="Jv????6") returned -1 [0099.017] lstrcmpiA (lpString1="Jv????6", lpString2="0") returned 1 [0099.017] lstrcmpiA (lpString1="0", lpString2="?k2") returned 1 [0099.017] lstrcmpiA (lpString1="?k2", lpString2="?????????x??u????ZW?????24") returned 1 [0099.017] lstrcmpiA (lpString1="?????????x??u????ZW?????24", lpString2="?????Ncv8") returned -1 [0099.017] lstrcmpiA (lpString1="?????Ncv8", lpString2="yKT?e?YbWx??????????WEV??c26") returned -1 [0099.017] lstrcmpiA (lpString1="yKT?e?YbWx??????????WEV??c26", lpString2="?zI?K?XQ??p????15") returned 1 [0099.017] lstrcmpiA (lpString1="?zI?K?XQ??p????15", lpString2="?E?aS?Wm?ScOZ???????F????j?We?????PLg????41") returned 1 [0099.017] lstrcmpiA (lpString1="?E?aS?Wm?ScOZ???????F????j?We?????PLg????41", lpString2="B?2") returned -1 [0099.017] lstrcmpiA (lpString1="B?2", lpString2="gz????nVM?f?v??C?w???G?NZWAD?D?x???DHho??41") returned -1 [0099.017] lstrcmpiA (lpString1="gz????nVM?f?v??C?w???G?NZWAD?D?x???DHho??41", lpString2="Gv??gn?cA?HiK??T????CB??r?26") returned 1 [0099.017] lstrcmpiA (lpString1="Gv??gn?cA?HiK??T????CB??r?26", lpString2="??kI????xx10") returned 1 [0099.017] lstrcmpiA (lpString1="??kI????xx10", lpString2="wgVP?rMYt?v??Mv?S?i??????25") returned -1 [0099.017] lstrcmpiA (lpString1="wgVP?rMYt?v??Mv?S?i??????25", lpString2="?PgHa?CR????V????Z?ZK??K?Syse?Hfy?Y?nF?x?X?NVlOMTx??SQVC?????AEQzC?????hC73") returned 1 [0099.017] lstrcmpiA (lpString1="?PgHa?CR????V????Z?ZK??K?Syse?Hfy?Y?nF?x?X?NVlOMTx??SQVC?????AEQzC?????hC73", lpString2="??????R????m?mz?UeR?????y?HM???M???XOT?a???v?b??48") returned 1 [0099.017] lstrcmpiA (lpString1="??????R????m?mz?UeR?????y?HM???M???XOT?a???v?b??48", lpString2="p????lrCxe??Ft?T??zt?SW?NpwX??????????iE?????u?Tr??bk53") returned -1 [0099.017] lstrcmpiA (lpString1="p????lrCxe??Ft?T??zt?SW?NpwX??????????iE?????u?Tr??bk53", lpString2="???OOH?eLs?11") returned 1 [0099.017] lstrcmpiA (lpString1="???OOH?eLs?11", lpString2="??j??5") returned -1 [0099.017] lstrcmpiA (lpString1="??j??5", lpString2="E1") returned -1 [0099.017] lstrcmpiA (lpString1="E1", lpString2="rT?3") returned -1 [0099.017] lstrcmpiA (lpString1="rT?3", lpString2="??yw?????9") returned 1 [0099.017] lstrcmpiA (lpString1="??yw?????9", lpString2="???S??6") returned 1 [0099.017] lstrcmpiA (lpString1="???S??6", lpString2="?z?????K?xZG??k??C?X??Ypa??x??lh?wp?MaLYsWCHX?h?????a?Tw????????rY??L69") returned -1 [0099.017] lstrcmpiA (lpString1="?z?????K?xZG??k??C?X??Ypa??x??lh?wp?MaLYsWCHX?h?????a?Tw????????rY??L69", lpString2="y1") returned -1 [0099.017] lstrcmpiA (lpString1="y1", lpString2="??WH?S?Jrh?e????V???Ip?At???mo???l?????p?Th??br?NE?RU?54") returned 1 [0099.017] lstrcmpiA (lpString1="??WH?S?Jrh?e????V???Ip?At???mo???l?????p?Th??br?NE?RU?54", lpString2="?H?Y?T?7") returned -1 [0099.017] lstrcmpiA (lpString1="?H?Y?T?7", lpString2="T?b?Ql?p??K?RYfzOO18") returned -1 [0099.017] lstrcmpiA (lpString1="T?b?Ql?p??K?RYfzOO18", lpString2="0") returned 1 [0099.017] lstrcmpiA (lpString1="0", lpString2="o?AQ?hz?YI??H??Os17") returned -1 [0099.017] lstrcmpiA (lpString1="o?AQ?hz?YI??H??Os17", lpString2="?G?i???????K?Y??????DhQ?O??S?xj???NBv?dM??JcyL46") returned 1 [0099.017] lstrcmpiA (lpString1="?G?i???????K?Y??????DhQ?O??S?xj???NBv?dM??JcyL46", lpString2="Is????p?t?oK?M??F?uB??Z???U????Adz?HJB??????K?46") returned -1 [0099.018] lstrcmpiA (lpString1="Is????p?t?oK?M??F?uB??Z???U????Adz?HJB??????K?46", lpString2="??2") returned 1 [0099.018] lstrcmpiA (lpString1="??2", lpString2="???S??p??A?????15") returned 1 [0099.018] lstrcmpiA (lpString1="???S??p??A?????15", lpString2="BL??4") returned -1 [0099.018] lstrcmpiA (lpString1="BL??4", lpString2="??Y??5") returned 1 [0099.018] lstrcmpiA (lpString1="??Y??5", lpString2="?1") returned -1 [0099.018] lstrcmpiA (lpString1="?1", lpString2="??W???Yl?zP?????e?e??K???OH??A??ps?kH?38") returned 1 [0099.018] lstrcmpiA (lpString1="??W???Yl?zP?????e?e??K???OH??A??ps?kH?38", lpString2="?D????sj????kDB?voEc?????L?kkK?j??s???sinhoU??Y???P?Dm???ii????On?ukW69") returned -1 [0099.018] lstrcmpiA (lpString1="?D????sj????kDB?voEc?????L?kkK?j??s???sinhoU??Y???P?Dm???ii????On?ukW69", lpString2="?Xd?gtBHoe?Ezz????jYj?ok?g?????kRaJY36") returned -1 [0099.018] lstrcmpiA (lpString1="?Xd?gtBHoe?Ezz????jYj?ok?g?????kRaJY36", lpString2="?j???gjf????w?B??Wr?w??US?fU??gR?33") returned 1 [0099.018] lstrcmpiA (lpString1="?j???gjf????w?B??Wr?w??US?fU??gR?33", lpString2="?j???gjf????w?B??Wr?w??US?fU??gR?33") returned 0 [0099.019] GetCurrentProcessId () returned 0x9f8 [0099.020] EnumProcessModules (in: hProcess=0x304, lphModule=0x23bd008, cb=0x100, lpcbNeeded=0x497fd0 | out: lphModule=0x23bd008, lpcbNeeded=0x497fd0) returned 1 [0099.020] GetModuleInformation (in: hProcess=0x304, hModule=0x310000, lpmodinfo=0x23bd148, cb=0xc | out: lpmodinfo=0x23bd148*(lpBaseOfDll=0x310000, SizeOfImage=0x3e000, EntryPoint=0x3479ce)) returned 1 [0099.020] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x310000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="unlikexpc.exe") returned 0xd [0099.020] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x310000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\unlikexpc.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\unlikexpc.exe")) returned 0x33 [0099.021] GetModuleInformation (in: hProcess=0x304, hModule=0x77ab0000, lpmodinfo=0x23bf29c, cb=0xc | out: lpmodinfo=0x23bf29c*(lpBaseOfDll=0x77ab0000, SizeOfImage=0x180000, EntryPoint=0x0)) returned 1 [0099.021] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x77ab0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="ntdll.dll") returned 0x9 [0099.021] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x77ab0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll")) returned 0x1d [0099.021] GetModuleInformation (in: hProcess=0x304, hModule=0x754b0000, lpmodinfo=0x23c13a0, cb=0xc | out: lpmodinfo=0x23c13a0*(lpBaseOfDll=0x754b0000, SizeOfImage=0x4a000, EntryPoint=0x754b2e54)) returned 1 [0099.021] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x754b0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="MSCOREE.DLL") returned 0xb [0099.021] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x754b0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\MSCOREE.DLL" (normalized: "c:\\windows\\system32\\mscoree.dll")) returned 0x1f [0099.021] GetModuleInformation (in: hProcess=0x304, hModule=0x757c0000, lpmodinfo=0x23c34ac, cb=0xc | out: lpmodinfo=0x23c34ac*(lpBaseOfDll=0x757c0000, SizeOfImage=0x110000, EntryPoint=0x757d32d3)) returned 1 [0099.021] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x757c0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="KERNEL32.dll") returned 0xc [0099.022] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x757c0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\KERNEL32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll")) returned 0x20 [0099.022] GetModuleInformation (in: hProcess=0x304, hModule=0x76260000, lpmodinfo=0x23c55c0, cb=0xc | out: lpmodinfo=0x23c55c0*(lpBaseOfDll=0x76260000, SizeOfImage=0x46000, EntryPoint=0x76267478)) returned 1 [0099.022] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x76260000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="KERNELBASE.dll") returned 0xe [0099.022] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x76260000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\KERNELBASE.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll")) returned 0x22 [0099.022] GetModuleInformation (in: hProcess=0x304, hModule=0x75720000, lpmodinfo=0x23c7708, cb=0xc | out: lpmodinfo=0x23c7708*(lpBaseOfDll=0x75720000, SizeOfImage=0xa0000, EntryPoint=0x757349e5)) returned 1 [0099.022] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75720000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="ADVAPI32.dll") returned 0xc [0099.023] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75720000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\ADVAPI32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll")) returned 0x20 [0099.023] GetModuleInformation (in: hProcess=0x304, hModule=0x75fe0000, lpmodinfo=0x23c981c, cb=0xc | out: lpmodinfo=0x23c981c*(lpBaseOfDll=0x75fe0000, SizeOfImage=0xac000, EntryPoint=0x75fea472)) returned 1 [0099.023] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75fe0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="msvcrt.dll") returned 0xa [0099.023] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75fe0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll")) returned 0x1e [0099.023] GetModuleInformation (in: hProcess=0x304, hModule=0x761b0000, lpmodinfo=0x23cb928, cb=0xc | out: lpmodinfo=0x23cb928*(lpBaseOfDll=0x761b0000, SizeOfImage=0x19000, EntryPoint=0x761b4975)) returned 1 [0099.023] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x761b0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="sechost.dll") returned 0xb [0099.024] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x761b0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll")) returned 0x1f [0099.024] GetModuleInformation (in: hProcess=0x304, hModule=0x76090000, lpmodinfo=0x23cda34, cb=0xc | out: lpmodinfo=0x23cda34*(lpBaseOfDll=0x76090000, SizeOfImage=0xf0000, EntryPoint=0x760a0569)) returned 1 [0099.024] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x76090000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="RPCRT4.dll") returned 0xa [0099.024] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x76090000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\RPCRT4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll")) returned 0x1e [0099.024] GetModuleInformation (in: hProcess=0x304, hModule=0x75610000, lpmodinfo=0x23cfb8c, cb=0xc | out: lpmodinfo=0x23cfb8c*(lpBaseOfDll=0x75610000, SizeOfImage=0x60000, EntryPoint=0x7562a3b3)) returned 1 [0099.025] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75610000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="SspiCli.dll") returned 0xb [0099.025] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75610000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\SspiCli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll")) returned 0x1f [0099.025] GetModuleInformation (in: hProcess=0x304, hModule=0x75600000, lpmodinfo=0x23d1c98, cb=0xc | out: lpmodinfo=0x23d1c98*(lpBaseOfDll=0x75600000, SizeOfImage=0xc000, EntryPoint=0x756010e1)) returned 1 [0099.025] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75600000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="CRYPTBASE.dll") returned 0xd [0099.025] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75600000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\CRYPTBASE.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll")) returned 0x21 [0099.026] GetModuleInformation (in: hProcess=0x304, hModule=0x75430000, lpmodinfo=0x23d3dac, cb=0xc | out: lpmodinfo=0x23d3dac*(lpBaseOfDll=0x75430000, SizeOfImage=0x78000, EntryPoint=0x7543f7ba)) returned 1 [0099.026] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75430000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="mscoreei.dll") returned 0xc [0099.026] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75430000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscoreei.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\mscoreei.dll")) returned 0x3a [0099.026] GetModuleInformation (in: hProcess=0x304, hModule=0x761d0000, lpmodinfo=0x23d5ef4, cb=0xc | out: lpmodinfo=0x23d5ef4*(lpBaseOfDll=0x761d0000, SizeOfImage=0x57000, EntryPoint=0x761e9ba6)) returned 1 [0099.027] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x761d0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="SHLWAPI.dll") returned 0xb [0099.027] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x761d0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\SHLWAPI.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll")) returned 0x1f [0099.027] GetModuleInformation (in: hProcess=0x304, hModule=0x766d0000, lpmodinfo=0x23d8000, cb=0xc | out: lpmodinfo=0x23d8000*(lpBaseOfDll=0x766d0000, SizeOfImage=0x90000, EntryPoint=0x766e6343)) returned 1 [0099.027] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x766d0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="GDI32.dll") returned 0x9 [0099.028] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x766d0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\GDI32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll")) returned 0x1d [0099.028] GetModuleInformation (in: hProcess=0x304, hModule=0x775b0000, lpmodinfo=0x23da104, cb=0xc | out: lpmodinfo=0x23da104*(lpBaseOfDll=0x775b0000, SizeOfImage=0x100000, EntryPoint=0x775cb6ed)) returned 1 [0099.028] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x775b0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="USER32.dll") returned 0xa [0099.028] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x775b0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\USER32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll")) returned 0x1e [0099.029] GetModuleInformation (in: hProcess=0x304, hModule=0x75a70000, lpmodinfo=0x23dc210, cb=0xc | out: lpmodinfo=0x23dc210*(lpBaseOfDll=0x75a70000, SizeOfImage=0xa000, EntryPoint=0x75a736a0)) returned 1 [0099.029] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75a70000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="LPK.dll") returned 0x7 [0099.029] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75a70000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\LPK.dll" (normalized: "c:\\windows\\syswow64\\lpk.dll")) returned 0x1b [0099.029] GetModuleInformation (in: hProcess=0x304, hModule=0x758d0000, lpmodinfo=0x23de30c, cb=0xc | out: lpmodinfo=0x23de30c*(lpBaseOfDll=0x758d0000, SizeOfImage=0x9d000, EntryPoint=0x75903fd7)) returned 1 [0099.030] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x758d0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="USP10.dll") returned 0x9 [0099.030] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x758d0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\USP10.dll" (normalized: "c:\\windows\\syswow64\\usp10.dll")) returned 0x1d [0099.030] GetModuleInformation (in: hProcess=0x304, hModule=0x75f80000, lpmodinfo=0x23e049c, cb=0xc | out: lpmodinfo=0x23e049c*(lpBaseOfDll=0x75f80000, SizeOfImage=0x60000, EntryPoint=0x75f9158f)) returned 1 [0099.031] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75f80000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="IMM32.DLL") returned 0x9 [0099.031] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75f80000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\system32\\IMM32.DLL" (normalized: "c:\\windows\\system32\\imm32.dll")) returned 0x1d [0099.031] GetModuleInformation (in: hProcess=0x304, hModule=0x75ea0000, lpmodinfo=0x23e25a0, cb=0xc | out: lpmodinfo=0x23e25a0*(lpBaseOfDll=0x75ea0000, SizeOfImage=0xcc000, EntryPoint=0x75ea168b)) returned 1 [0099.031] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75ea0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="MSCTF.dll") returned 0x9 [0099.033] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75ea0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\MSCTF.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll")) returned 0x1d [0099.033] GetModuleInformation (in: hProcess=0x304, hModule=0x75420000, lpmodinfo=0x21e7514, cb=0xc | out: lpmodinfo=0x21e7514*(lpBaseOfDll=0x75420000, SizeOfImage=0x9000, EntryPoint=0x75421220)) returned 1 [0099.033] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75420000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="VERSION.dll") returned 0xb [0099.033] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75420000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\system32\\VERSION.dll" (normalized: "c:\\windows\\system32\\version.dll")) returned 0x1f [0099.034] GetModuleInformation (in: hProcess=0x304, hModule=0x74890000, lpmodinfo=0x21e9620, cb=0xc | out: lpmodinfo=0x21e9620*(lpBaseOfDll=0x74890000, SizeOfImage=0x6a8000, EntryPoint=0x749d7040)) returned 1 [0099.034] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x74890000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="clr.dll") returned 0x7 [0099.034] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x74890000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\clr.dll")) returned 0x35 [0099.035] GetModuleInformation (in: hProcess=0x304, hModule=0x75320000, lpmodinfo=0x21eb750, cb=0xc | out: lpmodinfo=0x21eb750*(lpBaseOfDll=0x75320000, SizeOfImage=0xf5000, EntryPoint=0x75374160)) returned 1 [0099.035] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75320000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="MSVCR120_CLR0400.dll") returned 0x14 [0099.035] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75320000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\system32\\MSVCR120_CLR0400.dll" (normalized: "c:\\windows\\system32\\msvcr120_clr0400.dll")) returned 0x28 [0099.036] GetModuleInformation (in: hProcess=0x304, hModule=0x72440000, lpmodinfo=0x21ed884, cb=0xc | out: lpmodinfo=0x21ed884*(lpBaseOfDll=0x72440000, SizeOfImage=0x122b000, EntryPoint=0x0)) returned 1 [0099.036] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x72440000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="mscorlib.ni.dll") returned 0xf [0099.036] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x72440000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\b7a12c4c0032847fcc6b9c710460456f\\mscorlib.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\mscorlib\\b7a12c4c0032847fcc6b9c710460456f\\mscorlib.ni.dll")) returned 0x68 [0099.037] GetModuleInformation (in: hProcess=0x304, hModule=0x764e0000, lpmodinfo=0x21efa2c, cb=0xc | out: lpmodinfo=0x21efa2c*(lpBaseOfDll=0x764e0000, SizeOfImage=0x15c000, EntryPoint=0x7652ba3d)) returned 1 [0099.037] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x764e0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="ole32.dll") returned 0x9 [0099.038] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x764e0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll")) returned 0x1d [0099.038] GetModuleInformation (in: hProcess=0x304, hModule=0x74f60000, lpmodinfo=0x21f1b30, cb=0xc | out: lpmodinfo=0x21f1b30*(lpBaseOfDll=0x74f60000, SizeOfImage=0x80000, EntryPoint=0x74f737c9)) returned 1 [0099.038] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x74f60000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="uxtheme.dll") returned 0xb [0099.039] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x74f60000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\system32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll")) returned 0x1f [0099.039] GetModuleInformation (in: hProcess=0x304, hModule=0x752a0000, lpmodinfo=0x21f3c3c, cb=0xc | out: lpmodinfo=0x21f3c3c*(lpBaseOfDll=0x752a0000, SizeOfImage=0x7d000, EntryPoint=0x752a1140)) returned 1 [0099.039] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x752a0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="clrjit.dll") returned 0xa [0099.040] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x752a0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clrjit.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\clrjit.dll")) returned 0x38 [0099.040] GetModuleInformation (in: hProcess=0x304, hModule=0x762b0000, lpmodinfo=0x21f5d7c, cb=0xc | out: lpmodinfo=0x21f5d7c*(lpBaseOfDll=0x762b0000, SizeOfImage=0x8f000, EntryPoint=0x762b3fb1)) returned 1 [0099.040] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x762b0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="OLEAUT32.dll") returned 0xc [0099.041] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x762b0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\OLEAUT32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll")) returned 0x20 [0099.041] GetModuleInformation (in: hProcess=0x304, hModule=0x736d0000, lpmodinfo=0x21f7e90, cb=0xc | out: lpmodinfo=0x21f7e90*(lpBaseOfDll=0x736d0000, SizeOfImage=0x9ad000, EntryPoint=0x0)) returned 1 [0099.042] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x736d0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="System.ni.dll") returned 0xd [0099.042] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x736d0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System\\500ffa28b327e171fe664023003e947e\\System.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system\\500ffa28b327e171fe664023003e947e\\system.ni.dll")) returned 0x64 [0099.042] GetModuleInformation (in: hProcess=0x304, hModule=0x71d20000, lpmodinfo=0x21fa02c, cb=0xc | out: lpmodinfo=0x21fa02c*(lpBaseOfDll=0x71d20000, SizeOfImage=0x716000, EntryPoint=0x0)) returned 1 [0099.043] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x71d20000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="System.Core.ni.dll") returned 0x12 [0099.043] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x71d20000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Core\\386fde9190d499d6645df8b90eb76242\\System.Core.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.core\\386fde9190d499d6645df8b90eb76242\\system.core.ni.dll")) returned 0x6e [0099.044] GetModuleInformation (in: hProcess=0x304, hModule=0x750d0000, lpmodinfo=0x21fc1e8, cb=0xc | out: lpmodinfo=0x21fc1e8*(lpBaseOfDll=0x750d0000, SizeOfImage=0x1cb000, EntryPoint=0x0)) returned 1 [0099.044] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x750d0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="Microsoft.VisualBasic.ni.dll") returned 0x1c [0099.044] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x750d0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Microsoft.V9921e851#\\cfbddeb6e93e8f421b92229b20e51233\\Microsoft.VisualBasic.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\microsoft.v9921e851#\\cfbddeb6e93e8f421b92229b20e51233\\microsoft.visualbasic.ni.dll")) returned 0x81 [0099.045] GetModuleInformation (in: hProcess=0x304, hModule=0x750b0000, lpmodinfo=0x21fe3dc, cb=0xc | out: lpmodinfo=0x21fe3dc*(lpBaseOfDll=0x750b0000, SizeOfImage=0x13000, EntryPoint=0x750b18f0)) returned 1 [0099.045] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x750b0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="nlssorting.dll") returned 0xe [0099.046] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x750b0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\nlssorting.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\nlssorting.dll")) returned 0x3c [0099.046] GetModuleInformation (in: hProcess=0x304, hModule=0x74870000, lpmodinfo=0x220052c, cb=0xc | out: lpmodinfo=0x220052c*(lpBaseOfDll=0x74870000, SizeOfImage=0x16000, EntryPoint=0x74872dc3)) returned 1 [0099.047] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x74870000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="CRYPTSP.dll") returned 0xb [0099.047] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x74870000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\system32\\CRYPTSP.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll")) returned 0x1f [0099.047] GetModuleInformation (in: hProcess=0x304, hModule=0x74830000, lpmodinfo=0x2202638, cb=0xc | out: lpmodinfo=0x2202638*(lpBaseOfDll=0x74830000, SizeOfImage=0x3b000, EntryPoint=0x7483128d)) returned 1 [0099.048] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x74830000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="rsaenh.dll") returned 0xa [0099.048] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x74830000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\system32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll")) returned 0x1e [0099.049] GetModuleInformation (in: hProcess=0x304, hModule=0x75a60000, lpmodinfo=0x2204850, cb=0xc | out: lpmodinfo=0x2204850*(lpBaseOfDll=0x75a60000, SizeOfImage=0x5000, EntryPoint=0x75a61438)) returned 1 [0099.049] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75a60000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="psapi.dll") returned 0x9 [0099.050] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75a60000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\psapi.dll" (normalized: "c:\\windows\\syswow64\\psapi.dll")) returned 0x1d [0099.050] GetModuleInformation (in: hProcess=0x304, hModule=0x746a0000, lpmodinfo=0x2206954, cb=0xc | out: lpmodinfo=0x2206954*(lpBaseOfDll=0x746a0000, SizeOfImage=0x18d000, EntryPoint=0x0)) returned 1 [0099.051] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x746a0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="System.Drawing.ni.dll") returned 0x15 [0099.051] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x746a0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Drawing\\553c0312fdf5a5449f3649f0515e70fb\\System.Drawing.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.drawing\\553c0312fdf5a5449f3649f0515e70fb\\system.drawing.ni.dll")) returned 0x74 [0099.052] GetModuleInformation (in: hProcess=0x304, hModule=0x710c0000, lpmodinfo=0x2208b20, cb=0xc | out: lpmodinfo=0x2208b20*(lpBaseOfDll=0x710c0000, SizeOfImage=0xc58000, EntryPoint=0x0)) returned 1 [0099.052] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x710c0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="System.Windows.Forms.ni.dll") returned 0x1b [0099.053] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x710c0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Windows.Forms\\7a6894982f35a1d75ec73d447c583da2\\System.Windows.Forms.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.windows.forms\\7a6894982f35a1d75ec73d447c583da2\\system.windows.forms.ni.dll")) returned 0x80 [0099.061] EnumProcessModules (in: hProcess=0x304, lphModule=0x23029a8, cb=0x100, lpcbNeeded=0x497fd0 | out: lphModule=0x23029a8, lpcbNeeded=0x497fd0) returned 1 [0099.061] GetModuleInformation (in: hProcess=0x304, hModule=0x310000, lpmodinfo=0x2302ae8, cb=0xc | out: lpmodinfo=0x2302ae8*(lpBaseOfDll=0x310000, SizeOfImage=0x3e000, EntryPoint=0x3479ce)) returned 1 [0099.061] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x310000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="unlikexpc.exe") returned 0xd [0099.061] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x310000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\unlikexpc.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\unlikexpc.exe")) returned 0x33 [0099.061] GetModuleInformation (in: hProcess=0x304, hModule=0x77ab0000, lpmodinfo=0x2304c3c, cb=0xc | out: lpmodinfo=0x2304c3c*(lpBaseOfDll=0x77ab0000, SizeOfImage=0x180000, EntryPoint=0x0)) returned 1 [0099.061] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x77ab0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="ntdll.dll") returned 0x9 [0099.062] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x77ab0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll")) returned 0x1d [0099.062] GetModuleInformation (in: hProcess=0x304, hModule=0x754b0000, lpmodinfo=0x2306d40, cb=0xc | out: lpmodinfo=0x2306d40*(lpBaseOfDll=0x754b0000, SizeOfImage=0x4a000, EntryPoint=0x754b2e54)) returned 1 [0099.062] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x754b0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="MSCOREE.DLL") returned 0xb [0099.062] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x754b0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\MSCOREE.DLL" (normalized: "c:\\windows\\system32\\mscoree.dll")) returned 0x1f [0099.062] GetModuleInformation (in: hProcess=0x304, hModule=0x757c0000, lpmodinfo=0x2308e4c, cb=0xc | out: lpmodinfo=0x2308e4c*(lpBaseOfDll=0x757c0000, SizeOfImage=0x110000, EntryPoint=0x757d32d3)) returned 1 [0099.062] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x757c0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="KERNEL32.dll") returned 0xc [0099.062] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x757c0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\KERNEL32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll")) returned 0x20 [0099.062] GetModuleInformation (in: hProcess=0x304, hModule=0x76260000, lpmodinfo=0x230af60, cb=0xc | out: lpmodinfo=0x230af60*(lpBaseOfDll=0x76260000, SizeOfImage=0x46000, EntryPoint=0x76267478)) returned 1 [0099.063] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x76260000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="KERNELBASE.dll") returned 0xe [0099.063] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x76260000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\KERNELBASE.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll")) returned 0x22 [0099.063] GetModuleInformation (in: hProcess=0x304, hModule=0x75720000, lpmodinfo=0x230d0a8, cb=0xc | out: lpmodinfo=0x230d0a8*(lpBaseOfDll=0x75720000, SizeOfImage=0xa0000, EntryPoint=0x757349e5)) returned 1 [0099.063] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75720000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="ADVAPI32.dll") returned 0xc [0099.063] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75720000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\ADVAPI32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll")) returned 0x20 [0099.064] GetModuleInformation (in: hProcess=0x304, hModule=0x75fe0000, lpmodinfo=0x230f1bc, cb=0xc | out: lpmodinfo=0x230f1bc*(lpBaseOfDll=0x75fe0000, SizeOfImage=0xac000, EntryPoint=0x75fea472)) returned 1 [0099.064] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75fe0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="msvcrt.dll") returned 0xa [0099.064] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75fe0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll")) returned 0x1e [0099.064] GetModuleInformation (in: hProcess=0x304, hModule=0x761b0000, lpmodinfo=0x23112c8, cb=0xc | out: lpmodinfo=0x23112c8*(lpBaseOfDll=0x761b0000, SizeOfImage=0x19000, EntryPoint=0x761b4975)) returned 1 [0099.064] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x761b0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="sechost.dll") returned 0xb [0099.064] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x761b0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll")) returned 0x1f [0099.065] GetModuleInformation (in: hProcess=0x304, hModule=0x76090000, lpmodinfo=0x23133d4, cb=0xc | out: lpmodinfo=0x23133d4*(lpBaseOfDll=0x76090000, SizeOfImage=0xf0000, EntryPoint=0x760a0569)) returned 1 [0099.065] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x76090000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="RPCRT4.dll") returned 0xa [0099.065] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x76090000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\RPCRT4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll")) returned 0x1e [0099.065] GetModuleInformation (in: hProcess=0x304, hModule=0x75610000, lpmodinfo=0x231552c, cb=0xc | out: lpmodinfo=0x231552c*(lpBaseOfDll=0x75610000, SizeOfImage=0x60000, EntryPoint=0x7562a3b3)) returned 1 [0099.065] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75610000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="SspiCli.dll") returned 0xb [0099.066] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75610000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\SspiCli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll")) returned 0x1f [0099.066] GetModuleInformation (in: hProcess=0x304, hModule=0x75600000, lpmodinfo=0x2317638, cb=0xc | out: lpmodinfo=0x2317638*(lpBaseOfDll=0x75600000, SizeOfImage=0xc000, EntryPoint=0x756010e1)) returned 1 [0099.066] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75600000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="CRYPTBASE.dll") returned 0xd [0099.066] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75600000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\CRYPTBASE.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll")) returned 0x21 [0099.066] GetModuleInformation (in: hProcess=0x304, hModule=0x75430000, lpmodinfo=0x231974c, cb=0xc | out: lpmodinfo=0x231974c*(lpBaseOfDll=0x75430000, SizeOfImage=0x78000, EntryPoint=0x7543f7ba)) returned 1 [0099.067] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75430000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="mscoreei.dll") returned 0xc [0099.067] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75430000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscoreei.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\mscoreei.dll")) returned 0x3a [0099.067] GetModuleInformation (in: hProcess=0x304, hModule=0x761d0000, lpmodinfo=0x231b894, cb=0xc | out: lpmodinfo=0x231b894*(lpBaseOfDll=0x761d0000, SizeOfImage=0x57000, EntryPoint=0x761e9ba6)) returned 1 [0099.067] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x761d0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="SHLWAPI.dll") returned 0xb [0099.067] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x761d0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\SHLWAPI.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll")) returned 0x1f [0099.068] GetModuleInformation (in: hProcess=0x304, hModule=0x766d0000, lpmodinfo=0x231d9a0, cb=0xc | out: lpmodinfo=0x231d9a0*(lpBaseOfDll=0x766d0000, SizeOfImage=0x90000, EntryPoint=0x766e6343)) returned 1 [0099.068] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x766d0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="GDI32.dll") returned 0x9 [0099.068] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x766d0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\GDI32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll")) returned 0x1d [0099.068] GetModuleInformation (in: hProcess=0x304, hModule=0x775b0000, lpmodinfo=0x231faa4, cb=0xc | out: lpmodinfo=0x231faa4*(lpBaseOfDll=0x775b0000, SizeOfImage=0x100000, EntryPoint=0x775cb6ed)) returned 1 [0099.069] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x775b0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="USER32.dll") returned 0xa [0099.069] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x775b0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\USER32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll")) returned 0x1e [0099.069] GetModuleInformation (in: hProcess=0x304, hModule=0x75a70000, lpmodinfo=0x2321bb0, cb=0xc | out: lpmodinfo=0x2321bb0*(lpBaseOfDll=0x75a70000, SizeOfImage=0xa000, EntryPoint=0x75a736a0)) returned 1 [0099.069] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75a70000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="LPK.dll") returned 0x7 [0099.070] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75a70000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\LPK.dll" (normalized: "c:\\windows\\syswow64\\lpk.dll")) returned 0x1b [0099.070] GetModuleInformation (in: hProcess=0x304, hModule=0x758d0000, lpmodinfo=0x2323cac, cb=0xc | out: lpmodinfo=0x2323cac*(lpBaseOfDll=0x758d0000, SizeOfImage=0x9d000, EntryPoint=0x75903fd7)) returned 1 [0099.070] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x758d0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="USP10.dll") returned 0x9 [0099.071] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x758d0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\USP10.dll" (normalized: "c:\\windows\\syswow64\\usp10.dll")) returned 0x1d [0099.071] GetModuleInformation (in: hProcess=0x304, hModule=0x75f80000, lpmodinfo=0x2325e3c, cb=0xc | out: lpmodinfo=0x2325e3c*(lpBaseOfDll=0x75f80000, SizeOfImage=0x60000, EntryPoint=0x75f9158f)) returned 1 [0099.071] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75f80000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="IMM32.DLL") returned 0x9 [0099.071] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75f80000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\system32\\IMM32.DLL" (normalized: "c:\\windows\\system32\\imm32.dll")) returned 0x1d [0099.072] GetModuleInformation (in: hProcess=0x304, hModule=0x75ea0000, lpmodinfo=0x2327f40, cb=0xc | out: lpmodinfo=0x2327f40*(lpBaseOfDll=0x75ea0000, SizeOfImage=0xcc000, EntryPoint=0x75ea168b)) returned 1 [0099.072] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75ea0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="MSCTF.dll") returned 0x9 [0099.072] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75ea0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\MSCTF.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll")) returned 0x1d [0099.073] GetModuleInformation (in: hProcess=0x304, hModule=0x75420000, lpmodinfo=0x232a044, cb=0xc | out: lpmodinfo=0x232a044*(lpBaseOfDll=0x75420000, SizeOfImage=0x9000, EntryPoint=0x75421220)) returned 1 [0099.073] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75420000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="VERSION.dll") returned 0xb [0099.073] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75420000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\system32\\VERSION.dll" (normalized: "c:\\windows\\system32\\version.dll")) returned 0x1f [0099.073] GetModuleInformation (in: hProcess=0x304, hModule=0x74890000, lpmodinfo=0x232c150, cb=0xc | out: lpmodinfo=0x232c150*(lpBaseOfDll=0x74890000, SizeOfImage=0x6a8000, EntryPoint=0x749d7040)) returned 1 [0099.074] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x74890000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="clr.dll") returned 0x7 [0099.074] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x74890000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\clr.dll")) returned 0x35 [0099.074] GetModuleInformation (in: hProcess=0x304, hModule=0x75320000, lpmodinfo=0x232e280, cb=0xc | out: lpmodinfo=0x232e280*(lpBaseOfDll=0x75320000, SizeOfImage=0xf5000, EntryPoint=0x75374160)) returned 1 [0099.075] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75320000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="MSVCR120_CLR0400.dll") returned 0x14 [0099.075] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75320000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\system32\\MSVCR120_CLR0400.dll" (normalized: "c:\\windows\\system32\\msvcr120_clr0400.dll")) returned 0x28 [0099.075] GetModuleInformation (in: hProcess=0x304, hModule=0x72440000, lpmodinfo=0x23303b4, cb=0xc | out: lpmodinfo=0x23303b4*(lpBaseOfDll=0x72440000, SizeOfImage=0x122b000, EntryPoint=0x0)) returned 1 [0099.076] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x72440000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="mscorlib.ni.dll") returned 0xf [0099.076] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x72440000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\b7a12c4c0032847fcc6b9c710460456f\\mscorlib.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\mscorlib\\b7a12c4c0032847fcc6b9c710460456f\\mscorlib.ni.dll")) returned 0x68 [0099.076] GetModuleInformation (in: hProcess=0x304, hModule=0x764e0000, lpmodinfo=0x233255c, cb=0xc | out: lpmodinfo=0x233255c*(lpBaseOfDll=0x764e0000, SizeOfImage=0x15c000, EntryPoint=0x7652ba3d)) returned 1 [0099.077] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x764e0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="ole32.dll") returned 0x9 [0099.077] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x764e0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll")) returned 0x1d [0099.077] GetModuleInformation (in: hProcess=0x304, hModule=0x74f60000, lpmodinfo=0x2334660, cb=0xc | out: lpmodinfo=0x2334660*(lpBaseOfDll=0x74f60000, SizeOfImage=0x80000, EntryPoint=0x74f737c9)) returned 1 [0099.078] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x74f60000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="uxtheme.dll") returned 0xb [0099.078] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x74f60000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\system32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll")) returned 0x1f [0099.079] GetModuleInformation (in: hProcess=0x304, hModule=0x752a0000, lpmodinfo=0x233676c, cb=0xc | out: lpmodinfo=0x233676c*(lpBaseOfDll=0x752a0000, SizeOfImage=0x7d000, EntryPoint=0x752a1140)) returned 1 [0099.079] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x752a0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="clrjit.dll") returned 0xa [0099.079] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x752a0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clrjit.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\clrjit.dll")) returned 0x38 [0099.080] GetModuleInformation (in: hProcess=0x304, hModule=0x762b0000, lpmodinfo=0x23388ac, cb=0xc | out: lpmodinfo=0x23388ac*(lpBaseOfDll=0x762b0000, SizeOfImage=0x8f000, EntryPoint=0x762b3fb1)) returned 1 [0099.080] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x762b0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="OLEAUT32.dll") returned 0xc [0099.080] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x762b0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\OLEAUT32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll")) returned 0x20 [0099.081] GetModuleInformation (in: hProcess=0x304, hModule=0x736d0000, lpmodinfo=0x233a9c0, cb=0xc | out: lpmodinfo=0x233a9c0*(lpBaseOfDll=0x736d0000, SizeOfImage=0x9ad000, EntryPoint=0x0)) returned 1 [0099.081] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x736d0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="System.ni.dll") returned 0xd [0099.081] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x736d0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System\\500ffa28b327e171fe664023003e947e\\System.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system\\500ffa28b327e171fe664023003e947e\\system.ni.dll")) returned 0x64 [0099.082] GetModuleInformation (in: hProcess=0x304, hModule=0x71d20000, lpmodinfo=0x233cb5c, cb=0xc | out: lpmodinfo=0x233cb5c*(lpBaseOfDll=0x71d20000, SizeOfImage=0x716000, EntryPoint=0x0)) returned 1 [0099.082] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x71d20000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="System.Core.ni.dll") returned 0x12 [0099.083] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x71d20000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Core\\386fde9190d499d6645df8b90eb76242\\System.Core.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.core\\386fde9190d499d6645df8b90eb76242\\system.core.ni.dll")) returned 0x6e [0099.083] GetModuleInformation (in: hProcess=0x304, hModule=0x750d0000, lpmodinfo=0x233ed18, cb=0xc | out: lpmodinfo=0x233ed18*(lpBaseOfDll=0x750d0000, SizeOfImage=0x1cb000, EntryPoint=0x0)) returned 1 [0099.083] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x750d0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="Microsoft.VisualBasic.ni.dll") returned 0x1c [0099.084] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x750d0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Microsoft.V9921e851#\\cfbddeb6e93e8f421b92229b20e51233\\Microsoft.VisualBasic.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\microsoft.v9921e851#\\cfbddeb6e93e8f421b92229b20e51233\\microsoft.visualbasic.ni.dll")) returned 0x81 [0099.084] GetModuleInformation (in: hProcess=0x304, hModule=0x750b0000, lpmodinfo=0x2340f0c, cb=0xc | out: lpmodinfo=0x2340f0c*(lpBaseOfDll=0x750b0000, SizeOfImage=0x13000, EntryPoint=0x750b18f0)) returned 1 [0099.085] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x750b0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="nlssorting.dll") returned 0xe [0099.085] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x750b0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\nlssorting.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\nlssorting.dll")) returned 0x3c [0099.085] GetModuleInformation (in: hProcess=0x304, hModule=0x74870000, lpmodinfo=0x234305c, cb=0xc | out: lpmodinfo=0x234305c*(lpBaseOfDll=0x74870000, SizeOfImage=0x16000, EntryPoint=0x74872dc3)) returned 1 [0099.086] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x74870000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="CRYPTSP.dll") returned 0xb [0099.086] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x74870000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\system32\\CRYPTSP.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll")) returned 0x1f [0099.087] GetModuleInformation (in: hProcess=0x304, hModule=0x74830000, lpmodinfo=0x2345168, cb=0xc | out: lpmodinfo=0x2345168*(lpBaseOfDll=0x74830000, SizeOfImage=0x3b000, EntryPoint=0x7483128d)) returned 1 [0099.087] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x74830000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="rsaenh.dll") returned 0xa [0099.088] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x74830000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\system32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll")) returned 0x1e [0099.088] GetModuleInformation (in: hProcess=0x304, hModule=0x75a60000, lpmodinfo=0x2347380, cb=0xc | out: lpmodinfo=0x2347380*(lpBaseOfDll=0x75a60000, SizeOfImage=0x5000, EntryPoint=0x75a61438)) returned 1 [0099.089] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75a60000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="psapi.dll") returned 0x9 [0099.089] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75a60000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\psapi.dll" (normalized: "c:\\windows\\syswow64\\psapi.dll")) returned 0x1d [0099.090] GetModuleInformation (in: hProcess=0x304, hModule=0x746a0000, lpmodinfo=0x2349484, cb=0xc | out: lpmodinfo=0x2349484*(lpBaseOfDll=0x746a0000, SizeOfImage=0x18d000, EntryPoint=0x0)) returned 1 [0099.090] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x746a0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="System.Drawing.ni.dll") returned 0x15 [0099.090] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x746a0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Drawing\\553c0312fdf5a5449f3649f0515e70fb\\System.Drawing.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.drawing\\553c0312fdf5a5449f3649f0515e70fb\\system.drawing.ni.dll")) returned 0x74 [0099.091] GetModuleInformation (in: hProcess=0x304, hModule=0x710c0000, lpmodinfo=0x234b650, cb=0xc | out: lpmodinfo=0x234b650*(lpBaseOfDll=0x710c0000, SizeOfImage=0xc58000, EntryPoint=0x0)) returned 1 [0099.091] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x710c0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="System.Windows.Forms.ni.dll") returned 0x1b [0099.092] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x710c0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Windows.Forms\\7a6894982f35a1d75ec73d447c583da2\\System.Windows.Forms.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.windows.forms\\7a6894982f35a1d75ec73d447c583da2\\system.windows.forms.ni.dll")) returned 0x80 [0099.095] EnumProcessModules (in: hProcess=0x304, lphModule=0x2246664, cb=0x100, lpcbNeeded=0x497fd0 | out: lphModule=0x2246664, lpcbNeeded=0x497fd0) returned 1 [0099.095] GetModuleInformation (in: hProcess=0x304, hModule=0x310000, lpmodinfo=0x22467a4, cb=0xc | out: lpmodinfo=0x22467a4*(lpBaseOfDll=0x310000, SizeOfImage=0x3e000, EntryPoint=0x3479ce)) returned 1 [0099.095] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x310000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="unlikexpc.exe") returned 0xd [0099.095] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x310000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\unlikexpc.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\unlikexpc.exe")) returned 0x33 [0099.095] GetModuleInformation (in: hProcess=0x304, hModule=0x77ab0000, lpmodinfo=0x22488f8, cb=0xc | out: lpmodinfo=0x22488f8*(lpBaseOfDll=0x77ab0000, SizeOfImage=0x180000, EntryPoint=0x0)) returned 1 [0099.095] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x77ab0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="ntdll.dll") returned 0x9 [0099.096] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x77ab0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll")) returned 0x1d [0099.096] GetModuleInformation (in: hProcess=0x304, hModule=0x754b0000, lpmodinfo=0x224a9fc, cb=0xc | out: lpmodinfo=0x224a9fc*(lpBaseOfDll=0x754b0000, SizeOfImage=0x4a000, EntryPoint=0x754b2e54)) returned 1 [0099.096] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x754b0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="MSCOREE.DLL") returned 0xb [0099.096] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x754b0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\MSCOREE.DLL" (normalized: "c:\\windows\\system32\\mscoree.dll")) returned 0x1f [0099.096] GetModuleInformation (in: hProcess=0x304, hModule=0x757c0000, lpmodinfo=0x224cb08, cb=0xc | out: lpmodinfo=0x224cb08*(lpBaseOfDll=0x757c0000, SizeOfImage=0x110000, EntryPoint=0x757d32d3)) returned 1 [0099.096] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x757c0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="KERNEL32.dll") returned 0xc [0099.096] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x757c0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\KERNEL32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll")) returned 0x20 [0099.096] GetModuleInformation (in: hProcess=0x304, hModule=0x76260000, lpmodinfo=0x224ec1c, cb=0xc | out: lpmodinfo=0x224ec1c*(lpBaseOfDll=0x76260000, SizeOfImage=0x46000, EntryPoint=0x76267478)) returned 1 [0099.097] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x76260000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="KERNELBASE.dll") returned 0xe [0099.097] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x76260000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\KERNELBASE.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll")) returned 0x22 [0099.097] GetModuleInformation (in: hProcess=0x304, hModule=0x75720000, lpmodinfo=0x2250d64, cb=0xc | out: lpmodinfo=0x2250d64*(lpBaseOfDll=0x75720000, SizeOfImage=0xa0000, EntryPoint=0x757349e5)) returned 1 [0099.097] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75720000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="ADVAPI32.dll") returned 0xc [0099.097] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75720000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\ADVAPI32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll")) returned 0x20 [0099.097] GetModuleInformation (in: hProcess=0x304, hModule=0x75fe0000, lpmodinfo=0x2252e78, cb=0xc | out: lpmodinfo=0x2252e78*(lpBaseOfDll=0x75fe0000, SizeOfImage=0xac000, EntryPoint=0x75fea472)) returned 1 [0099.098] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75fe0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="msvcrt.dll") returned 0xa [0099.098] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75fe0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll")) returned 0x1e [0099.098] GetModuleInformation (in: hProcess=0x304, hModule=0x761b0000, lpmodinfo=0x2254f84, cb=0xc | out: lpmodinfo=0x2254f84*(lpBaseOfDll=0x761b0000, SizeOfImage=0x19000, EntryPoint=0x761b4975)) returned 1 [0099.098] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x761b0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="sechost.dll") returned 0xb [0099.098] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x761b0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll")) returned 0x1f [0099.098] GetModuleInformation (in: hProcess=0x304, hModule=0x76090000, lpmodinfo=0x2257090, cb=0xc | out: lpmodinfo=0x2257090*(lpBaseOfDll=0x76090000, SizeOfImage=0xf0000, EntryPoint=0x760a0569)) returned 1 [0099.099] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x76090000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="RPCRT4.dll") returned 0xa [0099.099] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x76090000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\RPCRT4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll")) returned 0x1e [0099.099] GetModuleInformation (in: hProcess=0x304, hModule=0x75610000, lpmodinfo=0x22591e8, cb=0xc | out: lpmodinfo=0x22591e8*(lpBaseOfDll=0x75610000, SizeOfImage=0x60000, EntryPoint=0x7562a3b3)) returned 1 [0099.099] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75610000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="SspiCli.dll") returned 0xb [0099.099] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75610000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\SspiCli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll")) returned 0x1f [0099.100] GetModuleInformation (in: hProcess=0x304, hModule=0x75600000, lpmodinfo=0x225b2f4, cb=0xc | out: lpmodinfo=0x225b2f4*(lpBaseOfDll=0x75600000, SizeOfImage=0xc000, EntryPoint=0x756010e1)) returned 1 [0099.100] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75600000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="CRYPTBASE.dll") returned 0xd [0099.100] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75600000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\CRYPTBASE.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll")) returned 0x21 [0099.100] GetModuleInformation (in: hProcess=0x304, hModule=0x75430000, lpmodinfo=0x225d408, cb=0xc | out: lpmodinfo=0x225d408*(lpBaseOfDll=0x75430000, SizeOfImage=0x78000, EntryPoint=0x7543f7ba)) returned 1 [0099.100] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75430000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="mscoreei.dll") returned 0xc [0099.101] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75430000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscoreei.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\mscoreei.dll")) returned 0x3a [0099.101] GetModuleInformation (in: hProcess=0x304, hModule=0x761d0000, lpmodinfo=0x225f550, cb=0xc | out: lpmodinfo=0x225f550*(lpBaseOfDll=0x761d0000, SizeOfImage=0x57000, EntryPoint=0x761e9ba6)) returned 1 [0099.101] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x761d0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="SHLWAPI.dll") returned 0xb [0099.101] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x761d0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\SHLWAPI.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll")) returned 0x1f [0099.102] GetModuleInformation (in: hProcess=0x304, hModule=0x766d0000, lpmodinfo=0x226165c, cb=0xc | out: lpmodinfo=0x226165c*(lpBaseOfDll=0x766d0000, SizeOfImage=0x90000, EntryPoint=0x766e6343)) returned 1 [0099.102] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x766d0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="GDI32.dll") returned 0x9 [0099.102] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x766d0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\GDI32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll")) returned 0x1d [0099.102] GetModuleInformation (in: hProcess=0x304, hModule=0x775b0000, lpmodinfo=0x2263760, cb=0xc | out: lpmodinfo=0x2263760*(lpBaseOfDll=0x775b0000, SizeOfImage=0x100000, EntryPoint=0x775cb6ed)) returned 1 [0099.103] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x775b0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="USER32.dll") returned 0xa [0099.103] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x775b0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\USER32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll")) returned 0x1e [0099.103] GetModuleInformation (in: hProcess=0x304, hModule=0x75a70000, lpmodinfo=0x226586c, cb=0xc | out: lpmodinfo=0x226586c*(lpBaseOfDll=0x75a70000, SizeOfImage=0xa000, EntryPoint=0x75a736a0)) returned 1 [0099.103] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75a70000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="LPK.dll") returned 0x7 [0099.104] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75a70000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\LPK.dll" (normalized: "c:\\windows\\syswow64\\lpk.dll")) returned 0x1b [0099.104] GetModuleInformation (in: hProcess=0x304, hModule=0x758d0000, lpmodinfo=0x2267968, cb=0xc | out: lpmodinfo=0x2267968*(lpBaseOfDll=0x758d0000, SizeOfImage=0x9d000, EntryPoint=0x75903fd7)) returned 1 [0099.104] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x758d0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="USP10.dll") returned 0x9 [0099.104] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x758d0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\USP10.dll" (normalized: "c:\\windows\\syswow64\\usp10.dll")) returned 0x1d [0099.105] GetModuleInformation (in: hProcess=0x304, hModule=0x75f80000, lpmodinfo=0x2269af8, cb=0xc | out: lpmodinfo=0x2269af8*(lpBaseOfDll=0x75f80000, SizeOfImage=0x60000, EntryPoint=0x75f9158f)) returned 1 [0099.105] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75f80000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="IMM32.DLL") returned 0x9 [0099.105] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75f80000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\system32\\IMM32.DLL" (normalized: "c:\\windows\\system32\\imm32.dll")) returned 0x1d [0099.105] GetModuleInformation (in: hProcess=0x304, hModule=0x75ea0000, lpmodinfo=0x226bbfc, cb=0xc | out: lpmodinfo=0x226bbfc*(lpBaseOfDll=0x75ea0000, SizeOfImage=0xcc000, EntryPoint=0x75ea168b)) returned 1 [0099.106] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75ea0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="MSCTF.dll") returned 0x9 [0099.106] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75ea0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\MSCTF.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll")) returned 0x1d [0099.106] GetModuleInformation (in: hProcess=0x304, hModule=0x75420000, lpmodinfo=0x226dd00, cb=0xc | out: lpmodinfo=0x226dd00*(lpBaseOfDll=0x75420000, SizeOfImage=0x9000, EntryPoint=0x75421220)) returned 1 [0099.107] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75420000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="VERSION.dll") returned 0xb [0099.107] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75420000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\system32\\VERSION.dll" (normalized: "c:\\windows\\system32\\version.dll")) returned 0x1f [0099.107] GetModuleInformation (in: hProcess=0x304, hModule=0x74890000, lpmodinfo=0x226fe0c, cb=0xc | out: lpmodinfo=0x226fe0c*(lpBaseOfDll=0x74890000, SizeOfImage=0x6a8000, EntryPoint=0x749d7040)) returned 1 [0099.108] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x74890000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="clr.dll") returned 0x7 [0099.108] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x74890000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\clr.dll")) returned 0x35 [0099.108] GetModuleInformation (in: hProcess=0x304, hModule=0x75320000, lpmodinfo=0x2271f3c, cb=0xc | out: lpmodinfo=0x2271f3c*(lpBaseOfDll=0x75320000, SizeOfImage=0xf5000, EntryPoint=0x75374160)) returned 1 [0099.109] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x75320000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="MSVCR120_CLR0400.dll") returned 0x14 [0099.109] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x75320000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\system32\\MSVCR120_CLR0400.dll" (normalized: "c:\\windows\\system32\\msvcr120_clr0400.dll")) returned 0x28 [0099.109] GetModuleInformation (in: hProcess=0x304, hModule=0x72440000, lpmodinfo=0x2274070, cb=0xc | out: lpmodinfo=0x2274070*(lpBaseOfDll=0x72440000, SizeOfImage=0x122b000, EntryPoint=0x0)) returned 1 [0099.110] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x72440000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="mscorlib.ni.dll") returned 0xf [0099.110] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x72440000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\b7a12c4c0032847fcc6b9c710460456f\\mscorlib.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\mscorlib\\b7a12c4c0032847fcc6b9c710460456f\\mscorlib.ni.dll")) returned 0x68 [0099.110] GetModuleInformation (in: hProcess=0x304, hModule=0x764e0000, lpmodinfo=0x2276218, cb=0xc | out: lpmodinfo=0x2276218*(lpBaseOfDll=0x764e0000, SizeOfImage=0x15c000, EntryPoint=0x7652ba3d)) returned 1 [0099.111] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x764e0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="ole32.dll") returned 0x9 [0099.111] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x764e0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll")) returned 0x1d [0099.111] GetModuleInformation (in: hProcess=0x304, hModule=0x74f60000, lpmodinfo=0x227831c, cb=0xc | out: lpmodinfo=0x227831c*(lpBaseOfDll=0x74f60000, SizeOfImage=0x80000, EntryPoint=0x74f737c9)) returned 1 [0099.112] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x74f60000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="uxtheme.dll") returned 0xb [0099.112] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x74f60000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\system32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll")) returned 0x1f [0099.112] GetModuleInformation (in: hProcess=0x304, hModule=0x752a0000, lpmodinfo=0x227a428, cb=0xc | out: lpmodinfo=0x227a428*(lpBaseOfDll=0x752a0000, SizeOfImage=0x7d000, EntryPoint=0x752a1140)) returned 1 [0099.113] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x752a0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="clrjit.dll") returned 0xa [0099.113] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x752a0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clrjit.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\clrjit.dll")) returned 0x38 [0099.113] GetModuleInformation (in: hProcess=0x304, hModule=0x762b0000, lpmodinfo=0x227c568, cb=0xc | out: lpmodinfo=0x227c568*(lpBaseOfDll=0x762b0000, SizeOfImage=0x8f000, EntryPoint=0x762b3fb1)) returned 1 [0099.114] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x762b0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="OLEAUT32.dll") returned 0xc [0099.114] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x762b0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\OLEAUT32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll")) returned 0x20 [0099.115] GetModuleInformation (in: hProcess=0x304, hModule=0x736d0000, lpmodinfo=0x227e67c, cb=0xc | out: lpmodinfo=0x227e67c*(lpBaseOfDll=0x736d0000, SizeOfImage=0x9ad000, EntryPoint=0x0)) returned 1 [0099.115] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x736d0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="System.ni.dll") returned 0xd [0099.115] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x736d0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System\\500ffa28b327e171fe664023003e947e\\System.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system\\500ffa28b327e171fe664023003e947e\\system.ni.dll")) returned 0x64 [0099.116] GetModuleInformation (in: hProcess=0x304, hModule=0x71d20000, lpmodinfo=0x2280818, cb=0xc | out: lpmodinfo=0x2280818*(lpBaseOfDll=0x71d20000, SizeOfImage=0x716000, EntryPoint=0x0)) returned 1 [0099.116] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x71d20000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="System.Core.ni.dll") returned 0x12 [0099.116] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x71d20000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Core\\386fde9190d499d6645df8b90eb76242\\System.Core.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.core\\386fde9190d499d6645df8b90eb76242\\system.core.ni.dll")) returned 0x6e [0099.117] GetModuleInformation (in: hProcess=0x304, hModule=0x750d0000, lpmodinfo=0x22829d4, cb=0xc | out: lpmodinfo=0x22829d4*(lpBaseOfDll=0x750d0000, SizeOfImage=0x1cb000, EntryPoint=0x0)) returned 1 [0099.117] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x750d0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="Microsoft.VisualBasic.ni.dll") returned 0x1c [0099.118] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x750d0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Microsoft.V9921e851#\\cfbddeb6e93e8f421b92229b20e51233\\Microsoft.VisualBasic.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\microsoft.v9921e851#\\cfbddeb6e93e8f421b92229b20e51233\\microsoft.visualbasic.ni.dll")) returned 0x81 [0099.118] GetModuleInformation (in: hProcess=0x304, hModule=0x750b0000, lpmodinfo=0x2284bc8, cb=0xc | out: lpmodinfo=0x2284bc8*(lpBaseOfDll=0x750b0000, SizeOfImage=0x13000, EntryPoint=0x750b18f0)) returned 1 [0099.118] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x750b0000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="nlssorting.dll") returned 0xe [0099.119] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x750b0000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\nlssorting.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\nlssorting.dll")) returned 0x3c [0099.119] GetModuleInformation (in: hProcess=0x304, hModule=0x74870000, lpmodinfo=0x2286d18, cb=0xc | out: lpmodinfo=0x2286d18*(lpBaseOfDll=0x74870000, SizeOfImage=0x16000, EntryPoint=0x74872dc3)) returned 1 [0099.120] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x74870000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="CRYPTSP.dll") returned 0xb [0099.120] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x74870000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\system32\\CRYPTSP.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll")) returned 0x1f [0099.121] GetModuleInformation (in: hProcess=0x304, hModule=0x74830000, lpmodinfo=0x2288e24, cb=0xc | out: lpmodinfo=0x2288e24*(lpBaseOfDll=0x74830000, SizeOfImage=0x3b000, EntryPoint=0x7483128d)) returned 1 [0099.121] GetModuleBaseNameW (in: hProcess=0x304, hModule=0x74830000, lpBaseName=0x5d7900, nSize=0x800 | out: lpBaseName="rsaenh.dll") returned 0xa [0099.121] GetModuleFileNameExW (in: hProcess=0x304, hModule=0x74830000, lpFilename=0x5d7900, nSize=0x800 | out: lpFilename="C:\\Windows\\system32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll")) returned 0x1e [0099.126] lstrcpynA (in: lpString1=0x498800, lpString2="??L??RC?Cu??T?????????????V?KBL??Zo?b?i?Nd??ah??t?F???Pdz??E?M???b???????Lc?r???????s???s?", iMaxLength=46 | out: lpString1="??L??RC?Cu??T?????????????V?KBL??Zo?b?i?Nd??a") returned="??L??RC?Cu??T?????????????V?KBL??Zo?b?i?Nd??a" [0099.126] lstrcpynA (in: lpString1=0x498808, lpString2="????h????toK??G?p?bz?y????B????g???v?Y??y?????zW?O?rY?J????G?afn?????z????g?x?av?", iMaxLength=15 | out: lpString1="????h????toK??") returned="????h????toK??" [0099.126] lstrcpynA (in: lpString1=0x498808, lpString2="??????yXnn???J?bGG?Zap????????Uz?Kpd?T???V?Dz??TJ?I??d?Xgo?M?U????xOI??aVe??FC?yw?C", iMaxLength=57 | out: lpString1="??????yXnn???J?bGG?Zap????????Uz?Kpd?T???V?Dz??TJ?I??d?X") returned="??????yXnn???J?bGG?Zap????????Uz?Kpd?T???V?Dz??TJ?I??d?X" [0099.126] lstrcpynA (in: lpString1=0x498814, lpString2="??????????YCK?m??BbN??ao?X?NQ?tt?d????w??C??o?P????YRwR???Tz?iZ??E?Y??", iMaxLength=26 | out: lpString1="??????????YCK?m??BbN??ao?") returned="??????????YCK?m??BbN??ao?" [0099.126] lstrcpynA (in: lpString1=0x49881c, lpString2="?u?d??sY??n?????j?X???enS?at?TI????bOM??p?V????BBECZ????yM?x?o", iMaxLength=47 | out: lpString1="?u?d??sY??n?????j?X???enS?at?TI????bOM??p?V???") returned="?u?d??sY??n?????j?X???enS?at?TI????bOM??p?V???" [0099.126] lstrcpynA (in: lpString1=0x49881c, lpString2="?z??V?J??E?v?BL??Y???I??l????e?r???OB???r???b??J?????Z??Xl??u?", iMaxLength=59 | out: lpString1="?z??V?J??E?v?BL??Y???I??l????e?r???OB???r???b??J?????Z??Xl") returned="?z??V?J??E?v?BL??Y???I??l????e?r???OB???r???b??J?????Z??Xl" [0099.126] lstrcpynA (in: lpString1=0x498830, lpString2="??MsW?Ml?i?l?PdO???U?kzH?UYT?h?yz?b?????iL?", iMaxLength=29 | out: lpString1="??MsW?Ml?i?l?PdO???U?kzH?UYT") returned="??MsW?Ml?i?l?PdO???U?kzH?UYT" [0099.126] lstrcpynA (in: lpString1=0x498828, lpString2="b??Ernv???ab??v??x???fkK?v?md??b??p????????D???e??", iMaxLength=38 | out: lpString1="b??Ernv???ab??v??x???fkK?v?md??b??p??") returned="b??Ernv???ab??v??x???fkK?v?md??b??p??" [0099.126] lstrcpynA (in: lpString1=0x498840, lpString2="?aDZU?E???k??v?C??A?rpN???", iMaxLength=10 | out: lpString1="?aDZU?E??") returned="?aDZU?E??" [0099.127] lstrcpynA (in: lpString1=0x498844, lpString2="???Zx????r?w??v?????T?n", iMaxLength=3 | out: lpString1="??") returned="??" [0099.127] lstrcpynA (in: lpString1=0x498818, lpString2="????I??txXze??gROeed??????????Xl?F????SLJ?e?????k??sQNw?UD????oZw", iMaxLength=1 | out: lpString1="") returned="" [0099.127] lstrcpynA (in: lpString1=0x49884c, lpString2="??", iMaxLength=1 | out: lpString1="") returned="" [0099.127] lstrcpynA (in: lpString1=0x498810, lpString2="??t?n?J?S?P?nFuK?????????Q???bbX??fUR?MJZ????az??s??meen??????lg??G?W?h??", iMaxLength=9 | out: lpString1="??t?n?J?") returned="??t?n?J?" [0099.127] lstrcpynA (in: lpString1=0x4987fc, lpString2="d??i???mVv???I????????????v?zPs?fT??c??D??T???S?Kpt??TPEi?XOH?ifs???Xj???ba??p??A??aU?o????n??", iMaxLength=92 | out: lpString1="d??i???mVv???I????????????v?zPs?fT??c??D??T???S?Kpt??TPEi?XOH?ifs???Xj???ba??p??A??aU?o????") returned="d??i???mVv???I????????????v?zPs?fT??c??D??T???S?Kpt??TPEi?XOH?ifs???Xj???ba??p??A??aU?o????" [0099.127] lstrcpynA (in: lpString1=0x49884c, lpString2="??T?dW????c???w", iMaxLength=9 | out: lpString1="??T?dW??") returned="??T?dW??" [0099.127] lstrcpynA (in: lpString1=0x49884c, lpString2="??", iMaxLength=1 | out: lpString1="") returned="" [0099.127] lstrcpynA (in: lpString1=0x498814, lpString2="??L?VQg???????K??o??Xe?n??S??AzE??G?g?lPi?c?wwGo?LpCvuP??cr??xykO?y?R", iMaxLength=47 | out: lpString1="??L?VQg???????K??o??Xe?n??S??AzE??G?g?lPi?c?ww") returned="??L?VQg???????K??o??Xe?n??S??AzE??G?g?lPi?c?ww" [0099.127] lstrcpynA (in: lpString1=0x498800, lpString2="R???pn?lTP?E?i??????WX??tEE????????N????o????????????????d?????MD?ZYgig??????epg??B?ceJj?s?", iMaxLength=42 | out: lpString1="R???pn?lTP?E?i??????WX??tEE????????N????o") returned="R???pn?lTP?E?i??????WX??tEE????????N????o" [0099.127] lstrcpynA (in: lpString1=0x49884c, lpString2="pS", iMaxLength=1 | out: lpString1="") returned="" [0099.127] lstrcpynA (in: lpString1=0x498824, lpString2="U????d?TWd?t?gB??TSQR?tJ????Kj??f?M???R??????MX?????", iMaxLength=12 | out: lpString1="U????d?TWd?") returned="U????d?TWd?" [0099.127] lstrcpynA (in: lpString1=0x498808, lpString2="?jvSP??s?R?d????eXBK?yLQQ?J???EJS?L????c?????PTg????D?????sNTr??e??is?va?ELC?????", iMaxLength=20 | out: lpString1="?jvSP??s?R?d????eXB") returned="?jvSP??s?R?d????eXB" [0099.127] lstrcpynA (in: lpString1=0x498818, lpString2="CtC??y??b???????nrr??ia???fYc?rt?U??LKR??E?DV?s??XVm?H?G??l????L??I", iMaxLength=16 | out: lpString1="CtC??y??b??????") returned="CtC??y??b??????" [0099.127] lstrcpynA (in: lpString1=0x49884c, lpString2="??nt???ha?x??C", iMaxLength=11 | out: lpString1="??nt???ha?") returned="??nt???ha?" [0099.127] lstrcpynA (in: lpString1=0x49882c, lpString2="U??mF?t?nN?x??ST?M?Sn?v?oi????s????????SwtUF?", iMaxLength=41 | out: lpString1="U??mF?t?nN?x??ST?M?Sn?v?oi????s????????S") returned="U??mF?t?nN?x??ST?M?Sn?v?oi????s????????S" [0099.127] lstrcpynA (in: lpString1=0x498844, lpString2="??KI?ECX?kUhs?WF?bpw", iMaxLength=10 | out: lpString1="??KI?ECX?") returned="??KI?ECX?" [0099.127] lstrcpynA (in: lpString1=0x4987f8, lpString2="?Ac??sloB?Jk????B???xb?Fy?o??D???Z??o????n?HFs??Q??t???YX???rMkst?UF?I???v????w?Ka?Z??hZ??OQT???o?", iMaxLength=32 | out: lpString1="?Ac??sloB?Jk????B???xb?Fy?o??D?") returned="?Ac??sloB?Jk????B???xb?Fy?o??D?" [0099.127] lstrcpynA (in: lpString1=0x49883c, lpString2="b?o?h?w?????????HGH??Q?RHQ???", iMaxLength=26 | out: lpString1="b?o?h?w?????????HGH??Q?RH") returned="b?o?h?w?????????HGH??Q?RH" [0099.128] lstrcpynA (in: lpString1=0x49884c, lpString2="a??S???L???Z?", iMaxLength=3 | out: lpString1="a?") returned="a?" [0099.128] lstrcmpiA (lpString1="??L??RC?Cu??T?????????????V?KBL??Zo?b?i?Nd??a45", lpString2="????h????toK??14") returned 1 [0099.128] lstrcmpiA (lpString1="????h????toK??14", lpString2="??????yXnn???J?bGG?Zap????????Uz?Kpd?T???V?Dz??TJ?I??d?X56") returned 1 [0099.128] lstrcmpiA (lpString1="??????yXnn???J?bGG?Zap????????Uz?Kpd?T???V?Dz??TJ?I??d?X56", lpString2="??????????YCK?m??BbN??ao?25") returned 1 [0099.128] lstrcmpiA (lpString1="??????????YCK?m??BbN??ao?25", lpString2="?u?d??sY??n?????j?X???enS?at?TI????bOM??p?V???46") returned -1 [0099.128] lstrcmpiA (lpString1="?u?d??sY??n?????j?X???enS?at?TI????bOM??p?V???46", lpString2="?z??V?J??E?v?BL??Y???I??l????e?r???OB???r???b??J?????Z??Xl58") returned -1 [0099.128] lstrcmpiA (lpString1="?z??V?J??E?v?BL??Y???I??l????e?r???OB???r???b??J?????Z??Xl58", lpString2="??MsW?Ml?i?l?PdO???U?kzH?UYT28") returned 1 [0099.128] lstrcmpiA (lpString1="??MsW?Ml?i?l?PdO???U?kzH?UYT28", lpString2="b??Ernv???ab??v??x???fkK?v?md??b??p??37") returned -1 [0099.128] lstrcmpiA (lpString1="b??Ernv???ab??v??x???fkK?v?md??b??p??37", lpString2="?aDZU?E??9") returned 1 [0099.128] lstrcmpiA (lpString1="?aDZU?E??9", lpString2="??2") returned 1 [0099.128] lstrcmpiA (lpString1="??2", lpString2="0") returned -1 [0099.128] lstrcmpiA (lpString1="0", lpString2="0") returned 0 [0099.128] lstrcmpiA (lpString1="0", lpString2="??t?n?J?8") returned 1 [0099.128] lstrcmpiA (lpString1="??t?n?J?8", lpString2="d??i???mVv???I????????????v?zPs?fT??c??D??T???S?Kpt??TPEi?XOH?ifs???Xj???ba??p??A??aU?o????91") returned -1 [0099.128] lstrcmpiA (lpString1="d??i???mVv???I????????????v?zPs?fT??c??D??T???S?Kpt??TPEi?XOH?ifs???Xj???ba??p??A??aU?o????91", lpString2="??T?dW??8") returned 1 [0099.128] lstrcmpiA (lpString1="??T?dW??8", lpString2="0") returned -1 [0099.128] lstrcmpiA (lpString1="0", lpString2="??L?VQg???????K??o??Xe?n??S??AzE??G?g?lPi?c?ww46") returned 1 [0099.128] lstrcmpiA (lpString1="??L?VQg???????K??o??Xe?n??S??AzE??G?g?lPi?c?ww46", lpString2="R???pn?lTP?E?i??????WX??tEE????????N????o41") returned -1 [0099.128] lstrcmpiA (lpString1="R???pn?lTP?E?i??????WX??tEE????????N????o41", lpString2="0") returned 1 [0099.128] lstrcmpiA (lpString1="0", lpString2="U????d?TWd?11") returned -1 [0099.128] lstrcmpiA (lpString1="U????d?TWd?11", lpString2="?jvSP??s?R?d????eXB19") returned 1 [0099.128] lstrcmpiA (lpString1="?jvSP??s?R?d????eXB19", lpString2="CtC??y??b??????15") returned -1 [0099.128] lstrcmpiA (lpString1="CtC??y??b??????15", lpString2="??nt???ha?10") returned 1 [0099.128] lstrcmpiA (lpString1="??nt???ha?10", lpString2="U??mF?t?nN?x??ST?M?Sn?v?oi????s????????S40") returned -1 [0099.128] lstrcmpiA (lpString1="U??mF?t?nN?x??ST?M?Sn?v?oi????s????????S40", lpString2="??KI?ECX?9") returned 1 [0099.128] lstrcmpiA (lpString1="??KI?ECX?9", lpString2="?Ac??sloB?Jk????B???xb?Fy?o??D?31") returned -1 [0099.128] lstrcmpiA (lpString1="?Ac??sloB?Jk????B???xb?Fy?o??D?31", lpString2="b?o?h?w?????????HGH??Q?RH25") returned -1 [0099.128] lstrcmpiA (lpString1="b?o?h?w?????????HGH??Q?RH25", lpString2="a?2") returned 1 [0099.128] lstrcmpiA (lpString1="a?2", lpString2="a?2") returned 0 [0099.129] SetThreadContext (hThread=0x2f8, lpContext=0x21cfeb8*(ContextFlags=0x10002, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, FloatSave.ControlWord=0x0, FloatSave.StatusWord=0x0, FloatSave.TagWord=0x0, FloatSave.ErrorOffset=0x0, FloatSave.ErrorSelector=0x0, FloatSave.DataOffset=0x0, FloatSave.DataSelector=0x0, FloatSave.RegisterArea=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0), FloatSave.Cr0NpxState=0x0, SegGs=0x0, SegFs=0x0, SegEs=0x0, SegDs=0x0, Edi=0x0, Esi=0x0, Ebx=0x7efde000, Edx=0x0, Ecx=0x0, Eax=0x40a9d0, Ebp=0x0, Eip=0x0, SegCs=0x0, EFlags=0x0, Esp=0x0, SegSs=0x0, ExtendedRegisters=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0, [192]=0x0, [193]=0x0, [194]=0x0, [195]=0x0, [196]=0x0, [197]=0x0, [198]=0x0, [199]=0x0, [200]=0x0, [201]=0x0, [202]=0x0, [203]=0x0, [204]=0x0, [205]=0x0, [206]=0x0, [207]=0x0, [208]=0x0, [209]=0x0, [210]=0x0, [211]=0x0, [212]=0x0, [213]=0x0, [214]=0x0, [215]=0x0, [216]=0x0, [217]=0x0, [218]=0x0, [219]=0x0, [220]=0x0, [221]=0x0, [222]=0x0, [223]=0x0, [224]=0x0, [225]=0x0, [226]=0x0, [227]=0x0, [228]=0x0, [229]=0x0, [230]=0x0, [231]=0x0, [232]=0x0, [233]=0x0, [234]=0x0, [235]=0x0, [236]=0x0, [237]=0x0, [238]=0x0, [239]=0x0, [240]=0x0, [241]=0x0, [242]=0x0, [243]=0x0, [244]=0x0, [245]=0x0, [246]=0x0, [247]=0x0, [248]=0x0, [249]=0x0, [250]=0x0, [251]=0x0, [252]=0x0, [253]=0x0, [254]=0x0, [255]=0x0, [256]=0x0, [257]=0x0, [258]=0x0, [259]=0x0, [260]=0x0, [261]=0x0, [262]=0x0, [263]=0x0, [264]=0x0, [265]=0x0, [266]=0x0, [267]=0x0, [268]=0x0, [269]=0x0, [270]=0x0, [271]=0x0, [272]=0x0, [273]=0x0, [274]=0x0, [275]=0x0, [276]=0x0, [277]=0x0, [278]=0x0, [279]=0x0, [280]=0x0, [281]=0x0, [282]=0x0, [283]=0x0, [284]=0x0, [285]=0x0, [286]=0x0, [287]=0x0, [288]=0x0, [289]=0x0, [290]=0x0, [291]=0x0, [292]=0x0, [293]=0x0, [294]=0x0, [295]=0x0, [296]=0x0, [297]=0x0, [298]=0x0, [299]=0x0, [300]=0x0, [301]=0x0, [302]=0x0, [303]=0x0, [304]=0x0, [305]=0x0, [306]=0x0, [307]=0x0, [308]=0x0, [309]=0x0, [310]=0x0, [311]=0x0, [312]=0x0, [313]=0x0, [314]=0x0, [315]=0x0, [316]=0x0, [317]=0x0, [318]=0x0, [319]=0x0, [320]=0x0, [321]=0x0, [322]=0x0, [323]=0x0, [324]=0x0, [325]=0x0, [326]=0x0, [327]=0x0, [328]=0x0, [329]=0x0, [330]=0x0, [331]=0x0, [332]=0x0, [333]=0x0, [334]=0x0, [335]=0x0, [336]=0x0, [337]=0x0, [338]=0x0, [339]=0x0, [340]=0x0, [341]=0x0, [342]=0x0, [343]=0x0, [344]=0x0, [345]=0x0, [346]=0x0, [347]=0x0, [348]=0x0, [349]=0x0, [350]=0x0, [351]=0x0, [352]=0x0, [353]=0x0, [354]=0x0, [355]=0x0, [356]=0x0, [357]=0x0, [358]=0x0, [359]=0x0, [360]=0x0, [361]=0x0, [362]=0x0, [363]=0x0, [364]=0x0, [365]=0x0, [366]=0x0, [367]=0x0, [368]=0x0, [369]=0x0, [370]=0x0, [371]=0x0, [372]=0x0, [373]=0x0, [374]=0x0, [375]=0x0, [376]=0x0, [377]=0x0, [378]=0x0, [379]=0x0, [380]=0x0, [381]=0x0, [382]=0x0, [383]=0x0, [384]=0x0, [385]=0x0, [386]=0x0, [387]=0x0, [388]=0x0, [389]=0x0, [390]=0x0, [391]=0x0, [392]=0x0, [393]=0x0, [394]=0x0, [395]=0x0, [396]=0x0, [397]=0x0, [398]=0x0, [399]=0x0, [400]=0x0, [401]=0x0, [402]=0x0, [403]=0x0, [404]=0x0, [405]=0x0, [406]=0x0, [407]=0x0, [408]=0x0, [409]=0x0, [410]=0x0, [411]=0x0, [412]=0x0, [413]=0x0, [414]=0x0, [415]=0x0, [416]=0x0, [417]=0x0, [418]=0x0, [419]=0x0, [420]=0x0, [421]=0x0, [422]=0x0, [423]=0x0, [424]=0x0, [425]=0x0, [426]=0x0, [427]=0x0, [428]=0x0, [429]=0x0, [430]=0x0, [431]=0x0, [432]=0x0, [433]=0x0, [434]=0x0, [435]=0x0, [436]=0x0, [437]=0x0, [438]=0x0, [439]=0x0, [440]=0x0, [441]=0x0, [442]=0x0, [443]=0x0, [444]=0x0, [445]=0x0, [446]=0x0, [447]=0x0, [448]=0x0, [449]=0x0, [450]=0x0, [451]=0x0, [452]=0x0, [453]=0x0, [454]=0x0, [455]=0x0, [456]=0x0, [457]=0x0, [458]=0x0, [459]=0x0, [460]=0x0, [461]=0x0, [462]=0x0, [463]=0x0, [464]=0x0, [465]=0x0, [466]=0x0, [467]=0x0, [468]=0x0, [469]=0x0, [470]=0x0, [471]=0x0, [472]=0x0, [473]=0x0, [474]=0x0, [475]=0x0, [476]=0x0, [477]=0x0, [478]=0x0, [479]=0x0, [480]=0x0, [481]=0x0, [482]=0x0, [483]=0x0, [484]=0x0, [485]=0x0, [486]=0x0, [487]=0x0, [488]=0x0, [489]=0x0, [490]=0x0, [491]=0x0, [492]=0x0, [493]=0x0, [494]=0x0, [495]=0x0, [496]=0x0, [497]=0x0, [498]=0x0, [499]=0x0, [500]=0x0, [501]=0x0, [502]=0x0, [503]=0x0, [504]=0x0, [505]=0x0, [506]=0x0, [507]=0x0, [508]=0x0, [509]=0x0, [510]=0x0, [511]=0x0))) returned 1 [0099.129] GetCurrentProcessId () returned 0x9f8 [0099.130] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x9f8) returned 0x304 [0099.132] CloseHandle (hObject=0x304) returned 1 [0099.144] lstrcpynA (in: lpString1=0x499094, lpString2="uu???UZ?b??S??X?D?p?AJy?????U??spaS??eFe??c??LS?????h?O?w?u?", iMaxLength=27 | out: lpString1="uu???UZ?b??S??X?D?p?AJy???") returned="uu???UZ?b??S??X?D?p?AJy???" [0099.144] lstrcpynA (in: lpString1=0x499098, lpString2="??ELN??A?i?XclXxjd?N?p?g???Y???uN?z?j?Aos?aow???I?JG?i??", iMaxLength=46 | out: lpString1="??ELN??A?i?XclXxjd?N?p?g???Y???uN?z?j?Aos?aow") returned="??ELN??A?i?XclXxjd?N?p?g???Y???uN?z?j?Aos?aow" [0099.144] lstrcpynA (in: lpString1=0x499080, lpString2="T?G???????tv??Fr??f?f??s?Q?K???eJ???AI?f?????x??????e????RSYB????r?Pp???F??l?KES", iMaxLength=54 | out: lpString1="T?G???????tv??Fr??f?f??s?Q?K???eJ???AI?f?????x??????e") returned="T?G???????tv??Fr??f?f??s?Q?K???eJ???AI?f?????x??????e" [0099.144] lstrcpynA (in: lpString1=0x49907c, lpString2="?????Ydo?P?FkK??FR??l??e???jw???????rl?????yS?w??V?Bc???B??Y??i??uZn?s?c??J?W??p?E??ez?", iMaxLength=25 | out: lpString1="?????Ydo?P?FkK??FR??l??e") returned="?????Ydo?P?FkK??FR??l??e" [0099.144] lstrcpynA (in: lpString1=0x4990b0, lpString2="ybWE???SYT??B???KPm??I??DH????f???", iMaxLength=26 | out: lpString1="ybWE???SYT??B???KPm??I??D") returned="ybWE???SYT??B???KPm??I??D" [0099.144] lstrcpynA (in: lpString1=0x499098, lpString2="???QN???b?m?s?wm??P??Ph???k?????j??Ox??p??l??i?h??Ow?t?C", iMaxLength=44 | out: lpString1="???QN???b?m?s?wm??P??Ph???k?????j??Ox??p??l") returned="???QN???b?m?s?wm??P??Ph???k?????j??Ox??p??l" [0099.144] lstrcpynA (in: lpString1=0x499088, lpString2="????lCKOX?u??W?il?d?br?YL?gdzc??mdXoP?DD?b?Y??d???Tl????sOkSIYjmW????M??S?t", iMaxLength=74 | out: lpString1="????lCKOX?u??W?il?d?br?YL?gdzc??mdXoP?DD?b?Y??d???Tl????sOkSIYjmW????M??S") returned="????lCKOX?u??W?il?d?br?YL?gdzc??mdXoP?DD?b?Y??d???Tl????sOkSIYjmW????M??S" [0099.144] lstrcpynA (in: lpString1=0x499090, lpString2="??????Gr????e?wuBo?ys?I?p??????J??T????O??fYs??yA????????y??v?U??L?", iMaxLength=27 | out: lpString1="??????Gr????e?wuBo?ys?I?p?") returned="??????Gr????e?wuBo?ys?I?p?" [0099.145] lstrcpynA (in: lpString1=0x4990a8, lpString2="??Wl??r??a??ta???yYj?v?dLmDU??G??P?V?Z?bB?", iMaxLength=37 | out: lpString1="??Wl??r??a??ta???yYj?v?dLmDU??G??P?V") returned="??Wl??r??a??ta???yYj?v?dLmDU??G??P?V" [0099.145] lstrcpynA (in: lpString1=0x499070, lpString2="E?J??H?O???h?C????????nmy?po?aPl?Z?????????F?B?????Y??J??k??I???R??ZN???g?itY?????GyZyWtt?k?z???r?s", iMaxLength=17 | out: lpString1="E?J??H?O???h?C??") returned="E?J??H?O???h?C??" [0099.145] lstrcpynA (in: lpString1=0x4990c4, lpString2="???kc?DT??k???", iMaxLength=8 | out: lpString1="???kc?D") returned="???kc?D" [0099.145] lstrcpynA (in: lpString1=0x4990b0, lpString2="?J??a??tfe??F??L?n??i??n?fr??Z?H", iMaxLength=28 | out: lpString1="?J??a??tfe??F??L?n??i??n?fr") returned="?J??a??tfe??F??L?n??i??n?fr" [0099.145] lstrcpynA (in: lpString1=0x49907c, lpString2="lb?i?kBS??SMxXfF?SY???x???s??b??U?QR??R?oZ??????Uk???MnKt?G?u?????zUx??QoG?UI?xjO??Z?G", iMaxLength=77 | out: lpString1="lb?i?kBS??SMxXfF?SY???x???s??b??U?QR??R?oZ??????Uk???MnKt?G?u?????zUx??QoG?U") returned="lb?i?kBS??SMxXfF?SY???x???s??b??U?QR??R?oZ??????Uk???MnKt?G?u?????zUx??QoG?U" [0099.145] lstrcpynA (in: lpString1=0x49907c, lpString2="m?nB?K????BRKCUJ?E??s??n??EZ???F?S?ce????O?b?ycufR??S???a??Jhmdcis?i?sG???Y??C??DbU??", iMaxLength=22 | out: lpString1="m?nB?K????BRKCUJ?E??s") returned="m?nB?K????BRKCUJ?E??s" [0099.145] lstrcpynA (in: lpString1=0x49909c, lpString2="?dr?gB?v?k?LhIr?e?G?????Cy?????p????Ds????OY?fn?T??J?S?", iMaxLength=9 | out: lpString1="?dr?gB?v") returned="?dr?gB?v" [0099.145] lstrcpynA (in: lpString1=0x4990b0, lpString2="p???dH????r??T??H?V?O?r???NX???????", iMaxLength=3 | out: lpString1="p?") returned="p?" [0099.145] lstrcpynA (in: lpString1=0x4990c0, lpString2="?A??CWz?f??R?e?uE??", iMaxLength=1 | out: lpString1="") returned="" [0099.145] lstrcpynA (in: lpString1=0x4990c0, lpString2="?????z??Z?H?F?T?", iMaxLength=7 | out: lpString1="?????z") returned="?????z" [0099.145] lstrcpynA (in: lpString1=0x4990b0, lpString2="???e???F?????k????C?BzE?T??F??L??", iMaxLength=19 | out: lpString1="???e???F?????k????") returned="???e???F?????k????" [0099.145] lstrcpynA (in: lpString1=0x4990c4, lpString2="????Hg", iMaxLength=5 | out: lpString1="????") returned="????" [0099.145] lstrcpynA (in: lpString1=0x4990a0, lpString2="vhXd?lU?H???yCJH?sMKC??????cpyFn?rHn???Px?PNcf?Cd?", iMaxLength=19 | out: lpString1="vhXd?lU?H???yCJH?s") returned="vhXd?lU?H???yCJH?s" [0099.145] lstrcpynA (in: lpString1=0x4990c0, lpString2="s??????d?AD?yriz?", iMaxLength=1 | out: lpString1="") returned="" [0099.145] lstrcpynA (in: lpString1=0x4990bc, lpString2="?bu??rbap??o????wP??", iMaxLength=2 | out: lpString1="?") returned="?" [0099.145] lstrcpynA (in: lpString1=0x4990c4, lpString2="?p?G?EKMw?K", iMaxLength=5 | out: lpString1="?p?G") returned="?p?G" [0099.145] lstrcpynA (in: lpString1=0x499078, lpString2="?Je?????sX????Xg?b?h?c?k?Api??z?yLxLofJO????G??????P???????F????E??DUei???W?N??J?a??o?Dn???", iMaxLength=18 | out: lpString1="?Je?????sX????Xg?") returned="?Je?????sX????Xg?" [0099.145] lstrcpynA (in: lpString1=0x499098, lpString2="F?W???D????????l?o???dl?LP?V?l???s?cbvp?SK??DCF?F?Eh?F?E", iMaxLength=30 | out: lpString1="F?W???D????????l?o???dl?LP?V?") returned="F?W???D????????l?o???dl?LP?V?" [0099.145] lstrcpynA (in: lpString1=0x4990a8, lpString2="Y?yM?c???V?N??KIWnj???pE????c??N??DXFNek?N?", iMaxLength=39 | out: lpString1="Y?yM?c???V?N??KIWnj???pE????c??N??DXFN") returned="Y?yM?c???V?N??KIWnj???pE????c??N??DXFN" [0099.146] lstrcpynA (in: lpString1=0x4990c4, lpString2="???wF?G?J???mY", iMaxLength=3 | out: lpString1="??") returned="??" [0099.146] lstrcpynA (in: lpString1=0x499084, lpString2="??G????b?Q??k?d?W???O??v?????????k?W?u??nk?h?K?iN?t?cX??ol?MV?Xg??jw???v???lkZ", iMaxLength=21 | out: lpString1="??G????b?Q??k?d?W???") returned="??G????b?Q??k?d?W???" [0099.146] lstrcpynA (in: lpString1=0x4990a4, lpString2="?v?????Rx?K?YP???aE?O???hA?G???a??NmU?P?G??x???", iMaxLength=7 | out: lpString1="?v????") returned="?v????" [0099.146] lstrcpynA (in: lpString1=0x499078, lpString2="vJkc?K??Q?S???O?D??R???J???rk???????????U?axt?nV?rYO?KdC??Ci?????L??u???G????XD??W?h??a??O", iMaxLength=83 | out: lpString1="vJkc?K??Q?S???O?D??R???J???rk???????????U?axt?nV?rYO?KdC??Ci?????L??u???G????XD??W") returned="vJkc?K??Q?S???O?D??R???J???rk???????????U?axt?nV?rYO?KdC??Ci?????L??u???G????XD??W" [0099.146] lstrcpynA (in: lpString1=0x4990a4, lpString2="gPm???x?J????zZv?C??X???ibOsi???b????g???v????", iMaxLength=26 | out: lpString1="gPm???x?J????zZv?C??X???i") returned="gPm???x?J????zZv?C??X???i" [0099.146] lstrcpynA (in: lpString1=0x4990a0, lpString2="??m?o????TJpB?F??o???????m???A?K??xf?S???t??A??Tv", iMaxLength=44 | out: lpString1="??m?o????TJpB?F??o???????m???A?K??xf?S???t?") returned="??m?o????TJpB?F??o???????m???A?K??xf?S???t?" [0099.146] lstrcpynA (in: lpString1=0x4990b0, lpString2="?ewiNk????m??b?MQpvR??????i?K?tpht", iMaxLength=13 | out: lpString1="?ewiNk????m?") returned="?ewiNk????m?" [0099.146] lstrcpynA (in: lpString1=0x4990c4, lpString2="cx??e", iMaxLength=2 | out: lpString1="c") returned="c" [0099.146] lstrcpynA (in: lpString1=0x4990b0, lpString2="?????uT???rU?sX?p?j???PUx?eU??k?", iMaxLength=24 | out: lpString1="?????uT???rU?sX?p?j???P") returned="?????uT???rU?sX?p?j???P" [0099.146] lstrcpynA (in: lpString1=0x49909c, lpString2="??bt?S??k?Qa?D??T?K?????t?u?VB????aY?f??pAjX???G??Gn??", iMaxLength=49 | out: lpString1="??bt?S??k?Qa?D??T?K?????t?u?VB????aY?f??pAjX???G") returned="??bt?S??k?Qa?D??T?K?????t?u?VB????aY?f??pAjX???G" [0099.146] lstrcpynA (in: lpString1=0x4990b8, lpString2="??U???TC??R?sk???AVXTdO???p", iMaxLength=9 | out: lpString1="??U???TC") returned="??U???TC" [0099.146] lstrcpynA (in: lpString1=0x499074, lpString2="pEEf?Jl?CjUK?dQ?nAuP???w???e???L??xM?yjL??eT??S??V?e?DD??Wmc?jr?n?Mn???xx??t?JrxY?SO??X??????", iMaxLength=88 | out: lpString1="pEEf?Jl?CjUK?dQ?nAuP???w???e???L??xM?yjL??eT??S??V?e?DD??Wmc?jr?n?Mn???xx??t?JrxY?SO??X") returned="pEEf?Jl?CjUK?dQ?nAuP???w???e???L??xM?yjL??eT??S??V?e?DD??Wmc?jr?n?Mn???xx??t?JrxY?SO??X" [0099.146] lstrcpynA (in: lpString1=0x499098, lpString2="YisOf?????A?P?Tmy?????I???W??GQa??DA??zIX?apahl??C?y???A", iMaxLength=43 | out: lpString1="YisOf?????A?P?Tmy?????I???W??GQa??DA??zIX?") returned="YisOf?????A?P?Tmy?????I???W??GQa??DA??zIX?" [0099.146] lstrcpynA (in: lpString1=0x4990ac, lpString2="???J?Q????Ol??BT?nV??NX??cSy?e?FB???", iMaxLength=23 | out: lpString1="???J?Q????Ol??BT?nV??N") returned="???J?Q????Ol??BT?nV??N" [0099.146] lstrcpynA (in: lpString1=0x49907c, lpString2="cDW?g?IWo?M?c??r?Y????x?B??????k???Yb????s?a??l?t??L?e?Yl?nx?D?s?O??E????????s???p??dE", iMaxLength=19 | out: lpString1="cDW?g?IWo?M?c??r?Y") returned="cDW?g?IWo?M?c??r?Y" [0099.146] lstrcpynA (in: lpString1=0x4990b8, lpString2="g??Oy???jIj?B??d?o?lDo??K?", iMaxLength=11 | out: lpString1="g??Oy???jI") returned="g??Oy???jI" [0099.146] lstrcpynA (in: lpString1=0x49908c, lpString2="aay?LPm???Eu??DY?Z???lIM?u???Qz??Bni?Mz??iR??IgwBdzr??u???iF?Z???Ol??Y?", iMaxLength=16 | out: lpString1="aay?LPm???Eu??D") returned="aay?LPm???Eu??D" [0099.147] lstrcpynA (in: lpString1=0x4990c4, lpString2="???????V?ijW", iMaxLength=10 | out: lpString1="???????V?") returned="???????V?" [0099.147] lstrcpynA (in: lpString1=0x4990b8, lpString2="?L?n?????h??lS????Mr?aVX??", iMaxLength=20 | out: lpString1="?L?n?????h??lS????M") returned="?L?n?????h??lS????M" [0099.147] lstrcpynA (in: lpString1=0x4990c4, lpString2="Rzme??", iMaxLength=2 | out: lpString1="R") returned="R" [0099.147] lstrcpynA (in: lpString1=0x4990c4, lpString2="Yx??HPY?fF?t?RU", iMaxLength=12 | out: lpString1="Yx??HPY?fF?") returned="Yx??HPY?fF?" [0099.147] lstrcpynA (in: lpString1=0x49909c, lpString2="??d???BPjNfV?TO??c?uH?UNHPQW??a???s?zQF??who??A?????aZ", iMaxLength=11 | out: lpString1="??d???BPjN") returned="??d???BPjN" [0099.147] lstrcpynA (in: lpString1=0x499090, lpString2="?T?bFXHR??x????ThH?nMB????I???PYy??a???????H??????Y?RQWcYQ??g?????", iMaxLength=53 | out: lpString1="?T?bFXHR??x????ThH?nMB????I???PYy??a???????H??????Y?") returned="?T?bFXHR??x????ThH?nMB????I???PYy??a???????H??????Y?" [0099.147] lstrcpynA (in: lpString1=0x499084, lpString2="OX?????????V??A?r?YM??g???I??????t??lX??Q?L?R?E??n??????I?E?CJ?k????M?P?a?mb", iMaxLength=28 | out: lpString1="OX?????????V??A?r?YM??g???I") returned="OX?????????V??A?r?YM??g???I" [0099.147] lstrcpynA (in: lpString1=0x499078, lpString2="??r??w?Gs??Ozik??EeVx?oh?T?hF?x?ODf?G?S??v???e?t?H?jOz??????d?eG???????b?m??o?T?????my?j?l", iMaxLength=81 | out: lpString1="??r??w?Gs??Ozik??EeVx?oh?T?hF?x?ODf?G?S??v???e?t?H?jOz??????d?eG???????b?m??o?T?") returned="??r??w?Gs??Ozik??EeVx?oh?T?hF?x?ODf?G?S??v???e?t?H?jOz??????d?eG???????b?m??o?T?" [0099.147] lstrcpynA (in: lpString1=0x499088, lpString2="?dcb?Yr?pi?Gmp???d???WYtj???E??oPx?C?????k??k?????T??b???lo?HzCU??yy?R?tg??", iMaxLength=48 | out: lpString1="?dcb?Yr?pi?Gmp???d???WYtj???E??oPx?C?????k??k??") returned="?dcb?Yr?pi?Gmp???d???WYtj???E??oPx?C?????k??k??" [0099.147] lstrcpynA (in: lpString1=0x499078, lpString2="Y?PLX??Tdmi???g????yL??oE?W?zKSyoY??i?e???????PQ?eh????McEk?Sfs??r?Lwm????X??????w?lEChD", iMaxLength=67 | out: lpString1="Y?PLX??Tdmi???g????yL??oE?W?zKSyoY??i?e???????PQ?eh????McEk?Sfs??r") returned="Y?PLX??Tdmi???g????yL??oE?W?zKSyoY??i?e???????PQ?eh????McEk?Sfs??r" [0099.147] lstrcpynA (in: lpString1=0x499080, lpString2="??B?Bn??v?Q?NnbhG??W???AV????c????UQK???wsK????ynw?h??li?fg????wA?P?????v?Q?QU??W?", iMaxLength=24 | out: lpString1="??B?Bn??v?Q?NnbhG??W???") returned="??B?Bn??v?Q?NnbhG??W???" [0099.147] lstrcpynA (in: lpString1=0x4990a0, lpString2="???m?Y?????JGm?ydWR???I??P??RTz????So?D??m??p??A", iMaxLength=42 | out: lpString1="???m?Y?????JGm?ydWR???I??P??RTz????So?D??") returned="???m?Y?????JGm?ydWR???I??P??RTz????So?D??" [0099.147] lstrcpynA (in: lpString1=0x4990c4, lpString2="?????t", iMaxLength=2 | out: lpString1="?") returned="?" [0099.147] lstrcpynA (in: lpString1=0x4990c4, lpString2="??X????P?Z???", iMaxLength=9 | out: lpString1="??X????P") returned="??X????P" [0099.147] lstrcpynA (in: lpString1=0x4990a0, lpString2="?LY?o?fifI??yG????cYYPC??m?k????a?X?VZ??O??E???y??", iMaxLength=7 | out: lpString1="?LY?o?") returned="?LY?o?" [0099.147] lstrcpynA (in: lpString1=0x4990b0, lpString2="W???k???cz?????eXW?K???xj?I?Q?????P", iMaxLength=25 | out: lpString1="W???k???cz?????eXW?K???x") returned="W???k???cz?????eXW?K???x" [0099.147] lstrcpynA (in: lpString1=0x4990b8, lpString2="??F?I??kMs???X?L???SE?w?", iMaxLength=6 | out: lpString1="??F?I") returned="??F?I" [0099.147] lstrcpynA (in: lpString1=0x499074, lpString2="?nErM?t????CC???PX?v?J??v?wE??G???GE??f?Ke??RC???xM????M?H?????y????B??CO???????????z??xD???oA?", iMaxLength=55 | out: lpString1="?nErM?t????CC???PX?v?J??v?wE??G???GE??f?Ke??RC???xM???") returned="?nErM?t????CC???PX?v?J??v?wE??G???GE??f?Ke??RC???xM???" [0099.148] lstrcpynA (in: lpString1=0x4990c0, lpString2="??Ougct???????io?I?", iMaxLength=16 | out: lpString1="??Ougct???????i") returned="??Ougct???????i" [0099.148] lstrcpynA (in: lpString1=0x4990b0, lpString2="P???G?oEd??u?M?Z?h?tIKp??wR?O??dM??", iMaxLength=18 | out: lpString1="P???G?oEd??u?M?Z?") returned="P???G?oEd??u?M?Z?" [0099.148] lstrcpynA (in: lpString1=0x49908c, lpString2="?X???b?z???C?gjo?Mb?F????s??K??T?NC???z?k???Xio?A?os?wJ???m??u?xw??D?", iMaxLength=34 | out: lpString1="?X???b?z???C?gjo?Mb?F????s??K??T?") returned="?X???b?z???C?gjo?Mb?F????s??K??T?" [0099.148] lstrcpynA (in: lpString1=0x4990b4, lpString2="???dp??r?P?Z?D?p???OF?si????", iMaxLength=20 | out: lpString1="???dp??r?P?Z?D?p???") returned="???dp??r?P?Z?D?p???" [0099.148] lstrcpynA (in: lpString1=0x4990c4, lpString2="??G", iMaxLength=1 | out: lpString1="") returned="" [0099.148] lstrcpynA (in: lpString1=0x499088, lpString2="k??k???jS?Tk??j???M???gOU???o?Kn?s????Gx?KM??hj?????NfxG???TetpFZuA???C?f", iMaxLength=20 | out: lpString1="k??k???jS?Tk??j???M") returned="k??k???jS?Tk??j???M" [0099.148] lstrcpynA (in: lpString1=0x4990ac, lpString2="C?lJHEbAZ????kr?sz?PdDN???y???zz??f??", iMaxLength=33 | out: lpString1="C?lJHEbAZ????kr?sz?PdDN???y???zz") returned="C?lJHEbAZ????kr?sz?PdDN???y???zz" [0099.148] lstrcpynA (in: lpString1=0x49907c, lpString2="twI??YDZ?egO?YaKF??b???????tSbb??NpSlW???p??u?p?tFLah?j???r??Oo???N?b?Qf??????????w??gK", iMaxLength=23 | out: lpString1="twI??YDZ?egO?YaKF??b??") returned="twI??YDZ?egO?YaKF??b??" [0099.148] lstrcpynA (in: lpString1=0x499080, lpString2="?nz?BetuNM??UgUlkg???fD?yOa??Rxx?????Ei???jTTE????Qk???L?S?j?iGcYM?GZKZ?i?gT?p???Q", iMaxLength=35 | out: lpString1="?nz?BetuNM??UgUlkg???fD?yOa??Rxx??") returned="?nz?BetuNM??UgUlkg???fD?yOa??Rxx??" [0099.148] lstrcpynA (in: lpString1=0x4990c4, lpString2="G??", iMaxLength=1 | out: lpString1="") returned="" [0099.149] lstrcmpiA (lpString1="uu???UZ?b??S??X?D?p?AJy???26", lpString2="??ELN??A?i?XclXxjd?N?p?g???Y???uN?z?j?Aos?aow45") returned 1 [0099.149] lstrcmpiA (lpString1="??ELN??A?i?XclXxjd?N?p?g???Y???uN?z?j?Aos?aow45", lpString2="T?G???????tv??Fr??f?f??s?Q?K???eJ???AI?f?????x??????e53") returned -1 [0099.149] lstrcmpiA (lpString1="T?G???????tv??Fr??f?f??s?Q?K???eJ???AI?f?????x??????e53", lpString2="?????Ydo?P?FkK??FR??l??e24") returned 1 [0099.149] lstrcmpiA (lpString1="?????Ydo?P?FkK??FR??l??e24", lpString2="ybWE???SYT??B???KPm??I??D25") returned -1 [0099.149] lstrcmpiA (lpString1="ybWE???SYT??B???KPm??I??D25", lpString2="???QN???b?m?s?wm??P??Ph???k?????j??Ox??p??l43") returned 1 [0099.149] lstrcmpiA (lpString1="???QN???b?m?s?wm??P??Ph???k?????j??Ox??p??l43", lpString2="????lCKOX?u??W?il?d?br?YL?gdzc??mdXoP?DD?b?Y??d???Tl????sOkSIYjmW????M??S73") returned 1 [0099.149] lstrcmpiA (lpString1="????lCKOX?u??W?il?d?br?YL?gdzc??mdXoP?DD?b?Y??d???Tl????sOkSIYjmW????M??S73", lpString2="??????Gr????e?wuBo?ys?I?p?26") returned 1 [0099.149] lstrcmpiA (lpString1="??????Gr????e?wuBo?ys?I?p?26", lpString2="??Wl??r??a??ta???yYj?v?dLmDU??G??P?V36") returned -1 [0099.149] lstrcmpiA (lpString1="??Wl??r??a??ta???yYj?v?dLmDU??G??P?V36", lpString2="E?J??H?O???h?C??16") returned -1 [0099.149] lstrcmpiA (lpString1="E?J??H?O???h?C??16", lpString2="???kc?D7") returned 1 [0099.149] lstrcmpiA (lpString1="???kc?D7", lpString2="?J??a??tfe??F??L?n??i??n?fr27") returned -1 [0099.149] lstrcmpiA (lpString1="?J??a??tfe??F??L?n??i??n?fr27", lpString2="lb?i?kBS??SMxXfF?SY???x???s??b??U?QR??R?oZ??????Uk???MnKt?G?u?????zUx??QoG?U76") returned -1 [0099.149] lstrcmpiA (lpString1="lb?i?kBS??SMxXfF?SY???x???s??b??U?QR??R?oZ??????Uk???MnKt?G?u?????zUx??QoG?U76", lpString2="m?nB?K????BRKCUJ?E??s21") returned -1 [0099.149] lstrcmpiA (lpString1="m?nB?K????BRKCUJ?E??s21", lpString2="?dr?gB?v8") returned 1 [0099.149] lstrcmpiA (lpString1="?dr?gB?v8", lpString2="p?2") returned -1 [0099.149] lstrcmpiA (lpString1="p?2", lpString2="0") returned 1 [0099.149] lstrcmpiA (lpString1="0", lpString2="?????z6") returned 1 [0099.149] lstrcmpiA (lpString1="?????z6", lpString2="???e???F?????k????18") returned -1 [0099.149] lstrcmpiA (lpString1="???e???F?????k????18", lpString2="????4") returned 1 [0099.149] lstrcmpiA (lpString1="????4", lpString2="vhXd?lU?H???yCJH?s18") returned -1 [0099.149] lstrcmpiA (lpString1="vhXd?lU?H???yCJH?s18", lpString2="0") returned 1 [0099.149] lstrcmpiA (lpString1="0", lpString2="?1") returned 1 [0099.149] lstrcmpiA (lpString1="?1", lpString2="?p?G4") returned -1 [0099.149] lstrcmpiA (lpString1="?p?G4", lpString2="?Je?????sX????Xg?17") returned 1 [0099.149] lstrcmpiA (lpString1="?Je?????sX????Xg?17", lpString2="F?W???D????????l?o???dl?LP?V?29") returned -1 [0099.149] lstrcmpiA (lpString1="F?W???D????????l?o???dl?LP?V?29", lpString2="Y?yM?c???V?N??KIWnj???pE????c??N??DXFN38") returned -1 [0099.149] lstrcmpiA (lpString1="Y?yM?c???V?N??KIWnj???pE????c??N??DXFN38", lpString2="??2") returned 1 [0099.149] lstrcmpiA (lpString1="??2", lpString2="??G????b?Q??k?d?W???20") returned -1 [0099.149] lstrcmpiA (lpString1="??G????b?Q??k?d?W???20", lpString2="?v????6") returned -1 [0099.149] lstrcmpiA (lpString1="?v????6", lpString2="vJkc?K??Q?S???O?D??R???J???rk???????????U?axt?nV?rYO?KdC??Ci?????L??u???G????XD??W82") returned -1 [0099.149] lstrcmpiA (lpString1="vJkc?K??Q?S???O?D??R???J???rk???????????U?axt?nV?rYO?KdC??Ci?????L??u???G????XD??W82", lpString2="gPm???x?J????zZv?C??X???i25") returned 1 [0099.149] lstrcmpiA (lpString1="gPm???x?J????zZv?C??X???i25", lpString2="??m?o????TJpB?F??o???????m???A?K??xf?S???t?43") returned 1 [0099.150] lstrcmpiA (lpString1="??m?o????TJpB?F??o???????m???A?K??xf?S???t?43", lpString2="?ewiNk????m?12") returned -1 [0099.150] lstrcmpiA (lpString1="?ewiNk????m?12", lpString2="c1") returned -1 [0099.150] lstrcmpiA (lpString1="c1", lpString2="?????uT???rU?sX?p?j???P23") returned 1 [0099.150] lstrcmpiA (lpString1="?????uT???rU?sX?p?j???P23", lpString2="??bt?S??k?Qa?D??T?K?????t?u?VB????aY?f??pAjX???G48") returned -1 [0099.150] lstrcmpiA (lpString1="??bt?S??k?Qa?D??T?K?????t?u?VB????aY?f??pAjX???G48", lpString2="??U???TC8") returned -1 [0099.150] lstrcmpiA (lpString1="??U???TC8", lpString2="pEEf?Jl?CjUK?dQ?nAuP???w???e???L??xM?yjL??eT??S??V?e?DD??Wmc?jr?n?Mn???xx??t?JrxY?SO??X87") returned -1 [0099.150] lstrcmpiA (lpString1="pEEf?Jl?CjUK?dQ?nAuP???w???e???L??xM?yjL??eT??S??V?e?DD??Wmc?jr?n?Mn???xx??t?JrxY?SO??X87", lpString2="YisOf?????A?P?Tmy?????I???W??GQa??DA??zIX?42") returned -1 [0099.150] lstrcmpiA (lpString1="YisOf?????A?P?Tmy?????I???W??GQa??DA??zIX?42", lpString2="???J?Q????Ol??BT?nV??N22") returned 1 [0099.150] lstrcmpiA (lpString1="???J?Q????Ol??BT?nV??N22", lpString2="cDW?g?IWo?M?c??r?Y18") returned -1 [0099.150] lstrcmpiA (lpString1="cDW?g?IWo?M?c??r?Y18", lpString2="g??Oy???jI10") returned -1 [0099.150] lstrcmpiA (lpString1="g??Oy???jI10", lpString2="aay?LPm???Eu??D15") returned 1 [0099.150] lstrcmpiA (lpString1="aay?LPm???Eu??D15", lpString2="???????V?9") returned 1 [0099.150] lstrcmpiA (lpString1="???????V?9", lpString2="?L?n?????h??lS????M19") returned -1 [0099.150] lstrcmpiA (lpString1="?L?n?????h??lS????M19", lpString2="R1") returned -1 [0099.150] lstrcmpiA (lpString1="R1", lpString2="Yx??HPY?fF?11") returned -1 [0099.150] lstrcmpiA (lpString1="Yx??HPY?fF?11", lpString2="??d???BPjN10") returned 1 [0099.150] lstrcmpiA (lpString1="??d???BPjN10", lpString2="?T?bFXHR??x????ThH?nMB????I???PYy??a???????H??????Y?52") returned -1 [0099.150] lstrcmpiA (lpString1="?T?bFXHR??x????ThH?nMB????I???PYy??a???????H??????Y?52", lpString2="OX?????????V??A?r?YM??g???I27") returned -1 [0099.150] lstrcmpiA (lpString1="OX?????????V??A?r?YM??g???I27", lpString2="??r??w?Gs??Ozik??EeVx?oh?T?hF?x?ODf?G?S??v???e?t?H?jOz??????d?eG???????b?m??o?T?80") returned 1 [0099.150] lstrcmpiA (lpString1="??r??w?Gs??Ozik??EeVx?oh?T?hF?x?ODf?G?S??v???e?t?H?jOz??????d?eG???????b?m??o?T?80", lpString2="?dcb?Yr?pi?Gmp???d???WYtj???E??oPx?C?????k??k??47") returned -1 [0099.150] lstrcmpiA (lpString1="?dcb?Yr?pi?Gmp???d???WYtj???E??oPx?C?????k??k??47", lpString2="Y?PLX??Tdmi???g????yL??oE?W?zKSyoY??i?e???????PQ?eh????McEk?Sfs??r66") returned -1 [0099.150] lstrcmpiA (lpString1="Y?PLX??Tdmi???g????yL??oE?W?zKSyoY??i?e???????PQ?eh????McEk?Sfs??r66", lpString2="??B?Bn??v?Q?NnbhG??W???23") returned 1 [0099.150] lstrcmpiA (lpString1="??B?Bn??v?Q?NnbhG??W???23", lpString2="???m?Y?????JGm?ydWR???I??P??RTz????So?D??41") returned 1 [0099.150] lstrcmpiA (lpString1="???m?Y?????JGm?ydWR???I??P??RTz????So?D??41", lpString2="?1") returned -1 [0099.150] lstrcmpiA (lpString1="?1", lpString2="??X????P8") returned 1 [0099.150] lstrcmpiA (lpString1="??X????P8", lpString2="?LY?o?6") returned -1 [0099.150] lstrcmpiA (lpString1="?LY?o?6", lpString2="W???k???cz?????eXW?K???x24") returned -1 [0099.150] lstrcmpiA (lpString1="W???k???cz?????eXW?K???x24", lpString2="??F?I5") returned 1 [0099.150] lstrcmpiA (lpString1="??F?I5", lpString2="?nErM?t????CC???PX?v?J??v?wE??G???GE??f?Ke??RC???xM???54") returned -1 [0099.150] lstrcmpiA (lpString1="?nErM?t????CC???PX?v?J??v?wE??G???GE??f?Ke??RC???xM???54", lpString2="??Ougct???????i15") returned 1 [0099.150] lstrcmpiA (lpString1="??Ougct???????i15", lpString2="P???G?oEd??u?M?Z?17") returned -1 [0099.150] lstrcmpiA (lpString1="P???G?oEd??u?M?Z?17", lpString2="?X???b?z???C?gjo?Mb?F????s??K??T?33") returned 1 [0099.151] lstrcmpiA (lpString1="?X???b?z???C?gjo?Mb?F????s??K??T?33", lpString2="???dp??r?P?Z?D?p???19") returned 1 [0099.151] lstrcmpiA (lpString1="???dp??r?P?Z?D?p???19", lpString2="0") returned -1 [0099.151] lstrcmpiA (lpString1="0", lpString2="k??k???jS?Tk??j???M19") returned -1 [0099.151] lstrcmpiA (lpString1="k??k???jS?Tk??j???M19", lpString2="C?lJHEbAZ????kr?sz?PdDN???y???zz32") returned 1 [0099.151] lstrcmpiA (lpString1="C?lJHEbAZ????kr?sz?PdDN???y???zz32", lpString2="twI??YDZ?egO?YaKF??b??22") returned -1 [0099.151] lstrcmpiA (lpString1="twI??YDZ?egO?YaKF??b??22", lpString2="?nz?BetuNM??UgUlkg???fD?yOa??Rxx??34") returned 1 [0099.151] lstrcmpiA (lpString1="?nz?BetuNM??UgUlkg???fD?yOa??Rxx??34", lpString2="0") returned -1 [0099.151] lstrcmpiA (lpString1="0", lpString2="???T???JZ?x?Daw??C???????zEswKtG?Kks?37") returned 1 [0099.175] CoGetContextToken (in: pToken=0x49fa18 | out: pToken=0x49fa18) returned 0x0 [0099.302] CObjectContext::QueryInterface () returned 0x0 [0099.303] CObjectContext::GetCurrentThreadType () returned 0x0 [0099.303] Release () returned 0x0 [0099.303] CoWaitForMultipleHandles (dwFlags=0x2, dwTimeout=0x13880, cHandles=0x1, pHandles=0x56d138*=0xa8, lpdwindex=0x49f8bc) Thread: id = 2 os_tid = 0xa08 Thread: id = 3 os_tid = 0xa0c [0045.091] CoGetContextToken (in: pToken=0x440f70c | out: pToken=0x440f70c) returned 0x800401f0 [0045.091] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0099.305] EtwEventUnregister () returned 0x0 [0099.307] CloseHandle (hObject=0x1f8) returned 1 [0099.307] UnmapViewOfFile (lpBaseAddress=0x2a0000) returned 1 [0099.307] RegCloseKey (hKey=0x80000004) returned 0x0 [0099.308] SleepEx (dwMilliseconds=0xffffffff, bAlertable=0) Thread: id = 4 os_tid = 0xa10 Thread: id = 5 os_tid = 0xa1c [0055.553] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0055.585] CoUninitialize () Thread: id = 6 os_tid = 0xa20 [0055.587] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0055.592] CoUninitialize () Thread: id = 7 os_tid = 0xa24 [0055.598] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0055.604] CoUninitialize () Thread: id = 8 os_tid = 0xa28 [0055.608] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0055.621] CoUninitialize () Thread: id = 9 os_tid = 0xa2c [0055.624] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0055.631] CoUninitialize () Thread: id = 10 os_tid = 0xa30 [0055.634] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0055.640] CoUninitialize () Thread: id = 11 os_tid = 0xa34 [0055.644] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0055.650] CoUninitialize () Thread: id = 12 os_tid = 0xa38 [0055.653] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0055.659] CoUninitialize () Thread: id = 13 os_tid = 0xa3c [0055.662] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0055.668] CoUninitialize () Thread: id = 14 os_tid = 0xa40 [0055.671] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0055.677] CoUninitialize () Thread: id = 15 os_tid = 0xad0 Thread: id = 16 os_tid = 0xad4 Thread: id = 18 os_tid = 0xb64 [0099.310] SleepEx (dwMilliseconds=0x14, bAlertable=0) returned 0x0 [0099.328] SleepEx (dwMilliseconds=0x14, bAlertable=0) returned 0x0 [0099.359] SleepEx (dwMilliseconds=0x14, bAlertable=0) returned 0x0 [0099.390] SleepEx (dwMilliseconds=0x14, bAlertable=0) returned 0x0 [0099.422] SleepEx (dwMilliseconds=0x14, bAlertable=0) returned 0x0 [0099.453] SleepEx (dwMilliseconds=0x14, bAlertable=0) returned 0x0 [0099.484] SleepEx (dwMilliseconds=0x14, bAlertable=0) returned 0x0 [0099.515] SleepEx (dwMilliseconds=0x14, bAlertable=0) returned 0x0 [0099.575] SleepEx (dwMilliseconds=0x14, bAlertable=0) returned 0x0 [0099.593] SleepEx (dwMilliseconds=0x14, bAlertable=0) returned 0x0 Process: id = "2" image_name = "unlikexpc.exe" filename = "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\unlikexpc.exe" page_root = "0x39071000" os_pid = "0xb58" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0x9f8" cmd_line = "\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\unlikexpc.exe\"" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f065" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 249 start_va = 0x10000 end_va = 0x2ffff entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 250 start_va = 0x30000 end_va = 0x31fff entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 251 start_va = 0x40000 end_va = 0x40fff entry_point = 0x40000 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 252 start_va = 0xd0000 end_va = 0x10ffff entry_point = 0x0 region_type = private name = "private_0x00000000000d0000" filename = "" Region: id = 253 start_va = 0x170000 end_va = 0x26ffff entry_point = 0x0 region_type = private name = "private_0x0000000000170000" filename = "" Region: id = 254 start_va = 0x310000 end_va = 0x34dfff entry_point = 0x310000 region_type = mapped_file name = "unlikexpc.exe" filename = "\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\unlikexpc.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\unlikexpc.exe") Region: id = 255 start_va = 0x778d0000 end_va = 0x77a78fff entry_point = 0x778d0000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 256 start_va = 0x77ab0000 end_va = 0x77c2ffff entry_point = 0x77ab0000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 257 start_va = 0x7efb0000 end_va = 0x7efd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efb0000" filename = "" Region: id = 258 start_va = 0x7efdb000 end_va = 0x7efddfff entry_point = 0x0 region_type = private name = "private_0x000000007efdb000" filename = "" Region: id = 259 start_va = 0x7efde000 end_va = 0x7efdefff entry_point = 0x0 region_type = private name = "private_0x000000007efde000" filename = "" Region: id = 260 start_va = 0x7efdf000 end_va = 0x7efdffff entry_point = 0x0 region_type = private name = "private_0x000000007efdf000" filename = "" Region: id = 261 start_va = 0x7efe0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 262 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 263 start_va = 0x7fff0000 end_va = 0x7fffffeffff entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 265 start_va = 0x50000 end_va = 0x53fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000050000" filename = "" Region: id = 266 start_va = 0x60000 end_va = 0x60fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000060000" filename = "" Region: id = 267 start_va = 0x400000 end_va = 0x418fff entry_point = 0x0 region_type = private name = "private_0x0000000000400000" filename = "" Region: id = 272 start_va = 0x5b0000 end_va = 0x62ffff entry_point = 0x0 region_type = private name = "private_0x00000000005b0000" filename = "" Region: id = 273 start_va = 0x74ff0000 end_va = 0x74ff7fff entry_point = 0x74ff0000 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 274 start_va = 0x75000000 end_va = 0x7505bfff entry_point = 0x75000000 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 275 start_va = 0x75060000 end_va = 0x7509efff entry_point = 0x75060000 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 276 start_va = 0x10000 end_va = 0x1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 277 start_va = 0x270000 end_va = 0x2d6fff entry_point = 0x270000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 278 start_va = 0x7c0000 end_va = 0x8bffff entry_point = 0x0 region_type = private name = "private_0x00000000007c0000" filename = "" Region: id = 279 start_va = 0x757c0000 end_va = 0x758cffff entry_point = 0x757c0000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 280 start_va = 0x76260000 end_va = 0x762a5fff entry_point = 0x76260000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 281 start_va = 0x776b0000 end_va = 0x777a9fff entry_point = 0x0 region_type = private name = "private_0x00000000776b0000" filename = "" Region: id = 282 start_va = 0x777b0000 end_va = 0x778cefff entry_point = 0x0 region_type = private name = "private_0x00000000777b0000" filename = "" Region: id = 283 start_va = 0x7efe0000 end_va = 0x7f0dffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 284 start_va = 0x7f0e0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 285 start_va = 0x75720000 end_va = 0x757bffff entry_point = 0x75720000 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll") Region: id = 286 start_va = 0x75fe0000 end_va = 0x7608bfff entry_point = 0x75fe0000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 287 start_va = 0x761b0000 end_va = 0x761c8fff entry_point = 0x761b0000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 288 start_va = 0x76090000 end_va = 0x7617ffff entry_point = 0x76090000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 289 start_va = 0x75610000 end_va = 0x7566ffff entry_point = 0x75610000 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 290 start_va = 0x75600000 end_va = 0x7560bfff entry_point = 0x75600000 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 291 start_va = 0x420000 end_va = 0x58ffff entry_point = 0x0 region_type = private name = "private_0x0000000000420000" filename = "" Region: id = 292 start_va = 0x775b0000 end_va = 0x776affff entry_point = 0x775b0000 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 293 start_va = 0x766d0000 end_va = 0x7675ffff entry_point = 0x766d0000 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 294 start_va = 0x75a70000 end_va = 0x75a79fff entry_point = 0x75a70000 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\SysWOW64\\lpk.dll" (normalized: "c:\\windows\\syswow64\\lpk.dll") Region: id = 295 start_va = 0x758d0000 end_va = 0x7596cfff entry_point = 0x758d0000 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\SysWOW64\\usp10.dll" (normalized: "c:\\windows\\syswow64\\usp10.dll") Region: id = 296 start_va = 0x20000 end_va = 0x3dfff entry_point = 0x20000 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 297 start_va = 0x630000 end_va = 0x7b7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000630000" filename = "" Region: id = 298 start_va = 0x20000 end_va = 0x3dfff entry_point = 0x20000 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 299 start_va = 0x75f80000 end_va = 0x75fdffff entry_point = 0x75f80000 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 300 start_va = 0x75ea0000 end_va = 0x75f6bfff entry_point = 0x75ea0000 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll") Region: id = 301 start_va = 0x8c0000 end_va = 0xa40fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000008c0000" filename = "" Region: id = 302 start_va = 0xa50000 end_va = 0x1e4ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000a50000" filename = "" Region: id = 303 start_va = 0x20000 end_va = 0x20fff entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 304 start_va = 0x30000 end_va = 0x30fff entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 305 start_va = 0x76900000 end_va = 0x77549fff entry_point = 0x76900000 region_type = mapped_file name = "shell32.dll" filename = "\\Windows\\SysWOW64\\shell32.dll" (normalized: "c:\\windows\\syswow64\\shell32.dll") Region: id = 306 start_va = 0x761d0000 end_va = 0x76226fff entry_point = 0x761d0000 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\SysWOW64\\shlwapi.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll") Region: id = 307 start_va = 0x74680000 end_va = 0x74691fff entry_point = 0x74680000 region_type = mapped_file name = "mpr.dll" filename = "\\Windows\\SysWOW64\\mpr.dll" (normalized: "c:\\windows\\syswow64\\mpr.dll") Region: id = 308 start_va = 0x768c0000 end_va = 0x768f4fff entry_point = 0x768c0000 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\SysWOW64\\ws2_32.dll" (normalized: "c:\\windows\\syswow64\\ws2_32.dll") Region: id = 309 start_va = 0x75970000 end_va = 0x75975fff entry_point = 0x75970000 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\SysWOW64\\nsi.dll" (normalized: "c:\\windows\\syswow64\\nsi.dll") Region: id = 310 start_va = 0x420000 end_va = 0x52ffff entry_point = 0x0 region_type = private name = "private_0x0000000000420000" filename = "" Region: id = 311 start_va = 0x580000 end_va = 0x58ffff entry_point = 0x0 region_type = private name = "private_0x0000000000580000" filename = "" Region: id = 312 start_va = 0x1e50000 end_va = 0x211efff entry_point = 0x1e50000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 313 start_va = 0x70000 end_va = 0x7ffff entry_point = 0x0 region_type = private name = "private_0x0000000000070000" filename = "" Region: id = 314 start_va = 0x2120000 end_va = 0x215ffff entry_point = 0x0 region_type = private name = "private_0x0000000002120000" filename = "" Region: id = 315 start_va = 0x2200000 end_va = 0x22fffff entry_point = 0x0 region_type = private name = "private_0x0000000002200000" filename = "" Region: id = 316 start_va = 0x7efd8000 end_va = 0x7efdafff entry_point = 0x0 region_type = private name = "private_0x000000007efd8000" filename = "" Region: id = 317 start_va = 0x80000 end_va = 0x87fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000080000" filename = "" Region: id = 318 start_va = 0x70000 end_va = 0x77fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000070000" filename = "" Region: id = 319 start_va = 0x70000 end_va = 0x77fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000070000" filename = "" Region: id = 320 start_va = 0x70000 end_va = 0x77fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000070000" filename = "" Region: id = 321 start_va = 0x70000 end_va = 0x77fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000070000" filename = "" Region: id = 322 start_va = 0x70000 end_va = 0x77fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000070000" filename = "" Region: id = 323 start_va = 0x70000 end_va = 0x77fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000070000" filename = "" Region: id = 324 start_va = 0x70000 end_va = 0x77fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000070000" filename = "" Region: id = 325 start_va = 0x70000 end_va = 0x77fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000070000" filename = "" Region: id = 326 start_va = 0x70000 end_va = 0x77fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000070000" filename = "" Region: id = 327 start_va = 0x70000 end_va = 0x77fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000070000" filename = "" Region: id = 328 start_va = 0x70000 end_va = 0x77fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000070000" filename = "" Region: id = 329 start_va = 0x70000 end_va = 0x77fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000070000" filename = "" Region: id = 330 start_va = 0x70000 end_va = 0x77fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000070000" filename = "" Region: id = 331 start_va = 0x70000 end_va = 0x77fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000070000" filename = "" Region: id = 332 start_va = 0x70000 end_va = 0x77fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000070000" filename = "" Region: id = 333 start_va = 0x70000 end_va = 0x77fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000070000" filename = "" Region: id = 334 start_va = 0x70000 end_va = 0x77fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000070000" filename = "" Region: id = 335 start_va = 0x70000 end_va = 0x77fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000070000" filename = "" Region: id = 336 start_va = 0x70000 end_va = 0x77fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000070000" filename = "" Region: id = 337 start_va = 0x70000 end_va = 0x77fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000070000" filename = "" Region: id = 338 start_va = 0x70000 end_va = 0x77fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000070000" filename = "" Region: id = 339 start_va = 0x70000 end_va = 0x77fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000070000" filename = "" Region: id = 340 start_va = 0x70000 end_va = 0x77fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000070000" filename = "" Region: id = 341 start_va = 0x70000 end_va = 0x77fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000070000" filename = "" Region: id = 342 start_va = 0x70000 end_va = 0x77fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000070000" filename = "" Region: id = 343 start_va = 0x70000 end_va = 0x77fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000070000" filename = "" Region: id = 344 start_va = 0x70000 end_va = 0x77fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000070000" filename = "" Region: id = 345 start_va = 0x70000 end_va = 0x77fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000070000" filename = "" Region: id = 346 start_va = 0x70000 end_va = 0x77fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000070000" filename = "" Region: id = 347 start_va = 0x70000 end_va = 0x77fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000070000" filename = "" Region: id = 348 start_va = 0x70000 end_va = 0x77fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000070000" filename = "" Region: id = 349 start_va = 0x70000 end_va = 0x77fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000070000" filename = "" Region: id = 350 start_va = 0x70000 end_va = 0x77fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000070000" filename = "" Region: id = 351 start_va = 0x70000 end_va = 0x77fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000070000" filename = "" Region: id = 352 start_va = 0x70000 end_va = 0x77fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000070000" filename = "" Region: id = 353 start_va = 0x70000 end_va = 0x77fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000070000" filename = "" Region: id = 354 start_va = 0x70000 end_va = 0x77fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000070000" filename = "" Region: id = 355 start_va = 0x70000 end_va = 0x77fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000070000" filename = "" Region: id = 356 start_va = 0x70000 end_va = 0x77fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000070000" filename = "" Region: id = 357 start_va = 0x70000 end_va = 0x77fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000070000" filename = "" Region: id = 358 start_va = 0x70000 end_va = 0x77fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000070000" filename = "" Region: id = 359 start_va = 0x70000 end_va = 0x77fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000070000" filename = "" Region: id = 360 start_va = 0x70000 end_va = 0x77fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000070000" filename = "" Region: id = 361 start_va = 0x70000 end_va = 0x77fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000070000" filename = "" Region: id = 362 start_va = 0x70000 end_va = 0x77fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000070000" filename = "" Region: id = 363 start_va = 0x70000 end_va = 0x77fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000070000" filename = "" Region: id = 364 start_va = 0x70000 end_va = 0x77fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000070000" filename = "" Region: id = 365 start_va = 0x70000 end_va = 0x77fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000070000" filename = "" Region: id = 366 start_va = 0x70000 end_va = 0x77fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000070000" filename = "" Region: id = 367 start_va = 0x70000 end_va = 0x77fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000070000" filename = "" Region: id = 368 start_va = 0x70000 end_va = 0x77fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000070000" filename = "" Region: id = 369 start_va = 0x70000 end_va = 0x77fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000070000" filename = "" Region: id = 370 start_va = 0x70000 end_va = 0x77fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000070000" filename = "" Region: id = 371 start_va = 0x2300000 end_va = 0x2400fff entry_point = 0x0 region_type = private name = "private_0x0000000002300000" filename = "" Region: id = 372 start_va = 0x2300000 end_va = 0x2400fff entry_point = 0x0 region_type = private name = "private_0x0000000002300000" filename = "" Region: id = 373 start_va = 0x2300000 end_va = 0x2400fff entry_point = 0x0 region_type = private name = "private_0x0000000002300000" filename = "" Region: id = 387 start_va = 0x70000 end_va = 0x7ffff entry_point = 0x0 region_type = private name = "private_0x0000000000070000" filename = "" Region: id = 388 start_va = 0x350000 end_va = 0x38ffff entry_point = 0x0 region_type = private name = "private_0x0000000000350000" filename = "" Region: id = 389 start_va = 0x390000 end_va = 0x3cffff entry_point = 0x0 region_type = private name = "private_0x0000000000390000" filename = "" Region: id = 390 start_va = 0x4a0000 end_va = 0x4dffff entry_point = 0x0 region_type = private name = "private_0x00000000004a0000" filename = "" Region: id = 391 start_va = 0x4f0000 end_va = 0x52ffff entry_point = 0x0 region_type = private name = "private_0x00000000004f0000" filename = "" Region: id = 392 start_va = 0x530000 end_va = 0x56ffff entry_point = 0x0 region_type = private name = "private_0x0000000000530000" filename = "" Region: id = 393 start_va = 0x21a0000 end_va = 0x21dffff entry_point = 0x0 region_type = private name = "private_0x00000000021a0000" filename = "" Region: id = 394 start_va = 0x2380000 end_va = 0x247ffff entry_point = 0x0 region_type = private name = "private_0x0000000002380000" filename = "" Region: id = 395 start_va = 0x24e0000 end_va = 0x25dffff entry_point = 0x0 region_type = private name = "private_0x00000000024e0000" filename = "" Region: id = 396 start_va = 0x25e0000 end_va = 0x26dffff entry_point = 0x0 region_type = private name = "private_0x00000000025e0000" filename = "" Region: id = 397 start_va = 0x2710000 end_va = 0x280ffff entry_point = 0x0 region_type = private name = "private_0x0000000002710000" filename = "" Region: id = 398 start_va = 0x2980000 end_va = 0x2a7ffff entry_point = 0x0 region_type = private name = "private_0x0000000002980000" filename = "" Region: id = 399 start_va = 0x7efa4000 end_va = 0x7efa6fff entry_point = 0x0 region_type = private name = "private_0x000000007efa4000" filename = "" Region: id = 400 start_va = 0x7efa7000 end_va = 0x7efa9fff entry_point = 0x0 region_type = private name = "private_0x000000007efa7000" filename = "" Region: id = 401 start_va = 0x7efaa000 end_va = 0x7efacfff entry_point = 0x0 region_type = private name = "private_0x000000007efaa000" filename = "" Region: id = 402 start_va = 0x7efad000 end_va = 0x7efaffff entry_point = 0x0 region_type = private name = "private_0x000000007efad000" filename = "" Region: id = 403 start_va = 0x7efd5000 end_va = 0x7efd7fff entry_point = 0x0 region_type = private name = "private_0x000000007efd5000" filename = "" Region: id = 404 start_va = 0x80000 end_va = 0x87fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000080000" filename = "" Region: id = 405 start_va = 0x70000 end_va = 0x77fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000070000" filename = "" Region: id = 406 start_va = 0x70000 end_va = 0x77fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000070000" filename = "" Region: id = 407 start_va = 0x70000 end_va = 0x77fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000070000" filename = "" Region: id = 408 start_va = 0x70000 end_va = 0x77fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000070000" filename = "" Region: id = 409 start_va = 0x70000 end_va = 0x77fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000070000" filename = "" Region: id = 410 start_va = 0x70000 end_va = 0x77fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000070000" filename = "" Region: id = 411 start_va = 0x70000 end_va = 0x77fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000070000" filename = "" Region: id = 412 start_va = 0x70000 end_va = 0x77fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000070000" filename = "" Region: id = 413 start_va = 0x70000 end_va = 0x77fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000070000" filename = "" Region: id = 414 start_va = 0x70000 end_va = 0x77fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000070000" filename = "" Region: id = 415 start_va = 0x70000 end_va = 0x77fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000070000" filename = "" Region: id = 416 start_va = 0x70000 end_va = 0x77fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000070000" filename = "" Region: id = 417 start_va = 0x70000 end_va = 0x77fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000070000" filename = "" Region: id = 418 start_va = 0x70000 end_va = 0x77fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000070000" filename = "" Region: id = 419 start_va = 0x70000 end_va = 0x77fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000070000" filename = "" Region: id = 420 start_va = 0x70000 end_va = 0x77fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000070000" filename = "" Region: id = 421 start_va = 0x70000 end_va = 0x77fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000070000" filename = "" Region: id = 422 start_va = 0x70000 end_va = 0x77fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000070000" filename = "" Region: id = 423 start_va = 0x70000 end_va = 0x77fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000070000" filename = "" Region: id = 424 start_va = 0x70000 end_va = 0x77fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000070000" filename = "" Region: id = 425 start_va = 0x70000 end_va = 0x77fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000070000" filename = "" Region: id = 426 start_va = 0x70000 end_va = 0x77fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000070000" filename = "" Region: id = 427 start_va = 0x70000 end_va = 0x77fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000070000" filename = "" Region: id = 428 start_va = 0x70000 end_va = 0x77fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000070000" filename = "" Region: id = 429 start_va = 0x70000 end_va = 0x77fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000070000" filename = "" Region: id = 430 start_va = 0x70000 end_va = 0x77fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000070000" filename = "" Region: id = 431 start_va = 0x70000 end_va = 0x77fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000070000" filename = "" Region: id = 432 start_va = 0x70000 end_va = 0x77fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000070000" filename = "" Region: id = 433 start_va = 0x70000 end_va = 0x77fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000070000" filename = "" Region: id = 434 start_va = 0x70000 end_va = 0x77fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000070000" filename = "" Region: id = 435 start_va = 0x70000 end_va = 0x77fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000070000" filename = "" Region: id = 436 start_va = 0x70000 end_va = 0x77fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000070000" filename = "" Region: id = 437 start_va = 0x70000 end_va = 0x77fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000070000" filename = "" Region: id = 438 start_va = 0x70000 end_va = 0x77fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000070000" filename = "" Region: id = 439 start_va = 0x70000 end_va = 0x77fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000070000" filename = "" Region: id = 440 start_va = 0x70000 end_va = 0x77fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000070000" filename = "" Region: id = 441 start_va = 0x70000 end_va = 0x77fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000070000" filename = "" Region: id = 442 start_va = 0x70000 end_va = 0x77fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000070000" filename = "" Region: id = 443 start_va = 0x70000 end_va = 0x77fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000070000" filename = "" Region: id = 444 start_va = 0x70000 end_va = 0x77fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000070000" filename = "" Region: id = 445 start_va = 0x70000 end_va = 0x77fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000070000" filename = "" Region: id = 446 start_va = 0x70000 end_va = 0x77fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000070000" filename = "" Region: id = 447 start_va = 0x70000 end_va = 0x77fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000070000" filename = "" Region: id = 448 start_va = 0x70000 end_va = 0x77fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000070000" filename = "" Region: id = 449 start_va = 0x70000 end_va = 0x77fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000070000" filename = "" Region: id = 450 start_va = 0x70000 end_va = 0x77fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000070000" filename = "" Region: id = 451 start_va = 0x70000 end_va = 0x77fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000070000" filename = "" Region: id = 452 start_va = 0x70000 end_va = 0x77fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000070000" filename = "" Region: id = 453 start_va = 0x70000 end_va = 0x77fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000070000" filename = "" Region: id = 454 start_va = 0x70000 end_va = 0x77fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000070000" filename = "" Region: id = 455 start_va = 0x70000 end_va = 0x77fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000070000" filename = "" Region: id = 456 start_va = 0x70000 end_va = 0x77fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000070000" filename = "" Region: id = 457 start_va = 0x70000 end_va = 0x77fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000070000" filename = "" Region: id = 458 start_va = 0x70000 end_va = 0x77fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000070000" filename = "" Region: id = 459 start_va = 0x70000 end_va = 0x76fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000070000" filename = "" Region: id = 460 start_va = 0x80000 end_va = 0x81fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000080000" filename = "" Region: id = 461 start_va = 0x2a80000 end_va = 0x2e72fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002a80000" filename = "" Region: id = 462 start_va = 0x754f0000 end_va = 0x754f7fff entry_point = 0x754f0000 region_type = mapped_file name = "drprov.dll" filename = "\\Windows\\SysWOW64\\drprov.dll" (normalized: "c:\\windows\\syswow64\\drprov.dll") Region: id = 466 start_va = 0x754c0000 end_va = 0x754e8fff entry_point = 0x754c0000 region_type = mapped_file name = "winsta.dll" filename = "\\Windows\\SysWOW64\\winsta.dll" (normalized: "c:\\windows\\syswow64\\winsta.dll") Region: id = 467 start_va = 0x420000 end_va = 0x45ffff entry_point = 0x0 region_type = private name = "private_0x0000000000420000" filename = "" Region: id = 468 start_va = 0x460000 end_va = 0x49ffff entry_point = 0x0 region_type = private name = "private_0x0000000000460000" filename = "" Region: id = 469 start_va = 0x21b0000 end_va = 0x21effff entry_point = 0x0 region_type = private name = "private_0x00000000021b0000" filename = "" Region: id = 470 start_va = 0x2320000 end_va = 0x235ffff entry_point = 0x0 region_type = private name = "private_0x0000000002320000" filename = "" Region: id = 471 start_va = 0x24a0000 end_va = 0x24dffff entry_point = 0x0 region_type = private name = "private_0x00000000024a0000" filename = "" Region: id = 472 start_va = 0x2600000 end_va = 0x26fffff entry_point = 0x0 region_type = private name = "private_0x0000000002600000" filename = "" Region: id = 473 start_va = 0x2830000 end_va = 0x292ffff entry_point = 0x0 region_type = private name = "private_0x0000000002830000" filename = "" Region: id = 474 start_va = 0x2ea0000 end_va = 0x2edffff entry_point = 0x0 region_type = private name = "private_0x0000000002ea0000" filename = "" Region: id = 475 start_va = 0x2ee0000 end_va = 0x2f1ffff entry_point = 0x0 region_type = private name = "private_0x0000000002ee0000" filename = "" Region: id = 476 start_va = 0x2f50000 end_va = 0x2f8ffff entry_point = 0x0 region_type = private name = "private_0x0000000002f50000" filename = "" Region: id = 477 start_va = 0x2fb0000 end_va = 0x30affff entry_point = 0x0 region_type = private name = "private_0x0000000002fb0000" filename = "" Region: id = 478 start_va = 0x3170000 end_va = 0x326ffff entry_point = 0x0 region_type = private name = "private_0x0000000003170000" filename = "" Region: id = 479 start_va = 0x3330000 end_va = 0x342ffff entry_point = 0x0 region_type = private name = "private_0x0000000003330000" filename = "" Region: id = 480 start_va = 0x3450000 end_va = 0x354ffff entry_point = 0x0 region_type = private name = "private_0x0000000003450000" filename = "" Region: id = 481 start_va = 0x36d0000 end_va = 0x37cffff entry_point = 0x0 region_type = private name = "private_0x00000000036d0000" filename = "" Region: id = 482 start_va = 0x3820000 end_va = 0x391ffff entry_point = 0x0 region_type = private name = "private_0x0000000003820000" filename = "" Region: id = 483 start_va = 0x7ef8f000 end_va = 0x7ef91fff entry_point = 0x0 region_type = private name = "private_0x000000007ef8f000" filename = "" Region: id = 484 start_va = 0x7ef92000 end_va = 0x7ef94fff entry_point = 0x0 region_type = private name = "private_0x000000007ef92000" filename = "" Region: id = 485 start_va = 0x7ef95000 end_va = 0x7ef97fff entry_point = 0x0 region_type = private name = "private_0x000000007ef95000" filename = "" Region: id = 486 start_va = 0x7ef98000 end_va = 0x7ef9afff entry_point = 0x0 region_type = private name = "private_0x000000007ef98000" filename = "" Region: id = 487 start_va = 0x7ef9b000 end_va = 0x7ef9dfff entry_point = 0x0 region_type = private name = "private_0x000000007ef9b000" filename = "" Region: id = 488 start_va = 0x7ef9e000 end_va = 0x7efa0fff entry_point = 0x0 region_type = private name = "private_0x000000007ef9e000" filename = "" Region: id = 489 start_va = 0x7efa1000 end_va = 0x7efa3fff entry_point = 0x0 region_type = private name = "private_0x000000007efa1000" filename = "" Region: id = 490 start_va = 0x7efad000 end_va = 0x7efaffff entry_point = 0x0 region_type = private name = "private_0x000000007efad000" filename = "" Region: id = 491 start_va = 0x3570000 end_va = 0x35affff entry_point = 0x0 region_type = private name = "private_0x0000000003570000" filename = "" Region: id = 492 start_va = 0x35d0000 end_va = 0x36cffff entry_point = 0x0 region_type = private name = "private_0x00000000035d0000" filename = "" Region: id = 493 start_va = 0x7ef8c000 end_va = 0x7ef8efff entry_point = 0x0 region_type = private name = "private_0x000000007ef8c000" filename = "" Region: id = 494 start_va = 0x3920000 end_va = 0x395ffff entry_point = 0x0 region_type = private name = "private_0x0000000003920000" filename = "" Region: id = 495 start_va = 0x3ae0000 end_va = 0x3bdffff entry_point = 0x0 region_type = private name = "private_0x0000000003ae0000" filename = "" Region: id = 496 start_va = 0x754a0000 end_va = 0x754b3fff entry_point = 0x754a0000 region_type = mapped_file name = "ntlanman.dll" filename = "\\Windows\\SysWOW64\\ntlanman.dll" (normalized: "c:\\windows\\syswow64\\ntlanman.dll") Region: id = 497 start_va = 0x7ef89000 end_va = 0x7ef8bfff entry_point = 0x0 region_type = private name = "private_0x000000007ef89000" filename = "" Region: id = 498 start_va = 0x3960000 end_va = 0x3a60fff entry_point = 0x0 region_type = private name = "private_0x0000000003960000" filename = "" Region: id = 499 start_va = 0x3be0000 end_va = 0x3ce0fff entry_point = 0x0 region_type = private name = "private_0x0000000003be0000" filename = "" Region: id = 500 start_va = 0x3cf0000 end_va = 0x3df0fff entry_point = 0x0 region_type = private name = "private_0x0000000003cf0000" filename = "" Region: id = 501 start_va = 0x3e00000 end_va = 0x3efffff entry_point = 0x0 region_type = private name = "private_0x0000000003e00000" filename = "" Region: id = 502 start_va = 0x3f00000 end_va = 0x4000fff entry_point = 0x0 region_type = private name = "private_0x0000000003f00000" filename = "" Region: id = 503 start_va = 0x4010000 end_va = 0x4110fff entry_point = 0x0 region_type = private name = "private_0x0000000004010000" filename = "" Region: id = 504 start_va = 0x4120000 end_va = 0x4220fff entry_point = 0x0 region_type = private name = "private_0x0000000004120000" filename = "" Region: id = 505 start_va = 0x4230000 end_va = 0x4330fff entry_point = 0x0 region_type = private name = "private_0x0000000004230000" filename = "" Region: id = 506 start_va = 0x4340000 end_va = 0x4440fff entry_point = 0x0 region_type = private name = "private_0x0000000004340000" filename = "" Region: id = 507 start_va = 0x4450000 end_va = 0x464ffff entry_point = 0x0 region_type = private name = "private_0x0000000004450000" filename = "" Region: id = 508 start_va = 0x75480000 end_va = 0x75496fff entry_point = 0x75480000 region_type = mapped_file name = "davclnt.dll" filename = "\\Windows\\SysWOW64\\davclnt.dll" (normalized: "c:\\windows\\syswow64\\davclnt.dll") Region: id = 509 start_va = 0x90000 end_va = 0x9ffff entry_point = 0x0 region_type = private name = "private_0x0000000000090000" filename = "" Region: id = 510 start_va = 0xa0000 end_va = 0xa7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000a0000" filename = "" Region: id = 511 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 512 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 513 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 514 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 515 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 516 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 517 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 518 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 519 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 520 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 521 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 522 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 523 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 524 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 525 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 526 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 527 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 528 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 529 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 530 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 531 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 532 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 533 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 534 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 535 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 536 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 537 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 538 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 539 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 540 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 541 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 542 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 543 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 544 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 545 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 546 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 547 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 548 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 549 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 550 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 551 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 552 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 553 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 554 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 555 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 556 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 557 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 558 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 559 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 560 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 561 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 562 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 563 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 564 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 565 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 566 start_va = 0x75470000 end_va = 0x75477fff entry_point = 0x75470000 region_type = mapped_file name = "davhlpr.dll" filename = "\\Windows\\SysWOW64\\davhlpr.dll" (normalized: "c:\\windows\\syswow64\\davhlpr.dll") Region: id = 567 start_va = 0x90000 end_va = 0x9ffff entry_point = 0x0 region_type = private name = "private_0x0000000000090000" filename = "" Region: id = 568 start_va = 0xa0000 end_va = 0xa7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000a0000" filename = "" Region: id = 569 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 570 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 571 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 572 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 573 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 574 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 575 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 576 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 577 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 578 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 579 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 580 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 581 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 582 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 583 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 584 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 585 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 586 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 587 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 588 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 589 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 590 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 591 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 592 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 593 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 594 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 595 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 596 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 597 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 598 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 599 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 600 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 601 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 602 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 603 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 604 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 605 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 606 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 607 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 608 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 609 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 610 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 611 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 612 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 613 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 614 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 615 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 616 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 617 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 618 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 619 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 620 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 621 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 622 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 623 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 624 start_va = 0x30b0000 end_va = 0x3130fff entry_point = 0x0 region_type = private name = "private_0x00000000030b0000" filename = "" Region: id = 625 start_va = 0x90000 end_va = 0x9ffff entry_point = 0x0 region_type = private name = "private_0x0000000000090000" filename = "" Region: id = 626 start_va = 0xa0000 end_va = 0xa7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000a0000" filename = "" Region: id = 627 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 628 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 629 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 630 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 631 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 632 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 633 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 634 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 635 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 636 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 637 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 638 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 639 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 640 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 641 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 642 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 643 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 644 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 645 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 646 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 647 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 648 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 649 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 650 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 651 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 652 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 653 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 654 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 655 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 656 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 657 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 658 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 659 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 660 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 661 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 662 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 663 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 664 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 665 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 666 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 667 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 668 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 669 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 670 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 671 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 672 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 673 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 674 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 675 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 676 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 677 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 678 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 679 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 680 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 681 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 682 start_va = 0x75460000 end_va = 0x7546efff entry_point = 0x75460000 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\SysWOW64\\wkscli.dll" (normalized: "c:\\windows\\syswow64\\wkscli.dll") Region: id = 683 start_va = 0x90000 end_va = 0x9ffff entry_point = 0x0 region_type = private name = "private_0x0000000000090000" filename = "" Region: id = 684 start_va = 0xa0000 end_va = 0xa7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000a0000" filename = "" Region: id = 685 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 686 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 687 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 688 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 689 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 690 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 691 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 692 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 693 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 694 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 695 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 696 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 697 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 698 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 699 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 700 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 701 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 702 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 703 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 704 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 705 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 706 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 707 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 708 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 709 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 710 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 711 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 712 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 713 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 714 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 715 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 716 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 717 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 718 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 719 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 720 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 721 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 722 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 723 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 724 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 725 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 726 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 727 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 728 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 729 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 730 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 731 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 732 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 733 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 734 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 735 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 736 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 737 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 738 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 739 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 740 start_va = 0x90000 end_va = 0x9ffff entry_point = 0x0 region_type = private name = "private_0x0000000000090000" filename = "" Region: id = 741 start_va = 0xa0000 end_va = 0xa7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000a0000" filename = "" Region: id = 742 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 743 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 744 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 745 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 746 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 747 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 748 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 749 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 750 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 751 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 752 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 753 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 754 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 755 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 756 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 757 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 758 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 759 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 760 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 761 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 762 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 763 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 764 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 765 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 766 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 767 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 768 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 769 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 770 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 771 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 772 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 773 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 774 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 775 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 776 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 777 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 778 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 779 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 780 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 781 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 782 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 783 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 784 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 785 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 786 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 787 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 788 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 789 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 790 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 791 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 792 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 793 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 794 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 795 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 796 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 808 start_va = 0x4650000 end_va = 0x4750fff entry_point = 0x0 region_type = private name = "private_0x0000000004650000" filename = "" Region: id = 809 start_va = 0x3a70000 end_va = 0x3aaffff entry_point = 0x0 region_type = private name = "private_0x0000000003a70000" filename = "" Region: id = 810 start_va = 0x4820000 end_va = 0x491ffff entry_point = 0x0 region_type = private name = "private_0x0000000004820000" filename = "" Region: id = 811 start_va = 0x75450000 end_va = 0x7545afff entry_point = 0x75450000 region_type = mapped_file name = "cscapi.dll" filename = "\\Windows\\SysWOW64\\cscapi.dll" (normalized: "c:\\windows\\syswow64\\cscapi.dll") Region: id = 812 start_va = 0x7ef86000 end_va = 0x7ef88fff entry_point = 0x0 region_type = private name = "private_0x000000007ef86000" filename = "" Region: id = 813 start_va = 0x90000 end_va = 0x9ffff entry_point = 0x0 region_type = private name = "private_0x0000000000090000" filename = "" Region: id = 814 start_va = 0xa0000 end_va = 0xa7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000a0000" filename = "" Region: id = 815 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 816 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 817 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 818 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 819 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 820 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 821 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 822 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 823 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 824 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 825 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 826 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 827 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 828 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 829 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 830 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 831 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 832 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 833 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 834 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 835 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 836 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 837 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 838 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 839 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 840 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 841 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 842 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 843 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 844 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 845 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 846 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 847 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 848 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 849 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 850 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 851 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 852 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 853 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 854 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 855 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 856 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 857 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 858 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 859 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 860 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 861 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 862 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 863 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 864 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 865 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 866 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 867 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 868 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 869 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 886 start_va = 0x90000 end_va = 0x9ffff entry_point = 0x0 region_type = private name = "private_0x0000000000090000" filename = "" Region: id = 887 start_va = 0xa0000 end_va = 0xa7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000a0000" filename = "" Region: id = 888 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 889 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 890 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 891 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 892 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 893 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 894 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 895 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 896 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 897 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 898 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 899 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 900 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 901 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 902 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 903 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 904 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 905 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 906 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 907 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 908 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 909 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 910 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 911 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 912 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 913 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 914 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 915 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 916 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 917 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 918 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 919 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 920 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 921 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 922 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 923 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 924 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 925 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 926 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 927 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 928 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 929 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 930 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 931 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 932 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 933 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 934 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 935 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 936 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 937 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 938 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 939 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 940 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 953 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 954 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 955 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 983 start_va = 0x90000 end_va = 0x9ffff entry_point = 0x0 region_type = private name = "private_0x0000000000090000" filename = "" Region: id = 984 start_va = 0xa0000 end_va = 0xa7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000a0000" filename = "" Region: id = 985 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 986 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 987 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 988 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 989 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 990 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 991 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 992 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 993 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 994 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 995 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 996 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 997 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 998 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 999 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1000 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1001 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1002 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1003 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1004 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1005 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1006 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1007 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1008 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1009 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1010 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1011 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1012 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1013 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1014 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1015 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1016 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1017 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1018 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1019 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1020 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1021 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1022 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1023 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1024 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1025 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1026 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1027 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1028 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1029 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1030 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1031 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1032 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1033 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1034 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1035 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1036 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1037 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1038 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1039 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1040 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1041 start_va = 0x75440000 end_va = 0x75448fff entry_point = 0x75440000 region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\SysWOW64\\netutils.dll" (normalized: "c:\\windows\\syswow64\\netutils.dll") Region: id = 1048 start_va = 0x90000 end_va = 0x9ffff entry_point = 0x0 region_type = private name = "private_0x0000000000090000" filename = "" Region: id = 1049 start_va = 0xa0000 end_va = 0xa7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000a0000" filename = "" Region: id = 1050 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1051 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1052 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1053 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1054 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1055 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1056 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1057 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1058 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1059 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1060 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1061 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1062 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1063 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1064 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1065 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1066 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1067 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1068 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1069 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1070 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1071 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1072 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1073 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1074 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1075 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1076 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1077 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1078 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1079 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1080 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1081 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1082 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1083 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1084 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1085 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1086 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1087 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1088 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1089 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1090 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1091 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1092 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1093 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1094 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1095 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1096 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1097 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1098 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1099 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1100 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1101 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1102 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1103 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1104 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1105 start_va = 0x30b0000 end_va = 0x3130fff entry_point = 0x0 region_type = private name = "private_0x00000000030b0000" filename = "" Region: id = 1106 start_va = 0x75430000 end_va = 0x7543cfff entry_point = 0x75430000 region_type = mapped_file name = "browcli.dll" filename = "\\Windows\\SysWOW64\\browcli.dll" (normalized: "c:\\windows\\syswow64\\browcli.dll") Region: id = 1122 start_va = 0x90000 end_va = 0x9ffff entry_point = 0x0 region_type = private name = "private_0x0000000000090000" filename = "" Region: id = 1123 start_va = 0xa0000 end_va = 0xa7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000a0000" filename = "" Region: id = 1124 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1125 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1126 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1127 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1128 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1129 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1130 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1131 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1132 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1133 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1134 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1135 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1136 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1137 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1138 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1139 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1140 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1141 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1142 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1143 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1144 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1145 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1146 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1147 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1148 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1149 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1150 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1151 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1152 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1153 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1154 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1155 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1156 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1157 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1158 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1159 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1160 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1161 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1162 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1163 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1164 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1165 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1166 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1167 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1168 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1169 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1170 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1171 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1172 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1173 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1174 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1175 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1176 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1177 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1178 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1179 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1210 start_va = 0x90000 end_va = 0x9ffff entry_point = 0x0 region_type = private name = "private_0x0000000000090000" filename = "" Region: id = 1211 start_va = 0xa0000 end_va = 0xa7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000a0000" filename = "" Region: id = 1212 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1213 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1214 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1215 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1216 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1217 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1218 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1219 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1220 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1221 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1222 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1223 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1224 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1225 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1226 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1227 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1228 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1229 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1230 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1231 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1232 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1233 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1234 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1235 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1236 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1237 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1238 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1239 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1240 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1241 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1242 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1243 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1244 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1245 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1246 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1247 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1248 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1249 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1250 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1251 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1252 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1253 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1254 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1255 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1256 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1257 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1258 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1259 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1260 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1261 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1262 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1263 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1264 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1265 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1266 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1267 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1281 start_va = 0x90000 end_va = 0x9ffff entry_point = 0x0 region_type = private name = "private_0x0000000000090000" filename = "" Region: id = 1282 start_va = 0xa0000 end_va = 0xa7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000a0000" filename = "" Region: id = 1283 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1284 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1285 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1286 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1287 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1288 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1289 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1290 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1291 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1292 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1293 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1294 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1295 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1296 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1297 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1298 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1299 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1300 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1301 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1302 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1303 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1304 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1305 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1306 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1307 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1308 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1309 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1310 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1311 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1312 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1313 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1314 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1315 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1316 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1317 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1318 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1319 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1320 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1321 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1322 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1323 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1324 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1325 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1326 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1327 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1328 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1329 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1330 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1331 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1332 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1333 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1334 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1335 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1336 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1337 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1338 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1339 start_va = 0x90000 end_va = 0x9ffff entry_point = 0x0 region_type = private name = "private_0x0000000000090000" filename = "" Region: id = 1340 start_va = 0xa0000 end_va = 0xa7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000a0000" filename = "" Region: id = 1341 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1342 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1343 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1344 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1345 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1346 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1347 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1348 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1349 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1350 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1351 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1352 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1353 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1354 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1355 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1356 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1357 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1358 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1359 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1360 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1361 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1362 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1363 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1364 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1365 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1366 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1367 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1368 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1369 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1370 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1371 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1372 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1373 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1374 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1375 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1376 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1377 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1378 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1379 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1380 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1381 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1382 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1383 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1384 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1385 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1386 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1387 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1388 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1389 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1390 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1391 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1392 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1393 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1394 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1395 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1396 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1397 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1398 start_va = 0x90000 end_va = 0x9ffff entry_point = 0x0 region_type = private name = "private_0x0000000000090000" filename = "" Region: id = 1399 start_va = 0xa0000 end_va = 0xa7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000a0000" filename = "" Region: id = 1400 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1401 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1402 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1403 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1404 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1405 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1406 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1407 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1408 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1409 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1410 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1411 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1412 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1413 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1414 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1415 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1416 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1417 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1418 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1419 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1420 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1421 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1422 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1423 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1424 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1425 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1426 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1427 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1428 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1429 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1430 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1431 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1432 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1433 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1434 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1435 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1436 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1437 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1438 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1439 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1440 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1441 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1442 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1443 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1444 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1445 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1446 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1447 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1448 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1449 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1450 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1451 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1452 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1453 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1454 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1455 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1456 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1673 start_va = 0x90000 end_va = 0x9ffff entry_point = 0x0 region_type = private name = "private_0x0000000000090000" filename = "" Region: id = 1674 start_va = 0xa0000 end_va = 0xa7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000a0000" filename = "" Region: id = 1675 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1676 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1677 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1678 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1679 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1680 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1681 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1682 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1683 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1684 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1685 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1686 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1687 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1688 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1689 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1690 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1691 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1692 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1693 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1694 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1695 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1696 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1697 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1698 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1699 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1700 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1701 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1702 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1703 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1704 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1705 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1706 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1707 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1708 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1709 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1710 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1711 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1712 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1713 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1714 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1715 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1716 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1717 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1718 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1719 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1720 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1721 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1722 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1723 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1724 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1725 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1726 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1727 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1728 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1729 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1730 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1731 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1732 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1798 start_va = 0x90000 end_va = 0x9ffff entry_point = 0x0 region_type = private name = "private_0x0000000000090000" filename = "" Region: id = 1799 start_va = 0xa0000 end_va = 0xa7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000a0000" filename = "" Region: id = 1800 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1801 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1802 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1803 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1804 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1805 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1806 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1807 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1808 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1809 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1810 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1811 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1812 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1813 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1814 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1815 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1816 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1817 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1818 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1819 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1820 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1821 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1822 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1823 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1824 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1825 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1826 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1827 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1828 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1829 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1830 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1831 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1832 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1833 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1834 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1835 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1836 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1837 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1838 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1839 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1840 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1841 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1842 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1843 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1844 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1845 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1846 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1847 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1848 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1849 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1850 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1851 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1852 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1853 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1854 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1855 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1856 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1857 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1858 start_va = 0x90000 end_va = 0x9ffff entry_point = 0x0 region_type = private name = "private_0x0000000000090000" filename = "" Region: id = 1859 start_va = 0xa0000 end_va = 0xa7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000a0000" filename = "" Region: id = 1860 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1861 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1862 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1863 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1864 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1865 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1866 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1867 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1868 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1869 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1870 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1871 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1872 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1873 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1874 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1875 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1876 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1877 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1878 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1879 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1880 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1881 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1882 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1883 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1884 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1885 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1886 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1887 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1888 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1889 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1890 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1891 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1892 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1893 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1894 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1895 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1896 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1897 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1898 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1899 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1900 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1901 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1902 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1903 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1904 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1905 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1906 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1907 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1908 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1909 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1910 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1911 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1912 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1913 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1914 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1915 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1916 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1917 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1918 start_va = 0x90000 end_va = 0x9ffff entry_point = 0x0 region_type = private name = "private_0x0000000000090000" filename = "" Region: id = 1919 start_va = 0xa0000 end_va = 0xa7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000a0000" filename = "" Region: id = 1920 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1921 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1922 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1923 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1924 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1925 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1926 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1927 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1928 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1929 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1930 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1931 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1932 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1933 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1934 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1935 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1936 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1937 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1938 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1939 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1940 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1941 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1942 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1943 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1944 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1945 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1946 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1947 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1948 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1949 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1950 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1951 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1952 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1953 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1954 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1955 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1956 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1957 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1958 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1959 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1960 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1961 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1962 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1963 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1964 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1965 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1966 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1967 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1968 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1969 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1970 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1971 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1972 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1973 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1974 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1975 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1976 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1977 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1978 start_va = 0x90000 end_va = 0x9ffff entry_point = 0x0 region_type = private name = "private_0x0000000000090000" filename = "" Region: id = 1979 start_va = 0xa0000 end_va = 0xa7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000a0000" filename = "" Region: id = 1980 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1981 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1982 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1983 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1984 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1985 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1986 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1987 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1988 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1989 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1990 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1991 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1992 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1993 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1994 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1995 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1996 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1997 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1998 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 1999 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2000 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2001 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2002 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2003 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2004 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2005 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2006 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2007 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2008 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2009 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2010 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2011 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2012 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2013 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2014 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2015 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2016 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2017 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2018 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2019 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2020 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2021 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2022 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2023 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2024 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2025 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2026 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2027 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2028 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2029 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2030 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2031 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2032 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2033 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2034 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2035 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2036 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2037 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2038 start_va = 0x4920000 end_va = 0x4a20fff entry_point = 0x0 region_type = private name = "private_0x0000000004920000" filename = "" Region: id = 2039 start_va = 0x90000 end_va = 0x9ffff entry_point = 0x0 region_type = private name = "private_0x0000000000090000" filename = "" Region: id = 2040 start_va = 0xa0000 end_va = 0xa7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000a0000" filename = "" Region: id = 2041 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2042 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2043 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2044 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2045 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2046 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2047 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2048 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2049 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2050 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2051 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2052 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2053 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2054 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2055 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2056 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2057 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2058 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2059 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2060 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2061 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2062 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2063 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2064 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2065 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2066 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2067 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2068 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2069 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2070 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2071 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2072 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2073 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2074 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2075 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2076 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2077 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2078 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2079 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2080 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2081 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2082 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2083 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2084 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2085 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2086 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2087 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2088 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2089 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2090 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2091 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2092 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2093 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2094 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2095 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2096 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2097 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2098 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2099 start_va = 0x90000 end_va = 0x9ffff entry_point = 0x0 region_type = private name = "private_0x0000000000090000" filename = "" Region: id = 2100 start_va = 0xa0000 end_va = 0xa7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000a0000" filename = "" Region: id = 2101 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2102 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2103 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2104 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2105 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2106 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2107 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2108 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2109 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2110 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2111 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2112 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2113 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2114 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2115 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2116 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2117 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2118 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2119 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2120 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2121 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2122 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2123 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2124 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2125 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2126 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2127 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2128 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2129 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2130 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2131 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2132 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2133 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2134 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2135 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2136 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2137 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2138 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2139 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2140 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2141 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2142 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2143 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2144 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2145 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2146 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2147 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2148 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2149 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2150 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2151 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2152 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2153 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2154 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2155 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2156 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2157 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2158 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2159 start_va = 0x90000 end_va = 0x9ffff entry_point = 0x0 region_type = private name = "private_0x0000000000090000" filename = "" Region: id = 2160 start_va = 0xa0000 end_va = 0xa7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000a0000" filename = "" Region: id = 2161 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2162 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2163 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2164 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2165 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2166 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2167 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2168 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2169 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2170 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2171 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2172 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2173 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2174 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2175 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2176 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2177 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2178 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2179 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2180 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2181 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2182 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2183 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2184 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2185 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2186 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2187 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2188 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2189 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2190 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2191 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2192 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2193 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2194 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2195 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2196 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2197 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2198 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2199 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2200 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2201 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2202 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2203 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2204 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2205 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2206 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2207 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2208 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2209 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2210 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2211 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2212 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2213 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2214 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2215 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2216 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2217 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2218 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2219 start_va = 0x90000 end_va = 0x9ffff entry_point = 0x0 region_type = private name = "private_0x0000000000090000" filename = "" Region: id = 2220 start_va = 0xa0000 end_va = 0xa7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000a0000" filename = "" Region: id = 2221 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2222 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2223 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2224 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2225 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2226 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2227 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2228 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2229 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2230 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2231 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2232 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2233 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2234 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2235 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2236 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2237 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2238 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2239 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2240 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2241 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2242 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2243 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2244 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2245 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2246 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2247 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2248 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2249 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2250 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2251 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2252 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2253 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2254 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2255 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2256 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2257 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2258 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2259 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2260 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2261 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2262 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2263 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2264 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2265 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2266 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2267 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2268 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2269 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2270 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2271 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2272 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2273 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2274 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2275 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2276 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2277 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2278 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2279 start_va = 0x90000 end_va = 0x9ffff entry_point = 0x0 region_type = private name = "private_0x0000000000090000" filename = "" Region: id = 2280 start_va = 0xa0000 end_va = 0xa7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000a0000" filename = "" Region: id = 2281 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2282 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2283 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2284 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2285 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2286 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2287 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2288 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2289 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2290 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2291 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2292 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2293 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2294 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2295 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2296 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2297 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2298 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2299 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2300 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2301 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2302 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2303 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2304 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2305 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2306 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2307 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2308 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2309 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2310 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2311 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2312 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2313 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2314 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2315 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2316 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2317 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2318 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2319 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2320 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2321 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2322 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2323 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2324 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2325 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2326 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2327 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2328 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2329 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2330 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2331 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2332 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2333 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2334 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2335 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2336 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2337 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2338 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2339 start_va = 0x90000 end_va = 0x9ffff entry_point = 0x0 region_type = private name = "private_0x0000000000090000" filename = "" Region: id = 2340 start_va = 0xa0000 end_va = 0xa7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000a0000" filename = "" Region: id = 2341 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2342 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2343 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2344 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2345 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2346 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2347 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2348 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2349 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2350 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2351 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2352 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2353 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2354 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2355 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2356 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2357 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2358 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2359 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2360 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2361 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2362 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2363 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2364 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2365 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2366 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2367 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2368 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2369 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2370 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2371 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2372 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2373 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2374 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2375 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2376 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2377 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2378 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2379 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2380 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2381 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2382 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2383 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2384 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2385 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2386 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2387 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2388 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2389 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2390 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2391 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2392 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2393 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2394 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2395 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2396 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2397 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2398 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2399 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2400 start_va = 0x90000 end_va = 0x9ffff entry_point = 0x0 region_type = private name = "private_0x0000000000090000" filename = "" Region: id = 2401 start_va = 0xa0000 end_va = 0xa7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000a0000" filename = "" Region: id = 2402 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2403 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2404 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2405 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2406 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2407 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2408 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2409 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2410 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2411 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2412 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2413 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2414 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2415 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2416 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2417 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2418 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2419 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2420 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2421 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2422 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2423 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2424 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2425 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2426 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2427 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2428 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2429 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2430 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2431 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2432 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2433 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2434 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2435 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2436 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2437 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2438 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2439 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2440 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2441 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2442 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2443 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2444 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2445 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2446 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2447 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2448 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2449 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2450 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2451 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2452 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2453 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2454 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2455 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2456 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2457 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2458 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2459 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2460 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2461 start_va = 0x90000 end_va = 0x9ffff entry_point = 0x0 region_type = private name = "private_0x0000000000090000" filename = "" Region: id = 2462 start_va = 0xa0000 end_va = 0xa7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000a0000" filename = "" Region: id = 2463 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2464 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2465 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2466 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2467 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2468 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2469 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2470 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2471 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2472 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2473 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2474 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2475 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2476 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2477 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2478 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2479 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2480 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2481 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2482 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2483 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2484 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2485 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2486 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2487 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2488 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2489 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2490 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2491 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2492 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2493 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2494 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2495 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2496 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2497 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2498 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2499 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2500 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2501 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2502 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2503 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2504 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2505 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2506 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2507 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2508 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2509 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2510 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2511 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2512 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2513 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2514 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2515 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2516 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2517 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2518 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2519 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2520 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Region: id = 2521 start_va = 0x90000 end_va = 0x97fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000090000" filename = "" Thread: id = 17 os_tid = 0xb5c [0099.746] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x757c0000 [0099.746] GetProcAddress (hModule=0x757c0000, lpProcName="GetProcAddress") returned 0x757d1222 [0099.746] GetProcAddress (hModule=0x757c0000, lpProcName="GetModuleHandleW") returned 0x757d34b0 [0099.746] GetProcAddress (hModule=0x757c0000, lpProcName="FindNextFileW") returned 0x757d54ee [0099.746] GetProcAddress (hModule=0x757c0000, lpProcName="FindClose") returned 0x757d4442 [0099.746] GetProcAddress (hModule=0x757c0000, lpProcName="MoveFileW") returned 0x757e9af0 [0099.746] GetProcAddress (hModule=0x757c0000, lpProcName="GetFileSizeEx") returned 0x757d59e2 [0099.746] GetProcAddress (hModule=0x757c0000, lpProcName="GetModuleFileNameW") returned 0x757d4950 [0099.746] GetProcAddress (hModule=0x757c0000, lpProcName="GetFileAttributesW") returned 0x757d1b18 [0099.746] GetProcAddress (hModule=0x757c0000, lpProcName="ExitProcess") returned 0x757d7a10 [0099.746] GetProcAddress (hModule=0x757c0000, lpProcName="GetCommandLineW") returned 0x757d5223 [0099.746] GetProcAddress (hModule=0x757c0000, lpProcName="GetComputerNameW") returned 0x757ddd0e [0099.746] GetProcAddress (hModule=0x757c0000, lpProcName="GetComputerNameA") returned 0x757eb6e0 [0099.746] GetProcAddress (hModule=0x757c0000, lpProcName="CreateMutexW") returned 0x757d424c [0099.746] GetProcAddress (hModule=0x757c0000, lpProcName="lstrlenW") returned 0x757d1700 [0099.746] GetProcAddress (hModule=0x757c0000, lpProcName="lstrlenA") returned 0x757d5a4b [0099.746] GetProcAddress (hModule=0x757c0000, lpProcName="GetCurrentProcess") returned 0x757d1809 [0099.746] GetProcAddress (hModule=0x757c0000, lpProcName="WaitForSingleObject") returned 0x757d1136 [0099.746] GetProcAddress (hModule=0x757c0000, lpProcName="GetLogicalDrives") returned 0x757d5371 [0099.747] GetProcAddress (hModule=0x757c0000, lpProcName="GetTickCount") returned 0x757d110c [0099.747] GetProcAddress (hModule=0x757c0000, lpProcName="DeleteFileW") returned 0x757d89b3 [0099.747] GetProcAddress (hModule=0x757c0000, lpProcName="WideCharToMultiByte") returned 0x757d170d [0099.747] GetProcAddress (hModule=0x757c0000, lpProcName="InitializeCriticalSectionAndSpinCount") returned 0x757d1916 [0099.747] GetProcAddress (hModule=0x757c0000, lpProcName="Sleep") returned 0x757d10ff [0099.747] GetProcAddress (hModule=0x757c0000, lpProcName="LeaveCriticalSection") returned 0x77ad2270 [0099.747] GetProcAddress (hModule=0x757c0000, lpProcName="ReadFile") returned 0x757d3ed3 [0099.747] GetProcAddress (hModule=0x757c0000, lpProcName="CreateFileW") returned 0x757d3f5c [0099.747] GetProcAddress (hModule=0x757c0000, lpProcName="OpenMutexW") returned 0x757d5151 [0099.747] GetProcAddress (hModule=0x757c0000, lpProcName="EnterCriticalSection") returned 0x77ad22b0 [0099.747] GetProcAddress (hModule=0x757c0000, lpProcName="WaitForMultipleObjects") returned 0x757d4220 [0099.747] GetProcAddress (hModule=0x757c0000, lpProcName="lstrcmpiW") returned 0x757ed5cd [0099.747] GetProcAddress (hModule=0x757c0000, lpProcName="lstrcmpiA") returned 0x757d3e8e [0099.747] GetProcAddress (hModule=0x757c0000, lpProcName="DeleteCriticalSection") returned 0x77ae45f5 [0099.747] GetProcAddress (hModule=0x757c0000, lpProcName="ReleaseMutex") returned 0x757d111e [0099.747] GetProcAddress (hModule=0x757c0000, lpProcName="CloseHandle") returned 0x757d1410 [0099.747] GetProcAddress (hModule=0x757c0000, lpProcName="GetVersion") returned 0x757d4467 [0099.747] GetProcAddress (hModule=0x757c0000, lpProcName="CreateThread") returned 0x757d34d5 [0099.747] GetProcAddress (hModule=0x757c0000, lpProcName="ExpandEnvironmentStringsW") returned 0x757d4173 [0099.747] GetProcAddress (hModule=0x757c0000, lpProcName="QueryPerformanceCounter") returned 0x757d1725 [0099.747] GetProcAddress (hModule=0x757c0000, lpProcName="QueryPerformanceFrequency") returned 0x757d41f0 [0099.747] GetProcAddress (hModule=0x757c0000, lpProcName="GetCurrentProcessId") returned 0x757d11f8 [0099.747] GetProcAddress (hModule=0x757c0000, lpProcName="SetFileAttributesW") returned 0x757ed4f7 [0099.747] GetProcAddress (hModule=0x757c0000, lpProcName="GetVolumeInformationW") returned 0x757ec860 [0099.747] GetProcAddress (hModule=0x757c0000, lpProcName="WriteFile") returned 0x757d1282 [0099.747] GetProcAddress (hModule=0x757c0000, lpProcName="SetFilePointerEx") returned 0x757ec807 [0099.747] GetProcAddress (hModule=0x757c0000, lpProcName="SetEndOfFile") returned 0x757ece2e [0099.748] GetProcAddress (hModule=0x757c0000, lpProcName="FindFirstFileW") returned 0x757d4435 [0099.748] GetProcAddress (hModule=0x757c0000, lpProcName="GetProcessHeap") returned 0x757d14e9 [0099.748] GetProcAddress (hModule=0x757c0000, lpProcName="HeapReAlloc") returned 0x77af1f6e [0099.748] GetProcAddress (hModule=0x757c0000, lpProcName="HeapAlloc") returned 0x77ade026 [0099.748] GetProcAddress (hModule=0x757c0000, lpProcName="HeapFree") returned 0x757d14c9 [0099.748] GetProcAddress (hModule=0x757c0000, lpProcName="CreatePipe") returned 0x7585415b [0099.748] GetProcAddress (hModule=0x757c0000, lpProcName="SetHandleInformation") returned 0x757e195c [0099.748] GetProcAddress (hModule=0x757c0000, lpProcName="CreateProcessW") returned 0x757d103d [0099.748] GetProcAddress (hModule=0x757c0000, lpProcName="CompareStringW") returned 0x757d3bca [0099.748] GetProcAddress (hModule=0x757c0000, lpProcName="CompareStringA") returned 0x757d3c5a [0099.748] GetProcAddress (hModule=0x757c0000, lpProcName="OpenProcess") returned 0x757d1986 [0099.748] GetProcAddress (hModule=0x757c0000, lpProcName="TerminateProcess") returned 0x757ed802 [0099.748] GetProcAddress (hModule=0x757c0000, lpProcName="GetSystemTime") returned 0x757d5a96 [0099.748] GetProcAddress (hModule=0x757c0000, lpProcName="SystemTimeToFileTime") returned 0x757d5a7e [0099.748] GetProcAddress (hModule=0x757c0000, lpProcName="GetLastError") returned 0x757d11c0 [0099.748] GetProcAddress (hModule=0x757c0000, lpProcName="CreateToolhelp32Snapshot") returned 0x757f735f [0099.748] GetProcAddress (hModule=0x757c0000, lpProcName="Process32NextW") returned 0x757f896c [0099.748] GetProcAddress (hModule=0x757c0000, lpProcName="Process32FirstW") returned 0x757f8baf [0099.748] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x75720000 [0099.753] GetProcAddress (hModule=0x75720000, lpProcName="RegOpenKeyExW") returned 0x7573468d [0099.753] GetProcAddress (hModule=0x75720000, lpProcName="RegQueryValueExW") returned 0x757346ad [0099.754] GetProcAddress (hModule=0x75720000, lpProcName="RegSetValueExW") returned 0x757314d6 [0099.754] GetProcAddress (hModule=0x75720000, lpProcName="RegCloseKey") returned 0x7573469d [0099.754] GetProcAddress (hModule=0x75720000, lpProcName="OpenProcessToken") returned 0x75734304 [0099.754] GetProcAddress (hModule=0x75720000, lpProcName="GetTokenInformation") returned 0x7573431c [0099.754] GetProcAddress (hModule=0x75720000, lpProcName="OpenSCManagerW") returned 0x7572ca64 [0099.754] GetProcAddress (hModule=0x75720000, lpProcName="OpenServiceW") returned 0x7572ca4c [0099.754] GetProcAddress (hModule=0x75720000, lpProcName="CloseServiceHandle") returned 0x7573369c [0099.754] GetProcAddress (hModule=0x75720000, lpProcName="ControlService") returned 0x75747144 [0099.754] GetProcAddress (hModule=0x75720000, lpProcName="QueryServiceStatus") returned 0x75732a86 [0099.754] GetProcAddress (hModule=0x75720000, lpProcName="EnumDependentServicesW") returned 0x75721e3a [0099.754] GetProcAddress (hModule=0x75720000, lpProcName="EnumServicesStatusExW") returned 0x7572b466 [0099.754] LoadLibraryA (lpLibFileName="user32.dll") returned 0x775b0000 [0099.763] GetProcAddress (hModule=0x775b0000, lpProcName="SystemParametersInfoW") returned 0x775c90d3 [0099.763] LoadLibraryA (lpLibFileName="Shell32.dll") returned 0x76900000 [0101.490] GetProcAddress (hModule=0x76900000, lpProcName="ShellExecuteExW") returned 0x76921e46 [0101.490] LoadLibraryA (lpLibFileName="ntdll.dll") returned 0x77ab0000 [0101.490] GetProcAddress (hModule=0x77ab0000, lpProcName="NtQuerySystemInformation") returned 0x77acfda0 [0101.490] LoadLibraryA (lpLibFileName="mpr.dll") returned 0x74680000 [0101.547] GetProcAddress (hModule=0x74680000, lpProcName="WNetCloseEnum") returned 0x74682dd6 [0101.547] GetProcAddress (hModule=0x74680000, lpProcName="WNetOpenEnumW") returned 0x74682f06 [0101.547] GetProcAddress (hModule=0x74680000, lpProcName="WNetEnumResourceW") returned 0x74683058 [0101.547] LoadLibraryA (lpLibFileName="ws2_32.dll") returned 0x768c0000 [0101.708] GetProcAddress (hModule=0x768c0000, lpProcName="WSAStartup") returned 0x768c3ab2 [0101.708] GetProcAddress (hModule=0x768c0000, lpProcName="socket") returned 0x768c3eb8 [0101.708] GetProcAddress (hModule=0x768c0000, lpProcName="send") returned 0x768c6f01 [0101.708] GetProcAddress (hModule=0x768c0000, lpProcName="recv") returned 0x768c6b0e [0101.708] GetProcAddress (hModule=0x768c0000, lpProcName="connect") returned 0x768c6bdd [0101.708] GetProcAddress (hModule=0x768c0000, lpProcName="closesocket") returned 0x768c3918 [0101.708] GetProcAddress (hModule=0x768c0000, lpProcName="gethostbyname") returned 0x768d7673 [0101.708] GetProcAddress (hModule=0x768c0000, lpProcName="inet_addr") returned 0x768c311b [0101.708] GetProcAddress (hModule=0x768c0000, lpProcName="ntohl") returned 0x768c2d57 [0101.708] GetProcAddress (hModule=0x768c0000, lpProcName="htonl") returned 0x768c2d57 [0101.708] GetProcAddress (hModule=0x768c0000, lpProcName="htons") returned 0x768c2d8b [0101.708] QueryPerformanceCounter (in: lpPerformanceCount=0x26f768 | out: lpPerformanceCount=0x26f768*=17174817961) returned 1 [0101.708] GetTickCount () returned 0x276a5 [0101.708] GetCurrentProcessId () returned 0xb58 [0101.709] GetTickCount () returned 0x276a5 [0101.709] GetTickCount () returned 0x276a5 [0101.709] GetVersion () returned 0x1db10106 [0101.709] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\syncronize_T738DVA") returned 0x0 [0101.710] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\syncronize_T738DVA") returned 0x84 [0101.710] lstrlenW (lpString="Global\\syncronize_") returned 18 [0101.710] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\syncronize_T738DVU") returned 0x0 [0101.710] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\syncronize_T738DVU") returned 0x88 [0101.710] lstrlenW (lpString="Global\\syncronize_") returned 18 [0101.710] GetVersion () returned 0x1db10106 [0101.710] GetCurrentProcess () returned 0xffffffff [0101.710] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x26f754 | out: TokenHandle=0x26f754*=0x8c) returned 1 [0101.710] GetTokenInformation (in: TokenHandle=0x8c, TokenInformationClass=0x14, TokenInformation=0x26f750, TokenInformationLength=0x4, ReturnLength=0x26f75c | out: TokenInformation=0x26f750, ReturnLength=0x26f75c) returned 1 [0101.710] CloseHandle (hObject=0x8c) returned 1 [0101.710] WaitForSingleObject (hHandle=0x88, dwMilliseconds=0x0) returned 0x0 [0101.710] WaitForSingleObject (hHandle=0x84, dwMilliseconds=0x3e8) returned 0x0 [0101.711] lstrlenW (lpString="doc(.doc;.docx;.pdf;.xls;.xlsx;.ppt;)arc(.zip;.rar;.bz2;.7z;)dbf(.dbf;)1c8(.1cd;)jpg(.jpg;)") returned 91 [0101.711] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x26f7a0 | out: lpWSAData=0x26f7a0) returned 0 [0101.717] lstrlenW (lpString="1c8.exe;1cv77.exe;outlook.exe;postgres.exe;mysqld-nt.exe;mysqld.exe;sqlservr.exe;") returned 81 [0101.717] lstrlenW (lpString="FirebirdGuardianDefaultInstance;FirebirdServerDefaultInstance;sqlwriter;mssqlserver;sqlserveradhelper;") returned 102 [0101.717] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x7f5940 [0101.720] EnumServicesStatusExW (in: hSCManager=0x7f5940, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x26f73c, lpServicesReturned=0x26f754, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x26f73c, lpServicesReturned=0x26f754, lpResumeHandle=0x0) returned 0 [0101.720] GetLastError () returned 0xea [0101.720] EnumServicesStatusExW (in: hSCManager=0x7f5940, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x7f9240, cbBufSize=0x13a2, pcbBytesNeeded=0x26f73c, lpServicesReturned=0x26f754, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x7f9240, pcbBytesNeeded=0x26f73c, lpServicesReturned=0x26f754, lpResumeHandle=0x0) returned 1 [0101.721] CloseServiceHandle (hSCObject=0x7f5940) returned 1 [0101.722] lstrlenW (lpString="Appinfo") returned 7 [0101.722] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0101.722] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0101.722] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0101.722] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0101.722] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0101.722] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0101.722] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0101.722] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0101.722] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0101.722] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0101.722] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0101.722] lstrlenW (lpString="AudioSrv") returned 8 [0101.722] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0101.722] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0101.722] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0101.722] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0101.722] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0101.722] lstrlenW (lpString="BFE") returned 3 [0101.722] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0101.722] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0101.722] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0101.722] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0101.722] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0101.722] lstrlenW (lpString="CryptSvc") returned 8 [0101.722] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0101.722] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0101.722] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0101.722] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0101.722] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0101.722] lstrlenW (lpString="CscService") returned 10 [0101.722] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0101.722] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0101.722] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0101.722] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0101.722] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0101.722] lstrlenW (lpString="DcomLaunch") returned 10 [0101.722] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0101.722] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0101.722] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0101.722] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0101.723] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0101.723] lstrlenW (lpString="Dhcp") returned 4 [0101.723] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0101.723] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0101.723] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0101.723] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0101.723] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0101.723] lstrlenW (lpString="Dnscache") returned 8 [0101.723] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0101.723] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0101.723] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0101.723] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0101.723] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0101.723] lstrlenW (lpString="DPS") returned 3 [0101.723] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0101.723] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0101.723] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0101.723] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0101.723] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0101.723] lstrlenW (lpString="eventlog") returned 8 [0101.723] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0101.723] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0101.723] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0101.723] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0101.723] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0101.723] lstrlenW (lpString="EventSystem") returned 11 [0101.723] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0101.723] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0101.723] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0101.723] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0101.723] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0101.723] lstrlenW (lpString="FontCache") returned 9 [0101.723] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0101.723] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0101.723] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0101.723] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0101.723] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0101.723] lstrlenW (lpString="gpsvc") returned 5 [0101.723] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0101.723] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0101.723] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0101.723] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0101.723] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0101.723] lstrlenW (lpString="iphlpsvc") returned 8 [0101.723] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0101.723] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0101.723] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0101.723] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0101.723] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0101.723] lstrlenW (lpString="LanmanServer") returned 12 [0101.723] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0101.723] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0101.724] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0101.724] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0101.724] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0101.724] lstrlenW (lpString="LanmanWorkstation") returned 17 [0101.724] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0101.724] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0101.724] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0101.724] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0101.724] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0101.724] lstrlenW (lpString="lmhosts") returned 7 [0101.724] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0101.724] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0101.724] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0101.724] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0101.724] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0101.724] lstrlenW (lpString="MMCSS") returned 5 [0101.724] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0101.724] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0101.724] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0101.724] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0101.724] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0101.724] lstrlenW (lpString="MpsSvc") returned 6 [0101.724] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0101.724] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0101.724] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0101.724] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0101.724] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0101.724] lstrlenW (lpString="Netman") returned 6 [0101.724] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0101.724] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0101.724] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0101.724] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0101.724] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0101.724] lstrlenW (lpString="netprofm") returned 8 [0101.724] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0101.724] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0101.724] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0101.724] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0101.724] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0101.724] lstrlenW (lpString="NlaSvc") returned 6 [0101.724] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0101.724] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0101.724] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0101.724] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0101.724] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0101.724] lstrlenW (lpString="nsi") returned 3 [0101.724] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0101.724] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0101.724] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0101.724] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0101.724] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0101.724] lstrlenW (lpString="PcaSvc") returned 6 [0101.725] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0101.725] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0101.725] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0101.725] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0101.725] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0101.725] lstrlenW (lpString="PlugPlay") returned 8 [0101.725] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0101.725] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0101.725] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0101.725] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0101.725] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0101.725] lstrlenW (lpString="Power") returned 5 [0101.725] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0101.725] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0101.725] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0101.725] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0101.725] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0101.725] lstrlenW (lpString="ProfSvc") returned 7 [0101.725] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0101.725] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0101.725] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0101.725] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0101.725] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0101.725] lstrlenW (lpString="RpcEptMapper") returned 12 [0101.725] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0101.725] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0101.725] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0101.725] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0101.725] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0101.725] lstrlenW (lpString="RpcSs") returned 5 [0101.725] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0101.725] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0101.725] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0101.725] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0101.725] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0101.725] lstrlenW (lpString="SamSs") returned 5 [0101.725] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0101.725] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0101.725] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0101.725] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0101.725] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0101.725] lstrlenW (lpString="Schedule") returned 8 [0101.725] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0101.725] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0101.725] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0101.725] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0101.725] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0101.725] lstrlenW (lpString="SENS") returned 4 [0101.725] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0101.725] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0101.725] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0101.725] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0101.726] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0101.726] lstrlenW (lpString="ShellHWDetection") returned 16 [0101.726] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0101.726] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0101.726] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0101.726] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0101.726] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0101.726] lstrlenW (lpString="Spooler") returned 7 [0101.726] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0101.726] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0101.726] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0101.726] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0101.726] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0101.726] lstrlenW (lpString="sppsvc") returned 6 [0101.726] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="sppsvc") returned -1 [0101.726] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="sppsvc") returned -1 [0101.726] lstrcmpiW (lpString1="sqlwriter", lpString2="sppsvc") returned 1 [0101.726] lstrcmpiW (lpString1="mssqlserver", lpString2="sppsvc") returned -1 [0101.726] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="sppsvc") returned 1 [0101.726] lstrlenW (lpString="SysMain") returned 7 [0101.726] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0101.726] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0101.726] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0101.726] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0101.726] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0101.726] lstrlenW (lpString="Themes") returned 6 [0101.726] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0101.726] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0101.726] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0101.726] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0101.726] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0101.726] lstrlenW (lpString="TrkWks") returned 6 [0101.726] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0101.726] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0101.726] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0101.726] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0101.726] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0101.726] lstrlenW (lpString="UxSms") returned 5 [0101.726] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0101.726] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0101.726] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0101.726] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0101.726] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0101.726] lstrlenW (lpString="W32Time") returned 7 [0101.726] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="W32Time") returned -1 [0101.726] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="W32Time") returned -1 [0101.726] lstrcmpiW (lpString1="sqlwriter", lpString2="W32Time") returned -1 [0101.726] lstrcmpiW (lpString1="mssqlserver", lpString2="W32Time") returned -1 [0101.726] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="W32Time") returned -1 [0101.726] lstrlenW (lpString="WdiServiceHost") returned 14 [0101.726] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0101.726] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0101.726] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0101.727] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0101.727] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0101.727] lstrlenW (lpString="WdiSystemHost") returned 13 [0101.727] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0101.727] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0101.727] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0101.727] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0101.727] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0101.727] lstrlenW (lpString="WinDefend") returned 9 [0101.727] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinDefend") returned -1 [0101.727] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinDefend") returned -1 [0101.727] lstrcmpiW (lpString1="sqlwriter", lpString2="WinDefend") returned -1 [0101.727] lstrcmpiW (lpString1="mssqlserver", lpString2="WinDefend") returned -1 [0101.727] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinDefend") returned -1 [0101.727] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0101.727] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0101.727] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0101.727] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0101.727] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0101.727] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0101.727] lstrlenW (lpString="Winmgmt") returned 7 [0101.727] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0101.727] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0101.727] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0101.727] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0101.727] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0101.727] lstrlenW (lpString="wscsvc") returned 6 [0101.727] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wscsvc") returned -1 [0101.727] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wscsvc") returned -1 [0101.727] lstrcmpiW (lpString1="sqlwriter", lpString2="wscsvc") returned -1 [0101.727] lstrcmpiW (lpString1="mssqlserver", lpString2="wscsvc") returned -1 [0101.727] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wscsvc") returned -1 [0101.727] lstrlenW (lpString="wuauserv") returned 8 [0101.727] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wuauserv") returned -1 [0101.727] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wuauserv") returned -1 [0101.727] lstrcmpiW (lpString1="sqlwriter", lpString2="wuauserv") returned -1 [0101.727] lstrcmpiW (lpString1="mssqlserver", lpString2="wuauserv") returned -1 [0101.727] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wuauserv") returned -1 [0101.727] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0xe0 [0101.729] Process32FirstW (in: hSnapshot=0xe0, lppe=0x26f52c | out: lppe=0x26f52c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0101.729] Process32NextW (in: hSnapshot=0xe0, lppe=0x26f52c | out: lppe=0x26f52c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0101.730] lstrlenW (lpString="System") returned 6 [0101.730] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0101.730] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0101.730] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0101.730] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0101.730] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0101.730] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0101.730] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0101.730] Process32NextW (in: hSnapshot=0xe0, lppe=0x26f52c | out: lppe=0x26f52c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0101.730] lstrlenW (lpString="smss.exe") returned 8 [0101.730] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0101.730] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0101.730] Process32NextW (in: hSnapshot=0xe0, lppe=0x26f52c | out: lppe=0x26f52c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0101.731] lstrlenW (lpString="csrss.exe") returned 9 [0101.731] Process32NextW (in: hSnapshot=0xe0, lppe=0x26f52c | out: lppe=0x26f52c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0101.731] lstrlenW (lpString="wininit.exe") returned 11 [0101.731] Process32NextW (in: hSnapshot=0xe0, lppe=0x26f52c | out: lppe=0x26f52c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0101.731] lstrlenW (lpString="csrss.exe") returned 9 [0101.731] Process32NextW (in: hSnapshot=0xe0, lppe=0x26f52c | out: lppe=0x26f52c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0101.731] lstrlenW (lpString="winlogon.exe") returned 12 [0101.732] Process32NextW (in: hSnapshot=0xe0, lppe=0x26f52c | out: lppe=0x26f52c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0101.732] lstrlenW (lpString="services.exe") returned 12 [0101.732] Process32NextW (in: hSnapshot=0xe0, lppe=0x26f52c | out: lppe=0x26f52c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0101.732] lstrlenW (lpString="lsass.exe") returned 9 [0101.732] Process32NextW (in: hSnapshot=0xe0, lppe=0x26f52c | out: lppe=0x26f52c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0101.732] lstrlenW (lpString="lsm.exe") returned 7 [0101.732] Process32NextW (in: hSnapshot=0xe0, lppe=0x26f52c | out: lppe=0x26f52c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0101.733] lstrlenW (lpString="svchost.exe") returned 11 [0101.733] Process32NextW (in: hSnapshot=0xe0, lppe=0x26f52c | out: lppe=0x26f52c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0101.733] lstrlenW (lpString="svchost.exe") returned 11 [0101.733] Process32NextW (in: hSnapshot=0xe0, lppe=0x26f52c | out: lppe=0x26f52c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0101.733] lstrlenW (lpString="svchost.exe") returned 11 [0101.733] Process32NextW (in: hSnapshot=0xe0, lppe=0x26f52c | out: lppe=0x26f52c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0101.734] lstrlenW (lpString="svchost.exe") returned 11 [0101.734] Process32NextW (in: hSnapshot=0xe0, lppe=0x26f52c | out: lppe=0x26f52c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2a, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0101.734] lstrlenW (lpString="svchost.exe") returned 11 [0101.734] Process32NextW (in: hSnapshot=0xe0, lppe=0x26f52c | out: lppe=0x26f52c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0101.734] lstrlenW (lpString="audiodg.exe") returned 11 [0101.734] Process32NextW (in: hSnapshot=0xe0, lppe=0x26f52c | out: lppe=0x26f52c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0101.735] lstrlenW (lpString="svchost.exe") returned 11 [0101.735] Process32NextW (in: hSnapshot=0xe0, lppe=0x26f52c | out: lppe=0x26f52c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0101.735] lstrlenW (lpString="svchost.exe") returned 11 [0101.735] Process32NextW (in: hSnapshot=0xe0, lppe=0x26f52c | out: lppe=0x26f52c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0101.735] lstrlenW (lpString="spoolsv.exe") returned 11 [0101.735] Process32NextW (in: hSnapshot=0xe0, lppe=0x26f52c | out: lppe=0x26f52c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0101.736] lstrlenW (lpString="svchost.exe") returned 11 [0101.736] Process32NextW (in: hSnapshot=0xe0, lppe=0x26f52c | out: lppe=0x26f52c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0101.736] lstrlenW (lpString="taskhost.exe") returned 12 [0101.736] Process32NextW (in: hSnapshot=0xe0, lppe=0x26f52c | out: lppe=0x26f52c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x558, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0101.736] lstrlenW (lpString="dwm.exe") returned 7 [0101.736] Process32NextW (in: hSnapshot=0xe0, lppe=0x26f52c | out: lppe=0x26f52c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x54c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0101.736] lstrlenW (lpString="explorer.exe") returned 12 [0101.737] Process32NextW (in: hSnapshot=0xe0, lppe=0x26f52c | out: lppe=0x26f52c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0101.737] lstrlenW (lpString="taskeng.exe") returned 11 [0101.737] Process32NextW (in: hSnapshot=0xe0, lppe=0x26f52c | out: lppe=0x26f52c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0101.737] lstrlenW (lpString="taskhost.exe") returned 12 [0101.737] Process32NextW (in: hSnapshot=0xe0, lppe=0x26f52c | out: lppe=0x26f52c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="watches-vessel-arbitrary.exe")) returned 1 [0101.737] lstrlenW (lpString="watches-vessel-arbitrary.exe") returned 28 [0101.737] Process32NextW (in: hSnapshot=0xe0, lppe=0x26f52c | out: lppe=0x26f52c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="alsopound.exe")) returned 1 [0101.738] lstrlenW (lpString="alsopound.exe") returned 13 [0101.738] Process32NextW (in: hSnapshot=0xe0, lppe=0x26f52c | out: lppe=0x26f52c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x478, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="measuredamsterdamsandwich.exe")) returned 1 [0101.738] lstrlenW (lpString="measuredamsterdamsandwich.exe") returned 29 [0101.738] Process32NextW (in: hSnapshot=0xe0, lppe=0x26f52c | out: lppe=0x26f52c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="ooo_lucy_millions.exe")) returned 1 [0101.738] lstrlenW (lpString="ooo_lucy_millions.exe") returned 21 [0101.738] Process32NextW (in: hSnapshot=0xe0, lppe=0x26f52c | out: lppe=0x26f52c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="appearance.exe")) returned 1 [0101.739] lstrlenW (lpString="appearance.exe") returned 14 [0101.739] Process32NextW (in: hSnapshot=0xe0, lppe=0x26f52c | out: lppe=0x26f52c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="albert.exe")) returned 1 [0101.739] lstrlenW (lpString="albert.exe") returned 10 [0101.739] Process32NextW (in: hSnapshot=0xe0, lppe=0x26f52c | out: lppe=0x26f52c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="implied-enquiries.exe")) returned 1 [0101.739] lstrlenW (lpString="implied-enquiries.exe") returned 21 [0101.739] Process32NextW (in: hSnapshot=0xe0, lppe=0x26f52c | out: lppe=0x26f52c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x72c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="boston_opening.exe")) returned 1 [0101.740] lstrlenW (lpString="boston_opening.exe") returned 18 [0101.740] Process32NextW (in: hSnapshot=0xe0, lppe=0x26f52c | out: lppe=0x26f52c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="portsmouth.exe")) returned 1 [0101.740] lstrlenW (lpString="portsmouth.exe") returned 14 [0101.740] Process32NextW (in: hSnapshot=0xe0, lppe=0x26f52c | out: lppe=0x26f52c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="cameras grew poverty.exe")) returned 1 [0101.740] lstrlenW (lpString="cameras grew poverty.exe") returned 24 [0101.740] Process32NextW (in: hSnapshot=0xe0, lppe=0x26f52c | out: lppe=0x26f52c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="dxrapids.exe")) returned 1 [0101.741] lstrlenW (lpString="dxrapids.exe") returned 12 [0101.741] Process32NextW (in: hSnapshot=0xe0, lppe=0x26f52c | out: lppe=0x26f52c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x33c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="visitors.exe")) returned 1 [0101.741] lstrlenW (lpString="visitors.exe") returned 12 [0101.741] Process32NextW (in: hSnapshot=0xe0, lppe=0x26f52c | out: lppe=0x26f52c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="organisations_officially.exe")) returned 1 [0101.741] lstrlenW (lpString="organisations_officially.exe") returned 28 [0101.741] Process32NextW (in: hSnapshot=0xe0, lppe=0x26f52c | out: lppe=0x26f52c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x61c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="pair.exe")) returned 1 [0101.741] lstrlenW (lpString="pair.exe") returned 8 [0101.742] Process32NextW (in: hSnapshot=0xe0, lppe=0x26f52c | out: lppe=0x26f52c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="gross.exe")) returned 1 [0101.742] lstrlenW (lpString="gross.exe") returned 9 [0101.742] Process32NextW (in: hSnapshot=0xe0, lppe=0x26f52c | out: lppe=0x26f52c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x470, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="viewpicture.exe")) returned 1 [0101.742] lstrlenW (lpString="viewpicture.exe") returned 15 [0101.742] Process32NextW (in: hSnapshot=0xe0, lppe=0x26f52c | out: lppe=0x26f52c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="transmitted.exe")) returned 1 [0101.742] lstrlenW (lpString="transmitted.exe") returned 15 [0101.742] Process32NextW (in: hSnapshot=0xe0, lppe=0x26f52c | out: lppe=0x26f52c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x634, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="sunglassescelebs.exe")) returned 1 [0101.743] lstrlenW (lpString="sunglassescelebs.exe") returned 20 [0101.743] Process32NextW (in: hSnapshot=0xe0, lppe=0x26f52c | out: lppe=0x26f52c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="waiver-issue.exe")) returned 1 [0101.743] lstrlenW (lpString="waiver-issue.exe") returned 16 [0101.743] Process32NextW (in: hSnapshot=0xe0, lppe=0x26f52c | out: lppe=0x26f52c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x808, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="gziprear.exe")) returned 1 [0101.743] lstrlenW (lpString="gziprear.exe") returned 12 [0101.744] Process32NextW (in: hSnapshot=0xe0, lppe=0x26f52c | out: lppe=0x26f52c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x818, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="gregoryletters.exe")) returned 1 [0101.744] lstrlenW (lpString="gregoryletters.exe") returned 18 [0101.744] Process32NextW (in: hSnapshot=0xe0, lppe=0x26f52c | out: lppe=0x26f52c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x828, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="intel-metadata-rich.exe")) returned 1 [0101.744] lstrlenW (lpString="intel-metadata-rich.exe") returned 23 [0101.744] Process32NextW (in: hSnapshot=0xe0, lppe=0x26f52c | out: lppe=0x26f52c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x838, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="cemeteryreconstructiondimension.exe")) returned 1 [0101.744] lstrlenW (lpString="cemeteryreconstructiondimension.exe") returned 35 [0101.744] Process32NextW (in: hSnapshot=0xe0, lppe=0x26f52c | out: lppe=0x26f52c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0101.745] lstrlenW (lpString="svchost.exe") returned 11 [0101.745] Process32NextW (in: hSnapshot=0xe0, lppe=0x26f52c | out: lppe=0x26f52c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0101.745] lstrlenW (lpString="sppsvc.exe") returned 10 [0101.745] Process32NextW (in: hSnapshot=0xe0, lppe=0x26f52c | out: lppe=0x26f52c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xab4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0101.745] lstrlenW (lpString="svchost.exe") returned 11 [0101.745] Process32NextW (in: hSnapshot=0xe0, lppe=0x26f52c | out: lppe=0x26f52c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x9f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="unlikexpc.exe")) returned 1 [0101.746] lstrlenW (lpString="unlikexpc.exe") returned 13 [0101.746] Process32NextW (in: hSnapshot=0xe0, lppe=0x26f52c | out: lppe=0x26f52c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x9f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="unlikexpc.exe")) returned 0 [0101.746] CloseHandle (hObject=0xe0) returned 1 [0101.747] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x80b650, nSize=0x7fff | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\unlikexpc.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\unlikexpc.exe")) returned 0x33 [0101.748] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0101.748] ExpandEnvironmentStringsW (in: lpSrc="%windir%\\System32\\unlikexpc.exe", lpDst=0x81b658, nSize=0x7fff | out: lpDst="C:\\Windows\\System32\\unlikexpc.exe") returned 0x22 [0101.748] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x757c0000 [0101.748] GetProcAddress (hModule=0x757c0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x757ed650 [0101.748] Wow64DisableWow64FsRedirection (in: OldValue=0x26f74c | out: OldValue=0x26f74c*=0x0) returned 1 [0101.748] lstrlenW (lpString="kernel32.dll") returned 12 [0101.748] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0101.748] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\unlikexpc.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\unlikexpc.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe0 [0101.748] CreateFileW (lpFileName="C:\\Windows\\System32\\unlikexpc.exe" (normalized: "c:\\windows\\system32\\unlikexpc.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe4 [0101.749] ReadFile (in: hFile=0xe0, lpBuffer=0x2300020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x26f748, lpOverlapped=0x0 | out: lpBuffer=0x2300020*, lpNumberOfBytesRead=0x26f748*=0x4de47, lpOverlapped=0x0) returned 1 [0101.753] WriteFile (in: hFile=0xe4, lpBuffer=0x2300020*, nNumberOfBytesToWrite=0x4de47, lpNumberOfBytesWritten=0x26f748, lpOverlapped=0x0 | out: lpBuffer=0x2300020*, lpNumberOfBytesWritten=0x26f748*=0x4de47, lpOverlapped=0x0) returned 1 [0101.756] ReadFile (in: hFile=0xe0, lpBuffer=0x2300020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x26f748, lpOverlapped=0x0 | out: lpBuffer=0x2300020*, lpNumberOfBytesRead=0x26f748*=0x0, lpOverlapped=0x0) returned 1 [0101.756] CloseHandle (hObject=0xe4) returned 1 [0101.759] CloseHandle (hObject=0xe0) returned 1 [0101.759] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x757c0000 [0101.759] GetProcAddress (hModule=0x757c0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x757ed650 [0101.759] Wow64DisableWow64FsRedirection (in: OldValue=0x26f74c | out: OldValue=0x26f74c*=0x1) returned 1 [0101.759] lstrlenW (lpString="kernel32.dll") returned 12 [0101.759] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0101.762] lstrlenW (lpString="C:\\Windows\\System32\\unlikexpc.exe") returned 33 [0101.762] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Run") returned 45 [0101.762] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Run", ulOptions=0x0, samDesired=0x20106, phkResult=0x26f71c | out: phkResult=0x26f71c*=0xe0) returned 0x0 [0101.763] RegSetValueExW (in: hKey=0xe0, lpValueName="unlikexpc.exe", Reserved=0x0, dwType=0x1, lpData="C:\\Windows\\System32\\unlikexpc.exe", cbData=0x42 | out: lpData="C:\\Windows\\System32\\unlikexpc.exe") returned 0x0 [0101.763] RegCloseKey (hKey=0xe0) returned 0x0 [0101.763] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Run") returned 45 [0101.763] lstrlenW (lpString="") returned 0 [0101.763] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0101.763] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x26f6c8 | out: phkResult=0x26f6c8*=0xe0) returned 0x0 [0101.763] RegQueryValueExW (in: hKey=0xe0, lpValueName="Startup", lpReserved=0x0, lpType=0x26f6d4, lpData=0x82d660, lpcbData=0x26f700*=0x7fff | out: lpType=0x26f6d4*=0x0, lpData=0x82d660*=0x53, lpcbData=0x26f700*=0x7fff) returned 0x2 [0101.763] RegCloseKey (hKey=0xe0) returned 0x0 [0101.763] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0101.763] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x26f6c8 | out: phkResult=0x26f6c8*=0xe4) returned 0x0 [0101.763] RegQueryValueExW (in: hKey=0xe4, lpValueName="Startup", lpReserved=0x0, lpType=0x26f6d4, lpData=0x82d660, lpcbData=0x26f700*=0x7fff | out: lpType=0x26f6d4*=0x2, lpData="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0x26f700*=0x98) returned 0x0 [0101.764] RegCloseKey (hKey=0xe4) returned 0x0 [0101.764] lstrlenW (lpString="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup") returned 75 [0101.764] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0101.764] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\unlikexpc.exe", lpDst=0x81d658, nSize=0x7fff | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\unlikexpc.exe") returned 0x6a [0101.764] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x757c0000 [0101.764] GetProcAddress (hModule=0x757c0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x757ed650 [0101.764] Wow64DisableWow64FsRedirection (in: OldValue=0x26f74c | out: OldValue=0x26f74c*=0x1) returned 1 [0101.764] lstrlenW (lpString="kernel32.dll") returned 12 [0101.764] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0101.764] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\unlikexpc.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\unlikexpc.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe4 [0101.764] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\unlikexpc.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\unlikexpc.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe8 [0101.765] ReadFile (in: hFile=0xe4, lpBuffer=0x2300020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x26f748, lpOverlapped=0x0 | out: lpBuffer=0x2300020*, lpNumberOfBytesRead=0x26f748*=0x4de47, lpOverlapped=0x0) returned 1 [0101.768] WriteFile (in: hFile=0xe8, lpBuffer=0x2300020*, nNumberOfBytesToWrite=0x4de47, lpNumberOfBytesWritten=0x26f748, lpOverlapped=0x0 | out: lpBuffer=0x2300020*, lpNumberOfBytesWritten=0x26f748*=0x4de47, lpOverlapped=0x0) returned 1 [0101.771] ReadFile (in: hFile=0xe4, lpBuffer=0x2300020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x26f748, lpOverlapped=0x0 | out: lpBuffer=0x2300020*, lpNumberOfBytesRead=0x26f748*=0x0, lpOverlapped=0x0) returned 1 [0101.771] CloseHandle (hObject=0xe8) returned 1 [0101.773] CloseHandle (hObject=0xe4) returned 1 [0101.773] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x757c0000 [0101.773] GetProcAddress (hModule=0x757c0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x757ed650 [0101.773] Wow64DisableWow64FsRedirection (in: OldValue=0x26f74c | out: OldValue=0x26f74c*=0x1) returned 1 [0101.773] lstrlenW (lpString="kernel32.dll") returned 12 [0101.773] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0101.776] lstrlenW (lpString="") returned 0 [0101.777] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0101.777] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x26f6c8 | out: phkResult=0x26f6c8*=0xe4) returned 0x0 [0101.777] RegQueryValueExW (in: hKey=0xe4, lpValueName="Common Startup", lpReserved=0x0, lpType=0x26f6d4, lpData=0x82d660, lpcbData=0x26f700*=0x7fff | out: lpType=0x26f6d4*=0x2, lpData="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0x26f700*=0x78) returned 0x0 [0101.777] RegCloseKey (hKey=0xe4) returned 0x0 [0101.777] lstrlenW (lpString="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup") returned 59 [0101.777] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0101.777] ExpandEnvironmentStringsW (in: lpSrc="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\unlikexpc.exe", lpDst=0x81d658, nSize=0x7fff | out: lpDst="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\unlikexpc.exe") returned 0x4b [0101.777] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x757c0000 [0101.777] GetProcAddress (hModule=0x757c0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x757ed650 [0101.777] Wow64DisableWow64FsRedirection (in: OldValue=0x26f74c | out: OldValue=0x26f74c*=0x1) returned 1 [0101.777] lstrlenW (lpString="kernel32.dll") returned 12 [0101.777] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0101.777] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\unlikexpc.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\unlikexpc.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe4 [0101.777] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\unlikexpc.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\unlikexpc.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe8 [0101.779] ReadFile (in: hFile=0xe4, lpBuffer=0x2300020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x26f748, lpOverlapped=0x0 | out: lpBuffer=0x2300020*, lpNumberOfBytesRead=0x26f748*=0x4de47, lpOverlapped=0x0) returned 1 [0101.782] WriteFile (in: hFile=0xe8, lpBuffer=0x2300020*, nNumberOfBytesToWrite=0x4de47, lpNumberOfBytesWritten=0x26f748, lpOverlapped=0x0 | out: lpBuffer=0x2300020*, lpNumberOfBytesWritten=0x26f748*=0x4de47, lpOverlapped=0x0) returned 1 [0101.784] ReadFile (in: hFile=0xe4, lpBuffer=0x2300020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x26f748, lpOverlapped=0x0 | out: lpBuffer=0x2300020*, lpNumberOfBytesRead=0x26f748*=0x0, lpOverlapped=0x0) returned 1 [0101.784] CloseHandle (hObject=0xe8) returned 1 [0101.786] CloseHandle (hObject=0xe4) returned 1 [0101.786] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x757c0000 [0101.787] GetProcAddress (hModule=0x757c0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x757ed650 [0101.787] Wow64DisableWow64FsRedirection (in: OldValue=0x26f74c | out: OldValue=0x26f74c*=0x1) returned 1 [0101.787] lstrlenW (lpString="kernel32.dll") returned 12 [0101.787] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0101.790] lstrlenW (lpString="%windir%\\System32") returned 17 [0101.790] lstrlenW (lpString="%appdata%") returned 9 [0101.790] lstrlenW (lpString="%sh(Startup)%") returned 13 [0101.790] lstrlenW (lpString="%sh(Common Startup)%") returned 20 [0101.790] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0101.790] ExpandEnvironmentStringsW (in: lpSrc="%comspec%", lpDst=0x81d658, nSize=0x7fff | out: lpDst="C:\\Windows\\system32\\cmd.exe") returned 0x1c [0101.790] CreatePipe (in: hReadPipe=0x26f708, hWritePipe=0x26f70c, lpPipeAttributes=0x26f6f8, nSize=0x0 | out: hReadPipe=0x26f708*=0xe8, hWritePipe=0x26f70c*=0xec) returned 1 [0101.790] CreatePipe (in: hReadPipe=0x26f778, hWritePipe=0x26f77c, lpPipeAttributes=0x26f6f8, nSize=0x0 | out: hReadPipe=0x26f778*=0xf0, hWritePipe=0x26f77c*=0xf4) returned 1 [0101.790] SetHandleInformation (hObject=0xec, dwMask=0x1, dwFlags=0x0) returned 1 [0101.790] SetHandleInformation (hObject=0xf0, dwMask=0x1, dwFlags=0x0) returned 1 [0101.791] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\cmd.exe", lpCommandLine=0x0, lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x0, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x26f718*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xe8, hStdOutput=0xf4, hStdError=0xf4), lpProcessInformation=0x26f768 | out: lpCommandLine=0x0, lpProcessInformation=0x26f768*(hProcess=0xfc, hThread=0xf8, dwProcessId=0xb74, dwThreadId=0xb78)) returned 1 [0101.799] lstrlenA (lpString="mode con cp select=1251\nvssadmin delete shadows /all /quiet\nExit\n") returned 65 [0101.799] WriteFile (in: hFile=0xec, lpBuffer=0x81b670*, nNumberOfBytesToWrite=0x41, lpNumberOfBytesWritten=0x26f714, lpOverlapped=0x0 | out: lpBuffer=0x81b670*, lpNumberOfBytesWritten=0x26f714*=0x41, lpOverlapped=0x0) returned 1 [0101.799] CloseHandle (hObject=0xfc) returned 1 [0101.799] CloseHandle (hObject=0xf8) returned 1 [0101.799] lstrlenA (lpString="mode con cp select=1251\nvssadmin delete shadows /all /quiet\nExit\n") returned 65 [0101.799] lstrlenW (lpString="%comspec%") returned 9 [0101.799] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40a530, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf8 [0101.800] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40a710, lpParameter=0x7f4a90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xfc [0101.800] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4098e0, lpParameter=0x7d4808, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x104 [0101.801] lstrlenW (lpString="ABCDEFGHIJKLMNOPQRSTUVWXYZ") returned 26 [0101.801] GetLogicalDrives () returned 0x4 [0101.803] lstrlenW (lpString=".waifu") returned 6 [0101.803] lstrlenW (lpString="FILES ENCRYPTED.txt") returned 19 [0101.803] lstrlenW (lpString="Info.hta") returned 8 [0101.804] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0101.804] ExpandEnvironmentStringsW (in: lpSrc="%windir%;", lpDst=0x82d660, nSize=0x8000 | out: lpDst="C:\\Windows;") returned 0xc [0101.804] lstrlenW (lpString="%windir%;") returned 9 [0101.804] lstrlenW (lpString="C:\\Windows;") returned 11 [0101.804] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x26f65c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x26f65c*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0101.926] lstrlenW (lpString="FILES ENCRYPTED.txt") returned 19 [0101.927] lstrlenW (lpString="Info.hta") returned 8 [0101.927] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0101.927] ExpandEnvironmentStringsW (in: lpSrc="%windir%;", lpDst=0x83d680, nSize=0x8000 | out: lpDst="C:\\Windows;") returned 0xc [0101.927] lstrlenW (lpString="%windir%;") returned 9 [0101.927] lstrlenW (lpString="C:\\Windows;") returned 11 [0101.927] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x26f65c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x26f65c*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 Thread: id = 19 os_tid = 0xb70 Thread: id = 21 os_tid = 0xb7c [0101.930] lstrlenW (lpString="1c8.exe;1cv77.exe;outlook.exe;postgres.exe;mysqld-nt.exe;mysqld.exe;sqlservr.exe;") returned 81 [0101.930] lstrlenW (lpString="FirebirdGuardianDefaultInstance;FirebirdServerDefaultInstance;sqlwriter;mssqlserver;sqlserveradhelper;") returned 102 [0101.930] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x7f5cb0 [0101.930] EnumServicesStatusExW (in: hSCManager=0x7f5cb0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x247fa74, lpServicesReturned=0x247fa8c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x247fa74, lpServicesReturned=0x247fa8c, lpResumeHandle=0x0) returned 0 [0101.930] GetLastError () returned 0xea [0101.930] EnumServicesStatusExW (in: hSCManager=0x7f5cb0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x8182e0, cbBufSize=0x13a2, pcbBytesNeeded=0x247fa74, lpServicesReturned=0x247fa8c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x8182e0, pcbBytesNeeded=0x247fa74, lpServicesReturned=0x247fa8c, lpResumeHandle=0x0) returned 1 [0101.931] CloseServiceHandle (hSCObject=0x7f5cb0) returned 1 [0101.931] lstrlenW (lpString="Appinfo") returned 7 [0101.931] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0101.931] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0101.931] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0101.931] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0101.931] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0101.931] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0101.931] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0101.931] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0101.931] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0101.931] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0101.931] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0101.931] lstrlenW (lpString="AudioSrv") returned 8 [0101.931] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0101.931] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0101.931] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0101.931] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0101.931] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0101.931] lstrlenW (lpString="BFE") returned 3 [0101.931] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0101.931] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0101.931] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0101.931] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0101.931] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0101.931] lstrlenW (lpString="CryptSvc") returned 8 [0101.932] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0101.932] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0101.932] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0101.932] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0101.932] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0101.932] lstrlenW (lpString="CscService") returned 10 [0101.932] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0101.932] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0101.932] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0101.932] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0101.932] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0101.932] lstrlenW (lpString="DcomLaunch") returned 10 [0101.932] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0101.932] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0101.932] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0101.932] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0101.932] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0101.932] lstrlenW (lpString="Dhcp") returned 4 [0101.932] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0101.932] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0101.932] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0101.932] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0101.932] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0101.932] lstrlenW (lpString="Dnscache") returned 8 [0101.932] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0101.932] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0101.932] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0101.932] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0101.932] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0101.932] lstrlenW (lpString="DPS") returned 3 [0101.932] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0101.932] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0101.932] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0101.932] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0101.932] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0101.932] lstrlenW (lpString="eventlog") returned 8 [0101.932] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0101.932] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0101.932] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0101.932] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0101.932] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0101.932] lstrlenW (lpString="EventSystem") returned 11 [0101.932] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0101.932] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0101.932] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0101.932] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0101.932] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0101.932] lstrlenW (lpString="FontCache") returned 9 [0101.932] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0101.932] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0101.933] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0101.933] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0101.933] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0101.933] lstrlenW (lpString="gpsvc") returned 5 [0101.933] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0101.933] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0101.933] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0101.933] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0101.933] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0101.933] lstrlenW (lpString="iphlpsvc") returned 8 [0101.933] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0101.933] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0101.933] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0101.933] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0101.933] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0101.933] lstrlenW (lpString="LanmanServer") returned 12 [0101.933] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0101.933] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0101.933] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0101.933] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0101.933] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0101.933] lstrlenW (lpString="LanmanWorkstation") returned 17 [0101.933] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0101.933] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0101.933] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0101.933] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0101.933] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0101.933] lstrlenW (lpString="lmhosts") returned 7 [0101.933] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0101.933] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0101.933] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0101.933] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0101.933] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0101.933] lstrlenW (lpString="MMCSS") returned 5 [0101.933] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0101.933] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0101.933] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0101.933] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0101.933] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0101.933] lstrlenW (lpString="MpsSvc") returned 6 [0101.933] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0101.933] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0101.933] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0101.933] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0101.933] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0101.933] lstrlenW (lpString="Netman") returned 6 [0101.933] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0101.933] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0101.933] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0101.934] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0101.934] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0101.934] lstrlenW (lpString="netprofm") returned 8 [0101.934] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0101.934] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0101.934] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0101.934] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0101.934] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0101.934] lstrlenW (lpString="NlaSvc") returned 6 [0101.934] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0101.934] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0101.934] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0101.934] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0101.934] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0101.934] lstrlenW (lpString="nsi") returned 3 [0101.934] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0101.934] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0101.934] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0101.934] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0101.934] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0101.934] lstrlenW (lpString="PcaSvc") returned 6 [0101.934] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0101.934] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0101.934] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0101.934] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0101.934] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0101.934] lstrlenW (lpString="PlugPlay") returned 8 [0101.934] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0101.934] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0101.934] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0101.934] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0101.934] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0101.934] lstrlenW (lpString="Power") returned 5 [0101.934] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0101.934] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0101.934] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0101.934] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0101.934] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0101.934] lstrlenW (lpString="ProfSvc") returned 7 [0101.934] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0101.934] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0101.934] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0101.934] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0101.934] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0101.934] lstrlenW (lpString="RpcEptMapper") returned 12 [0101.934] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0101.934] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0101.934] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0101.934] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0101.934] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0101.934] lstrlenW (lpString="RpcSs") returned 5 [0101.935] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0101.935] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0101.935] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0101.935] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0101.935] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0101.935] lstrlenW (lpString="SamSs") returned 5 [0101.935] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0101.935] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0101.935] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0101.935] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0101.935] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0101.935] lstrlenW (lpString="Schedule") returned 8 [0101.935] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0101.935] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0101.935] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0101.935] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0101.935] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0101.935] lstrlenW (lpString="SENS") returned 4 [0101.935] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0101.935] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0101.935] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0101.935] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0101.935] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0101.935] lstrlenW (lpString="ShellHWDetection") returned 16 [0101.935] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0101.935] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0101.935] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0101.935] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0101.935] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0101.935] lstrlenW (lpString="Spooler") returned 7 [0101.935] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0101.935] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0101.935] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0101.935] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0101.935] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0101.935] lstrlenW (lpString="sppsvc") returned 6 [0101.935] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="sppsvc") returned -1 [0101.935] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="sppsvc") returned -1 [0101.935] lstrcmpiW (lpString1="sqlwriter", lpString2="sppsvc") returned 1 [0101.935] lstrcmpiW (lpString1="mssqlserver", lpString2="sppsvc") returned -1 [0101.935] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="sppsvc") returned 1 [0101.935] lstrlenW (lpString="SysMain") returned 7 [0101.935] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0101.935] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0101.935] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0101.935] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0101.935] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0101.935] lstrlenW (lpString="Themes") returned 6 [0101.935] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0101.935] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0101.936] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0101.936] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0101.936] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0101.936] lstrlenW (lpString="TrkWks") returned 6 [0101.936] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0101.936] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0101.936] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0101.936] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0101.936] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0101.936] lstrlenW (lpString="UxSms") returned 5 [0101.936] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0101.936] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0101.936] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0101.936] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0101.936] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0101.936] lstrlenW (lpString="W32Time") returned 7 [0101.936] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="W32Time") returned -1 [0101.936] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="W32Time") returned -1 [0101.936] lstrcmpiW (lpString1="sqlwriter", lpString2="W32Time") returned -1 [0101.936] lstrcmpiW (lpString1="mssqlserver", lpString2="W32Time") returned -1 [0101.936] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="W32Time") returned -1 [0101.936] lstrlenW (lpString="WdiServiceHost") returned 14 [0101.936] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0101.936] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0101.936] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0101.936] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0101.936] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0101.936] lstrlenW (lpString="WdiSystemHost") returned 13 [0101.936] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0101.936] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0101.936] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0101.936] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0101.936] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0101.936] lstrlenW (lpString="WinDefend") returned 9 [0101.936] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinDefend") returned -1 [0101.936] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinDefend") returned -1 [0101.936] lstrcmpiW (lpString1="sqlwriter", lpString2="WinDefend") returned -1 [0101.936] lstrcmpiW (lpString1="mssqlserver", lpString2="WinDefend") returned -1 [0101.936] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinDefend") returned -1 [0101.936] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0101.936] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0101.936] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0101.936] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0101.936] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0101.936] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0101.936] lstrlenW (lpString="Winmgmt") returned 7 [0101.936] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0101.936] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0101.936] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0101.936] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0101.937] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0101.937] lstrlenW (lpString="wscsvc") returned 6 [0101.937] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wscsvc") returned -1 [0101.937] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wscsvc") returned -1 [0101.937] lstrcmpiW (lpString1="sqlwriter", lpString2="wscsvc") returned -1 [0101.937] lstrcmpiW (lpString1="mssqlserver", lpString2="wscsvc") returned -1 [0101.937] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wscsvc") returned -1 [0101.937] lstrlenW (lpString="wuauserv") returned 8 [0101.937] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wuauserv") returned -1 [0101.937] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wuauserv") returned -1 [0101.937] lstrcmpiW (lpString1="sqlwriter", lpString2="wuauserv") returned -1 [0101.937] lstrcmpiW (lpString1="mssqlserver", lpString2="wuauserv") returned -1 [0101.937] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wuauserv") returned -1 [0101.937] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x118 [0101.938] Process32FirstW (in: hSnapshot=0x118, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0101.938] Process32NextW (in: hSnapshot=0x118, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0101.939] lstrlenW (lpString="System") returned 6 [0101.939] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0101.939] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0101.939] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0101.939] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0101.939] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0101.939] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0101.939] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0101.939] Process32NextW (in: hSnapshot=0x118, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0101.939] lstrlenW (lpString="smss.exe") returned 8 [0101.939] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0101.939] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0101.939] Process32NextW (in: hSnapshot=0x118, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0101.940] lstrlenW (lpString="csrss.exe") returned 9 [0101.940] Process32NextW (in: hSnapshot=0x118, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0101.940] lstrlenW (lpString="wininit.exe") returned 11 [0101.940] Process32NextW (in: hSnapshot=0x118, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0101.940] lstrlenW (lpString="csrss.exe") returned 9 [0101.940] Process32NextW (in: hSnapshot=0x118, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0101.941] lstrlenW (lpString="winlogon.exe") returned 12 [0101.941] Process32NextW (in: hSnapshot=0x118, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0101.941] lstrlenW (lpString="services.exe") returned 12 [0101.941] Process32NextW (in: hSnapshot=0x118, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0101.941] lstrlenW (lpString="lsass.exe") returned 9 [0101.941] Process32NextW (in: hSnapshot=0x118, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0101.942] lstrlenW (lpString="lsm.exe") returned 7 [0101.942] Process32NextW (in: hSnapshot=0x118, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0101.942] lstrlenW (lpString="svchost.exe") returned 11 [0101.942] Process32NextW (in: hSnapshot=0x118, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0101.942] lstrlenW (lpString="svchost.exe") returned 11 [0101.943] Process32NextW (in: hSnapshot=0x118, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0101.943] lstrlenW (lpString="svchost.exe") returned 11 [0101.943] Process32NextW (in: hSnapshot=0x118, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0101.943] lstrlenW (lpString="svchost.exe") returned 11 [0101.943] Process32NextW (in: hSnapshot=0x118, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2a, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0101.944] lstrlenW (lpString="svchost.exe") returned 11 [0101.944] Process32NextW (in: hSnapshot=0x118, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0101.944] lstrlenW (lpString="audiodg.exe") returned 11 [0101.944] Process32NextW (in: hSnapshot=0x118, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0101.944] lstrlenW (lpString="svchost.exe") returned 11 [0101.945] Process32NextW (in: hSnapshot=0x118, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0101.945] lstrlenW (lpString="svchost.exe") returned 11 [0101.945] Process32NextW (in: hSnapshot=0x118, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0101.945] lstrlenW (lpString="spoolsv.exe") returned 11 [0101.945] Process32NextW (in: hSnapshot=0x118, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0101.946] lstrlenW (lpString="svchost.exe") returned 11 [0101.946] Process32NextW (in: hSnapshot=0x118, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0101.946] lstrlenW (lpString="taskhost.exe") returned 12 [0101.946] Process32NextW (in: hSnapshot=0x118, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x558, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0101.946] lstrlenW (lpString="dwm.exe") returned 7 [0101.946] Process32NextW (in: hSnapshot=0x118, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x54c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0101.947] lstrlenW (lpString="explorer.exe") returned 12 [0101.947] Process32NextW (in: hSnapshot=0x118, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0101.947] lstrlenW (lpString="taskeng.exe") returned 11 [0101.947] Process32NextW (in: hSnapshot=0x118, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0101.947] lstrlenW (lpString="taskhost.exe") returned 12 [0101.947] Process32NextW (in: hSnapshot=0x118, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="watches-vessel-arbitrary.exe")) returned 1 [0101.948] lstrlenW (lpString="watches-vessel-arbitrary.exe") returned 28 [0101.948] Process32NextW (in: hSnapshot=0x118, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="alsopound.exe")) returned 1 [0101.948] lstrlenW (lpString="alsopound.exe") returned 13 [0101.948] Process32NextW (in: hSnapshot=0x118, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x478, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="measuredamsterdamsandwich.exe")) returned 1 [0101.948] lstrlenW (lpString="measuredamsterdamsandwich.exe") returned 29 [0101.948] Process32NextW (in: hSnapshot=0x118, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="ooo_lucy_millions.exe")) returned 1 [0101.949] lstrlenW (lpString="ooo_lucy_millions.exe") returned 21 [0101.949] Process32NextW (in: hSnapshot=0x118, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="appearance.exe")) returned 1 [0101.949] lstrlenW (lpString="appearance.exe") returned 14 [0101.949] Process32NextW (in: hSnapshot=0x118, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="albert.exe")) returned 1 [0101.949] lstrlenW (lpString="albert.exe") returned 10 [0101.950] Process32NextW (in: hSnapshot=0x118, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="implied-enquiries.exe")) returned 1 [0101.950] lstrlenW (lpString="implied-enquiries.exe") returned 21 [0101.950] Process32NextW (in: hSnapshot=0x118, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x72c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="boston_opening.exe")) returned 1 [0101.950] lstrlenW (lpString="boston_opening.exe") returned 18 [0101.950] Process32NextW (in: hSnapshot=0x118, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="portsmouth.exe")) returned 1 [0101.951] lstrlenW (lpString="portsmouth.exe") returned 14 [0101.951] Process32NextW (in: hSnapshot=0x118, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="cameras grew poverty.exe")) returned 1 [0101.951] lstrlenW (lpString="cameras grew poverty.exe") returned 24 [0101.951] Process32NextW (in: hSnapshot=0x118, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="dxrapids.exe")) returned 1 [0101.951] lstrlenW (lpString="dxrapids.exe") returned 12 [0101.951] Process32NextW (in: hSnapshot=0x118, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x33c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="visitors.exe")) returned 1 [0101.952] lstrlenW (lpString="visitors.exe") returned 12 [0101.952] Process32NextW (in: hSnapshot=0x118, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="organisations_officially.exe")) returned 1 [0101.952] lstrlenW (lpString="organisations_officially.exe") returned 28 [0101.952] Process32NextW (in: hSnapshot=0x118, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x61c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="pair.exe")) returned 1 [0101.952] lstrlenW (lpString="pair.exe") returned 8 [0101.952] Process32NextW (in: hSnapshot=0x118, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="gross.exe")) returned 1 [0101.953] lstrlenW (lpString="gross.exe") returned 9 [0101.953] Process32NextW (in: hSnapshot=0x118, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x470, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="viewpicture.exe")) returned 1 [0101.953] lstrlenW (lpString="viewpicture.exe") returned 15 [0101.953] Process32NextW (in: hSnapshot=0x118, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="transmitted.exe")) returned 1 [0101.953] lstrlenW (lpString="transmitted.exe") returned 15 [0101.953] Process32NextW (in: hSnapshot=0x118, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x634, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="sunglassescelebs.exe")) returned 1 [0101.954] lstrlenW (lpString="sunglassescelebs.exe") returned 20 [0101.954] Process32NextW (in: hSnapshot=0x118, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="waiver-issue.exe")) returned 1 [0101.954] lstrlenW (lpString="waiver-issue.exe") returned 16 [0101.954] Process32NextW (in: hSnapshot=0x118, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x808, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="gziprear.exe")) returned 1 [0101.954] lstrlenW (lpString="gziprear.exe") returned 12 [0101.954] Process32NextW (in: hSnapshot=0x118, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x818, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="gregoryletters.exe")) returned 1 [0101.955] lstrlenW (lpString="gregoryletters.exe") returned 18 [0101.955] Process32NextW (in: hSnapshot=0x118, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x828, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="intel-metadata-rich.exe")) returned 1 [0101.955] lstrlenW (lpString="intel-metadata-rich.exe") returned 23 [0101.955] Process32NextW (in: hSnapshot=0x118, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x838, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="cemeteryreconstructiondimension.exe")) returned 1 [0101.955] lstrlenW (lpString="cemeteryreconstructiondimension.exe") returned 35 [0101.956] Process32NextW (in: hSnapshot=0x118, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0101.956] lstrlenW (lpString="svchost.exe") returned 11 [0101.956] Process32NextW (in: hSnapshot=0x118, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0101.956] lstrlenW (lpString="sppsvc.exe") returned 10 [0101.956] Process32NextW (in: hSnapshot=0x118, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xab4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0101.957] lstrlenW (lpString="svchost.exe") returned 11 [0101.957] Process32NextW (in: hSnapshot=0x118, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x9f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="unlikexpc.exe")) returned 1 [0101.957] lstrlenW (lpString="unlikexpc.exe") returned 13 [0101.957] Process32NextW (in: hSnapshot=0x118, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xb58, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0101.957] lstrlenW (lpString="cmd.exe") returned 7 [0101.957] Process32NextW (in: hSnapshot=0x118, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xb58, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 0 [0101.958] CloseHandle (hObject=0x118) returned 1 [0101.958] Sleep (dwMilliseconds=0x1f4) [0103.217] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x819b60 [0103.218] EnumServicesStatusExW (in: hSCManager=0x819b60, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x247fa74, lpServicesReturned=0x247fa8c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x247fa74, lpServicesReturned=0x247fa8c, lpResumeHandle=0x0) returned 0 [0103.218] GetLastError () returned 0xea [0103.218] EnumServicesStatusExW (in: hSCManager=0x819b60, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x80e278, cbBufSize=0x13a2, pcbBytesNeeded=0x247fa74, lpServicesReturned=0x247fa8c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x80e278, pcbBytesNeeded=0x247fa74, lpServicesReturned=0x247fa8c, lpResumeHandle=0x0) returned 1 [0103.218] CloseServiceHandle (hSCObject=0x819b60) returned 1 [0103.218] lstrlenW (lpString="Appinfo") returned 7 [0103.218] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0103.218] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0103.218] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0103.219] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0103.219] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0103.219] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0103.219] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0103.219] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0103.219] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0103.219] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0103.219] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0103.219] lstrlenW (lpString="AudioSrv") returned 8 [0103.219] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0103.219] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0103.219] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0103.219] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0103.219] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0103.219] lstrlenW (lpString="BFE") returned 3 [0103.219] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0103.219] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0103.219] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0103.219] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0103.219] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0103.219] lstrlenW (lpString="CryptSvc") returned 8 [0103.219] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0103.219] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0103.219] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0103.219] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0103.219] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0103.219] lstrlenW (lpString="CscService") returned 10 [0103.219] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0103.219] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0103.219] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0103.219] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0103.219] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0103.219] lstrlenW (lpString="DcomLaunch") returned 10 [0103.219] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0103.219] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0103.219] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0103.219] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0103.219] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0103.219] lstrlenW (lpString="Dhcp") returned 4 [0103.219] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0103.219] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0103.219] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0103.219] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0103.219] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0103.220] lstrlenW (lpString="Dnscache") returned 8 [0103.220] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0103.220] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0103.220] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0103.220] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0103.220] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0103.220] lstrlenW (lpString="DPS") returned 3 [0103.220] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0103.220] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0103.220] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0103.220] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0103.220] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0103.220] lstrlenW (lpString="eventlog") returned 8 [0103.220] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0103.220] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0103.220] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0103.220] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0103.220] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0103.220] lstrlenW (lpString="EventSystem") returned 11 [0103.220] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0103.220] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0103.220] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0103.220] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0103.220] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0103.220] lstrlenW (lpString="FontCache") returned 9 [0103.220] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0103.220] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0103.220] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0103.220] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0103.220] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0103.220] lstrlenW (lpString="gpsvc") returned 5 [0103.220] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0103.220] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0103.220] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0103.220] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0103.220] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0103.220] lstrlenW (lpString="iphlpsvc") returned 8 [0103.220] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0103.220] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0103.220] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0103.220] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0103.220] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0103.221] lstrlenW (lpString="LanmanServer") returned 12 [0103.221] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0103.221] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0103.221] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0103.221] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0103.221] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0103.221] lstrlenW (lpString="LanmanWorkstation") returned 17 [0103.221] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0103.221] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0103.221] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0103.221] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0103.221] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0103.221] lstrlenW (lpString="lmhosts") returned 7 [0103.221] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0103.221] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0103.221] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0103.221] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0103.221] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0103.221] lstrlenW (lpString="MMCSS") returned 5 [0103.221] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0103.221] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0103.221] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0103.221] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0103.221] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0103.221] lstrlenW (lpString="MpsSvc") returned 6 [0103.221] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0103.221] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0103.221] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0103.221] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0103.221] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0103.221] lstrlenW (lpString="Netman") returned 6 [0103.221] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0103.221] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0103.221] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0103.221] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0103.221] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0103.221] lstrlenW (lpString="netprofm") returned 8 [0103.221] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0103.221] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0103.222] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0103.222] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0103.222] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0103.222] lstrlenW (lpString="NlaSvc") returned 6 [0103.222] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0103.222] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0103.222] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0103.222] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0103.222] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0103.222] lstrlenW (lpString="nsi") returned 3 [0103.222] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0103.222] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0103.222] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0103.222] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0103.222] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0103.222] lstrlenW (lpString="PcaSvc") returned 6 [0103.222] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0103.222] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0103.222] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0103.222] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0103.222] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0103.222] lstrlenW (lpString="PlugPlay") returned 8 [0103.222] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0103.222] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0103.222] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0103.222] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0103.222] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0103.222] lstrlenW (lpString="Power") returned 5 [0103.222] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0103.222] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0103.222] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0103.222] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0103.222] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0103.222] lstrlenW (lpString="ProfSvc") returned 7 [0103.222] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0103.222] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0103.222] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0103.222] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0103.222] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0103.222] lstrlenW (lpString="RpcEptMapper") returned 12 [0103.222] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0103.222] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0103.222] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0103.222] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0103.223] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0103.223] lstrlenW (lpString="RpcSs") returned 5 [0103.223] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0103.223] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0103.223] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0103.223] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0103.223] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0103.223] lstrlenW (lpString="SamSs") returned 5 [0103.223] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0103.223] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0103.223] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0103.223] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0103.223] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0103.223] lstrlenW (lpString="Schedule") returned 8 [0103.223] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0103.223] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0103.223] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0103.223] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0103.223] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0103.223] lstrlenW (lpString="SENS") returned 4 [0103.223] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0103.223] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0103.223] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0103.223] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0103.223] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0103.223] lstrlenW (lpString="ShellHWDetection") returned 16 [0103.223] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0103.223] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0103.223] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0103.223] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0103.223] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0103.223] lstrlenW (lpString="Spooler") returned 7 [0103.223] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0103.223] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0103.223] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0103.223] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0103.223] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0103.223] lstrlenW (lpString="sppsvc") returned 6 [0103.223] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="sppsvc") returned -1 [0103.223] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="sppsvc") returned -1 [0103.223] lstrcmpiW (lpString1="sqlwriter", lpString2="sppsvc") returned 1 [0103.223] lstrcmpiW (lpString1="mssqlserver", lpString2="sppsvc") returned -1 [0103.224] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="sppsvc") returned 1 [0103.224] lstrlenW (lpString="SysMain") returned 7 [0103.224] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0103.224] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0103.224] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0103.224] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0103.224] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0103.224] lstrlenW (lpString="Themes") returned 6 [0103.224] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0103.224] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0103.224] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0103.224] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0103.224] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0103.224] lstrlenW (lpString="TrkWks") returned 6 [0103.224] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0103.224] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0103.224] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0103.224] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0103.224] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0103.224] lstrlenW (lpString="UxSms") returned 5 [0103.224] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0103.224] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0103.224] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0103.224] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0103.224] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0103.224] lstrlenW (lpString="W32Time") returned 7 [0103.224] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="W32Time") returned -1 [0103.224] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="W32Time") returned -1 [0103.224] lstrcmpiW (lpString1="sqlwriter", lpString2="W32Time") returned -1 [0103.224] lstrcmpiW (lpString1="mssqlserver", lpString2="W32Time") returned -1 [0103.224] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="W32Time") returned -1 [0103.224] lstrlenW (lpString="WdiServiceHost") returned 14 [0103.224] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0103.224] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0103.224] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0103.224] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0103.224] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0103.224] lstrlenW (lpString="WdiSystemHost") returned 13 [0103.224] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0103.224] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0103.224] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0103.224] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0103.225] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0103.225] lstrlenW (lpString="WinDefend") returned 9 [0103.225] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinDefend") returned -1 [0103.225] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinDefend") returned -1 [0103.225] lstrcmpiW (lpString1="sqlwriter", lpString2="WinDefend") returned -1 [0103.225] lstrcmpiW (lpString1="mssqlserver", lpString2="WinDefend") returned -1 [0103.225] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinDefend") returned -1 [0103.225] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0103.225] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0103.225] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0103.225] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0103.225] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0103.225] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0103.225] lstrlenW (lpString="Winmgmt") returned 7 [0103.225] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0103.225] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0103.225] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0103.225] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0103.225] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0103.225] lstrlenW (lpString="wscsvc") returned 6 [0103.225] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wscsvc") returned -1 [0103.225] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wscsvc") returned -1 [0103.225] lstrcmpiW (lpString1="sqlwriter", lpString2="wscsvc") returned -1 [0103.225] lstrcmpiW (lpString1="mssqlserver", lpString2="wscsvc") returned -1 [0103.225] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wscsvc") returned -1 [0103.225] lstrlenW (lpString="wuauserv") returned 8 [0103.225] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wuauserv") returned -1 [0103.225] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wuauserv") returned -1 [0103.225] lstrcmpiW (lpString1="sqlwriter", lpString2="wuauserv") returned -1 [0103.225] lstrcmpiW (lpString1="mssqlserver", lpString2="wuauserv") returned -1 [0103.225] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wuauserv") returned -1 [0103.225] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x180 [0103.227] Process32FirstW (in: hSnapshot=0x180, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0103.227] Process32NextW (in: hSnapshot=0x180, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0103.227] lstrlenW (lpString="System") returned 6 [0103.227] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0103.227] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0103.227] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0103.228] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0103.228] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0103.228] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0103.228] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0103.228] Process32NextW (in: hSnapshot=0x180, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0103.228] lstrlenW (lpString="smss.exe") returned 8 [0103.228] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0103.228] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0103.228] Process32NextW (in: hSnapshot=0x180, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0103.229] lstrlenW (lpString="csrss.exe") returned 9 [0103.229] Process32NextW (in: hSnapshot=0x180, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0103.229] lstrlenW (lpString="wininit.exe") returned 11 [0103.229] Process32NextW (in: hSnapshot=0x180, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0103.230] lstrlenW (lpString="csrss.exe") returned 9 [0103.230] Process32NextW (in: hSnapshot=0x180, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0103.230] lstrlenW (lpString="winlogon.exe") returned 12 [0103.230] Process32NextW (in: hSnapshot=0x180, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0103.230] lstrlenW (lpString="services.exe") returned 12 [0103.230] Process32NextW (in: hSnapshot=0x180, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0103.231] lstrlenW (lpString="lsass.exe") returned 9 [0103.231] Process32NextW (in: hSnapshot=0x180, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0103.231] lstrlenW (lpString="lsm.exe") returned 7 [0103.231] Process32NextW (in: hSnapshot=0x180, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0103.232] lstrlenW (lpString="svchost.exe") returned 11 [0103.232] Process32NextW (in: hSnapshot=0x180, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0103.232] lstrlenW (lpString="svchost.exe") returned 11 [0103.232] Process32NextW (in: hSnapshot=0x180, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0103.233] lstrlenW (lpString="svchost.exe") returned 11 [0103.233] Process32NextW (in: hSnapshot=0x180, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0103.233] lstrlenW (lpString="svchost.exe") returned 11 [0103.233] Process32NextW (in: hSnapshot=0x180, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2a, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0103.233] lstrlenW (lpString="svchost.exe") returned 11 [0103.234] Process32NextW (in: hSnapshot=0x180, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0103.234] lstrlenW (lpString="audiodg.exe") returned 11 [0103.234] Process32NextW (in: hSnapshot=0x180, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0103.234] lstrlenW (lpString="svchost.exe") returned 11 [0103.234] Process32NextW (in: hSnapshot=0x180, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0103.235] lstrlenW (lpString="svchost.exe") returned 11 [0103.235] Process32NextW (in: hSnapshot=0x180, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0103.235] lstrlenW (lpString="spoolsv.exe") returned 11 [0103.235] Process32NextW (in: hSnapshot=0x180, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0103.236] lstrlenW (lpString="svchost.exe") returned 11 [0103.236] Process32NextW (in: hSnapshot=0x180, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0103.236] lstrlenW (lpString="taskhost.exe") returned 12 [0103.236] Process32NextW (in: hSnapshot=0x180, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x558, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0103.237] lstrlenW (lpString="dwm.exe") returned 7 [0103.237] Process32NextW (in: hSnapshot=0x180, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x54c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0103.237] lstrlenW (lpString="explorer.exe") returned 12 [0103.237] Process32NextW (in: hSnapshot=0x180, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0103.238] lstrlenW (lpString="taskeng.exe") returned 11 [0103.238] Process32NextW (in: hSnapshot=0x180, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0103.238] lstrlenW (lpString="taskhost.exe") returned 12 [0103.238] Process32NextW (in: hSnapshot=0x180, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="watches-vessel-arbitrary.exe")) returned 1 [0103.238] lstrlenW (lpString="watches-vessel-arbitrary.exe") returned 28 [0103.238] Process32NextW (in: hSnapshot=0x180, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="alsopound.exe")) returned 1 [0103.239] lstrlenW (lpString="alsopound.exe") returned 13 [0103.239] Process32NextW (in: hSnapshot=0x180, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x478, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="measuredamsterdamsandwich.exe")) returned 1 [0103.239] lstrlenW (lpString="measuredamsterdamsandwich.exe") returned 29 [0103.239] Process32NextW (in: hSnapshot=0x180, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="ooo_lucy_millions.exe")) returned 1 [0103.240] lstrlenW (lpString="ooo_lucy_millions.exe") returned 21 [0103.240] Process32NextW (in: hSnapshot=0x180, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="appearance.exe")) returned 1 [0103.240] lstrlenW (lpString="appearance.exe") returned 14 [0103.240] Process32NextW (in: hSnapshot=0x180, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="albert.exe")) returned 1 [0103.241] lstrlenW (lpString="albert.exe") returned 10 [0103.241] Process32NextW (in: hSnapshot=0x180, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="implied-enquiries.exe")) returned 1 [0103.241] lstrlenW (lpString="implied-enquiries.exe") returned 21 [0103.241] Process32NextW (in: hSnapshot=0x180, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x72c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="boston_opening.exe")) returned 1 [0103.242] lstrlenW (lpString="boston_opening.exe") returned 18 [0103.242] Process32NextW (in: hSnapshot=0x180, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="portsmouth.exe")) returned 1 [0103.242] lstrlenW (lpString="portsmouth.exe") returned 14 [0103.242] Process32NextW (in: hSnapshot=0x180, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="cameras grew poverty.exe")) returned 1 [0103.242] lstrlenW (lpString="cameras grew poverty.exe") returned 24 [0103.242] Process32NextW (in: hSnapshot=0x180, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="dxrapids.exe")) returned 1 [0103.243] lstrlenW (lpString="dxrapids.exe") returned 12 [0103.243] Process32NextW (in: hSnapshot=0x180, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x33c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="visitors.exe")) returned 1 [0103.243] lstrlenW (lpString="visitors.exe") returned 12 [0103.243] Process32NextW (in: hSnapshot=0x180, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="organisations_officially.exe")) returned 1 [0103.244] lstrlenW (lpString="organisations_officially.exe") returned 28 [0103.244] Process32NextW (in: hSnapshot=0x180, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x61c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="pair.exe")) returned 1 [0103.244] lstrlenW (lpString="pair.exe") returned 8 [0103.244] Process32NextW (in: hSnapshot=0x180, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="gross.exe")) returned 1 [0103.245] lstrlenW (lpString="gross.exe") returned 9 [0103.245] Process32NextW (in: hSnapshot=0x180, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x470, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="viewpicture.exe")) returned 1 [0103.245] lstrlenW (lpString="viewpicture.exe") returned 15 [0103.245] Process32NextW (in: hSnapshot=0x180, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="transmitted.exe")) returned 1 [0103.246] lstrlenW (lpString="transmitted.exe") returned 15 [0103.246] Process32NextW (in: hSnapshot=0x180, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x634, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="sunglassescelebs.exe")) returned 1 [0103.246] lstrlenW (lpString="sunglassescelebs.exe") returned 20 [0103.246] Process32NextW (in: hSnapshot=0x180, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="waiver-issue.exe")) returned 1 [0103.246] lstrlenW (lpString="waiver-issue.exe") returned 16 [0103.246] Process32NextW (in: hSnapshot=0x180, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x808, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="gziprear.exe")) returned 1 [0103.247] lstrlenW (lpString="gziprear.exe") returned 12 [0103.247] Process32NextW (in: hSnapshot=0x180, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x818, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="gregoryletters.exe")) returned 1 [0103.247] lstrlenW (lpString="gregoryletters.exe") returned 18 [0103.247] Process32NextW (in: hSnapshot=0x180, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x828, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="intel-metadata-rich.exe")) returned 1 [0103.248] lstrlenW (lpString="intel-metadata-rich.exe") returned 23 [0103.248] Process32NextW (in: hSnapshot=0x180, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x838, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="cemeteryreconstructiondimension.exe")) returned 1 [0103.248] lstrlenW (lpString="cemeteryreconstructiondimension.exe") returned 35 [0103.248] Process32NextW (in: hSnapshot=0x180, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0103.249] lstrlenW (lpString="svchost.exe") returned 11 [0103.249] Process32NextW (in: hSnapshot=0x180, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0103.249] lstrlenW (lpString="sppsvc.exe") returned 10 [0103.249] Process32NextW (in: hSnapshot=0x180, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xab4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0103.249] lstrlenW (lpString="svchost.exe") returned 11 [0103.250] Process32NextW (in: hSnapshot=0x180, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x9f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="unlikexpc.exe")) returned 1 [0103.250] lstrlenW (lpString="unlikexpc.exe") returned 13 [0103.250] Process32NextW (in: hSnapshot=0x180, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xb58, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0103.250] lstrlenW (lpString="cmd.exe") returned 7 [0103.250] Process32NextW (in: hSnapshot=0x180, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0103.251] lstrlenW (lpString="conhost.exe") returned 11 [0103.251] Process32NextW (in: hSnapshot=0x180, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0103.251] CloseHandle (hObject=0x180) returned 1 [0103.251] Sleep (dwMilliseconds=0x1f4) [0104.043] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x819b60 [0104.043] EnumServicesStatusExW (in: hSCManager=0x819b60, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x247fa74, lpServicesReturned=0x247fa8c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x247fa74, lpServicesReturned=0x247fa8c, lpResumeHandle=0x0) returned 0 [0104.043] GetLastError () returned 0xea [0104.044] EnumServicesStatusExW (in: hSCManager=0x819b60, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x80e278, cbBufSize=0x13a2, pcbBytesNeeded=0x247fa74, lpServicesReturned=0x247fa8c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x80e278, pcbBytesNeeded=0x247fa74, lpServicesReturned=0x247fa8c, lpResumeHandle=0x0) returned 1 [0104.044] CloseServiceHandle (hSCObject=0x819b60) returned 1 [0104.044] lstrlenW (lpString="Appinfo") returned 7 [0104.044] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0104.044] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0104.044] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0104.044] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0104.044] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0104.044] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0104.044] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0104.044] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0104.044] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0104.044] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0104.044] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0104.044] lstrlenW (lpString="AudioSrv") returned 8 [0104.044] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0104.044] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0104.044] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0104.044] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0104.044] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0104.044] lstrlenW (lpString="BFE") returned 3 [0104.044] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0104.044] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0104.044] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0104.044] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0104.044] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0104.045] lstrlenW (lpString="CryptSvc") returned 8 [0104.045] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0104.045] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0104.045] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0104.045] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0104.045] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0104.045] lstrlenW (lpString="CscService") returned 10 [0104.045] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0104.045] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0104.045] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0104.045] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0104.045] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0104.045] lstrlenW (lpString="DcomLaunch") returned 10 [0104.045] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0104.045] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0104.045] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0104.045] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0104.045] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0104.045] lstrlenW (lpString="Dhcp") returned 4 [0104.045] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0104.045] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0104.045] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0104.045] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0104.045] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0104.045] lstrlenW (lpString="Dnscache") returned 8 [0104.045] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0104.045] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0104.045] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0104.045] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0104.045] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0104.045] lstrlenW (lpString="DPS") returned 3 [0104.045] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0104.045] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0104.045] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0104.045] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0104.045] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0104.045] lstrlenW (lpString="eventlog") returned 8 [0104.045] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0104.045] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0104.045] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0104.045] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0104.045] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0104.045] lstrlenW (lpString="EventSystem") returned 11 [0104.045] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0104.045] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0104.045] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0104.045] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0104.045] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0104.045] lstrlenW (lpString="FontCache") returned 9 [0104.045] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0104.045] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0104.045] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0104.046] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0104.046] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0104.046] lstrlenW (lpString="gpsvc") returned 5 [0104.046] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0104.046] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0104.046] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0104.046] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0104.046] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0104.046] lstrlenW (lpString="iphlpsvc") returned 8 [0104.046] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0104.046] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0104.046] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0104.046] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0104.046] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0104.046] lstrlenW (lpString="LanmanServer") returned 12 [0104.046] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0104.046] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0104.046] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0104.046] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0104.046] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0104.046] lstrlenW (lpString="LanmanWorkstation") returned 17 [0104.046] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0104.046] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0104.046] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0104.046] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0104.046] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0104.046] lstrlenW (lpString="lmhosts") returned 7 [0104.046] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0104.046] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0104.046] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0104.046] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0104.046] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0104.046] lstrlenW (lpString="MMCSS") returned 5 [0104.046] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0104.046] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0104.046] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0104.046] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0104.046] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0104.046] lstrlenW (lpString="MpsSvc") returned 6 [0104.046] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0104.046] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0104.046] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0104.046] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0104.046] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0104.046] lstrlenW (lpString="Netman") returned 6 [0104.046] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0104.046] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0104.046] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0104.046] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0104.046] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0104.046] lstrlenW (lpString="netprofm") returned 8 [0104.047] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0104.047] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0104.047] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0104.047] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0104.047] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0104.047] lstrlenW (lpString="NlaSvc") returned 6 [0104.047] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0104.047] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0104.047] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0104.047] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0104.047] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0104.047] lstrlenW (lpString="nsi") returned 3 [0104.047] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0104.047] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0104.047] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0104.047] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0104.047] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0104.047] lstrlenW (lpString="PcaSvc") returned 6 [0104.047] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0104.047] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0104.047] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0104.047] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0104.047] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0104.047] lstrlenW (lpString="PlugPlay") returned 8 [0104.047] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0104.047] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0104.047] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0104.047] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0104.047] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0104.047] lstrlenW (lpString="Power") returned 5 [0104.047] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0104.047] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0104.047] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0104.047] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0104.047] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0104.047] lstrlenW (lpString="ProfSvc") returned 7 [0104.047] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0104.047] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0104.047] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0104.047] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0104.047] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0104.047] lstrlenW (lpString="RpcEptMapper") returned 12 [0104.047] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0104.047] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0104.047] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0104.047] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0104.047] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0104.047] lstrlenW (lpString="RpcSs") returned 5 [0104.047] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0104.047] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0104.047] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0104.047] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0104.048] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0104.048] lstrlenW (lpString="SamSs") returned 5 [0104.048] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0104.048] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0104.048] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0104.048] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0104.048] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0104.048] lstrlenW (lpString="Schedule") returned 8 [0104.048] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0104.048] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0104.048] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0104.048] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0104.048] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0104.048] lstrlenW (lpString="SENS") returned 4 [0104.048] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0104.048] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0104.048] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0104.048] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0104.048] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0104.048] lstrlenW (lpString="ShellHWDetection") returned 16 [0104.048] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0104.048] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0104.048] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0104.048] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0104.048] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0104.048] lstrlenW (lpString="Spooler") returned 7 [0104.048] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0104.048] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0104.048] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0104.048] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0104.048] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0104.048] lstrlenW (lpString="sppsvc") returned 6 [0104.048] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="sppsvc") returned -1 [0104.048] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="sppsvc") returned -1 [0104.048] lstrcmpiW (lpString1="sqlwriter", lpString2="sppsvc") returned 1 [0104.048] lstrcmpiW (lpString1="mssqlserver", lpString2="sppsvc") returned -1 [0104.048] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="sppsvc") returned 1 [0104.048] lstrlenW (lpString="SysMain") returned 7 [0104.048] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0104.048] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0104.048] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0104.048] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0104.048] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0104.048] lstrlenW (lpString="Themes") returned 6 [0104.048] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0104.048] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0104.048] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0104.048] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0104.048] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0104.048] lstrlenW (lpString="TrkWks") returned 6 [0104.049] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0104.049] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0104.049] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0104.049] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0104.049] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0104.049] lstrlenW (lpString="UxSms") returned 5 [0104.049] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0104.049] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0104.049] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0104.049] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0104.049] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0104.049] lstrlenW (lpString="W32Time") returned 7 [0104.049] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="W32Time") returned -1 [0104.049] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="W32Time") returned -1 [0104.049] lstrcmpiW (lpString1="sqlwriter", lpString2="W32Time") returned -1 [0104.049] lstrcmpiW (lpString1="mssqlserver", lpString2="W32Time") returned -1 [0104.049] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="W32Time") returned -1 [0104.049] lstrlenW (lpString="WdiServiceHost") returned 14 [0104.049] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0104.049] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0104.049] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0104.049] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0104.049] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0104.049] lstrlenW (lpString="WdiSystemHost") returned 13 [0104.049] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0104.049] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0104.049] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0104.049] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0104.049] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0104.049] lstrlenW (lpString="WinDefend") returned 9 [0104.049] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinDefend") returned -1 [0104.049] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinDefend") returned -1 [0104.049] lstrcmpiW (lpString1="sqlwriter", lpString2="WinDefend") returned -1 [0104.049] lstrcmpiW (lpString1="mssqlserver", lpString2="WinDefend") returned -1 [0104.049] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinDefend") returned -1 [0104.049] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0104.049] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0104.049] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0104.049] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0104.049] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0104.049] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0104.049] lstrlenW (lpString="Winmgmt") returned 7 [0104.049] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0104.049] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0104.049] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0104.049] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0104.049] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0104.049] lstrlenW (lpString="wscsvc") returned 6 [0104.049] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wscsvc") returned -1 [0104.049] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wscsvc") returned -1 [0104.049] lstrcmpiW (lpString1="sqlwriter", lpString2="wscsvc") returned -1 [0104.049] lstrcmpiW (lpString1="mssqlserver", lpString2="wscsvc") returned -1 [0104.049] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wscsvc") returned -1 [0104.050] lstrlenW (lpString="wuauserv") returned 8 [0104.050] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wuauserv") returned -1 [0104.050] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wuauserv") returned -1 [0104.050] lstrcmpiW (lpString1="sqlwriter", lpString2="wuauserv") returned -1 [0104.050] lstrcmpiW (lpString1="mssqlserver", lpString2="wuauserv") returned -1 [0104.050] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wuauserv") returned -1 [0104.050] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x184 [0104.051] Process32FirstW (in: hSnapshot=0x184, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0104.051] Process32NextW (in: hSnapshot=0x184, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0104.052] lstrlenW (lpString="System") returned 6 [0104.052] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0104.052] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0104.052] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0104.052] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0104.052] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0104.052] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0104.052] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0104.052] Process32NextW (in: hSnapshot=0x184, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0104.052] lstrlenW (lpString="smss.exe") returned 8 [0104.052] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0104.052] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0104.052] Process32NextW (in: hSnapshot=0x184, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0104.053] lstrlenW (lpString="csrss.exe") returned 9 [0104.053] Process32NextW (in: hSnapshot=0x184, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0104.053] lstrlenW (lpString="wininit.exe") returned 11 [0104.053] Process32NextW (in: hSnapshot=0x184, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0104.054] lstrlenW (lpString="csrss.exe") returned 9 [0104.054] Process32NextW (in: hSnapshot=0x184, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0104.054] lstrlenW (lpString="winlogon.exe") returned 12 [0104.054] Process32NextW (in: hSnapshot=0x184, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0104.054] lstrlenW (lpString="services.exe") returned 12 [0104.054] Process32NextW (in: hSnapshot=0x184, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0104.055] lstrlenW (lpString="lsass.exe") returned 9 [0104.055] Process32NextW (in: hSnapshot=0x184, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0104.055] lstrlenW (lpString="lsm.exe") returned 7 [0104.056] Process32NextW (in: hSnapshot=0x184, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0104.056] lstrlenW (lpString="svchost.exe") returned 11 [0104.056] Process32NextW (in: hSnapshot=0x184, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0104.056] lstrlenW (lpString="svchost.exe") returned 11 [0104.056] Process32NextW (in: hSnapshot=0x184, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0104.057] lstrlenW (lpString="svchost.exe") returned 11 [0104.057] Process32NextW (in: hSnapshot=0x184, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0104.057] lstrlenW (lpString="svchost.exe") returned 11 [0104.057] Process32NextW (in: hSnapshot=0x184, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2a, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0104.058] lstrlenW (lpString="svchost.exe") returned 11 [0104.058] Process32NextW (in: hSnapshot=0x184, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0104.058] lstrlenW (lpString="audiodg.exe") returned 11 [0104.058] Process32NextW (in: hSnapshot=0x184, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0104.058] lstrlenW (lpString="svchost.exe") returned 11 [0104.058] Process32NextW (in: hSnapshot=0x184, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0104.059] lstrlenW (lpString="svchost.exe") returned 11 [0104.059] Process32NextW (in: hSnapshot=0x184, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0104.059] lstrlenW (lpString="spoolsv.exe") returned 11 [0104.059] Process32NextW (in: hSnapshot=0x184, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0104.060] lstrlenW (lpString="svchost.exe") returned 11 [0104.060] Process32NextW (in: hSnapshot=0x184, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0104.060] lstrlenW (lpString="taskhost.exe") returned 12 [0104.060] Process32NextW (in: hSnapshot=0x184, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x558, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0104.061] lstrlenW (lpString="dwm.exe") returned 7 [0104.061] Process32NextW (in: hSnapshot=0x184, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x54c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0104.061] lstrlenW (lpString="explorer.exe") returned 12 [0104.061] Process32NextW (in: hSnapshot=0x184, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0104.061] lstrlenW (lpString="taskeng.exe") returned 11 [0104.061] Process32NextW (in: hSnapshot=0x184, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0104.062] lstrlenW (lpString="taskhost.exe") returned 12 [0104.062] Process32NextW (in: hSnapshot=0x184, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="watches-vessel-arbitrary.exe")) returned 1 [0104.062] lstrlenW (lpString="watches-vessel-arbitrary.exe") returned 28 [0104.062] Process32NextW (in: hSnapshot=0x184, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="alsopound.exe")) returned 1 [0104.063] lstrlenW (lpString="alsopound.exe") returned 13 [0104.063] Process32NextW (in: hSnapshot=0x184, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x478, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="measuredamsterdamsandwich.exe")) returned 1 [0104.063] lstrlenW (lpString="measuredamsterdamsandwich.exe") returned 29 [0104.063] Process32NextW (in: hSnapshot=0x184, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="ooo_lucy_millions.exe")) returned 1 [0104.063] lstrlenW (lpString="ooo_lucy_millions.exe") returned 21 [0104.063] Process32NextW (in: hSnapshot=0x184, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="appearance.exe")) returned 1 [0104.064] lstrlenW (lpString="appearance.exe") returned 14 [0104.064] Process32NextW (in: hSnapshot=0x184, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="albert.exe")) returned 1 [0104.064] lstrlenW (lpString="albert.exe") returned 10 [0104.064] Process32NextW (in: hSnapshot=0x184, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="implied-enquiries.exe")) returned 1 [0104.065] lstrlenW (lpString="implied-enquiries.exe") returned 21 [0104.065] Process32NextW (in: hSnapshot=0x184, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x72c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="boston_opening.exe")) returned 1 [0104.065] lstrlenW (lpString="boston_opening.exe") returned 18 [0104.065] Process32NextW (in: hSnapshot=0x184, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="portsmouth.exe")) returned 1 [0104.066] lstrlenW (lpString="portsmouth.exe") returned 14 [0104.066] Process32NextW (in: hSnapshot=0x184, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="cameras grew poverty.exe")) returned 1 [0104.066] lstrlenW (lpString="cameras grew poverty.exe") returned 24 [0104.066] Process32NextW (in: hSnapshot=0x184, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="dxrapids.exe")) returned 1 [0104.066] lstrlenW (lpString="dxrapids.exe") returned 12 [0104.066] Process32NextW (in: hSnapshot=0x184, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x33c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="visitors.exe")) returned 1 [0104.067] lstrlenW (lpString="visitors.exe") returned 12 [0104.067] Process32NextW (in: hSnapshot=0x184, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="organisations_officially.exe")) returned 1 [0104.067] lstrlenW (lpString="organisations_officially.exe") returned 28 [0104.067] Process32NextW (in: hSnapshot=0x184, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x61c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="pair.exe")) returned 1 [0104.068] lstrlenW (lpString="pair.exe") returned 8 [0104.068] Process32NextW (in: hSnapshot=0x184, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="gross.exe")) returned 1 [0104.068] lstrlenW (lpString="gross.exe") returned 9 [0104.068] Process32NextW (in: hSnapshot=0x184, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x470, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="viewpicture.exe")) returned 1 [0104.069] lstrlenW (lpString="viewpicture.exe") returned 15 [0104.069] Process32NextW (in: hSnapshot=0x184, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="transmitted.exe")) returned 1 [0104.069] lstrlenW (lpString="transmitted.exe") returned 15 [0104.069] Process32NextW (in: hSnapshot=0x184, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x634, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="sunglassescelebs.exe")) returned 1 [0104.069] lstrlenW (lpString="sunglassescelebs.exe") returned 20 [0104.069] Process32NextW (in: hSnapshot=0x184, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="waiver-issue.exe")) returned 1 [0104.070] lstrlenW (lpString="waiver-issue.exe") returned 16 [0104.070] Process32NextW (in: hSnapshot=0x184, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x808, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="gziprear.exe")) returned 1 [0104.070] lstrlenW (lpString="gziprear.exe") returned 12 [0104.070] Process32NextW (in: hSnapshot=0x184, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x818, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="gregoryletters.exe")) returned 1 [0104.071] lstrlenW (lpString="gregoryletters.exe") returned 18 [0104.071] Process32NextW (in: hSnapshot=0x184, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x828, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="intel-metadata-rich.exe")) returned 1 [0104.071] lstrlenW (lpString="intel-metadata-rich.exe") returned 23 [0104.071] Process32NextW (in: hSnapshot=0x184, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x838, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="cemeteryreconstructiondimension.exe")) returned 1 [0104.071] lstrlenW (lpString="cemeteryreconstructiondimension.exe") returned 35 [0104.072] Process32NextW (in: hSnapshot=0x184, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0104.072] lstrlenW (lpString="svchost.exe") returned 11 [0104.072] Process32NextW (in: hSnapshot=0x184, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0104.072] lstrlenW (lpString="sppsvc.exe") returned 10 [0104.072] Process32NextW (in: hSnapshot=0x184, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xab4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0104.073] lstrlenW (lpString="svchost.exe") returned 11 [0104.073] Process32NextW (in: hSnapshot=0x184, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x9f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="unlikexpc.exe")) returned 1 [0104.073] lstrlenW (lpString="unlikexpc.exe") returned 13 [0104.073] Process32NextW (in: hSnapshot=0x184, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xb58, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0104.074] lstrlenW (lpString="cmd.exe") returned 7 [0104.074] Process32NextW (in: hSnapshot=0x184, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0104.074] lstrlenW (lpString="conhost.exe") returned 11 [0104.074] Process32NextW (in: hSnapshot=0x184, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0104.074] CloseHandle (hObject=0x184) returned 1 [0104.074] Sleep (dwMilliseconds=0x1f4) [0104.762] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x819b60 [0104.762] EnumServicesStatusExW (in: hSCManager=0x819b60, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x247fa74, lpServicesReturned=0x247fa8c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x247fa74, lpServicesReturned=0x247fa8c, lpResumeHandle=0x0) returned 0 [0104.762] GetLastError () returned 0xea [0104.762] EnumServicesStatusExW (in: hSCManager=0x819b60, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x3ef10c8, cbBufSize=0x13a2, pcbBytesNeeded=0x247fa74, lpServicesReturned=0x247fa8c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x3ef10c8, pcbBytesNeeded=0x247fa74, lpServicesReturned=0x247fa8c, lpResumeHandle=0x0) returned 1 [0104.763] CloseServiceHandle (hSCObject=0x819b60) returned 1 [0104.763] lstrlenW (lpString="Appinfo") returned 7 [0104.763] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0104.763] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0104.763] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0104.763] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0104.763] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0104.763] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0104.763] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0104.763] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0104.763] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0104.763] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0104.763] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0104.763] lstrlenW (lpString="AudioSrv") returned 8 [0104.763] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0104.763] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0104.763] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0104.763] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0104.763] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0104.763] lstrlenW (lpString="BFE") returned 3 [0104.763] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0104.763] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0104.763] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0104.763] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0104.763] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0104.763] lstrlenW (lpString="CryptSvc") returned 8 [0104.763] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0104.763] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0104.763] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0104.763] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0104.763] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0104.763] lstrlenW (lpString="CscService") returned 10 [0104.763] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0104.763] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0104.763] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0104.763] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0104.763] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0104.763] lstrlenW (lpString="DcomLaunch") returned 10 [0104.763] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0104.763] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0104.763] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0104.763] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0104.763] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0104.764] lstrlenW (lpString="Dhcp") returned 4 [0104.764] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0104.764] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0104.764] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0104.764] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0104.764] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0104.764] lstrlenW (lpString="Dnscache") returned 8 [0104.764] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0104.764] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0104.764] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0104.764] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0104.764] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0104.764] lstrlenW (lpString="DPS") returned 3 [0104.764] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0104.764] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0104.764] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0104.764] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0104.764] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0104.764] lstrlenW (lpString="eventlog") returned 8 [0104.764] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0104.764] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0104.764] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0104.764] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0104.764] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0104.764] lstrlenW (lpString="EventSystem") returned 11 [0104.764] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0104.764] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0104.764] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0104.764] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0104.764] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0104.764] lstrlenW (lpString="FontCache") returned 9 [0104.764] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0104.764] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0104.764] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0104.764] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0104.764] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0104.764] lstrlenW (lpString="gpsvc") returned 5 [0104.764] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0104.764] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0104.764] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0104.764] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0104.764] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0104.764] lstrlenW (lpString="iphlpsvc") returned 8 [0104.764] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0104.764] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0104.764] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0104.764] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0104.764] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0104.764] lstrlenW (lpString="LanmanServer") returned 12 [0104.764] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0104.764] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0104.764] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0104.764] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0104.765] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0104.765] lstrlenW (lpString="LanmanWorkstation") returned 17 [0104.765] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0104.765] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0104.765] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0104.765] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0104.765] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0104.765] lstrlenW (lpString="lmhosts") returned 7 [0104.765] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0104.765] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0104.765] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0104.765] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0104.765] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0104.765] lstrlenW (lpString="MMCSS") returned 5 [0104.765] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0104.765] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0104.765] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0104.765] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0104.765] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0104.765] lstrlenW (lpString="MpsSvc") returned 6 [0104.765] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0104.765] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0104.765] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0104.765] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0104.765] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0104.765] lstrlenW (lpString="Netman") returned 6 [0104.765] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0104.765] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0104.765] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0104.765] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0104.765] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0104.765] lstrlenW (lpString="netprofm") returned 8 [0104.765] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0104.765] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0104.765] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0104.765] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0104.765] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0104.765] lstrlenW (lpString="NlaSvc") returned 6 [0104.765] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0104.765] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0104.765] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0104.765] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0104.765] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0104.765] lstrlenW (lpString="nsi") returned 3 [0104.765] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0104.765] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0104.765] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0104.765] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0104.765] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0104.765] lstrlenW (lpString="PcaSvc") returned 6 [0104.765] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0104.765] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0104.765] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0104.766] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0104.766] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0104.766] lstrlenW (lpString="PlugPlay") returned 8 [0104.766] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0104.766] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0104.766] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0104.766] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0104.766] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0104.766] lstrlenW (lpString="Power") returned 5 [0104.766] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0104.766] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0104.766] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0104.766] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0104.766] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0104.766] lstrlenW (lpString="ProfSvc") returned 7 [0104.766] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0104.766] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0104.766] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0104.766] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0104.766] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0104.766] lstrlenW (lpString="RpcEptMapper") returned 12 [0104.766] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0104.766] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0104.766] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0104.766] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0104.766] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0104.766] lstrlenW (lpString="RpcSs") returned 5 [0104.766] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0104.766] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0104.766] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0104.766] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0104.766] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0104.766] lstrlenW (lpString="SamSs") returned 5 [0104.766] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0104.766] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0104.766] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0104.766] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0104.766] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0104.766] lstrlenW (lpString="Schedule") returned 8 [0104.766] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0104.766] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0104.766] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0104.766] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0104.766] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0104.766] lstrlenW (lpString="SENS") returned 4 [0104.766] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0104.766] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0104.766] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0104.766] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0104.766] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0104.766] lstrlenW (lpString="ShellHWDetection") returned 16 [0104.766] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0104.766] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0104.767] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0104.767] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0104.767] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0104.767] lstrlenW (lpString="Spooler") returned 7 [0104.767] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0104.767] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0104.767] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0104.767] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0104.767] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0104.767] lstrlenW (lpString="sppsvc") returned 6 [0104.767] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="sppsvc") returned -1 [0104.767] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="sppsvc") returned -1 [0104.767] lstrcmpiW (lpString1="sqlwriter", lpString2="sppsvc") returned 1 [0104.767] lstrcmpiW (lpString1="mssqlserver", lpString2="sppsvc") returned -1 [0104.767] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="sppsvc") returned 1 [0104.767] lstrlenW (lpString="SysMain") returned 7 [0104.767] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0104.767] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0104.767] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0104.767] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0104.767] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0104.767] lstrlenW (lpString="Themes") returned 6 [0104.767] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0104.767] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0104.767] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0104.767] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0104.767] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0104.767] lstrlenW (lpString="TrkWks") returned 6 [0104.767] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0104.767] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0104.767] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0104.767] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0104.767] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0104.767] lstrlenW (lpString="UxSms") returned 5 [0104.767] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0104.767] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0104.767] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0104.767] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0104.767] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0104.767] lstrlenW (lpString="W32Time") returned 7 [0104.767] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="W32Time") returned -1 [0104.767] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="W32Time") returned -1 [0104.767] lstrcmpiW (lpString1="sqlwriter", lpString2="W32Time") returned -1 [0104.767] lstrcmpiW (lpString1="mssqlserver", lpString2="W32Time") returned -1 [0104.767] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="W32Time") returned -1 [0104.767] lstrlenW (lpString="WdiServiceHost") returned 14 [0104.767] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0104.767] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0104.767] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0104.767] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0104.767] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0104.767] lstrlenW (lpString="WdiSystemHost") returned 13 [0104.768] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0104.768] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0104.768] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0104.768] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0104.768] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0104.768] lstrlenW (lpString="WinDefend") returned 9 [0104.768] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinDefend") returned -1 [0104.768] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinDefend") returned -1 [0104.768] lstrcmpiW (lpString1="sqlwriter", lpString2="WinDefend") returned -1 [0104.768] lstrcmpiW (lpString1="mssqlserver", lpString2="WinDefend") returned -1 [0104.768] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinDefend") returned -1 [0104.768] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0104.768] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0104.768] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0104.768] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0104.768] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0104.768] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0104.768] lstrlenW (lpString="Winmgmt") returned 7 [0104.768] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0104.768] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0104.768] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0104.768] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0104.768] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0104.768] lstrlenW (lpString="wscsvc") returned 6 [0104.768] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wscsvc") returned -1 [0104.768] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wscsvc") returned -1 [0104.768] lstrcmpiW (lpString1="sqlwriter", lpString2="wscsvc") returned -1 [0104.768] lstrcmpiW (lpString1="mssqlserver", lpString2="wscsvc") returned -1 [0104.768] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wscsvc") returned -1 [0104.768] lstrlenW (lpString="wuauserv") returned 8 [0104.768] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wuauserv") returned -1 [0104.768] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wuauserv") returned -1 [0104.768] lstrcmpiW (lpString1="sqlwriter", lpString2="wuauserv") returned -1 [0104.768] lstrcmpiW (lpString1="mssqlserver", lpString2="wuauserv") returned -1 [0104.768] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wuauserv") returned -1 [0104.768] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x194 [0104.769] Process32FirstW (in: hSnapshot=0x194, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0104.770] Process32NextW (in: hSnapshot=0x194, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0104.770] lstrlenW (lpString="System") returned 6 [0104.770] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0104.770] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0104.770] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0104.770] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0104.770] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0104.770] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0104.770] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0104.770] Process32NextW (in: hSnapshot=0x194, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0104.771] lstrlenW (lpString="smss.exe") returned 8 [0104.771] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0104.771] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0104.771] Process32NextW (in: hSnapshot=0x194, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0104.771] lstrlenW (lpString="csrss.exe") returned 9 [0104.771] Process32NextW (in: hSnapshot=0x194, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0104.772] lstrlenW (lpString="wininit.exe") returned 11 [0104.772] Process32NextW (in: hSnapshot=0x194, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0104.772] lstrlenW (lpString="csrss.exe") returned 9 [0104.772] Process32NextW (in: hSnapshot=0x194, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0104.773] lstrlenW (lpString="winlogon.exe") returned 12 [0104.773] Process32NextW (in: hSnapshot=0x194, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0104.773] lstrlenW (lpString="services.exe") returned 12 [0104.773] Process32NextW (in: hSnapshot=0x194, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0104.773] lstrlenW (lpString="lsass.exe") returned 9 [0104.773] Process32NextW (in: hSnapshot=0x194, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0104.774] lstrlenW (lpString="lsm.exe") returned 7 [0104.774] Process32NextW (in: hSnapshot=0x194, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0104.774] lstrlenW (lpString="svchost.exe") returned 11 [0104.774] Process32NextW (in: hSnapshot=0x194, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0104.775] lstrlenW (lpString="svchost.exe") returned 11 [0104.775] Process32NextW (in: hSnapshot=0x194, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0104.775] lstrlenW (lpString="svchost.exe") returned 11 [0104.775] Process32NextW (in: hSnapshot=0x194, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0104.775] lstrlenW (lpString="svchost.exe") returned 11 [0104.775] Process32NextW (in: hSnapshot=0x194, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x23, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0104.776] lstrlenW (lpString="svchost.exe") returned 11 [0104.776] Process32NextW (in: hSnapshot=0x194, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0104.776] lstrlenW (lpString="audiodg.exe") returned 11 [0104.776] Process32NextW (in: hSnapshot=0x194, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0104.777] lstrlenW (lpString="svchost.exe") returned 11 [0104.777] Process32NextW (in: hSnapshot=0x194, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0104.777] lstrlenW (lpString="svchost.exe") returned 11 [0104.777] Process32NextW (in: hSnapshot=0x194, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0104.778] lstrlenW (lpString="spoolsv.exe") returned 11 [0104.778] Process32NextW (in: hSnapshot=0x194, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0104.778] lstrlenW (lpString="svchost.exe") returned 11 [0104.778] Process32NextW (in: hSnapshot=0x194, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0104.778] lstrlenW (lpString="taskhost.exe") returned 12 [0104.778] Process32NextW (in: hSnapshot=0x194, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x558, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0104.779] lstrlenW (lpString="dwm.exe") returned 7 [0104.779] Process32NextW (in: hSnapshot=0x194, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x54c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0104.779] lstrlenW (lpString="explorer.exe") returned 12 [0104.779] Process32NextW (in: hSnapshot=0x194, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0104.780] lstrlenW (lpString="taskeng.exe") returned 11 [0104.780] Process32NextW (in: hSnapshot=0x194, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0104.780] lstrlenW (lpString="taskhost.exe") returned 12 [0104.780] Process32NextW (in: hSnapshot=0x194, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="watches-vessel-arbitrary.exe")) returned 1 [0104.780] lstrlenW (lpString="watches-vessel-arbitrary.exe") returned 28 [0104.781] Process32NextW (in: hSnapshot=0x194, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="alsopound.exe")) returned 1 [0104.781] lstrlenW (lpString="alsopound.exe") returned 13 [0104.781] Process32NextW (in: hSnapshot=0x194, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x478, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="measuredamsterdamsandwich.exe")) returned 1 [0104.781] lstrlenW (lpString="measuredamsterdamsandwich.exe") returned 29 [0104.781] Process32NextW (in: hSnapshot=0x194, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="ooo_lucy_millions.exe")) returned 1 [0104.782] lstrlenW (lpString="ooo_lucy_millions.exe") returned 21 [0104.782] Process32NextW (in: hSnapshot=0x194, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="appearance.exe")) returned 1 [0104.782] lstrlenW (lpString="appearance.exe") returned 14 [0104.782] Process32NextW (in: hSnapshot=0x194, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="albert.exe")) returned 1 [0104.783] lstrlenW (lpString="albert.exe") returned 10 [0104.783] Process32NextW (in: hSnapshot=0x194, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="implied-enquiries.exe")) returned 1 [0104.783] lstrlenW (lpString="implied-enquiries.exe") returned 21 [0104.783] Process32NextW (in: hSnapshot=0x194, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x72c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="boston_opening.exe")) returned 1 [0104.783] lstrlenW (lpString="boston_opening.exe") returned 18 [0104.783] Process32NextW (in: hSnapshot=0x194, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="portsmouth.exe")) returned 1 [0104.784] lstrlenW (lpString="portsmouth.exe") returned 14 [0104.784] Process32NextW (in: hSnapshot=0x194, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="cameras grew poverty.exe")) returned 1 [0104.784] lstrlenW (lpString="cameras grew poverty.exe") returned 24 [0104.784] Process32NextW (in: hSnapshot=0x194, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="dxrapids.exe")) returned 1 [0104.785] lstrlenW (lpString="dxrapids.exe") returned 12 [0104.785] Process32NextW (in: hSnapshot=0x194, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x33c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="visitors.exe")) returned 1 [0104.785] lstrlenW (lpString="visitors.exe") returned 12 [0104.785] Process32NextW (in: hSnapshot=0x194, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="organisations_officially.exe")) returned 1 [0104.785] lstrlenW (lpString="organisations_officially.exe") returned 28 [0104.786] Process32NextW (in: hSnapshot=0x194, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x61c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="pair.exe")) returned 1 [0104.786] lstrlenW (lpString="pair.exe") returned 8 [0104.786] Process32NextW (in: hSnapshot=0x194, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="gross.exe")) returned 1 [0104.786] lstrlenW (lpString="gross.exe") returned 9 [0104.786] Process32NextW (in: hSnapshot=0x194, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x470, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="viewpicture.exe")) returned 1 [0104.787] lstrlenW (lpString="viewpicture.exe") returned 15 [0104.787] Process32NextW (in: hSnapshot=0x194, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="transmitted.exe")) returned 1 [0104.787] lstrlenW (lpString="transmitted.exe") returned 15 [0104.787] Process32NextW (in: hSnapshot=0x194, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x634, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="sunglassescelebs.exe")) returned 1 [0104.788] lstrlenW (lpString="sunglassescelebs.exe") returned 20 [0104.788] Process32NextW (in: hSnapshot=0x194, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="waiver-issue.exe")) returned 1 [0104.788] lstrlenW (lpString="waiver-issue.exe") returned 16 [0104.788] Process32NextW (in: hSnapshot=0x194, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x808, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="gziprear.exe")) returned 1 [0104.789] lstrlenW (lpString="gziprear.exe") returned 12 [0104.789] Process32NextW (in: hSnapshot=0x194, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x818, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="gregoryletters.exe")) returned 1 [0104.789] lstrlenW (lpString="gregoryletters.exe") returned 18 [0104.789] Process32NextW (in: hSnapshot=0x194, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x828, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="intel-metadata-rich.exe")) returned 1 [0104.789] lstrlenW (lpString="intel-metadata-rich.exe") returned 23 [0104.789] Process32NextW (in: hSnapshot=0x194, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x838, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="cemeteryreconstructiondimension.exe")) returned 1 [0104.790] lstrlenW (lpString="cemeteryreconstructiondimension.exe") returned 35 [0104.790] Process32NextW (in: hSnapshot=0x194, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0104.790] lstrlenW (lpString="svchost.exe") returned 11 [0104.790] Process32NextW (in: hSnapshot=0x194, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0104.791] lstrlenW (lpString="sppsvc.exe") returned 10 [0104.791] Process32NextW (in: hSnapshot=0x194, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xab4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0104.791] lstrlenW (lpString="svchost.exe") returned 11 [0104.791] Process32NextW (in: hSnapshot=0x194, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x9f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="unlikexpc.exe")) returned 1 [0104.792] lstrlenW (lpString="unlikexpc.exe") returned 13 [0104.792] Process32NextW (in: hSnapshot=0x194, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xb58, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0104.792] lstrlenW (lpString="cmd.exe") returned 7 [0104.792] Process32NextW (in: hSnapshot=0x194, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0104.792] lstrlenW (lpString="conhost.exe") returned 11 [0104.792] Process32NextW (in: hSnapshot=0x194, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0104.793] CloseHandle (hObject=0x194) returned 1 [0104.793] Sleep (dwMilliseconds=0x1f4) [0105.557] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x819ca0 [0105.557] EnumServicesStatusExW (in: hSCManager=0x819ca0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x247fa74, lpServicesReturned=0x247fa8c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x247fa74, lpServicesReturned=0x247fa8c, lpResumeHandle=0x0) returned 0 [0105.558] GetLastError () returned 0xea [0105.558] EnumServicesStatusExW (in: hSCManager=0x819ca0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x3ef4118, cbBufSize=0x13a2, pcbBytesNeeded=0x247fa74, lpServicesReturned=0x247fa8c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x3ef4118, pcbBytesNeeded=0x247fa74, lpServicesReturned=0x247fa8c, lpResumeHandle=0x0) returned 1 [0105.558] CloseServiceHandle (hSCObject=0x819ca0) returned 1 [0105.558] lstrlenW (lpString="Appinfo") returned 7 [0105.558] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0105.558] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0105.558] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0105.558] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0105.558] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0105.558] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0105.558] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0105.558] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0105.558] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0105.558] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0105.558] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0105.559] lstrlenW (lpString="AudioSrv") returned 8 [0105.559] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0105.559] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0105.559] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0105.559] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0105.559] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0105.559] lstrlenW (lpString="BFE") returned 3 [0105.559] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0105.559] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0105.559] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0105.559] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0105.559] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0105.559] lstrlenW (lpString="CryptSvc") returned 8 [0105.559] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0105.559] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0105.559] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0105.559] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0105.559] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0105.559] lstrlenW (lpString="CscService") returned 10 [0105.559] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0105.559] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0105.559] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0105.559] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0105.559] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0105.559] lstrlenW (lpString="DcomLaunch") returned 10 [0105.559] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0105.559] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0105.559] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0105.559] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0105.559] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0105.559] lstrlenW (lpString="Dhcp") returned 4 [0105.559] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0105.559] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0105.559] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0105.559] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0105.559] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0105.559] lstrlenW (lpString="Dnscache") returned 8 [0105.559] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0105.559] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0105.559] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0105.559] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0105.559] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0105.559] lstrlenW (lpString="DPS") returned 3 [0105.559] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0105.559] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0105.559] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0105.559] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0105.559] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0105.559] lstrlenW (lpString="eventlog") returned 8 [0105.559] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0105.560] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0105.560] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0105.560] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0105.560] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0105.560] lstrlenW (lpString="EventSystem") returned 11 [0105.560] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0105.560] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0105.560] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0105.560] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0105.560] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0105.560] lstrlenW (lpString="FontCache") returned 9 [0105.560] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0105.560] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0105.560] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0105.560] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0105.560] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0105.560] lstrlenW (lpString="gpsvc") returned 5 [0105.560] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0105.560] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0105.560] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0105.560] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0105.560] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0105.560] lstrlenW (lpString="iphlpsvc") returned 8 [0105.560] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0105.560] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0105.560] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0105.560] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0105.560] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0105.560] lstrlenW (lpString="LanmanServer") returned 12 [0105.560] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0105.560] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0105.560] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0105.560] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0105.560] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0105.560] lstrlenW (lpString="LanmanWorkstation") returned 17 [0105.560] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0105.560] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0105.560] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0105.560] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0105.560] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0105.560] lstrlenW (lpString="lmhosts") returned 7 [0105.560] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0105.560] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0105.560] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0105.560] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0105.560] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0105.560] lstrlenW (lpString="MMCSS") returned 5 [0105.560] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0105.560] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0105.561] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0105.561] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0105.561] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0105.561] lstrlenW (lpString="MpsSvc") returned 6 [0105.561] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0105.561] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0105.561] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0105.561] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0105.561] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0105.561] lstrlenW (lpString="Netman") returned 6 [0105.561] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0105.561] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0105.561] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0105.561] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0105.561] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0105.561] lstrlenW (lpString="netprofm") returned 8 [0105.561] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0105.561] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0105.561] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0105.561] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0105.561] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0105.561] lstrlenW (lpString="NlaSvc") returned 6 [0105.561] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0105.561] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0105.561] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0105.561] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0105.561] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0105.561] lstrlenW (lpString="nsi") returned 3 [0105.561] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0105.561] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0105.561] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0105.561] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0105.561] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0105.561] lstrlenW (lpString="PcaSvc") returned 6 [0105.561] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0105.561] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0105.561] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0105.561] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0105.561] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0105.561] lstrlenW (lpString="PlugPlay") returned 8 [0105.561] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0105.561] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0105.561] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0105.561] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0105.561] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0105.561] lstrlenW (lpString="Power") returned 5 [0105.561] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0105.561] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0105.561] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0105.561] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0105.562] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0105.562] lstrlenW (lpString="ProfSvc") returned 7 [0105.562] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0105.562] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0105.562] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0105.562] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0105.562] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0105.562] lstrlenW (lpString="RpcEptMapper") returned 12 [0105.562] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0105.562] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0105.562] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0105.562] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0105.562] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0105.562] lstrlenW (lpString="RpcSs") returned 5 [0105.562] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0105.562] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0105.562] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0105.562] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0105.562] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0105.562] lstrlenW (lpString="SamSs") returned 5 [0105.562] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0105.562] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0105.562] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0105.562] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0105.562] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0105.562] lstrlenW (lpString="Schedule") returned 8 [0105.562] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0105.562] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0105.562] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0105.562] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0105.562] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0105.562] lstrlenW (lpString="SENS") returned 4 [0105.562] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0105.562] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0105.562] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0105.562] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0105.562] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0105.562] lstrlenW (lpString="ShellHWDetection") returned 16 [0105.562] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0105.562] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0105.562] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0105.562] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0105.562] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0105.562] lstrlenW (lpString="Spooler") returned 7 [0105.562] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0105.562] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0105.562] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0105.562] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0105.562] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0105.562] lstrlenW (lpString="sppsvc") returned 6 [0105.563] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="sppsvc") returned -1 [0105.563] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="sppsvc") returned -1 [0105.563] lstrcmpiW (lpString1="sqlwriter", lpString2="sppsvc") returned 1 [0105.563] lstrcmpiW (lpString1="mssqlserver", lpString2="sppsvc") returned -1 [0105.563] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="sppsvc") returned 1 [0105.563] lstrlenW (lpString="SysMain") returned 7 [0105.563] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0105.563] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0105.563] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0105.563] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0105.563] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0105.563] lstrlenW (lpString="Themes") returned 6 [0105.563] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0105.563] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0105.563] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0105.563] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0105.563] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0105.563] lstrlenW (lpString="TrkWks") returned 6 [0105.563] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0105.563] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0105.563] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0105.563] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0105.563] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0105.563] lstrlenW (lpString="UxSms") returned 5 [0105.563] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0105.563] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0105.563] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0105.563] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0105.563] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0105.563] lstrlenW (lpString="W32Time") returned 7 [0105.563] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="W32Time") returned -1 [0105.563] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="W32Time") returned -1 [0105.563] lstrcmpiW (lpString1="sqlwriter", lpString2="W32Time") returned -1 [0105.563] lstrcmpiW (lpString1="mssqlserver", lpString2="W32Time") returned -1 [0105.563] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="W32Time") returned -1 [0105.563] lstrlenW (lpString="WdiServiceHost") returned 14 [0105.563] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0105.563] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0105.563] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0105.563] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0105.563] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0105.563] lstrlenW (lpString="WdiSystemHost") returned 13 [0105.563] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0105.563] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0105.563] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0105.563] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0105.563] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0105.563] lstrlenW (lpString="WinDefend") returned 9 [0105.563] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinDefend") returned -1 [0105.563] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinDefend") returned -1 [0105.563] lstrcmpiW (lpString1="sqlwriter", lpString2="WinDefend") returned -1 [0105.564] lstrcmpiW (lpString1="mssqlserver", lpString2="WinDefend") returned -1 [0105.564] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinDefend") returned -1 [0105.564] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0105.564] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0105.564] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0105.564] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0105.564] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0105.564] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0105.564] lstrlenW (lpString="Winmgmt") returned 7 [0105.564] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0105.564] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0105.564] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0105.564] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0105.564] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0105.564] lstrlenW (lpString="wscsvc") returned 6 [0105.564] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wscsvc") returned -1 [0105.564] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wscsvc") returned -1 [0105.564] lstrcmpiW (lpString1="sqlwriter", lpString2="wscsvc") returned -1 [0105.564] lstrcmpiW (lpString1="mssqlserver", lpString2="wscsvc") returned -1 [0105.564] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wscsvc") returned -1 [0105.564] lstrlenW (lpString="wuauserv") returned 8 [0105.564] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wuauserv") returned -1 [0105.564] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wuauserv") returned -1 [0105.564] lstrcmpiW (lpString1="sqlwriter", lpString2="wuauserv") returned -1 [0105.564] lstrcmpiW (lpString1="mssqlserver", lpString2="wuauserv") returned -1 [0105.564] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wuauserv") returned -1 [0105.564] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1b0 [0105.565] Process32FirstW (in: hSnapshot=0x1b0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0105.566] Process32NextW (in: hSnapshot=0x1b0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0105.566] lstrlenW (lpString="System") returned 6 [0105.566] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0105.566] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0105.566] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0105.566] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0105.566] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0105.566] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0105.566] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0105.566] Process32NextW (in: hSnapshot=0x1b0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0105.567] lstrlenW (lpString="smss.exe") returned 8 [0105.567] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0105.567] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0105.567] Process32NextW (in: hSnapshot=0x1b0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0105.567] lstrlenW (lpString="csrss.exe") returned 9 [0105.567] Process32NextW (in: hSnapshot=0x1b0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0105.567] lstrlenW (lpString="wininit.exe") returned 11 [0105.568] Process32NextW (in: hSnapshot=0x1b0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0105.568] lstrlenW (lpString="csrss.exe") returned 9 [0105.568] Process32NextW (in: hSnapshot=0x1b0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0105.568] lstrlenW (lpString="winlogon.exe") returned 12 [0105.568] Process32NextW (in: hSnapshot=0x1b0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0105.569] lstrlenW (lpString="services.exe") returned 12 [0105.569] Process32NextW (in: hSnapshot=0x1b0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0105.569] lstrlenW (lpString="lsass.exe") returned 9 [0105.569] Process32NextW (in: hSnapshot=0x1b0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0105.570] lstrlenW (lpString="lsm.exe") returned 7 [0105.570] Process32NextW (in: hSnapshot=0x1b0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0105.570] lstrlenW (lpString="svchost.exe") returned 11 [0105.570] Process32NextW (in: hSnapshot=0x1b0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0105.571] lstrlenW (lpString="svchost.exe") returned 11 [0105.571] Process32NextW (in: hSnapshot=0x1b0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0105.571] lstrlenW (lpString="svchost.exe") returned 11 [0105.571] Process32NextW (in: hSnapshot=0x1b0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0105.571] lstrlenW (lpString="svchost.exe") returned 11 [0105.571] Process32NextW (in: hSnapshot=0x1b0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x23, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0105.572] lstrlenW (lpString="svchost.exe") returned 11 [0105.572] Process32NextW (in: hSnapshot=0x1b0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0105.572] lstrlenW (lpString="audiodg.exe") returned 11 [0105.572] Process32NextW (in: hSnapshot=0x1b0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0105.573] lstrlenW (lpString="svchost.exe") returned 11 [0105.573] Process32NextW (in: hSnapshot=0x1b0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0105.573] lstrlenW (lpString="svchost.exe") returned 11 [0105.573] Process32NextW (in: hSnapshot=0x1b0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0105.573] lstrlenW (lpString="spoolsv.exe") returned 11 [0105.573] Process32NextW (in: hSnapshot=0x1b0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0105.574] lstrlenW (lpString="svchost.exe") returned 11 [0105.574] Process32NextW (in: hSnapshot=0x1b0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0105.574] lstrlenW (lpString="taskhost.exe") returned 12 [0105.574] Process32NextW (in: hSnapshot=0x1b0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x558, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0105.575] lstrlenW (lpString="dwm.exe") returned 7 [0105.575] Process32NextW (in: hSnapshot=0x1b0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x54c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0105.575] lstrlenW (lpString="explorer.exe") returned 12 [0105.575] Process32NextW (in: hSnapshot=0x1b0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0105.576] lstrlenW (lpString="taskeng.exe") returned 11 [0105.576] Process32NextW (in: hSnapshot=0x1b0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0105.576] lstrlenW (lpString="taskhost.exe") returned 12 [0105.576] Process32NextW (in: hSnapshot=0x1b0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="watches-vessel-arbitrary.exe")) returned 1 [0105.576] lstrlenW (lpString="watches-vessel-arbitrary.exe") returned 28 [0105.576] Process32NextW (in: hSnapshot=0x1b0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="alsopound.exe")) returned 1 [0105.577] lstrlenW (lpString="alsopound.exe") returned 13 [0105.577] Process32NextW (in: hSnapshot=0x1b0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x478, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="measuredamsterdamsandwich.exe")) returned 1 [0105.577] lstrlenW (lpString="measuredamsterdamsandwich.exe") returned 29 [0105.577] Process32NextW (in: hSnapshot=0x1b0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="ooo_lucy_millions.exe")) returned 1 [0105.578] lstrlenW (lpString="ooo_lucy_millions.exe") returned 21 [0105.578] Process32NextW (in: hSnapshot=0x1b0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="appearance.exe")) returned 1 [0105.578] lstrlenW (lpString="appearance.exe") returned 14 [0105.578] Process32NextW (in: hSnapshot=0x1b0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="albert.exe")) returned 1 [0105.579] lstrlenW (lpString="albert.exe") returned 10 [0105.579] Process32NextW (in: hSnapshot=0x1b0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="implied-enquiries.exe")) returned 1 [0105.579] lstrlenW (lpString="implied-enquiries.exe") returned 21 [0105.579] Process32NextW (in: hSnapshot=0x1b0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x72c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="boston_opening.exe")) returned 1 [0105.579] lstrlenW (lpString="boston_opening.exe") returned 18 [0105.579] Process32NextW (in: hSnapshot=0x1b0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="portsmouth.exe")) returned 1 [0105.580] lstrlenW (lpString="portsmouth.exe") returned 14 [0105.580] Process32NextW (in: hSnapshot=0x1b0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="cameras grew poverty.exe")) returned 1 [0105.580] lstrlenW (lpString="cameras grew poverty.exe") returned 24 [0105.580] Process32NextW (in: hSnapshot=0x1b0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="dxrapids.exe")) returned 1 [0105.581] lstrlenW (lpString="dxrapids.exe") returned 12 [0105.581] Process32NextW (in: hSnapshot=0x1b0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x33c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="visitors.exe")) returned 1 [0105.581] lstrlenW (lpString="visitors.exe") returned 12 [0105.581] Process32NextW (in: hSnapshot=0x1b0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="organisations_officially.exe")) returned 1 [0105.581] lstrlenW (lpString="organisations_officially.exe") returned 28 [0105.581] Process32NextW (in: hSnapshot=0x1b0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x61c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="pair.exe")) returned 1 [0105.582] lstrlenW (lpString="pair.exe") returned 8 [0105.582] Process32NextW (in: hSnapshot=0x1b0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="gross.exe")) returned 1 [0105.582] lstrlenW (lpString="gross.exe") returned 9 [0105.582] Process32NextW (in: hSnapshot=0x1b0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x470, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="viewpicture.exe")) returned 1 [0105.583] lstrlenW (lpString="viewpicture.exe") returned 15 [0105.583] Process32NextW (in: hSnapshot=0x1b0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="transmitted.exe")) returned 1 [0105.583] lstrlenW (lpString="transmitted.exe") returned 15 [0105.583] Process32NextW (in: hSnapshot=0x1b0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x634, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="sunglassescelebs.exe")) returned 1 [0105.584] lstrlenW (lpString="sunglassescelebs.exe") returned 20 [0105.584] Process32NextW (in: hSnapshot=0x1b0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="waiver-issue.exe")) returned 1 [0105.584] lstrlenW (lpString="waiver-issue.exe") returned 16 [0105.584] Process32NextW (in: hSnapshot=0x1b0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x808, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="gziprear.exe")) returned 1 [0105.585] lstrlenW (lpString="gziprear.exe") returned 12 [0105.585] Process32NextW (in: hSnapshot=0x1b0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x818, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="gregoryletters.exe")) returned 1 [0105.585] lstrlenW (lpString="gregoryletters.exe") returned 18 [0105.585] Process32NextW (in: hSnapshot=0x1b0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x828, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="intel-metadata-rich.exe")) returned 1 [0105.585] lstrlenW (lpString="intel-metadata-rich.exe") returned 23 [0105.585] Process32NextW (in: hSnapshot=0x1b0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x838, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="cemeteryreconstructiondimension.exe")) returned 1 [0105.586] lstrlenW (lpString="cemeteryreconstructiondimension.exe") returned 35 [0105.586] Process32NextW (in: hSnapshot=0x1b0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0105.586] lstrlenW (lpString="svchost.exe") returned 11 [0105.586] Process32NextW (in: hSnapshot=0x1b0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0105.587] lstrlenW (lpString="sppsvc.exe") returned 10 [0105.587] Process32NextW (in: hSnapshot=0x1b0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xab4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0105.587] lstrlenW (lpString="svchost.exe") returned 11 [0105.587] Process32NextW (in: hSnapshot=0x1b0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x9f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="unlikexpc.exe")) returned 1 [0105.587] lstrlenW (lpString="unlikexpc.exe") returned 13 [0105.587] Process32NextW (in: hSnapshot=0x1b0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xb58, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0105.588] lstrlenW (lpString="cmd.exe") returned 7 [0105.588] Process32NextW (in: hSnapshot=0x1b0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0105.588] lstrlenW (lpString="conhost.exe") returned 11 [0105.588] Process32NextW (in: hSnapshot=0x1b0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0105.589] CloseHandle (hObject=0x1b0) returned 1 [0105.589] Sleep (dwMilliseconds=0x1f4) [0106.289] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x819b60 [0106.289] EnumServicesStatusExW (in: hSCManager=0x819b60, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x247fa74, lpServicesReturned=0x247fa8c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x247fa74, lpServicesReturned=0x247fa8c, lpResumeHandle=0x0) returned 0 [0106.289] GetLastError () returned 0xea [0106.289] EnumServicesStatusExW (in: hSCManager=0x819b60, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x3ef4118, cbBufSize=0x13a2, pcbBytesNeeded=0x247fa74, lpServicesReturned=0x247fa8c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x3ef4118, pcbBytesNeeded=0x247fa74, lpServicesReturned=0x247fa8c, lpResumeHandle=0x0) returned 1 [0106.290] CloseServiceHandle (hSCObject=0x819b60) returned 1 [0106.290] lstrlenW (lpString="Appinfo") returned 7 [0106.290] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0106.290] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0106.290] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0106.290] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0106.290] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0106.290] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0106.290] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0106.290] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0106.290] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0106.290] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0106.290] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0106.290] lstrlenW (lpString="AudioSrv") returned 8 [0106.290] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0106.290] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0106.290] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0106.290] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0106.290] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0106.290] lstrlenW (lpString="BFE") returned 3 [0106.290] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0106.290] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0106.290] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0106.290] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0106.290] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0106.290] lstrlenW (lpString="CryptSvc") returned 8 [0106.290] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0106.291] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0106.291] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0106.291] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0106.291] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0106.291] lstrlenW (lpString="CscService") returned 10 [0106.291] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0106.291] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0106.291] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0106.291] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0106.291] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0106.291] lstrlenW (lpString="DcomLaunch") returned 10 [0106.291] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0106.291] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0106.291] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0106.291] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0106.291] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0106.291] lstrlenW (lpString="Dhcp") returned 4 [0106.291] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0106.291] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0106.291] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0106.291] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0106.291] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0106.291] lstrlenW (lpString="Dnscache") returned 8 [0106.291] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0106.291] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0106.291] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0106.291] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0106.291] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0106.291] lstrlenW (lpString="DPS") returned 3 [0106.291] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0106.291] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0106.291] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0106.291] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0106.291] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0106.291] lstrlenW (lpString="eventlog") returned 8 [0106.291] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0106.291] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0106.291] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0106.291] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0106.291] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0106.291] lstrlenW (lpString="EventSystem") returned 11 [0106.291] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0106.291] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0106.291] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0106.291] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0106.291] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0106.291] lstrlenW (lpString="FontCache") returned 9 [0106.291] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0106.291] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0106.292] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0106.292] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0106.292] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0106.292] lstrlenW (lpString="gpsvc") returned 5 [0106.292] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0106.292] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0106.292] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0106.292] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0106.292] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0106.292] lstrlenW (lpString="iphlpsvc") returned 8 [0106.292] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0106.292] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0106.292] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0106.292] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0106.292] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0106.292] lstrlenW (lpString="LanmanServer") returned 12 [0106.292] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0106.292] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0106.292] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0106.292] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0106.292] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0106.292] lstrlenW (lpString="LanmanWorkstation") returned 17 [0106.292] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0106.292] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0106.292] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0106.292] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0106.292] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0106.292] lstrlenW (lpString="lmhosts") returned 7 [0106.292] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0106.292] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0106.292] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0106.292] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0106.292] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0106.292] lstrlenW (lpString="MMCSS") returned 5 [0106.292] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0106.292] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0106.292] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0106.292] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0106.292] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0106.292] lstrlenW (lpString="MpsSvc") returned 6 [0106.292] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0106.292] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0106.292] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0106.292] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0106.292] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0106.292] lstrlenW (lpString="Netman") returned 6 [0106.292] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0106.292] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0106.292] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0106.293] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0106.293] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0106.293] lstrlenW (lpString="netprofm") returned 8 [0106.293] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0106.293] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0106.293] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0106.293] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0106.293] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0106.293] lstrlenW (lpString="NlaSvc") returned 6 [0106.293] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0106.293] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0106.293] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0106.293] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0106.293] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0106.293] lstrlenW (lpString="nsi") returned 3 [0106.293] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0106.293] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0106.293] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0106.293] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0106.293] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0106.293] lstrlenW (lpString="PcaSvc") returned 6 [0106.293] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0106.293] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0106.293] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0106.293] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0106.293] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0106.293] lstrlenW (lpString="PlugPlay") returned 8 [0106.293] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0106.293] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0106.293] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0106.293] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0106.293] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0106.293] lstrlenW (lpString="Power") returned 5 [0106.293] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0106.293] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0106.293] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0106.293] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0106.293] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0106.293] lstrlenW (lpString="ProfSvc") returned 7 [0106.293] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0106.293] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0106.293] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0106.293] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0106.293] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0106.293] lstrlenW (lpString="RpcEptMapper") returned 12 [0106.293] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0106.293] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0106.293] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0106.293] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0106.293] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0106.294] lstrlenW (lpString="RpcSs") returned 5 [0106.294] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0106.294] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0106.294] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0106.294] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0106.294] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0106.294] lstrlenW (lpString="SamSs") returned 5 [0106.294] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0106.294] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0106.294] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0106.294] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0106.294] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0106.294] lstrlenW (lpString="Schedule") returned 8 [0106.294] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0106.294] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0106.294] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0106.294] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0106.294] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0106.294] lstrlenW (lpString="SENS") returned 4 [0106.294] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0106.294] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0106.294] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0106.294] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0106.294] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0106.294] lstrlenW (lpString="ShellHWDetection") returned 16 [0106.294] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0106.294] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0106.294] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0106.294] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0106.294] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0106.294] lstrlenW (lpString="Spooler") returned 7 [0106.294] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0106.294] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0106.294] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0106.294] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0106.294] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0106.294] lstrlenW (lpString="sppsvc") returned 6 [0106.294] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="sppsvc") returned -1 [0106.294] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="sppsvc") returned -1 [0106.294] lstrcmpiW (lpString1="sqlwriter", lpString2="sppsvc") returned 1 [0106.294] lstrcmpiW (lpString1="mssqlserver", lpString2="sppsvc") returned -1 [0106.294] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="sppsvc") returned 1 [0106.294] lstrlenW (lpString="SysMain") returned 7 [0106.294] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0106.294] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0106.294] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0106.294] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0106.294] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0106.294] lstrlenW (lpString="Themes") returned 6 [0106.294] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0106.295] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0106.295] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0106.295] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0106.295] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0106.295] lstrlenW (lpString="TrkWks") returned 6 [0106.295] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0106.295] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0106.295] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0106.295] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0106.295] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0106.295] lstrlenW (lpString="UxSms") returned 5 [0106.295] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0106.295] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0106.295] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0106.295] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0106.295] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0106.295] lstrlenW (lpString="W32Time") returned 7 [0106.295] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="W32Time") returned -1 [0106.295] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="W32Time") returned -1 [0106.295] lstrcmpiW (lpString1="sqlwriter", lpString2="W32Time") returned -1 [0106.295] lstrcmpiW (lpString1="mssqlserver", lpString2="W32Time") returned -1 [0106.295] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="W32Time") returned -1 [0106.295] lstrlenW (lpString="WdiServiceHost") returned 14 [0106.295] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0106.295] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0106.295] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0106.295] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0106.295] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0106.295] lstrlenW (lpString="WdiSystemHost") returned 13 [0106.295] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0106.295] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0106.295] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0106.295] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0106.295] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0106.295] lstrlenW (lpString="WinDefend") returned 9 [0106.295] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinDefend") returned -1 [0106.295] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinDefend") returned -1 [0106.295] lstrcmpiW (lpString1="sqlwriter", lpString2="WinDefend") returned -1 [0106.295] lstrcmpiW (lpString1="mssqlserver", lpString2="WinDefend") returned -1 [0106.295] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinDefend") returned -1 [0106.295] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0106.295] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0106.295] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0106.295] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0106.295] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0106.295] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0106.295] lstrlenW (lpString="Winmgmt") returned 7 [0106.295] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0106.295] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0106.295] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0106.296] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0106.296] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0106.296] lstrlenW (lpString="wscsvc") returned 6 [0106.296] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wscsvc") returned -1 [0106.296] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wscsvc") returned -1 [0106.296] lstrcmpiW (lpString1="sqlwriter", lpString2="wscsvc") returned -1 [0106.296] lstrcmpiW (lpString1="mssqlserver", lpString2="wscsvc") returned -1 [0106.296] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wscsvc") returned -1 [0106.296] lstrlenW (lpString="wuauserv") returned 8 [0106.296] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wuauserv") returned -1 [0106.296] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wuauserv") returned -1 [0106.296] lstrcmpiW (lpString1="sqlwriter", lpString2="wuauserv") returned -1 [0106.296] lstrcmpiW (lpString1="mssqlserver", lpString2="wuauserv") returned -1 [0106.296] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wuauserv") returned -1 [0106.296] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1cc [0106.297] Process32FirstW (in: hSnapshot=0x1cc, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0106.297] Process32NextW (in: hSnapshot=0x1cc, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0106.298] lstrlenW (lpString="System") returned 6 [0106.298] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0106.298] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0106.298] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0106.298] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0106.298] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0106.298] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0106.298] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0106.298] Process32NextW (in: hSnapshot=0x1cc, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0106.298] lstrlenW (lpString="smss.exe") returned 8 [0106.298] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0106.298] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0106.298] Process32NextW (in: hSnapshot=0x1cc, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0106.299] lstrlenW (lpString="csrss.exe") returned 9 [0106.299] Process32NextW (in: hSnapshot=0x1cc, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0106.299] lstrlenW (lpString="wininit.exe") returned 11 [0106.299] Process32NextW (in: hSnapshot=0x1cc, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0106.300] lstrlenW (lpString="csrss.exe") returned 9 [0106.300] Process32NextW (in: hSnapshot=0x1cc, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0106.300] lstrlenW (lpString="winlogon.exe") returned 12 [0106.300] Process32NextW (in: hSnapshot=0x1cc, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0106.301] lstrlenW (lpString="services.exe") returned 12 [0106.301] Process32NextW (in: hSnapshot=0x1cc, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0106.301] lstrlenW (lpString="lsass.exe") returned 9 [0106.301] Process32NextW (in: hSnapshot=0x1cc, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0106.302] lstrlenW (lpString="lsm.exe") returned 7 [0106.302] Process32NextW (in: hSnapshot=0x1cc, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0106.302] lstrlenW (lpString="svchost.exe") returned 11 [0106.302] Process32NextW (in: hSnapshot=0x1cc, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0106.302] lstrlenW (lpString="svchost.exe") returned 11 [0106.303] Process32NextW (in: hSnapshot=0x1cc, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0106.303] lstrlenW (lpString="svchost.exe") returned 11 [0106.303] Process32NextW (in: hSnapshot=0x1cc, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0106.303] lstrlenW (lpString="svchost.exe") returned 11 [0106.303] Process32NextW (in: hSnapshot=0x1cc, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x23, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0106.304] lstrlenW (lpString="svchost.exe") returned 11 [0106.304] Process32NextW (in: hSnapshot=0x1cc, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0106.304] lstrlenW (lpString="audiodg.exe") returned 11 [0106.304] Process32NextW (in: hSnapshot=0x1cc, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0106.305] lstrlenW (lpString="svchost.exe") returned 11 [0106.305] Process32NextW (in: hSnapshot=0x1cc, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0106.305] lstrlenW (lpString="svchost.exe") returned 11 [0106.305] Process32NextW (in: hSnapshot=0x1cc, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0106.305] lstrlenW (lpString="spoolsv.exe") returned 11 [0106.305] Process32NextW (in: hSnapshot=0x1cc, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0106.306] lstrlenW (lpString="svchost.exe") returned 11 [0106.306] Process32NextW (in: hSnapshot=0x1cc, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0106.306] lstrlenW (lpString="taskhost.exe") returned 12 [0106.306] Process32NextW (in: hSnapshot=0x1cc, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x558, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0106.307] lstrlenW (lpString="dwm.exe") returned 7 [0106.307] Process32NextW (in: hSnapshot=0x1cc, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x54c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0106.307] lstrlenW (lpString="explorer.exe") returned 12 [0106.307] Process32NextW (in: hSnapshot=0x1cc, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0106.308] lstrlenW (lpString="taskeng.exe") returned 11 [0106.308] Process32NextW (in: hSnapshot=0x1cc, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0106.308] lstrlenW (lpString="taskhost.exe") returned 12 [0106.308] Process32NextW (in: hSnapshot=0x1cc, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="watches-vessel-arbitrary.exe")) returned 1 [0106.308] lstrlenW (lpString="watches-vessel-arbitrary.exe") returned 28 [0106.308] Process32NextW (in: hSnapshot=0x1cc, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="alsopound.exe")) returned 1 [0106.309] lstrlenW (lpString="alsopound.exe") returned 13 [0106.309] Process32NextW (in: hSnapshot=0x1cc, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x478, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="measuredamsterdamsandwich.exe")) returned 1 [0106.309] lstrlenW (lpString="measuredamsterdamsandwich.exe") returned 29 [0106.309] Process32NextW (in: hSnapshot=0x1cc, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="ooo_lucy_millions.exe")) returned 1 [0106.310] lstrlenW (lpString="ooo_lucy_millions.exe") returned 21 [0106.310] Process32NextW (in: hSnapshot=0x1cc, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="appearance.exe")) returned 1 [0106.310] lstrlenW (lpString="appearance.exe") returned 14 [0106.310] Process32NextW (in: hSnapshot=0x1cc, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="albert.exe")) returned 1 [0106.311] lstrlenW (lpString="albert.exe") returned 10 [0106.311] Process32NextW (in: hSnapshot=0x1cc, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="implied-enquiries.exe")) returned 1 [0106.311] lstrlenW (lpString="implied-enquiries.exe") returned 21 [0106.311] Process32NextW (in: hSnapshot=0x1cc, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x72c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="boston_opening.exe")) returned 1 [0106.311] lstrlenW (lpString="boston_opening.exe") returned 18 [0106.311] Process32NextW (in: hSnapshot=0x1cc, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="portsmouth.exe")) returned 1 [0106.312] lstrlenW (lpString="portsmouth.exe") returned 14 [0106.312] Process32NextW (in: hSnapshot=0x1cc, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="cameras grew poverty.exe")) returned 1 [0106.312] lstrlenW (lpString="cameras grew poverty.exe") returned 24 [0106.312] Process32NextW (in: hSnapshot=0x1cc, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="dxrapids.exe")) returned 1 [0106.313] lstrlenW (lpString="dxrapids.exe") returned 12 [0106.313] Process32NextW (in: hSnapshot=0x1cc, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x33c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="visitors.exe")) returned 1 [0106.313] lstrlenW (lpString="visitors.exe") returned 12 [0106.313] Process32NextW (in: hSnapshot=0x1cc, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="organisations_officially.exe")) returned 1 [0106.314] lstrlenW (lpString="organisations_officially.exe") returned 28 [0106.314] Process32NextW (in: hSnapshot=0x1cc, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x61c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="pair.exe")) returned 1 [0106.314] lstrlenW (lpString="pair.exe") returned 8 [0106.314] Process32NextW (in: hSnapshot=0x1cc, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="gross.exe")) returned 1 [0106.314] lstrlenW (lpString="gross.exe") returned 9 [0106.314] Process32NextW (in: hSnapshot=0x1cc, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x470, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="viewpicture.exe")) returned 1 [0106.315] lstrlenW (lpString="viewpicture.exe") returned 15 [0106.315] Process32NextW (in: hSnapshot=0x1cc, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="transmitted.exe")) returned 1 [0106.315] lstrlenW (lpString="transmitted.exe") returned 15 [0106.315] Process32NextW (in: hSnapshot=0x1cc, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x634, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="sunglassescelebs.exe")) returned 1 [0106.316] lstrlenW (lpString="sunglassescelebs.exe") returned 20 [0106.316] Process32NextW (in: hSnapshot=0x1cc, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="waiver-issue.exe")) returned 1 [0106.316] lstrlenW (lpString="waiver-issue.exe") returned 16 [0106.316] Process32NextW (in: hSnapshot=0x1cc, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x808, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="gziprear.exe")) returned 1 [0106.317] lstrlenW (lpString="gziprear.exe") returned 12 [0106.317] Process32NextW (in: hSnapshot=0x1cc, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x818, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="gregoryletters.exe")) returned 1 [0106.317] lstrlenW (lpString="gregoryletters.exe") returned 18 [0106.317] Process32NextW (in: hSnapshot=0x1cc, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x828, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="intel-metadata-rich.exe")) returned 1 [0106.318] lstrlenW (lpString="intel-metadata-rich.exe") returned 23 [0106.318] Process32NextW (in: hSnapshot=0x1cc, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x838, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="cemeteryreconstructiondimension.exe")) returned 1 [0106.318] lstrlenW (lpString="cemeteryreconstructiondimension.exe") returned 35 [0106.318] Process32NextW (in: hSnapshot=0x1cc, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0106.318] lstrlenW (lpString="svchost.exe") returned 11 [0106.318] Process32NextW (in: hSnapshot=0x1cc, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0106.319] lstrlenW (lpString="sppsvc.exe") returned 10 [0106.319] Process32NextW (in: hSnapshot=0x1cc, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xab4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0106.319] lstrlenW (lpString="svchost.exe") returned 11 [0106.319] Process32NextW (in: hSnapshot=0x1cc, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x9f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="unlikexpc.exe")) returned 1 [0106.320] lstrlenW (lpString="unlikexpc.exe") returned 13 [0106.320] Process32NextW (in: hSnapshot=0x1cc, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xb58, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0106.320] lstrlenW (lpString="cmd.exe") returned 7 [0106.320] Process32NextW (in: hSnapshot=0x1cc, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0106.321] lstrlenW (lpString="conhost.exe") returned 11 [0106.321] Process32NextW (in: hSnapshot=0x1cc, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0106.321] CloseHandle (hObject=0x1cc) returned 1 [0106.321] Sleep (dwMilliseconds=0x1f4) [0106.863] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x819b38 [0107.897] EnumServicesStatusExW (in: hSCManager=0x819b38, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x247fa74, lpServicesReturned=0x247fa8c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x247fa74, lpServicesReturned=0x247fa8c, lpResumeHandle=0x0) returned 0 [0107.897] GetLastError () returned 0xea [0107.898] EnumServicesStatusExW (in: hSCManager=0x819b38, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x3ef9118, cbBufSize=0x13a2, pcbBytesNeeded=0x247fa74, lpServicesReturned=0x247fa8c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x3ef9118, pcbBytesNeeded=0x247fa74, lpServicesReturned=0x247fa8c, lpResumeHandle=0x0) returned 1 [0107.907] CloseServiceHandle (hSCObject=0x819b38) returned 1 [0107.909] lstrlenW (lpString="Appinfo") returned 7 [0107.909] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0107.909] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0107.909] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0107.909] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0107.909] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0107.909] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0107.909] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0107.909] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0107.909] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0107.909] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0107.909] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0107.909] lstrlenW (lpString="AudioSrv") returned 8 [0107.909] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0107.909] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0107.909] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0107.909] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0107.909] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0107.909] lstrlenW (lpString="BFE") returned 3 [0107.909] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0107.909] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0107.909] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0107.909] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0107.909] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0107.909] lstrlenW (lpString="CryptSvc") returned 8 [0107.909] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0107.909] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0107.909] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0107.909] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0107.909] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0107.909] lstrlenW (lpString="CscService") returned 10 [0107.909] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0107.910] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0107.910] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0107.910] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0107.910] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0107.910] lstrlenW (lpString="DcomLaunch") returned 10 [0107.910] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0107.910] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0107.910] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0107.910] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0107.910] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0107.910] lstrlenW (lpString="Dhcp") returned 4 [0107.910] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0107.910] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0107.910] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0107.910] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0107.910] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0107.910] lstrlenW (lpString="Dnscache") returned 8 [0107.910] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0107.910] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0107.910] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0107.910] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0107.910] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0107.910] lstrlenW (lpString="DPS") returned 3 [0107.910] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0107.910] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0107.910] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0107.910] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0107.910] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0107.910] lstrlenW (lpString="eventlog") returned 8 [0107.910] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0107.910] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0107.910] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0107.910] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0107.910] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0107.910] lstrlenW (lpString="EventSystem") returned 11 [0107.910] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0107.910] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0107.910] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0107.910] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0107.910] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0107.910] lstrlenW (lpString="FontCache") returned 9 [0107.910] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0107.910] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0107.910] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0107.910] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0107.910] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0107.910] lstrlenW (lpString="gpsvc") returned 5 [0107.910] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0107.910] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0107.910] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0107.910] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0107.910] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0107.910] lstrlenW (lpString="iphlpsvc") returned 8 [0107.911] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0107.911] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0107.911] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0107.911] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0107.911] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0107.911] lstrlenW (lpString="LanmanServer") returned 12 [0107.911] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0107.911] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0107.911] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0107.911] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0107.911] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0107.911] lstrlenW (lpString="LanmanWorkstation") returned 17 [0107.911] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0107.911] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0107.911] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0107.911] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0107.911] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0107.911] lstrlenW (lpString="lmhosts") returned 7 [0107.911] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0107.911] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0107.911] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0107.911] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0107.911] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0107.911] lstrlenW (lpString="MMCSS") returned 5 [0107.911] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0107.911] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0107.911] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0107.911] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0107.911] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0107.911] lstrlenW (lpString="MpsSvc") returned 6 [0107.911] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0107.911] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0107.911] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0107.911] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0107.911] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0107.911] lstrlenW (lpString="Netman") returned 6 [0107.911] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0107.911] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0107.911] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0107.911] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0107.911] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0107.911] lstrlenW (lpString="netprofm") returned 8 [0107.911] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0107.911] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0107.911] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0107.911] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0107.911] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0107.911] lstrlenW (lpString="NlaSvc") returned 6 [0107.911] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0107.911] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0107.911] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0107.911] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0107.911] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0107.912] lstrlenW (lpString="nsi") returned 3 [0107.912] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0107.912] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0107.912] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0107.912] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0107.912] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0107.912] lstrlenW (lpString="PcaSvc") returned 6 [0107.912] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0107.912] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0107.912] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0107.912] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0107.912] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0107.912] lstrlenW (lpString="PlugPlay") returned 8 [0107.912] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0107.912] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0107.912] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0107.912] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0107.912] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0107.912] lstrlenW (lpString="Power") returned 5 [0107.912] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0107.912] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0107.912] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0107.912] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0107.912] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0107.912] lstrlenW (lpString="ProfSvc") returned 7 [0107.912] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0107.912] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0107.912] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0107.912] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0107.912] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0107.912] lstrlenW (lpString="RpcEptMapper") returned 12 [0107.912] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0107.912] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0107.912] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0107.912] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0107.912] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0107.912] lstrlenW (lpString="RpcSs") returned 5 [0107.912] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0107.912] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0107.912] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0107.912] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0107.912] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0107.912] lstrlenW (lpString="SamSs") returned 5 [0107.912] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0107.912] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0107.912] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0107.912] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0107.912] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0107.912] lstrlenW (lpString="Schedule") returned 8 [0107.912] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0107.912] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0107.912] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0107.913] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0107.913] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0107.913] lstrlenW (lpString="SENS") returned 4 [0107.913] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0107.913] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0107.913] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0107.913] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0107.913] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0107.913] lstrlenW (lpString="ShellHWDetection") returned 16 [0107.913] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0107.913] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0107.913] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0107.913] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0107.913] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0107.913] lstrlenW (lpString="Spooler") returned 7 [0107.913] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0107.913] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0107.913] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0107.913] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0107.913] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0107.913] lstrlenW (lpString="sppsvc") returned 6 [0107.913] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="sppsvc") returned -1 [0107.913] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="sppsvc") returned -1 [0107.913] lstrcmpiW (lpString1="sqlwriter", lpString2="sppsvc") returned 1 [0107.913] lstrcmpiW (lpString1="mssqlserver", lpString2="sppsvc") returned -1 [0107.913] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="sppsvc") returned 1 [0107.913] lstrlenW (lpString="SysMain") returned 7 [0107.913] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0107.913] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0107.913] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0107.913] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0107.913] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0107.913] lstrlenW (lpString="Themes") returned 6 [0107.913] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0107.913] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0107.913] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0107.913] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0107.913] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0107.913] lstrlenW (lpString="TrkWks") returned 6 [0107.913] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0107.913] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0107.913] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0107.913] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0107.913] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0107.913] lstrlenW (lpString="UxSms") returned 5 [0107.913] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0107.913] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0107.913] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0107.913] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0107.913] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0107.913] lstrlenW (lpString="W32Time") returned 7 [0107.913] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="W32Time") returned -1 [0107.913] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="W32Time") returned -1 [0107.914] lstrcmpiW (lpString1="sqlwriter", lpString2="W32Time") returned -1 [0107.914] lstrcmpiW (lpString1="mssqlserver", lpString2="W32Time") returned -1 [0107.914] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="W32Time") returned -1 [0107.914] lstrlenW (lpString="WdiServiceHost") returned 14 [0107.914] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0107.914] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0107.914] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0107.914] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0107.914] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0107.914] lstrlenW (lpString="WdiSystemHost") returned 13 [0107.914] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0107.914] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0107.914] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0107.914] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0107.914] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0107.914] lstrlenW (lpString="WinDefend") returned 9 [0107.914] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinDefend") returned -1 [0107.914] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinDefend") returned -1 [0107.914] lstrcmpiW (lpString1="sqlwriter", lpString2="WinDefend") returned -1 [0107.914] lstrcmpiW (lpString1="mssqlserver", lpString2="WinDefend") returned -1 [0107.914] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinDefend") returned -1 [0107.914] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0107.914] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0107.914] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0107.914] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0107.914] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0107.914] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0107.914] lstrlenW (lpString="Winmgmt") returned 7 [0107.914] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0107.914] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0107.914] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0107.914] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0107.914] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0107.914] lstrlenW (lpString="wscsvc") returned 6 [0107.914] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wscsvc") returned -1 [0107.914] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wscsvc") returned -1 [0107.914] lstrcmpiW (lpString1="sqlwriter", lpString2="wscsvc") returned -1 [0107.914] lstrcmpiW (lpString1="mssqlserver", lpString2="wscsvc") returned -1 [0107.914] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wscsvc") returned -1 [0107.914] lstrlenW (lpString="wuauserv") returned 8 [0107.914] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wuauserv") returned -1 [0107.914] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wuauserv") returned -1 [0107.914] lstrcmpiW (lpString1="sqlwriter", lpString2="wuauserv") returned -1 [0107.914] lstrcmpiW (lpString1="mssqlserver", lpString2="wuauserv") returned -1 [0107.914] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wuauserv") returned -1 [0107.914] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x16c [0107.916] Process32FirstW (in: hSnapshot=0x16c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0107.916] Process32NextW (in: hSnapshot=0x16c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0107.916] lstrlenW (lpString="System") returned 6 [0107.916] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0107.916] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0107.916] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0107.916] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0107.917] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0107.917] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0107.917] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0107.917] Process32NextW (in: hSnapshot=0x16c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0107.917] lstrlenW (lpString="smss.exe") returned 8 [0107.917] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0107.917] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0107.917] Process32NextW (in: hSnapshot=0x16c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0107.917] lstrlenW (lpString="csrss.exe") returned 9 [0107.918] Process32NextW (in: hSnapshot=0x16c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0107.918] lstrlenW (lpString="wininit.exe") returned 11 [0107.918] Process32NextW (in: hSnapshot=0x16c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0107.918] lstrlenW (lpString="csrss.exe") returned 9 [0107.918] Process32NextW (in: hSnapshot=0x16c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0107.919] lstrlenW (lpString="winlogon.exe") returned 12 [0107.919] Process32NextW (in: hSnapshot=0x16c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0107.919] lstrlenW (lpString="services.exe") returned 12 [0107.919] Process32NextW (in: hSnapshot=0x16c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0107.920] lstrlenW (lpString="lsass.exe") returned 9 [0107.920] Process32NextW (in: hSnapshot=0x16c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0107.920] lstrlenW (lpString="lsm.exe") returned 7 [0107.920] Process32NextW (in: hSnapshot=0x16c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0107.921] lstrlenW (lpString="svchost.exe") returned 11 [0107.921] Process32NextW (in: hSnapshot=0x16c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0107.921] lstrlenW (lpString="svchost.exe") returned 11 [0107.921] Process32NextW (in: hSnapshot=0x16c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0107.921] lstrlenW (lpString="svchost.exe") returned 11 [0107.921] Process32NextW (in: hSnapshot=0x16c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0107.922] lstrlenW (lpString="svchost.exe") returned 11 [0107.922] Process32NextW (in: hSnapshot=0x16c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x23, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0107.922] lstrlenW (lpString="svchost.exe") returned 11 [0107.922] Process32NextW (in: hSnapshot=0x16c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0107.923] lstrlenW (lpString="audiodg.exe") returned 11 [0107.923] Process32NextW (in: hSnapshot=0x16c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0107.923] lstrlenW (lpString="svchost.exe") returned 11 [0107.923] Process32NextW (in: hSnapshot=0x16c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0107.924] lstrlenW (lpString="svchost.exe") returned 11 [0107.924] Process32NextW (in: hSnapshot=0x16c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0107.924] lstrlenW (lpString="spoolsv.exe") returned 11 [0107.924] Process32NextW (in: hSnapshot=0x16c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0107.925] lstrlenW (lpString="svchost.exe") returned 11 [0107.925] Process32NextW (in: hSnapshot=0x16c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0107.925] lstrlenW (lpString="taskhost.exe") returned 12 [0107.925] Process32NextW (in: hSnapshot=0x16c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x558, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0107.925] lstrlenW (lpString="dwm.exe") returned 7 [0107.925] Process32NextW (in: hSnapshot=0x16c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x54c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0107.926] lstrlenW (lpString="explorer.exe") returned 12 [0107.926] Process32NextW (in: hSnapshot=0x16c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0107.926] lstrlenW (lpString="taskeng.exe") returned 11 [0107.926] Process32NextW (in: hSnapshot=0x16c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0107.927] lstrlenW (lpString="taskhost.exe") returned 12 [0107.927] Process32NextW (in: hSnapshot=0x16c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="watches-vessel-arbitrary.exe")) returned 1 [0107.927] lstrlenW (lpString="watches-vessel-arbitrary.exe") returned 28 [0107.927] Process32NextW (in: hSnapshot=0x16c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="alsopound.exe")) returned 1 [0107.928] lstrlenW (lpString="alsopound.exe") returned 13 [0107.928] Process32NextW (in: hSnapshot=0x16c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x478, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="measuredamsterdamsandwich.exe")) returned 1 [0107.928] lstrlenW (lpString="measuredamsterdamsandwich.exe") returned 29 [0107.928] Process32NextW (in: hSnapshot=0x16c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="ooo_lucy_millions.exe")) returned 1 [0107.928] lstrlenW (lpString="ooo_lucy_millions.exe") returned 21 [0107.928] Process32NextW (in: hSnapshot=0x16c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="appearance.exe")) returned 1 [0107.929] lstrlenW (lpString="appearance.exe") returned 14 [0107.929] Process32NextW (in: hSnapshot=0x16c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="albert.exe")) returned 1 [0107.929] lstrlenW (lpString="albert.exe") returned 10 [0107.929] Process32NextW (in: hSnapshot=0x16c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="implied-enquiries.exe")) returned 1 [0107.930] lstrlenW (lpString="implied-enquiries.exe") returned 21 [0107.930] Process32NextW (in: hSnapshot=0x16c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x72c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="boston_opening.exe")) returned 1 [0107.930] lstrlenW (lpString="boston_opening.exe") returned 18 [0107.930] Process32NextW (in: hSnapshot=0x16c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="portsmouth.exe")) returned 1 [0107.931] lstrlenW (lpString="portsmouth.exe") returned 14 [0107.931] Process32NextW (in: hSnapshot=0x16c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="cameras grew poverty.exe")) returned 1 [0107.931] lstrlenW (lpString="cameras grew poverty.exe") returned 24 [0107.931] Process32NextW (in: hSnapshot=0x16c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="dxrapids.exe")) returned 1 [0107.931] lstrlenW (lpString="dxrapids.exe") returned 12 [0107.931] Process32NextW (in: hSnapshot=0x16c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x33c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="visitors.exe")) returned 1 [0107.932] lstrlenW (lpString="visitors.exe") returned 12 [0107.932] Process32NextW (in: hSnapshot=0x16c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="organisations_officially.exe")) returned 1 [0107.932] lstrlenW (lpString="organisations_officially.exe") returned 28 [0107.932] Process32NextW (in: hSnapshot=0x16c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x61c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="pair.exe")) returned 1 [0107.933] lstrlenW (lpString="pair.exe") returned 8 [0107.933] Process32NextW (in: hSnapshot=0x16c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="gross.exe")) returned 1 [0107.933] lstrlenW (lpString="gross.exe") returned 9 [0107.933] Process32NextW (in: hSnapshot=0x16c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x470, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="viewpicture.exe")) returned 1 [0107.934] lstrlenW (lpString="viewpicture.exe") returned 15 [0107.934] Process32NextW (in: hSnapshot=0x16c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="transmitted.exe")) returned 1 [0107.934] lstrlenW (lpString="transmitted.exe") returned 15 [0107.934] Process32NextW (in: hSnapshot=0x16c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x634, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="sunglassescelebs.exe")) returned 1 [0107.934] lstrlenW (lpString="sunglassescelebs.exe") returned 20 [0107.935] Process32NextW (in: hSnapshot=0x16c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="waiver-issue.exe")) returned 1 [0107.935] lstrlenW (lpString="waiver-issue.exe") returned 16 [0107.935] Process32NextW (in: hSnapshot=0x16c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x808, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="gziprear.exe")) returned 1 [0107.935] lstrlenW (lpString="gziprear.exe") returned 12 [0107.935] Process32NextW (in: hSnapshot=0x16c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x818, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="gregoryletters.exe")) returned 1 [0107.936] lstrlenW (lpString="gregoryletters.exe") returned 18 [0107.936] Process32NextW (in: hSnapshot=0x16c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x828, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="intel-metadata-rich.exe")) returned 1 [0107.936] lstrlenW (lpString="intel-metadata-rich.exe") returned 23 [0107.936] Process32NextW (in: hSnapshot=0x16c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x838, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="cemeteryreconstructiondimension.exe")) returned 1 [0107.937] lstrlenW (lpString="cemeteryreconstructiondimension.exe") returned 35 [0107.937] Process32NextW (in: hSnapshot=0x16c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0107.937] lstrlenW (lpString="svchost.exe") returned 11 [0107.937] Process32NextW (in: hSnapshot=0x16c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0107.938] lstrlenW (lpString="sppsvc.exe") returned 10 [0107.938] Process32NextW (in: hSnapshot=0x16c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xab4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0107.938] lstrlenW (lpString="svchost.exe") returned 11 [0107.938] Process32NextW (in: hSnapshot=0x16c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x9f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="unlikexpc.exe")) returned 1 [0107.938] lstrlenW (lpString="unlikexpc.exe") returned 13 [0107.938] Process32NextW (in: hSnapshot=0x16c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xb58, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0107.939] lstrlenW (lpString="cmd.exe") returned 7 [0107.939] Process32NextW (in: hSnapshot=0x16c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0107.939] lstrlenW (lpString="conhost.exe") returned 11 [0107.939] Process32NextW (in: hSnapshot=0x16c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0107.940] CloseHandle (hObject=0x16c) returned 1 [0107.940] Sleep (dwMilliseconds=0x1f4) [0110.525] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x819b38 [0110.525] EnumServicesStatusExW (in: hSCManager=0x819b38, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x247fa74, lpServicesReturned=0x247fa8c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x247fa74, lpServicesReturned=0x247fa8c, lpResumeHandle=0x0) returned 0 [0110.526] GetLastError () returned 0xea [0110.526] EnumServicesStatusExW (in: hSCManager=0x819b38, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x3ef9118, cbBufSize=0x13a2, pcbBytesNeeded=0x247fa74, lpServicesReturned=0x247fa8c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x3ef9118, pcbBytesNeeded=0x247fa74, lpServicesReturned=0x247fa8c, lpResumeHandle=0x0) returned 1 [0110.526] CloseServiceHandle (hSCObject=0x819b38) returned 1 [0110.526] lstrlenW (lpString="Appinfo") returned 7 [0110.526] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0110.526] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0110.526] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0110.526] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0110.526] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0110.526] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0110.526] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0110.526] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0110.526] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0110.527] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0110.527] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0110.527] lstrlenW (lpString="AudioSrv") returned 8 [0110.527] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0110.527] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0110.527] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0110.527] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0110.527] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0110.527] lstrlenW (lpString="BFE") returned 3 [0110.527] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0110.527] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0110.527] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0110.527] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0110.527] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0110.527] lstrlenW (lpString="CryptSvc") returned 8 [0110.527] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0110.527] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0110.527] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0110.527] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0110.527] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0110.527] lstrlenW (lpString="CscService") returned 10 [0110.527] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0110.527] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0110.527] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0110.527] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0110.527] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0110.527] lstrlenW (lpString="DcomLaunch") returned 10 [0110.527] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0110.527] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0110.527] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0110.527] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0110.527] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0110.527] lstrlenW (lpString="Dhcp") returned 4 [0110.527] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0110.527] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0110.527] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0110.527] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0110.527] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0110.527] lstrlenW (lpString="Dnscache") returned 8 [0110.527] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0110.527] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0110.527] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0110.528] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0110.528] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0110.528] lstrlenW (lpString="DPS") returned 3 [0110.528] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0110.528] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0110.528] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0110.528] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0110.528] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0110.528] lstrlenW (lpString="eventlog") returned 8 [0110.528] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0110.528] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0110.528] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0110.528] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0110.528] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0110.528] lstrlenW (lpString="EventSystem") returned 11 [0110.528] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0110.528] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0110.528] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0110.528] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0110.528] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0110.528] lstrlenW (lpString="FontCache") returned 9 [0110.528] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0110.528] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0110.528] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0110.528] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0110.528] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0110.528] lstrlenW (lpString="gpsvc") returned 5 [0110.528] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0110.528] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0110.528] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0110.528] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0110.528] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0110.528] lstrlenW (lpString="iphlpsvc") returned 8 [0110.528] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0110.528] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0110.528] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0110.528] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0110.528] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0110.528] lstrlenW (lpString="LanmanServer") returned 12 [0110.528] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0110.528] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0110.528] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0110.529] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0110.529] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0110.529] lstrlenW (lpString="LanmanWorkstation") returned 17 [0110.529] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0110.529] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0110.529] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0110.529] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0110.529] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0110.529] lstrlenW (lpString="lmhosts") returned 7 [0110.529] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0110.529] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0110.529] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0110.529] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0110.529] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0110.529] lstrlenW (lpString="MMCSS") returned 5 [0110.529] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0110.529] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0110.529] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0110.529] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0110.529] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0110.529] lstrlenW (lpString="MpsSvc") returned 6 [0110.529] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0110.529] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0110.529] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0110.529] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0110.529] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0110.529] lstrlenW (lpString="Netman") returned 6 [0110.529] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0110.529] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0110.529] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0110.529] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0110.529] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0110.529] lstrlenW (lpString="netprofm") returned 8 [0110.529] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0110.529] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0110.530] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0110.530] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0110.530] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0110.530] lstrlenW (lpString="NlaSvc") returned 6 [0110.530] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0110.530] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0110.530] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0110.530] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0110.530] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0110.530] lstrlenW (lpString="nsi") returned 3 [0110.530] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0110.530] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0110.530] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0110.530] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0110.530] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0110.530] lstrlenW (lpString="PcaSvc") returned 6 [0110.530] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0110.530] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0110.530] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0110.530] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0110.530] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0110.530] lstrlenW (lpString="PlugPlay") returned 8 [0110.530] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0110.530] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0110.530] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0110.530] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0110.530] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0110.530] lstrlenW (lpString="Power") returned 5 [0110.530] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0110.530] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0110.530] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0110.530] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0110.530] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0110.530] lstrlenW (lpString="ProfSvc") returned 7 [0110.530] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0110.530] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0110.530] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0110.530] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0110.530] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0110.530] lstrlenW (lpString="RpcEptMapper") returned 12 [0110.530] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0110.530] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0110.531] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0110.531] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0110.531] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0110.531] lstrlenW (lpString="RpcSs") returned 5 [0110.531] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0110.531] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0110.531] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0110.531] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0110.531] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0110.531] lstrlenW (lpString="SamSs") returned 5 [0110.531] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0110.531] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0110.531] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0110.531] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0110.531] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0110.531] lstrlenW (lpString="Schedule") returned 8 [0110.531] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0110.531] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0110.531] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0110.531] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0110.531] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0110.531] lstrlenW (lpString="SENS") returned 4 [0110.531] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0110.531] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0110.531] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0110.531] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0110.531] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0110.531] lstrlenW (lpString="ShellHWDetection") returned 16 [0110.531] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0110.531] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0110.531] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0110.531] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0110.531] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0110.531] lstrlenW (lpString="Spooler") returned 7 [0110.531] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0110.531] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0110.531] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0110.531] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0110.531] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0110.531] lstrlenW (lpString="sppsvc") returned 6 [0110.531] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="sppsvc") returned -1 [0110.531] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="sppsvc") returned -1 [0110.531] lstrcmpiW (lpString1="sqlwriter", lpString2="sppsvc") returned 1 [0110.532] lstrcmpiW (lpString1="mssqlserver", lpString2="sppsvc") returned -1 [0110.532] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="sppsvc") returned 1 [0110.532] lstrlenW (lpString="SysMain") returned 7 [0110.532] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0110.532] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0110.532] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0110.532] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0110.532] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0110.532] lstrlenW (lpString="Themes") returned 6 [0110.532] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0110.532] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0110.532] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0110.532] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0110.532] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0110.532] lstrlenW (lpString="TrkWks") returned 6 [0110.532] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0110.532] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0110.532] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0110.532] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0110.532] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0110.532] lstrlenW (lpString="UxSms") returned 5 [0110.532] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0110.532] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0110.532] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0110.532] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0110.532] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0110.532] lstrlenW (lpString="W32Time") returned 7 [0110.532] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="W32Time") returned -1 [0110.532] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="W32Time") returned -1 [0110.532] lstrcmpiW (lpString1="sqlwriter", lpString2="W32Time") returned -1 [0110.532] lstrcmpiW (lpString1="mssqlserver", lpString2="W32Time") returned -1 [0110.532] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="W32Time") returned -1 [0110.532] lstrlenW (lpString="WdiServiceHost") returned 14 [0110.532] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0110.532] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0110.532] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0110.532] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0110.532] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0110.532] lstrlenW (lpString="WdiSystemHost") returned 13 [0110.532] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0110.532] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0110.533] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0110.533] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0110.533] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0110.533] lstrlenW (lpString="WinDefend") returned 9 [0110.533] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinDefend") returned -1 [0110.533] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinDefend") returned -1 [0110.533] lstrcmpiW (lpString1="sqlwriter", lpString2="WinDefend") returned -1 [0110.533] lstrcmpiW (lpString1="mssqlserver", lpString2="WinDefend") returned -1 [0110.533] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinDefend") returned -1 [0110.533] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0110.533] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0110.533] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0110.533] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0110.533] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0110.533] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0110.533] lstrlenW (lpString="Winmgmt") returned 7 [0110.533] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0110.533] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0110.533] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0110.533] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0110.533] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0110.533] lstrlenW (lpString="wscsvc") returned 6 [0110.533] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wscsvc") returned -1 [0110.533] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wscsvc") returned -1 [0110.533] lstrcmpiW (lpString1="sqlwriter", lpString2="wscsvc") returned -1 [0110.533] lstrcmpiW (lpString1="mssqlserver", lpString2="wscsvc") returned -1 [0110.533] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wscsvc") returned -1 [0110.533] lstrlenW (lpString="wuauserv") returned 8 [0110.533] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wuauserv") returned -1 [0110.533] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wuauserv") returned -1 [0110.533] lstrcmpiW (lpString1="sqlwriter", lpString2="wuauserv") returned -1 [0110.533] lstrcmpiW (lpString1="mssqlserver", lpString2="wuauserv") returned -1 [0110.533] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wuauserv") returned -1 [0110.533] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x168 [0110.535] Process32FirstW (in: hSnapshot=0x168, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0110.535] Process32NextW (in: hSnapshot=0x168, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0110.536] lstrlenW (lpString="System") returned 6 [0110.536] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0110.536] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0110.536] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0110.536] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0110.536] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0110.536] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0110.536] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0110.536] Process32NextW (in: hSnapshot=0x168, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0110.536] lstrlenW (lpString="smss.exe") returned 8 [0110.536] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0110.536] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0110.536] Process32NextW (in: hSnapshot=0x168, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0110.537] lstrlenW (lpString="csrss.exe") returned 9 [0110.537] Process32NextW (in: hSnapshot=0x168, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0110.537] lstrlenW (lpString="wininit.exe") returned 11 [0110.537] Process32NextW (in: hSnapshot=0x168, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0110.538] lstrlenW (lpString="csrss.exe") returned 9 [0110.538] Process32NextW (in: hSnapshot=0x168, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0110.538] lstrlenW (lpString="winlogon.exe") returned 12 [0110.538] Process32NextW (in: hSnapshot=0x168, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0110.539] lstrlenW (lpString="services.exe") returned 12 [0110.539] Process32NextW (in: hSnapshot=0x168, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0110.539] lstrlenW (lpString="lsass.exe") returned 9 [0110.539] Process32NextW (in: hSnapshot=0x168, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0110.540] lstrlenW (lpString="lsm.exe") returned 7 [0110.540] Process32NextW (in: hSnapshot=0x168, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0110.540] lstrlenW (lpString="svchost.exe") returned 11 [0110.540] Process32NextW (in: hSnapshot=0x168, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0110.541] lstrlenW (lpString="svchost.exe") returned 11 [0110.541] Process32NextW (in: hSnapshot=0x168, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0110.541] lstrlenW (lpString="svchost.exe") returned 11 [0110.541] Process32NextW (in: hSnapshot=0x168, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0110.542] lstrlenW (lpString="svchost.exe") returned 11 [0110.542] Process32NextW (in: hSnapshot=0x168, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x23, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0110.542] lstrlenW (lpString="svchost.exe") returned 11 [0110.542] Process32NextW (in: hSnapshot=0x168, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0110.543] lstrlenW (lpString="audiodg.exe") returned 11 [0110.543] Process32NextW (in: hSnapshot=0x168, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0110.543] lstrlenW (lpString="svchost.exe") returned 11 [0110.543] Process32NextW (in: hSnapshot=0x168, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0110.544] lstrlenW (lpString="svchost.exe") returned 11 [0110.544] Process32NextW (in: hSnapshot=0x168, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0110.544] lstrlenW (lpString="spoolsv.exe") returned 11 [0110.544] Process32NextW (in: hSnapshot=0x168, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0110.544] lstrlenW (lpString="svchost.exe") returned 11 [0110.545] Process32NextW (in: hSnapshot=0x168, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0110.545] lstrlenW (lpString="taskhost.exe") returned 12 [0110.545] Process32NextW (in: hSnapshot=0x168, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x558, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0110.545] lstrlenW (lpString="dwm.exe") returned 7 [0110.545] Process32NextW (in: hSnapshot=0x168, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x54c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0110.546] lstrlenW (lpString="explorer.exe") returned 12 [0110.546] Process32NextW (in: hSnapshot=0x168, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0110.546] lstrlenW (lpString="taskeng.exe") returned 11 [0110.546] Process32NextW (in: hSnapshot=0x168, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0110.547] lstrlenW (lpString="taskhost.exe") returned 12 [0110.547] Process32NextW (in: hSnapshot=0x168, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="watches-vessel-arbitrary.exe")) returned 1 [0110.547] lstrlenW (lpString="watches-vessel-arbitrary.exe") returned 28 [0110.547] Process32NextW (in: hSnapshot=0x168, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="alsopound.exe")) returned 1 [0110.548] lstrlenW (lpString="alsopound.exe") returned 13 [0110.548] Process32NextW (in: hSnapshot=0x168, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x478, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="measuredamsterdamsandwich.exe")) returned 1 [0110.548] lstrlenW (lpString="measuredamsterdamsandwich.exe") returned 29 [0110.548] Process32NextW (in: hSnapshot=0x168, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="ooo_lucy_millions.exe")) returned 1 [0110.549] lstrlenW (lpString="ooo_lucy_millions.exe") returned 21 [0110.549] Process32NextW (in: hSnapshot=0x168, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="appearance.exe")) returned 1 [0110.549] lstrlenW (lpString="appearance.exe") returned 14 [0110.549] Process32NextW (in: hSnapshot=0x168, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="albert.exe")) returned 1 [0110.550] lstrlenW (lpString="albert.exe") returned 10 [0110.550] Process32NextW (in: hSnapshot=0x168, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="implied-enquiries.exe")) returned 1 [0110.550] lstrlenW (lpString="implied-enquiries.exe") returned 21 [0110.550] Process32NextW (in: hSnapshot=0x168, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x72c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="boston_opening.exe")) returned 1 [0110.551] lstrlenW (lpString="boston_opening.exe") returned 18 [0110.551] Process32NextW (in: hSnapshot=0x168, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="portsmouth.exe")) returned 1 [0110.551] lstrlenW (lpString="portsmouth.exe") returned 14 [0110.551] Process32NextW (in: hSnapshot=0x168, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="cameras grew poverty.exe")) returned 1 [0110.552] lstrlenW (lpString="cameras grew poverty.exe") returned 24 [0110.552] Process32NextW (in: hSnapshot=0x168, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="dxrapids.exe")) returned 1 [0110.552] lstrlenW (lpString="dxrapids.exe") returned 12 [0110.552] Process32NextW (in: hSnapshot=0x168, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x33c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="visitors.exe")) returned 1 [0110.552] lstrlenW (lpString="visitors.exe") returned 12 [0110.552] Process32NextW (in: hSnapshot=0x168, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="organisations_officially.exe")) returned 1 [0110.553] lstrlenW (lpString="organisations_officially.exe") returned 28 [0110.553] Process32NextW (in: hSnapshot=0x168, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x61c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="pair.exe")) returned 1 [0110.553] lstrlenW (lpString="pair.exe") returned 8 [0110.553] Process32NextW (in: hSnapshot=0x168, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="gross.exe")) returned 1 [0110.554] lstrlenW (lpString="gross.exe") returned 9 [0110.554] Process32NextW (in: hSnapshot=0x168, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x470, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="viewpicture.exe")) returned 1 [0110.554] lstrlenW (lpString="viewpicture.exe") returned 15 [0110.554] Process32NextW (in: hSnapshot=0x168, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="transmitted.exe")) returned 1 [0110.555] lstrlenW (lpString="transmitted.exe") returned 15 [0110.555] Process32NextW (in: hSnapshot=0x168, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x634, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="sunglassescelebs.exe")) returned 1 [0110.555] lstrlenW (lpString="sunglassescelebs.exe") returned 20 [0110.555] Process32NextW (in: hSnapshot=0x168, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="waiver-issue.exe")) returned 1 [0110.556] lstrlenW (lpString="waiver-issue.exe") returned 16 [0110.556] Process32NextW (in: hSnapshot=0x168, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x808, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="gziprear.exe")) returned 1 [0110.556] lstrlenW (lpString="gziprear.exe") returned 12 [0110.556] Process32NextW (in: hSnapshot=0x168, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x818, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="gregoryletters.exe")) returned 1 [0110.557] lstrlenW (lpString="gregoryletters.exe") returned 18 [0110.557] Process32NextW (in: hSnapshot=0x168, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x828, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="intel-metadata-rich.exe")) returned 1 [0110.557] lstrlenW (lpString="intel-metadata-rich.exe") returned 23 [0110.557] Process32NextW (in: hSnapshot=0x168, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x838, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="cemeteryreconstructiondimension.exe")) returned 1 [0110.558] lstrlenW (lpString="cemeteryreconstructiondimension.exe") returned 35 [0110.558] Process32NextW (in: hSnapshot=0x168, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0110.558] lstrlenW (lpString="svchost.exe") returned 11 [0110.558] Process32NextW (in: hSnapshot=0x168, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0110.558] lstrlenW (lpString="sppsvc.exe") returned 10 [0110.559] Process32NextW (in: hSnapshot=0x168, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xab4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0110.559] lstrlenW (lpString="svchost.exe") returned 11 [0110.559] Process32NextW (in: hSnapshot=0x168, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x9f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="unlikexpc.exe")) returned 1 [0110.559] lstrlenW (lpString="unlikexpc.exe") returned 13 [0110.559] Process32NextW (in: hSnapshot=0x168, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xb58, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0110.560] lstrlenW (lpString="cmd.exe") returned 7 [0110.791] Process32NextW (in: hSnapshot=0x168, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0110.792] lstrlenW (lpString="conhost.exe") returned 11 [0110.792] Process32NextW (in: hSnapshot=0x168, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbcc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xb74, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 1 [0110.793] lstrlenW (lpString="mode.com") returned 8 [0110.793] Process32NextW (in: hSnapshot=0x168, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbcc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xb74, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 0 [0110.793] CloseHandle (hObject=0x168) returned 1 [0110.793] Sleep (dwMilliseconds=0x1f4) [0111.683] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x819f20 [0111.684] EnumServicesStatusExW (in: hSCManager=0x819f20, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x247fa74, lpServicesReturned=0x247fa8c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x247fa74, lpServicesReturned=0x247fa8c, lpResumeHandle=0x0) returned 0 [0111.684] GetLastError () returned 0xea [0111.684] EnumServicesStatusExW (in: hSCManager=0x819f20, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x815298, cbBufSize=0x13a2, pcbBytesNeeded=0x247fa74, lpServicesReturned=0x247fa8c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x815298, pcbBytesNeeded=0x247fa74, lpServicesReturned=0x247fa8c, lpResumeHandle=0x0) returned 1 [0111.684] CloseServiceHandle (hSCObject=0x819f20) returned 1 [0111.685] lstrlenW (lpString="Appinfo") returned 7 [0111.685] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0111.685] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0111.685] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0111.685] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0111.685] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0111.685] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0111.685] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0111.685] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0111.685] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0111.685] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0111.685] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0111.685] lstrlenW (lpString="AudioSrv") returned 8 [0111.685] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0111.685] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0111.685] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0111.685] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0111.685] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0111.685] lstrlenW (lpString="BFE") returned 3 [0111.685] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0111.685] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0111.685] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0111.685] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0111.685] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0111.685] lstrlenW (lpString="CryptSvc") returned 8 [0111.685] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0111.685] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0111.685] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0111.685] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0111.685] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0111.686] lstrlenW (lpString="CscService") returned 10 [0111.686] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0111.686] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0111.686] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0111.686] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0111.686] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0111.686] lstrlenW (lpString="DcomLaunch") returned 10 [0111.686] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0111.686] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0111.686] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0111.686] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0111.686] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0111.686] lstrlenW (lpString="Dhcp") returned 4 [0111.686] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0111.686] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0111.686] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0111.686] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0111.686] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0111.686] lstrlenW (lpString="Dnscache") returned 8 [0111.686] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0111.686] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0111.686] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0111.686] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0111.686] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0111.686] lstrlenW (lpString="DPS") returned 3 [0111.686] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0111.686] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0111.686] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0111.686] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0111.686] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0111.686] lstrlenW (lpString="eventlog") returned 8 [0111.686] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0111.686] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0111.686] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0111.687] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0111.687] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0111.687] lstrlenW (lpString="EventSystem") returned 11 [0111.687] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0111.687] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0111.687] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0111.687] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0111.687] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0111.687] lstrlenW (lpString="FontCache") returned 9 [0111.687] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0111.687] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0111.687] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0111.687] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0111.687] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0111.687] lstrlenW (lpString="gpsvc") returned 5 [0111.687] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0111.687] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0111.687] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0111.687] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0111.687] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0111.687] lstrlenW (lpString="iphlpsvc") returned 8 [0111.687] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0111.687] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0111.687] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0111.687] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0111.687] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0111.687] lstrlenW (lpString="LanmanServer") returned 12 [0111.687] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0111.687] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0111.687] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0111.687] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0111.687] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0111.687] lstrlenW (lpString="LanmanWorkstation") returned 17 [0111.687] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0111.688] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0111.688] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0111.688] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0111.688] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0111.688] lstrlenW (lpString="lmhosts") returned 7 [0111.688] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0111.688] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0111.688] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0111.688] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0111.688] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0111.688] lstrlenW (lpString="MMCSS") returned 5 [0111.688] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0111.688] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0111.688] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0111.688] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0111.688] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0111.688] lstrlenW (lpString="MpsSvc") returned 6 [0111.688] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0111.688] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0111.688] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0111.688] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0111.688] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0111.688] lstrlenW (lpString="Netman") returned 6 [0111.688] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0111.688] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0111.688] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0111.688] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0111.688] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0111.688] lstrlenW (lpString="netprofm") returned 8 [0111.688] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0111.688] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0111.688] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0111.688] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0111.688] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0111.689] lstrlenW (lpString="NlaSvc") returned 6 [0111.689] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0111.689] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0111.689] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0111.689] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0111.689] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0111.689] lstrlenW (lpString="nsi") returned 3 [0111.689] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0111.689] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0111.689] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0111.689] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0111.689] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0111.689] lstrlenW (lpString="PcaSvc") returned 6 [0111.689] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0111.689] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0111.689] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0111.689] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0111.689] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0111.689] lstrlenW (lpString="PlugPlay") returned 8 [0111.689] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0111.689] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0111.689] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0111.689] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0111.689] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0111.689] lstrlenW (lpString="Power") returned 5 [0111.689] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0111.689] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0111.689] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0111.689] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0111.689] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0111.689] lstrlenW (lpString="ProfSvc") returned 7 [0111.689] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0111.689] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0111.689] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0111.689] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0111.690] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0111.690] lstrlenW (lpString="RpcEptMapper") returned 12 [0111.690] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0111.690] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0111.690] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0111.690] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0111.690] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0111.690] lstrlenW (lpString="RpcSs") returned 5 [0111.690] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0111.690] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0111.690] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0111.690] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0111.690] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0111.690] lstrlenW (lpString="SamSs") returned 5 [0111.690] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0111.690] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0111.690] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0111.690] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0111.690] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0111.690] lstrlenW (lpString="Schedule") returned 8 [0111.690] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0111.690] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0111.690] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0111.690] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0111.690] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0111.690] lstrlenW (lpString="SENS") returned 4 [0111.690] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0111.690] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0111.690] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0111.690] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0111.690] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0111.690] lstrlenW (lpString="ShellHWDetection") returned 16 [0111.690] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0111.690] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0111.691] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0111.691] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0111.691] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0111.691] lstrlenW (lpString="Spooler") returned 7 [0111.691] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0111.691] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0111.691] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0111.691] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0111.691] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0111.691] lstrlenW (lpString="sppsvc") returned 6 [0111.691] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="sppsvc") returned -1 [0111.691] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="sppsvc") returned -1 [0111.691] lstrcmpiW (lpString1="sqlwriter", lpString2="sppsvc") returned 1 [0111.691] lstrcmpiW (lpString1="mssqlserver", lpString2="sppsvc") returned -1 [0111.691] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="sppsvc") returned 1 [0111.691] lstrlenW (lpString="SysMain") returned 7 [0111.691] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0111.691] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0111.691] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0111.691] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0111.691] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0111.691] lstrlenW (lpString="Themes") returned 6 [0111.691] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0111.691] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0111.691] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0111.691] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0111.691] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0111.691] lstrlenW (lpString="TrkWks") returned 6 [0111.691] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0111.691] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0111.691] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0111.691] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0111.691] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0111.691] lstrlenW (lpString="UxSms") returned 5 [0111.691] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0111.692] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0111.692] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0111.692] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0111.692] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0111.692] lstrlenW (lpString="W32Time") returned 7 [0111.692] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="W32Time") returned -1 [0111.692] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="W32Time") returned -1 [0111.692] lstrcmpiW (lpString1="sqlwriter", lpString2="W32Time") returned -1 [0111.692] lstrcmpiW (lpString1="mssqlserver", lpString2="W32Time") returned -1 [0111.692] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="W32Time") returned -1 [0111.692] lstrlenW (lpString="WdiServiceHost") returned 14 [0111.692] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0111.692] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0111.692] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0111.692] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0111.692] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0111.692] lstrlenW (lpString="WdiSystemHost") returned 13 [0111.692] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0111.692] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0111.692] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0111.692] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0111.692] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0111.692] lstrlenW (lpString="WinDefend") returned 9 [0111.692] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinDefend") returned -1 [0111.692] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinDefend") returned -1 [0111.692] lstrcmpiW (lpString1="sqlwriter", lpString2="WinDefend") returned -1 [0111.692] lstrcmpiW (lpString1="mssqlserver", lpString2="WinDefend") returned -1 [0111.692] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinDefend") returned -1 [0111.692] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0111.692] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0111.692] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0111.692] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0111.692] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0111.692] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0111.693] lstrlenW (lpString="Winmgmt") returned 7 [0111.693] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0111.693] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0111.693] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0111.693] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0111.693] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0111.693] lstrlenW (lpString="wscsvc") returned 6 [0111.693] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wscsvc") returned -1 [0111.693] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wscsvc") returned -1 [0111.693] lstrcmpiW (lpString1="sqlwriter", lpString2="wscsvc") returned -1 [0111.693] lstrcmpiW (lpString1="mssqlserver", lpString2="wscsvc") returned -1 [0111.693] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wscsvc") returned -1 [0111.693] lstrlenW (lpString="wuauserv") returned 8 [0111.693] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wuauserv") returned -1 [0111.693] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wuauserv") returned -1 [0111.693] lstrcmpiW (lpString1="sqlwriter", lpString2="wuauserv") returned -1 [0111.693] lstrcmpiW (lpString1="mssqlserver", lpString2="wuauserv") returned -1 [0111.693] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wuauserv") returned -1 [0111.693] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1d8 [0111.695] Process32FirstW (in: hSnapshot=0x1d8, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0111.695] Process32NextW (in: hSnapshot=0x1d8, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0111.696] lstrlenW (lpString="System") returned 6 [0111.696] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0111.696] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0111.696] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0111.696] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0111.696] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0111.696] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0111.696] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0111.696] Process32NextW (in: hSnapshot=0x1d8, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0111.697] lstrlenW (lpString="smss.exe") returned 8 [0111.697] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0111.697] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0111.697] Process32NextW (in: hSnapshot=0x1d8, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0111.697] lstrlenW (lpString="csrss.exe") returned 9 [0111.698] Process32NextW (in: hSnapshot=0x1d8, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0111.698] lstrlenW (lpString="wininit.exe") returned 11 [0111.698] Process32NextW (in: hSnapshot=0x1d8, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0111.699] lstrlenW (lpString="csrss.exe") returned 9 [0111.699] Process32NextW (in: hSnapshot=0x1d8, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0111.699] lstrlenW (lpString="winlogon.exe") returned 12 [0111.699] Process32NextW (in: hSnapshot=0x1d8, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0111.700] lstrlenW (lpString="services.exe") returned 12 [0111.700] Process32NextW (in: hSnapshot=0x1d8, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0111.700] lstrlenW (lpString="lsass.exe") returned 9 [0111.700] Process32NextW (in: hSnapshot=0x1d8, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0111.701] lstrlenW (lpString="lsm.exe") returned 7 [0111.701] Process32NextW (in: hSnapshot=0x1d8, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0111.701] lstrlenW (lpString="svchost.exe") returned 11 [0111.701] Process32NextW (in: hSnapshot=0x1d8, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0111.701] lstrlenW (lpString="svchost.exe") returned 11 [0111.702] Process32NextW (in: hSnapshot=0x1d8, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0111.702] lstrlenW (lpString="svchost.exe") returned 11 [0111.702] Process32NextW (in: hSnapshot=0x1d8, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0111.702] lstrlenW (lpString="svchost.exe") returned 11 [0111.702] Process32NextW (in: hSnapshot=0x1d8, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x23, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0111.703] lstrlenW (lpString="svchost.exe") returned 11 [0111.703] Process32NextW (in: hSnapshot=0x1d8, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0111.703] lstrlenW (lpString="audiodg.exe") returned 11 [0111.703] Process32NextW (in: hSnapshot=0x1d8, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0111.704] lstrlenW (lpString="svchost.exe") returned 11 [0111.704] Process32NextW (in: hSnapshot=0x1d8, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0111.704] lstrlenW (lpString="svchost.exe") returned 11 [0111.704] Process32NextW (in: hSnapshot=0x1d8, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0111.705] lstrlenW (lpString="spoolsv.exe") returned 11 [0111.705] Process32NextW (in: hSnapshot=0x1d8, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0111.705] lstrlenW (lpString="svchost.exe") returned 11 [0111.705] Process32NextW (in: hSnapshot=0x1d8, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0111.705] lstrlenW (lpString="taskhost.exe") returned 12 [0111.705] Process32NextW (in: hSnapshot=0x1d8, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x558, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0111.706] lstrlenW (lpString="dwm.exe") returned 7 [0111.706] Process32NextW (in: hSnapshot=0x1d8, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x54c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0111.706] lstrlenW (lpString="explorer.exe") returned 12 [0111.706] Process32NextW (in: hSnapshot=0x1d8, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0111.707] lstrlenW (lpString="taskeng.exe") returned 11 [0111.707] Process32NextW (in: hSnapshot=0x1d8, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0111.707] lstrlenW (lpString="taskhost.exe") returned 12 [0111.707] Process32NextW (in: hSnapshot=0x1d8, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="watches-vessel-arbitrary.exe")) returned 1 [0111.708] lstrlenW (lpString="watches-vessel-arbitrary.exe") returned 28 [0111.708] Process32NextW (in: hSnapshot=0x1d8, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="alsopound.exe")) returned 1 [0111.708] lstrlenW (lpString="alsopound.exe") returned 13 [0111.708] Process32NextW (in: hSnapshot=0x1d8, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x478, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="measuredamsterdamsandwich.exe")) returned 1 [0111.708] lstrlenW (lpString="measuredamsterdamsandwich.exe") returned 29 [0111.708] Process32NextW (in: hSnapshot=0x1d8, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="ooo_lucy_millions.exe")) returned 1 [0111.709] lstrlenW (lpString="ooo_lucy_millions.exe") returned 21 [0111.709] Process32NextW (in: hSnapshot=0x1d8, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="appearance.exe")) returned 1 [0111.709] lstrlenW (lpString="appearance.exe") returned 14 [0111.709] Process32NextW (in: hSnapshot=0x1d8, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="albert.exe")) returned 1 [0111.710] lstrlenW (lpString="albert.exe") returned 10 [0111.710] Process32NextW (in: hSnapshot=0x1d8, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="implied-enquiries.exe")) returned 1 [0111.710] lstrlenW (lpString="implied-enquiries.exe") returned 21 [0111.710] Process32NextW (in: hSnapshot=0x1d8, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x72c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="boston_opening.exe")) returned 1 [0111.711] lstrlenW (lpString="boston_opening.exe") returned 18 [0111.711] Process32NextW (in: hSnapshot=0x1d8, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="portsmouth.exe")) returned 1 [0111.711] lstrlenW (lpString="portsmouth.exe") returned 14 [0111.711] Process32NextW (in: hSnapshot=0x1d8, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="cameras grew poverty.exe")) returned 1 [0111.712] lstrlenW (lpString="cameras grew poverty.exe") returned 24 [0111.712] Process32NextW (in: hSnapshot=0x1d8, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="dxrapids.exe")) returned 1 [0111.712] lstrlenW (lpString="dxrapids.exe") returned 12 [0111.712] Process32NextW (in: hSnapshot=0x1d8, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x33c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="visitors.exe")) returned 1 [0111.712] lstrlenW (lpString="visitors.exe") returned 12 [0111.713] Process32NextW (in: hSnapshot=0x1d8, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="organisations_officially.exe")) returned 1 [0111.713] lstrlenW (lpString="organisations_officially.exe") returned 28 [0111.713] Process32NextW (in: hSnapshot=0x1d8, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x61c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="pair.exe")) returned 1 [0111.713] lstrlenW (lpString="pair.exe") returned 8 [0111.713] Process32NextW (in: hSnapshot=0x1d8, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="gross.exe")) returned 1 [0111.714] lstrlenW (lpString="gross.exe") returned 9 [0111.714] Process32NextW (in: hSnapshot=0x1d8, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x470, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="viewpicture.exe")) returned 1 [0111.714] lstrlenW (lpString="viewpicture.exe") returned 15 [0111.714] Process32NextW (in: hSnapshot=0x1d8, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="transmitted.exe")) returned 1 [0111.715] lstrlenW (lpString="transmitted.exe") returned 15 [0111.715] Process32NextW (in: hSnapshot=0x1d8, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x634, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="sunglassescelebs.exe")) returned 1 [0111.715] lstrlenW (lpString="sunglassescelebs.exe") returned 20 [0111.715] Process32NextW (in: hSnapshot=0x1d8, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="waiver-issue.exe")) returned 1 [0111.716] lstrlenW (lpString="waiver-issue.exe") returned 16 [0111.716] Process32NextW (in: hSnapshot=0x1d8, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x808, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="gziprear.exe")) returned 1 [0111.716] lstrlenW (lpString="gziprear.exe") returned 12 [0111.716] Process32NextW (in: hSnapshot=0x1d8, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x818, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="gregoryletters.exe")) returned 1 [0111.716] lstrlenW (lpString="gregoryletters.exe") returned 18 [0111.716] Process32NextW (in: hSnapshot=0x1d8, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x828, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="intel-metadata-rich.exe")) returned 1 [0111.717] lstrlenW (lpString="intel-metadata-rich.exe") returned 23 [0111.717] Process32NextW (in: hSnapshot=0x1d8, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x838, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="cemeteryreconstructiondimension.exe")) returned 1 [0111.717] lstrlenW (lpString="cemeteryreconstructiondimension.exe") returned 35 [0111.717] Process32NextW (in: hSnapshot=0x1d8, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0111.718] lstrlenW (lpString="svchost.exe") returned 11 [0111.718] Process32NextW (in: hSnapshot=0x1d8, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0111.718] lstrlenW (lpString="sppsvc.exe") returned 10 [0111.718] Process32NextW (in: hSnapshot=0x1d8, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xab4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0111.719] lstrlenW (lpString="svchost.exe") returned 11 [0111.719] Process32NextW (in: hSnapshot=0x1d8, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x9f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="unlikexpc.exe")) returned 1 [0111.719] lstrlenW (lpString="unlikexpc.exe") returned 13 [0111.719] Process32NextW (in: hSnapshot=0x1d8, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xb58, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0111.720] lstrlenW (lpString="cmd.exe") returned 7 [0111.720] Process32NextW (in: hSnapshot=0x1d8, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0111.720] lstrlenW (lpString="conhost.exe") returned 11 [0111.720] Process32NextW (in: hSnapshot=0x1d8, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbcc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xb74, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 1 [0111.720] lstrlenW (lpString="mode.com") returned 8 [0111.721] Process32NextW (in: hSnapshot=0x1d8, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbcc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xb74, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 0 [0111.721] CloseHandle (hObject=0x1d8) returned 1 [0111.721] Sleep (dwMilliseconds=0x1f4) [0112.329] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x819ef8 [0112.329] EnumServicesStatusExW (in: hSCManager=0x819ef8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x247fa74, lpServicesReturned=0x247fa8c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x247fa74, lpServicesReturned=0x247fa8c, lpResumeHandle=0x0) returned 0 [0112.330] GetLastError () returned 0xea [0112.330] EnumServicesStatusExW (in: hSCManager=0x819ef8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x815298, cbBufSize=0x13a2, pcbBytesNeeded=0x247fa74, lpServicesReturned=0x247fa8c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x815298, pcbBytesNeeded=0x247fa74, lpServicesReturned=0x247fa8c, lpResumeHandle=0x0) returned 1 [0112.330] CloseServiceHandle (hSCObject=0x819ef8) returned 1 [0112.330] lstrlenW (lpString="Appinfo") returned 7 [0112.330] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0112.330] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0112.330] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0112.330] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0112.330] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0112.330] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0112.330] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0112.330] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0112.330] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0112.330] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0112.330] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0112.330] lstrlenW (lpString="AudioSrv") returned 8 [0112.330] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0112.330] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0112.330] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0112.330] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0112.330] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0112.330] lstrlenW (lpString="BFE") returned 3 [0112.331] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0112.331] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0112.331] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0112.331] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0112.331] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0112.331] lstrlenW (lpString="CryptSvc") returned 8 [0112.331] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0112.331] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0112.331] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0112.331] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0112.331] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0112.331] lstrlenW (lpString="CscService") returned 10 [0112.331] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0112.331] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0112.331] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0112.331] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0112.331] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0112.331] lstrlenW (lpString="DcomLaunch") returned 10 [0112.331] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0112.331] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0112.331] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0112.331] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0112.331] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0112.331] lstrlenW (lpString="Dhcp") returned 4 [0112.331] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0112.331] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0112.331] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0112.331] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0112.331] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0112.331] lstrlenW (lpString="Dnscache") returned 8 [0112.331] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0112.331] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0112.331] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0112.331] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0112.331] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0112.331] lstrlenW (lpString="DPS") returned 3 [0112.331] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0112.331] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0112.331] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0112.331] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0112.331] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0112.331] lstrlenW (lpString="eventlog") returned 8 [0112.331] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0112.331] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0112.331] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0112.331] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0112.331] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0112.331] lstrlenW (lpString="EventSystem") returned 11 [0112.331] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0112.332] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0112.332] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0112.332] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0112.332] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0112.332] lstrlenW (lpString="FontCache") returned 9 [0112.332] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0112.332] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0112.332] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0112.332] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0112.332] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0112.332] lstrlenW (lpString="gpsvc") returned 5 [0112.332] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0112.332] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0112.332] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0112.332] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0112.332] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0112.332] lstrlenW (lpString="iphlpsvc") returned 8 [0112.332] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0112.332] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0112.332] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0112.332] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0112.332] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0112.332] lstrlenW (lpString="LanmanServer") returned 12 [0112.332] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0112.332] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0112.332] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0112.332] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0112.332] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0112.332] lstrlenW (lpString="LanmanWorkstation") returned 17 [0112.332] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0112.332] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0112.332] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0112.332] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0112.332] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0112.332] lstrlenW (lpString="lmhosts") returned 7 [0112.332] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0112.332] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0112.332] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0112.332] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0112.332] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0112.332] lstrlenW (lpString="MMCSS") returned 5 [0112.332] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0112.332] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0112.332] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0112.332] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0112.332] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0112.332] lstrlenW (lpString="MpsSvc") returned 6 [0112.333] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0112.333] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0112.333] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0112.333] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0112.333] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0112.333] lstrlenW (lpString="Netman") returned 6 [0112.333] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0112.333] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0112.333] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0112.333] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0112.333] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0112.333] lstrlenW (lpString="netprofm") returned 8 [0112.333] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0112.333] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0112.333] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0112.333] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0112.333] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0112.333] lstrlenW (lpString="NlaSvc") returned 6 [0112.333] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0112.333] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0112.333] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0112.333] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0112.333] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0112.333] lstrlenW (lpString="nsi") returned 3 [0112.333] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0112.333] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0112.333] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0112.333] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0112.333] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0112.333] lstrlenW (lpString="PcaSvc") returned 6 [0112.333] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0112.333] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0112.333] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0112.333] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0112.333] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0112.333] lstrlenW (lpString="PlugPlay") returned 8 [0112.333] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0112.333] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0112.333] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0112.333] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0112.333] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0112.333] lstrlenW (lpString="Power") returned 5 [0112.333] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0112.333] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0112.333] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0112.333] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0112.333] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0112.333] lstrlenW (lpString="ProfSvc") returned 7 [0112.333] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0112.334] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0112.334] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0112.334] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0112.334] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0112.334] lstrlenW (lpString="RpcEptMapper") returned 12 [0112.334] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0112.334] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0112.334] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0112.334] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0112.334] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0112.334] lstrlenW (lpString="RpcSs") returned 5 [0112.334] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0112.334] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0112.334] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0112.334] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0112.334] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0112.334] lstrlenW (lpString="SamSs") returned 5 [0112.334] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0112.334] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0112.334] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0112.334] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0112.334] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0112.334] lstrlenW (lpString="Schedule") returned 8 [0112.334] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0112.334] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0112.334] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0112.334] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0112.334] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0112.334] lstrlenW (lpString="SENS") returned 4 [0112.334] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0112.334] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0112.334] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0112.334] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0112.334] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0112.334] lstrlenW (lpString="ShellHWDetection") returned 16 [0112.334] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0112.334] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0112.334] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0112.334] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0112.334] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0112.334] lstrlenW (lpString="Spooler") returned 7 [0112.334] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0112.334] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0112.334] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0112.334] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0112.334] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0112.334] lstrlenW (lpString="sppsvc") returned 6 [0112.334] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="sppsvc") returned -1 [0112.334] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="sppsvc") returned -1 [0112.335] lstrcmpiW (lpString1="sqlwriter", lpString2="sppsvc") returned 1 [0112.335] lstrcmpiW (lpString1="mssqlserver", lpString2="sppsvc") returned -1 [0112.335] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="sppsvc") returned 1 [0112.335] lstrlenW (lpString="SysMain") returned 7 [0112.335] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0112.335] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0112.335] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0112.335] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0112.335] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0112.335] lstrlenW (lpString="Themes") returned 6 [0112.335] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0112.335] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0112.335] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0112.335] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0112.335] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0112.335] lstrlenW (lpString="TrkWks") returned 6 [0112.335] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0112.335] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0112.335] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0112.335] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0112.335] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0112.335] lstrlenW (lpString="UxSms") returned 5 [0112.335] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0112.335] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0112.335] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0112.335] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0112.335] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0112.335] lstrlenW (lpString="W32Time") returned 7 [0112.335] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="W32Time") returned -1 [0112.335] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="W32Time") returned -1 [0112.335] lstrcmpiW (lpString1="sqlwriter", lpString2="W32Time") returned -1 [0112.335] lstrcmpiW (lpString1="mssqlserver", lpString2="W32Time") returned -1 [0112.335] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="W32Time") returned -1 [0112.335] lstrlenW (lpString="WdiServiceHost") returned 14 [0112.335] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0112.335] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0112.335] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0112.335] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0112.335] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0112.335] lstrlenW (lpString="WdiSystemHost") returned 13 [0112.335] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0112.335] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0112.335] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0112.335] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0112.335] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0112.335] lstrlenW (lpString="WinDefend") returned 9 [0112.335] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinDefend") returned -1 [0112.335] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinDefend") returned -1 [0112.336] lstrcmpiW (lpString1="sqlwriter", lpString2="WinDefend") returned -1 [0112.336] lstrcmpiW (lpString1="mssqlserver", lpString2="WinDefend") returned -1 [0112.336] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinDefend") returned -1 [0112.336] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0112.336] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0112.336] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0112.336] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0112.336] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0112.336] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0112.336] lstrlenW (lpString="Winmgmt") returned 7 [0112.336] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0112.336] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0112.336] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0112.336] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0112.336] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0112.336] lstrlenW (lpString="wscsvc") returned 6 [0112.336] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wscsvc") returned -1 [0112.336] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wscsvc") returned -1 [0112.336] lstrcmpiW (lpString1="sqlwriter", lpString2="wscsvc") returned -1 [0112.336] lstrcmpiW (lpString1="mssqlserver", lpString2="wscsvc") returned -1 [0112.336] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wscsvc") returned -1 [0112.336] lstrlenW (lpString="wuauserv") returned 8 [0112.336] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wuauserv") returned -1 [0112.336] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wuauserv") returned -1 [0112.336] lstrcmpiW (lpString1="sqlwriter", lpString2="wuauserv") returned -1 [0112.336] lstrcmpiW (lpString1="mssqlserver", lpString2="wuauserv") returned -1 [0112.336] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wuauserv") returned -1 [0112.336] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1ec [0112.338] Process32FirstW (in: hSnapshot=0x1ec, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0112.339] Process32NextW (in: hSnapshot=0x1ec, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0112.339] lstrlenW (lpString="System") returned 6 [0112.339] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0112.339] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0112.339] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0112.339] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0112.339] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0112.339] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0112.339] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0112.339] Process32NextW (in: hSnapshot=0x1ec, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0112.340] lstrlenW (lpString="smss.exe") returned 8 [0112.340] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0112.340] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0112.340] Process32NextW (in: hSnapshot=0x1ec, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0112.340] lstrlenW (lpString="csrss.exe") returned 9 [0112.340] Process32NextW (in: hSnapshot=0x1ec, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0112.341] lstrlenW (lpString="wininit.exe") returned 11 [0112.341] Process32NextW (in: hSnapshot=0x1ec, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0112.341] lstrlenW (lpString="csrss.exe") returned 9 [0112.341] Process32NextW (in: hSnapshot=0x1ec, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0112.342] lstrlenW (lpString="winlogon.exe") returned 12 [0112.342] Process32NextW (in: hSnapshot=0x1ec, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0112.342] lstrlenW (lpString="services.exe") returned 12 [0112.342] Process32NextW (in: hSnapshot=0x1ec, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0112.342] lstrlenW (lpString="lsass.exe") returned 9 [0112.343] Process32NextW (in: hSnapshot=0x1ec, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0112.343] lstrlenW (lpString="lsm.exe") returned 7 [0112.343] Process32NextW (in: hSnapshot=0x1ec, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0112.344] lstrlenW (lpString="svchost.exe") returned 11 [0112.344] Process32NextW (in: hSnapshot=0x1ec, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0112.344] lstrlenW (lpString="svchost.exe") returned 11 [0112.344] Process32NextW (in: hSnapshot=0x1ec, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0112.344] lstrlenW (lpString="svchost.exe") returned 11 [0112.344] Process32NextW (in: hSnapshot=0x1ec, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0112.345] lstrlenW (lpString="svchost.exe") returned 11 [0112.345] Process32NextW (in: hSnapshot=0x1ec, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x23, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0112.345] lstrlenW (lpString="svchost.exe") returned 11 [0112.345] Process32NextW (in: hSnapshot=0x1ec, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0112.346] lstrlenW (lpString="audiodg.exe") returned 11 [0112.346] Process32NextW (in: hSnapshot=0x1ec, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0112.346] lstrlenW (lpString="svchost.exe") returned 11 [0112.346] Process32NextW (in: hSnapshot=0x1ec, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0112.347] lstrlenW (lpString="svchost.exe") returned 11 [0112.347] Process32NextW (in: hSnapshot=0x1ec, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0112.347] lstrlenW (lpString="spoolsv.exe") returned 11 [0112.347] Process32NextW (in: hSnapshot=0x1ec, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0112.347] lstrlenW (lpString="svchost.exe") returned 11 [0112.347] Process32NextW (in: hSnapshot=0x1ec, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0112.348] lstrlenW (lpString="taskhost.exe") returned 12 [0112.348] Process32NextW (in: hSnapshot=0x1ec, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x558, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0112.348] lstrlenW (lpString="dwm.exe") returned 7 [0112.348] Process32NextW (in: hSnapshot=0x1ec, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x54c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0112.349] lstrlenW (lpString="explorer.exe") returned 12 [0112.349] Process32NextW (in: hSnapshot=0x1ec, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0112.349] lstrlenW (lpString="taskeng.exe") returned 11 [0112.349] Process32NextW (in: hSnapshot=0x1ec, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0112.350] lstrlenW (lpString="taskhost.exe") returned 12 [0112.350] Process32NextW (in: hSnapshot=0x1ec, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="watches-vessel-arbitrary.exe")) returned 1 [0112.350] lstrlenW (lpString="watches-vessel-arbitrary.exe") returned 28 [0112.350] Process32NextW (in: hSnapshot=0x1ec, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="alsopound.exe")) returned 1 [0112.350] lstrlenW (lpString="alsopound.exe") returned 13 [0112.350] Process32NextW (in: hSnapshot=0x1ec, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x478, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="measuredamsterdamsandwich.exe")) returned 1 [0112.351] lstrlenW (lpString="measuredamsterdamsandwich.exe") returned 29 [0112.351] Process32NextW (in: hSnapshot=0x1ec, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="ooo_lucy_millions.exe")) returned 1 [0112.351] lstrlenW (lpString="ooo_lucy_millions.exe") returned 21 [0112.351] Process32NextW (in: hSnapshot=0x1ec, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="appearance.exe")) returned 1 [0112.352] lstrlenW (lpString="appearance.exe") returned 14 [0112.352] Process32NextW (in: hSnapshot=0x1ec, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="albert.exe")) returned 1 [0112.352] lstrlenW (lpString="albert.exe") returned 10 [0112.352] Process32NextW (in: hSnapshot=0x1ec, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="implied-enquiries.exe")) returned 1 [0112.353] lstrlenW (lpString="implied-enquiries.exe") returned 21 [0112.353] Process32NextW (in: hSnapshot=0x1ec, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x72c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="boston_opening.exe")) returned 1 [0112.353] lstrlenW (lpString="boston_opening.exe") returned 18 [0112.353] Process32NextW (in: hSnapshot=0x1ec, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="portsmouth.exe")) returned 1 [0112.353] lstrlenW (lpString="portsmouth.exe") returned 14 [0112.354] Process32NextW (in: hSnapshot=0x1ec, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="cameras grew poverty.exe")) returned 1 [0112.354] lstrlenW (lpString="cameras grew poverty.exe") returned 24 [0112.354] Process32NextW (in: hSnapshot=0x1ec, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="dxrapids.exe")) returned 1 [0112.355] lstrlenW (lpString="dxrapids.exe") returned 12 [0112.355] Process32NextW (in: hSnapshot=0x1ec, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x33c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="visitors.exe")) returned 1 [0112.355] lstrlenW (lpString="visitors.exe") returned 12 [0112.355] Process32NextW (in: hSnapshot=0x1ec, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="organisations_officially.exe")) returned 1 [0112.355] lstrlenW (lpString="organisations_officially.exe") returned 28 [0112.355] Process32NextW (in: hSnapshot=0x1ec, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x61c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="pair.exe")) returned 1 [0112.356] lstrlenW (lpString="pair.exe") returned 8 [0112.356] Process32NextW (in: hSnapshot=0x1ec, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="gross.exe")) returned 1 [0112.356] lstrlenW (lpString="gross.exe") returned 9 [0112.356] Process32NextW (in: hSnapshot=0x1ec, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x470, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="viewpicture.exe")) returned 1 [0112.357] lstrlenW (lpString="viewpicture.exe") returned 15 [0112.357] Process32NextW (in: hSnapshot=0x1ec, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="transmitted.exe")) returned 1 [0112.357] lstrlenW (lpString="transmitted.exe") returned 15 [0112.357] Process32NextW (in: hSnapshot=0x1ec, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x634, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="sunglassescelebs.exe")) returned 1 [0112.358] lstrlenW (lpString="sunglassescelebs.exe") returned 20 [0112.358] Process32NextW (in: hSnapshot=0x1ec, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="waiver-issue.exe")) returned 1 [0112.358] lstrlenW (lpString="waiver-issue.exe") returned 16 [0112.358] Process32NextW (in: hSnapshot=0x1ec, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x808, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="gziprear.exe")) returned 1 [0112.358] lstrlenW (lpString="gziprear.exe") returned 12 [0112.359] Process32NextW (in: hSnapshot=0x1ec, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x818, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="gregoryletters.exe")) returned 1 [0112.359] lstrlenW (lpString="gregoryletters.exe") returned 18 [0112.359] Process32NextW (in: hSnapshot=0x1ec, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x828, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="intel-metadata-rich.exe")) returned 1 [0112.359] lstrlenW (lpString="intel-metadata-rich.exe") returned 23 [0112.359] Process32NextW (in: hSnapshot=0x1ec, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x838, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="cemeteryreconstructiondimension.exe")) returned 1 [0112.360] lstrlenW (lpString="cemeteryreconstructiondimension.exe") returned 35 [0112.360] Process32NextW (in: hSnapshot=0x1ec, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0112.360] lstrlenW (lpString="svchost.exe") returned 11 [0112.360] Process32NextW (in: hSnapshot=0x1ec, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0112.361] lstrlenW (lpString="sppsvc.exe") returned 10 [0112.361] Process32NextW (in: hSnapshot=0x1ec, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xab4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0112.361] lstrlenW (lpString="svchost.exe") returned 11 [0112.361] Process32NextW (in: hSnapshot=0x1ec, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x9f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="unlikexpc.exe")) returned 1 [0112.361] lstrlenW (lpString="unlikexpc.exe") returned 13 [0112.362] Process32NextW (in: hSnapshot=0x1ec, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xb58, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0112.362] lstrlenW (lpString="cmd.exe") returned 7 [0112.362] Process32NextW (in: hSnapshot=0x1ec, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0112.362] lstrlenW (lpString="conhost.exe") returned 11 [0112.362] Process32NextW (in: hSnapshot=0x1ec, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0112.363] CloseHandle (hObject=0x1ec) returned 1 [0112.363] Sleep (dwMilliseconds=0x1f4) [0113.081] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x819f98 [0113.081] EnumServicesStatusExW (in: hSCManager=0x819f98, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x247fa74, lpServicesReturned=0x247fa8c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x247fa74, lpServicesReturned=0x247fa8c, lpResumeHandle=0x0) returned 0 [0113.082] GetLastError () returned 0xea [0113.082] EnumServicesStatusExW (in: hSCManager=0x819f98, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x815298, cbBufSize=0x13a2, pcbBytesNeeded=0x247fa74, lpServicesReturned=0x247fa8c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x815298, pcbBytesNeeded=0x247fa74, lpServicesReturned=0x247fa8c, lpResumeHandle=0x0) returned 1 [0113.082] CloseServiceHandle (hSCObject=0x819f98) returned 1 [0113.082] lstrlenW (lpString="Appinfo") returned 7 [0113.082] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0113.082] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0113.082] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0113.082] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0113.082] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0113.082] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0113.082] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0113.082] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0113.082] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0113.082] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0113.082] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0113.082] lstrlenW (lpString="AudioSrv") returned 8 [0113.082] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0113.083] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0113.083] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0113.083] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0113.083] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0113.083] lstrlenW (lpString="BFE") returned 3 [0113.083] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0113.083] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0113.083] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0113.083] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0113.083] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0113.083] lstrlenW (lpString="CryptSvc") returned 8 [0113.083] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0113.083] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0113.083] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0113.083] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0113.083] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0113.083] lstrlenW (lpString="CscService") returned 10 [0113.083] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0113.083] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0113.083] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0113.083] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0113.083] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0113.083] lstrlenW (lpString="DcomLaunch") returned 10 [0113.083] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0113.083] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0113.083] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0113.083] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0113.083] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0113.083] lstrlenW (lpString="Dhcp") returned 4 [0113.083] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0113.083] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0113.083] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0113.083] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0113.083] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0113.083] lstrlenW (lpString="Dnscache") returned 8 [0113.083] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0113.083] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0113.083] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0113.083] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0113.083] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0113.083] lstrlenW (lpString="DPS") returned 3 [0113.083] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0113.083] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0113.083] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0113.083] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0113.083] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0113.083] lstrlenW (lpString="eventlog") returned 8 [0113.083] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0113.083] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0113.083] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0113.084] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0113.084] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0113.084] lstrlenW (lpString="EventSystem") returned 11 [0113.084] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0113.084] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0113.084] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0113.084] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0113.084] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0113.084] lstrlenW (lpString="FontCache") returned 9 [0113.084] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0113.084] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0113.084] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0113.084] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0113.084] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0113.084] lstrlenW (lpString="gpsvc") returned 5 [0113.084] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0113.084] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0113.084] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0113.084] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0113.084] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0113.084] lstrlenW (lpString="iphlpsvc") returned 8 [0113.084] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0113.084] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0113.084] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0113.084] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0113.084] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0113.084] lstrlenW (lpString="LanmanServer") returned 12 [0113.084] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0113.084] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0113.084] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0113.084] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0113.084] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0113.084] lstrlenW (lpString="LanmanWorkstation") returned 17 [0113.084] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0113.084] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0113.084] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0113.084] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0113.084] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0113.084] lstrlenW (lpString="lmhosts") returned 7 [0113.084] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0113.084] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0113.084] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0113.084] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0113.084] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0113.084] lstrlenW (lpString="MMCSS") returned 5 [0113.084] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0113.084] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0113.084] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0113.084] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0113.085] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0113.085] lstrlenW (lpString="MpsSvc") returned 6 [0113.085] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0113.085] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0113.085] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0113.085] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0113.085] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0113.085] lstrlenW (lpString="Netman") returned 6 [0113.085] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0113.085] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0113.085] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0113.085] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0113.085] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0113.085] lstrlenW (lpString="netprofm") returned 8 [0113.085] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0113.085] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0113.085] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0113.085] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0113.085] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0113.085] lstrlenW (lpString="NlaSvc") returned 6 [0113.085] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0113.085] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0113.085] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0113.085] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0113.085] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0113.085] lstrlenW (lpString="nsi") returned 3 [0113.085] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0113.085] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0113.085] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0113.085] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0113.085] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0113.085] lstrlenW (lpString="PcaSvc") returned 6 [0113.085] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0113.085] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0113.085] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0113.085] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0113.085] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0113.085] lstrlenW (lpString="PlugPlay") returned 8 [0113.085] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0113.085] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0113.085] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0113.085] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0113.085] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0113.085] lstrlenW (lpString="Power") returned 5 [0113.085] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0113.085] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0113.085] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0113.085] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0113.085] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0113.085] lstrlenW (lpString="ProfSvc") returned 7 [0113.086] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0113.086] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0113.086] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0113.086] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0113.086] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0113.086] lstrlenW (lpString="RpcEptMapper") returned 12 [0113.086] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0113.086] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0113.086] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0113.086] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0113.086] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0113.086] lstrlenW (lpString="RpcSs") returned 5 [0113.086] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0113.086] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0113.086] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0113.086] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0113.086] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0113.086] lstrlenW (lpString="SamSs") returned 5 [0113.086] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0113.086] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0113.086] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0113.086] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0113.086] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0113.086] lstrlenW (lpString="Schedule") returned 8 [0113.086] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0113.086] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0113.086] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0113.086] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0113.086] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0113.086] lstrlenW (lpString="SENS") returned 4 [0113.086] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0113.086] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0113.086] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0113.086] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0113.086] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0113.086] lstrlenW (lpString="ShellHWDetection") returned 16 [0113.086] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0113.086] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0113.086] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0113.086] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0113.086] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0113.086] lstrlenW (lpString="Spooler") returned 7 [0113.086] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0113.086] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0113.086] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0113.086] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0113.086] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0113.086] lstrlenW (lpString="sppsvc") returned 6 [0113.086] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="sppsvc") returned -1 [0113.086] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="sppsvc") returned -1 [0113.087] lstrcmpiW (lpString1="sqlwriter", lpString2="sppsvc") returned 1 [0113.087] lstrcmpiW (lpString1="mssqlserver", lpString2="sppsvc") returned -1 [0113.087] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="sppsvc") returned 1 [0113.087] lstrlenW (lpString="SysMain") returned 7 [0113.087] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0113.087] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0113.087] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0113.087] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0113.087] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0113.087] lstrlenW (lpString="Themes") returned 6 [0113.087] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0113.087] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0113.087] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0113.087] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0113.087] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0113.087] lstrlenW (lpString="TrkWks") returned 6 [0113.087] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0113.087] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0113.087] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0113.087] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0113.087] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0113.087] lstrlenW (lpString="UxSms") returned 5 [0113.087] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0113.087] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0113.087] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0113.087] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0113.087] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0113.087] lstrlenW (lpString="W32Time") returned 7 [0113.087] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="W32Time") returned -1 [0113.087] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="W32Time") returned -1 [0113.087] lstrcmpiW (lpString1="sqlwriter", lpString2="W32Time") returned -1 [0113.087] lstrcmpiW (lpString1="mssqlserver", lpString2="W32Time") returned -1 [0113.087] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="W32Time") returned -1 [0113.087] lstrlenW (lpString="WdiServiceHost") returned 14 [0113.087] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0113.087] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0113.088] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0113.088] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0113.088] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0113.088] lstrlenW (lpString="WdiSystemHost") returned 13 [0113.088] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0113.088] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0113.088] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0113.088] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0113.088] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0113.088] lstrlenW (lpString="WinDefend") returned 9 [0113.088] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinDefend") returned -1 [0113.088] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinDefend") returned -1 [0113.088] lstrcmpiW (lpString1="sqlwriter", lpString2="WinDefend") returned -1 [0113.088] lstrcmpiW (lpString1="mssqlserver", lpString2="WinDefend") returned -1 [0113.088] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinDefend") returned -1 [0113.088] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0113.088] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0113.088] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0113.088] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0113.088] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0113.088] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0113.088] lstrlenW (lpString="Winmgmt") returned 7 [0113.088] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0113.088] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0113.088] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0113.088] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0113.088] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0113.088] lstrlenW (lpString="wscsvc") returned 6 [0113.088] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wscsvc") returned -1 [0113.088] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wscsvc") returned -1 [0113.088] lstrcmpiW (lpString1="sqlwriter", lpString2="wscsvc") returned -1 [0113.088] lstrcmpiW (lpString1="mssqlserver", lpString2="wscsvc") returned -1 [0113.088] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wscsvc") returned -1 [0113.088] lstrlenW (lpString="wuauserv") returned 8 [0113.088] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wuauserv") returned -1 [0113.088] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wuauserv") returned -1 [0113.088] lstrcmpiW (lpString1="sqlwriter", lpString2="wuauserv") returned -1 [0113.088] lstrcmpiW (lpString1="mssqlserver", lpString2="wuauserv") returned -1 [0113.088] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wuauserv") returned -1 [0113.088] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x200 [0113.090] Process32FirstW (in: hSnapshot=0x200, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0113.090] Process32NextW (in: hSnapshot=0x200, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0113.090] lstrlenW (lpString="System") returned 6 [0113.090] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0113.090] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0113.091] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0113.091] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0113.091] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0113.091] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0113.091] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0113.091] Process32NextW (in: hSnapshot=0x200, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0113.091] lstrlenW (lpString="smss.exe") returned 8 [0113.091] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0113.091] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0113.091] Process32NextW (in: hSnapshot=0x200, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0113.092] lstrlenW (lpString="csrss.exe") returned 9 [0113.092] Process32NextW (in: hSnapshot=0x200, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0113.092] lstrlenW (lpString="wininit.exe") returned 11 [0113.092] Process32NextW (in: hSnapshot=0x200, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0113.092] lstrlenW (lpString="csrss.exe") returned 9 [0113.093] Process32NextW (in: hSnapshot=0x200, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0113.093] lstrlenW (lpString="winlogon.exe") returned 12 [0113.093] Process32NextW (in: hSnapshot=0x200, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0113.093] lstrlenW (lpString="services.exe") returned 12 [0113.093] Process32NextW (in: hSnapshot=0x200, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0113.094] lstrlenW (lpString="lsass.exe") returned 9 [0113.094] Process32NextW (in: hSnapshot=0x200, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0113.094] lstrlenW (lpString="lsm.exe") returned 7 [0113.094] Process32NextW (in: hSnapshot=0x200, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0113.095] lstrlenW (lpString="svchost.exe") returned 11 [0113.095] Process32NextW (in: hSnapshot=0x200, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0113.095] lstrlenW (lpString="svchost.exe") returned 11 [0113.095] Process32NextW (in: hSnapshot=0x200, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0113.096] lstrlenW (lpString="svchost.exe") returned 11 [0113.096] Process32NextW (in: hSnapshot=0x200, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0113.096] lstrlenW (lpString="svchost.exe") returned 11 [0113.096] Process32NextW (in: hSnapshot=0x200, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x23, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0113.096] lstrlenW (lpString="svchost.exe") returned 11 [0113.096] Process32NextW (in: hSnapshot=0x200, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0113.097] lstrlenW (lpString="audiodg.exe") returned 11 [0113.097] Process32NextW (in: hSnapshot=0x200, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0113.097] lstrlenW (lpString="svchost.exe") returned 11 [0113.097] Process32NextW (in: hSnapshot=0x200, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0113.098] lstrlenW (lpString="svchost.exe") returned 11 [0113.098] Process32NextW (in: hSnapshot=0x200, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0113.098] lstrlenW (lpString="spoolsv.exe") returned 11 [0113.098] Process32NextW (in: hSnapshot=0x200, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0113.099] lstrlenW (lpString="svchost.exe") returned 11 [0113.099] Process32NextW (in: hSnapshot=0x200, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0113.099] lstrlenW (lpString="taskhost.exe") returned 12 [0113.099] Process32NextW (in: hSnapshot=0x200, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x558, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0113.100] lstrlenW (lpString="dwm.exe") returned 7 [0113.100] Process32NextW (in: hSnapshot=0x200, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x54c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0113.100] lstrlenW (lpString="explorer.exe") returned 12 [0113.100] Process32NextW (in: hSnapshot=0x200, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0113.100] lstrlenW (lpString="taskeng.exe") returned 11 [0113.100] Process32NextW (in: hSnapshot=0x200, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0113.101] lstrlenW (lpString="taskhost.exe") returned 12 [0113.101] Process32NextW (in: hSnapshot=0x200, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="watches-vessel-arbitrary.exe")) returned 1 [0113.101] lstrlenW (lpString="watches-vessel-arbitrary.exe") returned 28 [0113.101] Process32NextW (in: hSnapshot=0x200, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="alsopound.exe")) returned 1 [0113.102] lstrlenW (lpString="alsopound.exe") returned 13 [0113.102] Process32NextW (in: hSnapshot=0x200, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x478, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="measuredamsterdamsandwich.exe")) returned 1 [0113.102] lstrlenW (lpString="measuredamsterdamsandwich.exe") returned 29 [0113.102] Process32NextW (in: hSnapshot=0x200, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="ooo_lucy_millions.exe")) returned 1 [0113.103] lstrlenW (lpString="ooo_lucy_millions.exe") returned 21 [0113.103] Process32NextW (in: hSnapshot=0x200, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="appearance.exe")) returned 1 [0113.103] lstrlenW (lpString="appearance.exe") returned 14 [0113.103] Process32NextW (in: hSnapshot=0x200, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="albert.exe")) returned 1 [0113.104] lstrlenW (lpString="albert.exe") returned 10 [0113.104] Process32NextW (in: hSnapshot=0x200, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="implied-enquiries.exe")) returned 1 [0113.104] lstrlenW (lpString="implied-enquiries.exe") returned 21 [0113.104] Process32NextW (in: hSnapshot=0x200, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x72c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="boston_opening.exe")) returned 1 [0113.105] lstrlenW (lpString="boston_opening.exe") returned 18 [0113.105] Process32NextW (in: hSnapshot=0x200, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="portsmouth.exe")) returned 1 [0113.105] lstrlenW (lpString="portsmouth.exe") returned 14 [0113.105] Process32NextW (in: hSnapshot=0x200, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="cameras grew poverty.exe")) returned 1 [0113.105] lstrlenW (lpString="cameras grew poverty.exe") returned 24 [0113.105] Process32NextW (in: hSnapshot=0x200, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="dxrapids.exe")) returned 1 [0113.106] lstrlenW (lpString="dxrapids.exe") returned 12 [0113.106] Process32NextW (in: hSnapshot=0x200, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x33c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="visitors.exe")) returned 1 [0113.106] lstrlenW (lpString="visitors.exe") returned 12 [0113.106] Process32NextW (in: hSnapshot=0x200, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="organisations_officially.exe")) returned 1 [0113.107] lstrlenW (lpString="organisations_officially.exe") returned 28 [0113.107] Process32NextW (in: hSnapshot=0x200, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x61c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="pair.exe")) returned 1 [0113.107] lstrlenW (lpString="pair.exe") returned 8 [0113.107] Process32NextW (in: hSnapshot=0x200, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="gross.exe")) returned 1 [0113.108] lstrlenW (lpString="gross.exe") returned 9 [0113.108] Process32NextW (in: hSnapshot=0x200, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x470, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="viewpicture.exe")) returned 1 [0113.108] lstrlenW (lpString="viewpicture.exe") returned 15 [0113.108] Process32NextW (in: hSnapshot=0x200, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="transmitted.exe")) returned 1 [0113.109] lstrlenW (lpString="transmitted.exe") returned 15 [0113.109] Process32NextW (in: hSnapshot=0x200, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x634, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="sunglassescelebs.exe")) returned 1 [0113.109] lstrlenW (lpString="sunglassescelebs.exe") returned 20 [0113.109] Process32NextW (in: hSnapshot=0x200, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="waiver-issue.exe")) returned 1 [0113.109] lstrlenW (lpString="waiver-issue.exe") returned 16 [0113.109] Process32NextW (in: hSnapshot=0x200, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x808, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="gziprear.exe")) returned 1 [0113.110] lstrlenW (lpString="gziprear.exe") returned 12 [0113.110] Process32NextW (in: hSnapshot=0x200, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x818, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="gregoryletters.exe")) returned 1 [0113.110] lstrlenW (lpString="gregoryletters.exe") returned 18 [0113.110] Process32NextW (in: hSnapshot=0x200, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x828, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="intel-metadata-rich.exe")) returned 1 [0113.111] lstrlenW (lpString="intel-metadata-rich.exe") returned 23 [0113.111] Process32NextW (in: hSnapshot=0x200, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x838, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="cemeteryreconstructiondimension.exe")) returned 1 [0113.111] lstrlenW (lpString="cemeteryreconstructiondimension.exe") returned 35 [0113.111] Process32NextW (in: hSnapshot=0x200, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0113.112] lstrlenW (lpString="svchost.exe") returned 11 [0113.112] Process32NextW (in: hSnapshot=0x200, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0113.112] lstrlenW (lpString="sppsvc.exe") returned 10 [0113.112] Process32NextW (in: hSnapshot=0x200, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xab4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0113.113] lstrlenW (lpString="svchost.exe") returned 11 [0113.113] Process32NextW (in: hSnapshot=0x200, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x9f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="unlikexpc.exe")) returned 1 [0113.113] lstrlenW (lpString="unlikexpc.exe") returned 13 [0113.113] Process32NextW (in: hSnapshot=0x200, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xb58, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0113.113] lstrlenW (lpString="cmd.exe") returned 7 [0113.113] Process32NextW (in: hSnapshot=0x200, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0113.114] lstrlenW (lpString="conhost.exe") returned 11 [0113.114] Process32NextW (in: hSnapshot=0x200, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xb74, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0113.114] lstrlenW (lpString="vssadmin.exe") returned 12 [0113.114] Process32NextW (in: hSnapshot=0x200, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xb74, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 0 [0113.115] CloseHandle (hObject=0x200) returned 1 [0113.115] Sleep (dwMilliseconds=0x1f4) [0114.334] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x3ef09a0 [0114.334] EnumServicesStatusExW (in: hSCManager=0x3ef09a0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x247fa74, lpServicesReturned=0x247fa8c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x247fa74, lpServicesReturned=0x247fa8c, lpResumeHandle=0x0) returned 0 [0114.334] GetLastError () returned 0xea [0114.334] EnumServicesStatusExW (in: hSCManager=0x3ef09a0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x815298, cbBufSize=0x13a2, pcbBytesNeeded=0x247fa74, lpServicesReturned=0x247fa8c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x815298, pcbBytesNeeded=0x247fa74, lpServicesReturned=0x247fa8c, lpResumeHandle=0x0) returned 1 [0114.335] CloseServiceHandle (hSCObject=0x3ef09a0) returned 1 [0114.335] lstrlenW (lpString="Appinfo") returned 7 [0114.335] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0114.335] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0114.335] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0114.335] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0114.335] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0114.335] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0114.335] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0114.335] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0114.335] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0114.335] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0114.335] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0114.335] lstrlenW (lpString="AudioSrv") returned 8 [0114.335] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0114.335] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0114.335] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0114.335] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0114.335] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0114.335] lstrlenW (lpString="BFE") returned 3 [0114.335] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0114.335] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0114.335] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0114.335] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0114.335] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0114.335] lstrlenW (lpString="CryptSvc") returned 8 [0114.335] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0114.335] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0114.335] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0114.335] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0114.335] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0114.335] lstrlenW (lpString="CscService") returned 10 [0114.335] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0114.335] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0114.335] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0114.335] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0114.335] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0114.336] lstrlenW (lpString="DcomLaunch") returned 10 [0114.336] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0114.336] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0114.336] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0114.336] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0114.336] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0114.336] lstrlenW (lpString="Dhcp") returned 4 [0114.336] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0114.336] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0114.336] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0114.336] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0114.336] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0114.336] lstrlenW (lpString="Dnscache") returned 8 [0114.336] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0114.348] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0114.348] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0114.358] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0114.360] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0114.360] lstrlenW (lpString="DPS") returned 3 [0114.360] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0114.360] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0114.371] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0114.371] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0114.379] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0114.379] lstrlenW (lpString="eventlog") returned 8 [0114.379] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0114.379] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0114.379] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0114.379] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0114.379] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0114.379] lstrlenW (lpString="EventSystem") returned 11 [0114.379] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0114.379] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0114.379] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0114.379] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0114.379] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0114.379] lstrlenW (lpString="FontCache") returned 9 [0114.379] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0114.379] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0114.379] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0114.379] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0114.379] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0114.379] lstrlenW (lpString="gpsvc") returned 5 [0114.379] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0114.379] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0114.379] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0114.379] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0114.379] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0114.379] lstrlenW (lpString="iphlpsvc") returned 8 [0114.379] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0114.379] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0114.379] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0114.379] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0114.379] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0114.379] lstrlenW (lpString="LanmanServer") returned 12 [0114.379] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0114.379] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0114.379] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0114.379] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0114.379] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0114.379] lstrlenW (lpString="LanmanWorkstation") returned 17 [0114.379] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0114.379] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0114.379] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0114.379] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0114.379] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0114.379] lstrlenW (lpString="lmhosts") returned 7 [0114.379] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0114.379] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0114.379] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0114.379] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0114.379] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0114.380] lstrlenW (lpString="MMCSS") returned 5 [0114.380] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0114.380] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0114.380] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0114.380] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0114.380] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0114.380] lstrlenW (lpString="MpsSvc") returned 6 [0114.380] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0114.380] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0114.380] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0114.380] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0114.380] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0114.380] lstrlenW (lpString="Netman") returned 6 [0114.380] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0114.380] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0114.380] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0114.380] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0114.380] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0114.380] lstrlenW (lpString="netprofm") returned 8 [0114.380] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0114.380] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0114.380] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0114.380] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0114.380] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0114.380] lstrlenW (lpString="NlaSvc") returned 6 [0114.380] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0114.380] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0114.380] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0114.380] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0114.380] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0114.380] lstrlenW (lpString="nsi") returned 3 [0114.380] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0114.380] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0114.380] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0114.380] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0114.380] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0114.380] lstrlenW (lpString="PcaSvc") returned 6 [0114.380] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0114.380] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0114.380] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0114.380] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0114.380] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0114.380] lstrlenW (lpString="PlugPlay") returned 8 [0114.380] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0114.380] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0114.380] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0114.380] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0114.381] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0114.381] lstrlenW (lpString="Power") returned 5 [0114.381] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0114.381] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0114.381] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0114.381] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0114.381] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0114.381] lstrlenW (lpString="ProfSvc") returned 7 [0114.381] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0114.381] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0114.381] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0114.381] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0114.381] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0114.381] lstrlenW (lpString="RpcEptMapper") returned 12 [0114.381] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0114.381] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0114.381] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0114.381] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0114.381] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0114.381] lstrlenW (lpString="RpcSs") returned 5 [0114.381] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0114.381] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0114.381] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0114.381] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0114.381] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0114.381] lstrlenW (lpString="SamSs") returned 5 [0114.381] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0114.381] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0114.381] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0114.381] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0114.381] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0114.381] lstrlenW (lpString="Schedule") returned 8 [0114.381] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0114.381] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0114.381] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0114.381] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0114.381] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0114.381] lstrlenW (lpString="SENS") returned 4 [0114.381] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0114.381] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0114.381] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0114.382] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0114.382] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0114.382] lstrlenW (lpString="ShellHWDetection") returned 16 [0114.382] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0114.382] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0114.382] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0114.382] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0114.382] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0114.382] lstrlenW (lpString="Spooler") returned 7 [0114.382] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0114.382] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0114.382] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0114.382] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0114.382] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0114.382] lstrlenW (lpString="sppsvc") returned 6 [0114.382] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="sppsvc") returned -1 [0114.382] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="sppsvc") returned -1 [0114.382] lstrcmpiW (lpString1="sqlwriter", lpString2="sppsvc") returned 1 [0114.382] lstrcmpiW (lpString1="mssqlserver", lpString2="sppsvc") returned -1 [0114.382] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="sppsvc") returned 1 [0114.382] lstrlenW (lpString="SysMain") returned 7 [0114.382] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0114.382] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0114.382] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0114.382] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0114.382] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0114.382] lstrlenW (lpString="Themes") returned 6 [0114.382] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0114.382] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0114.382] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0114.382] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0114.382] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0114.382] lstrlenW (lpString="TrkWks") returned 6 [0114.382] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0114.382] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0114.382] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0114.382] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0114.382] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0114.382] lstrlenW (lpString="UxSms") returned 5 [0114.382] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0114.383] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0114.383] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0114.383] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0114.383] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0114.383] lstrlenW (lpString="W32Time") returned 7 [0114.383] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="W32Time") returned -1 [0114.383] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="W32Time") returned -1 [0114.383] lstrcmpiW (lpString1="sqlwriter", lpString2="W32Time") returned -1 [0114.383] lstrcmpiW (lpString1="mssqlserver", lpString2="W32Time") returned -1 [0114.383] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="W32Time") returned -1 [0114.383] lstrlenW (lpString="WdiServiceHost") returned 14 [0114.383] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0114.383] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0114.383] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0114.383] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0114.383] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0114.383] lstrlenW (lpString="WdiSystemHost") returned 13 [0114.383] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0114.383] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0114.383] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0114.383] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0114.383] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0114.383] lstrlenW (lpString="WinDefend") returned 9 [0114.383] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinDefend") returned -1 [0114.383] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinDefend") returned -1 [0114.383] lstrcmpiW (lpString1="sqlwriter", lpString2="WinDefend") returned -1 [0114.383] lstrcmpiW (lpString1="mssqlserver", lpString2="WinDefend") returned -1 [0114.383] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinDefend") returned -1 [0114.383] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0114.383] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0114.383] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0114.383] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0114.383] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0114.383] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0114.383] lstrlenW (lpString="Winmgmt") returned 7 [0114.383] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0114.383] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0114.383] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0114.383] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0114.383] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0114.383] lstrlenW (lpString="wscsvc") returned 6 [0114.384] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wscsvc") returned -1 [0114.384] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wscsvc") returned -1 [0114.384] lstrcmpiW (lpString1="sqlwriter", lpString2="wscsvc") returned -1 [0114.384] lstrcmpiW (lpString1="mssqlserver", lpString2="wscsvc") returned -1 [0114.384] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wscsvc") returned -1 [0114.384] lstrlenW (lpString="wuauserv") returned 8 [0114.384] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wuauserv") returned -1 [0114.384] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wuauserv") returned -1 [0114.384] lstrcmpiW (lpString1="sqlwriter", lpString2="wuauserv") returned -1 [0114.384] lstrcmpiW (lpString1="mssqlserver", lpString2="wuauserv") returned -1 [0114.384] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wuauserv") returned -1 [0114.384] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1f0 [0114.385] Process32FirstW (in: hSnapshot=0x1f0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0114.386] Process32NextW (in: hSnapshot=0x1f0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0114.386] lstrlenW (lpString="System") returned 6 [0114.386] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0114.386] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0114.386] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0114.386] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0114.386] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0114.386] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0114.386] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0114.386] Process32NextW (in: hSnapshot=0x1f0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0114.387] lstrlenW (lpString="smss.exe") returned 8 [0114.387] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0114.387] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0114.387] Process32NextW (in: hSnapshot=0x1f0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0114.387] lstrlenW (lpString="csrss.exe") returned 9 [0114.387] Process32NextW (in: hSnapshot=0x1f0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0114.388] lstrlenW (lpString="wininit.exe") returned 11 [0114.388] Process32NextW (in: hSnapshot=0x1f0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0114.388] lstrlenW (lpString="csrss.exe") returned 9 [0114.388] Process32NextW (in: hSnapshot=0x1f0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0114.389] lstrlenW (lpString="winlogon.exe") returned 12 [0114.389] Process32NextW (in: hSnapshot=0x1f0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0114.389] lstrlenW (lpString="services.exe") returned 12 [0114.389] Process32NextW (in: hSnapshot=0x1f0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0114.390] lstrlenW (lpString="lsass.exe") returned 9 [0114.390] Process32NextW (in: hSnapshot=0x1f0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0114.390] lstrlenW (lpString="lsm.exe") returned 7 [0114.390] Process32NextW (in: hSnapshot=0x1f0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0114.391] lstrlenW (lpString="svchost.exe") returned 11 [0114.391] Process32NextW (in: hSnapshot=0x1f0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0114.391] lstrlenW (lpString="svchost.exe") returned 11 [0114.391] Process32NextW (in: hSnapshot=0x1f0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0114.392] lstrlenW (lpString="svchost.exe") returned 11 [0114.392] Process32NextW (in: hSnapshot=0x1f0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0114.392] lstrlenW (lpString="svchost.exe") returned 11 [0114.392] Process32NextW (in: hSnapshot=0x1f0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x23, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0114.392] lstrlenW (lpString="svchost.exe") returned 11 [0114.393] Process32NextW (in: hSnapshot=0x1f0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0114.393] lstrlenW (lpString="audiodg.exe") returned 11 [0114.393] Process32NextW (in: hSnapshot=0x1f0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0114.393] lstrlenW (lpString="svchost.exe") returned 11 [0114.393] Process32NextW (in: hSnapshot=0x1f0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0114.394] lstrlenW (lpString="svchost.exe") returned 11 [0114.394] Process32NextW (in: hSnapshot=0x1f0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0114.394] lstrlenW (lpString="spoolsv.exe") returned 11 [0114.394] Process32NextW (in: hSnapshot=0x1f0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0114.395] lstrlenW (lpString="svchost.exe") returned 11 [0114.395] Process32NextW (in: hSnapshot=0x1f0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0114.395] lstrlenW (lpString="taskhost.exe") returned 12 [0114.395] Process32NextW (in: hSnapshot=0x1f0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x558, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0114.396] lstrlenW (lpString="dwm.exe") returned 7 [0114.396] Process32NextW (in: hSnapshot=0x1f0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x54c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0114.396] lstrlenW (lpString="explorer.exe") returned 12 [0114.396] Process32NextW (in: hSnapshot=0x1f0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0114.397] lstrlenW (lpString="taskeng.exe") returned 11 [0114.397] Process32NextW (in: hSnapshot=0x1f0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0114.397] lstrlenW (lpString="taskhost.exe") returned 12 [0114.397] Process32NextW (in: hSnapshot=0x1f0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="watches-vessel-arbitrary.exe")) returned 1 [0114.398] lstrlenW (lpString="watches-vessel-arbitrary.exe") returned 28 [0114.398] Process32NextW (in: hSnapshot=0x1f0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="alsopound.exe")) returned 1 [0114.398] lstrlenW (lpString="alsopound.exe") returned 13 [0114.398] Process32NextW (in: hSnapshot=0x1f0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x478, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="measuredamsterdamsandwich.exe")) returned 1 [0114.399] lstrlenW (lpString="measuredamsterdamsandwich.exe") returned 29 [0114.399] Process32NextW (in: hSnapshot=0x1f0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="ooo_lucy_millions.exe")) returned 1 [0114.399] lstrlenW (lpString="ooo_lucy_millions.exe") returned 21 [0114.399] Process32NextW (in: hSnapshot=0x1f0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="appearance.exe")) returned 1 [0114.399] lstrlenW (lpString="appearance.exe") returned 14 [0114.399] Process32NextW (in: hSnapshot=0x1f0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="albert.exe")) returned 1 [0114.400] lstrlenW (lpString="albert.exe") returned 10 [0114.400] Process32NextW (in: hSnapshot=0x1f0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="implied-enquiries.exe")) returned 1 [0114.400] lstrlenW (lpString="implied-enquiries.exe") returned 21 [0114.400] Process32NextW (in: hSnapshot=0x1f0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x72c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="boston_opening.exe")) returned 1 [0114.401] lstrlenW (lpString="boston_opening.exe") returned 18 [0114.401] Process32NextW (in: hSnapshot=0x1f0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="portsmouth.exe")) returned 1 [0114.401] lstrlenW (lpString="portsmouth.exe") returned 14 [0114.401] Process32NextW (in: hSnapshot=0x1f0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="cameras grew poverty.exe")) returned 1 [0114.402] lstrlenW (lpString="cameras grew poverty.exe") returned 24 [0114.402] Process32NextW (in: hSnapshot=0x1f0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="dxrapids.exe")) returned 1 [0114.402] lstrlenW (lpString="dxrapids.exe") returned 12 [0114.402] Process32NextW (in: hSnapshot=0x1f0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x33c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="visitors.exe")) returned 1 [0114.403] lstrlenW (lpString="visitors.exe") returned 12 [0114.403] Process32NextW (in: hSnapshot=0x1f0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="organisations_officially.exe")) returned 1 [0114.403] lstrlenW (lpString="organisations_officially.exe") returned 28 [0114.403] Process32NextW (in: hSnapshot=0x1f0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x61c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="pair.exe")) returned 1 [0114.404] lstrlenW (lpString="pair.exe") returned 8 [0114.404] Process32NextW (in: hSnapshot=0x1f0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="gross.exe")) returned 1 [0114.404] lstrlenW (lpString="gross.exe") returned 9 [0114.404] Process32NextW (in: hSnapshot=0x1f0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x470, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="viewpicture.exe")) returned 1 [0114.404] lstrlenW (lpString="viewpicture.exe") returned 15 [0114.404] Process32NextW (in: hSnapshot=0x1f0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="transmitted.exe")) returned 1 [0114.405] lstrlenW (lpString="transmitted.exe") returned 15 [0114.405] Process32NextW (in: hSnapshot=0x1f0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x634, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="sunglassescelebs.exe")) returned 1 [0114.405] lstrlenW (lpString="sunglassescelebs.exe") returned 20 [0114.405] Process32NextW (in: hSnapshot=0x1f0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="waiver-issue.exe")) returned 1 [0114.406] lstrlenW (lpString="waiver-issue.exe") returned 16 [0114.406] Process32NextW (in: hSnapshot=0x1f0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x808, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="gziprear.exe")) returned 1 [0114.406] lstrlenW (lpString="gziprear.exe") returned 12 [0114.406] Process32NextW (in: hSnapshot=0x1f0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x818, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="gregoryletters.exe")) returned 1 [0114.407] lstrlenW (lpString="gregoryletters.exe") returned 18 [0114.407] Process32NextW (in: hSnapshot=0x1f0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x828, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="intel-metadata-rich.exe")) returned 1 [0114.407] lstrlenW (lpString="intel-metadata-rich.exe") returned 23 [0114.407] Process32NextW (in: hSnapshot=0x1f0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x838, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="cemeteryreconstructiondimension.exe")) returned 1 [0114.408] lstrlenW (lpString="cemeteryreconstructiondimension.exe") returned 35 [0114.408] Process32NextW (in: hSnapshot=0x1f0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0114.408] lstrlenW (lpString="svchost.exe") returned 11 [0114.408] Process32NextW (in: hSnapshot=0x1f0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0114.408] lstrlenW (lpString="sppsvc.exe") returned 10 [0114.409] Process32NextW (in: hSnapshot=0x1f0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xab4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0114.409] lstrlenW (lpString="svchost.exe") returned 11 [0114.444] Process32NextW (in: hSnapshot=0x1f0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x9f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="unlikexpc.exe")) returned 1 [0114.448] lstrlenW (lpString="unlikexpc.exe") returned 13 [0114.448] Process32NextW (in: hSnapshot=0x1f0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xb58, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0114.448] lstrlenW (lpString="cmd.exe") returned 7 [0114.448] Process32NextW (in: hSnapshot=0x1f0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0114.449] lstrlenW (lpString="conhost.exe") returned 11 [0114.449] Process32NextW (in: hSnapshot=0x1f0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xb74, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0114.450] lstrlenW (lpString="vssadmin.exe") returned 12 [0114.450] Process32NextW (in: hSnapshot=0x1f0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xb74, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 0 [0114.450] CloseHandle (hObject=0x1f0) returned 1 [0114.450] Sleep (dwMilliseconds=0x1f4) [0115.047] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x81a010 [0115.048] EnumServicesStatusExW (in: hSCManager=0x81a010, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x247fa74, lpServicesReturned=0x247fa8c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x247fa74, lpServicesReturned=0x247fa8c, lpResumeHandle=0x0) returned 0 [0115.048] GetLastError () returned 0xea [0115.048] EnumServicesStatusExW (in: hSCManager=0x81a010, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x815298, cbBufSize=0x13a2, pcbBytesNeeded=0x247fa74, lpServicesReturned=0x247fa8c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x815298, pcbBytesNeeded=0x247fa74, lpServicesReturned=0x247fa8c, lpResumeHandle=0x0) returned 1 [0115.048] CloseServiceHandle (hSCObject=0x81a010) returned 1 [0115.048] lstrlenW (lpString="Appinfo") returned 7 [0115.048] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0115.048] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0115.048] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0115.048] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0115.048] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0115.048] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0115.049] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0115.049] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0115.049] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0115.049] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0115.049] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0115.049] lstrlenW (lpString="AudioSrv") returned 8 [0115.049] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0115.049] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0115.049] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0115.049] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0115.049] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0115.049] lstrlenW (lpString="BFE") returned 3 [0115.049] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0115.049] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0115.049] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0115.049] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0115.049] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0115.049] lstrlenW (lpString="CryptSvc") returned 8 [0115.049] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0115.049] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0115.049] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0115.049] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0115.049] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0115.049] lstrlenW (lpString="CscService") returned 10 [0115.049] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0115.049] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0115.049] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0115.049] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0115.049] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0115.049] lstrlenW (lpString="DcomLaunch") returned 10 [0115.049] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0115.049] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0115.049] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0115.049] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0115.049] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0115.049] lstrlenW (lpString="Dhcp") returned 4 [0115.049] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0115.049] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0115.049] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0115.049] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0115.049] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0115.049] lstrlenW (lpString="Dnscache") returned 8 [0115.049] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0115.049] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0115.049] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0115.049] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0115.049] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0115.049] lstrlenW (lpString="DPS") returned 3 [0115.049] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0115.049] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0115.050] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0115.050] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0115.050] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0115.050] lstrlenW (lpString="eventlog") returned 8 [0115.050] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0115.050] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0115.050] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0115.050] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0115.050] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0115.050] lstrlenW (lpString="EventSystem") returned 11 [0115.050] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0115.050] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0115.050] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0115.050] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0115.050] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0115.050] lstrlenW (lpString="FontCache") returned 9 [0115.050] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0115.050] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0115.050] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0115.050] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0115.050] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0115.050] lstrlenW (lpString="gpsvc") returned 5 [0115.050] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0115.050] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0115.050] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0115.050] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0115.050] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0115.050] lstrlenW (lpString="iphlpsvc") returned 8 [0115.050] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0115.050] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0115.050] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0115.050] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0115.050] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0115.050] lstrlenW (lpString="LanmanServer") returned 12 [0115.050] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0115.050] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0115.050] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0115.050] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0115.050] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0115.050] lstrlenW (lpString="LanmanWorkstation") returned 17 [0115.050] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0115.050] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0115.050] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0115.050] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0115.050] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0115.050] lstrlenW (lpString="lmhosts") returned 7 [0115.050] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0115.050] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0115.050] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0115.050] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0115.051] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0115.051] lstrlenW (lpString="MMCSS") returned 5 [0115.051] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0115.051] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0115.051] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0115.051] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0115.051] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0115.051] lstrlenW (lpString="MpsSvc") returned 6 [0115.051] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0115.051] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0115.051] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0115.051] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0115.051] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0115.051] lstrlenW (lpString="Netman") returned 6 [0115.051] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0115.051] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0115.051] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0115.051] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0115.051] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0115.051] lstrlenW (lpString="netprofm") returned 8 [0115.051] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0115.051] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0115.051] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0115.051] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0115.051] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0115.051] lstrlenW (lpString="NlaSvc") returned 6 [0115.051] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0115.051] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0115.051] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0115.051] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0115.051] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0115.051] lstrlenW (lpString="nsi") returned 3 [0115.051] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0115.051] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0115.051] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0115.051] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0115.051] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0115.051] lstrlenW (lpString="PcaSvc") returned 6 [0115.051] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0115.051] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0115.051] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0115.051] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0115.051] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0115.051] lstrlenW (lpString="PlugPlay") returned 8 [0115.051] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0115.051] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0115.051] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0115.051] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0115.051] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0115.052] lstrlenW (lpString="Power") returned 5 [0115.052] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0115.052] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0115.052] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0115.052] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0115.052] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0115.052] lstrlenW (lpString="ProfSvc") returned 7 [0115.052] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0115.052] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0115.052] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0115.052] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0115.052] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0115.052] lstrlenW (lpString="RpcEptMapper") returned 12 [0115.052] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0115.052] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0115.052] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0115.052] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0115.052] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0115.052] lstrlenW (lpString="RpcSs") returned 5 [0115.052] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0115.052] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0115.052] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0115.052] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0115.052] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0115.052] lstrlenW (lpString="SamSs") returned 5 [0115.052] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0115.052] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0115.052] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0115.052] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0115.052] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0115.052] lstrlenW (lpString="Schedule") returned 8 [0115.052] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0115.052] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0115.052] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0115.052] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0115.052] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0115.052] lstrlenW (lpString="SENS") returned 4 [0115.052] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0115.052] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0115.052] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0115.052] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0115.052] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0115.052] lstrlenW (lpString="ShellHWDetection") returned 16 [0115.052] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0115.052] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0115.052] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0115.052] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0115.052] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0115.052] lstrlenW (lpString="Spooler") returned 7 [0115.052] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0115.053] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0115.053] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0115.053] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0115.053] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0115.053] lstrlenW (lpString="sppsvc") returned 6 [0115.053] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="sppsvc") returned -1 [0115.053] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="sppsvc") returned -1 [0115.053] lstrcmpiW (lpString1="sqlwriter", lpString2="sppsvc") returned 1 [0115.053] lstrcmpiW (lpString1="mssqlserver", lpString2="sppsvc") returned -1 [0115.053] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="sppsvc") returned 1 [0115.053] lstrlenW (lpString="SysMain") returned 7 [0115.053] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0115.053] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0115.053] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0115.053] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0115.053] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0115.053] lstrlenW (lpString="Themes") returned 6 [0115.053] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0115.053] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0115.053] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0115.053] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0115.053] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0115.053] lstrlenW (lpString="TrkWks") returned 6 [0115.053] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0115.053] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0115.053] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0115.053] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0115.053] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0115.053] lstrlenW (lpString="UxSms") returned 5 [0115.053] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0115.053] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0115.053] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0115.053] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0115.053] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0115.053] lstrlenW (lpString="W32Time") returned 7 [0115.053] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="W32Time") returned -1 [0115.053] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="W32Time") returned -1 [0115.053] lstrcmpiW (lpString1="sqlwriter", lpString2="W32Time") returned -1 [0115.053] lstrcmpiW (lpString1="mssqlserver", lpString2="W32Time") returned -1 [0115.053] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="W32Time") returned -1 [0115.053] lstrlenW (lpString="WdiServiceHost") returned 14 [0115.053] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0115.053] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0115.053] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0115.054] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0115.054] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0115.054] lstrlenW (lpString="WdiSystemHost") returned 13 [0115.054] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0115.054] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0115.054] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0115.054] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0115.054] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0115.054] lstrlenW (lpString="WinDefend") returned 9 [0115.054] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinDefend") returned -1 [0115.054] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinDefend") returned -1 [0115.054] lstrcmpiW (lpString1="sqlwriter", lpString2="WinDefend") returned -1 [0115.054] lstrcmpiW (lpString1="mssqlserver", lpString2="WinDefend") returned -1 [0115.054] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinDefend") returned -1 [0115.054] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0115.054] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0115.054] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0115.054] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0115.054] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0115.054] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0115.054] lstrlenW (lpString="Winmgmt") returned 7 [0115.054] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0115.054] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0115.054] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0115.054] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0115.054] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0115.054] lstrlenW (lpString="wscsvc") returned 6 [0115.054] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wscsvc") returned -1 [0115.054] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wscsvc") returned -1 [0115.054] lstrcmpiW (lpString1="sqlwriter", lpString2="wscsvc") returned -1 [0115.054] lstrcmpiW (lpString1="mssqlserver", lpString2="wscsvc") returned -1 [0115.054] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wscsvc") returned -1 [0115.054] lstrlenW (lpString="wuauserv") returned 8 [0115.054] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wuauserv") returned -1 [0115.054] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wuauserv") returned -1 [0115.054] lstrcmpiW (lpString1="sqlwriter", lpString2="wuauserv") returned -1 [0115.054] lstrcmpiW (lpString1="mssqlserver", lpString2="wuauserv") returned -1 [0115.054] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wuauserv") returned -1 [0115.054] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x164 [0115.056] Process32FirstW (in: hSnapshot=0x164, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0115.056] Process32NextW (in: hSnapshot=0x164, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0115.057] lstrlenW (lpString="System") returned 6 [0115.057] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0115.057] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0115.057] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0115.057] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0115.057] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0115.057] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0115.057] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0115.057] Process32NextW (in: hSnapshot=0x164, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0115.057] lstrlenW (lpString="smss.exe") returned 8 [0115.057] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0115.057] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0115.057] Process32NextW (in: hSnapshot=0x164, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0115.058] lstrlenW (lpString="csrss.exe") returned 9 [0115.058] Process32NextW (in: hSnapshot=0x164, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0115.058] lstrlenW (lpString="wininit.exe") returned 11 [0115.058] Process32NextW (in: hSnapshot=0x164, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0115.059] lstrlenW (lpString="csrss.exe") returned 9 [0115.059] Process32NextW (in: hSnapshot=0x164, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0115.059] lstrlenW (lpString="winlogon.exe") returned 12 [0115.059] Process32NextW (in: hSnapshot=0x164, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0115.060] lstrlenW (lpString="services.exe") returned 12 [0115.060] Process32NextW (in: hSnapshot=0x164, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0115.060] lstrlenW (lpString="lsass.exe") returned 9 [0115.060] Process32NextW (in: hSnapshot=0x164, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0115.060] lstrlenW (lpString="lsm.exe") returned 7 [0115.060] Process32NextW (in: hSnapshot=0x164, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0115.061] lstrlenW (lpString="svchost.exe") returned 11 [0115.061] Process32NextW (in: hSnapshot=0x164, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0115.061] lstrlenW (lpString="svchost.exe") returned 11 [0115.061] Process32NextW (in: hSnapshot=0x164, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0115.062] lstrlenW (lpString="svchost.exe") returned 11 [0115.062] Process32NextW (in: hSnapshot=0x164, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0115.062] lstrlenW (lpString="svchost.exe") returned 11 [0115.062] Process32NextW (in: hSnapshot=0x164, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x23, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0115.063] lstrlenW (lpString="svchost.exe") returned 11 [0115.063] Process32NextW (in: hSnapshot=0x164, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0115.063] lstrlenW (lpString="audiodg.exe") returned 11 [0115.063] Process32NextW (in: hSnapshot=0x164, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0115.064] lstrlenW (lpString="svchost.exe") returned 11 [0115.064] Process32NextW (in: hSnapshot=0x164, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0115.064] lstrlenW (lpString="svchost.exe") returned 11 [0115.064] Process32NextW (in: hSnapshot=0x164, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0115.064] lstrlenW (lpString="spoolsv.exe") returned 11 [0115.064] Process32NextW (in: hSnapshot=0x164, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0115.065] lstrlenW (lpString="svchost.exe") returned 11 [0115.065] Process32NextW (in: hSnapshot=0x164, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0115.065] lstrlenW (lpString="taskhost.exe") returned 12 [0115.065] Process32NextW (in: hSnapshot=0x164, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x558, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0115.066] lstrlenW (lpString="dwm.exe") returned 7 [0115.066] Process32NextW (in: hSnapshot=0x164, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x54c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0115.066] lstrlenW (lpString="explorer.exe") returned 12 [0115.066] Process32NextW (in: hSnapshot=0x164, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0115.067] lstrlenW (lpString="taskeng.exe") returned 11 [0115.067] Process32NextW (in: hSnapshot=0x164, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0115.067] lstrlenW (lpString="taskhost.exe") returned 12 [0115.067] Process32NextW (in: hSnapshot=0x164, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="watches-vessel-arbitrary.exe")) returned 1 [0115.068] lstrlenW (lpString="watches-vessel-arbitrary.exe") returned 28 [0115.068] Process32NextW (in: hSnapshot=0x164, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="alsopound.exe")) returned 1 [0115.068] lstrlenW (lpString="alsopound.exe") returned 13 [0115.068] Process32NextW (in: hSnapshot=0x164, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x478, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="measuredamsterdamsandwich.exe")) returned 1 [0115.068] lstrlenW (lpString="measuredamsterdamsandwich.exe") returned 29 [0115.069] Process32NextW (in: hSnapshot=0x164, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="ooo_lucy_millions.exe")) returned 1 [0115.069] lstrlenW (lpString="ooo_lucy_millions.exe") returned 21 [0115.069] Process32NextW (in: hSnapshot=0x164, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="appearance.exe")) returned 1 [0115.070] lstrlenW (lpString="appearance.exe") returned 14 [0115.070] Process32NextW (in: hSnapshot=0x164, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="albert.exe")) returned 1 [0115.070] lstrlenW (lpString="albert.exe") returned 10 [0115.070] Process32NextW (in: hSnapshot=0x164, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="implied-enquiries.exe")) returned 1 [0115.071] lstrlenW (lpString="implied-enquiries.exe") returned 21 [0115.071] Process32NextW (in: hSnapshot=0x164, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x72c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="boston_opening.exe")) returned 1 [0115.071] lstrlenW (lpString="boston_opening.exe") returned 18 [0115.071] Process32NextW (in: hSnapshot=0x164, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="portsmouth.exe")) returned 1 [0115.072] lstrlenW (lpString="portsmouth.exe") returned 14 [0115.072] Process32NextW (in: hSnapshot=0x164, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="cameras grew poverty.exe")) returned 1 [0115.072] lstrlenW (lpString="cameras grew poverty.exe") returned 24 [0115.072] Process32NextW (in: hSnapshot=0x164, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="dxrapids.exe")) returned 1 [0115.073] lstrlenW (lpString="dxrapids.exe") returned 12 [0115.073] Process32NextW (in: hSnapshot=0x164, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x33c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="visitors.exe")) returned 1 [0115.074] lstrlenW (lpString="visitors.exe") returned 12 [0115.074] Process32NextW (in: hSnapshot=0x164, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="organisations_officially.exe")) returned 1 [0115.074] lstrlenW (lpString="organisations_officially.exe") returned 28 [0115.074] Process32NextW (in: hSnapshot=0x164, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x61c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="pair.exe")) returned 1 [0115.075] lstrlenW (lpString="pair.exe") returned 8 [0115.075] Process32NextW (in: hSnapshot=0x164, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="gross.exe")) returned 1 [0115.075] lstrlenW (lpString="gross.exe") returned 9 [0115.075] Process32NextW (in: hSnapshot=0x164, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x470, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="viewpicture.exe")) returned 1 [0115.075] lstrlenW (lpString="viewpicture.exe") returned 15 [0115.076] Process32NextW (in: hSnapshot=0x164, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="transmitted.exe")) returned 1 [0115.076] lstrlenW (lpString="transmitted.exe") returned 15 [0115.076] Process32NextW (in: hSnapshot=0x164, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x634, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="sunglassescelebs.exe")) returned 1 [0115.076] lstrlenW (lpString="sunglassescelebs.exe") returned 20 [0115.076] Process32NextW (in: hSnapshot=0x164, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="waiver-issue.exe")) returned 1 [0115.077] lstrlenW (lpString="waiver-issue.exe") returned 16 [0115.077] Process32NextW (in: hSnapshot=0x164, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x808, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="gziprear.exe")) returned 1 [0115.077] lstrlenW (lpString="gziprear.exe") returned 12 [0115.077] Process32NextW (in: hSnapshot=0x164, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x818, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="gregoryletters.exe")) returned 1 [0115.078] lstrlenW (lpString="gregoryletters.exe") returned 18 [0115.078] Process32NextW (in: hSnapshot=0x164, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x828, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="intel-metadata-rich.exe")) returned 1 [0115.078] lstrlenW (lpString="intel-metadata-rich.exe") returned 23 [0115.078] Process32NextW (in: hSnapshot=0x164, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x838, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="cemeteryreconstructiondimension.exe")) returned 1 [0115.079] lstrlenW (lpString="cemeteryreconstructiondimension.exe") returned 35 [0115.079] Process32NextW (in: hSnapshot=0x164, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0115.079] lstrlenW (lpString="svchost.exe") returned 11 [0115.079] Process32NextW (in: hSnapshot=0x164, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0115.080] lstrlenW (lpString="sppsvc.exe") returned 10 [0115.080] Process32NextW (in: hSnapshot=0x164, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xab4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0115.080] lstrlenW (lpString="svchost.exe") returned 11 [0115.080] Process32NextW (in: hSnapshot=0x164, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x9f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="unlikexpc.exe")) returned 1 [0115.080] lstrlenW (lpString="unlikexpc.exe") returned 13 [0115.080] Process32NextW (in: hSnapshot=0x164, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xb58, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0115.081] lstrlenW (lpString="cmd.exe") returned 7 [0115.081] Process32NextW (in: hSnapshot=0x164, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0115.081] lstrlenW (lpString="conhost.exe") returned 11 [0115.081] Process32NextW (in: hSnapshot=0x164, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xb74, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0115.082] lstrlenW (lpString="vssadmin.exe") returned 12 [0115.082] Process32NextW (in: hSnapshot=0x164, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xb74, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 0 [0115.082] CloseHandle (hObject=0x164) returned 1 [0115.082] Sleep (dwMilliseconds=0x1f4) [0115.756] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x81a010 [0115.756] EnumServicesStatusExW (in: hSCManager=0x81a010, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x247fa74, lpServicesReturned=0x247fa8c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x247fa74, lpServicesReturned=0x247fa8c, lpResumeHandle=0x0) returned 0 [0115.757] GetLastError () returned 0xea [0115.757] EnumServicesStatusExW (in: hSCManager=0x81a010, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x815298, cbBufSize=0x13fc, pcbBytesNeeded=0x247fa74, lpServicesReturned=0x247fa8c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x815298, pcbBytesNeeded=0x247fa74, lpServicesReturned=0x247fa8c, lpResumeHandle=0x0) returned 1 [0115.757] CloseServiceHandle (hSCObject=0x81a010) returned 1 [0115.757] lstrlenW (lpString="Appinfo") returned 7 [0115.757] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0115.757] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0115.757] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0115.757] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0115.758] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0115.758] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0115.758] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0115.758] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0115.758] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0115.758] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0115.758] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0115.758] lstrlenW (lpString="AudioSrv") returned 8 [0115.758] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0115.758] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0115.758] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0115.758] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0115.758] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0115.758] lstrlenW (lpString="BFE") returned 3 [0115.758] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0115.758] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0115.758] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0115.758] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0115.758] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0115.758] lstrlenW (lpString="CryptSvc") returned 8 [0115.758] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0115.758] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0115.758] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0115.758] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0115.758] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0115.758] lstrlenW (lpString="CscService") returned 10 [0115.758] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0115.758] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0115.758] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0115.758] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0115.758] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0115.758] lstrlenW (lpString="DcomLaunch") returned 10 [0115.758] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0115.758] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0115.758] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0115.758] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0115.758] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0115.759] lstrlenW (lpString="Dhcp") returned 4 [0115.759] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0115.759] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0115.759] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0115.759] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0115.759] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0115.759] lstrlenW (lpString="Dnscache") returned 8 [0115.759] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0115.759] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0115.759] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0115.759] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0115.759] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0115.759] lstrlenW (lpString="DPS") returned 3 [0115.759] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0115.759] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0115.759] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0115.759] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0115.759] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0115.759] lstrlenW (lpString="eventlog") returned 8 [0115.759] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0115.759] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0115.759] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0115.759] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0115.759] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0115.759] lstrlenW (lpString="EventSystem") returned 11 [0115.759] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0115.759] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0115.759] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0115.759] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0115.759] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0115.759] lstrlenW (lpString="FontCache") returned 9 [0115.759] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0115.759] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0115.759] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0115.759] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0115.759] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0115.759] lstrlenW (lpString="gpsvc") returned 5 [0115.759] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0115.760] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0115.760] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0115.760] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0115.760] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0115.760] lstrlenW (lpString="iphlpsvc") returned 8 [0115.760] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0115.760] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0115.760] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0115.760] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0115.760] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0115.760] lstrlenW (lpString="LanmanServer") returned 12 [0115.760] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0115.760] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0115.760] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0115.760] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0115.760] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0115.760] lstrlenW (lpString="LanmanWorkstation") returned 17 [0115.760] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0115.760] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0115.760] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0115.760] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0115.760] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0115.760] lstrlenW (lpString="lmhosts") returned 7 [0115.760] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0115.760] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0115.760] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0115.760] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0115.760] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0115.760] lstrlenW (lpString="MMCSS") returned 5 [0115.760] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0115.760] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0115.760] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0115.760] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0115.760] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0115.760] lstrlenW (lpString="MpsSvc") returned 6 [0115.760] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0115.760] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0115.760] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0115.760] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0115.761] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0115.761] lstrlenW (lpString="Netman") returned 6 [0115.761] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0115.761] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0115.761] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0115.761] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0115.761] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0115.761] lstrlenW (lpString="netprofm") returned 8 [0115.761] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0115.761] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0115.761] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0115.761] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0115.761] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0115.761] lstrlenW (lpString="NlaSvc") returned 6 [0115.761] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0115.761] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0115.761] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0115.761] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0115.761] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0115.761] lstrlenW (lpString="nsi") returned 3 [0115.761] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0115.761] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0115.761] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0115.761] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0115.761] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0115.761] lstrlenW (lpString="PcaSvc") returned 6 [0115.761] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0115.761] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0115.761] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0115.761] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0115.761] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0115.761] lstrlenW (lpString="PlugPlay") returned 8 [0115.761] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0115.761] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0115.761] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0115.761] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0115.761] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0115.761] lstrlenW (lpString="Power") returned 5 [0115.761] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0115.762] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0115.762] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0115.762] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0115.762] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0115.762] lstrlenW (lpString="ProfSvc") returned 7 [0115.762] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0115.762] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0115.762] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0115.762] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0115.762] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0115.762] lstrlenW (lpString="RpcEptMapper") returned 12 [0115.762] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0115.762] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0115.762] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0115.762] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0115.762] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0115.762] lstrlenW (lpString="RpcSs") returned 5 [0115.762] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0115.762] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0115.762] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0115.762] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0115.762] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0115.762] lstrlenW (lpString="SamSs") returned 5 [0115.762] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0115.762] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0115.762] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0115.762] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0115.762] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0115.762] lstrlenW (lpString="Schedule") returned 8 [0115.762] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0115.762] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0115.762] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0115.762] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0115.762] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0115.762] lstrlenW (lpString="SENS") returned 4 [0115.762] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0115.762] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0115.762] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0115.763] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0115.763] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0115.763] lstrlenW (lpString="ShellHWDetection") returned 16 [0115.763] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0115.763] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0115.763] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0115.763] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0115.763] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0115.763] lstrlenW (lpString="Spooler") returned 7 [0115.763] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0115.763] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0115.763] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0115.763] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0115.763] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0115.763] lstrlenW (lpString="sppsvc") returned 6 [0115.763] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="sppsvc") returned -1 [0115.763] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="sppsvc") returned -1 [0115.763] lstrcmpiW (lpString1="sqlwriter", lpString2="sppsvc") returned 1 [0115.763] lstrcmpiW (lpString1="mssqlserver", lpString2="sppsvc") returned -1 [0115.763] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="sppsvc") returned 1 [0115.763] lstrlenW (lpString="SysMain") returned 7 [0115.763] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0115.763] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0115.763] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0115.763] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0115.763] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0115.763] lstrlenW (lpString="Themes") returned 6 [0115.763] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0115.763] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0115.763] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0115.763] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0115.763] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0115.763] lstrlenW (lpString="TrkWks") returned 6 [0115.763] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0115.763] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0115.763] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0115.763] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0115.763] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0115.764] lstrlenW (lpString="UxSms") returned 5 [0115.764] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0115.764] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0115.764] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0115.764] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0115.764] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0115.764] lstrlenW (lpString="VSS") returned 3 [0115.764] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0115.764] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0115.764] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0115.764] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0115.764] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0115.764] lstrlenW (lpString="W32Time") returned 7 [0115.764] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="W32Time") returned -1 [0115.764] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="W32Time") returned -1 [0115.764] lstrcmpiW (lpString1="sqlwriter", lpString2="W32Time") returned -1 [0115.764] lstrcmpiW (lpString1="mssqlserver", lpString2="W32Time") returned -1 [0115.764] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="W32Time") returned -1 [0115.764] lstrlenW (lpString="WdiServiceHost") returned 14 [0115.764] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0115.764] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0115.764] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0115.764] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0115.764] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0115.764] lstrlenW (lpString="WdiSystemHost") returned 13 [0115.764] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0115.764] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0115.764] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0115.764] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0115.764] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0115.764] lstrlenW (lpString="WinDefend") returned 9 [0115.764] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinDefend") returned -1 [0115.764] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinDefend") returned -1 [0115.764] lstrcmpiW (lpString1="sqlwriter", lpString2="WinDefend") returned -1 [0115.764] lstrcmpiW (lpString1="mssqlserver", lpString2="WinDefend") returned -1 [0115.764] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinDefend") returned -1 [0115.764] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0115.765] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0115.765] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0115.765] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0115.765] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0115.765] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0115.765] lstrlenW (lpString="Winmgmt") returned 7 [0115.765] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0115.765] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0115.765] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0115.765] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0115.765] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0115.765] lstrlenW (lpString="wscsvc") returned 6 [0115.765] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wscsvc") returned -1 [0115.765] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wscsvc") returned -1 [0115.765] lstrcmpiW (lpString1="sqlwriter", lpString2="wscsvc") returned -1 [0115.765] lstrcmpiW (lpString1="mssqlserver", lpString2="wscsvc") returned -1 [0115.765] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wscsvc") returned -1 [0115.765] lstrlenW (lpString="wuauserv") returned 8 [0115.765] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wuauserv") returned -1 [0115.765] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wuauserv") returned -1 [0115.765] lstrcmpiW (lpString1="sqlwriter", lpString2="wuauserv") returned -1 [0115.765] lstrcmpiW (lpString1="mssqlserver", lpString2="wuauserv") returned -1 [0115.765] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wuauserv") returned -1 [0115.765] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1fc [0115.767] Process32FirstW (in: hSnapshot=0x1fc, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0115.768] Process32NextW (in: hSnapshot=0x1fc, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0115.768] lstrlenW (lpString="System") returned 6 [0115.768] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0115.768] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0115.768] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0115.768] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0115.768] Process32NextW (in: hSnapshot=0x1fc, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0115.769] lstrlenW (lpString="smss.exe") returned 8 [0115.769] Process32NextW (in: hSnapshot=0x1fc, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0115.770] lstrlenW (lpString="csrss.exe") returned 9 [0115.770] Process32NextW (in: hSnapshot=0x1fc, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0115.770] lstrlenW (lpString="wininit.exe") returned 11 [0115.770] Process32NextW (in: hSnapshot=0x1fc, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0115.771] lstrlenW (lpString="csrss.exe") returned 9 [0115.771] Process32NextW (in: hSnapshot=0x1fc, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0115.772] lstrlenW (lpString="winlogon.exe") returned 12 [0115.772] Process32NextW (in: hSnapshot=0x1fc, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0115.772] lstrlenW (lpString="services.exe") returned 12 [0115.772] Process32NextW (in: hSnapshot=0x1fc, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0115.773] lstrlenW (lpString="lsass.exe") returned 9 [0115.773] Process32NextW (in: hSnapshot=0x1fc, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0115.773] lstrlenW (lpString="lsm.exe") returned 7 [0115.773] Process32NextW (in: hSnapshot=0x1fc, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0115.774] lstrlenW (lpString="svchost.exe") returned 11 [0115.774] Process32NextW (in: hSnapshot=0x1fc, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0115.783] lstrlenW (lpString="svchost.exe") returned 11 [0115.783] Process32NextW (in: hSnapshot=0x1fc, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0115.783] lstrlenW (lpString="svchost.exe") returned 11 [0115.783] Process32NextW (in: hSnapshot=0x1fc, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0115.784] lstrlenW (lpString="svchost.exe") returned 11 [0115.784] Process32NextW (in: hSnapshot=0x1fc, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x23, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0115.785] lstrlenW (lpString="svchost.exe") returned 11 [0115.785] Process32NextW (in: hSnapshot=0x1fc, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0115.785] lstrlenW (lpString="audiodg.exe") returned 11 [0115.785] Process32NextW (in: hSnapshot=0x1fc, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0115.786] lstrlenW (lpString="svchost.exe") returned 11 [0115.786] Process32NextW (in: hSnapshot=0x1fc, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0115.787] lstrlenW (lpString="svchost.exe") returned 11 [0115.787] Process32NextW (in: hSnapshot=0x1fc, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0115.787] lstrlenW (lpString="spoolsv.exe") returned 11 [0115.787] Process32NextW (in: hSnapshot=0x1fc, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0115.788] lstrlenW (lpString="svchost.exe") returned 11 [0115.788] Process32NextW (in: hSnapshot=0x1fc, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0115.788] lstrlenW (lpString="taskhost.exe") returned 12 [0115.788] Process32NextW (in: hSnapshot=0x1fc, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x558, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0115.789] lstrlenW (lpString="dwm.exe") returned 7 [0115.789] Process32NextW (in: hSnapshot=0x1fc, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x54c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0115.790] lstrlenW (lpString="explorer.exe") returned 12 [0115.790] Process32NextW (in: hSnapshot=0x1fc, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0115.790] lstrlenW (lpString="taskeng.exe") returned 11 [0115.790] Process32NextW (in: hSnapshot=0x1fc, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0115.791] lstrlenW (lpString="taskhost.exe") returned 12 [0115.791] Process32NextW (in: hSnapshot=0x1fc, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="watches-vessel-arbitrary.exe")) returned 1 [0115.791] lstrlenW (lpString="watches-vessel-arbitrary.exe") returned 28 [0115.791] Process32NextW (in: hSnapshot=0x1fc, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="alsopound.exe")) returned 1 [0115.793] lstrlenW (lpString="alsopound.exe") returned 13 [0115.794] Process32NextW (in: hSnapshot=0x1fc, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x478, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="measuredamsterdamsandwich.exe")) returned 1 [0115.794] lstrlenW (lpString="measuredamsterdamsandwich.exe") returned 29 [0115.794] Process32NextW (in: hSnapshot=0x1fc, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="ooo_lucy_millions.exe")) returned 1 [0115.795] lstrlenW (lpString="ooo_lucy_millions.exe") returned 21 [0115.795] Process32NextW (in: hSnapshot=0x1fc, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="appearance.exe")) returned 1 [0115.795] lstrlenW (lpString="appearance.exe") returned 14 [0115.795] Process32NextW (in: hSnapshot=0x1fc, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="albert.exe")) returned 1 [0115.796] lstrlenW (lpString="albert.exe") returned 10 [0115.796] Process32NextW (in: hSnapshot=0x1fc, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="implied-enquiries.exe")) returned 1 [0115.797] lstrlenW (lpString="implied-enquiries.exe") returned 21 [0115.797] Process32NextW (in: hSnapshot=0x1fc, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x72c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="boston_opening.exe")) returned 1 [0115.797] lstrlenW (lpString="boston_opening.exe") returned 18 [0115.797] Process32NextW (in: hSnapshot=0x1fc, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="portsmouth.exe")) returned 1 [0115.798] lstrlenW (lpString="portsmouth.exe") returned 14 [0115.798] Process32NextW (in: hSnapshot=0x1fc, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="cameras grew poverty.exe")) returned 1 [0115.798] lstrlenW (lpString="cameras grew poverty.exe") returned 24 [0115.798] Process32NextW (in: hSnapshot=0x1fc, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="dxrapids.exe")) returned 1 [0115.977] lstrlenW (lpString="dxrapids.exe") returned 12 [0115.977] Process32NextW (in: hSnapshot=0x1fc, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x33c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="visitors.exe")) returned 1 [0115.978] lstrlenW (lpString="visitors.exe") returned 12 [0115.978] Process32NextW (in: hSnapshot=0x1fc, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="organisations_officially.exe")) returned 1 [0115.978] lstrlenW (lpString="organisations_officially.exe") returned 28 [0115.978] Process32NextW (in: hSnapshot=0x1fc, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x61c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="pair.exe")) returned 1 [0115.979] lstrlenW (lpString="pair.exe") returned 8 [0115.979] Process32NextW (in: hSnapshot=0x1fc, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="gross.exe")) returned 1 [0115.979] lstrlenW (lpString="gross.exe") returned 9 [0115.979] Process32NextW (in: hSnapshot=0x1fc, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x470, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="viewpicture.exe")) returned 1 [0115.980] lstrlenW (lpString="viewpicture.exe") returned 15 [0115.980] Process32NextW (in: hSnapshot=0x1fc, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="transmitted.exe")) returned 1 [0115.980] lstrlenW (lpString="transmitted.exe") returned 15 [0115.980] Process32NextW (in: hSnapshot=0x1fc, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x634, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="sunglassescelebs.exe")) returned 1 [0115.981] lstrlenW (lpString="sunglassescelebs.exe") returned 20 [0115.981] Process32NextW (in: hSnapshot=0x1fc, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="waiver-issue.exe")) returned 1 [0115.981] lstrlenW (lpString="waiver-issue.exe") returned 16 [0115.981] Process32NextW (in: hSnapshot=0x1fc, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x808, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="gziprear.exe")) returned 1 [0115.982] lstrlenW (lpString="gziprear.exe") returned 12 [0115.982] Process32NextW (in: hSnapshot=0x1fc, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x818, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="gregoryletters.exe")) returned 1 [0115.982] lstrlenW (lpString="gregoryletters.exe") returned 18 [0115.982] Process32NextW (in: hSnapshot=0x1fc, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x828, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="intel-metadata-rich.exe")) returned 1 [0115.983] lstrlenW (lpString="intel-metadata-rich.exe") returned 23 [0115.983] Process32NextW (in: hSnapshot=0x1fc, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x838, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="cemeteryreconstructiondimension.exe")) returned 1 [0115.983] lstrlenW (lpString="cemeteryreconstructiondimension.exe") returned 35 [0115.983] Process32NextW (in: hSnapshot=0x1fc, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0115.984] lstrlenW (lpString="svchost.exe") returned 11 [0115.984] Process32NextW (in: hSnapshot=0x1fc, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0115.985] lstrlenW (lpString="sppsvc.exe") returned 10 [0115.985] Process32NextW (in: hSnapshot=0x1fc, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xab4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0115.985] lstrlenW (lpString="svchost.exe") returned 11 [0115.985] Process32NextW (in: hSnapshot=0x1fc, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x9f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="unlikexpc.exe")) returned 1 [0115.986] lstrlenW (lpString="unlikexpc.exe") returned 13 [0115.986] Process32NextW (in: hSnapshot=0x1fc, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xb58, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0115.986] lstrlenW (lpString="cmd.exe") returned 7 [0115.986] Process32NextW (in: hSnapshot=0x1fc, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0115.987] lstrlenW (lpString="conhost.exe") returned 11 [0115.987] Process32NextW (in: hSnapshot=0x1fc, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xb74, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0115.987] lstrlenW (lpString="vssadmin.exe") returned 12 [0115.987] Process32NextW (in: hSnapshot=0x1fc, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0115.987] lstrlenW (lpString="VSSVC.exe") returned 9 [0115.988] Process32NextW (in: hSnapshot=0x1fc, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 0 [0115.988] CloseHandle (hObject=0x1fc) returned 1 [0115.988] Sleep (dwMilliseconds=0x1f4) [0116.510] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x8199d0 [0116.513] EnumServicesStatusExW (in: hSCManager=0x8199d0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x247fa74, lpServicesReturned=0x247fa8c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x247fa74, lpServicesReturned=0x247fa8c, lpResumeHandle=0x0) returned 0 [0116.514] GetLastError () returned 0xea [0116.514] EnumServicesStatusExW (in: hSCManager=0x8199d0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x815298, cbBufSize=0x13fc, pcbBytesNeeded=0x247fa74, lpServicesReturned=0x247fa8c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x815298, pcbBytesNeeded=0x247fa74, lpServicesReturned=0x247fa8c, lpResumeHandle=0x0) returned 1 [0116.514] CloseServiceHandle (hSCObject=0x8199d0) returned 1 [0116.514] lstrlenW (lpString="Appinfo") returned 7 [0116.514] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0116.514] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0116.514] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0116.514] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0116.514] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0116.514] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0116.514] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0116.514] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0116.514] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0116.514] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0116.514] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0116.514] lstrlenW (lpString="AudioSrv") returned 8 [0116.514] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0116.514] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0116.514] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0116.514] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0116.515] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0116.515] lstrlenW (lpString="BFE") returned 3 [0116.515] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0116.515] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0116.515] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0116.515] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0116.515] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0116.515] lstrlenW (lpString="CryptSvc") returned 8 [0116.515] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0116.515] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0116.515] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0116.515] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0116.515] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0116.515] lstrlenW (lpString="CscService") returned 10 [0116.515] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0116.515] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0116.515] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0116.515] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0116.515] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0116.515] lstrlenW (lpString="DcomLaunch") returned 10 [0116.515] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0116.515] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0116.515] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0116.515] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0116.515] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0116.515] lstrlenW (lpString="Dhcp") returned 4 [0116.515] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0116.515] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0116.515] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0116.515] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0116.515] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0116.515] lstrlenW (lpString="Dnscache") returned 8 [0116.515] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0116.515] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0116.515] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0116.515] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0116.515] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0116.515] lstrlenW (lpString="DPS") returned 3 [0116.515] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0116.515] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0116.515] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0116.515] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0116.515] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0116.515] lstrlenW (lpString="eventlog") returned 8 [0116.515] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0116.515] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0116.515] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0116.515] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0116.515] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0116.516] lstrlenW (lpString="EventSystem") returned 11 [0116.516] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0116.516] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0116.516] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0116.516] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0116.516] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0116.516] lstrlenW (lpString="FontCache") returned 9 [0116.516] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0116.516] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0116.516] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0116.516] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0116.516] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0116.516] lstrlenW (lpString="gpsvc") returned 5 [0116.516] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0116.516] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0116.516] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0116.516] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0116.516] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0116.516] lstrlenW (lpString="iphlpsvc") returned 8 [0116.516] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0116.516] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0116.516] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0116.516] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0116.516] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0116.516] lstrlenW (lpString="LanmanServer") returned 12 [0116.516] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0116.516] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0116.516] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0116.516] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0116.516] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0116.516] lstrlenW (lpString="LanmanWorkstation") returned 17 [0116.516] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0116.516] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0116.516] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0116.516] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0116.516] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0116.516] lstrlenW (lpString="lmhosts") returned 7 [0116.516] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0116.516] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0116.516] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0116.516] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0116.516] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0116.516] lstrlenW (lpString="MMCSS") returned 5 [0116.516] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0116.516] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0116.516] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0116.516] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0116.516] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0116.517] lstrlenW (lpString="MpsSvc") returned 6 [0116.517] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0116.517] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0116.517] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0116.517] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0116.517] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0116.517] lstrlenW (lpString="Netman") returned 6 [0116.517] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0116.517] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0116.517] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0116.517] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0116.517] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0116.517] lstrlenW (lpString="netprofm") returned 8 [0116.517] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0116.517] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0116.517] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0116.517] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0116.517] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0116.517] lstrlenW (lpString="NlaSvc") returned 6 [0116.517] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0116.517] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0116.517] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0116.517] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0116.517] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0116.517] lstrlenW (lpString="nsi") returned 3 [0116.517] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0116.517] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0116.517] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0116.517] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0116.517] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0116.517] lstrlenW (lpString="PcaSvc") returned 6 [0116.517] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0116.517] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0116.517] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0116.517] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0116.517] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0116.517] lstrlenW (lpString="PlugPlay") returned 8 [0116.517] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0116.517] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0116.517] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0116.517] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0116.517] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0116.517] lstrlenW (lpString="Power") returned 5 [0116.517] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0116.517] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0116.517] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0116.517] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0116.517] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0116.518] lstrlenW (lpString="ProfSvc") returned 7 [0116.518] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0116.518] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0116.518] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0116.518] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0116.518] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0116.518] lstrlenW (lpString="RpcEptMapper") returned 12 [0116.518] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0116.518] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0116.518] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0116.518] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0116.518] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0116.518] lstrlenW (lpString="RpcSs") returned 5 [0116.518] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0116.518] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0116.518] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0116.518] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0116.518] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0116.518] lstrlenW (lpString="SamSs") returned 5 [0116.518] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0116.518] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0116.518] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0116.518] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0116.518] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0116.518] lstrlenW (lpString="Schedule") returned 8 [0116.518] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0116.518] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0116.518] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0116.518] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0116.518] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0116.518] lstrlenW (lpString="SENS") returned 4 [0116.518] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0116.518] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0116.518] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0116.518] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0116.518] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0116.518] lstrlenW (lpString="ShellHWDetection") returned 16 [0116.518] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0116.518] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0116.518] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0116.518] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0116.518] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0116.518] lstrlenW (lpString="Spooler") returned 7 [0116.518] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0116.518] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0116.518] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0116.518] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0116.518] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0116.518] lstrlenW (lpString="sppsvc") returned 6 [0116.519] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="sppsvc") returned -1 [0116.519] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="sppsvc") returned -1 [0116.519] lstrcmpiW (lpString1="sqlwriter", lpString2="sppsvc") returned 1 [0116.519] lstrcmpiW (lpString1="mssqlserver", lpString2="sppsvc") returned -1 [0116.519] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="sppsvc") returned 1 [0116.519] lstrlenW (lpString="SysMain") returned 7 [0116.519] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0116.519] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0116.519] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0116.519] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0116.519] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0116.519] lstrlenW (lpString="Themes") returned 6 [0116.519] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0116.519] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0116.519] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0116.519] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0116.519] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0116.519] lstrlenW (lpString="TrkWks") returned 6 [0116.519] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0116.519] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0116.519] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0116.519] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0116.519] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0116.519] lstrlenW (lpString="UxSms") returned 5 [0116.519] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0116.519] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0116.519] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0116.519] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0116.519] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0116.519] lstrlenW (lpString="VSS") returned 3 [0116.519] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0116.519] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0116.519] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0116.519] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0116.519] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0116.519] lstrlenW (lpString="W32Time") returned 7 [0116.519] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="W32Time") returned -1 [0116.519] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="W32Time") returned -1 [0116.519] lstrcmpiW (lpString1="sqlwriter", lpString2="W32Time") returned -1 [0116.519] lstrcmpiW (lpString1="mssqlserver", lpString2="W32Time") returned -1 [0116.520] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="W32Time") returned -1 [0116.520] lstrlenW (lpString="WdiServiceHost") returned 14 [0116.520] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0116.520] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0116.520] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0116.520] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0116.520] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0116.520] lstrlenW (lpString="WdiSystemHost") returned 13 [0116.520] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0116.520] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0116.520] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0116.520] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0116.520] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0116.520] lstrlenW (lpString="WinDefend") returned 9 [0116.520] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinDefend") returned -1 [0116.520] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinDefend") returned -1 [0116.520] lstrcmpiW (lpString1="sqlwriter", lpString2="WinDefend") returned -1 [0116.520] lstrcmpiW (lpString1="mssqlserver", lpString2="WinDefend") returned -1 [0116.520] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinDefend") returned -1 [0116.520] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0116.520] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0116.520] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0116.520] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0116.520] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0116.520] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0116.520] lstrlenW (lpString="Winmgmt") returned 7 [0116.520] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0116.520] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0116.520] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0116.520] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0116.520] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0116.520] lstrlenW (lpString="wscsvc") returned 6 [0116.520] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wscsvc") returned -1 [0116.520] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wscsvc") returned -1 [0116.520] lstrcmpiW (lpString1="sqlwriter", lpString2="wscsvc") returned -1 [0116.520] lstrcmpiW (lpString1="mssqlserver", lpString2="wscsvc") returned -1 [0116.520] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wscsvc") returned -1 [0116.520] lstrlenW (lpString="wuauserv") returned 8 [0116.520] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wuauserv") returned -1 [0116.520] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wuauserv") returned -1 [0116.520] lstrcmpiW (lpString1="sqlwriter", lpString2="wuauserv") returned -1 [0116.520] lstrcmpiW (lpString1="mssqlserver", lpString2="wuauserv") returned -1 [0116.520] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wuauserv") returned -1 [0116.520] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x16c [0116.522] Process32FirstW (in: hSnapshot=0x16c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0116.523] Process32NextW (in: hSnapshot=0x16c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0116.523] lstrlenW (lpString="System") returned 6 [0116.523] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0116.523] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0116.523] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0116.523] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0116.523] Process32NextW (in: hSnapshot=0x16c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0116.524] lstrlenW (lpString="smss.exe") returned 8 [0116.524] Process32NextW (in: hSnapshot=0x16c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0116.524] lstrlenW (lpString="csrss.exe") returned 9 [0116.524] Process32NextW (in: hSnapshot=0x16c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0116.525] lstrlenW (lpString="wininit.exe") returned 11 [0116.525] Process32NextW (in: hSnapshot=0x16c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0116.525] lstrlenW (lpString="csrss.exe") returned 9 [0116.525] Process32NextW (in: hSnapshot=0x16c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0116.526] lstrlenW (lpString="winlogon.exe") returned 12 [0116.526] Process32NextW (in: hSnapshot=0x16c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0116.526] lstrlenW (lpString="services.exe") returned 12 [0116.526] Process32NextW (in: hSnapshot=0x16c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0116.527] lstrlenW (lpString="lsass.exe") returned 9 [0116.527] Process32NextW (in: hSnapshot=0x16c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0116.527] lstrlenW (lpString="lsm.exe") returned 7 [0116.527] Process32NextW (in: hSnapshot=0x16c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0116.528] lstrlenW (lpString="svchost.exe") returned 11 [0116.528] Process32NextW (in: hSnapshot=0x16c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0116.528] lstrlenW (lpString="svchost.exe") returned 11 [0116.528] Process32NextW (in: hSnapshot=0x16c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0116.529] lstrlenW (lpString="svchost.exe") returned 11 [0116.529] Process32NextW (in: hSnapshot=0x16c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0116.529] lstrlenW (lpString="svchost.exe") returned 11 [0116.529] Process32NextW (in: hSnapshot=0x16c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x23, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0116.529] lstrlenW (lpString="svchost.exe") returned 11 [0116.529] Process32NextW (in: hSnapshot=0x16c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0116.530] lstrlenW (lpString="audiodg.exe") returned 11 [0116.530] Process32NextW (in: hSnapshot=0x16c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0116.530] lstrlenW (lpString="svchost.exe") returned 11 [0116.530] Process32NextW (in: hSnapshot=0x16c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0116.531] lstrlenW (lpString="svchost.exe") returned 11 [0116.531] Process32NextW (in: hSnapshot=0x16c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0116.531] lstrlenW (lpString="spoolsv.exe") returned 11 [0116.531] Process32NextW (in: hSnapshot=0x16c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0116.532] lstrlenW (lpString="svchost.exe") returned 11 [0116.532] Process32NextW (in: hSnapshot=0x16c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0116.532] lstrlenW (lpString="taskhost.exe") returned 12 [0116.532] Process32NextW (in: hSnapshot=0x16c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x558, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0116.533] lstrlenW (lpString="dwm.exe") returned 7 [0116.533] Process32NextW (in: hSnapshot=0x16c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x54c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0116.533] lstrlenW (lpString="explorer.exe") returned 12 [0116.533] Process32NextW (in: hSnapshot=0x16c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0116.533] lstrlenW (lpString="taskeng.exe") returned 11 [0116.533] Process32NextW (in: hSnapshot=0x16c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0116.534] lstrlenW (lpString="taskhost.exe") returned 12 [0116.534] Process32NextW (in: hSnapshot=0x16c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="watches-vessel-arbitrary.exe")) returned 1 [0116.534] lstrlenW (lpString="watches-vessel-arbitrary.exe") returned 28 [0116.534] Process32NextW (in: hSnapshot=0x16c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="alsopound.exe")) returned 1 [0116.535] lstrlenW (lpString="alsopound.exe") returned 13 [0116.535] Process32NextW (in: hSnapshot=0x16c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x478, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="measuredamsterdamsandwich.exe")) returned 1 [0116.535] lstrlenW (lpString="measuredamsterdamsandwich.exe") returned 29 [0116.535] Process32NextW (in: hSnapshot=0x16c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="ooo_lucy_millions.exe")) returned 1 [0116.536] lstrlenW (lpString="ooo_lucy_millions.exe") returned 21 [0116.536] Process32NextW (in: hSnapshot=0x16c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="appearance.exe")) returned 1 [0116.536] lstrlenW (lpString="appearance.exe") returned 14 [0116.536] Process32NextW (in: hSnapshot=0x16c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="albert.exe")) returned 1 [0116.537] lstrlenW (lpString="albert.exe") returned 10 [0116.537] Process32NextW (in: hSnapshot=0x16c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="implied-enquiries.exe")) returned 1 [0116.537] lstrlenW (lpString="implied-enquiries.exe") returned 21 [0116.537] Process32NextW (in: hSnapshot=0x16c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x72c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="boston_opening.exe")) returned 1 [0116.538] lstrlenW (lpString="boston_opening.exe") returned 18 [0116.538] Process32NextW (in: hSnapshot=0x16c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="portsmouth.exe")) returned 1 [0116.538] lstrlenW (lpString="portsmouth.exe") returned 14 [0116.538] Process32NextW (in: hSnapshot=0x16c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="cameras grew poverty.exe")) returned 1 [0116.539] lstrlenW (lpString="cameras grew poverty.exe") returned 24 [0116.539] Process32NextW (in: hSnapshot=0x16c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="dxrapids.exe")) returned 1 [0116.539] lstrlenW (lpString="dxrapids.exe") returned 12 [0116.539] Process32NextW (in: hSnapshot=0x16c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x33c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="visitors.exe")) returned 1 [0116.539] lstrlenW (lpString="visitors.exe") returned 12 [0116.540] Process32NextW (in: hSnapshot=0x16c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="organisations_officially.exe")) returned 1 [0116.540] lstrlenW (lpString="organisations_officially.exe") returned 28 [0116.540] Process32NextW (in: hSnapshot=0x16c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x61c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="pair.exe")) returned 1 [0116.540] lstrlenW (lpString="pair.exe") returned 8 [0116.540] Process32NextW (in: hSnapshot=0x16c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="gross.exe")) returned 1 [0116.541] lstrlenW (lpString="gross.exe") returned 9 [0116.541] Process32NextW (in: hSnapshot=0x16c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x470, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="viewpicture.exe")) returned 1 [0116.541] lstrlenW (lpString="viewpicture.exe") returned 15 [0116.541] Process32NextW (in: hSnapshot=0x16c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="transmitted.exe")) returned 1 [0116.542] lstrlenW (lpString="transmitted.exe") returned 15 [0116.542] Process32NextW (in: hSnapshot=0x16c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x634, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="sunglassescelebs.exe")) returned 1 [0116.542] lstrlenW (lpString="sunglassescelebs.exe") returned 20 [0116.542] Process32NextW (in: hSnapshot=0x16c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="waiver-issue.exe")) returned 1 [0116.543] lstrlenW (lpString="waiver-issue.exe") returned 16 [0116.543] Process32NextW (in: hSnapshot=0x16c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x808, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="gziprear.exe")) returned 1 [0116.543] lstrlenW (lpString="gziprear.exe") returned 12 [0116.543] Process32NextW (in: hSnapshot=0x16c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x818, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="gregoryletters.exe")) returned 1 [0116.543] lstrlenW (lpString="gregoryletters.exe") returned 18 [0116.544] Process32NextW (in: hSnapshot=0x16c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x828, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="intel-metadata-rich.exe")) returned 1 [0116.544] lstrlenW (lpString="intel-metadata-rich.exe") returned 23 [0116.544] Process32NextW (in: hSnapshot=0x16c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x838, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="cemeteryreconstructiondimension.exe")) returned 1 [0116.544] lstrlenW (lpString="cemeteryreconstructiondimension.exe") returned 35 [0116.544] Process32NextW (in: hSnapshot=0x16c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0116.545] lstrlenW (lpString="svchost.exe") returned 11 [0116.545] Process32NextW (in: hSnapshot=0x16c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0116.545] lstrlenW (lpString="sppsvc.exe") returned 10 [0116.545] Process32NextW (in: hSnapshot=0x16c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xab4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0116.546] lstrlenW (lpString="svchost.exe") returned 11 [0116.546] Process32NextW (in: hSnapshot=0x16c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x9f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="unlikexpc.exe")) returned 1 [0116.546] lstrlenW (lpString="unlikexpc.exe") returned 13 [0116.546] Process32NextW (in: hSnapshot=0x16c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xb58, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0116.547] lstrlenW (lpString="cmd.exe") returned 7 [0116.547] Process32NextW (in: hSnapshot=0x16c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0116.547] lstrlenW (lpString="conhost.exe") returned 11 [0116.547] Process32NextW (in: hSnapshot=0x16c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xb74, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0116.547] lstrlenW (lpString="vssadmin.exe") returned 12 [0116.548] Process32NextW (in: hSnapshot=0x16c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0116.548] lstrlenW (lpString="VSSVC.exe") returned 9 [0116.548] Process32NextW (in: hSnapshot=0x16c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 0 [0116.548] CloseHandle (hObject=0x16c) returned 1 [0116.549] Sleep (dwMilliseconds=0x1f4) [0117.607] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x8199d0 [0117.607] EnumServicesStatusExW (in: hSCManager=0x8199d0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x247fa74, lpServicesReturned=0x247fa8c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x247fa74, lpServicesReturned=0x247fa8c, lpResumeHandle=0x0) returned 0 [0117.607] GetLastError () returned 0xea [0117.608] EnumServicesStatusExW (in: hSCManager=0x8199d0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x8b48e0, cbBufSize=0x1484, pcbBytesNeeded=0x247fa74, lpServicesReturned=0x247fa8c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x8b48e0, pcbBytesNeeded=0x247fa74, lpServicesReturned=0x247fa8c, lpResumeHandle=0x0) returned 1 [0117.608] CloseServiceHandle (hSCObject=0x8199d0) returned 1 [0117.608] lstrlenW (lpString="Appinfo") returned 7 [0117.608] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0117.608] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0117.608] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0117.608] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0117.608] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0117.608] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0117.608] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0117.608] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0117.608] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0117.608] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0117.608] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0117.608] lstrlenW (lpString="AudioSrv") returned 8 [0117.608] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0117.608] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0117.608] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0117.609] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0117.609] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0117.609] lstrlenW (lpString="BFE") returned 3 [0117.609] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0117.609] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0117.609] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0117.609] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0117.609] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0117.609] lstrlenW (lpString="CryptSvc") returned 8 [0117.609] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0117.609] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0117.609] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0117.609] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0117.609] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0117.609] lstrlenW (lpString="CscService") returned 10 [0117.609] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0117.609] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0117.609] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0117.609] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0117.609] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0117.609] lstrlenW (lpString="DcomLaunch") returned 10 [0117.609] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0117.609] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0117.609] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0117.609] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0117.609] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0117.609] lstrlenW (lpString="Dhcp") returned 4 [0117.609] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0117.609] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0117.609] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0117.609] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0117.609] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0117.609] lstrlenW (lpString="Dnscache") returned 8 [0117.609] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0117.609] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0117.609] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0117.609] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0117.609] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0117.609] lstrlenW (lpString="DPS") returned 3 [0117.609] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0117.609] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0117.609] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0117.609] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0117.609] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0117.609] lstrlenW (lpString="eventlog") returned 8 [0117.609] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0117.609] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0117.609] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0117.609] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0117.609] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0117.610] lstrlenW (lpString="EventSystem") returned 11 [0117.610] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0117.610] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0117.610] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0117.610] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0117.610] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0117.610] lstrlenW (lpString="FontCache") returned 9 [0117.610] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0117.610] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0117.610] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0117.610] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0117.610] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0117.610] lstrlenW (lpString="gpsvc") returned 5 [0117.610] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0117.610] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0117.610] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0117.610] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0117.610] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0117.610] lstrlenW (lpString="iphlpsvc") returned 8 [0117.610] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0117.610] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0117.610] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0117.610] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0117.610] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0117.610] lstrlenW (lpString="LanmanServer") returned 12 [0117.610] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0117.610] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0117.610] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0117.610] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0117.610] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0117.610] lstrlenW (lpString="LanmanWorkstation") returned 17 [0117.610] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0117.610] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0117.610] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0117.610] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0117.610] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0117.610] lstrlenW (lpString="lmhosts") returned 7 [0117.610] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0117.610] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0117.610] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0117.610] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0117.610] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0117.610] lstrlenW (lpString="MMCSS") returned 5 [0117.610] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0117.610] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0117.610] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0117.610] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0117.610] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0117.611] lstrlenW (lpString="MpsSvc") returned 6 [0117.611] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0117.611] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0117.611] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0117.611] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0117.611] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0117.611] lstrlenW (lpString="Netman") returned 6 [0117.611] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0117.611] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0117.611] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0117.611] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0117.611] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0117.611] lstrlenW (lpString="netprofm") returned 8 [0117.611] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0117.611] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0117.611] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0117.611] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0117.611] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0117.611] lstrlenW (lpString="NlaSvc") returned 6 [0117.611] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0117.611] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0117.611] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0117.611] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0117.611] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0117.611] lstrlenW (lpString="nsi") returned 3 [0117.611] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0117.611] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0117.611] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0117.611] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0117.611] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0117.611] lstrlenW (lpString="PcaSvc") returned 6 [0117.611] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0117.611] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0117.611] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0117.611] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0117.611] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0117.611] lstrlenW (lpString="PlugPlay") returned 8 [0117.611] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0117.611] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0117.611] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0117.611] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0117.611] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0117.611] lstrlenW (lpString="Power") returned 5 [0117.612] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0117.612] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0117.612] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0117.612] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0117.612] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0117.612] lstrlenW (lpString="ProfSvc") returned 7 [0117.612] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0117.612] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0117.612] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0117.612] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0117.612] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0117.612] lstrlenW (lpString="RpcEptMapper") returned 12 [0117.612] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0117.612] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0117.612] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0117.612] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0117.612] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0117.612] lstrlenW (lpString="RpcSs") returned 5 [0117.612] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0117.612] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0117.612] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0117.612] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0117.612] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0117.612] lstrlenW (lpString="SamSs") returned 5 [0117.612] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0117.612] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0117.612] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0117.612] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0117.612] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0117.612] lstrlenW (lpString="Schedule") returned 8 [0117.612] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0117.612] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0117.612] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0117.612] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0117.612] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0117.612] lstrlenW (lpString="SENS") returned 4 [0117.612] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0117.612] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0117.612] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0117.612] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0117.612] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0117.612] lstrlenW (lpString="ShellHWDetection") returned 16 [0117.612] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0117.612] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0117.612] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0117.612] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0117.612] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0117.612] lstrlenW (lpString="Spooler") returned 7 [0117.612] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0117.613] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0117.613] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0117.613] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0117.613] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0117.613] lstrlenW (lpString="sppsvc") returned 6 [0117.613] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="sppsvc") returned -1 [0117.613] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="sppsvc") returned -1 [0117.613] lstrcmpiW (lpString1="sqlwriter", lpString2="sppsvc") returned 1 [0117.613] lstrcmpiW (lpString1="mssqlserver", lpString2="sppsvc") returned -1 [0117.613] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="sppsvc") returned 1 [0117.613] lstrlenW (lpString="swprv") returned 5 [0117.613] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0117.613] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0117.613] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0117.613] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0117.613] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0117.613] lstrlenW (lpString="SysMain") returned 7 [0117.613] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0117.613] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0117.613] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0117.613] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0117.613] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0117.613] lstrlenW (lpString="Themes") returned 6 [0117.613] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0117.613] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0117.613] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0117.613] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0117.613] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0117.613] lstrlenW (lpString="TrkWks") returned 6 [0117.613] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0117.613] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0117.613] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0117.613] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0117.613] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0117.613] lstrlenW (lpString="UxSms") returned 5 [0117.613] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0117.613] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0117.613] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0117.613] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0117.613] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0117.613] lstrlenW (lpString="VSS") returned 3 [0117.613] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0117.613] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0117.613] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0117.613] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0117.613] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0117.613] lstrlenW (lpString="W32Time") returned 7 [0117.613] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="W32Time") returned -1 [0117.613] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="W32Time") returned -1 [0117.614] lstrcmpiW (lpString1="sqlwriter", lpString2="W32Time") returned -1 [0117.614] lstrcmpiW (lpString1="mssqlserver", lpString2="W32Time") returned -1 [0117.614] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="W32Time") returned -1 [0117.614] lstrlenW (lpString="WdiServiceHost") returned 14 [0117.614] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0117.614] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0117.614] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0117.614] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0117.614] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0117.614] lstrlenW (lpString="WdiSystemHost") returned 13 [0117.614] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0117.614] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0117.614] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0117.614] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0117.614] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0117.614] lstrlenW (lpString="WinDefend") returned 9 [0117.614] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinDefend") returned -1 [0117.614] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinDefend") returned -1 [0117.614] lstrcmpiW (lpString1="sqlwriter", lpString2="WinDefend") returned -1 [0117.614] lstrcmpiW (lpString1="mssqlserver", lpString2="WinDefend") returned -1 [0117.614] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinDefend") returned -1 [0117.614] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0117.614] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0117.614] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0117.614] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0117.614] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0117.614] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0117.614] lstrlenW (lpString="Winmgmt") returned 7 [0117.614] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0117.614] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0117.614] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0117.614] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0117.614] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0117.614] lstrlenW (lpString="wscsvc") returned 6 [0117.614] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wscsvc") returned -1 [0117.614] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wscsvc") returned -1 [0117.614] lstrcmpiW (lpString1="sqlwriter", lpString2="wscsvc") returned -1 [0117.614] lstrcmpiW (lpString1="mssqlserver", lpString2="wscsvc") returned -1 [0117.614] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wscsvc") returned -1 [0117.614] lstrlenW (lpString="wuauserv") returned 8 [0117.614] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wuauserv") returned -1 [0117.614] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wuauserv") returned -1 [0117.614] lstrcmpiW (lpString1="sqlwriter", lpString2="wuauserv") returned -1 [0117.614] lstrcmpiW (lpString1="mssqlserver", lpString2="wuauserv") returned -1 [0117.614] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x208 [0117.616] Process32FirstW (in: hSnapshot=0x208, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0117.616] Process32NextW (in: hSnapshot=0x208, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0117.617] lstrlenW (lpString="System") returned 6 [0117.617] Process32NextW (in: hSnapshot=0x208, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0117.617] lstrlenW (lpString="smss.exe") returned 8 [0117.617] Process32NextW (in: hSnapshot=0x208, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0117.631] lstrlenW (lpString="csrss.exe") returned 9 [0117.631] Process32NextW (in: hSnapshot=0x208, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0117.632] lstrlenW (lpString="wininit.exe") returned 11 [0117.632] Process32NextW (in: hSnapshot=0x208, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0117.632] lstrlenW (lpString="csrss.exe") returned 9 [0117.632] Process32NextW (in: hSnapshot=0x208, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0117.633] lstrlenW (lpString="winlogon.exe") returned 12 [0117.633] Process32NextW (in: hSnapshot=0x208, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0117.633] lstrlenW (lpString="services.exe") returned 12 [0117.633] Process32NextW (in: hSnapshot=0x208, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0117.647] lstrlenW (lpString="lsass.exe") returned 9 [0117.648] Process32NextW (in: hSnapshot=0x208, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0117.648] lstrlenW (lpString="lsm.exe") returned 7 [0117.648] Process32NextW (in: hSnapshot=0x208, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0117.649] lstrlenW (lpString="svchost.exe") returned 11 [0117.649] Process32NextW (in: hSnapshot=0x208, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0117.649] lstrlenW (lpString="svchost.exe") returned 11 [0117.649] Process32NextW (in: hSnapshot=0x208, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0117.649] lstrlenW (lpString="svchost.exe") returned 11 [0117.649] Process32NextW (in: hSnapshot=0x208, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0117.650] lstrlenW (lpString="svchost.exe") returned 11 [0117.650] Process32NextW (in: hSnapshot=0x208, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x23, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0117.650] lstrlenW (lpString="svchost.exe") returned 11 [0117.650] Process32NextW (in: hSnapshot=0x208, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0117.651] lstrlenW (lpString="audiodg.exe") returned 11 [0117.651] Process32NextW (in: hSnapshot=0x208, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0117.651] lstrlenW (lpString="svchost.exe") returned 11 [0117.651] Process32NextW (in: hSnapshot=0x208, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0117.652] lstrlenW (lpString="svchost.exe") returned 11 [0117.652] Process32NextW (in: hSnapshot=0x208, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0117.652] lstrlenW (lpString="spoolsv.exe") returned 11 [0117.652] Process32NextW (in: hSnapshot=0x208, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0117.653] lstrlenW (lpString="svchost.exe") returned 11 [0117.653] Process32NextW (in: hSnapshot=0x208, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0117.653] lstrlenW (lpString="taskhost.exe") returned 12 [0117.653] Process32NextW (in: hSnapshot=0x208, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x558, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0117.653] lstrlenW (lpString="dwm.exe") returned 7 [0117.654] Process32NextW (in: hSnapshot=0x208, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x54c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0117.654] lstrlenW (lpString="explorer.exe") returned 12 [0117.654] Process32NextW (in: hSnapshot=0x208, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0117.654] lstrlenW (lpString="taskeng.exe") returned 11 [0117.654] Process32NextW (in: hSnapshot=0x208, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0117.655] lstrlenW (lpString="taskhost.exe") returned 12 [0117.655] Process32NextW (in: hSnapshot=0x208, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="watches-vessel-arbitrary.exe")) returned 1 [0117.655] lstrlenW (lpString="watches-vessel-arbitrary.exe") returned 28 [0117.655] Process32NextW (in: hSnapshot=0x208, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="alsopound.exe")) returned 1 [0117.656] lstrlenW (lpString="alsopound.exe") returned 13 [0117.656] Process32NextW (in: hSnapshot=0x208, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x478, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="measuredamsterdamsandwich.exe")) returned 1 [0117.656] lstrlenW (lpString="measuredamsterdamsandwich.exe") returned 29 [0117.656] Process32NextW (in: hSnapshot=0x208, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="ooo_lucy_millions.exe")) returned 1 [0117.657] lstrlenW (lpString="ooo_lucy_millions.exe") returned 21 [0117.657] Process32NextW (in: hSnapshot=0x208, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="appearance.exe")) returned 1 [0117.657] lstrlenW (lpString="appearance.exe") returned 14 [0117.657] Process32NextW (in: hSnapshot=0x208, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="albert.exe")) returned 1 [0117.659] lstrlenW (lpString="albert.exe") returned 10 [0117.659] Process32NextW (in: hSnapshot=0x208, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="implied-enquiries.exe")) returned 1 [0117.659] lstrlenW (lpString="implied-enquiries.exe") returned 21 [0117.659] Process32NextW (in: hSnapshot=0x208, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x72c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="boston_opening.exe")) returned 1 [0117.660] lstrlenW (lpString="boston_opening.exe") returned 18 [0117.660] Process32NextW (in: hSnapshot=0x208, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="portsmouth.exe")) returned 1 [0117.660] lstrlenW (lpString="portsmouth.exe") returned 14 [0117.660] Process32NextW (in: hSnapshot=0x208, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="cameras grew poverty.exe")) returned 1 [0117.661] lstrlenW (lpString="cameras grew poverty.exe") returned 24 [0117.661] Process32NextW (in: hSnapshot=0x208, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="dxrapids.exe")) returned 1 [0117.661] lstrlenW (lpString="dxrapids.exe") returned 12 [0117.661] Process32NextW (in: hSnapshot=0x208, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x33c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="visitors.exe")) returned 1 [0117.685] lstrlenW (lpString="visitors.exe") returned 12 [0117.685] Process32NextW (in: hSnapshot=0x208, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="organisations_officially.exe")) returned 1 [0117.686] lstrlenW (lpString="organisations_officially.exe") returned 28 [0117.686] Process32NextW (in: hSnapshot=0x208, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x61c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="pair.exe")) returned 1 [0117.686] lstrlenW (lpString="pair.exe") returned 8 [0117.686] Process32NextW (in: hSnapshot=0x208, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="gross.exe")) returned 1 [0117.686] lstrlenW (lpString="gross.exe") returned 9 [0117.686] Process32NextW (in: hSnapshot=0x208, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x470, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="viewpicture.exe")) returned 1 [0117.687] lstrlenW (lpString="viewpicture.exe") returned 15 [0117.687] Process32NextW (in: hSnapshot=0x208, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="transmitted.exe")) returned 1 [0117.692] lstrlenW (lpString="transmitted.exe") returned 15 [0117.692] Process32NextW (in: hSnapshot=0x208, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x634, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="sunglassescelebs.exe")) returned 1 [0117.693] lstrlenW (lpString="sunglassescelebs.exe") returned 20 [0117.693] Process32NextW (in: hSnapshot=0x208, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="waiver-issue.exe")) returned 1 [0117.693] lstrlenW (lpString="waiver-issue.exe") returned 16 [0117.693] Process32NextW (in: hSnapshot=0x208, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x808, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="gziprear.exe")) returned 1 [0117.694] lstrlenW (lpString="gziprear.exe") returned 12 [0117.694] Process32NextW (in: hSnapshot=0x208, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x818, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="gregoryletters.exe")) returned 1 [0117.694] lstrlenW (lpString="gregoryletters.exe") returned 18 [0117.694] Process32NextW (in: hSnapshot=0x208, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x828, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="intel-metadata-rich.exe")) returned 1 [0117.695] lstrlenW (lpString="intel-metadata-rich.exe") returned 23 [0117.695] Process32NextW (in: hSnapshot=0x208, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x838, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="cemeteryreconstructiondimension.exe")) returned 1 [0117.695] lstrlenW (lpString="cemeteryreconstructiondimension.exe") returned 35 [0117.695] Process32NextW (in: hSnapshot=0x208, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0117.696] lstrlenW (lpString="svchost.exe") returned 11 [0117.696] Process32NextW (in: hSnapshot=0x208, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0117.696] lstrlenW (lpString="sppsvc.exe") returned 10 [0117.696] Process32NextW (in: hSnapshot=0x208, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xab4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0117.856] lstrlenW (lpString="svchost.exe") returned 11 [0117.856] Process32NextW (in: hSnapshot=0x208, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x9f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="unlikexpc.exe")) returned 1 [0117.856] lstrlenW (lpString="unlikexpc.exe") returned 13 [0117.856] Process32NextW (in: hSnapshot=0x208, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xb58, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0117.877] lstrlenW (lpString="cmd.exe") returned 7 [0117.877] Process32NextW (in: hSnapshot=0x208, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0117.877] lstrlenW (lpString="conhost.exe") returned 11 [0117.878] Process32NextW (in: hSnapshot=0x208, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xb74, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0117.878] lstrlenW (lpString="vssadmin.exe") returned 12 [0117.878] Process32NextW (in: hSnapshot=0x208, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0117.878] lstrlenW (lpString="VSSVC.exe") returned 9 [0117.878] Process32NextW (in: hSnapshot=0x208, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x824, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0117.879] lstrlenW (lpString="svchost.exe") returned 11 [0117.879] Process32NextW (in: hSnapshot=0x208, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x824, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0117.879] CloseHandle (hObject=0x208) returned 1 [0117.879] Sleep (dwMilliseconds=0x1f4) [0118.392] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x8199d0 [0118.392] EnumServicesStatusExW (in: hSCManager=0x8199d0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x247fa74, lpServicesReturned=0x247fa8c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x247fa74, lpServicesReturned=0x247fa8c, lpResumeHandle=0x0) returned 0 [0118.392] GetLastError () returned 0xea [0118.393] EnumServicesStatusExW (in: hSCManager=0x8199d0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x8b48e0, cbBufSize=0x1484, pcbBytesNeeded=0x247fa74, lpServicesReturned=0x247fa8c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x8b48e0, pcbBytesNeeded=0x247fa74, lpServicesReturned=0x247fa8c, lpResumeHandle=0x0) returned 1 [0118.393] CloseServiceHandle (hSCObject=0x8199d0) returned 1 [0118.393] lstrlenW (lpString="Appinfo") returned 7 [0118.393] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0118.393] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0118.393] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0118.393] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0118.393] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0118.393] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0118.393] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0118.393] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0118.393] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0118.393] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0118.393] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0118.394] lstrlenW (lpString="AudioSrv") returned 8 [0118.394] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0118.394] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0118.394] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0118.394] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0118.394] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0118.394] lstrlenW (lpString="BFE") returned 3 [0118.394] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0118.394] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0118.394] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0118.394] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0118.394] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0118.394] lstrlenW (lpString="CryptSvc") returned 8 [0118.394] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0118.394] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0118.394] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0118.394] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0118.394] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0118.394] lstrlenW (lpString="CscService") returned 10 [0118.394] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0118.394] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0118.394] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0118.394] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0118.394] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0118.394] lstrlenW (lpString="DcomLaunch") returned 10 [0118.394] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0118.394] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0118.394] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0118.394] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0118.394] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0118.394] lstrlenW (lpString="Dhcp") returned 4 [0118.394] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0118.394] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0118.394] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0118.394] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0118.394] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0118.394] lstrlenW (lpString="Dnscache") returned 8 [0118.395] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0118.395] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0118.395] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0118.395] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0118.395] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0118.395] lstrlenW (lpString="DPS") returned 3 [0118.395] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0118.395] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0118.395] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0118.395] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0118.395] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0118.395] lstrlenW (lpString="eventlog") returned 8 [0118.395] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0118.395] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0118.395] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0118.395] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0118.395] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0118.395] lstrlenW (lpString="EventSystem") returned 11 [0118.395] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0118.395] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0118.395] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0118.395] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0118.395] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0118.395] lstrlenW (lpString="FontCache") returned 9 [0118.395] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0118.395] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0118.395] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0118.395] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0118.395] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0118.395] lstrlenW (lpString="gpsvc") returned 5 [0118.395] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0118.395] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0118.395] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0118.395] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0118.395] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0118.395] lstrlenW (lpString="iphlpsvc") returned 8 [0118.395] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0118.396] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0118.396] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0118.396] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0118.396] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0118.396] lstrlenW (lpString="LanmanServer") returned 12 [0118.396] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0118.396] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0118.396] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0118.396] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0118.396] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0118.396] lstrlenW (lpString="LanmanWorkstation") returned 17 [0118.396] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0118.396] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0118.396] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0118.396] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0118.396] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0118.396] lstrlenW (lpString="lmhosts") returned 7 [0118.396] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0118.396] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0118.396] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0118.396] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0118.396] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0118.396] lstrlenW (lpString="MMCSS") returned 5 [0118.396] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0118.396] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0118.396] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0118.396] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0118.396] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0118.396] lstrlenW (lpString="MpsSvc") returned 6 [0118.396] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0118.396] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0118.396] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0118.396] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0118.396] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0118.396] lstrlenW (lpString="Netman") returned 6 [0118.396] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0118.396] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0118.397] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0118.397] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0118.397] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0118.397] lstrlenW (lpString="netprofm") returned 8 [0118.397] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0118.397] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0118.397] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0118.397] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0118.397] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0118.397] lstrlenW (lpString="NlaSvc") returned 6 [0118.397] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0118.397] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0118.397] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0118.397] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0118.397] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0118.397] lstrlenW (lpString="nsi") returned 3 [0118.397] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0118.397] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0118.397] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0118.397] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0118.397] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0118.397] lstrlenW (lpString="PcaSvc") returned 6 [0118.397] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0118.397] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0118.397] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0118.397] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0118.397] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0118.397] lstrlenW (lpString="PlugPlay") returned 8 [0118.397] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0118.397] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0118.397] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0118.397] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0118.397] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0118.397] lstrlenW (lpString="Power") returned 5 [0118.397] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0118.397] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0118.397] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0118.397] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0118.398] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0118.398] lstrlenW (lpString="ProfSvc") returned 7 [0118.398] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0118.398] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0118.398] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0118.398] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0118.398] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0118.398] lstrlenW (lpString="RpcEptMapper") returned 12 [0118.398] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0118.398] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0118.398] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0118.398] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0118.398] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0118.398] lstrlenW (lpString="RpcSs") returned 5 [0118.398] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0118.398] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0118.398] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0118.398] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0118.398] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0118.398] lstrlenW (lpString="SamSs") returned 5 [0118.398] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0118.398] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0118.398] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0118.398] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0118.398] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0118.398] lstrlenW (lpString="Schedule") returned 8 [0118.398] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0118.398] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0118.398] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0118.398] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0118.399] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0118.399] lstrlenW (lpString="SENS") returned 4 [0118.399] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0118.399] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0118.399] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0118.399] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0118.399] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0118.399] lstrlenW (lpString="ShellHWDetection") returned 16 [0118.399] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0118.399] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0118.399] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0118.399] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0118.399] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0118.399] lstrlenW (lpString="Spooler") returned 7 [0118.399] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0118.399] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0118.399] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0118.399] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0118.399] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0118.399] lstrlenW (lpString="sppsvc") returned 6 [0118.399] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="sppsvc") returned -1 [0118.399] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="sppsvc") returned -1 [0118.399] lstrcmpiW (lpString1="sqlwriter", lpString2="sppsvc") returned 1 [0118.399] lstrcmpiW (lpString1="mssqlserver", lpString2="sppsvc") returned -1 [0118.399] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="sppsvc") returned 1 [0118.399] lstrlenW (lpString="swprv") returned 5 [0118.399] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0118.399] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0118.399] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0118.399] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0118.399] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0118.399] lstrlenW (lpString="SysMain") returned 7 [0118.399] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0118.399] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0118.399] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0118.399] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0118.399] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0118.400] lstrlenW (lpString="Themes") returned 6 [0118.400] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0118.400] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0118.400] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0118.400] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0118.400] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0118.400] lstrlenW (lpString="TrkWks") returned 6 [0118.400] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0118.400] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0118.400] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0118.400] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0118.400] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0118.400] lstrlenW (lpString="UxSms") returned 5 [0118.400] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0118.400] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0118.400] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0118.400] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0118.400] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0118.400] lstrlenW (lpString="VSS") returned 3 [0118.400] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0118.400] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0118.400] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0118.400] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0118.400] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0118.400] lstrlenW (lpString="W32Time") returned 7 [0118.400] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="W32Time") returned -1 [0118.400] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="W32Time") returned -1 [0118.400] lstrcmpiW (lpString1="sqlwriter", lpString2="W32Time") returned -1 [0118.400] lstrcmpiW (lpString1="mssqlserver", lpString2="W32Time") returned -1 [0118.400] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="W32Time") returned -1 [0118.401] lstrlenW (lpString="WdiServiceHost") returned 14 [0118.401] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0118.401] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0118.401] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0118.401] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0118.401] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0118.401] lstrlenW (lpString="WdiSystemHost") returned 13 [0118.401] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0118.401] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0118.401] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0118.401] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0118.401] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0118.402] lstrlenW (lpString="WinDefend") returned 9 [0118.402] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinDefend") returned -1 [0118.402] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinDefend") returned -1 [0118.402] lstrcmpiW (lpString1="sqlwriter", lpString2="WinDefend") returned -1 [0118.402] lstrcmpiW (lpString1="mssqlserver", lpString2="WinDefend") returned -1 [0118.402] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinDefend") returned -1 [0118.402] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0118.402] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0118.402] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0118.402] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0118.403] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0118.403] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0118.403] lstrlenW (lpString="Winmgmt") returned 7 [0118.403] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0118.403] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0118.403] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0118.403] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0118.403] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0118.403] lstrlenW (lpString="wscsvc") returned 6 [0118.403] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wscsvc") returned -1 [0118.403] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wscsvc") returned -1 [0118.403] lstrcmpiW (lpString1="sqlwriter", lpString2="wscsvc") returned -1 [0118.403] lstrcmpiW (lpString1="mssqlserver", lpString2="wscsvc") returned -1 [0118.403] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wscsvc") returned -1 [0118.403] lstrlenW (lpString="wuauserv") returned 8 [0118.403] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wuauserv") returned -1 [0118.403] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wuauserv") returned -1 [0118.403] lstrcmpiW (lpString1="sqlwriter", lpString2="wuauserv") returned -1 [0118.403] lstrcmpiW (lpString1="mssqlserver", lpString2="wuauserv") returned -1 [0118.403] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x20c [0118.405] Process32FirstW (in: hSnapshot=0x20c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0118.405] Process32NextW (in: hSnapshot=0x20c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0118.406] lstrlenW (lpString="System") returned 6 [0118.406] Process32NextW (in: hSnapshot=0x20c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0118.407] lstrlenW (lpString="smss.exe") returned 8 [0118.407] Process32NextW (in: hSnapshot=0x20c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0118.408] lstrlenW (lpString="csrss.exe") returned 9 [0118.408] Process32NextW (in: hSnapshot=0x20c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0118.408] lstrlenW (lpString="wininit.exe") returned 11 [0118.409] Process32NextW (in: hSnapshot=0x20c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0118.409] lstrlenW (lpString="csrss.exe") returned 9 [0118.409] Process32NextW (in: hSnapshot=0x20c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0118.410] lstrlenW (lpString="winlogon.exe") returned 12 [0118.410] Process32NextW (in: hSnapshot=0x20c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0118.410] lstrlenW (lpString="services.exe") returned 12 [0118.410] Process32NextW (in: hSnapshot=0x20c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0118.411] lstrlenW (lpString="lsass.exe") returned 9 [0118.411] Process32NextW (in: hSnapshot=0x20c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0118.412] lstrlenW (lpString="lsm.exe") returned 7 [0118.412] Process32NextW (in: hSnapshot=0x20c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0118.412] lstrlenW (lpString="svchost.exe") returned 11 [0118.412] Process32NextW (in: hSnapshot=0x20c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0118.413] lstrlenW (lpString="svchost.exe") returned 11 [0118.413] Process32NextW (in: hSnapshot=0x20c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0118.413] lstrlenW (lpString="svchost.exe") returned 11 [0118.413] Process32NextW (in: hSnapshot=0x20c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0118.414] lstrlenW (lpString="svchost.exe") returned 11 [0118.414] Process32NextW (in: hSnapshot=0x20c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0118.415] lstrlenW (lpString="svchost.exe") returned 11 [0118.415] Process32NextW (in: hSnapshot=0x20c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0118.415] lstrlenW (lpString="audiodg.exe") returned 11 [0118.415] Process32NextW (in: hSnapshot=0x20c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0118.432] lstrlenW (lpString="svchost.exe") returned 11 [0118.432] Process32NextW (in: hSnapshot=0x20c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0118.433] lstrlenW (lpString="svchost.exe") returned 11 [0118.433] Process32NextW (in: hSnapshot=0x20c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0118.433] lstrlenW (lpString="spoolsv.exe") returned 11 [0118.433] Process32NextW (in: hSnapshot=0x20c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0118.434] lstrlenW (lpString="svchost.exe") returned 11 [0118.434] Process32NextW (in: hSnapshot=0x20c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0118.434] lstrlenW (lpString="taskhost.exe") returned 12 [0118.434] Process32NextW (in: hSnapshot=0x20c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x558, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0118.435] lstrlenW (lpString="dwm.exe") returned 7 [0118.435] Process32NextW (in: hSnapshot=0x20c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x54c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0118.436] lstrlenW (lpString="explorer.exe") returned 12 [0118.436] Process32NextW (in: hSnapshot=0x20c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0118.437] lstrlenW (lpString="taskeng.exe") returned 11 [0118.437] Process32NextW (in: hSnapshot=0x20c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0118.437] lstrlenW (lpString="taskhost.exe") returned 12 [0118.437] Process32NextW (in: hSnapshot=0x20c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="watches-vessel-arbitrary.exe")) returned 1 [0118.438] lstrlenW (lpString="watches-vessel-arbitrary.exe") returned 28 [0118.438] Process32NextW (in: hSnapshot=0x20c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="alsopound.exe")) returned 1 [0118.439] lstrlenW (lpString="alsopound.exe") returned 13 [0118.439] Process32NextW (in: hSnapshot=0x20c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x478, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="measuredamsterdamsandwich.exe")) returned 1 [0118.439] lstrlenW (lpString="measuredamsterdamsandwich.exe") returned 29 [0118.440] Process32NextW (in: hSnapshot=0x20c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="ooo_lucy_millions.exe")) returned 1 [0118.440] lstrlenW (lpString="ooo_lucy_millions.exe") returned 21 [0118.440] Process32NextW (in: hSnapshot=0x20c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="appearance.exe")) returned 1 [0118.441] lstrlenW (lpString="appearance.exe") returned 14 [0118.441] Process32NextW (in: hSnapshot=0x20c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="albert.exe")) returned 1 [0118.442] lstrlenW (lpString="albert.exe") returned 10 [0118.442] Process32NextW (in: hSnapshot=0x20c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="implied-enquiries.exe")) returned 1 [0118.442] lstrlenW (lpString="implied-enquiries.exe") returned 21 [0118.443] Process32NextW (in: hSnapshot=0x20c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x72c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="boston_opening.exe")) returned 1 [0118.444] lstrlenW (lpString="boston_opening.exe") returned 18 [0118.444] Process32NextW (in: hSnapshot=0x20c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="portsmouth.exe")) returned 1 [0118.445] lstrlenW (lpString="portsmouth.exe") returned 14 [0118.445] Process32NextW (in: hSnapshot=0x20c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="cameras grew poverty.exe")) returned 1 [0118.445] lstrlenW (lpString="cameras grew poverty.exe") returned 24 [0118.446] Process32NextW (in: hSnapshot=0x20c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="dxrapids.exe")) returned 1 [0118.446] lstrlenW (lpString="dxrapids.exe") returned 12 [0118.446] Process32NextW (in: hSnapshot=0x20c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x33c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="visitors.exe")) returned 1 [0118.447] lstrlenW (lpString="visitors.exe") returned 12 [0118.447] Process32NextW (in: hSnapshot=0x20c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="organisations_officially.exe")) returned 1 [0118.448] lstrlenW (lpString="organisations_officially.exe") returned 28 [0118.448] Process32NextW (in: hSnapshot=0x20c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x61c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="pair.exe")) returned 1 [0118.448] lstrlenW (lpString="pair.exe") returned 8 [0118.448] Process32NextW (in: hSnapshot=0x20c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="gross.exe")) returned 1 [0118.449] lstrlenW (lpString="gross.exe") returned 9 [0118.449] Process32NextW (in: hSnapshot=0x20c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x470, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="viewpicture.exe")) returned 1 [0118.450] lstrlenW (lpString="viewpicture.exe") returned 15 [0118.450] Process32NextW (in: hSnapshot=0x20c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="transmitted.exe")) returned 1 [0118.451] lstrlenW (lpString="transmitted.exe") returned 15 [0118.451] Process32NextW (in: hSnapshot=0x20c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x634, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="sunglassescelebs.exe")) returned 1 [0118.451] lstrlenW (lpString="sunglassescelebs.exe") returned 20 [0118.451] Process32NextW (in: hSnapshot=0x20c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="waiver-issue.exe")) returned 1 [0118.452] lstrlenW (lpString="waiver-issue.exe") returned 16 [0118.452] Process32NextW (in: hSnapshot=0x20c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x808, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="gziprear.exe")) returned 1 [0118.453] lstrlenW (lpString="gziprear.exe") returned 12 [0118.453] Process32NextW (in: hSnapshot=0x20c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x818, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="gregoryletters.exe")) returned 1 [0118.453] lstrlenW (lpString="gregoryletters.exe") returned 18 [0118.453] Process32NextW (in: hSnapshot=0x20c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x828, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="intel-metadata-rich.exe")) returned 1 [0118.454] lstrlenW (lpString="intel-metadata-rich.exe") returned 23 [0118.454] Process32NextW (in: hSnapshot=0x20c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x838, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="cemeteryreconstructiondimension.exe")) returned 1 [0118.455] lstrlenW (lpString="cemeteryreconstructiondimension.exe") returned 35 [0118.455] Process32NextW (in: hSnapshot=0x20c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0118.456] lstrlenW (lpString="svchost.exe") returned 11 [0118.456] Process32NextW (in: hSnapshot=0x20c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0118.457] lstrlenW (lpString="sppsvc.exe") returned 10 [0118.457] Process32NextW (in: hSnapshot=0x20c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xab4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0118.457] lstrlenW (lpString="svchost.exe") returned 11 [0118.457] Process32NextW (in: hSnapshot=0x20c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x9f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="unlikexpc.exe")) returned 1 [0118.458] lstrlenW (lpString="unlikexpc.exe") returned 13 [0118.458] Process32NextW (in: hSnapshot=0x20c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xb58, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0118.458] lstrlenW (lpString="cmd.exe") returned 7 [0118.458] Process32NextW (in: hSnapshot=0x20c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0118.459] lstrlenW (lpString="conhost.exe") returned 11 [0118.459] Process32NextW (in: hSnapshot=0x20c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xb74, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0118.460] lstrlenW (lpString="vssadmin.exe") returned 12 [0118.460] Process32NextW (in: hSnapshot=0x20c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0118.460] lstrlenW (lpString="VSSVC.exe") returned 9 [0118.460] Process32NextW (in: hSnapshot=0x20c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x824, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0118.461] lstrlenW (lpString="svchost.exe") returned 11 [0118.461] Process32NextW (in: hSnapshot=0x20c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x824, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0118.461] CloseHandle (hObject=0x20c) returned 1 [0118.461] Sleep (dwMilliseconds=0x1f4) [0119.000] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x819cf0 [0119.000] EnumServicesStatusExW (in: hSCManager=0x819cf0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x247fa74, lpServicesReturned=0x247fa8c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x247fa74, lpServicesReturned=0x247fa8c, lpResumeHandle=0x0) returned 0 [0119.000] GetLastError () returned 0xea [0119.000] EnumServicesStatusExW (in: hSCManager=0x819cf0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x8b48e0, cbBufSize=0x1484, pcbBytesNeeded=0x247fa74, lpServicesReturned=0x247fa8c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x8b48e0, pcbBytesNeeded=0x247fa74, lpServicesReturned=0x247fa8c, lpResumeHandle=0x0) returned 1 [0119.001] CloseServiceHandle (hSCObject=0x819cf0) returned 1 [0119.001] lstrlenW (lpString="Appinfo") returned 7 [0119.001] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0119.001] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0119.001] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0119.001] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0119.001] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0119.001] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0119.001] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0119.001] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0119.001] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0119.001] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0119.001] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0119.001] lstrlenW (lpString="AudioSrv") returned 8 [0119.001] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0119.001] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0119.001] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0119.001] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0119.001] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0119.001] lstrlenW (lpString="BFE") returned 3 [0119.001] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0119.001] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0119.001] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0119.001] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0119.001] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0119.001] lstrlenW (lpString="CryptSvc") returned 8 [0119.001] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0119.001] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0119.001] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0119.001] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0119.001] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0119.001] lstrlenW (lpString="CscService") returned 10 [0119.001] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0119.001] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0119.001] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0119.001] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0119.002] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0119.002] lstrlenW (lpString="DcomLaunch") returned 10 [0119.002] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0119.002] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0119.002] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0119.002] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0119.002] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0119.002] lstrlenW (lpString="Dhcp") returned 4 [0119.002] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0119.002] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0119.002] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0119.002] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0119.002] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0119.002] lstrlenW (lpString="Dnscache") returned 8 [0119.002] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0119.002] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0119.002] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0119.002] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0119.002] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0119.002] lstrlenW (lpString="DPS") returned 3 [0119.002] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0119.002] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0119.002] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0119.002] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0119.002] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0119.002] lstrlenW (lpString="eventlog") returned 8 [0119.002] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0119.002] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0119.002] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0119.002] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0119.002] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0119.002] lstrlenW (lpString="EventSystem") returned 11 [0119.002] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0119.002] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0119.002] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0119.002] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0119.002] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0119.002] lstrlenW (lpString="FontCache") returned 9 [0119.002] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0119.002] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0119.002] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0119.002] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0119.002] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0119.002] lstrlenW (lpString="gpsvc") returned 5 [0119.002] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0119.003] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0119.003] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0119.003] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0119.003] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0119.003] lstrlenW (lpString="iphlpsvc") returned 8 [0119.003] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0119.003] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0119.003] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0119.003] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0119.003] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0119.003] lstrlenW (lpString="LanmanServer") returned 12 [0119.003] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0119.003] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0119.003] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0119.003] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0119.003] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0119.003] lstrlenW (lpString="LanmanWorkstation") returned 17 [0119.003] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0119.003] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0119.003] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0119.003] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0119.003] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0119.003] lstrlenW (lpString="lmhosts") returned 7 [0119.003] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0119.003] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0119.003] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0119.003] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0119.003] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0119.003] lstrlenW (lpString="MMCSS") returned 5 [0119.003] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0119.003] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0119.003] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0119.003] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0119.003] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0119.003] lstrlenW (lpString="MpsSvc") returned 6 [0119.003] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0119.004] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0119.004] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0119.004] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0119.004] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0119.004] lstrlenW (lpString="Netman") returned 6 [0119.004] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0119.004] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0119.004] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0119.004] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0119.004] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0119.004] lstrlenW (lpString="netprofm") returned 8 [0119.004] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0119.004] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0119.004] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0119.004] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0119.004] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0119.004] lstrlenW (lpString="NlaSvc") returned 6 [0119.004] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0119.004] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0119.004] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0119.004] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0119.004] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0119.004] lstrlenW (lpString="nsi") returned 3 [0119.004] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0119.004] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0119.004] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0119.004] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0119.004] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0119.004] lstrlenW (lpString="PcaSvc") returned 6 [0119.004] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0119.004] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0119.004] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0119.004] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0119.004] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0119.004] lstrlenW (lpString="PlugPlay") returned 8 [0119.004] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0119.004] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0119.005] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0119.005] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0119.005] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0119.005] lstrlenW (lpString="Power") returned 5 [0119.005] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0119.005] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0119.005] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0119.005] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0119.005] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0119.005] lstrlenW (lpString="ProfSvc") returned 7 [0119.005] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0119.005] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0119.005] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0119.005] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0119.005] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0119.005] lstrlenW (lpString="RpcEptMapper") returned 12 [0119.005] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0119.005] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0119.005] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0119.005] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0119.005] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0119.005] lstrlenW (lpString="RpcSs") returned 5 [0119.005] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0119.005] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0119.005] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0119.005] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0119.005] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0119.005] lstrlenW (lpString="SamSs") returned 5 [0119.005] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0119.005] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0119.005] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0119.005] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0119.005] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0119.005] lstrlenW (lpString="Schedule") returned 8 [0119.005] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0119.005] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0119.005] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0119.005] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0119.005] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0119.006] lstrlenW (lpString="SENS") returned 4 [0119.006] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0119.006] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0119.006] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0119.006] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0119.006] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0119.006] lstrlenW (lpString="ShellHWDetection") returned 16 [0119.006] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0119.006] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0119.006] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0119.006] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0119.006] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0119.006] lstrlenW (lpString="Spooler") returned 7 [0119.006] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0119.006] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0119.006] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0119.006] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0119.006] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0119.006] lstrlenW (lpString="sppsvc") returned 6 [0119.006] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="sppsvc") returned -1 [0119.006] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="sppsvc") returned -1 [0119.006] lstrcmpiW (lpString1="sqlwriter", lpString2="sppsvc") returned 1 [0119.006] lstrcmpiW (lpString1="mssqlserver", lpString2="sppsvc") returned -1 [0119.006] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="sppsvc") returned 1 [0119.006] lstrlenW (lpString="swprv") returned 5 [0119.006] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0119.006] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0119.006] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0119.006] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0119.006] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0119.006] lstrlenW (lpString="SysMain") returned 7 [0119.006] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0119.006] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0119.006] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0119.006] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0119.006] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0119.006] lstrlenW (lpString="Themes") returned 6 [0119.006] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0119.006] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0119.006] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0119.006] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0119.006] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0119.006] lstrlenW (lpString="TrkWks") returned 6 [0119.006] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0119.006] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0119.006] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0119.006] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0119.006] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0119.006] lstrlenW (lpString="UxSms") returned 5 [0119.007] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0119.007] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0119.007] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0119.007] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0119.007] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0119.007] lstrlenW (lpString="VSS") returned 3 [0119.007] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0119.007] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0119.007] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0119.007] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0119.007] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0119.007] lstrlenW (lpString="W32Time") returned 7 [0119.007] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="W32Time") returned -1 [0119.007] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="W32Time") returned -1 [0119.007] lstrcmpiW (lpString1="sqlwriter", lpString2="W32Time") returned -1 [0119.007] lstrcmpiW (lpString1="mssqlserver", lpString2="W32Time") returned -1 [0119.007] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="W32Time") returned -1 [0119.007] lstrlenW (lpString="WdiServiceHost") returned 14 [0119.007] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0119.007] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0119.007] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0119.007] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0119.007] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0119.007] lstrlenW (lpString="WdiSystemHost") returned 13 [0119.007] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0119.007] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0119.007] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0119.007] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0119.007] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0119.007] lstrlenW (lpString="WinDefend") returned 9 [0119.007] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinDefend") returned -1 [0119.007] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinDefend") returned -1 [0119.007] lstrcmpiW (lpString1="sqlwriter", lpString2="WinDefend") returned -1 [0119.007] lstrcmpiW (lpString1="mssqlserver", lpString2="WinDefend") returned -1 [0119.007] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinDefend") returned -1 [0119.007] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0119.007] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0119.007] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0119.007] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0119.007] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0119.007] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0119.007] lstrlenW (lpString="Winmgmt") returned 7 [0119.007] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0119.007] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0119.007] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0119.007] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0119.007] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0119.008] lstrlenW (lpString="wscsvc") returned 6 [0119.008] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wscsvc") returned -1 [0119.008] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wscsvc") returned -1 [0119.008] lstrcmpiW (lpString1="sqlwriter", lpString2="wscsvc") returned -1 [0119.008] lstrcmpiW (lpString1="mssqlserver", lpString2="wscsvc") returned -1 [0119.008] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wscsvc") returned -1 [0119.008] lstrlenW (lpString="wuauserv") returned 8 [0119.008] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wuauserv") returned -1 [0119.008] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wuauserv") returned -1 [0119.008] lstrcmpiW (lpString1="sqlwriter", lpString2="wuauserv") returned -1 [0119.008] lstrcmpiW (lpString1="mssqlserver", lpString2="wuauserv") returned -1 [0119.008] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1ec [0119.009] Process32FirstW (in: hSnapshot=0x1ec, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0119.010] Process32NextW (in: hSnapshot=0x1ec, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0119.010] lstrlenW (lpString="System") returned 6 [0119.010] Process32NextW (in: hSnapshot=0x1ec, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0119.011] lstrlenW (lpString="smss.exe") returned 8 [0119.011] Process32NextW (in: hSnapshot=0x1ec, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0119.011] lstrlenW (lpString="csrss.exe") returned 9 [0119.011] Process32NextW (in: hSnapshot=0x1ec, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0119.012] lstrlenW (lpString="wininit.exe") returned 11 [0119.012] Process32NextW (in: hSnapshot=0x1ec, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0119.012] lstrlenW (lpString="csrss.exe") returned 9 [0119.012] Process32NextW (in: hSnapshot=0x1ec, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0119.013] lstrlenW (lpString="winlogon.exe") returned 12 [0119.013] Process32NextW (in: hSnapshot=0x1ec, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0119.013] lstrlenW (lpString="services.exe") returned 12 [0119.013] Process32NextW (in: hSnapshot=0x1ec, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0119.013] lstrlenW (lpString="lsass.exe") returned 9 [0119.013] Process32NextW (in: hSnapshot=0x1ec, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0119.014] lstrlenW (lpString="lsm.exe") returned 7 [0119.014] Process32NextW (in: hSnapshot=0x1ec, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0119.014] lstrlenW (lpString="svchost.exe") returned 11 [0119.014] Process32NextW (in: hSnapshot=0x1ec, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0119.015] lstrlenW (lpString="svchost.exe") returned 11 [0119.015] Process32NextW (in: hSnapshot=0x1ec, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0119.015] lstrlenW (lpString="svchost.exe") returned 11 [0119.016] Process32NextW (in: hSnapshot=0x1ec, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0119.016] lstrlenW (lpString="svchost.exe") returned 11 [0119.016] Process32NextW (in: hSnapshot=0x1ec, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0119.028] lstrlenW (lpString="svchost.exe") returned 11 [0119.028] Process32NextW (in: hSnapshot=0x1ec, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0119.050] lstrlenW (lpString="audiodg.exe") returned 11 [0119.050] Process32NextW (in: hSnapshot=0x1ec, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0119.051] lstrlenW (lpString="svchost.exe") returned 11 [0119.051] Process32NextW (in: hSnapshot=0x1ec, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0119.052] lstrlenW (lpString="svchost.exe") returned 11 [0119.052] Process32NextW (in: hSnapshot=0x1ec, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0119.053] lstrlenW (lpString="spoolsv.exe") returned 11 [0119.053] Process32NextW (in: hSnapshot=0x1ec, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0119.063] lstrlenW (lpString="svchost.exe") returned 11 [0119.063] Process32NextW (in: hSnapshot=0x1ec, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0119.064] lstrlenW (lpString="taskhost.exe") returned 12 [0119.064] Process32NextW (in: hSnapshot=0x1ec, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x558, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0119.064] lstrlenW (lpString="dwm.exe") returned 7 [0119.064] Process32NextW (in: hSnapshot=0x1ec, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x54c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0119.065] lstrlenW (lpString="explorer.exe") returned 12 [0119.065] Process32NextW (in: hSnapshot=0x1ec, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0119.065] lstrlenW (lpString="taskeng.exe") returned 11 [0119.065] Process32NextW (in: hSnapshot=0x1ec, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0119.066] lstrlenW (lpString="taskhost.exe") returned 12 [0119.066] Process32NextW (in: hSnapshot=0x1ec, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="watches-vessel-arbitrary.exe")) returned 1 [0119.067] lstrlenW (lpString="watches-vessel-arbitrary.exe") returned 28 [0119.067] Process32NextW (in: hSnapshot=0x1ec, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="alsopound.exe")) returned 1 [0119.067] lstrlenW (lpString="alsopound.exe") returned 13 [0119.067] Process32NextW (in: hSnapshot=0x1ec, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x478, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="measuredamsterdamsandwich.exe")) returned 1 [0119.068] lstrlenW (lpString="measuredamsterdamsandwich.exe") returned 29 [0119.068] Process32NextW (in: hSnapshot=0x1ec, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="ooo_lucy_millions.exe")) returned 1 [0119.069] lstrlenW (lpString="ooo_lucy_millions.exe") returned 21 [0119.069] Process32NextW (in: hSnapshot=0x1ec, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="appearance.exe")) returned 1 [0119.069] lstrlenW (lpString="appearance.exe") returned 14 [0119.069] Process32NextW (in: hSnapshot=0x1ec, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="albert.exe")) returned 1 [0119.070] lstrlenW (lpString="albert.exe") returned 10 [0119.070] Process32NextW (in: hSnapshot=0x1ec, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="implied-enquiries.exe")) returned 1 [0119.161] lstrlenW (lpString="implied-enquiries.exe") returned 21 [0119.161] Process32NextW (in: hSnapshot=0x1ec, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x72c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="boston_opening.exe")) returned 1 [0119.162] lstrlenW (lpString="boston_opening.exe") returned 18 [0119.162] Process32NextW (in: hSnapshot=0x1ec, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="portsmouth.exe")) returned 1 [0119.162] lstrlenW (lpString="portsmouth.exe") returned 14 [0119.162] Process32NextW (in: hSnapshot=0x1ec, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="cameras grew poverty.exe")) returned 1 [0119.163] lstrlenW (lpString="cameras grew poverty.exe") returned 24 [0119.163] Process32NextW (in: hSnapshot=0x1ec, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="dxrapids.exe")) returned 1 [0119.163] lstrlenW (lpString="dxrapids.exe") returned 12 [0119.163] Process32NextW (in: hSnapshot=0x1ec, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x33c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="visitors.exe")) returned 1 [0119.164] lstrlenW (lpString="visitors.exe") returned 12 [0119.164] Process32NextW (in: hSnapshot=0x1ec, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="organisations_officially.exe")) returned 1 [0119.164] lstrlenW (lpString="organisations_officially.exe") returned 28 [0119.164] Process32NextW (in: hSnapshot=0x1ec, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x61c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="pair.exe")) returned 1 [0119.165] lstrlenW (lpString="pair.exe") returned 8 [0119.165] Process32NextW (in: hSnapshot=0x1ec, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="gross.exe")) returned 1 [0119.165] lstrlenW (lpString="gross.exe") returned 9 [0119.165] Process32NextW (in: hSnapshot=0x1ec, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x470, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="viewpicture.exe")) returned 1 [0119.181] lstrlenW (lpString="viewpicture.exe") returned 15 [0119.181] Process32NextW (in: hSnapshot=0x1ec, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="transmitted.exe")) returned 1 [0119.182] lstrlenW (lpString="transmitted.exe") returned 15 [0119.182] Process32NextW (in: hSnapshot=0x1ec, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x634, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="sunglassescelebs.exe")) returned 1 [0119.182] lstrlenW (lpString="sunglassescelebs.exe") returned 20 [0119.182] Process32NextW (in: hSnapshot=0x1ec, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="waiver-issue.exe")) returned 1 [0119.183] lstrlenW (lpString="waiver-issue.exe") returned 16 [0119.183] Process32NextW (in: hSnapshot=0x1ec, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x808, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="gziprear.exe")) returned 1 [0119.183] lstrlenW (lpString="gziprear.exe") returned 12 [0119.183] Process32NextW (in: hSnapshot=0x1ec, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x818, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="gregoryletters.exe")) returned 1 [0119.184] lstrlenW (lpString="gregoryletters.exe") returned 18 [0119.184] Process32NextW (in: hSnapshot=0x1ec, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x828, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="intel-metadata-rich.exe")) returned 1 [0119.184] lstrlenW (lpString="intel-metadata-rich.exe") returned 23 [0119.184] Process32NextW (in: hSnapshot=0x1ec, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x838, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="cemeteryreconstructiondimension.exe")) returned 1 [0119.185] lstrlenW (lpString="cemeteryreconstructiondimension.exe") returned 35 [0119.185] Process32NextW (in: hSnapshot=0x1ec, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0119.185] lstrlenW (lpString="svchost.exe") returned 11 [0119.185] Process32NextW (in: hSnapshot=0x1ec, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0119.186] lstrlenW (lpString="sppsvc.exe") returned 10 [0119.186] Process32NextW (in: hSnapshot=0x1ec, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xab4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0119.186] lstrlenW (lpString="svchost.exe") returned 11 [0119.186] Process32NextW (in: hSnapshot=0x1ec, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x9f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="unlikexpc.exe")) returned 1 [0119.187] lstrlenW (lpString="unlikexpc.exe") returned 13 [0119.187] Process32NextW (in: hSnapshot=0x1ec, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xb58, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0119.187] lstrlenW (lpString="cmd.exe") returned 7 [0119.187] Process32NextW (in: hSnapshot=0x1ec, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0119.188] lstrlenW (lpString="conhost.exe") returned 11 [0119.188] Process32NextW (in: hSnapshot=0x1ec, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xb74, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0119.188] lstrlenW (lpString="vssadmin.exe") returned 12 [0119.188] Process32NextW (in: hSnapshot=0x1ec, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0119.189] lstrlenW (lpString="VSSVC.exe") returned 9 [0119.189] Process32NextW (in: hSnapshot=0x1ec, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x824, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0119.189] lstrlenW (lpString="svchost.exe") returned 11 [0119.189] Process32NextW (in: hSnapshot=0x1ec, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x824, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0119.189] CloseHandle (hObject=0x1ec) returned 1 [0119.190] Sleep (dwMilliseconds=0x1f4) [0119.710] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x819a20 [0119.711] EnumServicesStatusExW (in: hSCManager=0x819a20, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x247fa74, lpServicesReturned=0x247fa8c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x247fa74, lpServicesReturned=0x247fa8c, lpResumeHandle=0x0) returned 0 [0119.712] GetLastError () returned 0xea [0119.712] EnumServicesStatusExW (in: hSCManager=0x819a20, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x8b48e0, cbBufSize=0x1484, pcbBytesNeeded=0x247fa74, lpServicesReturned=0x247fa8c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x8b48e0, pcbBytesNeeded=0x247fa74, lpServicesReturned=0x247fa8c, lpResumeHandle=0x0) returned 1 [0119.712] CloseServiceHandle (hSCObject=0x819a20) returned 1 [0119.712] lstrlenW (lpString="Appinfo") returned 7 [0119.712] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0119.712] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0119.712] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0119.712] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0119.712] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0119.712] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0119.712] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0119.712] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0119.712] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0119.712] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0119.713] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0119.713] lstrlenW (lpString="AudioSrv") returned 8 [0119.713] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0119.713] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0119.713] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0119.713] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0119.713] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0119.713] lstrlenW (lpString="BFE") returned 3 [0119.713] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0119.713] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0119.713] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0119.713] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0119.713] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0119.713] lstrlenW (lpString="CryptSvc") returned 8 [0119.713] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0119.713] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0119.713] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0119.713] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0119.713] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0119.713] lstrlenW (lpString="CscService") returned 10 [0119.713] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0119.713] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0119.713] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0119.713] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0119.713] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0119.713] lstrlenW (lpString="DcomLaunch") returned 10 [0119.713] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0119.713] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0119.713] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0119.713] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0119.713] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0119.713] lstrlenW (lpString="Dhcp") returned 4 [0119.713] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0119.713] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0119.713] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0119.713] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0119.713] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0119.713] lstrlenW (lpString="Dnscache") returned 8 [0119.713] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0119.713] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0119.713] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0119.713] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0119.713] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0119.713] lstrlenW (lpString="DPS") returned 3 [0119.713] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0119.713] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0119.713] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0119.713] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0119.713] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0119.713] lstrlenW (lpString="eventlog") returned 8 [0119.714] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0119.714] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0119.714] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0119.714] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0119.714] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0119.714] lstrlenW (lpString="EventSystem") returned 11 [0119.714] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0119.714] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0119.714] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0119.714] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0119.714] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0119.714] lstrlenW (lpString="FontCache") returned 9 [0119.714] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0119.714] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0119.714] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0119.714] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0119.714] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0119.714] lstrlenW (lpString="gpsvc") returned 5 [0119.714] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0119.714] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0119.714] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0119.714] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0119.714] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0119.714] lstrlenW (lpString="iphlpsvc") returned 8 [0119.714] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0119.714] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0119.714] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0119.714] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0119.714] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0119.714] lstrlenW (lpString="LanmanServer") returned 12 [0119.714] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0119.714] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0119.714] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0119.714] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0119.714] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0119.714] lstrlenW (lpString="LanmanWorkstation") returned 17 [0119.714] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0119.714] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0119.714] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0119.714] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0119.714] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0119.714] lstrlenW (lpString="lmhosts") returned 7 [0119.714] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0119.714] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0119.714] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0119.714] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0119.714] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0119.714] lstrlenW (lpString="MMCSS") returned 5 [0119.715] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0119.715] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0119.723] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0119.723] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0119.723] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0119.723] lstrlenW (lpString="MpsSvc") returned 6 [0119.723] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0119.723] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0119.723] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0119.723] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0119.723] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0119.723] lstrlenW (lpString="Netman") returned 6 [0119.723] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0119.723] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0119.723] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0119.723] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0119.723] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0119.723] lstrlenW (lpString="netprofm") returned 8 [0119.723] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0119.723] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0119.723] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0119.723] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0119.723] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0119.723] lstrlenW (lpString="NlaSvc") returned 6 [0119.723] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0119.723] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0119.723] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0119.723] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0119.723] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0119.723] lstrlenW (lpString="nsi") returned 3 [0119.723] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0119.723] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0119.723] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0119.723] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0119.723] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0119.723] lstrlenW (lpString="PcaSvc") returned 6 [0119.723] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0119.723] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0119.723] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0119.723] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0119.723] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0119.723] lstrlenW (lpString="PlugPlay") returned 8 [0119.723] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0119.723] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0119.723] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0119.724] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0119.724] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0119.724] lstrlenW (lpString="Power") returned 5 [0119.724] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0119.724] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0119.724] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0119.724] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0119.724] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0119.724] lstrlenW (lpString="ProfSvc") returned 7 [0119.724] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0119.724] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0119.724] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0119.724] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0119.724] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0119.724] lstrlenW (lpString="RpcEptMapper") returned 12 [0119.724] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0119.724] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0119.724] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0119.724] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0119.724] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0119.724] lstrlenW (lpString="RpcSs") returned 5 [0119.724] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0119.724] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0119.724] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0119.724] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0119.724] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0119.724] lstrlenW (lpString="SamSs") returned 5 [0119.724] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0119.724] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0119.724] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0119.724] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0119.724] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0119.724] lstrlenW (lpString="Schedule") returned 8 [0119.724] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0119.724] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0119.724] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0119.724] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0119.724] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0119.724] lstrlenW (lpString="SENS") returned 4 [0119.724] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0119.724] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0119.724] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0119.724] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0119.724] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0119.724] lstrlenW (lpString="ShellHWDetection") returned 16 [0119.724] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0119.724] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0119.724] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0119.724] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0119.725] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0119.725] lstrlenW (lpString="Spooler") returned 7 [0119.725] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0119.725] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0119.725] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0119.725] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0119.725] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0119.725] lstrlenW (lpString="sppsvc") returned 6 [0119.725] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="sppsvc") returned -1 [0119.725] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="sppsvc") returned -1 [0119.725] lstrcmpiW (lpString1="sqlwriter", lpString2="sppsvc") returned 1 [0119.725] lstrcmpiW (lpString1="mssqlserver", lpString2="sppsvc") returned -1 [0119.725] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="sppsvc") returned 1 [0119.725] lstrlenW (lpString="swprv") returned 5 [0119.725] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0119.725] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0119.725] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0119.725] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0119.725] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0119.725] lstrlenW (lpString="SysMain") returned 7 [0119.725] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0119.725] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0119.725] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0119.725] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0119.725] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0119.725] lstrlenW (lpString="Themes") returned 6 [0119.725] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0119.725] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0119.725] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0119.725] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0119.725] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0119.725] lstrlenW (lpString="TrkWks") returned 6 [0119.725] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0119.725] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0119.725] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0119.725] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0119.725] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0119.725] lstrlenW (lpString="UxSms") returned 5 [0119.725] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0119.725] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0119.725] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0119.725] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0119.725] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0119.725] lstrlenW (lpString="VSS") returned 3 [0119.725] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0119.725] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0119.725] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0119.725] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0119.725] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0119.725] lstrlenW (lpString="W32Time") returned 7 [0119.726] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="W32Time") returned -1 [0119.726] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="W32Time") returned -1 [0119.726] lstrcmpiW (lpString1="sqlwriter", lpString2="W32Time") returned -1 [0119.726] lstrcmpiW (lpString1="mssqlserver", lpString2="W32Time") returned -1 [0119.726] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="W32Time") returned -1 [0119.726] lstrlenW (lpString="WdiServiceHost") returned 14 [0119.726] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0119.726] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0119.726] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0119.726] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0119.726] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0119.726] lstrlenW (lpString="WdiSystemHost") returned 13 [0119.726] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0119.726] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0119.726] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0119.726] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0119.726] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0119.726] lstrlenW (lpString="WinDefend") returned 9 [0119.726] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinDefend") returned -1 [0119.726] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinDefend") returned -1 [0119.726] lstrcmpiW (lpString1="sqlwriter", lpString2="WinDefend") returned -1 [0119.726] lstrcmpiW (lpString1="mssqlserver", lpString2="WinDefend") returned -1 [0119.726] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinDefend") returned -1 [0119.726] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0119.726] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0119.726] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0119.726] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0119.726] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0119.726] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0119.726] lstrlenW (lpString="Winmgmt") returned 7 [0119.726] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0119.726] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0119.726] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0119.726] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0119.726] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0119.726] lstrlenW (lpString="wscsvc") returned 6 [0119.726] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wscsvc") returned -1 [0119.726] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wscsvc") returned -1 [0119.726] lstrcmpiW (lpString1="sqlwriter", lpString2="wscsvc") returned -1 [0119.726] lstrcmpiW (lpString1="mssqlserver", lpString2="wscsvc") returned -1 [0119.726] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wscsvc") returned -1 [0119.726] lstrlenW (lpString="wuauserv") returned 8 [0119.726] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wuauserv") returned -1 [0119.726] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wuauserv") returned -1 [0119.726] lstrcmpiW (lpString1="sqlwriter", lpString2="wuauserv") returned -1 [0119.726] lstrcmpiW (lpString1="mssqlserver", lpString2="wuauserv") returned -1 [0119.726] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x19c [0119.728] Process32FirstW (in: hSnapshot=0x19c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0119.728] Process32NextW (in: hSnapshot=0x19c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x51, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0119.729] lstrlenW (lpString="System") returned 6 [0119.729] Process32NextW (in: hSnapshot=0x19c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0119.729] lstrlenW (lpString="smss.exe") returned 8 [0119.729] Process32NextW (in: hSnapshot=0x19c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0119.730] lstrlenW (lpString="csrss.exe") returned 9 [0119.730] Process32NextW (in: hSnapshot=0x19c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0119.730] lstrlenW (lpString="wininit.exe") returned 11 [0119.730] Process32NextW (in: hSnapshot=0x19c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0119.731] lstrlenW (lpString="csrss.exe") returned 9 [0119.731] Process32NextW (in: hSnapshot=0x19c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0119.731] lstrlenW (lpString="winlogon.exe") returned 12 [0119.731] Process32NextW (in: hSnapshot=0x19c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0119.731] lstrlenW (lpString="services.exe") returned 12 [0119.732] Process32NextW (in: hSnapshot=0x19c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0119.732] lstrlenW (lpString="lsass.exe") returned 9 [0119.732] Process32NextW (in: hSnapshot=0x19c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0119.743] lstrlenW (lpString="lsm.exe") returned 7 [0119.743] Process32NextW (in: hSnapshot=0x19c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0119.744] lstrlenW (lpString="svchost.exe") returned 11 [0119.744] Process32NextW (in: hSnapshot=0x19c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0119.744] lstrlenW (lpString="svchost.exe") returned 11 [0119.744] Process32NextW (in: hSnapshot=0x19c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0119.744] lstrlenW (lpString="svchost.exe") returned 11 [0119.744] Process32NextW (in: hSnapshot=0x19c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0119.745] lstrlenW (lpString="svchost.exe") returned 11 [0119.745] Process32NextW (in: hSnapshot=0x19c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0119.745] lstrlenW (lpString="svchost.exe") returned 11 [0119.745] Process32NextW (in: hSnapshot=0x19c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0119.746] lstrlenW (lpString="audiodg.exe") returned 11 [0119.746] Process32NextW (in: hSnapshot=0x19c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0119.746] lstrlenW (lpString="svchost.exe") returned 11 [0119.746] Process32NextW (in: hSnapshot=0x19c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0119.747] lstrlenW (lpString="svchost.exe") returned 11 [0119.747] Process32NextW (in: hSnapshot=0x19c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0119.747] lstrlenW (lpString="spoolsv.exe") returned 11 [0119.747] Process32NextW (in: hSnapshot=0x19c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0119.748] lstrlenW (lpString="svchost.exe") returned 11 [0119.748] Process32NextW (in: hSnapshot=0x19c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0119.748] lstrlenW (lpString="taskhost.exe") returned 12 [0119.748] Process32NextW (in: hSnapshot=0x19c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x558, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0119.749] lstrlenW (lpString="dwm.exe") returned 7 [0119.749] Process32NextW (in: hSnapshot=0x19c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x54c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0119.749] lstrlenW (lpString="explorer.exe") returned 12 [0119.749] Process32NextW (in: hSnapshot=0x19c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0119.749] lstrlenW (lpString="taskeng.exe") returned 11 [0119.750] Process32NextW (in: hSnapshot=0x19c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0119.750] lstrlenW (lpString="taskhost.exe") returned 12 [0119.750] Process32NextW (in: hSnapshot=0x19c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="watches-vessel-arbitrary.exe")) returned 1 [0119.750] lstrlenW (lpString="watches-vessel-arbitrary.exe") returned 28 [0119.750] Process32NextW (in: hSnapshot=0x19c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="alsopound.exe")) returned 1 [0119.751] lstrlenW (lpString="alsopound.exe") returned 13 [0119.751] Process32NextW (in: hSnapshot=0x19c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x478, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="measuredamsterdamsandwich.exe")) returned 1 [0119.756] lstrlenW (lpString="measuredamsterdamsandwich.exe") returned 29 [0119.757] Process32NextW (in: hSnapshot=0x19c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="ooo_lucy_millions.exe")) returned 1 [0119.757] lstrlenW (lpString="ooo_lucy_millions.exe") returned 21 [0119.757] Process32NextW (in: hSnapshot=0x19c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="appearance.exe")) returned 1 [0119.757] lstrlenW (lpString="appearance.exe") returned 14 [0119.758] Process32NextW (in: hSnapshot=0x19c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="albert.exe")) returned 1 [0119.758] lstrlenW (lpString="albert.exe") returned 10 [0119.758] Process32NextW (in: hSnapshot=0x19c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="implied-enquiries.exe")) returned 1 [0119.758] lstrlenW (lpString="implied-enquiries.exe") returned 21 [0119.758] Process32NextW (in: hSnapshot=0x19c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x72c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="boston_opening.exe")) returned 1 [0119.759] lstrlenW (lpString="boston_opening.exe") returned 18 [0119.759] Process32NextW (in: hSnapshot=0x19c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="portsmouth.exe")) returned 1 [0119.759] lstrlenW (lpString="portsmouth.exe") returned 14 [0119.759] Process32NextW (in: hSnapshot=0x19c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="cameras grew poverty.exe")) returned 1 [0119.760] lstrlenW (lpString="cameras grew poverty.exe") returned 24 [0119.760] Process32NextW (in: hSnapshot=0x19c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="dxrapids.exe")) returned 1 [0119.760] lstrlenW (lpString="dxrapids.exe") returned 12 [0119.760] Process32NextW (in: hSnapshot=0x19c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x33c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="visitors.exe")) returned 1 [0119.761] lstrlenW (lpString="visitors.exe") returned 12 [0119.761] Process32NextW (in: hSnapshot=0x19c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="organisations_officially.exe")) returned 1 [0119.761] lstrlenW (lpString="organisations_officially.exe") returned 28 [0119.761] Process32NextW (in: hSnapshot=0x19c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x61c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="pair.exe")) returned 1 [0119.762] lstrlenW (lpString="pair.exe") returned 8 [0119.762] Process32NextW (in: hSnapshot=0x19c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="gross.exe")) returned 1 [0119.762] lstrlenW (lpString="gross.exe") returned 9 [0119.762] Process32NextW (in: hSnapshot=0x19c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x470, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="viewpicture.exe")) returned 1 [0119.762] lstrlenW (lpString="viewpicture.exe") returned 15 [0119.763] Process32NextW (in: hSnapshot=0x19c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="transmitted.exe")) returned 1 [0119.763] lstrlenW (lpString="transmitted.exe") returned 15 [0119.763] Process32NextW (in: hSnapshot=0x19c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x634, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="sunglassescelebs.exe")) returned 1 [0119.763] lstrlenW (lpString="sunglassescelebs.exe") returned 20 [0119.763] Process32NextW (in: hSnapshot=0x19c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="waiver-issue.exe")) returned 1 [0119.764] lstrlenW (lpString="waiver-issue.exe") returned 16 [0119.764] Process32NextW (in: hSnapshot=0x19c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x808, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="gziprear.exe")) returned 1 [0119.764] lstrlenW (lpString="gziprear.exe") returned 12 [0119.764] Process32NextW (in: hSnapshot=0x19c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x818, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="gregoryletters.exe")) returned 1 [0119.765] lstrlenW (lpString="gregoryletters.exe") returned 18 [0119.765] Process32NextW (in: hSnapshot=0x19c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x828, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="intel-metadata-rich.exe")) returned 1 [0119.765] lstrlenW (lpString="intel-metadata-rich.exe") returned 23 [0119.765] Process32NextW (in: hSnapshot=0x19c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x838, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="cemeteryreconstructiondimension.exe")) returned 1 [0119.766] lstrlenW (lpString="cemeteryreconstructiondimension.exe") returned 35 [0119.766] Process32NextW (in: hSnapshot=0x19c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0119.766] lstrlenW (lpString="svchost.exe") returned 11 [0119.766] Process32NextW (in: hSnapshot=0x19c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0119.767] lstrlenW (lpString="sppsvc.exe") returned 10 [0119.767] Process32NextW (in: hSnapshot=0x19c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xab4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0119.767] lstrlenW (lpString="svchost.exe") returned 11 [0119.767] Process32NextW (in: hSnapshot=0x19c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x9f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="unlikexpc.exe")) returned 1 [0119.768] lstrlenW (lpString="unlikexpc.exe") returned 13 [0119.768] Process32NextW (in: hSnapshot=0x19c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xb58, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0119.768] lstrlenW (lpString="cmd.exe") returned 7 [0119.768] Process32NextW (in: hSnapshot=0x19c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0119.768] lstrlenW (lpString="conhost.exe") returned 11 [0119.768] Process32NextW (in: hSnapshot=0x19c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xb74, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0119.769] lstrlenW (lpString="vssadmin.exe") returned 12 [0119.769] Process32NextW (in: hSnapshot=0x19c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0119.769] lstrlenW (lpString="VSSVC.exe") returned 9 [0119.769] Process32NextW (in: hSnapshot=0x19c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x824, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0119.770] lstrlenW (lpString="svchost.exe") returned 11 [0119.770] Process32NextW (in: hSnapshot=0x19c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x824, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0119.770] CloseHandle (hObject=0x19c) returned 1 [0119.770] Sleep (dwMilliseconds=0x1f4) [0120.358] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x819a20 [0120.359] EnumServicesStatusExW (in: hSCManager=0x819a20, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x247fa74, lpServicesReturned=0x247fa8c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x247fa74, lpServicesReturned=0x247fa8c, lpResumeHandle=0x0) returned 0 [0120.359] GetLastError () returned 0xea [0120.359] EnumServicesStatusExW (in: hSCManager=0x819a20, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x8b48e0, cbBufSize=0x1484, pcbBytesNeeded=0x247fa74, lpServicesReturned=0x247fa8c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x8b48e0, pcbBytesNeeded=0x247fa74, lpServicesReturned=0x247fa8c, lpResumeHandle=0x0) returned 1 [0120.359] CloseServiceHandle (hSCObject=0x819a20) returned 1 [0120.359] lstrlenW (lpString="Appinfo") returned 7 [0120.359] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0120.359] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0120.359] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0120.359] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0120.359] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0120.360] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0120.360] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0120.360] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0120.360] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0120.360] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0120.360] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0120.360] lstrlenW (lpString="AudioSrv") returned 8 [0120.360] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0120.360] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0120.360] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0120.360] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0120.360] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0120.360] lstrlenW (lpString="BFE") returned 3 [0120.360] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0120.360] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0120.360] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0120.360] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0120.360] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0120.360] lstrlenW (lpString="CryptSvc") returned 8 [0120.360] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0120.360] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0120.360] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0120.360] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0120.360] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0120.360] lstrlenW (lpString="CscService") returned 10 [0120.360] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0120.360] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0120.360] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0120.360] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0120.360] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0120.360] lstrlenW (lpString="DcomLaunch") returned 10 [0120.360] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0120.360] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0120.360] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0120.360] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0120.360] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0120.360] lstrlenW (lpString="Dhcp") returned 4 [0120.360] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0120.360] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0120.360] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0120.360] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0120.360] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0120.360] lstrlenW (lpString="Dnscache") returned 8 [0120.360] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0120.360] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0120.360] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0120.360] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0120.360] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0120.360] lstrlenW (lpString="DPS") returned 3 [0120.360] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0120.361] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0120.361] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0120.361] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0120.361] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0120.361] lstrlenW (lpString="eventlog") returned 8 [0120.361] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0120.361] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0120.361] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0120.361] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0120.361] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0120.361] lstrlenW (lpString="EventSystem") returned 11 [0120.361] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0120.361] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0120.361] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0120.361] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0120.361] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0120.361] lstrlenW (lpString="FontCache") returned 9 [0120.361] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0120.361] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0120.361] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0120.361] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0120.361] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0120.361] lstrlenW (lpString="gpsvc") returned 5 [0120.361] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0120.361] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0120.361] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0120.361] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0120.361] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0120.361] lstrlenW (lpString="iphlpsvc") returned 8 [0120.361] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0120.361] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0120.361] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0120.361] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0120.361] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0120.361] lstrlenW (lpString="LanmanServer") returned 12 [0120.361] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0120.361] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0120.361] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0120.361] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0120.361] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0120.361] lstrlenW (lpString="LanmanWorkstation") returned 17 [0120.361] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0120.361] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0120.361] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0120.361] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0120.361] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0120.361] lstrlenW (lpString="lmhosts") returned 7 [0120.361] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0120.361] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0120.361] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0120.361] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0120.362] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0120.362] lstrlenW (lpString="MMCSS") returned 5 [0120.362] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0120.362] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0120.362] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0120.362] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0120.362] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0120.362] lstrlenW (lpString="MpsSvc") returned 6 [0120.362] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0120.362] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0120.362] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0120.362] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0120.362] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0120.362] lstrlenW (lpString="Netman") returned 6 [0120.362] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0120.362] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0120.362] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0120.362] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0120.362] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0120.362] lstrlenW (lpString="netprofm") returned 8 [0120.362] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0120.362] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0120.362] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0120.362] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0120.362] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0120.362] lstrlenW (lpString="NlaSvc") returned 6 [0120.362] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0120.362] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0120.362] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0120.362] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0120.362] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0120.362] lstrlenW (lpString="nsi") returned 3 [0120.362] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0120.362] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0120.362] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0120.362] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0120.362] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0120.362] lstrlenW (lpString="PcaSvc") returned 6 [0120.362] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0120.362] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0120.362] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0120.362] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0120.362] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0120.362] lstrlenW (lpString="PlugPlay") returned 8 [0120.362] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0120.362] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0120.362] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0120.362] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0120.362] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0120.362] lstrlenW (lpString="Power") returned 5 [0120.362] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0120.363] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0120.363] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0120.363] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0120.363] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0120.363] lstrlenW (lpString="ProfSvc") returned 7 [0120.363] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0120.363] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0120.363] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0120.363] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0120.363] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0120.363] lstrlenW (lpString="RpcEptMapper") returned 12 [0120.363] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0120.363] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0120.363] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0120.363] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0120.363] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0120.363] lstrlenW (lpString="RpcSs") returned 5 [0120.363] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0120.363] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0120.363] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0120.363] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0120.363] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0120.363] lstrlenW (lpString="SamSs") returned 5 [0120.363] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0120.363] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0120.363] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0120.363] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0120.363] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0120.363] lstrlenW (lpString="Schedule") returned 8 [0120.363] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0120.363] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0120.363] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0120.363] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0120.363] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0120.363] lstrlenW (lpString="SENS") returned 4 [0120.363] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0120.363] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0120.363] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0120.363] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0120.363] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0120.363] lstrlenW (lpString="ShellHWDetection") returned 16 [0120.363] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0120.363] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0120.363] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0120.363] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0120.363] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0120.363] lstrlenW (lpString="Spooler") returned 7 [0120.363] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0120.363] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0120.363] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0120.364] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0120.364] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0120.364] lstrlenW (lpString="sppsvc") returned 6 [0120.364] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="sppsvc") returned -1 [0120.364] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="sppsvc") returned -1 [0120.364] lstrcmpiW (lpString1="sqlwriter", lpString2="sppsvc") returned 1 [0120.364] lstrcmpiW (lpString1="mssqlserver", lpString2="sppsvc") returned -1 [0120.364] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="sppsvc") returned 1 [0120.364] lstrlenW (lpString="swprv") returned 5 [0120.364] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0120.364] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0120.364] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0120.364] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0120.364] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0120.364] lstrlenW (lpString="SysMain") returned 7 [0120.364] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0120.364] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0120.364] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0120.364] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0120.364] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0120.364] lstrlenW (lpString="Themes") returned 6 [0120.364] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0120.364] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0120.364] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0120.364] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0120.364] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0120.364] lstrlenW (lpString="TrkWks") returned 6 [0120.364] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0120.364] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0120.364] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0120.364] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0120.364] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0120.364] lstrlenW (lpString="UxSms") returned 5 [0120.364] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0120.364] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0120.364] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0120.364] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0120.364] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0120.364] lstrlenW (lpString="VSS") returned 3 [0120.364] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0120.364] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0120.364] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0120.364] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0120.364] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0120.364] lstrlenW (lpString="W32Time") returned 7 [0120.364] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="W32Time") returned -1 [0120.364] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="W32Time") returned -1 [0120.364] lstrcmpiW (lpString1="sqlwriter", lpString2="W32Time") returned -1 [0120.364] lstrcmpiW (lpString1="mssqlserver", lpString2="W32Time") returned -1 [0120.364] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="W32Time") returned -1 [0120.364] lstrlenW (lpString="WdiServiceHost") returned 14 [0120.365] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0120.365] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0120.365] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0120.365] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0120.365] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0120.365] lstrlenW (lpString="WdiSystemHost") returned 13 [0120.365] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0120.365] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0120.365] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0120.365] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0120.365] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0120.365] lstrlenW (lpString="WinDefend") returned 9 [0120.365] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinDefend") returned -1 [0120.365] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinDefend") returned -1 [0120.365] lstrcmpiW (lpString1="sqlwriter", lpString2="WinDefend") returned -1 [0120.365] lstrcmpiW (lpString1="mssqlserver", lpString2="WinDefend") returned -1 [0120.365] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinDefend") returned -1 [0120.365] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0120.365] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0120.365] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0120.365] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0120.365] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0120.365] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0120.365] lstrlenW (lpString="Winmgmt") returned 7 [0120.365] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0120.365] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0120.365] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0120.365] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0120.365] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0120.365] lstrlenW (lpString="wscsvc") returned 6 [0120.365] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wscsvc") returned -1 [0120.365] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wscsvc") returned -1 [0120.365] lstrcmpiW (lpString1="sqlwriter", lpString2="wscsvc") returned -1 [0120.365] lstrcmpiW (lpString1="mssqlserver", lpString2="wscsvc") returned -1 [0120.365] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wscsvc") returned -1 [0120.365] lstrlenW (lpString="wuauserv") returned 8 [0120.365] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wuauserv") returned -1 [0120.365] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wuauserv") returned -1 [0120.365] lstrcmpiW (lpString1="sqlwriter", lpString2="wuauserv") returned -1 [0120.365] lstrcmpiW (lpString1="mssqlserver", lpString2="wuauserv") returned -1 [0120.365] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1f0 [0120.367] Process32FirstW (in: hSnapshot=0x1f0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0120.367] Process32NextW (in: hSnapshot=0x1f0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x51, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0120.371] lstrlenW (lpString="System") returned 6 [0120.371] Process32NextW (in: hSnapshot=0x1f0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0120.371] lstrlenW (lpString="smss.exe") returned 8 [0120.371] Process32NextW (in: hSnapshot=0x1f0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0120.372] lstrlenW (lpString="csrss.exe") returned 9 [0120.372] Process32NextW (in: hSnapshot=0x1f0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0120.373] lstrlenW (lpString="wininit.exe") returned 11 [0120.373] Process32NextW (in: hSnapshot=0x1f0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0120.373] lstrlenW (lpString="csrss.exe") returned 9 [0120.373] Process32NextW (in: hSnapshot=0x1f0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0120.374] lstrlenW (lpString="winlogon.exe") returned 12 [0120.374] Process32NextW (in: hSnapshot=0x1f0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0120.374] lstrlenW (lpString="services.exe") returned 12 [0120.374] Process32NextW (in: hSnapshot=0x1f0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0120.396] lstrlenW (lpString="lsass.exe") returned 9 [0120.396] Process32NextW (in: hSnapshot=0x1f0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0120.396] lstrlenW (lpString="lsm.exe") returned 7 [0120.396] Process32NextW (in: hSnapshot=0x1f0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0120.397] lstrlenW (lpString="svchost.exe") returned 11 [0120.397] Process32NextW (in: hSnapshot=0x1f0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0120.397] lstrlenW (lpString="svchost.exe") returned 11 [0120.397] Process32NextW (in: hSnapshot=0x1f0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0120.398] lstrlenW (lpString="svchost.exe") returned 11 [0120.398] Process32NextW (in: hSnapshot=0x1f0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0120.398] lstrlenW (lpString="svchost.exe") returned 11 [0120.398] Process32NextW (in: hSnapshot=0x1f0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0120.399] lstrlenW (lpString="svchost.exe") returned 11 [0120.399] Process32NextW (in: hSnapshot=0x1f0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0120.399] lstrlenW (lpString="audiodg.exe") returned 11 [0120.399] Process32NextW (in: hSnapshot=0x1f0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0120.400] lstrlenW (lpString="svchost.exe") returned 11 [0120.400] Process32NextW (in: hSnapshot=0x1f0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0120.401] lstrlenW (lpString="svchost.exe") returned 11 [0120.401] Process32NextW (in: hSnapshot=0x1f0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0120.401] lstrlenW (lpString="spoolsv.exe") returned 11 [0120.401] Process32NextW (in: hSnapshot=0x1f0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0120.402] lstrlenW (lpString="svchost.exe") returned 11 [0120.402] Process32NextW (in: hSnapshot=0x1f0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0120.402] lstrlenW (lpString="taskhost.exe") returned 12 [0120.402] Process32NextW (in: hSnapshot=0x1f0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x558, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0120.403] lstrlenW (lpString="dwm.exe") returned 7 [0120.403] Process32NextW (in: hSnapshot=0x1f0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x54c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0120.404] lstrlenW (lpString="explorer.exe") returned 12 [0120.404] Process32NextW (in: hSnapshot=0x1f0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0120.404] lstrlenW (lpString="taskeng.exe") returned 11 [0120.405] Process32NextW (in: hSnapshot=0x1f0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0120.405] lstrlenW (lpString="taskhost.exe") returned 12 [0120.405] Process32NextW (in: hSnapshot=0x1f0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="watches-vessel-arbitrary.exe")) returned 1 [0120.406] lstrlenW (lpString="watches-vessel-arbitrary.exe") returned 28 [0120.406] Process32NextW (in: hSnapshot=0x1f0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="alsopound.exe")) returned 1 [0120.406] lstrlenW (lpString="alsopound.exe") returned 13 [0120.406] Process32NextW (in: hSnapshot=0x1f0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x478, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="measuredamsterdamsandwich.exe")) returned 1 [0120.407] lstrlenW (lpString="measuredamsterdamsandwich.exe") returned 29 [0120.407] Process32NextW (in: hSnapshot=0x1f0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="ooo_lucy_millions.exe")) returned 1 [0120.408] lstrlenW (lpString="ooo_lucy_millions.exe") returned 21 [0120.408] Process32NextW (in: hSnapshot=0x1f0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="appearance.exe")) returned 1 [0120.408] lstrlenW (lpString="appearance.exe") returned 14 [0120.408] Process32NextW (in: hSnapshot=0x1f0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="albert.exe")) returned 1 [0120.409] lstrlenW (lpString="albert.exe") returned 10 [0120.409] Process32NextW (in: hSnapshot=0x1f0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="implied-enquiries.exe")) returned 1 [0120.409] lstrlenW (lpString="implied-enquiries.exe") returned 21 [0120.409] Process32NextW (in: hSnapshot=0x1f0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x72c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="boston_opening.exe")) returned 1 [0120.410] lstrlenW (lpString="boston_opening.exe") returned 18 [0120.410] Process32NextW (in: hSnapshot=0x1f0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="portsmouth.exe")) returned 1 [0120.410] lstrlenW (lpString="portsmouth.exe") returned 14 [0120.410] Process32NextW (in: hSnapshot=0x1f0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="cameras grew poverty.exe")) returned 1 [0120.410] lstrlenW (lpString="cameras grew poverty.exe") returned 24 [0120.410] Process32NextW (in: hSnapshot=0x1f0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="dxrapids.exe")) returned 1 [0120.411] lstrlenW (lpString="dxrapids.exe") returned 12 [0120.411] Process32NextW (in: hSnapshot=0x1f0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x33c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="visitors.exe")) returned 1 [0120.411] lstrlenW (lpString="visitors.exe") returned 12 [0120.411] Process32NextW (in: hSnapshot=0x1f0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="organisations_officially.exe")) returned 1 [0120.412] lstrlenW (lpString="organisations_officially.exe") returned 28 [0120.412] Process32NextW (in: hSnapshot=0x1f0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x61c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="pair.exe")) returned 1 [0120.412] lstrlenW (lpString="pair.exe") returned 8 [0120.412] Process32NextW (in: hSnapshot=0x1f0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="gross.exe")) returned 1 [0120.413] lstrlenW (lpString="gross.exe") returned 9 [0120.413] Process32NextW (in: hSnapshot=0x1f0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x470, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="viewpicture.exe")) returned 1 [0120.413] lstrlenW (lpString="viewpicture.exe") returned 15 [0120.413] Process32NextW (in: hSnapshot=0x1f0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="transmitted.exe")) returned 1 [0120.414] lstrlenW (lpString="transmitted.exe") returned 15 [0120.414] Process32NextW (in: hSnapshot=0x1f0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x634, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="sunglassescelebs.exe")) returned 1 [0120.416] lstrlenW (lpString="sunglassescelebs.exe") returned 20 [0120.416] Process32NextW (in: hSnapshot=0x1f0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="waiver-issue.exe")) returned 1 [0120.417] lstrlenW (lpString="waiver-issue.exe") returned 16 [0120.417] Process32NextW (in: hSnapshot=0x1f0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x808, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="gziprear.exe")) returned 1 [0120.433] lstrlenW (lpString="gziprear.exe") returned 12 [0120.433] Process32NextW (in: hSnapshot=0x1f0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x818, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="gregoryletters.exe")) returned 1 [0120.434] lstrlenW (lpString="gregoryletters.exe") returned 18 [0120.434] Process32NextW (in: hSnapshot=0x1f0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x828, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="intel-metadata-rich.exe")) returned 1 [0120.434] lstrlenW (lpString="intel-metadata-rich.exe") returned 23 [0120.434] Process32NextW (in: hSnapshot=0x1f0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x838, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="cemeteryreconstructiondimension.exe")) returned 1 [0120.435] lstrlenW (lpString="cemeteryreconstructiondimension.exe") returned 35 [0120.435] Process32NextW (in: hSnapshot=0x1f0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0120.435] lstrlenW (lpString="svchost.exe") returned 11 [0120.435] Process32NextW (in: hSnapshot=0x1f0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0120.435] lstrlenW (lpString="sppsvc.exe") returned 10 [0120.436] Process32NextW (in: hSnapshot=0x1f0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xab4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0120.436] lstrlenW (lpString="svchost.exe") returned 11 [0120.436] Process32NextW (in: hSnapshot=0x1f0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x9f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="unlikexpc.exe")) returned 1 [0120.436] lstrlenW (lpString="unlikexpc.exe") returned 13 [0120.436] Process32NextW (in: hSnapshot=0x1f0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xb58, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0120.437] lstrlenW (lpString="cmd.exe") returned 7 [0120.437] Process32NextW (in: hSnapshot=0x1f0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0120.437] lstrlenW (lpString="conhost.exe") returned 11 [0120.437] Process32NextW (in: hSnapshot=0x1f0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xb74, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0120.438] lstrlenW (lpString="vssadmin.exe") returned 12 [0120.438] Process32NextW (in: hSnapshot=0x1f0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0120.438] lstrlenW (lpString="VSSVC.exe") returned 9 [0120.438] Process32NextW (in: hSnapshot=0x1f0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x824, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0120.439] lstrlenW (lpString="svchost.exe") returned 11 [0120.439] Process32NextW (in: hSnapshot=0x1f0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x824, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0120.439] CloseHandle (hObject=0x1f0) returned 1 [0120.439] Sleep (dwMilliseconds=0x1f4) [0121.059] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x819a20 [0121.059] EnumServicesStatusExW (in: hSCManager=0x819a20, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x247fa74, lpServicesReturned=0x247fa8c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x247fa74, lpServicesReturned=0x247fa8c, lpResumeHandle=0x0) returned 0 [0121.059] GetLastError () returned 0xea [0121.060] EnumServicesStatusExW (in: hSCManager=0x819a20, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x8b48e0, cbBufSize=0x1484, pcbBytesNeeded=0x247fa74, lpServicesReturned=0x247fa8c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x8b48e0, pcbBytesNeeded=0x247fa74, lpServicesReturned=0x247fa8c, lpResumeHandle=0x0) returned 1 [0121.060] CloseServiceHandle (hSCObject=0x819a20) returned 1 [0121.060] lstrlenW (lpString="Appinfo") returned 7 [0121.060] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0121.060] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0121.060] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0121.060] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0121.060] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0121.060] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0121.060] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0121.060] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0121.060] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0121.060] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0121.060] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0121.060] lstrlenW (lpString="AudioSrv") returned 8 [0121.060] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0121.060] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0121.060] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0121.061] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0121.061] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0121.061] lstrlenW (lpString="BFE") returned 3 [0121.061] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0121.061] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0121.061] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0121.061] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0121.061] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0121.061] lstrlenW (lpString="CryptSvc") returned 8 [0121.061] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0121.061] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0121.061] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0121.061] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0121.061] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0121.061] lstrlenW (lpString="CscService") returned 10 [0121.061] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0121.061] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0121.061] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0121.061] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0121.061] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0121.061] lstrlenW (lpString="DcomLaunch") returned 10 [0121.061] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0121.061] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0121.061] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0121.061] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0121.061] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0121.061] lstrlenW (lpString="Dhcp") returned 4 [0121.061] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0121.061] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0121.061] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0121.061] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0121.061] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0121.061] lstrlenW (lpString="Dnscache") returned 8 [0121.061] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0121.061] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0121.061] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0121.061] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0121.061] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0121.061] lstrlenW (lpString="DPS") returned 3 [0121.061] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0121.061] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0121.061] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0121.061] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0121.061] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0121.061] lstrlenW (lpString="eventlog") returned 8 [0121.061] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0121.062] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0121.062] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0121.062] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0121.062] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0121.062] lstrlenW (lpString="EventSystem") returned 11 [0121.062] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0121.062] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0121.062] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0121.062] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0121.062] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0121.062] lstrlenW (lpString="FontCache") returned 9 [0121.062] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0121.062] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0121.062] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0121.062] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0121.062] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0121.062] lstrlenW (lpString="gpsvc") returned 5 [0121.062] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0121.062] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0121.062] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0121.062] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0121.062] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0121.062] lstrlenW (lpString="iphlpsvc") returned 8 [0121.062] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0121.062] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0121.062] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0121.062] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0121.062] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0121.062] lstrlenW (lpString="LanmanServer") returned 12 [0121.062] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0121.062] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0121.062] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0121.062] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0121.062] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0121.062] lstrlenW (lpString="LanmanWorkstation") returned 17 [0121.062] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0121.062] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0121.062] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0121.062] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0121.062] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0121.062] lstrlenW (lpString="lmhosts") returned 7 [0121.062] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0121.062] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0121.062] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0121.062] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0121.062] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0121.062] lstrlenW (lpString="MMCSS") returned 5 [0121.062] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0121.063] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0121.063] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0121.063] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0121.063] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0121.063] lstrlenW (lpString="MpsSvc") returned 6 [0121.063] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0121.063] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0121.063] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0121.063] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0121.063] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0121.063] lstrlenW (lpString="Netman") returned 6 [0121.063] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0121.063] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0121.063] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0121.063] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0121.063] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0121.063] lstrlenW (lpString="netprofm") returned 8 [0121.063] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0121.063] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0121.063] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0121.063] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0121.063] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0121.063] lstrlenW (lpString="NlaSvc") returned 6 [0121.063] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0121.063] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0121.063] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0121.063] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0121.063] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0121.063] lstrlenW (lpString="nsi") returned 3 [0121.063] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0121.063] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0121.063] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0121.063] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0121.063] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0121.063] lstrlenW (lpString="PcaSvc") returned 6 [0121.063] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0121.063] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0121.063] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0121.063] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0121.063] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0121.063] lstrlenW (lpString="PlugPlay") returned 8 [0121.063] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0121.063] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0121.063] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0121.063] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0121.063] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0121.063] lstrlenW (lpString="Power") returned 5 [0121.064] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0121.064] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0121.064] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0121.064] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0121.064] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0121.064] lstrlenW (lpString="ProfSvc") returned 7 [0121.064] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0121.064] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0121.064] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0121.064] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0121.064] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0121.064] lstrlenW (lpString="RpcEptMapper") returned 12 [0121.064] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0121.064] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0121.064] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0121.064] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0121.064] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0121.064] lstrlenW (lpString="RpcSs") returned 5 [0121.064] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0121.064] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0121.064] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0121.064] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0121.064] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0121.064] lstrlenW (lpString="SamSs") returned 5 [0121.064] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0121.064] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0121.064] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0121.064] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0121.064] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0121.064] lstrlenW (lpString="Schedule") returned 8 [0121.064] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0121.064] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0121.064] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0121.064] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0121.064] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0121.064] lstrlenW (lpString="SENS") returned 4 [0121.064] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0121.064] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0121.064] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0121.064] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0121.064] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0121.064] lstrlenW (lpString="ShellHWDetection") returned 16 [0121.064] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0121.064] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0121.064] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0121.064] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0121.064] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0121.064] lstrlenW (lpString="Spooler") returned 7 [0121.064] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0121.065] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0121.065] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0121.065] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0121.065] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0121.065] lstrlenW (lpString="sppsvc") returned 6 [0121.065] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="sppsvc") returned -1 [0121.065] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="sppsvc") returned -1 [0121.065] lstrcmpiW (lpString1="sqlwriter", lpString2="sppsvc") returned 1 [0121.065] lstrcmpiW (lpString1="mssqlserver", lpString2="sppsvc") returned -1 [0121.065] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="sppsvc") returned 1 [0121.065] lstrlenW (lpString="swprv") returned 5 [0121.065] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0121.065] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0121.065] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0121.065] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0121.065] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0121.065] lstrlenW (lpString="SysMain") returned 7 [0121.065] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0121.065] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0121.065] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0121.065] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0121.065] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0121.065] lstrlenW (lpString="Themes") returned 6 [0121.065] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0121.065] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0121.065] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0121.065] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0121.065] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0121.065] lstrlenW (lpString="TrkWks") returned 6 [0121.065] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0121.065] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0121.065] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0121.065] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0121.065] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0121.065] lstrlenW (lpString="UxSms") returned 5 [0121.065] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0121.065] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0121.065] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0121.065] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0121.065] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0121.065] lstrlenW (lpString="VSS") returned 3 [0121.065] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0121.065] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0121.065] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0121.065] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0121.065] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0121.065] lstrlenW (lpString="W32Time") returned 7 [0121.065] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="W32Time") returned -1 [0121.065] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="W32Time") returned -1 [0121.065] lstrcmpiW (lpString1="sqlwriter", lpString2="W32Time") returned -1 [0121.065] lstrcmpiW (lpString1="mssqlserver", lpString2="W32Time") returned -1 [0121.066] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="W32Time") returned -1 [0121.066] lstrlenW (lpString="WdiServiceHost") returned 14 [0121.066] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0121.066] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0121.066] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0121.066] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0121.066] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0121.066] lstrlenW (lpString="WdiSystemHost") returned 13 [0121.066] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0121.066] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0121.066] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0121.066] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0121.066] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0121.066] lstrlenW (lpString="WinDefend") returned 9 [0121.066] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinDefend") returned -1 [0121.066] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinDefend") returned -1 [0121.066] lstrcmpiW (lpString1="sqlwriter", lpString2="WinDefend") returned -1 [0121.066] lstrcmpiW (lpString1="mssqlserver", lpString2="WinDefend") returned -1 [0121.066] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinDefend") returned -1 [0121.066] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0121.066] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0121.066] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0121.066] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0121.066] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0121.066] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0121.066] lstrlenW (lpString="Winmgmt") returned 7 [0121.066] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0121.066] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0121.066] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0121.066] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0121.066] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0121.066] lstrlenW (lpString="wscsvc") returned 6 [0121.066] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wscsvc") returned -1 [0121.066] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wscsvc") returned -1 [0121.066] lstrcmpiW (lpString1="sqlwriter", lpString2="wscsvc") returned -1 [0121.066] lstrcmpiW (lpString1="mssqlserver", lpString2="wscsvc") returned -1 [0121.066] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wscsvc") returned -1 [0121.066] lstrlenW (lpString="wuauserv") returned 8 [0121.066] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wuauserv") returned -1 [0121.066] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wuauserv") returned -1 [0121.066] lstrcmpiW (lpString1="sqlwriter", lpString2="wuauserv") returned -1 [0121.066] lstrcmpiW (lpString1="mssqlserver", lpString2="wuauserv") returned -1 [0121.066] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x21c [0121.068] Process32FirstW (in: hSnapshot=0x21c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0121.069] Process32NextW (in: hSnapshot=0x21c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x51, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0121.069] lstrlenW (lpString="System") returned 6 [0121.069] Process32NextW (in: hSnapshot=0x21c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0121.070] lstrlenW (lpString="smss.exe") returned 8 [0121.070] Process32NextW (in: hSnapshot=0x21c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0121.070] lstrlenW (lpString="csrss.exe") returned 9 [0121.070] Process32NextW (in: hSnapshot=0x21c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0121.071] lstrlenW (lpString="wininit.exe") returned 11 [0121.071] Process32NextW (in: hSnapshot=0x21c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0121.071] lstrlenW (lpString="csrss.exe") returned 9 [0121.071] Process32NextW (in: hSnapshot=0x21c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0121.071] lstrlenW (lpString="winlogon.exe") returned 12 [0121.071] Process32NextW (in: hSnapshot=0x21c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0121.072] lstrlenW (lpString="services.exe") returned 12 [0121.072] Process32NextW (in: hSnapshot=0x21c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0121.072] lstrlenW (lpString="lsass.exe") returned 9 [0121.072] Process32NextW (in: hSnapshot=0x21c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0121.073] lstrlenW (lpString="lsm.exe") returned 7 [0121.073] Process32NextW (in: hSnapshot=0x21c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0121.073] lstrlenW (lpString="svchost.exe") returned 11 [0121.073] Process32NextW (in: hSnapshot=0x21c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0121.074] lstrlenW (lpString="svchost.exe") returned 11 [0121.074] Process32NextW (in: hSnapshot=0x21c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0121.074] lstrlenW (lpString="svchost.exe") returned 11 [0121.074] Process32NextW (in: hSnapshot=0x21c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0121.075] lstrlenW (lpString="svchost.exe") returned 11 [0121.075] Process32NextW (in: hSnapshot=0x21c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0121.075] lstrlenW (lpString="svchost.exe") returned 11 [0121.075] Process32NextW (in: hSnapshot=0x21c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0121.076] lstrlenW (lpString="audiodg.exe") returned 11 [0121.076] Process32NextW (in: hSnapshot=0x21c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0121.076] lstrlenW (lpString="svchost.exe") returned 11 [0121.076] Process32NextW (in: hSnapshot=0x21c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0121.077] lstrlenW (lpString="svchost.exe") returned 11 [0121.077] Process32NextW (in: hSnapshot=0x21c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0121.077] lstrlenW (lpString="spoolsv.exe") returned 11 [0121.077] Process32NextW (in: hSnapshot=0x21c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0121.078] lstrlenW (lpString="svchost.exe") returned 11 [0121.078] Process32NextW (in: hSnapshot=0x21c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0121.078] lstrlenW (lpString="taskhost.exe") returned 12 [0121.078] Process32NextW (in: hSnapshot=0x21c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x558, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0121.079] lstrlenW (lpString="dwm.exe") returned 7 [0121.079] Process32NextW (in: hSnapshot=0x21c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x54c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0121.079] lstrlenW (lpString="explorer.exe") returned 12 [0121.079] Process32NextW (in: hSnapshot=0x21c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0121.079] lstrlenW (lpString="taskeng.exe") returned 11 [0121.079] Process32NextW (in: hSnapshot=0x21c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0121.080] lstrlenW (lpString="taskhost.exe") returned 12 [0121.080] Process32NextW (in: hSnapshot=0x21c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="watches-vessel-arbitrary.exe")) returned 1 [0121.080] lstrlenW (lpString="watches-vessel-arbitrary.exe") returned 28 [0121.080] Process32NextW (in: hSnapshot=0x21c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="alsopound.exe")) returned 1 [0121.081] lstrlenW (lpString="alsopound.exe") returned 13 [0121.081] Process32NextW (in: hSnapshot=0x21c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x478, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="measuredamsterdamsandwich.exe")) returned 1 [0121.081] lstrlenW (lpString="measuredamsterdamsandwich.exe") returned 29 [0121.081] Process32NextW (in: hSnapshot=0x21c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="ooo_lucy_millions.exe")) returned 1 [0121.082] lstrlenW (lpString="ooo_lucy_millions.exe") returned 21 [0121.082] Process32NextW (in: hSnapshot=0x21c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="appearance.exe")) returned 1 [0121.082] lstrlenW (lpString="appearance.exe") returned 14 [0121.082] Process32NextW (in: hSnapshot=0x21c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="albert.exe")) returned 1 [0121.083] lstrlenW (lpString="albert.exe") returned 10 [0121.083] Process32NextW (in: hSnapshot=0x21c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="implied-enquiries.exe")) returned 1 [0121.083] lstrlenW (lpString="implied-enquiries.exe") returned 21 [0121.083] Process32NextW (in: hSnapshot=0x21c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x72c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="boston_opening.exe")) returned 1 [0121.084] lstrlenW (lpString="boston_opening.exe") returned 18 [0121.084] Process32NextW (in: hSnapshot=0x21c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="portsmouth.exe")) returned 1 [0121.084] lstrlenW (lpString="portsmouth.exe") returned 14 [0121.084] Process32NextW (in: hSnapshot=0x21c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="cameras grew poverty.exe")) returned 1 [0121.084] lstrlenW (lpString="cameras grew poverty.exe") returned 24 [0121.084] Process32NextW (in: hSnapshot=0x21c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="dxrapids.exe")) returned 1 [0121.085] lstrlenW (lpString="dxrapids.exe") returned 12 [0121.085] Process32NextW (in: hSnapshot=0x21c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x33c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="visitors.exe")) returned 1 [0121.085] lstrlenW (lpString="visitors.exe") returned 12 [0121.085] Process32NextW (in: hSnapshot=0x21c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="organisations_officially.exe")) returned 1 [0121.086] lstrlenW (lpString="organisations_officially.exe") returned 28 [0121.086] Process32NextW (in: hSnapshot=0x21c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x61c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="pair.exe")) returned 1 [0121.086] lstrlenW (lpString="pair.exe") returned 8 [0121.086] Process32NextW (in: hSnapshot=0x21c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="gross.exe")) returned 1 [0121.087] lstrlenW (lpString="gross.exe") returned 9 [0121.087] Process32NextW (in: hSnapshot=0x21c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x470, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="viewpicture.exe")) returned 1 [0121.087] lstrlenW (lpString="viewpicture.exe") returned 15 [0121.088] Process32NextW (in: hSnapshot=0x21c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="transmitted.exe")) returned 1 [0121.090] lstrlenW (lpString="transmitted.exe") returned 15 [0121.090] Process32NextW (in: hSnapshot=0x21c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x634, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="sunglassescelebs.exe")) returned 1 [0121.176] lstrlenW (lpString="sunglassescelebs.exe") returned 20 [0121.176] Process32NextW (in: hSnapshot=0x21c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="waiver-issue.exe")) returned 1 [0121.177] lstrlenW (lpString="waiver-issue.exe") returned 16 [0121.177] Process32NextW (in: hSnapshot=0x21c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x808, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="gziprear.exe")) returned 1 [0121.177] lstrlenW (lpString="gziprear.exe") returned 12 [0121.177] Process32NextW (in: hSnapshot=0x21c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x818, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="gregoryletters.exe")) returned 1 [0121.182] lstrlenW (lpString="gregoryletters.exe") returned 18 [0121.182] Process32NextW (in: hSnapshot=0x21c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x828, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="intel-metadata-rich.exe")) returned 1 [0121.183] lstrlenW (lpString="intel-metadata-rich.exe") returned 23 [0121.183] Process32NextW (in: hSnapshot=0x21c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x838, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="cemeteryreconstructiondimension.exe")) returned 1 [0121.183] lstrlenW (lpString="cemeteryreconstructiondimension.exe") returned 35 [0121.183] Process32NextW (in: hSnapshot=0x21c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0121.225] lstrlenW (lpString="svchost.exe") returned 11 [0121.226] Process32NextW (in: hSnapshot=0x21c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0121.226] lstrlenW (lpString="sppsvc.exe") returned 10 [0121.226] Process32NextW (in: hSnapshot=0x21c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xab4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0121.227] lstrlenW (lpString="svchost.exe") returned 11 [0121.227] Process32NextW (in: hSnapshot=0x21c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x9f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="unlikexpc.exe")) returned 1 [0121.227] lstrlenW (lpString="unlikexpc.exe") returned 13 [0121.227] Process32NextW (in: hSnapshot=0x21c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xb58, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0121.227] lstrlenW (lpString="cmd.exe") returned 7 [0121.227] Process32NextW (in: hSnapshot=0x21c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0121.228] lstrlenW (lpString="conhost.exe") returned 11 [0121.228] Process32NextW (in: hSnapshot=0x21c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xb74, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0121.228] lstrlenW (lpString="vssadmin.exe") returned 12 [0121.228] Process32NextW (in: hSnapshot=0x21c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0121.229] lstrlenW (lpString="VSSVC.exe") returned 9 [0121.229] Process32NextW (in: hSnapshot=0x21c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x824, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0121.229] lstrlenW (lpString="svchost.exe") returned 11 [0121.230] Process32NextW (in: hSnapshot=0x21c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x824, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0121.230] CloseHandle (hObject=0x21c) returned 1 [0121.230] Sleep (dwMilliseconds=0x1f4) [0121.773] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x819a20 [0121.773] EnumServicesStatusExW (in: hSCManager=0x819a20, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x247fa74, lpServicesReturned=0x247fa8c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x247fa74, lpServicesReturned=0x247fa8c, lpResumeHandle=0x0) returned 0 [0121.785] GetLastError () returned 0xea [0121.785] EnumServicesStatusExW (in: hSCManager=0x819a20, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x8b48e0, cbBufSize=0x1484, pcbBytesNeeded=0x247fa74, lpServicesReturned=0x247fa8c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x8b48e0, pcbBytesNeeded=0x247fa74, lpServicesReturned=0x247fa8c, lpResumeHandle=0x0) returned 1 [0121.786] CloseServiceHandle (hSCObject=0x819a20) returned 1 [0121.786] lstrlenW (lpString="Appinfo") returned 7 [0121.786] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0121.786] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0121.802] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0121.802] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0121.802] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0121.802] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0121.803] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0121.803] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0121.803] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0121.803] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0121.803] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0121.803] lstrlenW (lpString="AudioSrv") returned 8 [0121.803] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0121.803] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0121.803] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0121.803] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0121.803] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0121.803] lstrlenW (lpString="BFE") returned 3 [0121.803] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0121.803] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0121.803] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0121.803] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0121.803] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0121.803] lstrlenW (lpString="CryptSvc") returned 8 [0121.803] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0121.803] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0121.803] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0121.803] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0121.803] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0121.803] lstrlenW (lpString="CscService") returned 10 [0121.803] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0121.803] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0121.803] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0121.803] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0121.803] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0121.803] lstrlenW (lpString="DcomLaunch") returned 10 [0121.803] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0121.803] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0121.803] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0121.803] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0121.803] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0121.803] lstrlenW (lpString="Dhcp") returned 4 [0121.803] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0121.803] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0121.803] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0121.803] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0121.803] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0121.803] lstrlenW (lpString="Dnscache") returned 8 [0121.803] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0121.803] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0121.803] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0121.803] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0121.803] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0121.803] lstrlenW (lpString="DPS") returned 3 [0121.803] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0121.803] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0121.803] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0121.804] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0121.804] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0121.804] lstrlenW (lpString="eventlog") returned 8 [0121.804] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0121.804] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0121.804] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0121.804] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0121.804] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0121.804] lstrlenW (lpString="EventSystem") returned 11 [0121.804] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0121.804] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0121.804] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0121.804] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0121.804] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0121.804] lstrlenW (lpString="FontCache") returned 9 [0121.804] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0121.804] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0121.804] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0121.804] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0121.804] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0121.804] lstrlenW (lpString="gpsvc") returned 5 [0121.804] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0121.804] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0121.804] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0121.804] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0121.804] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0121.804] lstrlenW (lpString="iphlpsvc") returned 8 [0121.804] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0121.804] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0121.804] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0121.804] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0121.804] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0121.804] lstrlenW (lpString="LanmanServer") returned 12 [0121.804] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0121.804] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0121.804] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0121.804] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0121.804] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0121.804] lstrlenW (lpString="LanmanWorkstation") returned 17 [0121.804] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0121.804] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0121.804] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0121.804] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0121.804] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0121.804] lstrlenW (lpString="lmhosts") returned 7 [0121.804] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0121.804] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0121.804] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0121.804] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0121.804] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0121.805] lstrlenW (lpString="MMCSS") returned 5 [0121.805] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0121.805] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0121.805] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0121.805] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0121.805] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0121.805] lstrlenW (lpString="MpsSvc") returned 6 [0121.805] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0121.805] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0121.805] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0121.805] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0121.805] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0121.805] lstrlenW (lpString="Netman") returned 6 [0121.805] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0121.805] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0121.805] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0121.805] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0121.805] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0121.805] lstrlenW (lpString="netprofm") returned 8 [0121.805] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0121.805] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0121.805] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0121.805] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0121.805] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0121.805] lstrlenW (lpString="NlaSvc") returned 6 [0121.805] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0121.805] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0121.805] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0121.805] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0121.805] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0121.805] lstrlenW (lpString="nsi") returned 3 [0121.805] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0121.805] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0121.805] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0121.805] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0121.805] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0121.805] lstrlenW (lpString="PcaSvc") returned 6 [0121.805] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0121.805] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0121.805] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0121.805] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0121.805] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0121.805] lstrlenW (lpString="PlugPlay") returned 8 [0121.805] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0121.805] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0121.805] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0121.805] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0121.805] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0121.805] lstrlenW (lpString="Power") returned 5 [0121.805] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0121.806] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0121.806] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0121.806] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0121.806] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0121.806] lstrlenW (lpString="ProfSvc") returned 7 [0121.806] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0121.806] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0121.806] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0121.806] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0121.806] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0121.806] lstrlenW (lpString="RpcEptMapper") returned 12 [0121.806] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0121.806] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0121.806] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0121.806] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0121.806] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0121.806] lstrlenW (lpString="RpcSs") returned 5 [0121.806] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0121.806] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0121.806] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0121.806] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0121.806] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0121.806] lstrlenW (lpString="SamSs") returned 5 [0121.806] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0121.806] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0121.806] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0121.806] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0121.806] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0121.806] lstrlenW (lpString="Schedule") returned 8 [0121.806] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0121.806] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0121.806] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0121.806] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0121.806] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0121.806] lstrlenW (lpString="SENS") returned 4 [0121.806] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0121.806] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0121.806] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0121.806] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0121.806] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0121.807] lstrlenW (lpString="ShellHWDetection") returned 16 [0121.807] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0121.807] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0121.807] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0121.807] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0121.807] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0121.807] lstrlenW (lpString="Spooler") returned 7 [0121.807] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0121.807] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0121.807] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0121.807] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0121.807] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0121.807] lstrlenW (lpString="sppsvc") returned 6 [0121.807] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="sppsvc") returned -1 [0121.807] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="sppsvc") returned -1 [0121.807] lstrcmpiW (lpString1="sqlwriter", lpString2="sppsvc") returned 1 [0121.807] lstrcmpiW (lpString1="mssqlserver", lpString2="sppsvc") returned -1 [0121.807] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="sppsvc") returned 1 [0121.807] lstrlenW (lpString="swprv") returned 5 [0121.807] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0121.807] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0121.807] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0121.807] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0121.807] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0121.807] lstrlenW (lpString="SysMain") returned 7 [0121.807] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0121.807] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0121.807] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0121.807] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0121.807] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0121.807] lstrlenW (lpString="Themes") returned 6 [0121.807] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0121.807] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0121.807] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0121.807] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0121.807] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0121.807] lstrlenW (lpString="TrkWks") returned 6 [0121.807] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0121.807] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0121.807] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0121.807] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0121.808] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0121.808] lstrlenW (lpString="UxSms") returned 5 [0121.808] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0121.808] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0121.808] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0121.808] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0121.808] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0121.808] lstrlenW (lpString="VSS") returned 3 [0121.808] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0121.808] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0121.808] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0121.808] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0121.808] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0121.808] lstrlenW (lpString="W32Time") returned 7 [0121.808] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="W32Time") returned -1 [0121.808] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="W32Time") returned -1 [0121.808] lstrcmpiW (lpString1="sqlwriter", lpString2="W32Time") returned -1 [0121.808] lstrcmpiW (lpString1="mssqlserver", lpString2="W32Time") returned -1 [0121.808] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="W32Time") returned -1 [0121.808] lstrlenW (lpString="WdiServiceHost") returned 14 [0121.808] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0121.808] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0121.808] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0121.808] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0121.808] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0121.808] lstrlenW (lpString="WdiSystemHost") returned 13 [0121.808] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0121.808] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0121.808] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0121.808] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0121.808] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0121.808] lstrlenW (lpString="WinDefend") returned 9 [0121.808] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinDefend") returned -1 [0121.808] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinDefend") returned -1 [0121.808] lstrcmpiW (lpString1="sqlwriter", lpString2="WinDefend") returned -1 [0121.808] lstrcmpiW (lpString1="mssqlserver", lpString2="WinDefend") returned -1 [0121.808] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinDefend") returned -1 [0121.808] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0121.808] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0121.808] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0121.808] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0121.808] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0121.808] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0121.808] lstrlenW (lpString="Winmgmt") returned 7 [0121.808] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0121.808] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0121.808] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0121.808] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0121.808] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0121.808] lstrlenW (lpString="wscsvc") returned 6 [0121.809] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wscsvc") returned -1 [0121.809] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wscsvc") returned -1 [0121.809] lstrcmpiW (lpString1="sqlwriter", lpString2="wscsvc") returned -1 [0121.809] lstrcmpiW (lpString1="mssqlserver", lpString2="wscsvc") returned -1 [0121.809] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wscsvc") returned -1 [0121.809] lstrlenW (lpString="wuauserv") returned 8 [0121.809] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wuauserv") returned -1 [0121.809] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wuauserv") returned -1 [0121.809] lstrcmpiW (lpString1="sqlwriter", lpString2="wuauserv") returned -1 [0121.809] lstrcmpiW (lpString1="mssqlserver", lpString2="wuauserv") returned -1 [0121.809] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1c0 [0121.811] Process32FirstW (in: hSnapshot=0x1c0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0121.811] Process32NextW (in: hSnapshot=0x1c0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x51, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0121.811] lstrlenW (lpString="System") returned 6 [0121.812] Process32NextW (in: hSnapshot=0x1c0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0121.812] lstrlenW (lpString="smss.exe") returned 8 [0121.812] Process32NextW (in: hSnapshot=0x1c0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0121.812] lstrlenW (lpString="csrss.exe") returned 9 [0121.812] Process32NextW (in: hSnapshot=0x1c0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0121.813] lstrlenW (lpString="wininit.exe") returned 11 [0121.813] Process32NextW (in: hSnapshot=0x1c0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0121.813] lstrlenW (lpString="csrss.exe") returned 9 [0121.813] Process32NextW (in: hSnapshot=0x1c0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0121.814] lstrlenW (lpString="winlogon.exe") returned 12 [0121.814] Process32NextW (in: hSnapshot=0x1c0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0121.814] lstrlenW (lpString="services.exe") returned 12 [0121.814] Process32NextW (in: hSnapshot=0x1c0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0121.815] lstrlenW (lpString="lsass.exe") returned 9 [0121.815] Process32NextW (in: hSnapshot=0x1c0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0121.815] lstrlenW (lpString="lsm.exe") returned 7 [0121.815] Process32NextW (in: hSnapshot=0x1c0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0121.816] lstrlenW (lpString="svchost.exe") returned 11 [0121.816] Process32NextW (in: hSnapshot=0x1c0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0121.816] lstrlenW (lpString="svchost.exe") returned 11 [0121.816] Process32NextW (in: hSnapshot=0x1c0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0121.816] lstrlenW (lpString="svchost.exe") returned 11 [0121.816] Process32NextW (in: hSnapshot=0x1c0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0121.817] lstrlenW (lpString="svchost.exe") returned 11 [0121.817] Process32NextW (in: hSnapshot=0x1c0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0121.817] lstrlenW (lpString="svchost.exe") returned 11 [0121.817] Process32NextW (in: hSnapshot=0x1c0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0121.818] lstrlenW (lpString="audiodg.exe") returned 11 [0121.818] Process32NextW (in: hSnapshot=0x1c0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0121.818] lstrlenW (lpString="svchost.exe") returned 11 [0121.818] Process32NextW (in: hSnapshot=0x1c0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0121.819] lstrlenW (lpString="svchost.exe") returned 11 [0121.819] Process32NextW (in: hSnapshot=0x1c0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0121.819] lstrlenW (lpString="spoolsv.exe") returned 11 [0121.819] Process32NextW (in: hSnapshot=0x1c0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0121.820] lstrlenW (lpString="svchost.exe") returned 11 [0121.820] Process32NextW (in: hSnapshot=0x1c0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0121.820] lstrlenW (lpString="taskhost.exe") returned 12 [0121.820] Process32NextW (in: hSnapshot=0x1c0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x558, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0121.820] lstrlenW (lpString="dwm.exe") returned 7 [0121.821] Process32NextW (in: hSnapshot=0x1c0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x54c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0121.821] lstrlenW (lpString="explorer.exe") returned 12 [0121.821] Process32NextW (in: hSnapshot=0x1c0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0121.821] lstrlenW (lpString="taskeng.exe") returned 11 [0121.821] Process32NextW (in: hSnapshot=0x1c0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0121.822] lstrlenW (lpString="taskhost.exe") returned 12 [0121.822] Process32NextW (in: hSnapshot=0x1c0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="watches-vessel-arbitrary.exe")) returned 1 [0121.823] lstrlenW (lpString="watches-vessel-arbitrary.exe") returned 28 [0121.823] Process32NextW (in: hSnapshot=0x1c0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="alsopound.exe")) returned 1 [0121.824] lstrlenW (lpString="alsopound.exe") returned 13 [0121.824] Process32NextW (in: hSnapshot=0x1c0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x478, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="measuredamsterdamsandwich.exe")) returned 1 [0121.824] lstrlenW (lpString="measuredamsterdamsandwich.exe") returned 29 [0121.825] Process32NextW (in: hSnapshot=0x1c0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="ooo_lucy_millions.exe")) returned 1 [0121.826] lstrlenW (lpString="ooo_lucy_millions.exe") returned 21 [0121.826] Process32NextW (in: hSnapshot=0x1c0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="appearance.exe")) returned 1 [0121.826] lstrlenW (lpString="appearance.exe") returned 14 [0121.826] Process32NextW (in: hSnapshot=0x1c0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="albert.exe")) returned 1 [0121.827] lstrlenW (lpString="albert.exe") returned 10 [0121.827] Process32NextW (in: hSnapshot=0x1c0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="implied-enquiries.exe")) returned 1 [0121.828] lstrlenW (lpString="implied-enquiries.exe") returned 21 [0121.828] Process32NextW (in: hSnapshot=0x1c0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x72c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="boston_opening.exe")) returned 1 [0121.828] lstrlenW (lpString="boston_opening.exe") returned 18 [0121.828] Process32NextW (in: hSnapshot=0x1c0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="portsmouth.exe")) returned 1 [0121.828] lstrlenW (lpString="portsmouth.exe") returned 14 [0121.829] Process32NextW (in: hSnapshot=0x1c0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="cameras grew poverty.exe")) returned 1 [0121.829] lstrlenW (lpString="cameras grew poverty.exe") returned 24 [0121.829] Process32NextW (in: hSnapshot=0x1c0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="dxrapids.exe")) returned 1 [0121.829] lstrlenW (lpString="dxrapids.exe") returned 12 [0121.829] Process32NextW (in: hSnapshot=0x1c0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x33c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="visitors.exe")) returned 1 [0121.830] lstrlenW (lpString="visitors.exe") returned 12 [0121.830] Process32NextW (in: hSnapshot=0x1c0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="organisations_officially.exe")) returned 1 [0121.830] lstrlenW (lpString="organisations_officially.exe") returned 28 [0121.833] Process32NextW (in: hSnapshot=0x1c0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x61c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="pair.exe")) returned 1 [0121.835] lstrlenW (lpString="pair.exe") returned 8 [0121.835] Process32NextW (in: hSnapshot=0x1c0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="gross.exe")) returned 1 [0121.835] lstrlenW (lpString="gross.exe") returned 9 [0121.835] Process32NextW (in: hSnapshot=0x1c0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x470, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="viewpicture.exe")) returned 1 [0121.836] lstrlenW (lpString="viewpicture.exe") returned 15 [0121.836] Process32NextW (in: hSnapshot=0x1c0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="transmitted.exe")) returned 1 [0121.836] lstrlenW (lpString="transmitted.exe") returned 15 [0121.836] Process32NextW (in: hSnapshot=0x1c0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x634, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="sunglassescelebs.exe")) returned 1 [0121.836] lstrlenW (lpString="sunglassescelebs.exe") returned 20 [0121.837] Process32NextW (in: hSnapshot=0x1c0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="waiver-issue.exe")) returned 1 [0121.837] lstrlenW (lpString="waiver-issue.exe") returned 16 [0121.837] Process32NextW (in: hSnapshot=0x1c0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x808, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="gziprear.exe")) returned 1 [0121.837] lstrlenW (lpString="gziprear.exe") returned 12 [0121.837] Process32NextW (in: hSnapshot=0x1c0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x818, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="gregoryletters.exe")) returned 1 [0121.838] lstrlenW (lpString="gregoryletters.exe") returned 18 [0121.838] Process32NextW (in: hSnapshot=0x1c0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x828, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="intel-metadata-rich.exe")) returned 1 [0121.838] lstrlenW (lpString="intel-metadata-rich.exe") returned 23 [0121.838] Process32NextW (in: hSnapshot=0x1c0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x838, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="cemeteryreconstructiondimension.exe")) returned 1 [0121.848] lstrlenW (lpString="cemeteryreconstructiondimension.exe") returned 35 [0121.849] Process32NextW (in: hSnapshot=0x1c0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0121.849] lstrlenW (lpString="svchost.exe") returned 11 [0121.849] Process32NextW (in: hSnapshot=0x1c0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0121.850] lstrlenW (lpString="sppsvc.exe") returned 10 [0121.850] Process32NextW (in: hSnapshot=0x1c0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xab4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0121.850] lstrlenW (lpString="svchost.exe") returned 11 [0121.850] Process32NextW (in: hSnapshot=0x1c0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x9f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="unlikexpc.exe")) returned 1 [0121.850] lstrlenW (lpString="unlikexpc.exe") returned 13 [0121.851] Process32NextW (in: hSnapshot=0x1c0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xb58, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0121.851] lstrlenW (lpString="cmd.exe") returned 7 [0121.851] Process32NextW (in: hSnapshot=0x1c0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0121.851] lstrlenW (lpString="conhost.exe") returned 11 [0121.851] Process32NextW (in: hSnapshot=0x1c0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xb74, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0121.921] lstrlenW (lpString="vssadmin.exe") returned 12 [0121.921] Process32NextW (in: hSnapshot=0x1c0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0121.922] lstrlenW (lpString="VSSVC.exe") returned 9 [0121.922] Process32NextW (in: hSnapshot=0x1c0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x824, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0121.922] lstrlenW (lpString="svchost.exe") returned 11 [0121.922] Process32NextW (in: hSnapshot=0x1c0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x824, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0121.923] CloseHandle (hObject=0x1c0) returned 1 [0121.923] Sleep (dwMilliseconds=0x1f4) [0122.479] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x819fc0 [0122.479] EnumServicesStatusExW (in: hSCManager=0x819fc0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x247fa74, lpServicesReturned=0x247fa8c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x247fa74, lpServicesReturned=0x247fa8c, lpResumeHandle=0x0) returned 0 [0122.480] GetLastError () returned 0xea [0122.480] EnumServicesStatusExW (in: hSCManager=0x819fc0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4502098, cbBufSize=0x1484, pcbBytesNeeded=0x247fa74, lpServicesReturned=0x247fa8c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4502098, pcbBytesNeeded=0x247fa74, lpServicesReturned=0x247fa8c, lpResumeHandle=0x0) returned 1 [0122.480] CloseServiceHandle (hSCObject=0x819fc0) returned 1 [0122.480] lstrlenW (lpString="Appinfo") returned 7 [0122.480] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0122.480] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0122.480] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0122.480] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0122.480] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0122.480] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0122.480] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0122.480] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0122.480] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0122.480] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0122.480] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0122.480] lstrlenW (lpString="AudioSrv") returned 8 [0122.480] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0122.480] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0122.480] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0122.480] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0122.480] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0122.480] lstrlenW (lpString="BFE") returned 3 [0122.480] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0122.480] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0122.480] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0122.481] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0122.481] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0122.481] lstrlenW (lpString="CryptSvc") returned 8 [0122.481] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0122.481] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0122.481] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0122.481] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0122.481] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0122.481] lstrlenW (lpString="CscService") returned 10 [0122.481] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0122.481] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0122.481] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0122.481] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0122.481] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0122.481] lstrlenW (lpString="DcomLaunch") returned 10 [0122.481] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0122.481] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0122.481] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0122.481] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0122.481] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0122.481] lstrlenW (lpString="Dhcp") returned 4 [0122.481] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0122.481] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0122.481] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0122.481] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0122.481] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0122.481] lstrlenW (lpString="Dnscache") returned 8 [0122.481] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0122.481] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0122.481] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0122.481] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0122.481] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0122.481] lstrlenW (lpString="DPS") returned 3 [0122.481] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0122.481] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0122.481] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0122.481] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0122.481] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0122.481] lstrlenW (lpString="eventlog") returned 8 [0122.481] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0122.481] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0122.481] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0122.481] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0122.481] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0122.481] lstrlenW (lpString="EventSystem") returned 11 [0122.481] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0122.481] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0122.481] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0122.481] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0122.481] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0122.481] lstrlenW (lpString="FontCache") returned 9 [0122.481] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0122.482] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0122.482] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0122.482] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0122.482] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0122.482] lstrlenW (lpString="gpsvc") returned 5 [0122.482] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0122.482] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0122.482] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0122.482] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0122.482] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0122.482] lstrlenW (lpString="iphlpsvc") returned 8 [0122.482] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0122.482] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0122.482] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0122.482] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0122.482] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0122.482] lstrlenW (lpString="LanmanServer") returned 12 [0122.482] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0122.482] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0122.482] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0122.482] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0122.482] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0122.482] lstrlenW (lpString="LanmanWorkstation") returned 17 [0122.482] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0122.482] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0122.482] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0122.482] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0122.482] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0122.482] lstrlenW (lpString="lmhosts") returned 7 [0122.482] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0122.482] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0122.482] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0122.482] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0122.482] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0122.482] lstrlenW (lpString="MMCSS") returned 5 [0122.482] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0122.482] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0122.482] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0122.482] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0122.482] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0122.482] lstrlenW (lpString="MpsSvc") returned 6 [0122.482] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0122.482] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0122.482] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0122.482] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0122.482] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0122.482] lstrlenW (lpString="Netman") returned 6 [0122.482] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0122.482] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0122.482] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0122.483] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0122.483] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0122.483] lstrlenW (lpString="netprofm") returned 8 [0122.483] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0122.483] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0122.483] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0122.483] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0122.483] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0122.483] lstrlenW (lpString="NlaSvc") returned 6 [0122.483] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0122.483] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0122.483] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0122.483] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0122.483] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0122.483] lstrlenW (lpString="nsi") returned 3 [0122.483] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0122.483] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0122.483] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0122.483] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0122.483] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0122.483] lstrlenW (lpString="PcaSvc") returned 6 [0122.483] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0122.483] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0122.483] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0122.483] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0122.483] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0122.483] lstrlenW (lpString="PlugPlay") returned 8 [0122.483] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0122.483] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0122.483] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0122.483] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0122.483] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0122.483] lstrlenW (lpString="Power") returned 5 [0122.483] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0122.483] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0122.483] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0122.483] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0122.483] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0122.483] lstrlenW (lpString="ProfSvc") returned 7 [0122.483] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0122.483] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0122.483] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0122.483] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0122.483] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0122.483] lstrlenW (lpString="RpcEptMapper") returned 12 [0122.483] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0122.483] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0122.483] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0122.483] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0122.483] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0122.483] lstrlenW (lpString="RpcSs") returned 5 [0122.484] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0122.484] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0122.484] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0122.484] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0122.484] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0122.484] lstrlenW (lpString="SamSs") returned 5 [0122.484] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0122.484] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0122.484] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0122.484] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0122.484] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0122.484] lstrlenW (lpString="Schedule") returned 8 [0122.484] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0122.484] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0122.484] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0122.484] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0122.506] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0122.506] lstrlenW (lpString="SENS") returned 4 [0122.506] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0122.506] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0122.506] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0122.506] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0122.506] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0122.506] lstrlenW (lpString="ShellHWDetection") returned 16 [0122.506] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0122.506] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0122.506] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0122.506] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0122.506] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0122.506] lstrlenW (lpString="Spooler") returned 7 [0122.506] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0122.506] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0122.506] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0122.506] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0122.506] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0122.506] lstrlenW (lpString="sppsvc") returned 6 [0122.506] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="sppsvc") returned -1 [0122.506] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="sppsvc") returned -1 [0122.506] lstrcmpiW (lpString1="sqlwriter", lpString2="sppsvc") returned 1 [0122.506] lstrcmpiW (lpString1="mssqlserver", lpString2="sppsvc") returned -1 [0122.506] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="sppsvc") returned 1 [0122.506] lstrlenW (lpString="swprv") returned 5 [0122.506] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0122.506] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0122.506] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0122.506] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0122.506] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0122.506] lstrlenW (lpString="SysMain") returned 7 [0122.507] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0122.507] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0122.507] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0122.507] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0122.507] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0122.507] lstrlenW (lpString="Themes") returned 6 [0122.507] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0122.507] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0122.507] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0122.507] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0122.507] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0122.507] lstrlenW (lpString="TrkWks") returned 6 [0122.507] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0122.507] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0122.507] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0122.507] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0122.507] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0122.507] lstrlenW (lpString="UxSms") returned 5 [0122.507] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0122.507] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0122.507] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0122.507] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0122.507] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0122.507] lstrlenW (lpString="VSS") returned 3 [0122.507] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0122.507] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0122.507] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0122.507] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0122.507] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0122.507] lstrlenW (lpString="W32Time") returned 7 [0122.507] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="W32Time") returned -1 [0122.507] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="W32Time") returned -1 [0122.507] lstrcmpiW (lpString1="sqlwriter", lpString2="W32Time") returned -1 [0122.507] lstrcmpiW (lpString1="mssqlserver", lpString2="W32Time") returned -1 [0122.507] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="W32Time") returned -1 [0122.507] lstrlenW (lpString="WdiServiceHost") returned 14 [0122.507] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0122.507] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0122.507] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0122.507] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0122.507] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0122.507] lstrlenW (lpString="WdiSystemHost") returned 13 [0122.507] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0122.507] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0122.507] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0122.507] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0122.507] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0122.507] lstrlenW (lpString="WinDefend") returned 9 [0122.507] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinDefend") returned -1 [0122.508] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinDefend") returned -1 [0122.508] lstrcmpiW (lpString1="sqlwriter", lpString2="WinDefend") returned -1 [0122.508] lstrcmpiW (lpString1="mssqlserver", lpString2="WinDefend") returned -1 [0122.508] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinDefend") returned -1 [0122.508] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0122.508] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0122.508] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0122.508] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0122.508] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0122.508] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0122.508] lstrlenW (lpString="Winmgmt") returned 7 [0122.508] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0122.508] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0122.508] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0122.508] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0122.508] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0122.508] lstrlenW (lpString="wscsvc") returned 6 [0122.508] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wscsvc") returned -1 [0122.508] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wscsvc") returned -1 [0122.508] lstrcmpiW (lpString1="sqlwriter", lpString2="wscsvc") returned -1 [0122.508] lstrcmpiW (lpString1="mssqlserver", lpString2="wscsvc") returned -1 [0122.508] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wscsvc") returned -1 [0122.508] lstrlenW (lpString="wuauserv") returned 8 [0122.508] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wuauserv") returned -1 [0122.508] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wuauserv") returned -1 [0122.508] lstrcmpiW (lpString1="sqlwriter", lpString2="wuauserv") returned -1 [0122.508] lstrcmpiW (lpString1="mssqlserver", lpString2="wuauserv") returned -1 [0122.508] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x238 [0122.510] Process32FirstW (in: hSnapshot=0x238, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0122.510] Process32NextW (in: hSnapshot=0x238, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x51, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0122.511] lstrlenW (lpString="System") returned 6 [0122.511] Process32NextW (in: hSnapshot=0x238, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0122.511] lstrlenW (lpString="smss.exe") returned 8 [0122.512] Process32NextW (in: hSnapshot=0x238, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0122.512] lstrlenW (lpString="csrss.exe") returned 9 [0122.512] Process32NextW (in: hSnapshot=0x238, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0122.513] lstrlenW (lpString="wininit.exe") returned 11 [0122.513] Process32NextW (in: hSnapshot=0x238, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0122.514] lstrlenW (lpString="csrss.exe") returned 9 [0122.514] Process32NextW (in: hSnapshot=0x238, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0122.514] lstrlenW (lpString="winlogon.exe") returned 12 [0122.514] Process32NextW (in: hSnapshot=0x238, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0122.515] lstrlenW (lpString="services.exe") returned 12 [0122.515] Process32NextW (in: hSnapshot=0x238, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0122.678] lstrlenW (lpString="lsass.exe") returned 9 [0122.678] Process32NextW (in: hSnapshot=0x238, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0122.678] lstrlenW (lpString="lsm.exe") returned 7 [0122.678] Process32NextW (in: hSnapshot=0x238, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0122.679] lstrlenW (lpString="svchost.exe") returned 11 [0122.679] Process32NextW (in: hSnapshot=0x238, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0122.679] lstrlenW (lpString="svchost.exe") returned 11 [0122.679] Process32NextW (in: hSnapshot=0x238, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0122.680] lstrlenW (lpString="svchost.exe") returned 11 [0122.680] Process32NextW (in: hSnapshot=0x238, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0122.680] lstrlenW (lpString="svchost.exe") returned 11 [0122.680] Process32NextW (in: hSnapshot=0x238, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0122.681] lstrlenW (lpString="svchost.exe") returned 11 [0122.681] Process32NextW (in: hSnapshot=0x238, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0122.681] lstrlenW (lpString="audiodg.exe") returned 11 [0122.681] Process32NextW (in: hSnapshot=0x238, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0122.682] lstrlenW (lpString="svchost.exe") returned 11 [0122.682] Process32NextW (in: hSnapshot=0x238, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0122.682] lstrlenW (lpString="svchost.exe") returned 11 [0122.682] Process32NextW (in: hSnapshot=0x238, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0122.683] lstrlenW (lpString="spoolsv.exe") returned 11 [0122.683] Process32NextW (in: hSnapshot=0x238, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0122.683] lstrlenW (lpString="svchost.exe") returned 11 [0122.683] Process32NextW (in: hSnapshot=0x238, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0122.683] lstrlenW (lpString="taskhost.exe") returned 12 [0122.683] Process32NextW (in: hSnapshot=0x238, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x558, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0122.684] lstrlenW (lpString="dwm.exe") returned 7 [0122.684] Process32NextW (in: hSnapshot=0x238, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x54c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0122.684] lstrlenW (lpString="explorer.exe") returned 12 [0122.684] Process32NextW (in: hSnapshot=0x238, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0122.685] lstrlenW (lpString="taskeng.exe") returned 11 [0122.685] Process32NextW (in: hSnapshot=0x238, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0122.685] lstrlenW (lpString="taskhost.exe") returned 12 [0122.685] Process32NextW (in: hSnapshot=0x238, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="watches-vessel-arbitrary.exe")) returned 1 [0122.686] lstrlenW (lpString="watches-vessel-arbitrary.exe") returned 28 [0122.686] Process32NextW (in: hSnapshot=0x238, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="alsopound.exe")) returned 1 [0122.686] lstrlenW (lpString="alsopound.exe") returned 13 [0122.686] Process32NextW (in: hSnapshot=0x238, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x478, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="measuredamsterdamsandwich.exe")) returned 1 [0122.687] lstrlenW (lpString="measuredamsterdamsandwich.exe") returned 29 [0122.687] Process32NextW (in: hSnapshot=0x238, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="ooo_lucy_millions.exe")) returned 1 [0122.687] lstrlenW (lpString="ooo_lucy_millions.exe") returned 21 [0122.687] Process32NextW (in: hSnapshot=0x238, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="appearance.exe")) returned 1 [0122.687] lstrlenW (lpString="appearance.exe") returned 14 [0122.687] Process32NextW (in: hSnapshot=0x238, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="albert.exe")) returned 1 [0122.688] lstrlenW (lpString="albert.exe") returned 10 [0122.688] Process32NextW (in: hSnapshot=0x238, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="implied-enquiries.exe")) returned 1 [0122.688] lstrlenW (lpString="implied-enquiries.exe") returned 21 [0122.688] Process32NextW (in: hSnapshot=0x238, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x72c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="boston_opening.exe")) returned 1 [0122.689] lstrlenW (lpString="boston_opening.exe") returned 18 [0122.689] Process32NextW (in: hSnapshot=0x238, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="portsmouth.exe")) returned 1 [0122.689] lstrlenW (lpString="portsmouth.exe") returned 14 [0122.689] Process32NextW (in: hSnapshot=0x238, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="cameras grew poverty.exe")) returned 1 [0122.690] lstrlenW (lpString="cameras grew poverty.exe") returned 24 [0122.690] Process32NextW (in: hSnapshot=0x238, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="dxrapids.exe")) returned 1 [0122.690] lstrlenW (lpString="dxrapids.exe") returned 12 [0122.690] Process32NextW (in: hSnapshot=0x238, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x33c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="visitors.exe")) returned 1 [0122.691] lstrlenW (lpString="visitors.exe") returned 12 [0122.691] Process32NextW (in: hSnapshot=0x238, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="organisations_officially.exe")) returned 1 [0122.691] lstrlenW (lpString="organisations_officially.exe") returned 28 [0122.691] Process32NextW (in: hSnapshot=0x238, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x61c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="pair.exe")) returned 1 [0122.691] lstrlenW (lpString="pair.exe") returned 8 [0122.692] Process32NextW (in: hSnapshot=0x238, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="gross.exe")) returned 1 [0122.692] lstrlenW (lpString="gross.exe") returned 9 [0122.692] Process32NextW (in: hSnapshot=0x238, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x470, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="viewpicture.exe")) returned 1 [0122.692] lstrlenW (lpString="viewpicture.exe") returned 15 [0122.692] Process32NextW (in: hSnapshot=0x238, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="transmitted.exe")) returned 1 [0122.712] lstrlenW (lpString="transmitted.exe") returned 15 [0122.712] Process32NextW (in: hSnapshot=0x238, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x634, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="sunglassescelebs.exe")) returned 1 [0122.712] lstrlenW (lpString="sunglassescelebs.exe") returned 20 [0122.712] Process32NextW (in: hSnapshot=0x238, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="waiver-issue.exe")) returned 1 [0122.713] lstrlenW (lpString="waiver-issue.exe") returned 16 [0122.713] Process32NextW (in: hSnapshot=0x238, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x808, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="gziprear.exe")) returned 1 [0122.713] lstrlenW (lpString="gziprear.exe") returned 12 [0122.713] Process32NextW (in: hSnapshot=0x238, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x818, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="gregoryletters.exe")) returned 1 [0122.714] lstrlenW (lpString="gregoryletters.exe") returned 18 [0122.714] Process32NextW (in: hSnapshot=0x238, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x828, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="intel-metadata-rich.exe")) returned 1 [0122.714] lstrlenW (lpString="intel-metadata-rich.exe") returned 23 [0122.714] Process32NextW (in: hSnapshot=0x238, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x838, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="cemeteryreconstructiondimension.exe")) returned 1 [0122.715] lstrlenW (lpString="cemeteryreconstructiondimension.exe") returned 35 [0122.715] Process32NextW (in: hSnapshot=0x238, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0122.715] lstrlenW (lpString="svchost.exe") returned 11 [0122.715] Process32NextW (in: hSnapshot=0x238, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0122.716] lstrlenW (lpString="sppsvc.exe") returned 10 [0122.716] Process32NextW (in: hSnapshot=0x238, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xab4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0122.716] lstrlenW (lpString="svchost.exe") returned 11 [0122.716] Process32NextW (in: hSnapshot=0x238, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x9f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="unlikexpc.exe")) returned 1 [0122.717] lstrlenW (lpString="unlikexpc.exe") returned 13 [0122.717] Process32NextW (in: hSnapshot=0x238, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xb58, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0122.965] lstrlenW (lpString="cmd.exe") returned 7 [0122.965] Process32NextW (in: hSnapshot=0x238, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0122.965] lstrlenW (lpString="conhost.exe") returned 11 [0122.965] Process32NextW (in: hSnapshot=0x238, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xb74, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0122.966] lstrlenW (lpString="vssadmin.exe") returned 12 [0122.966] Process32NextW (in: hSnapshot=0x238, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0122.966] lstrlenW (lpString="VSSVC.exe") returned 9 [0122.966] Process32NextW (in: hSnapshot=0x238, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x824, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0122.967] lstrlenW (lpString="svchost.exe") returned 11 [0122.967] Process32NextW (in: hSnapshot=0x238, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x824, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0122.967] CloseHandle (hObject=0x238) returned 1 [0122.967] Sleep (dwMilliseconds=0x1f4) [0123.477] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x3ef0a68 [0123.478] EnumServicesStatusExW (in: hSCManager=0x3ef0a68, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x247fa74, lpServicesReturned=0x247fa8c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x247fa74, lpServicesReturned=0x247fa8c, lpResumeHandle=0x0) returned 0 [0123.478] GetLastError () returned 0xea [0123.478] EnumServicesStatusExW (in: hSCManager=0x3ef0a68, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4502098, cbBufSize=0x1484, pcbBytesNeeded=0x247fa74, lpServicesReturned=0x247fa8c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4502098, pcbBytesNeeded=0x247fa74, lpServicesReturned=0x247fa8c, lpResumeHandle=0x0) returned 1 [0123.478] CloseServiceHandle (hSCObject=0x3ef0a68) returned 1 [0123.478] lstrlenW (lpString="Appinfo") returned 7 [0123.478] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0123.478] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0123.479] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0123.479] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0123.479] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0123.479] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0123.479] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0123.479] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0123.479] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0123.479] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0123.479] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0123.479] lstrlenW (lpString="AudioSrv") returned 8 [0123.479] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0123.479] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0123.479] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0123.479] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0123.479] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0123.479] lstrlenW (lpString="BFE") returned 3 [0123.479] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0123.479] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0123.479] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0123.479] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0123.479] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0123.479] lstrlenW (lpString="CryptSvc") returned 8 [0123.479] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0123.479] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0123.479] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0123.479] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0123.479] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0123.479] lstrlenW (lpString="CscService") returned 10 [0123.479] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0123.479] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0123.479] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0123.479] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0123.479] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0123.479] lstrlenW (lpString="DcomLaunch") returned 10 [0123.479] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0123.479] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0123.479] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0123.479] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0123.479] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0123.479] lstrlenW (lpString="Dhcp") returned 4 [0123.479] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0123.479] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0123.479] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0123.479] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0123.480] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0123.480] lstrlenW (lpString="Dnscache") returned 8 [0123.480] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0123.480] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0123.480] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0123.480] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0123.480] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0123.480] lstrlenW (lpString="DPS") returned 3 [0123.480] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0123.480] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0123.480] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0123.480] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0123.480] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0123.480] lstrlenW (lpString="eventlog") returned 8 [0123.480] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0123.480] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0123.480] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0123.480] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0123.480] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0123.480] lstrlenW (lpString="EventSystem") returned 11 [0123.480] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0123.480] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0123.480] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0123.480] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0123.480] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0123.480] lstrlenW (lpString="FontCache") returned 9 [0123.480] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0123.480] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0123.480] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0123.480] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0123.480] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0123.480] lstrlenW (lpString="gpsvc") returned 5 [0123.480] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0123.480] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0123.480] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0123.480] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0123.480] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0123.480] lstrlenW (lpString="iphlpsvc") returned 8 [0123.480] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0123.480] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0123.480] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0123.480] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0123.480] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0123.480] lstrlenW (lpString="LanmanServer") returned 12 [0123.480] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0123.480] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0123.480] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0123.480] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0123.480] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0123.480] lstrlenW (lpString="LanmanWorkstation") returned 17 [0123.481] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0123.481] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0123.481] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0123.481] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0123.481] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0123.481] lstrlenW (lpString="lmhosts") returned 7 [0123.481] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0123.481] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0123.481] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0123.481] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0123.481] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0123.481] lstrlenW (lpString="MMCSS") returned 5 [0123.481] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0123.481] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0123.481] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0123.481] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0123.481] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0123.481] lstrlenW (lpString="MpsSvc") returned 6 [0123.481] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0123.481] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0123.481] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0123.481] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0123.481] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0123.481] lstrlenW (lpString="Netman") returned 6 [0123.481] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0123.481] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0123.481] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0123.481] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0123.481] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0123.481] lstrlenW (lpString="netprofm") returned 8 [0123.481] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0123.481] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0123.481] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0123.481] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0123.481] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0123.481] lstrlenW (lpString="NlaSvc") returned 6 [0123.481] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0123.481] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0123.481] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0123.481] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0123.481] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0123.481] lstrlenW (lpString="nsi") returned 3 [0123.481] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0123.481] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0123.481] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0123.481] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0123.481] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0123.481] lstrlenW (lpString="PcaSvc") returned 6 [0123.481] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0123.481] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0123.481] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0123.482] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0123.482] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0123.482] lstrlenW (lpString="PlugPlay") returned 8 [0123.482] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0123.482] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0123.482] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0123.482] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0123.482] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0123.482] lstrlenW (lpString="Power") returned 5 [0123.482] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0123.482] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0123.482] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0123.482] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0123.482] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0123.482] lstrlenW (lpString="ProfSvc") returned 7 [0123.482] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0123.482] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0123.482] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0123.482] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0123.482] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0123.482] lstrlenW (lpString="RpcEptMapper") returned 12 [0123.482] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0123.482] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0123.482] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0123.482] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0123.482] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0123.482] lstrlenW (lpString="RpcSs") returned 5 [0123.482] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0123.482] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0123.482] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0123.482] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0123.482] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0123.482] lstrlenW (lpString="SamSs") returned 5 [0123.482] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0123.482] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0123.482] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0123.482] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0123.482] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0123.482] lstrlenW (lpString="Schedule") returned 8 [0123.482] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0123.482] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0123.482] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0123.482] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0123.482] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0123.482] lstrlenW (lpString="SENS") returned 4 [0123.482] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0123.482] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0123.482] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0123.482] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0123.482] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0123.482] lstrlenW (lpString="ShellHWDetection") returned 16 [0123.482] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0123.483] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0123.483] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0123.483] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0123.483] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0123.483] lstrlenW (lpString="Spooler") returned 7 [0123.483] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0123.483] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0123.483] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0123.483] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0123.483] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0123.483] lstrlenW (lpString="sppsvc") returned 6 [0123.483] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="sppsvc") returned -1 [0123.483] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="sppsvc") returned -1 [0123.483] lstrcmpiW (lpString1="sqlwriter", lpString2="sppsvc") returned 1 [0123.483] lstrcmpiW (lpString1="mssqlserver", lpString2="sppsvc") returned -1 [0123.483] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="sppsvc") returned 1 [0123.483] lstrlenW (lpString="swprv") returned 5 [0123.483] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0123.483] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0123.483] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0123.483] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0123.483] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0123.483] lstrlenW (lpString="SysMain") returned 7 [0123.483] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0123.483] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0123.483] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0123.483] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0123.483] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0123.483] lstrlenW (lpString="Themes") returned 6 [0123.483] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0123.483] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0123.483] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0123.483] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0123.483] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0123.483] lstrlenW (lpString="TrkWks") returned 6 [0123.483] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0123.483] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0123.483] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0123.483] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0123.483] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0123.483] lstrlenW (lpString="UxSms") returned 5 [0123.483] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0123.483] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0123.483] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0123.483] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0123.483] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0123.483] lstrlenW (lpString="VSS") returned 3 [0123.484] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0123.484] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0123.484] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0123.484] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0123.484] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0123.484] lstrlenW (lpString="W32Time") returned 7 [0123.484] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="W32Time") returned -1 [0123.484] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="W32Time") returned -1 [0123.484] lstrcmpiW (lpString1="sqlwriter", lpString2="W32Time") returned -1 [0123.484] lstrcmpiW (lpString1="mssqlserver", lpString2="W32Time") returned -1 [0123.484] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="W32Time") returned -1 [0123.484] lstrlenW (lpString="WdiServiceHost") returned 14 [0123.484] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0123.484] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0123.484] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0123.484] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0123.484] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0123.484] lstrlenW (lpString="WdiSystemHost") returned 13 [0123.484] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0123.484] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0123.484] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0123.484] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0123.484] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0123.484] lstrlenW (lpString="WinDefend") returned 9 [0123.484] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinDefend") returned -1 [0123.484] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinDefend") returned -1 [0123.484] lstrcmpiW (lpString1="sqlwriter", lpString2="WinDefend") returned -1 [0123.484] lstrcmpiW (lpString1="mssqlserver", lpString2="WinDefend") returned -1 [0123.484] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinDefend") returned -1 [0123.484] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0123.484] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0123.484] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0123.484] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0123.484] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0123.484] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0123.484] lstrlenW (lpString="Winmgmt") returned 7 [0123.484] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0123.484] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0123.484] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0123.484] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0123.484] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0123.484] lstrlenW (lpString="wscsvc") returned 6 [0123.484] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wscsvc") returned -1 [0123.484] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wscsvc") returned -1 [0123.485] lstrcmpiW (lpString1="sqlwriter", lpString2="wscsvc") returned -1 [0123.485] lstrcmpiW (lpString1="mssqlserver", lpString2="wscsvc") returned -1 [0123.485] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wscsvc") returned -1 [0123.485] lstrlenW (lpString="wuauserv") returned 8 [0123.485] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wuauserv") returned -1 [0123.485] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wuauserv") returned -1 [0123.485] lstrcmpiW (lpString1="sqlwriter", lpString2="wuauserv") returned -1 [0123.485] lstrcmpiW (lpString1="mssqlserver", lpString2="wuauserv") returned -1 [0123.485] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x258 [0123.486] Process32FirstW (in: hSnapshot=0x258, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0123.487] Process32NextW (in: hSnapshot=0x258, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x51, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0123.487] lstrlenW (lpString="System") returned 6 [0123.487] Process32NextW (in: hSnapshot=0x258, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0123.487] lstrlenW (lpString="smss.exe") returned 8 [0123.488] Process32NextW (in: hSnapshot=0x258, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0123.488] lstrlenW (lpString="csrss.exe") returned 9 [0123.488] Process32NextW (in: hSnapshot=0x258, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0123.489] lstrlenW (lpString="wininit.exe") returned 11 [0123.489] Process32NextW (in: hSnapshot=0x258, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0123.489] lstrlenW (lpString="csrss.exe") returned 9 [0123.489] Process32NextW (in: hSnapshot=0x258, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0123.490] lstrlenW (lpString="winlogon.exe") returned 12 [0123.490] Process32NextW (in: hSnapshot=0x258, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0123.490] lstrlenW (lpString="services.exe") returned 12 [0123.490] Process32NextW (in: hSnapshot=0x258, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0123.490] lstrlenW (lpString="lsass.exe") returned 9 [0123.490] Process32NextW (in: hSnapshot=0x258, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0123.491] lstrlenW (lpString="lsm.exe") returned 7 [0123.491] Process32NextW (in: hSnapshot=0x258, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0123.491] lstrlenW (lpString="svchost.exe") returned 11 [0123.491] Process32NextW (in: hSnapshot=0x258, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0123.492] lstrlenW (lpString="svchost.exe") returned 11 [0123.492] Process32NextW (in: hSnapshot=0x258, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0123.492] lstrlenW (lpString="svchost.exe") returned 11 [0123.492] Process32NextW (in: hSnapshot=0x258, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0123.493] lstrlenW (lpString="svchost.exe") returned 11 [0123.493] Process32NextW (in: hSnapshot=0x258, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0123.494] lstrlenW (lpString="svchost.exe") returned 11 [0123.494] Process32NextW (in: hSnapshot=0x258, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0123.494] lstrlenW (lpString="audiodg.exe") returned 11 [0123.494] Process32NextW (in: hSnapshot=0x258, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0123.494] lstrlenW (lpString="svchost.exe") returned 11 [0123.494] Process32NextW (in: hSnapshot=0x258, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0123.495] lstrlenW (lpString="svchost.exe") returned 11 [0123.495] Process32NextW (in: hSnapshot=0x258, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0123.495] lstrlenW (lpString="spoolsv.exe") returned 11 [0123.495] Process32NextW (in: hSnapshot=0x258, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0123.496] lstrlenW (lpString="svchost.exe") returned 11 [0123.496] Process32NextW (in: hSnapshot=0x258, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0123.496] lstrlenW (lpString="taskhost.exe") returned 12 [0123.496] Process32NextW (in: hSnapshot=0x258, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x558, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0123.497] lstrlenW (lpString="dwm.exe") returned 7 [0123.497] Process32NextW (in: hSnapshot=0x258, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x54c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0123.497] lstrlenW (lpString="explorer.exe") returned 12 [0123.497] Process32NextW (in: hSnapshot=0x258, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0123.498] lstrlenW (lpString="taskeng.exe") returned 11 [0123.498] Process32NextW (in: hSnapshot=0x258, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0123.498] lstrlenW (lpString="taskhost.exe") returned 12 [0123.498] Process32NextW (in: hSnapshot=0x258, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="watches-vessel-arbitrary.exe")) returned 1 [0123.499] lstrlenW (lpString="watches-vessel-arbitrary.exe") returned 28 [0123.499] Process32NextW (in: hSnapshot=0x258, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="alsopound.exe")) returned 1 [0123.499] lstrlenW (lpString="alsopound.exe") returned 13 [0123.499] Process32NextW (in: hSnapshot=0x258, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x478, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="measuredamsterdamsandwich.exe")) returned 1 [0123.499] lstrlenW (lpString="measuredamsterdamsandwich.exe") returned 29 [0123.499] Process32NextW (in: hSnapshot=0x258, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="ooo_lucy_millions.exe")) returned 1 [0123.500] lstrlenW (lpString="ooo_lucy_millions.exe") returned 21 [0123.500] Process32NextW (in: hSnapshot=0x258, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="appearance.exe")) returned 1 [0123.500] lstrlenW (lpString="appearance.exe") returned 14 [0123.500] Process32NextW (in: hSnapshot=0x258, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="albert.exe")) returned 1 [0123.501] lstrlenW (lpString="albert.exe") returned 10 [0123.501] Process32NextW (in: hSnapshot=0x258, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="implied-enquiries.exe")) returned 1 [0123.501] lstrlenW (lpString="implied-enquiries.exe") returned 21 [0123.501] Process32NextW (in: hSnapshot=0x258, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x72c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="boston_opening.exe")) returned 1 [0123.502] lstrlenW (lpString="boston_opening.exe") returned 18 [0123.502] Process32NextW (in: hSnapshot=0x258, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="portsmouth.exe")) returned 1 [0123.502] lstrlenW (lpString="portsmouth.exe") returned 14 [0123.502] Process32NextW (in: hSnapshot=0x258, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="cameras grew poverty.exe")) returned 1 [0123.503] lstrlenW (lpString="cameras grew poverty.exe") returned 24 [0123.503] Process32NextW (in: hSnapshot=0x258, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="dxrapids.exe")) returned 1 [0123.503] lstrlenW (lpString="dxrapids.exe") returned 12 [0123.503] Process32NextW (in: hSnapshot=0x258, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x33c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="visitors.exe")) returned 1 [0123.504] lstrlenW (lpString="visitors.exe") returned 12 [0123.504] Process32NextW (in: hSnapshot=0x258, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="organisations_officially.exe")) returned 1 [0123.504] lstrlenW (lpString="organisations_officially.exe") returned 28 [0123.504] Process32NextW (in: hSnapshot=0x258, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x61c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="pair.exe")) returned 1 [0123.504] lstrlenW (lpString="pair.exe") returned 8 [0123.505] Process32NextW (in: hSnapshot=0x258, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="gross.exe")) returned 1 [0123.505] lstrlenW (lpString="gross.exe") returned 9 [0123.505] Process32NextW (in: hSnapshot=0x258, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x470, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="viewpicture.exe")) returned 1 [0123.505] lstrlenW (lpString="viewpicture.exe") returned 15 [0123.505] Process32NextW (in: hSnapshot=0x258, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="transmitted.exe")) returned 1 [0123.506] lstrlenW (lpString="transmitted.exe") returned 15 [0123.506] Process32NextW (in: hSnapshot=0x258, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x634, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="sunglassescelebs.exe")) returned 1 [0123.506] lstrlenW (lpString="sunglassescelebs.exe") returned 20 [0123.506] Process32NextW (in: hSnapshot=0x258, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="waiver-issue.exe")) returned 1 [0123.507] lstrlenW (lpString="waiver-issue.exe") returned 16 [0123.507] Process32NextW (in: hSnapshot=0x258, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x808, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="gziprear.exe")) returned 1 [0123.507] lstrlenW (lpString="gziprear.exe") returned 12 [0123.507] Process32NextW (in: hSnapshot=0x258, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x818, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="gregoryletters.exe")) returned 1 [0123.508] lstrlenW (lpString="gregoryletters.exe") returned 18 [0123.508] Process32NextW (in: hSnapshot=0x258, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x828, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="intel-metadata-rich.exe")) returned 1 [0123.509] lstrlenW (lpString="intel-metadata-rich.exe") returned 23 [0123.509] Process32NextW (in: hSnapshot=0x258, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x838, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="cemeteryreconstructiondimension.exe")) returned 1 [0123.509] lstrlenW (lpString="cemeteryreconstructiondimension.exe") returned 35 [0123.509] Process32NextW (in: hSnapshot=0x258, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0123.510] lstrlenW (lpString="svchost.exe") returned 11 [0123.510] Process32NextW (in: hSnapshot=0x258, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0123.510] lstrlenW (lpString="sppsvc.exe") returned 10 [0123.510] Process32NextW (in: hSnapshot=0x258, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xab4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0123.511] lstrlenW (lpString="svchost.exe") returned 11 [0123.511] Process32NextW (in: hSnapshot=0x258, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x9f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="unlikexpc.exe")) returned 1 [0123.511] lstrlenW (lpString="unlikexpc.exe") returned 13 [0123.511] Process32NextW (in: hSnapshot=0x258, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xb58, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0123.511] lstrlenW (lpString="cmd.exe") returned 7 [0123.512] Process32NextW (in: hSnapshot=0x258, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0123.512] lstrlenW (lpString="conhost.exe") returned 11 [0123.512] Process32NextW (in: hSnapshot=0x258, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xb74, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0123.512] lstrlenW (lpString="vssadmin.exe") returned 12 [0123.512] Process32NextW (in: hSnapshot=0x258, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0123.513] lstrlenW (lpString="VSSVC.exe") returned 9 [0123.513] Process32NextW (in: hSnapshot=0x258, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x824, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0123.513] lstrlenW (lpString="svchost.exe") returned 11 [0123.513] Process32NextW (in: hSnapshot=0x258, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x824, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0123.514] CloseHandle (hObject=0x258) returned 1 [0123.514] Sleep (dwMilliseconds=0x1f4) [0124.185] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x3ef0ab8 [0124.185] EnumServicesStatusExW (in: hSCManager=0x3ef0ab8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x247fa74, lpServicesReturned=0x247fa8c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x247fa74, lpServicesReturned=0x247fa8c, lpResumeHandle=0x0) returned 0 [0124.186] GetLastError () returned 0xea [0124.186] EnumServicesStatusExW (in: hSCManager=0x3ef0ab8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4502098, cbBufSize=0x1484, pcbBytesNeeded=0x247fa74, lpServicesReturned=0x247fa8c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4502098, pcbBytesNeeded=0x247fa74, lpServicesReturned=0x247fa8c, lpResumeHandle=0x0) returned 1 [0124.186] CloseServiceHandle (hSCObject=0x3ef0ab8) returned 1 [0124.186] lstrlenW (lpString="Appinfo") returned 7 [0124.186] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0124.186] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0124.186] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0124.186] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0124.186] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0124.186] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0124.186] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0124.186] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0124.186] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0124.186] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0124.186] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0124.186] lstrlenW (lpString="AudioSrv") returned 8 [0124.187] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0124.187] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0124.187] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0124.187] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0124.187] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0124.187] lstrlenW (lpString="BFE") returned 3 [0124.187] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0124.187] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0124.187] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0124.187] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0124.187] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0124.187] lstrlenW (lpString="CryptSvc") returned 8 [0124.188] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0124.188] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0124.188] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0124.188] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0124.188] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0124.188] lstrlenW (lpString="CscService") returned 10 [0124.188] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0124.188] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0124.188] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0124.188] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0124.188] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0124.188] lstrlenW (lpString="DcomLaunch") returned 10 [0124.188] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0124.188] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0124.188] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0124.188] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0124.188] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0124.188] lstrlenW (lpString="Dhcp") returned 4 [0124.188] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0124.188] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0124.188] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0124.188] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0124.188] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0124.188] lstrlenW (lpString="Dnscache") returned 8 [0124.188] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0124.188] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0124.188] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0124.188] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0124.188] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0124.188] lstrlenW (lpString="DPS") returned 3 [0124.188] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0124.188] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0124.188] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0124.188] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0124.188] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0124.188] lstrlenW (lpString="eventlog") returned 8 [0124.188] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0124.188] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0124.188] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0124.188] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0124.188] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0124.188] lstrlenW (lpString="EventSystem") returned 11 [0124.188] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0124.188] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0124.188] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0124.188] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0124.188] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0124.188] lstrlenW (lpString="FontCache") returned 9 [0124.188] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0124.189] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0124.189] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0124.189] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0124.189] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0124.189] lstrlenW (lpString="gpsvc") returned 5 [0124.189] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0124.189] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0124.189] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0124.189] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0124.189] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0124.189] lstrlenW (lpString="iphlpsvc") returned 8 [0124.189] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0124.189] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0124.189] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0124.189] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0124.189] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0124.189] lstrlenW (lpString="LanmanServer") returned 12 [0124.189] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0124.189] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0124.189] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0124.189] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0124.189] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0124.189] lstrlenW (lpString="LanmanWorkstation") returned 17 [0124.189] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0124.189] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0124.189] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0124.189] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0124.189] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0124.189] lstrlenW (lpString="lmhosts") returned 7 [0124.189] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0124.189] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0124.189] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0124.189] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0124.189] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0124.189] lstrlenW (lpString="MMCSS") returned 5 [0124.189] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0124.189] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0124.189] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0124.189] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0124.189] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0124.189] lstrlenW (lpString="MpsSvc") returned 6 [0124.189] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0124.189] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0124.189] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0124.189] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0124.191] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0124.191] lstrlenW (lpString="Netman") returned 6 [0124.191] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0124.191] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0124.191] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0124.191] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0124.191] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0124.191] lstrlenW (lpString="netprofm") returned 8 [0124.191] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0124.191] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0124.191] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0124.191] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0124.191] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0124.191] lstrlenW (lpString="NlaSvc") returned 6 [0124.191] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0124.191] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0124.191] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0124.191] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0124.191] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0124.191] lstrlenW (lpString="nsi") returned 3 [0124.191] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0124.191] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0124.192] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0124.192] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0124.192] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0124.192] lstrlenW (lpString="PcaSvc") returned 6 [0124.192] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0124.192] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0124.192] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0124.192] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0124.192] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0124.192] lstrlenW (lpString="PlugPlay") returned 8 [0124.192] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0124.192] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0124.192] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0124.192] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0124.192] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0124.192] lstrlenW (lpString="Power") returned 5 [0124.192] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0124.192] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0124.192] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0124.192] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0124.192] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0124.192] lstrlenW (lpString="ProfSvc") returned 7 [0124.192] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0124.192] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0124.192] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0124.192] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0124.192] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0124.192] lstrlenW (lpString="RpcEptMapper") returned 12 [0124.192] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0124.192] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0124.192] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0124.192] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0124.192] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0124.192] lstrlenW (lpString="RpcSs") returned 5 [0124.192] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0124.192] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0124.193] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0124.193] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0124.193] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0124.193] lstrlenW (lpString="SamSs") returned 5 [0124.193] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0124.193] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0124.193] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0124.193] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0124.193] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0124.193] lstrlenW (lpString="Schedule") returned 8 [0124.193] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0124.193] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0124.193] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0124.193] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0124.193] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0124.193] lstrlenW (lpString="SENS") returned 4 [0124.193] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0124.193] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0124.193] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0124.193] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0124.193] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0124.193] lstrlenW (lpString="ShellHWDetection") returned 16 [0124.193] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0124.193] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0124.193] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0124.193] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0124.193] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0124.193] lstrlenW (lpString="Spooler") returned 7 [0124.193] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0124.193] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0124.193] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0124.193] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0124.193] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0124.193] lstrlenW (lpString="sppsvc") returned 6 [0124.193] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="sppsvc") returned -1 [0124.193] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="sppsvc") returned -1 [0124.194] lstrcmpiW (lpString1="sqlwriter", lpString2="sppsvc") returned 1 [0124.194] lstrcmpiW (lpString1="mssqlserver", lpString2="sppsvc") returned -1 [0124.194] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="sppsvc") returned 1 [0124.194] lstrlenW (lpString="swprv") returned 5 [0124.194] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0124.194] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0124.194] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0124.194] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0124.194] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0124.194] lstrlenW (lpString="SysMain") returned 7 [0124.194] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0124.194] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0124.194] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0124.194] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0124.194] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0124.194] lstrlenW (lpString="Themes") returned 6 [0124.194] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0124.194] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0124.194] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0124.194] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0124.194] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0124.194] lstrlenW (lpString="TrkWks") returned 6 [0124.194] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0124.194] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0124.194] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0124.194] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0124.194] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0124.194] lstrlenW (lpString="UxSms") returned 5 [0124.194] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0124.195] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0124.195] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0124.195] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0124.195] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0124.195] lstrlenW (lpString="VSS") returned 3 [0124.195] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0124.195] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0124.195] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0124.195] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0124.195] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0124.195] lstrlenW (lpString="W32Time") returned 7 [0124.195] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="W32Time") returned -1 [0124.195] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="W32Time") returned -1 [0124.195] lstrcmpiW (lpString1="sqlwriter", lpString2="W32Time") returned -1 [0124.195] lstrcmpiW (lpString1="mssqlserver", lpString2="W32Time") returned -1 [0124.195] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="W32Time") returned -1 [0124.195] lstrlenW (lpString="WdiServiceHost") returned 14 [0124.195] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0124.195] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0124.195] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0124.195] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0124.195] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0124.195] lstrlenW (lpString="WdiSystemHost") returned 13 [0124.195] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0124.195] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0124.195] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0124.195] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0124.195] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0124.196] lstrlenW (lpString="WinDefend") returned 9 [0124.196] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinDefend") returned -1 [0124.196] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinDefend") returned -1 [0124.196] lstrcmpiW (lpString1="sqlwriter", lpString2="WinDefend") returned -1 [0124.196] lstrcmpiW (lpString1="mssqlserver", lpString2="WinDefend") returned -1 [0124.196] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinDefend") returned -1 [0124.197] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0124.197] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0124.197] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0124.197] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0124.197] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0124.197] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0124.197] lstrlenW (lpString="Winmgmt") returned 7 [0124.197] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0124.197] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0124.197] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0124.197] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0124.197] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0124.197] lstrlenW (lpString="wscsvc") returned 6 [0124.197] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wscsvc") returned -1 [0124.197] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wscsvc") returned -1 [0124.197] lstrcmpiW (lpString1="sqlwriter", lpString2="wscsvc") returned -1 [0124.197] lstrcmpiW (lpString1="mssqlserver", lpString2="wscsvc") returned -1 [0124.197] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wscsvc") returned -1 [0124.197] lstrlenW (lpString="wuauserv") returned 8 [0124.197] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wuauserv") returned -1 [0124.197] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wuauserv") returned -1 [0124.197] lstrcmpiW (lpString1="sqlwriter", lpString2="wuauserv") returned -1 [0124.197] lstrcmpiW (lpString1="mssqlserver", lpString2="wuauserv") returned -1 [0124.197] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1b0 [0124.199] Process32FirstW (in: hSnapshot=0x1b0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0124.201] Process32NextW (in: hSnapshot=0x1b0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x51, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0124.202] lstrlenW (lpString="System") returned 6 [0124.202] Process32NextW (in: hSnapshot=0x1b0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0124.202] lstrlenW (lpString="smss.exe") returned 8 [0124.202] Process32NextW (in: hSnapshot=0x1b0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0124.203] lstrlenW (lpString="csrss.exe") returned 9 [0124.203] Process32NextW (in: hSnapshot=0x1b0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0124.204] lstrlenW (lpString="wininit.exe") returned 11 [0124.204] Process32NextW (in: hSnapshot=0x1b0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0124.205] lstrlenW (lpString="csrss.exe") returned 9 [0124.205] Process32NextW (in: hSnapshot=0x1b0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0124.205] lstrlenW (lpString="winlogon.exe") returned 12 [0124.206] Process32NextW (in: hSnapshot=0x1b0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0124.206] lstrlenW (lpString="services.exe") returned 12 [0124.206] Process32NextW (in: hSnapshot=0x1b0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0124.207] lstrlenW (lpString="lsass.exe") returned 9 [0124.207] Process32NextW (in: hSnapshot=0x1b0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0124.208] lstrlenW (lpString="lsm.exe") returned 7 [0124.208] Process32NextW (in: hSnapshot=0x1b0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0124.209] lstrlenW (lpString="svchost.exe") returned 11 [0124.209] Process32NextW (in: hSnapshot=0x1b0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0124.209] lstrlenW (lpString="svchost.exe") returned 11 [0124.209] Process32NextW (in: hSnapshot=0x1b0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0124.210] lstrlenW (lpString="svchost.exe") returned 11 [0124.211] Process32NextW (in: hSnapshot=0x1b0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0124.214] lstrlenW (lpString="svchost.exe") returned 11 [0124.214] Process32NextW (in: hSnapshot=0x1b0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0124.215] lstrlenW (lpString="svchost.exe") returned 11 [0124.215] Process32NextW (in: hSnapshot=0x1b0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0124.215] lstrlenW (lpString="audiodg.exe") returned 11 [0124.215] Process32NextW (in: hSnapshot=0x1b0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0124.216] lstrlenW (lpString="svchost.exe") returned 11 [0124.216] Process32NextW (in: hSnapshot=0x1b0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0124.217] lstrlenW (lpString="svchost.exe") returned 11 [0124.217] Process32NextW (in: hSnapshot=0x1b0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0124.217] lstrlenW (lpString="spoolsv.exe") returned 11 [0124.217] Process32NextW (in: hSnapshot=0x1b0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0124.217] lstrlenW (lpString="svchost.exe") returned 11 [0124.217] Process32NextW (in: hSnapshot=0x1b0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0124.218] lstrlenW (lpString="taskhost.exe") returned 12 [0124.218] Process32NextW (in: hSnapshot=0x1b0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x558, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0124.218] lstrlenW (lpString="dwm.exe") returned 7 [0124.218] Process32NextW (in: hSnapshot=0x1b0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x54c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0124.219] lstrlenW (lpString="explorer.exe") returned 12 [0124.219] Process32NextW (in: hSnapshot=0x1b0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0124.219] lstrlenW (lpString="taskeng.exe") returned 11 [0124.219] Process32NextW (in: hSnapshot=0x1b0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0124.220] lstrlenW (lpString="taskhost.exe") returned 12 [0124.220] Process32NextW (in: hSnapshot=0x1b0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="watches-vessel-arbitrary.exe")) returned 1 [0124.220] lstrlenW (lpString="watches-vessel-arbitrary.exe") returned 28 [0124.220] Process32NextW (in: hSnapshot=0x1b0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="alsopound.exe")) returned 1 [0124.221] lstrlenW (lpString="alsopound.exe") returned 13 [0124.221] Process32NextW (in: hSnapshot=0x1b0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x478, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="measuredamsterdamsandwich.exe")) returned 1 [0124.221] lstrlenW (lpString="measuredamsterdamsandwich.exe") returned 29 [0124.221] Process32NextW (in: hSnapshot=0x1b0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="ooo_lucy_millions.exe")) returned 1 [0124.222] lstrlenW (lpString="ooo_lucy_millions.exe") returned 21 [0124.222] Process32NextW (in: hSnapshot=0x1b0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="appearance.exe")) returned 1 [0124.222] lstrlenW (lpString="appearance.exe") returned 14 [0124.222] Process32NextW (in: hSnapshot=0x1b0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="albert.exe")) returned 1 [0124.222] lstrlenW (lpString="albert.exe") returned 10 [0124.222] Process32NextW (in: hSnapshot=0x1b0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="implied-enquiries.exe")) returned 1 [0124.223] lstrlenW (lpString="implied-enquiries.exe") returned 21 [0124.223] Process32NextW (in: hSnapshot=0x1b0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x72c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="boston_opening.exe")) returned 1 [0124.223] lstrlenW (lpString="boston_opening.exe") returned 18 [0124.223] Process32NextW (in: hSnapshot=0x1b0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="portsmouth.exe")) returned 1 [0124.224] lstrlenW (lpString="portsmouth.exe") returned 14 [0124.224] Process32NextW (in: hSnapshot=0x1b0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="cameras grew poverty.exe")) returned 1 [0124.224] lstrlenW (lpString="cameras grew poverty.exe") returned 24 [0124.224] Process32NextW (in: hSnapshot=0x1b0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="dxrapids.exe")) returned 1 [0124.225] lstrlenW (lpString="dxrapids.exe") returned 12 [0124.225] Process32NextW (in: hSnapshot=0x1b0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x33c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="visitors.exe")) returned 1 [0124.228] lstrlenW (lpString="visitors.exe") returned 12 [0124.228] Process32NextW (in: hSnapshot=0x1b0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="organisations_officially.exe")) returned 1 [0124.229] lstrlenW (lpString="organisations_officially.exe") returned 28 [0124.229] Process32NextW (in: hSnapshot=0x1b0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x61c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="pair.exe")) returned 1 [0124.229] lstrlenW (lpString="pair.exe") returned 8 [0124.229] Process32NextW (in: hSnapshot=0x1b0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="gross.exe")) returned 1 [0124.252] lstrlenW (lpString="gross.exe") returned 9 [0124.252] Process32NextW (in: hSnapshot=0x1b0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x470, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="viewpicture.exe")) returned 1 [0124.253] lstrlenW (lpString="viewpicture.exe") returned 15 [0124.253] Process32NextW (in: hSnapshot=0x1b0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="transmitted.exe")) returned 1 [0124.253] lstrlenW (lpString="transmitted.exe") returned 15 [0124.253] Process32NextW (in: hSnapshot=0x1b0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x634, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="sunglassescelebs.exe")) returned 1 [0124.258] lstrlenW (lpString="sunglassescelebs.exe") returned 20 [0124.258] Process32NextW (in: hSnapshot=0x1b0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="waiver-issue.exe")) returned 1 [0124.258] lstrlenW (lpString="waiver-issue.exe") returned 16 [0124.259] Process32NextW (in: hSnapshot=0x1b0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x808, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="gziprear.exe")) returned 1 [0124.259] lstrlenW (lpString="gziprear.exe") returned 12 [0124.259] Process32NextW (in: hSnapshot=0x1b0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x818, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="gregoryletters.exe")) returned 1 [0124.259] lstrlenW (lpString="gregoryletters.exe") returned 18 [0124.259] Process32NextW (in: hSnapshot=0x1b0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x828, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="intel-metadata-rich.exe")) returned 1 [0124.260] lstrlenW (lpString="intel-metadata-rich.exe") returned 23 [0124.260] Process32NextW (in: hSnapshot=0x1b0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x838, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="cemeteryreconstructiondimension.exe")) returned 1 [0124.261] lstrlenW (lpString="cemeteryreconstructiondimension.exe") returned 35 [0124.261] Process32NextW (in: hSnapshot=0x1b0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0124.261] lstrlenW (lpString="svchost.exe") returned 11 [0124.261] Process32NextW (in: hSnapshot=0x1b0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0124.262] lstrlenW (lpString="sppsvc.exe") returned 10 [0124.262] Process32NextW (in: hSnapshot=0x1b0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xab4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0124.262] lstrlenW (lpString="svchost.exe") returned 11 [0124.262] Process32NextW (in: hSnapshot=0x1b0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x9f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="unlikexpc.exe")) returned 1 [0124.263] lstrlenW (lpString="unlikexpc.exe") returned 13 [0124.263] Process32NextW (in: hSnapshot=0x1b0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xb58, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0124.263] lstrlenW (lpString="cmd.exe") returned 7 [0124.263] Process32NextW (in: hSnapshot=0x1b0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0124.264] lstrlenW (lpString="conhost.exe") returned 11 [0124.264] Process32NextW (in: hSnapshot=0x1b0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xb74, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0124.264] lstrlenW (lpString="vssadmin.exe") returned 12 [0124.264] Process32NextW (in: hSnapshot=0x1b0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0124.264] lstrlenW (lpString="VSSVC.exe") returned 9 [0124.264] Process32NextW (in: hSnapshot=0x1b0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x824, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0124.265] lstrlenW (lpString="svchost.exe") returned 11 [0124.265] Process32NextW (in: hSnapshot=0x1b0, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x824, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0124.265] CloseHandle (hObject=0x1b0) returned 1 [0124.266] Sleep (dwMilliseconds=0x1f4) [0124.890] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x3ef0ab8 [0124.890] EnumServicesStatusExW (in: hSCManager=0x3ef0ab8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x247fa74, lpServicesReturned=0x247fa8c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x247fa74, lpServicesReturned=0x247fa8c, lpResumeHandle=0x0) returned 0 [0124.890] GetLastError () returned 0xea [0124.891] EnumServicesStatusExW (in: hSCManager=0x3ef0ab8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4502098, cbBufSize=0x1484, pcbBytesNeeded=0x247fa74, lpServicesReturned=0x247fa8c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4502098, pcbBytesNeeded=0x247fa74, lpServicesReturned=0x247fa8c, lpResumeHandle=0x0) returned 1 [0124.891] CloseServiceHandle (hSCObject=0x3ef0ab8) returned 1 [0124.891] lstrlenW (lpString="Appinfo") returned 7 [0124.891] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0124.891] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0124.891] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0124.891] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0124.891] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0124.891] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0124.891] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0124.891] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0124.891] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0124.891] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0124.891] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0124.891] lstrlenW (lpString="AudioSrv") returned 8 [0124.891] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0124.891] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0124.891] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0124.891] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0124.891] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0124.891] lstrlenW (lpString="BFE") returned 3 [0124.891] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0124.891] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0124.891] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0124.891] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0124.891] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0124.891] lstrlenW (lpString="CryptSvc") returned 8 [0124.891] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0124.892] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0124.892] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0124.892] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0124.892] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0124.892] lstrlenW (lpString="CscService") returned 10 [0124.892] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0124.892] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0124.892] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0124.892] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0124.892] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0124.892] lstrlenW (lpString="DcomLaunch") returned 10 [0124.892] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0124.892] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0124.892] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0124.892] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0124.892] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0124.892] lstrlenW (lpString="Dhcp") returned 4 [0124.892] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0124.892] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0124.892] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0124.892] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0124.892] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0124.892] lstrlenW (lpString="Dnscache") returned 8 [0124.892] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0124.892] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0124.892] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0124.892] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0124.892] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0124.892] lstrlenW (lpString="DPS") returned 3 [0124.892] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0124.892] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0124.892] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0124.892] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0124.892] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0124.892] lstrlenW (lpString="eventlog") returned 8 [0124.892] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0124.892] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0124.892] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0124.892] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0124.892] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0124.892] lstrlenW (lpString="EventSystem") returned 11 [0124.892] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0124.892] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0124.892] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0124.892] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0124.892] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0124.892] lstrlenW (lpString="FontCache") returned 9 [0124.892] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0124.892] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0124.892] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0124.893] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0124.893] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0124.893] lstrlenW (lpString="gpsvc") returned 5 [0124.893] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0124.893] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0124.893] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0124.893] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0124.893] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0124.893] lstrlenW (lpString="iphlpsvc") returned 8 [0124.893] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0124.893] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0124.893] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0124.893] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0124.893] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0124.893] lstrlenW (lpString="LanmanServer") returned 12 [0124.893] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0124.893] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0124.893] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0124.893] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0124.893] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0124.893] lstrlenW (lpString="LanmanWorkstation") returned 17 [0124.893] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0124.893] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0124.893] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0124.893] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0124.893] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0124.893] lstrlenW (lpString="lmhosts") returned 7 [0124.893] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0124.893] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0124.893] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0124.893] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0124.893] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0124.893] lstrlenW (lpString="MMCSS") returned 5 [0124.893] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0124.893] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0124.893] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0124.893] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0124.893] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0124.893] lstrlenW (lpString="MpsSvc") returned 6 [0124.893] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0124.893] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0124.893] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0124.893] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0124.893] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0124.893] lstrlenW (lpString="Netman") returned 6 [0124.893] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0124.893] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0124.893] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0124.893] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0124.893] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0124.893] lstrlenW (lpString="netprofm") returned 8 [0124.894] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0124.894] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0124.894] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0124.894] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0124.894] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0124.894] lstrlenW (lpString="NlaSvc") returned 6 [0124.894] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0124.894] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0124.894] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0124.894] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0124.894] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0124.894] lstrlenW (lpString="nsi") returned 3 [0124.894] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0124.894] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0124.894] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0124.894] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0124.894] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0124.894] lstrlenW (lpString="PcaSvc") returned 6 [0124.894] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0124.894] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0124.894] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0124.894] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0124.894] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0124.894] lstrlenW (lpString="PlugPlay") returned 8 [0124.894] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0124.894] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0124.894] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0124.894] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0124.894] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0124.894] lstrlenW (lpString="Power") returned 5 [0124.894] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0124.894] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0124.894] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0124.894] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0124.894] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0124.894] lstrlenW (lpString="ProfSvc") returned 7 [0124.894] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0124.894] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0124.894] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0124.894] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0124.894] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0124.894] lstrlenW (lpString="RpcEptMapper") returned 12 [0124.894] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0124.894] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0124.894] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0124.894] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0124.894] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0124.894] lstrlenW (lpString="RpcSs") returned 5 [0124.895] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0124.895] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0124.895] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0124.895] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0124.895] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0124.895] lstrlenW (lpString="SamSs") returned 5 [0124.895] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0124.895] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0124.895] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0124.895] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0124.895] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0124.895] lstrlenW (lpString="Schedule") returned 8 [0124.895] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0124.895] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0124.895] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0124.895] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0124.895] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0124.895] lstrlenW (lpString="SENS") returned 4 [0124.895] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0124.895] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0124.895] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0124.895] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0124.895] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0124.895] lstrlenW (lpString="ShellHWDetection") returned 16 [0124.895] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0124.895] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0124.895] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0124.895] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0124.895] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0124.895] lstrlenW (lpString="Spooler") returned 7 [0124.895] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0124.895] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0124.895] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0124.895] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0124.895] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0124.895] lstrlenW (lpString="sppsvc") returned 6 [0124.895] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="sppsvc") returned -1 [0124.895] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="sppsvc") returned -1 [0124.895] lstrcmpiW (lpString1="sqlwriter", lpString2="sppsvc") returned 1 [0124.895] lstrcmpiW (lpString1="mssqlserver", lpString2="sppsvc") returned -1 [0124.895] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="sppsvc") returned 1 [0124.895] lstrlenW (lpString="swprv") returned 5 [0124.895] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0124.895] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0124.895] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0124.895] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0124.895] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0124.895] lstrlenW (lpString="SysMain") returned 7 [0124.895] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0124.895] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0124.896] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0124.896] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0124.896] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0124.896] lstrlenW (lpString="Themes") returned 6 [0124.896] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0124.896] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0124.896] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0124.896] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0124.896] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0124.896] lstrlenW (lpString="TrkWks") returned 6 [0124.896] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0124.896] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0124.896] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0124.896] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0124.896] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0124.896] lstrlenW (lpString="UxSms") returned 5 [0124.896] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0124.896] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0124.896] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0124.896] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0124.896] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0124.896] lstrlenW (lpString="VSS") returned 3 [0124.896] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0124.896] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0124.896] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0124.896] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0124.896] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0124.896] lstrlenW (lpString="W32Time") returned 7 [0124.896] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="W32Time") returned -1 [0124.896] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="W32Time") returned -1 [0124.896] lstrcmpiW (lpString1="sqlwriter", lpString2="W32Time") returned -1 [0124.896] lstrcmpiW (lpString1="mssqlserver", lpString2="W32Time") returned -1 [0124.896] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="W32Time") returned -1 [0124.896] lstrlenW (lpString="WdiServiceHost") returned 14 [0124.896] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0124.896] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0124.896] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0124.896] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0124.896] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0124.896] lstrlenW (lpString="WdiSystemHost") returned 13 [0124.896] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0124.896] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0124.896] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0124.896] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0124.896] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0124.896] lstrlenW (lpString="WinDefend") returned 9 [0124.896] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinDefend") returned -1 [0124.896] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinDefend") returned -1 [0124.897] lstrcmpiW (lpString1="sqlwriter", lpString2="WinDefend") returned -1 [0124.897] lstrcmpiW (lpString1="mssqlserver", lpString2="WinDefend") returned -1 [0124.897] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinDefend") returned -1 [0124.897] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0124.897] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0124.897] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0124.897] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0124.897] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0124.897] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0124.897] lstrlenW (lpString="Winmgmt") returned 7 [0124.897] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0124.897] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0124.897] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0124.897] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0124.897] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0124.897] lstrlenW (lpString="wscsvc") returned 6 [0124.897] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wscsvc") returned -1 [0124.897] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wscsvc") returned -1 [0124.897] lstrcmpiW (lpString1="sqlwriter", lpString2="wscsvc") returned -1 [0124.897] lstrcmpiW (lpString1="mssqlserver", lpString2="wscsvc") returned -1 [0124.897] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wscsvc") returned -1 [0124.897] lstrlenW (lpString="wuauserv") returned 8 [0124.897] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wuauserv") returned -1 [0124.897] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wuauserv") returned -1 [0124.897] lstrcmpiW (lpString1="sqlwriter", lpString2="wuauserv") returned -1 [0124.897] lstrcmpiW (lpString1="mssqlserver", lpString2="wuauserv") returned -1 [0124.897] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x16c [0124.898] Process32FirstW (in: hSnapshot=0x16c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0124.899] Process32NextW (in: hSnapshot=0x16c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x52, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0124.899] lstrlenW (lpString="System") returned 6 [0124.899] Process32NextW (in: hSnapshot=0x16c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0124.900] lstrlenW (lpString="smss.exe") returned 8 [0124.900] Process32NextW (in: hSnapshot=0x16c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0124.900] lstrlenW (lpString="csrss.exe") returned 9 [0124.900] Process32NextW (in: hSnapshot=0x16c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0124.901] lstrlenW (lpString="wininit.exe") returned 11 [0124.901] Process32NextW (in: hSnapshot=0x16c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0124.901] lstrlenW (lpString="csrss.exe") returned 9 [0124.901] Process32NextW (in: hSnapshot=0x16c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0124.902] lstrlenW (lpString="winlogon.exe") returned 12 [0124.902] Process32NextW (in: hSnapshot=0x16c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0124.902] lstrlenW (lpString="services.exe") returned 12 [0124.902] Process32NextW (in: hSnapshot=0x16c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0124.903] lstrlenW (lpString="lsass.exe") returned 9 [0124.903] Process32NextW (in: hSnapshot=0x16c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0124.903] lstrlenW (lpString="lsm.exe") returned 7 [0124.903] Process32NextW (in: hSnapshot=0x16c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0124.903] lstrlenW (lpString="svchost.exe") returned 11 [0124.904] Process32NextW (in: hSnapshot=0x16c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0124.904] lstrlenW (lpString="svchost.exe") returned 11 [0124.904] Process32NextW (in: hSnapshot=0x16c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0124.904] lstrlenW (lpString="svchost.exe") returned 11 [0124.904] Process32NextW (in: hSnapshot=0x16c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0124.905] lstrlenW (lpString="svchost.exe") returned 11 [0124.905] Process32NextW (in: hSnapshot=0x16c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0124.905] lstrlenW (lpString="svchost.exe") returned 11 [0124.905] Process32NextW (in: hSnapshot=0x16c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0124.906] lstrlenW (lpString="audiodg.exe") returned 11 [0124.906] Process32NextW (in: hSnapshot=0x16c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0124.906] lstrlenW (lpString="svchost.exe") returned 11 [0124.906] Process32NextW (in: hSnapshot=0x16c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0124.907] lstrlenW (lpString="svchost.exe") returned 11 [0124.907] Process32NextW (in: hSnapshot=0x16c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0124.907] lstrlenW (lpString="spoolsv.exe") returned 11 [0124.907] Process32NextW (in: hSnapshot=0x16c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0124.908] lstrlenW (lpString="svchost.exe") returned 11 [0124.908] Process32NextW (in: hSnapshot=0x16c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0124.908] lstrlenW (lpString="taskhost.exe") returned 12 [0124.908] Process32NextW (in: hSnapshot=0x16c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x558, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0124.909] lstrlenW (lpString="dwm.exe") returned 7 [0124.909] Process32NextW (in: hSnapshot=0x16c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x54c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0124.909] lstrlenW (lpString="explorer.exe") returned 12 [0124.909] Process32NextW (in: hSnapshot=0x16c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0124.909] lstrlenW (lpString="taskeng.exe") returned 11 [0124.910] Process32NextW (in: hSnapshot=0x16c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0124.910] lstrlenW (lpString="taskhost.exe") returned 12 [0124.910] Process32NextW (in: hSnapshot=0x16c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="watches-vessel-arbitrary.exe")) returned 1 [0124.910] lstrlenW (lpString="watches-vessel-arbitrary.exe") returned 28 [0124.910] Process32NextW (in: hSnapshot=0x16c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="alsopound.exe")) returned 1 [0124.911] lstrlenW (lpString="alsopound.exe") returned 13 [0124.911] Process32NextW (in: hSnapshot=0x16c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x478, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="measuredamsterdamsandwich.exe")) returned 1 [0124.911] lstrlenW (lpString="measuredamsterdamsandwich.exe") returned 29 [0124.911] Process32NextW (in: hSnapshot=0x16c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="ooo_lucy_millions.exe")) returned 1 [0124.912] lstrlenW (lpString="ooo_lucy_millions.exe") returned 21 [0124.912] Process32NextW (in: hSnapshot=0x16c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="appearance.exe")) returned 1 [0124.912] lstrlenW (lpString="appearance.exe") returned 14 [0124.912] Process32NextW (in: hSnapshot=0x16c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="albert.exe")) returned 1 [0124.913] lstrlenW (lpString="albert.exe") returned 10 [0124.913] Process32NextW (in: hSnapshot=0x16c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="implied-enquiries.exe")) returned 1 [0124.913] lstrlenW (lpString="implied-enquiries.exe") returned 21 [0124.913] Process32NextW (in: hSnapshot=0x16c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x72c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="boston_opening.exe")) returned 1 [0124.914] lstrlenW (lpString="boston_opening.exe") returned 18 [0124.914] Process32NextW (in: hSnapshot=0x16c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="portsmouth.exe")) returned 1 [0124.914] lstrlenW (lpString="portsmouth.exe") returned 14 [0124.914] Process32NextW (in: hSnapshot=0x16c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="cameras grew poverty.exe")) returned 1 [0124.915] lstrlenW (lpString="cameras grew poverty.exe") returned 24 [0124.915] Process32NextW (in: hSnapshot=0x16c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="dxrapids.exe")) returned 1 [0124.915] lstrlenW (lpString="dxrapids.exe") returned 12 [0124.915] Process32NextW (in: hSnapshot=0x16c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x33c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="visitors.exe")) returned 1 [0124.916] lstrlenW (lpString="visitors.exe") returned 12 [0124.916] Process32NextW (in: hSnapshot=0x16c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="organisations_officially.exe")) returned 1 [0124.916] lstrlenW (lpString="organisations_officially.exe") returned 28 [0124.916] Process32NextW (in: hSnapshot=0x16c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x61c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="pair.exe")) returned 1 [0124.916] lstrlenW (lpString="pair.exe") returned 8 [0124.916] Process32NextW (in: hSnapshot=0x16c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="gross.exe")) returned 1 [0124.917] lstrlenW (lpString="gross.exe") returned 9 [0124.917] Process32NextW (in: hSnapshot=0x16c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x470, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="viewpicture.exe")) returned 1 [0124.917] lstrlenW (lpString="viewpicture.exe") returned 15 [0124.917] Process32NextW (in: hSnapshot=0x16c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="transmitted.exe")) returned 1 [0124.918] lstrlenW (lpString="transmitted.exe") returned 15 [0124.918] Process32NextW (in: hSnapshot=0x16c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x634, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="sunglassescelebs.exe")) returned 1 [0124.918] lstrlenW (lpString="sunglassescelebs.exe") returned 20 [0124.918] Process32NextW (in: hSnapshot=0x16c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="waiver-issue.exe")) returned 1 [0124.919] lstrlenW (lpString="waiver-issue.exe") returned 16 [0124.919] Process32NextW (in: hSnapshot=0x16c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x808, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="gziprear.exe")) returned 1 [0124.919] lstrlenW (lpString="gziprear.exe") returned 12 [0124.919] Process32NextW (in: hSnapshot=0x16c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x818, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="gregoryletters.exe")) returned 1 [0124.920] lstrlenW (lpString="gregoryletters.exe") returned 18 [0124.920] Process32NextW (in: hSnapshot=0x16c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x828, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="intel-metadata-rich.exe")) returned 1 [0124.920] lstrlenW (lpString="intel-metadata-rich.exe") returned 23 [0124.920] Process32NextW (in: hSnapshot=0x16c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x838, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="cemeteryreconstructiondimension.exe")) returned 1 [0124.921] lstrlenW (lpString="cemeteryreconstructiondimension.exe") returned 35 [0124.921] Process32NextW (in: hSnapshot=0x16c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0124.921] lstrlenW (lpString="svchost.exe") returned 11 [0124.921] Process32NextW (in: hSnapshot=0x16c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0124.921] lstrlenW (lpString="sppsvc.exe") returned 10 [0124.921] Process32NextW (in: hSnapshot=0x16c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xab4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0124.922] lstrlenW (lpString="svchost.exe") returned 11 [0124.922] Process32NextW (in: hSnapshot=0x16c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x9f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="unlikexpc.exe")) returned 1 [0124.922] lstrlenW (lpString="unlikexpc.exe") returned 13 [0124.922] Process32NextW (in: hSnapshot=0x16c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xb58, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0124.923] lstrlenW (lpString="cmd.exe") returned 7 [0124.923] Process32NextW (in: hSnapshot=0x16c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0124.923] lstrlenW (lpString="conhost.exe") returned 11 [0124.923] Process32NextW (in: hSnapshot=0x16c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xb74, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0124.924] lstrlenW (lpString="vssadmin.exe") returned 12 [0124.924] Process32NextW (in: hSnapshot=0x16c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0124.924] lstrlenW (lpString="VSSVC.exe") returned 9 [0124.924] Process32NextW (in: hSnapshot=0x16c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x824, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0124.925] lstrlenW (lpString="svchost.exe") returned 11 [0124.925] Process32NextW (in: hSnapshot=0x16c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x878, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="LogonUI.exe")) returned 1 [0124.925] lstrlenW (lpString="LogonUI.exe") returned 11 [0124.925] Process32NextW (in: hSnapshot=0x16c, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x878, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="LogonUI.exe")) returned 0 [0124.926] CloseHandle (hObject=0x16c) returned 1 [0124.926] Sleep (dwMilliseconds=0x1f4) [0125.453] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x819ef8 [0125.453] EnumServicesStatusExW (in: hSCManager=0x819ef8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x247fa74, lpServicesReturned=0x247fa8c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x247fa74, lpServicesReturned=0x247fa8c, lpResumeHandle=0x0) returned 0 [0125.453] GetLastError () returned 0xea [0125.453] EnumServicesStatusExW (in: hSCManager=0x819ef8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x8b48e0, cbBufSize=0x1484, pcbBytesNeeded=0x247fa74, lpServicesReturned=0x247fa8c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x8b48e0, pcbBytesNeeded=0x247fa74, lpServicesReturned=0x247fa8c, lpResumeHandle=0x0) returned 1 [0125.454] CloseServiceHandle (hSCObject=0x819ef8) returned 1 [0125.454] lstrlenW (lpString="Appinfo") returned 7 [0125.454] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0125.454] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0125.454] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0125.454] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0125.454] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0125.454] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0125.454] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0125.454] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0125.455] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0125.455] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0125.455] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0125.455] lstrlenW (lpString="AudioSrv") returned 8 [0125.455] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0125.455] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0125.455] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0125.455] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0125.455] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0125.455] lstrlenW (lpString="BFE") returned 3 [0125.455] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0125.455] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0125.455] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0125.455] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0125.455] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0125.455] lstrlenW (lpString="CryptSvc") returned 8 [0125.455] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0125.455] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0125.455] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0125.455] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0125.455] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0125.455] lstrlenW (lpString="CscService") returned 10 [0125.455] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0125.455] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0125.455] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0125.455] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0125.455] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0125.455] lstrlenW (lpString="DcomLaunch") returned 10 [0125.455] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0125.455] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0125.455] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0125.455] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0125.455] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0125.455] lstrlenW (lpString="Dhcp") returned 4 [0125.455] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0125.455] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0125.456] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0125.456] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0125.456] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0125.456] lstrlenW (lpString="Dnscache") returned 8 [0125.456] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0125.456] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0125.456] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0125.456] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0125.456] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0125.456] lstrlenW (lpString="DPS") returned 3 [0125.456] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0125.456] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0125.456] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0125.456] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0125.456] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0125.456] lstrlenW (lpString="eventlog") returned 8 [0125.456] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0125.456] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0125.456] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0125.456] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0125.456] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0125.456] lstrlenW (lpString="EventSystem") returned 11 [0125.456] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0125.456] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0125.456] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0125.456] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0125.456] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0125.456] lstrlenW (lpString="FontCache") returned 9 [0125.456] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0125.456] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0125.456] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0125.456] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0125.456] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0125.456] lstrlenW (lpString="gpsvc") returned 5 [0125.456] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0125.456] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0125.457] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0125.457] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0125.457] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0125.457] lstrlenW (lpString="iphlpsvc") returned 8 [0125.457] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0125.457] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0125.457] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0125.457] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0125.457] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0125.457] lstrlenW (lpString="LanmanServer") returned 12 [0125.457] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0125.457] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0125.457] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0125.457] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0125.457] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0125.457] lstrlenW (lpString="LanmanWorkstation") returned 17 [0125.457] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0125.457] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0125.457] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0125.457] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0125.457] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0125.457] lstrlenW (lpString="lmhosts") returned 7 [0125.457] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0125.457] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0125.457] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0125.457] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0125.457] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0125.457] lstrlenW (lpString="MMCSS") returned 5 [0125.457] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0125.457] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0125.457] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0125.457] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0125.457] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0125.457] lstrlenW (lpString="MpsSvc") returned 6 [0125.457] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0125.457] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0125.458] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0125.458] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0125.458] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0125.458] lstrlenW (lpString="Netman") returned 6 [0125.458] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0125.458] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0125.458] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0125.458] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0125.458] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0125.458] lstrlenW (lpString="netprofm") returned 8 [0125.458] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0125.458] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0125.458] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0125.458] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0125.458] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0125.458] lstrlenW (lpString="NlaSvc") returned 6 [0125.458] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0125.458] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0125.458] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0125.458] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0125.458] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0125.458] lstrlenW (lpString="nsi") returned 3 [0125.458] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0125.458] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0125.458] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0125.458] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0125.458] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0125.458] lstrlenW (lpString="PcaSvc") returned 6 [0125.458] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0125.458] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0125.458] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0125.458] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0125.458] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0125.459] lstrlenW (lpString="PlugPlay") returned 8 [0125.459] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0125.459] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0125.459] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0125.459] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0125.459] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0125.459] lstrlenW (lpString="Power") returned 5 [0125.459] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0125.459] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0125.459] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0125.459] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0125.459] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0125.459] lstrlenW (lpString="ProfSvc") returned 7 [0125.459] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0125.459] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0125.459] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0125.459] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0125.459] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0125.459] lstrlenW (lpString="RpcEptMapper") returned 12 [0125.459] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0125.459] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0125.459] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0125.459] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0125.459] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0125.459] lstrlenW (lpString="RpcSs") returned 5 [0125.459] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0125.459] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0125.459] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0125.459] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0125.459] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0125.459] lstrlenW (lpString="SamSs") returned 5 [0125.459] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0125.459] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0125.460] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0125.460] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0125.460] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0125.460] lstrlenW (lpString="Schedule") returned 8 [0125.460] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0125.460] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0125.460] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0125.460] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0125.460] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0125.460] lstrlenW (lpString="SENS") returned 4 [0125.460] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0125.460] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0125.460] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0125.460] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0125.460] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0125.460] lstrlenW (lpString="ShellHWDetection") returned 16 [0125.460] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0125.460] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0125.460] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0125.460] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0125.460] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0125.460] lstrlenW (lpString="Spooler") returned 7 [0125.460] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0125.460] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0125.460] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0125.460] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0125.460] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0125.460] lstrlenW (lpString="sppsvc") returned 6 [0125.460] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="sppsvc") returned -1 [0125.460] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="sppsvc") returned -1 [0125.460] lstrcmpiW (lpString1="sqlwriter", lpString2="sppsvc") returned 1 [0125.460] lstrcmpiW (lpString1="mssqlserver", lpString2="sppsvc") returned -1 [0125.460] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="sppsvc") returned 1 [0125.460] lstrlenW (lpString="swprv") returned 5 [0125.460] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0125.461] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0125.461] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0125.461] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0125.461] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0125.461] lstrlenW (lpString="SysMain") returned 7 [0125.461] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0125.461] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0125.461] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0125.461] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0125.461] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0125.461] lstrlenW (lpString="Themes") returned 6 [0125.461] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0125.461] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0125.461] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0125.461] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0125.461] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0125.461] lstrlenW (lpString="TrkWks") returned 6 [0125.461] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0125.461] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0125.461] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0125.461] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0125.461] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0125.461] lstrlenW (lpString="UxSms") returned 5 [0125.461] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0125.461] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0125.461] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0125.461] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0125.461] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0125.461] lstrlenW (lpString="VSS") returned 3 [0125.461] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0125.461] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0125.461] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0125.461] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0125.461] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0125.461] lstrlenW (lpString="W32Time") returned 7 [0125.462] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="W32Time") returned -1 [0125.462] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="W32Time") returned -1 [0125.462] lstrcmpiW (lpString1="sqlwriter", lpString2="W32Time") returned -1 [0125.462] lstrcmpiW (lpString1="mssqlserver", lpString2="W32Time") returned -1 [0125.462] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="W32Time") returned -1 [0125.462] lstrlenW (lpString="WdiServiceHost") returned 14 [0125.462] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0125.462] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0125.462] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0125.462] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0125.462] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0125.462] lstrlenW (lpString="WdiSystemHost") returned 13 [0125.462] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0125.462] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0125.462] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0125.462] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0125.462] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0125.462] lstrlenW (lpString="WinDefend") returned 9 [0125.462] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinDefend") returned -1 [0125.462] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinDefend") returned -1 [0125.462] lstrcmpiW (lpString1="sqlwriter", lpString2="WinDefend") returned -1 [0125.462] lstrcmpiW (lpString1="mssqlserver", lpString2="WinDefend") returned -1 [0125.462] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinDefend") returned -1 [0125.462] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0125.462] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0125.462] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0125.462] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0125.462] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0125.462] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0125.462] lstrlenW (lpString="Winmgmt") returned 7 [0125.462] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0125.462] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0125.462] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0125.462] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0125.462] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0125.462] lstrlenW (lpString="wscsvc") returned 6 [0125.463] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wscsvc") returned -1 [0125.463] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wscsvc") returned -1 [0125.463] lstrcmpiW (lpString1="sqlwriter", lpString2="wscsvc") returned -1 [0125.463] lstrcmpiW (lpString1="mssqlserver", lpString2="wscsvc") returned -1 [0125.463] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wscsvc") returned -1 [0125.463] lstrlenW (lpString="wuauserv") returned 8 [0125.463] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wuauserv") returned -1 [0125.463] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wuauserv") returned -1 [0125.463] lstrcmpiW (lpString1="sqlwriter", lpString2="wuauserv") returned -1 [0125.463] lstrcmpiW (lpString1="mssqlserver", lpString2="wuauserv") returned -1 [0125.463] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x258 [0125.465] Process32FirstW (in: hSnapshot=0x258, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0125.465] Process32NextW (in: hSnapshot=0x258, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x52, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0125.466] lstrlenW (lpString="System") returned 6 [0125.466] Process32NextW (in: hSnapshot=0x258, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0125.467] lstrlenW (lpString="smss.exe") returned 8 [0125.467] Process32NextW (in: hSnapshot=0x258, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0125.467] lstrlenW (lpString="csrss.exe") returned 9 [0125.467] Process32NextW (in: hSnapshot=0x258, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0125.468] lstrlenW (lpString="wininit.exe") returned 11 [0125.468] Process32NextW (in: hSnapshot=0x258, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0125.468] lstrlenW (lpString="csrss.exe") returned 9 [0125.469] Process32NextW (in: hSnapshot=0x258, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0125.469] lstrlenW (lpString="winlogon.exe") returned 12 [0125.469] Process32NextW (in: hSnapshot=0x258, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0125.470] lstrlenW (lpString="services.exe") returned 12 [0125.470] Process32NextW (in: hSnapshot=0x258, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0125.510] lstrlenW (lpString="lsass.exe") returned 9 [0125.511] Process32NextW (in: hSnapshot=0x258, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0125.511] lstrlenW (lpString="lsm.exe") returned 7 [0125.511] Process32NextW (in: hSnapshot=0x258, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0125.511] lstrlenW (lpString="svchost.exe") returned 11 [0125.511] Process32NextW (in: hSnapshot=0x258, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0125.512] lstrlenW (lpString="svchost.exe") returned 11 [0125.512] Process32NextW (in: hSnapshot=0x258, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0125.512] lstrlenW (lpString="svchost.exe") returned 11 [0125.512] Process32NextW (in: hSnapshot=0x258, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0125.513] lstrlenW (lpString="svchost.exe") returned 11 [0125.513] Process32NextW (in: hSnapshot=0x258, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0125.513] lstrlenW (lpString="svchost.exe") returned 11 [0125.513] Process32NextW (in: hSnapshot=0x258, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0125.514] lstrlenW (lpString="audiodg.exe") returned 11 [0125.514] Process32NextW (in: hSnapshot=0x258, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0125.514] lstrlenW (lpString="svchost.exe") returned 11 [0125.514] Process32NextW (in: hSnapshot=0x258, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0125.515] lstrlenW (lpString="svchost.exe") returned 11 [0125.515] Process32NextW (in: hSnapshot=0x258, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0125.515] lstrlenW (lpString="spoolsv.exe") returned 11 [0125.515] Process32NextW (in: hSnapshot=0x258, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0125.516] lstrlenW (lpString="svchost.exe") returned 11 [0125.516] Process32NextW (in: hSnapshot=0x258, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0125.516] lstrlenW (lpString="taskhost.exe") returned 12 [0125.516] Process32NextW (in: hSnapshot=0x258, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x558, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0125.516] lstrlenW (lpString="dwm.exe") returned 7 [0125.516] Process32NextW (in: hSnapshot=0x258, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x54c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0125.517] lstrlenW (lpString="explorer.exe") returned 12 [0125.517] Process32NextW (in: hSnapshot=0x258, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0125.517] lstrlenW (lpString="taskeng.exe") returned 11 [0125.517] Process32NextW (in: hSnapshot=0x258, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0125.518] lstrlenW (lpString="taskhost.exe") returned 12 [0125.518] Process32NextW (in: hSnapshot=0x258, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="watches-vessel-arbitrary.exe")) returned 1 [0125.518] lstrlenW (lpString="watches-vessel-arbitrary.exe") returned 28 [0125.518] Process32NextW (in: hSnapshot=0x258, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="alsopound.exe")) returned 1 [0125.519] lstrlenW (lpString="alsopound.exe") returned 13 [0125.519] Process32NextW (in: hSnapshot=0x258, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x478, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="measuredamsterdamsandwich.exe")) returned 1 [0125.519] lstrlenW (lpString="measuredamsterdamsandwich.exe") returned 29 [0125.519] Process32NextW (in: hSnapshot=0x258, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="ooo_lucy_millions.exe")) returned 1 [0125.520] lstrlenW (lpString="ooo_lucy_millions.exe") returned 21 [0125.520] Process32NextW (in: hSnapshot=0x258, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="appearance.exe")) returned 1 [0125.520] lstrlenW (lpString="appearance.exe") returned 14 [0125.520] Process32NextW (in: hSnapshot=0x258, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="albert.exe")) returned 1 [0125.521] lstrlenW (lpString="albert.exe") returned 10 [0125.521] Process32NextW (in: hSnapshot=0x258, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="implied-enquiries.exe")) returned 1 [0125.522] lstrlenW (lpString="implied-enquiries.exe") returned 21 [0125.522] Process32NextW (in: hSnapshot=0x258, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x72c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="boston_opening.exe")) returned 1 [0125.522] lstrlenW (lpString="boston_opening.exe") returned 18 [0125.522] Process32NextW (in: hSnapshot=0x258, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="portsmouth.exe")) returned 1 [0125.523] lstrlenW (lpString="portsmouth.exe") returned 14 [0125.523] Process32NextW (in: hSnapshot=0x258, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="cameras grew poverty.exe")) returned 1 [0125.523] lstrlenW (lpString="cameras grew poverty.exe") returned 24 [0125.523] Process32NextW (in: hSnapshot=0x258, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="dxrapids.exe")) returned 1 [0125.524] lstrlenW (lpString="dxrapids.exe") returned 12 [0125.524] Process32NextW (in: hSnapshot=0x258, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x33c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="visitors.exe")) returned 1 [0125.524] lstrlenW (lpString="visitors.exe") returned 12 [0125.524] Process32NextW (in: hSnapshot=0x258, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="organisations_officially.exe")) returned 1 [0125.525] lstrlenW (lpString="organisations_officially.exe") returned 28 [0125.525] Process32NextW (in: hSnapshot=0x258, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x61c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="pair.exe")) returned 1 [0125.526] lstrlenW (lpString="pair.exe") returned 8 [0125.526] Process32NextW (in: hSnapshot=0x258, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="gross.exe")) returned 1 [0125.526] lstrlenW (lpString="gross.exe") returned 9 [0125.526] Process32NextW (in: hSnapshot=0x258, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x470, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="viewpicture.exe")) returned 1 [0125.529] lstrlenW (lpString="viewpicture.exe") returned 15 [0125.529] Process32NextW (in: hSnapshot=0x258, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="transmitted.exe")) returned 1 [0125.530] lstrlenW (lpString="transmitted.exe") returned 15 [0125.530] Process32NextW (in: hSnapshot=0x258, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x634, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="sunglassescelebs.exe")) returned 1 [0125.535] lstrlenW (lpString="sunglassescelebs.exe") returned 20 [0125.535] Process32NextW (in: hSnapshot=0x258, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="waiver-issue.exe")) returned 1 [0125.536] lstrlenW (lpString="waiver-issue.exe") returned 16 [0125.536] Process32NextW (in: hSnapshot=0x258, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x808, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="gziprear.exe")) returned 1 [0125.536] lstrlenW (lpString="gziprear.exe") returned 12 [0125.536] Process32NextW (in: hSnapshot=0x258, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x818, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="gregoryletters.exe")) returned 1 [0125.537] lstrlenW (lpString="gregoryletters.exe") returned 18 [0125.537] Process32NextW (in: hSnapshot=0x258, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x828, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="intel-metadata-rich.exe")) returned 1 [0125.537] lstrlenW (lpString="intel-metadata-rich.exe") returned 23 [0125.537] Process32NextW (in: hSnapshot=0x258, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x838, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="cemeteryreconstructiondimension.exe")) returned 1 [0125.538] lstrlenW (lpString="cemeteryreconstructiondimension.exe") returned 35 [0125.538] Process32NextW (in: hSnapshot=0x258, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0125.538] lstrlenW (lpString="svchost.exe") returned 11 [0125.538] Process32NextW (in: hSnapshot=0x258, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0125.539] lstrlenW (lpString="sppsvc.exe") returned 10 [0125.539] Process32NextW (in: hSnapshot=0x258, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xab4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0125.539] lstrlenW (lpString="svchost.exe") returned 11 [0125.539] Process32NextW (in: hSnapshot=0x258, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x9f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="unlikexpc.exe")) returned 1 [0125.540] lstrlenW (lpString="unlikexpc.exe") returned 13 [0125.540] Process32NextW (in: hSnapshot=0x258, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xb58, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0125.540] lstrlenW (lpString="cmd.exe") returned 7 [0125.540] Process32NextW (in: hSnapshot=0x258, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0125.541] lstrlenW (lpString="conhost.exe") returned 11 [0125.541] Process32NextW (in: hSnapshot=0x258, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xb74, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0125.541] lstrlenW (lpString="vssadmin.exe") returned 12 [0125.541] Process32NextW (in: hSnapshot=0x258, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0125.542] lstrlenW (lpString="VSSVC.exe") returned 9 [0125.542] Process32NextW (in: hSnapshot=0x258, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x824, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0125.542] lstrlenW (lpString="svchost.exe") returned 11 [0125.542] Process32NextW (in: hSnapshot=0x258, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x878, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="LogonUI.exe")) returned 1 [0125.543] lstrlenW (lpString="LogonUI.exe") returned 11 [0125.543] Process32NextW (in: hSnapshot=0x258, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x878, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="LogonUI.exe")) returned 0 [0125.543] CloseHandle (hObject=0x258) returned 1 [0125.543] Sleep (dwMilliseconds=0x1f4) [0126.224] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x819ef8 [0126.224] EnumServicesStatusExW (in: hSCManager=0x819ef8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x247fa74, lpServicesReturned=0x247fa8c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x247fa74, lpServicesReturned=0x247fa8c, lpResumeHandle=0x0) returned 0 [0126.225] GetLastError () returned 0xea [0126.225] EnumServicesStatusExW (in: hSCManager=0x819ef8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x8b48e0, cbBufSize=0x1484, pcbBytesNeeded=0x247fa74, lpServicesReturned=0x247fa8c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x8b48e0, pcbBytesNeeded=0x247fa74, lpServicesReturned=0x247fa8c, lpResumeHandle=0x0) returned 1 [0126.225] CloseServiceHandle (hSCObject=0x819ef8) returned 1 [0126.225] lstrlenW (lpString="Appinfo") returned 7 [0126.225] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0126.225] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0126.225] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0126.225] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0126.225] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0126.225] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0126.225] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0126.225] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0126.225] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0126.225] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0126.225] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0126.225] lstrlenW (lpString="AudioSrv") returned 8 [0126.225] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0126.225] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0126.225] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0126.226] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0126.226] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0126.226] lstrlenW (lpString="BFE") returned 3 [0126.226] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0126.226] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0126.226] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0126.226] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0126.226] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0126.226] lstrlenW (lpString="CryptSvc") returned 8 [0126.226] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0126.226] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0126.226] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0126.226] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0126.226] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0126.226] lstrlenW (lpString="CscService") returned 10 [0126.226] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0126.226] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0126.226] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0126.226] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0126.226] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0126.226] lstrlenW (lpString="DcomLaunch") returned 10 [0126.226] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0126.226] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0126.226] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0126.226] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0126.226] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0126.226] lstrlenW (lpString="Dhcp") returned 4 [0126.226] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0126.226] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0126.226] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0126.226] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0126.226] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0126.226] lstrlenW (lpString="Dnscache") returned 8 [0126.226] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0126.226] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0126.226] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0126.226] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0126.226] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0126.226] lstrlenW (lpString="DPS") returned 3 [0126.226] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0126.226] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0126.226] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0126.226] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0126.226] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0126.226] lstrlenW (lpString="eventlog") returned 8 [0126.226] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0126.226] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0126.226] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0126.226] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0126.226] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0126.227] lstrlenW (lpString="EventSystem") returned 11 [0126.227] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0126.227] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0126.227] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0126.227] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0126.227] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0126.227] lstrlenW (lpString="FontCache") returned 9 [0126.227] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0126.227] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0126.227] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0126.227] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0126.227] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0126.227] lstrlenW (lpString="gpsvc") returned 5 [0126.227] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0126.227] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0126.227] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0126.227] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0126.227] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0126.227] lstrlenW (lpString="iphlpsvc") returned 8 [0126.227] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0126.227] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0126.227] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0126.227] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0126.227] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0126.227] lstrlenW (lpString="LanmanServer") returned 12 [0126.227] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0126.227] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0126.227] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0126.227] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0126.227] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0126.227] lstrlenW (lpString="LanmanWorkstation") returned 17 [0126.227] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0126.227] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0126.227] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0126.227] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0126.227] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0126.227] lstrlenW (lpString="lmhosts") returned 7 [0126.227] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0126.227] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0126.227] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0126.227] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0126.227] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0126.227] lstrlenW (lpString="MMCSS") returned 5 [0126.227] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0126.227] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0126.227] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0126.227] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0126.227] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0126.227] lstrlenW (lpString="MpsSvc") returned 6 [0126.227] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0126.228] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0126.228] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0126.228] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0126.228] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0126.228] lstrlenW (lpString="Netman") returned 6 [0126.228] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0126.228] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0126.228] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0126.228] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0126.228] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0126.228] lstrlenW (lpString="netprofm") returned 8 [0126.228] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0126.228] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0126.228] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0126.228] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0126.228] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0126.228] lstrlenW (lpString="NlaSvc") returned 6 [0126.228] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0126.228] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0126.228] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0126.228] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0126.228] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0126.228] lstrlenW (lpString="nsi") returned 3 [0126.228] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0126.228] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0126.228] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0126.228] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0126.228] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0126.228] lstrlenW (lpString="PcaSvc") returned 6 [0126.228] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0126.228] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0126.228] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0126.228] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0126.228] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0126.228] lstrlenW (lpString="PlugPlay") returned 8 [0126.228] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0126.228] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0126.228] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0126.228] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0126.228] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0126.228] lstrlenW (lpString="Power") returned 5 [0126.228] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0126.228] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0126.228] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0126.228] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0126.228] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0126.228] lstrlenW (lpString="ProfSvc") returned 7 [0126.228] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0126.228] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0126.229] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0126.229] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0126.229] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0126.229] lstrlenW (lpString="RpcEptMapper") returned 12 [0126.229] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0126.229] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0126.229] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0126.229] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0126.229] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0126.229] lstrlenW (lpString="RpcSs") returned 5 [0126.229] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0126.229] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0126.229] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0126.229] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0126.229] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0126.229] lstrlenW (lpString="SamSs") returned 5 [0126.229] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0126.229] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0126.229] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0126.229] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0126.229] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0126.229] lstrlenW (lpString="Schedule") returned 8 [0126.229] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0126.229] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0126.229] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0126.229] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0126.229] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0126.229] lstrlenW (lpString="SENS") returned 4 [0126.229] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0126.229] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0126.229] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0126.229] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0126.229] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0126.229] lstrlenW (lpString="ShellHWDetection") returned 16 [0126.229] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0126.229] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0126.229] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0126.229] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0126.229] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0126.229] lstrlenW (lpString="Spooler") returned 7 [0126.229] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0126.229] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0126.229] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0126.229] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0126.229] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0126.229] lstrlenW (lpString="sppsvc") returned 6 [0126.229] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="sppsvc") returned -1 [0126.229] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="sppsvc") returned -1 [0126.229] lstrcmpiW (lpString1="sqlwriter", lpString2="sppsvc") returned 1 [0126.230] lstrcmpiW (lpString1="mssqlserver", lpString2="sppsvc") returned -1 [0126.230] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="sppsvc") returned 1 [0126.230] lstrlenW (lpString="swprv") returned 5 [0126.230] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0126.230] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0126.230] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0126.230] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0126.230] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0126.230] lstrlenW (lpString="SysMain") returned 7 [0126.230] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0126.230] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0126.230] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0126.230] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0126.230] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0126.230] lstrlenW (lpString="Themes") returned 6 [0126.230] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0126.230] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0126.230] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0126.230] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0126.230] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0126.230] lstrlenW (lpString="TrkWks") returned 6 [0126.230] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0126.230] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0126.230] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0126.230] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0126.230] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0126.230] lstrlenW (lpString="UxSms") returned 5 [0126.230] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0126.230] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0126.230] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0126.230] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0126.230] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0126.230] lstrlenW (lpString="VSS") returned 3 [0126.230] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0126.230] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0126.230] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0126.230] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0126.230] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0126.230] lstrlenW (lpString="W32Time") returned 7 [0126.230] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="W32Time") returned -1 [0126.230] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="W32Time") returned -1 [0126.230] lstrcmpiW (lpString1="sqlwriter", lpString2="W32Time") returned -1 [0126.230] lstrcmpiW (lpString1="mssqlserver", lpString2="W32Time") returned -1 [0126.230] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="W32Time") returned -1 [0126.230] lstrlenW (lpString="WdiServiceHost") returned 14 [0126.230] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0126.230] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0126.230] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0126.230] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0126.231] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0126.231] lstrlenW (lpString="WdiSystemHost") returned 13 [0126.231] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0126.231] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0126.231] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0126.231] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0126.231] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0126.231] lstrlenW (lpString="WinDefend") returned 9 [0126.231] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinDefend") returned -1 [0126.231] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinDefend") returned -1 [0126.231] lstrcmpiW (lpString1="sqlwriter", lpString2="WinDefend") returned -1 [0126.231] lstrcmpiW (lpString1="mssqlserver", lpString2="WinDefend") returned -1 [0126.231] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinDefend") returned -1 [0126.231] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0126.231] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0126.231] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0126.231] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0126.231] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0126.231] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0126.231] lstrlenW (lpString="Winmgmt") returned 7 [0126.231] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0126.231] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0126.231] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0126.231] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0126.231] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0126.231] lstrlenW (lpString="wscsvc") returned 6 [0126.231] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wscsvc") returned -1 [0126.231] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wscsvc") returned -1 [0126.231] lstrcmpiW (lpString1="sqlwriter", lpString2="wscsvc") returned -1 [0126.231] lstrcmpiW (lpString1="mssqlserver", lpString2="wscsvc") returned -1 [0126.231] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="wscsvc") returned -1 [0126.231] lstrlenW (lpString="wuauserv") returned 8 [0126.231] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="wuauserv") returned -1 [0126.231] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="wuauserv") returned -1 [0126.231] lstrcmpiW (lpString1="sqlwriter", lpString2="wuauserv") returned -1 [0126.231] lstrcmpiW (lpString1="mssqlserver", lpString2="wuauserv") returned -1 [0126.231] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x224 [0126.233] Process32FirstW (in: hSnapshot=0x224, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0126.233] Process32NextW (in: hSnapshot=0x224, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x51, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0126.234] lstrlenW (lpString="System") returned 6 [0126.234] Process32NextW (in: hSnapshot=0x224, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0126.234] lstrlenW (lpString="smss.exe") returned 8 [0126.234] Process32NextW (in: hSnapshot=0x224, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0126.235] lstrlenW (lpString="csrss.exe") returned 9 [0126.235] Process32NextW (in: hSnapshot=0x224, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0126.235] lstrlenW (lpString="wininit.exe") returned 11 [0126.235] Process32NextW (in: hSnapshot=0x224, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0126.235] lstrlenW (lpString="csrss.exe") returned 9 [0126.236] Process32NextW (in: hSnapshot=0x224, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0126.236] lstrlenW (lpString="winlogon.exe") returned 12 [0126.236] Process32NextW (in: hSnapshot=0x224, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0126.237] lstrlenW (lpString="services.exe") returned 12 [0126.237] Process32NextW (in: hSnapshot=0x224, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0126.237] lstrlenW (lpString="lsass.exe") returned 9 [0126.237] Process32NextW (in: hSnapshot=0x224, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0126.238] lstrlenW (lpString="lsm.exe") returned 7 [0126.238] Process32NextW (in: hSnapshot=0x224, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0126.238] lstrlenW (lpString="svchost.exe") returned 11 [0126.238] Process32NextW (in: hSnapshot=0x224, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0126.239] lstrlenW (lpString="svchost.exe") returned 11 [0126.239] Process32NextW (in: hSnapshot=0x224, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0126.243] lstrlenW (lpString="svchost.exe") returned 11 [0126.243] Process32NextW (in: hSnapshot=0x224, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0126.243] lstrlenW (lpString="svchost.exe") returned 11 [0126.243] Process32NextW (in: hSnapshot=0x224, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0126.244] lstrlenW (lpString="svchost.exe") returned 11 [0126.244] Process32NextW (in: hSnapshot=0x224, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0126.244] lstrlenW (lpString="audiodg.exe") returned 11 [0126.244] Process32NextW (in: hSnapshot=0x224, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0126.244] lstrlenW (lpString="svchost.exe") returned 11 [0126.245] Process32NextW (in: hSnapshot=0x224, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0126.245] lstrlenW (lpString="svchost.exe") returned 11 [0126.245] Process32NextW (in: hSnapshot=0x224, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x410, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0126.245] lstrlenW (lpString="spoolsv.exe") returned 11 [0126.245] Process32NextW (in: hSnapshot=0x224, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0126.246] lstrlenW (lpString="svchost.exe") returned 11 [0126.246] Process32NextW (in: hSnapshot=0x224, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0126.246] lstrlenW (lpString="taskhost.exe") returned 12 [0126.246] Process32NextW (in: hSnapshot=0x224, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x558, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0126.247] lstrlenW (lpString="dwm.exe") returned 7 [0126.247] Process32NextW (in: hSnapshot=0x224, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x54c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0126.247] lstrlenW (lpString="explorer.exe") returned 12 [0126.247] Process32NextW (in: hSnapshot=0x224, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0126.248] lstrlenW (lpString="taskeng.exe") returned 11 [0126.248] Process32NextW (in: hSnapshot=0x224, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0126.248] lstrlenW (lpString="taskhost.exe") returned 12 [0126.248] Process32NextW (in: hSnapshot=0x224, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="watches-vessel-arbitrary.exe")) returned 1 [0126.248] lstrlenW (lpString="watches-vessel-arbitrary.exe") returned 28 [0126.248] Process32NextW (in: hSnapshot=0x224, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="alsopound.exe")) returned 1 [0126.249] lstrlenW (lpString="alsopound.exe") returned 13 [0126.249] Process32NextW (in: hSnapshot=0x224, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x478, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="measuredamsterdamsandwich.exe")) returned 1 [0126.249] lstrlenW (lpString="measuredamsterdamsandwich.exe") returned 29 [0126.249] Process32NextW (in: hSnapshot=0x224, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="ooo_lucy_millions.exe")) returned 1 [0126.250] lstrlenW (lpString="ooo_lucy_millions.exe") returned 21 [0126.250] Process32NextW (in: hSnapshot=0x224, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="appearance.exe")) returned 1 [0126.250] lstrlenW (lpString="appearance.exe") returned 14 [0126.250] Process32NextW (in: hSnapshot=0x224, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x24c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="albert.exe")) returned 1 [0126.251] lstrlenW (lpString="albert.exe") returned 10 [0126.251] Process32NextW (in: hSnapshot=0x224, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="implied-enquiries.exe")) returned 1 [0126.251] lstrlenW (lpString="implied-enquiries.exe") returned 21 [0126.251] Process32NextW (in: hSnapshot=0x224, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x72c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="boston_opening.exe")) returned 1 [0126.252] lstrlenW (lpString="boston_opening.exe") returned 18 [0126.252] Process32NextW (in: hSnapshot=0x224, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="portsmouth.exe")) returned 1 [0126.252] lstrlenW (lpString="portsmouth.exe") returned 14 [0126.252] Process32NextW (in: hSnapshot=0x224, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="cameras grew poverty.exe")) returned 1 [0126.252] lstrlenW (lpString="cameras grew poverty.exe") returned 24 [0126.252] Process32NextW (in: hSnapshot=0x224, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="dxrapids.exe")) returned 1 [0126.253] lstrlenW (lpString="dxrapids.exe") returned 12 [0126.253] Process32NextW (in: hSnapshot=0x224, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x33c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="visitors.exe")) returned 1 [0126.253] lstrlenW (lpString="visitors.exe") returned 12 [0126.253] Process32NextW (in: hSnapshot=0x224, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="organisations_officially.exe")) returned 1 [0126.254] lstrlenW (lpString="organisations_officially.exe") returned 28 [0126.254] Process32NextW (in: hSnapshot=0x224, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x61c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="pair.exe")) returned 1 [0126.254] lstrlenW (lpString="pair.exe") returned 8 [0126.254] Process32NextW (in: hSnapshot=0x224, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="gross.exe")) returned 1 [0126.255] lstrlenW (lpString="gross.exe") returned 9 [0126.255] Process32NextW (in: hSnapshot=0x224, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x470, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="viewpicture.exe")) returned 1 [0126.255] lstrlenW (lpString="viewpicture.exe") returned 15 [0126.255] Process32NextW (in: hSnapshot=0x224, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="transmitted.exe")) returned 1 [0126.256] lstrlenW (lpString="transmitted.exe") returned 15 [0126.256] Process32NextW (in: hSnapshot=0x224, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x634, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="sunglassescelebs.exe")) returned 1 [0126.256] lstrlenW (lpString="sunglassescelebs.exe") returned 20 [0126.256] Process32NextW (in: hSnapshot=0x224, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="waiver-issue.exe")) returned 1 [0126.257] lstrlenW (lpString="waiver-issue.exe") returned 16 [0126.257] Process32NextW (in: hSnapshot=0x224, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x808, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="gziprear.exe")) returned 1 [0126.257] lstrlenW (lpString="gziprear.exe") returned 12 [0126.257] Process32NextW (in: hSnapshot=0x224, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x818, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="gregoryletters.exe")) returned 1 [0126.257] lstrlenW (lpString="gregoryletters.exe") returned 18 [0126.257] Process32NextW (in: hSnapshot=0x224, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x828, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="intel-metadata-rich.exe")) returned 1 [0126.258] lstrlenW (lpString="intel-metadata-rich.exe") returned 23 [0126.258] Process32NextW (in: hSnapshot=0x224, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x838, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="cemeteryreconstructiondimension.exe")) returned 1 [0126.258] lstrlenW (lpString="cemeteryreconstructiondimension.exe") returned 35 [0126.258] Process32NextW (in: hSnapshot=0x224, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0126.259] lstrlenW (lpString="svchost.exe") returned 11 [0126.259] Process32NextW (in: hSnapshot=0x224, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0126.259] lstrlenW (lpString="sppsvc.exe") returned 10 [0126.259] Process32NextW (in: hSnapshot=0x224, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xab4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0126.260] lstrlenW (lpString="svchost.exe") returned 11 [0126.260] Process32NextW (in: hSnapshot=0x224, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x9f8, pcPriClassBase=8, dwFlags=0x0, szExeFile="unlikexpc.exe")) returned 1 [0126.260] lstrlenW (lpString="unlikexpc.exe") returned 13 [0126.260] Process32NextW (in: hSnapshot=0x224, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xb58, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0126.261] lstrlenW (lpString="cmd.exe") returned 7 [0126.261] Process32NextW (in: hSnapshot=0x224, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0126.261] lstrlenW (lpString="conhost.exe") returned 11 [0126.261] Process32NextW (in: hSnapshot=0x224, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbd4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xb74, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0126.261] lstrlenW (lpString="vssadmin.exe") returned 12 [0126.261] Process32NextW (in: hSnapshot=0x224, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0126.262] lstrlenW (lpString="VSSVC.exe") returned 9 [0126.262] Process32NextW (in: hSnapshot=0x224, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x824, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0126.262] lstrlenW (lpString="svchost.exe") returned 11 [0126.262] Process32NextW (in: hSnapshot=0x224, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x878, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="LogonUI.exe")) returned 1 [0126.263] lstrlenW (lpString="LogonUI.exe") returned 11 [0126.263] Process32NextW (in: hSnapshot=0x224, lppe=0x247f864 | out: lppe=0x247f864*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x878, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="LogonUI.exe")) returned 0 [0126.263] CloseHandle (hObject=0x224) returned 1 [0126.299] Sleep (dwMilliseconds=0x1f4) Thread: id = 22 os_tid = 0xb80 [0101.958] WaitForSingleObject (hHandle=0x26f794, dwMilliseconds=0xffffffff) returned 0xffffffff Thread: id = 23 os_tid = 0xb84 [0101.959] GetLogicalDrives () returned 0x4 [0101.959] GetComputerNameW (in: lpBuffer=0x82d67c, nSize=0x280fcd4 | out: lpBuffer="XDUWTFONO", nSize=0x280fcd4) returned 1 [0101.959] WNetOpenEnumW (in: dwScope=0x3, dwType=0x1, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x280fca4 | out: lphEnum=0x280fca4*=0x7f6200) returned 0x0 [0101.959] WNetEnumResourceW (in: hEnum=0x7f6200, lpcCount=0x280fca0, lpBuffer=0x8182e0, lpBufferSize=0x280fca8 | out: lpcCount=0x280fca0, lpBuffer=0x8182e0, lpBufferSize=0x280fca8) returned 0x103 [0101.959] WNetCloseEnum (hEnum=0x7f6200) returned 0x0 [0101.959] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x280fca4 | out: lphEnum=0x280fca4*=0x4471238) returned 0x0 [0104.946] WNetEnumResourceW (in: hEnum=0x4471238, lpcCount=0x280fca0, lpBuffer=0x8182e0, lpBufferSize=0x280fca8 | out: lpcCount=0x280fca0, lpBuffer=0x8182e0, lpBufferSize=0x280fca8) returned 0x0 [0104.946] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x8182e0, lphEnum=0x280fc78 | out: lphEnum=0x280fc78*=0x7f6380) returned 0x0 [0105.348] WNetEnumResourceW (in: hEnum=0x7f6380, lpcCount=0x280fc74, lpBuffer=0x3ef10c8, lpBufferSize=0x280fc7c | out: lpcCount=0x280fc74, lpBuffer=0x3ef10c8, lpBufferSize=0x280fc7c) returned 0x103 [0105.348] WNetCloseEnum (hEnum=0x7f6380) returned 0x0 [0105.348] WNetOpenEnumW (dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x818300, lphEnum=0x280fc78) Thread: id = 24 os_tid = 0xb88 [0102.559] GetTickCount () returned 0x2779f [0102.559] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x813650, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x118 [0102.560] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x813650, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x128 [0102.561] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x813650, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x130 [0102.561] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x813650, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x138 [0102.563] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x757c0000 [0102.563] GetProcAddress (hModule=0x757c0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x757ed650 [0102.563] Wow64DisableWow64FsRedirection (in: OldValue=0x2a7f94c | out: OldValue=0x2a7f94c*=0x0) returned 1 [0102.563] lstrlenW (lpString="kernel32.dll") returned 12 [0102.563] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0102.563] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091a0, lpParameter=0x7fb648, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x140 [0102.565] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0102.737] GetTickCount () returned 0x2781b [0102.737] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0102.967] GetTickCount () returned 0x278e6 [0102.967] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0103.252] GetTickCount () returned 0x279ff [0103.252] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0103.676] GetTickCount () returned 0x27ba4 [0103.676] GetTickCount () returned 0x27ba4 [0103.676] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0104.102] GetTickCount () returned 0x27d0b [0104.102] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0104.291] GetTickCount () returned 0x27da7 [0104.292] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0104.584] GetTickCount () returned 0x27ec0 [0104.584] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0104.796] GetTickCount () returned 0x27f7b [0104.796] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0104.913] GetTickCount () returned 0x27ff8 [0104.913] GetTickCount () returned 0x27ff8 [0104.913] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0105.428] GetTickCount () returned 0x281cc [0105.428] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0105.821] GetTickCount () returned 0x28333 [0105.821] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0106.237] GetTickCount () returned 0x284a9 [0106.237] GetTickCount () returned 0x284a9 [0106.237] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0106.491] GetTickCount () returned 0x285b2 [0106.491] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0106.684] GetTickCount () returned 0x2865e [0106.684] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0106.801] GetTickCount () returned 0x286cb [0106.801] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0106.911] GetTickCount () returned 0x28738 [0106.912] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0107.019] GetTickCount () returned 0x287a5 [0107.019] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0107.128] GetTickCount () returned 0x28813 [0107.128] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0107.237] GetTickCount () returned 0x28880 [0107.238] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0108.053] GetTickCount () returned 0x28ac1 [0108.053] GetTickCount () returned 0x28ac1 [0108.053] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0108.237] GetTickCount () returned 0x28b7c [0108.237] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0110.395] GetTickCount () returned 0x28cd3 [0110.395] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0110.791] GetTickCount () returned 0x28e0b [0110.791] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0111.549] GetTickCount () returned 0x28fa1 [0111.549] GetTickCount () returned 0x28fa1 [0111.549] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0111.683] GetTickCount () returned 0x2902d [0111.683] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0111.992] GetTickCount () returned 0x29137 [0111.992] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0112.245] GetTickCount () returned 0x29240 [0112.246] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0112.435] GetTickCount () returned 0x292fb [0112.435] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0112.713] GetTickCount () returned 0x293f5 [0112.713] GetTickCount () returned 0x293f5 [0112.713] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0113.077] GetTickCount () returned 0x2950d [0113.077] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0113.886] GetTickCount () returned 0x29636 [0113.886] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0114.091] GetTickCount () returned 0x29701 [0114.092] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0114.411] GetTickCount () returned 0x29839 [0114.411] GetTickCount () returned 0x29839 [0114.411] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0114.641] GetTickCount () returned 0x29923 [0114.642] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0114.988] GetTickCount () returned 0x29a7a [0114.988] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0115.334] GetTickCount () returned 0x29bd1 [0115.334] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0115.635] GetTickCount () returned 0x29d09 [0115.635] GetTickCount () returned 0x29d09 [0115.635] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0115.973] GetTickCount () returned 0x29e60 [0115.973] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0116.153] GetTickCount () returned 0x29f0c [0116.153] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0116.443] GetTickCount () returned 0x2a034 [0116.443] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0116.633] GetTickCount () returned 0x2a0ef [0116.633] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0116.847] GetTickCount () returned 0x2a17c [0116.847] GetTickCount () returned 0x2a17c [0116.847] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0117.519] GetTickCount () returned 0x2a256 [0117.519] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0117.816] GetTickCount () returned 0x2a37f [0117.816] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0117.971] GetTickCount () returned 0x2a41b [0117.971] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0118.193] GetTickCount () returned 0x2a4f5 [0118.193] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0118.298] GetTickCount () returned 0x2a562 [0118.298] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0118.443] GetTickCount () returned 0x2a5ef [0118.443] GetTickCount () returned 0x2a5ef [0118.443] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0118.707] GetTickCount () returned 0x2a6f8 [0118.707] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0118.887] GetTickCount () returned 0x2a7a3 [0118.887] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0119.168] GetTickCount () returned 0x2a8bc [0119.168] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0119.276] GetTickCount () returned 0x2a929 [0119.276] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0119.374] GetTickCount () returned 0x2a997 [0119.374] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0119.513] GetTickCount () returned 0x2aa13 [0119.513] GetTickCount () returned 0x2aa13 [0119.513] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0119.661] GetTickCount () returned 0x2aaaf [0119.661] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0119.772] GetTickCount () returned 0x2ab1d [0119.772] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0119.883] GetTickCount () returned 0x2ab8a [0119.883] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0120.009] GetTickCount () returned 0x2ac07 [0120.009] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0120.159] GetTickCount () returned 0x2aca3 [0120.159] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0120.358] GetTickCount () returned 0x2ad6d [0120.358] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0120.482] GetTickCount () returned 0x2adea [0120.482] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0120.593] GetTickCount () returned 0x2ae57 [0120.593] GetTickCount () returned 0x2ae57 [0120.593] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0120.833] GetTickCount () returned 0x2af41 [0120.833] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0121.059] GetTickCount () returned 0x2b02b [0121.059] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0121.225] GetTickCount () returned 0x2b0c7 [0121.225] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0121.339] GetTickCount () returned 0x2b135 [0121.339] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0121.465] GetTickCount () returned 0x2b1c1 [0121.465] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0121.732] GetTickCount () returned 0x2b2ca [0121.732] GetTickCount () returned 0x2b2ca [0121.732] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0121.848] GetTickCount () returned 0x2b337 [0121.848] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0121.960] GetTickCount () returned 0x2b3a5 [0121.960] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0122.058] GetTickCount () returned 0x2b412 [0122.058] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0122.353] GetTickCount () returned 0x2b52b [0122.353] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0122.717] GetTickCount () returned 0x2b6a1 [0122.717] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0122.967] GetTickCount () returned 0x2b79b [0122.967] GetTickCount () returned 0x2b79b [0122.967] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0123.300] GetTickCount () returned 0x2b8e2 [0123.302] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0123.477] GetTickCount () returned 0x2b99d [0123.477] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0123.586] GetTickCount () returned 0x2ba0b [0123.586] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0123.696] GetTickCount () returned 0x2ba78 [0123.696] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0123.805] GetTickCount () returned 0x2bae5 [0123.805] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0123.914] GetTickCount () returned 0x2bb52 [0123.914] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0124.185] GetTickCount () returned 0x2bc5b [0124.185] GetTickCount () returned 0x2bc5b [0124.185] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0124.302] GetTickCount () returned 0x2bcc9 [0124.302] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0124.501] GetTickCount () returned 0x2bd93 [0124.501] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0124.654] GetTickCount () returned 0x2be2f [0124.654] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0124.763] GetTickCount () returned 0x2be9d [0124.763] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0125.319] GetTickCount () returned 0x2c0ce [0125.319] GetTickCount () returned 0x2c0ce [0125.319] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0125.452] GetTickCount () returned 0x2c14b [0125.452] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0125.553] GetTickCount () returned 0x2c1b8 [0125.553] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0125.662] GetTickCount () returned 0x2c225 [0125.662] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0125.815] GetTickCount () returned 0x2c2b2 [0125.815] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0125.911] GetTickCount () returned 0x2c31f [0125.911] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0126.065] GetTickCount () returned 0x2c3ab [0126.065] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0126.299] GetTickCount () returned 0x2c495 [0126.299] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0126.562] GetTickCount () returned 0x2c59f [0126.562] GetTickCount () returned 0x2c59f [0126.562] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) Thread: id = 25 os_tid = 0xb8c [0102.559] GetTickCount () returned 0x2779f [0102.559] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x80c018, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x124 [0102.560] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x80c018, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x12c [0102.561] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x80c018, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x134 [0102.562] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x80c018, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x13c [0102.564] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x757c0000 [0102.564] GetProcAddress (hModule=0x757c0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x757ed650 [0102.564] Wow64DisableWow64FsRedirection (in: OldValue=0x25dfa74 | out: OldValue=0x25dfa74*=0x0) returned 1 [0102.564] lstrlenW (lpString="kernel32.dll") returned 12 [0102.564] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0102.564] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091a0, lpParameter=0x81d658, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x144 [0102.565] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0102.737] GetTickCount () returned 0x2781b [0102.737] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0102.967] GetTickCount () returned 0x278e6 [0102.967] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0103.252] GetTickCount () returned 0x279ff [0103.252] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0103.658] GetTickCount () returned 0x27b95 [0103.658] GetTickCount () returned 0x27b95 [0103.658] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0104.043] GetTickCount () returned 0x27ccd [0104.043] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0104.290] GetTickCount () returned 0x27da7 [0104.290] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0104.584] GetTickCount () returned 0x27ec0 [0104.584] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0104.796] GetTickCount () returned 0x27f7b [0104.796] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0104.913] GetTickCount () returned 0x27fe8 [0104.913] GetTickCount () returned 0x27ff8 [0104.913] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0105.428] GetTickCount () returned 0x281cc [0105.428] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0105.821] GetTickCount () returned 0x28333 [0105.821] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0106.237] GetTickCount () returned 0x284a9 [0106.237] GetTickCount () returned 0x284a9 [0106.237] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0106.491] GetTickCount () returned 0x285b2 [0106.491] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0106.684] GetTickCount () returned 0x2865e [0106.684] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0106.801] GetTickCount () returned 0x286cb [0106.801] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0106.911] GetTickCount () returned 0x28738 [0106.911] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0107.019] GetTickCount () returned 0x287a5 [0107.019] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0107.128] GetTickCount () returned 0x28813 [0107.128] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0107.238] GetTickCount () returned 0x28880 [0107.238] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0108.053] GetTickCount () returned 0x28ac1 [0108.053] GetTickCount () returned 0x28ac1 [0108.053] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0108.236] GetTickCount () returned 0x28b7c [0108.237] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0110.395] GetTickCount () returned 0x28cd3 [0110.395] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0110.791] GetTickCount () returned 0x28e0b [0110.791] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0111.549] GetTickCount () returned 0x28fa1 [0111.549] GetTickCount () returned 0x28fa1 [0111.549] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0111.683] GetTickCount () returned 0x2902d [0111.683] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0111.992] GetTickCount () returned 0x29137 [0111.992] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0112.246] GetTickCount () returned 0x29240 [0112.246] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0112.435] GetTickCount () returned 0x292fb [0112.436] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0112.713] GetTickCount () returned 0x293f5 [0112.713] GetTickCount () returned 0x293f5 [0112.713] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0113.077] GetTickCount () returned 0x2950d [0113.077] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0113.886] GetTickCount () returned 0x29636 [0113.886] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0114.092] GetTickCount () returned 0x29701 [0114.092] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0114.411] GetTickCount () returned 0x29839 [0114.411] GetTickCount () returned 0x29839 [0114.411] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0114.641] GetTickCount () returned 0x29923 [0114.641] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0114.988] GetTickCount () returned 0x29a7a [0114.988] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0115.334] GetTickCount () returned 0x29bd1 [0115.334] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0115.635] GetTickCount () returned 0x29d09 [0115.635] GetTickCount () returned 0x29d09 [0115.635] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0115.973] GetTickCount () returned 0x29e60 [0115.973] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0116.153] GetTickCount () returned 0x29f0c [0116.153] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0116.443] GetTickCount () returned 0x2a034 [0116.443] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0116.633] GetTickCount () returned 0x2a0ef [0116.633] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0116.847] GetTickCount () returned 0x2a17c [0116.847] GetTickCount () returned 0x2a17c [0116.847] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0117.519] GetTickCount () returned 0x2a256 [0117.519] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0117.816] GetTickCount () returned 0x2a37f [0117.816] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0117.971] GetTickCount () returned 0x2a41b [0117.971] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0118.192] GetTickCount () returned 0x2a4f5 [0118.192] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0118.298] GetTickCount () returned 0x2a562 [0118.298] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0118.443] GetTickCount () returned 0x2a5ef [0118.443] GetTickCount () returned 0x2a5ef [0118.443] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0118.708] GetTickCount () returned 0x2a6f8 [0118.708] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0118.887] GetTickCount () returned 0x2a7a3 [0118.887] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0119.168] GetTickCount () returned 0x2a8bc [0119.168] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0119.275] GetTickCount () returned 0x2a929 [0119.276] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0119.374] GetTickCount () returned 0x2a997 [0119.374] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0119.513] GetTickCount () returned 0x2aa13 [0119.513] GetTickCount () returned 0x2aa13 [0119.513] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0119.661] GetTickCount () returned 0x2aaaf [0119.661] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0119.772] GetTickCount () returned 0x2ab1d [0119.772] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0119.883] GetTickCount () returned 0x2ab8a [0119.883] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0120.009] GetTickCount () returned 0x2ac07 [0120.009] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0120.159] GetTickCount () returned 0x2aca3 [0120.159] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0120.358] GetTickCount () returned 0x2ad6d [0120.358] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0120.482] GetTickCount () returned 0x2adea [0120.482] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0120.592] GetTickCount () returned 0x2ae57 [0120.593] GetTickCount () returned 0x2ae57 [0120.593] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0120.833] GetTickCount () returned 0x2af41 [0120.833] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0121.059] GetTickCount () returned 0x2b02b [0121.059] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0121.225] GetTickCount () returned 0x2b0c7 [0121.225] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0121.339] GetTickCount () returned 0x2b135 [0121.339] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0121.465] GetTickCount () returned 0x2b1c1 [0121.465] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0121.732] GetTickCount () returned 0x2b2ca [0121.732] GetTickCount () returned 0x2b2ca [0121.732] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0121.848] GetTickCount () returned 0x2b337 [0121.848] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0121.960] GetTickCount () returned 0x2b3a5 [0121.960] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0122.058] GetTickCount () returned 0x2b412 [0122.058] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0122.353] GetTickCount () returned 0x2b52b [0122.353] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0122.717] GetTickCount () returned 0x2b6a1 [0122.717] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0122.968] GetTickCount () returned 0x2b79b [0122.968] GetTickCount () returned 0x2b79b [0122.968] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0123.370] GetTickCount () returned 0x2b930 [0123.370] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0123.477] GetTickCount () returned 0x2b99d [0123.477] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0123.586] GetTickCount () returned 0x2ba0b [0123.586] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0123.696] GetTickCount () returned 0x2ba78 [0123.696] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0123.805] GetTickCount () returned 0x2bae5 [0123.805] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0123.914] GetTickCount () returned 0x2bb52 [0123.914] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0124.185] GetTickCount () returned 0x2bc5b [0124.185] GetTickCount () returned 0x2bc5b [0124.185] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0124.302] GetTickCount () returned 0x2bcc9 [0124.302] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0124.501] GetTickCount () returned 0x2bd93 [0124.501] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0124.654] GetTickCount () returned 0x2be2f [0124.654] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0124.763] GetTickCount () returned 0x2be9d [0124.763] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0125.319] GetTickCount () returned 0x2c0ce [0125.319] GetTickCount () returned 0x2c0ce [0125.319] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0125.453] GetTickCount () returned 0x2c14b [0125.453] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0125.553] GetTickCount () returned 0x2c1b8 [0125.553] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0125.662] GetTickCount () returned 0x2c225 [0125.662] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0125.815] GetTickCount () returned 0x2c2b2 [0125.815] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0125.911] GetTickCount () returned 0x2c31f [0125.911] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0126.065] GetTickCount () returned 0x2c3ab [0126.065] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0126.299] GetTickCount () returned 0x2c495 [0126.299] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0126.562] GetTickCount () returned 0x2c59f [0126.562] GetTickCount () returned 0x2c59f [0126.562] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) Thread: id = 26 os_tid = 0xb98 [0102.634] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x757c0000 [0102.635] GetProcAddress (hModule=0x757c0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x757ed650 [0102.635] Wow64DisableWow64FsRedirection (in: OldValue=0x26ffa38 | out: OldValue=0x26ffa38*=0x0) returned 1 [0102.635] lstrlenW (lpString="kernel32.dll") returned 12 [0102.635] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0102.635] Sleep (dwMilliseconds=0x64) [0102.740] lstrcmpiW (lpString1=".ini", lpString2=".waifu") returned -1 [0102.740] lstrlenW (lpString="desktop.ini") returned 11 [0102.740] CreateFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0102.740] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x26ff9fc | out: lpFileSize=0x26ff9fc*=129) returned 1 [0102.740] CloseHandle (hObject=0x174) returned 1 [0102.740] GetFileAttributesW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini")) returned 0x26 [0102.740] GetFileAttributesW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0102.740] CreateFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0102.740] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0102.740] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0102.740] CreateFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0102.777] GetLastError () returned 0x0 [0102.777] ReadFile (in: hFile=0x174, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x81, lpOverlapped=0x0) returned 1 [0102.937] WriteFile (in: hFile=0x184, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x90, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0x90, lpOverlapped=0x0) returned 1 [0102.938] ReadFile (in: hFile=0x174, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x0, lpOverlapped=0x0) returned 1 [0102.938] WriteFile (in: hFile=0x184, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0xea, lpOverlapped=0x0) returned 1 [0102.938] SetEndOfFile (hFile=0x184) returned 1 [0102.938] CloseHandle (hObject=0x184) returned 1 [0102.938] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0102.938] SetEndOfFile (hFile=0x174) returned 1 [0102.939] CloseHandle (hObject=0x174) returned 1 [0102.939] SetFileAttributesW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x26) returned 1 [0102.939] DeleteFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini")) returned 1 [0102.940] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0102.940] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0102.940] lstrlenW (lpString=".doc") returned 4 [0102.940] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0102.940] lstrlenW (lpString=".docx") returned 5 [0102.940] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0102.940] lstrlenW (lpString=".pdf") returned 4 [0102.940] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0102.940] lstrlenW (lpString=".xls") returned 4 [0102.940] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0102.940] lstrlenW (lpString=".xlsx") returned 5 [0102.940] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0102.940] lstrlenW (lpString=".ppt") returned 4 [0102.940] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0102.940] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0102.940] lstrlenW (lpString=".zip") returned 4 [0102.940] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0102.940] lstrlenW (lpString=".rar") returned 4 [0102.940] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0102.940] lstrlenW (lpString=".bz2") returned 4 [0102.940] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0102.940] lstrlenW (lpString=".7z") returned 3 [0102.940] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0102.940] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0102.940] lstrlenW (lpString=".dbf") returned 4 [0102.940] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0102.940] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0102.940] lstrlenW (lpString=".1cd") returned 4 [0102.940] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0102.940] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0102.940] lstrlenW (lpString=".jpg") returned 4 [0102.940] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0102.940] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0102.940] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0102.940] lstrlenW (lpString=".doc") returned 4 [0102.940] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0102.940] lstrlenW (lpString=".docx") returned 5 [0102.940] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0102.940] lstrlenW (lpString=".pdf") returned 4 [0102.940] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0102.940] lstrlenW (lpString=".xls") returned 4 [0102.940] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0102.940] lstrlenW (lpString=".xlsx") returned 5 [0102.940] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0102.940] lstrlenW (lpString=".ppt") returned 4 [0102.940] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0102.940] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0102.940] lstrlenW (lpString=".zip") returned 4 [0102.940] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0102.940] lstrlenW (lpString=".rar") returned 4 [0102.940] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0102.941] lstrlenW (lpString=".bz2") returned 4 [0102.941] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0102.941] lstrlenW (lpString=".7z") returned 3 [0102.941] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0102.941] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0102.941] lstrlenW (lpString=".dbf") returned 4 [0102.941] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0102.941] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0102.941] lstrlenW (lpString=".1cd") returned 4 [0102.941] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0102.941] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0102.941] lstrlenW (lpString=".jpg") returned 4 [0102.941] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0102.941] lstrcmpiW (lpString1=".xml", lpString2=".waifu") returned 1 [0102.941] lstrlenW (lpString="OutlookMUI.xml") returned 14 [0102.941] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0102.941] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x26ff9fc | out: lpFileSize=0x26ff9fc*=3186) returned 1 [0102.942] CloseHandle (hObject=0x174) returned 1 [0102.942] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml")) returned 0x2020 [0102.942] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0102.942] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0102.942] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0102.942] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0102.942] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0102.942] GetLastError () returned 0x0 [0102.942] ReadFile (in: hFile=0x174, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0xc72, lpOverlapped=0x0) returned 1 [0102.943] WriteFile (in: hFile=0x184, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xc80, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0xc80, lpOverlapped=0x0) returned 1 [0102.944] ReadFile (in: hFile=0x174, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x0, lpOverlapped=0x0) returned 1 [0102.944] WriteFile (in: hFile=0x184, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0xf0, lpOverlapped=0x0) returned 1 [0102.944] SetEndOfFile (hFile=0x184) returned 1 [0102.944] CloseHandle (hObject=0x184) returned 1 [0102.944] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0102.945] SetEndOfFile (hFile=0x174) returned 1 [0102.945] CloseHandle (hObject=0x174) returned 1 [0102.945] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x2020) returned 1 [0102.946] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml")) returned 1 [0102.946] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0102.946] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0102.946] lstrlenW (lpString=".doc") returned 4 [0102.946] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0102.946] lstrlenW (lpString=".docx") returned 5 [0102.946] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0102.946] lstrlenW (lpString=".pdf") returned 4 [0102.946] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0102.946] lstrlenW (lpString=".xls") returned 4 [0102.946] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0102.946] lstrlenW (lpString=".xlsx") returned 5 [0102.946] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0102.946] lstrlenW (lpString=".ppt") returned 4 [0102.946] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0102.946] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0102.946] lstrlenW (lpString=".zip") returned 4 [0102.946] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0102.946] lstrlenW (lpString=".rar") returned 4 [0102.946] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0102.946] lstrlenW (lpString=".bz2") returned 4 [0102.946] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0102.946] lstrlenW (lpString=".7z") returned 3 [0102.946] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0102.946] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0102.946] lstrlenW (lpString=".dbf") returned 4 [0102.946] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0102.946] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0102.946] lstrlenW (lpString=".1cd") returned 4 [0102.946] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0102.946] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0102.946] lstrlenW (lpString=".jpg") returned 4 [0102.946] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0102.946] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0102.946] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0102.946] lstrlenW (lpString=".doc") returned 4 [0102.946] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0102.946] lstrlenW (lpString=".docx") returned 5 [0102.946] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0102.946] lstrlenW (lpString=".pdf") returned 4 [0102.946] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0102.946] lstrlenW (lpString=".xls") returned 4 [0102.946] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0102.947] lstrlenW (lpString=".xlsx") returned 5 [0102.947] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0102.947] lstrlenW (lpString=".ppt") returned 4 [0102.947] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0102.947] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0102.947] lstrlenW (lpString=".zip") returned 4 [0102.947] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0102.947] lstrlenW (lpString=".rar") returned 4 [0102.947] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0102.947] lstrlenW (lpString=".bz2") returned 4 [0102.947] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0102.947] lstrlenW (lpString=".7z") returned 3 [0102.947] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0102.947] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0102.947] lstrlenW (lpString=".dbf") returned 4 [0102.947] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0102.947] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0102.947] lstrlenW (lpString=".1cd") returned 4 [0102.947] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0102.947] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0102.947] lstrlenW (lpString=".jpg") returned 4 [0102.947] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0102.947] lstrcmpiW (lpString1=".xml", lpString2=".waifu") returned 1 [0102.947] lstrlenW (lpString="Setup.xml") returned 9 [0102.947] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0102.948] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x26ff9fc | out: lpFileSize=0x26ff9fc*=4207) returned 1 [0102.948] CloseHandle (hObject=0x174) returned 1 [0102.948] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0102.948] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0102.948] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0102.948] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0102.948] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0102.948] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0102.948] GetLastError () returned 0x0 [0102.948] ReadFile (in: hFile=0x174, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x106f, lpOverlapped=0x0) returned 1 [0102.949] WriteFile (in: hFile=0x184, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x1070, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0x1070, lpOverlapped=0x0) returned 1 [0102.950] ReadFile (in: hFile=0x174, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x0, lpOverlapped=0x0) returned 1 [0102.950] WriteFile (in: hFile=0x184, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0xe6, lpOverlapped=0x0) returned 1 [0102.950] SetEndOfFile (hFile=0x184) returned 1 [0102.950] CloseHandle (hObject=0x184) returned 1 [0102.950] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0102.950] SetEndOfFile (hFile=0x174) returned 1 [0102.951] CloseHandle (hObject=0x174) returned 1 [0102.951] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x2020) returned 1 [0102.951] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0102.951] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0102.951] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0102.951] lstrlenW (lpString=".doc") returned 4 [0102.951] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0102.952] lstrlenW (lpString=".docx") returned 5 [0102.952] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0102.952] lstrlenW (lpString=".pdf") returned 4 [0102.952] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0102.952] lstrlenW (lpString=".xls") returned 4 [0102.952] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0102.952] lstrlenW (lpString=".xlsx") returned 5 [0102.952] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0102.952] lstrlenW (lpString=".ppt") returned 4 [0102.952] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0102.952] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0102.952] lstrlenW (lpString=".zip") returned 4 [0102.952] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0102.952] lstrlenW (lpString=".rar") returned 4 [0102.952] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0102.952] lstrlenW (lpString=".bz2") returned 4 [0102.952] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0102.952] lstrlenW (lpString=".7z") returned 3 [0102.952] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0102.952] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0102.952] lstrlenW (lpString=".dbf") returned 4 [0102.952] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0102.952] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0102.952] lstrlenW (lpString=".1cd") returned 4 [0102.952] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0102.952] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0102.952] lstrlenW (lpString=".jpg") returned 4 [0102.952] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0102.952] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0102.952] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0102.952] lstrlenW (lpString=".doc") returned 4 [0102.952] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0102.952] lstrlenW (lpString=".docx") returned 5 [0102.952] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0102.952] lstrlenW (lpString=".pdf") returned 4 [0102.952] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0102.952] lstrlenW (lpString=".xls") returned 4 [0102.952] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0102.952] lstrlenW (lpString=".xlsx") returned 5 [0102.952] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0102.952] lstrlenW (lpString=".ppt") returned 4 [0102.952] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0102.952] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0102.952] lstrlenW (lpString=".zip") returned 4 [0102.952] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0102.952] lstrlenW (lpString=".rar") returned 4 [0102.952] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0102.952] lstrlenW (lpString=".bz2") returned 4 [0102.952] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0102.952] lstrlenW (lpString=".7z") returned 3 [0102.953] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0102.953] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0102.953] lstrlenW (lpString=".dbf") returned 4 [0102.953] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0102.953] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0102.953] lstrlenW (lpString=".1cd") returned 4 [0102.953] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0102.953] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0102.953] lstrlenW (lpString=".jpg") returned 4 [0102.953] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0102.953] lstrcmpiW (lpString1=".xml", lpString2=".waifu") returned 1 [0102.953] lstrlenW (lpString="Setup.xml") returned 9 [0102.953] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0102.953] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x26ff9fc | out: lpFileSize=0x26ff9fc*=2424) returned 1 [0102.953] CloseHandle (hObject=0x174) returned 1 [0102.954] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0102.954] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0102.954] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0102.954] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0102.954] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0102.954] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0102.955] GetLastError () returned 0x0 [0102.955] ReadFile (in: hFile=0x174, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x978, lpOverlapped=0x0) returned 1 [0102.956] WriteFile (in: hFile=0x184, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x980, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0x980, lpOverlapped=0x0) returned 1 [0102.956] ReadFile (in: hFile=0x174, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x0, lpOverlapped=0x0) returned 1 [0102.956] WriteFile (in: hFile=0x184, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0xe6, lpOverlapped=0x0) returned 1 [0102.957] SetEndOfFile (hFile=0x184) returned 1 [0102.957] CloseHandle (hObject=0x184) returned 1 [0102.957] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0102.957] SetEndOfFile (hFile=0x174) returned 1 [0102.958] CloseHandle (hObject=0x174) returned 1 [0102.958] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x2020) returned 1 [0102.958] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0102.958] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0102.958] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0102.959] lstrlenW (lpString=".doc") returned 4 [0102.959] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0102.959] lstrlenW (lpString=".docx") returned 5 [0102.959] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0102.959] lstrlenW (lpString=".pdf") returned 4 [0102.959] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0102.959] lstrlenW (lpString=".xls") returned 4 [0102.959] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0102.959] lstrlenW (lpString=".xlsx") returned 5 [0102.959] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0102.959] lstrlenW (lpString=".ppt") returned 4 [0102.959] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0102.959] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0102.959] lstrlenW (lpString=".zip") returned 4 [0102.959] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0102.959] lstrlenW (lpString=".rar") returned 4 [0102.959] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0102.959] lstrlenW (lpString=".bz2") returned 4 [0102.959] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0102.959] lstrlenW (lpString=".7z") returned 3 [0102.959] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0102.959] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0102.959] lstrlenW (lpString=".dbf") returned 4 [0102.959] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0102.959] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0102.959] lstrlenW (lpString=".1cd") returned 4 [0102.959] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0102.959] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0102.959] lstrlenW (lpString=".jpg") returned 4 [0102.959] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0102.959] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0102.959] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0102.959] lstrlenW (lpString=".doc") returned 4 [0102.959] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0102.959] lstrlenW (lpString=".docx") returned 5 [0102.959] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0102.959] lstrlenW (lpString=".pdf") returned 4 [0102.959] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0102.959] lstrlenW (lpString=".xls") returned 4 [0102.959] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0102.959] lstrlenW (lpString=".xlsx") returned 5 [0102.959] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0102.959] lstrlenW (lpString=".ppt") returned 4 [0102.959] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0102.959] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0102.959] lstrlenW (lpString=".zip") returned 4 [0102.959] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0102.959] lstrlenW (lpString=".rar") returned 4 [0102.959] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0102.959] lstrlenW (lpString=".bz2") returned 4 [0102.959] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0102.960] lstrlenW (lpString=".7z") returned 3 [0102.960] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0102.960] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0102.960] lstrlenW (lpString=".dbf") returned 4 [0102.960] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0102.960] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0102.960] lstrlenW (lpString=".1cd") returned 4 [0102.960] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0102.960] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0102.960] lstrlenW (lpString=".jpg") returned 4 [0102.960] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0102.960] lstrcmpiW (lpString1=".xml", lpString2=".waifu") returned 1 [0102.960] lstrlenW (lpString="WordMUI.xml") returned 11 [0102.960] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0102.960] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x26ff9fc | out: lpFileSize=0x26ff9fc*=1800) returned 1 [0102.960] CloseHandle (hObject=0x174) returned 1 [0102.960] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml")) returned 0x2020 [0102.960] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0102.960] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0102.960] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0102.960] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0102.960] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0102.961] GetLastError () returned 0x0 [0102.961] ReadFile (in: hFile=0x174, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x708, lpOverlapped=0x0) returned 1 [0102.962] WriteFile (in: hFile=0x184, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x710, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0x710, lpOverlapped=0x0) returned 1 [0102.962] ReadFile (in: hFile=0x174, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x0, lpOverlapped=0x0) returned 1 [0102.962] WriteFile (in: hFile=0x184, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0xea, lpOverlapped=0x0) returned 1 [0102.962] SetEndOfFile (hFile=0x184) returned 1 [0102.963] CloseHandle (hObject=0x184) returned 1 [0102.963] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0102.963] SetEndOfFile (hFile=0x174) returned 1 [0102.964] CloseHandle (hObject=0x174) returned 1 [0102.964] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x2020) returned 1 [0102.964] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml")) returned 1 [0102.964] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0102.964] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0102.964] lstrlenW (lpString=".doc") returned 4 [0102.964] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0102.964] lstrlenW (lpString=".docx") returned 5 [0102.964] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0102.964] lstrlenW (lpString=".pdf") returned 4 [0102.964] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0102.964] lstrlenW (lpString=".xls") returned 4 [0102.964] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0102.964] lstrlenW (lpString=".xlsx") returned 5 [0102.964] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0102.964] lstrlenW (lpString=".ppt") returned 4 [0102.964] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0102.964] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0102.964] lstrlenW (lpString=".zip") returned 4 [0102.964] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0102.964] lstrlenW (lpString=".rar") returned 4 [0102.964] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0102.965] lstrlenW (lpString=".bz2") returned 4 [0102.965] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0102.965] lstrlenW (lpString=".7z") returned 3 [0102.965] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0102.965] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0102.965] lstrlenW (lpString=".dbf") returned 4 [0102.965] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0102.965] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0102.965] lstrlenW (lpString=".1cd") returned 4 [0102.965] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0102.965] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0102.965] lstrlenW (lpString=".jpg") returned 4 [0102.965] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0102.965] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0102.965] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0102.965] lstrlenW (lpString=".doc") returned 4 [0102.965] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0102.965] lstrlenW (lpString=".docx") returned 5 [0102.965] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0102.965] lstrlenW (lpString=".pdf") returned 4 [0102.965] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0102.965] lstrlenW (lpString=".xls") returned 4 [0102.965] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0102.965] lstrlenW (lpString=".xlsx") returned 5 [0102.965] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0102.965] lstrlenW (lpString=".ppt") returned 4 [0102.965] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0102.965] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0102.965] lstrlenW (lpString=".zip") returned 4 [0102.965] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0102.965] lstrlenW (lpString=".rar") returned 4 [0102.965] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0102.965] lstrlenW (lpString=".bz2") returned 4 [0102.965] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0102.965] lstrlenW (lpString=".7z") returned 3 [0102.965] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0102.965] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0102.965] lstrlenW (lpString=".dbf") returned 4 [0102.965] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0102.965] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0102.965] lstrlenW (lpString=".1cd") returned 4 [0102.965] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0102.965] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0102.965] lstrlenW (lpString=".jpg") returned 4 [0102.965] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0102.965] lstrcmpiW (lpString1=".xml", lpString2=".waifu") returned 1 [0102.966] lstrlenW (lpString="Proof.xml") returned 9 [0102.966] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0103.178] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x26ff9fc | out: lpFileSize=0x26ff9fc*=1347) returned 1 [0103.178] CloseHandle (hObject=0x168) returned 1 [0103.178] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml")) returned 0x2020 [0103.178] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0103.178] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0103.179] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0103.179] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0103.179] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0103.179] GetLastError () returned 0x0 [0103.179] ReadFile (in: hFile=0x168, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x543, lpOverlapped=0x0) returned 1 [0103.180] WriteFile (in: hFile=0x180, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0x550, lpOverlapped=0x0) returned 1 [0103.180] ReadFile (in: hFile=0x168, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x0, lpOverlapped=0x0) returned 1 [0103.180] WriteFile (in: hFile=0x180, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0xe6, lpOverlapped=0x0) returned 1 [0103.180] SetEndOfFile (hFile=0x180) returned 1 [0103.181] CloseHandle (hObject=0x180) returned 1 [0103.181] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0103.181] SetEndOfFile (hFile=0x168) returned 1 [0103.182] CloseHandle (hObject=0x168) returned 1 [0103.182] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x2020) returned 1 [0103.182] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml")) returned 1 [0103.182] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0103.182] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0103.182] lstrlenW (lpString=".doc") returned 4 [0103.182] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0103.182] lstrlenW (lpString=".docx") returned 5 [0103.182] lstrcmpiW (lpString1=".docx", lpString2="f.xml") returned -1 [0103.182] lstrlenW (lpString=".pdf") returned 4 [0103.182] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0103.182] lstrlenW (lpString=".xls") returned 4 [0103.182] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0103.182] lstrlenW (lpString=".xlsx") returned 5 [0103.182] lstrcmpiW (lpString1=".xlsx", lpString2="f.xml") returned -1 [0103.182] lstrlenW (lpString=".ppt") returned 4 [0103.182] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0103.182] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0103.182] lstrlenW (lpString=".zip") returned 4 [0103.182] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0103.182] lstrlenW (lpString=".rar") returned 4 [0103.182] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0103.183] lstrlenW (lpString=".bz2") returned 4 [0103.183] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0103.183] lstrlenW (lpString=".7z") returned 3 [0103.183] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0103.183] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0103.183] lstrlenW (lpString=".dbf") returned 4 [0103.183] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0103.183] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0103.183] lstrlenW (lpString=".1cd") returned 4 [0103.183] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0103.183] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0103.183] lstrlenW (lpString=".jpg") returned 4 [0103.183] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0103.183] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0103.183] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0103.183] lstrlenW (lpString=".doc") returned 4 [0103.183] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0103.183] lstrlenW (lpString=".docx") returned 5 [0103.183] lstrcmpiW (lpString1=".docx", lpString2="f.xml") returned -1 [0103.183] lstrlenW (lpString=".pdf") returned 4 [0103.183] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0103.183] lstrlenW (lpString=".xls") returned 4 [0103.183] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0103.183] lstrlenW (lpString=".xlsx") returned 5 [0103.183] lstrcmpiW (lpString1=".xlsx", lpString2="f.xml") returned -1 [0103.183] lstrlenW (lpString=".ppt") returned 4 [0103.183] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0103.183] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0103.183] lstrlenW (lpString=".zip") returned 4 [0103.183] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0103.183] lstrlenW (lpString=".rar") returned 4 [0103.183] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0103.183] lstrlenW (lpString=".bz2") returned 4 [0103.183] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0103.183] lstrlenW (lpString=".7z") returned 3 [0103.183] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0103.183] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0103.183] lstrlenW (lpString=".dbf") returned 4 [0103.183] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0103.183] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0103.183] lstrlenW (lpString=".1cd") returned 4 [0103.183] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0103.183] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0103.183] lstrlenW (lpString=".jpg") returned 4 [0103.183] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0103.183] lstrcmpiW (lpString1=".xml", lpString2=".waifu") returned 1 [0103.184] lstrlenW (lpString="Setup.xml") returned 9 [0103.184] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0103.184] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x26ff9fc | out: lpFileSize=0x26ff9fc*=6241) returned 1 [0103.184] CloseHandle (hObject=0x168) returned 1 [0103.185] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0103.185] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0103.185] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0103.185] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0103.185] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0103.185] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0103.186] GetLastError () returned 0x0 [0103.186] ReadFile (in: hFile=0x168, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x1861, lpOverlapped=0x0) returned 1 [0103.187] WriteFile (in: hFile=0x180, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x1870, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0x1870, lpOverlapped=0x0) returned 1 [0103.187] ReadFile (in: hFile=0x168, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x0, lpOverlapped=0x0) returned 1 [0103.188] WriteFile (in: hFile=0x180, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0xe6, lpOverlapped=0x0) returned 1 [0103.188] SetEndOfFile (hFile=0x180) returned 1 [0103.188] CloseHandle (hObject=0x180) returned 1 [0103.188] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0103.188] SetEndOfFile (hFile=0x168) returned 1 [0103.189] CloseHandle (hObject=0x168) returned 1 [0103.189] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x2020) returned 1 [0103.189] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0103.190] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0103.190] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0103.190] lstrlenW (lpString=".doc") returned 4 [0103.190] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0103.190] lstrlenW (lpString=".docx") returned 5 [0103.190] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0103.190] lstrlenW (lpString=".pdf") returned 4 [0103.190] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0103.190] lstrlenW (lpString=".xls") returned 4 [0103.190] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0103.190] lstrlenW (lpString=".xlsx") returned 5 [0103.190] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0103.190] lstrlenW (lpString=".ppt") returned 4 [0103.190] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0103.190] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0103.190] lstrlenW (lpString=".zip") returned 4 [0103.190] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0103.190] lstrlenW (lpString=".rar") returned 4 [0103.190] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0103.190] lstrlenW (lpString=".bz2") returned 4 [0103.190] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0103.190] lstrlenW (lpString=".7z") returned 3 [0103.190] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0103.190] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0103.190] lstrlenW (lpString=".dbf") returned 4 [0103.190] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0103.190] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0103.190] lstrlenW (lpString=".1cd") returned 4 [0103.190] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0103.190] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0103.190] lstrlenW (lpString=".jpg") returned 4 [0103.190] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0103.190] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0103.190] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0103.190] lstrlenW (lpString=".doc") returned 4 [0103.190] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0103.190] lstrlenW (lpString=".docx") returned 5 [0103.190] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0103.190] lstrlenW (lpString=".pdf") returned 4 [0103.190] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0103.190] lstrlenW (lpString=".xls") returned 4 [0103.190] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0103.190] lstrlenW (lpString=".xlsx") returned 5 [0103.190] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0103.190] lstrlenW (lpString=".ppt") returned 4 [0103.190] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0103.190] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0103.191] lstrlenW (lpString=".zip") returned 4 [0103.191] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0103.191] lstrlenW (lpString=".rar") returned 4 [0103.191] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0103.191] lstrlenW (lpString=".bz2") returned 4 [0103.191] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0103.191] lstrlenW (lpString=".7z") returned 3 [0103.191] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0103.191] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0103.191] lstrlenW (lpString=".dbf") returned 4 [0103.191] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0103.191] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0103.191] lstrlenW (lpString=".1cd") returned 4 [0103.191] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0103.191] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0103.191] lstrlenW (lpString=".jpg") returned 4 [0103.191] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0103.191] lstrcmpiW (lpString1=".xml", lpString2=".waifu") returned 1 [0103.191] lstrlenW (lpString="VisioMUI.xml") returned 12 [0103.191] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0103.191] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x26ff9fc | out: lpFileSize=0x26ff9fc*=9503) returned 1 [0103.191] CloseHandle (hObject=0x168) returned 1 [0103.191] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml")) returned 0x2020 [0103.191] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0103.191] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0103.192] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0103.192] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0103.192] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0103.192] GetLastError () returned 0x0 [0103.192] ReadFile (in: hFile=0x168, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x251f, lpOverlapped=0x0) returned 1 [0103.193] WriteFile (in: hFile=0x180, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x2520, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0x2520, lpOverlapped=0x0) returned 1 [0103.194] ReadFile (in: hFile=0x168, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x0, lpOverlapped=0x0) returned 1 [0103.194] WriteFile (in: hFile=0x180, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0xec, lpOverlapped=0x0) returned 1 [0103.194] SetEndOfFile (hFile=0x180) returned 1 [0103.194] CloseHandle (hObject=0x180) returned 1 [0103.195] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0103.195] SetEndOfFile (hFile=0x168) returned 1 [0103.195] CloseHandle (hObject=0x168) returned 1 [0103.195] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x2020) returned 1 [0103.195] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml")) returned 1 [0103.196] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0103.196] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0103.196] lstrlenW (lpString=".doc") returned 4 [0103.196] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0103.196] lstrlenW (lpString=".docx") returned 5 [0103.196] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0103.196] lstrlenW (lpString=".pdf") returned 4 [0103.196] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0103.196] lstrlenW (lpString=".xls") returned 4 [0103.196] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0103.196] lstrlenW (lpString=".xlsx") returned 5 [0103.196] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0103.196] lstrlenW (lpString=".ppt") returned 4 [0103.196] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0103.196] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0103.196] lstrlenW (lpString=".zip") returned 4 [0103.196] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0103.196] lstrlenW (lpString=".rar") returned 4 [0103.196] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0103.196] lstrlenW (lpString=".bz2") returned 4 [0103.196] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0103.196] lstrlenW (lpString=".7z") returned 3 [0103.196] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0103.196] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0103.196] lstrlenW (lpString=".dbf") returned 4 [0103.196] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0103.196] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0103.196] lstrlenW (lpString=".1cd") returned 4 [0103.196] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0103.196] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0103.196] lstrlenW (lpString=".jpg") returned 4 [0103.196] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0103.196] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0103.196] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0103.196] lstrlenW (lpString=".doc") returned 4 [0103.196] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0103.196] lstrlenW (lpString=".docx") returned 5 [0103.196] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0103.196] lstrlenW (lpString=".pdf") returned 4 [0103.196] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0103.196] lstrlenW (lpString=".xls") returned 4 [0103.196] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0103.196] lstrlenW (lpString=".xlsx") returned 5 [0103.196] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0103.196] lstrlenW (lpString=".ppt") returned 4 [0103.196] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0103.196] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0103.196] lstrlenW (lpString=".zip") returned 4 [0103.196] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0103.197] lstrlenW (lpString=".rar") returned 4 [0103.197] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0103.197] lstrlenW (lpString=".bz2") returned 4 [0103.197] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0103.197] lstrlenW (lpString=".7z") returned 3 [0103.197] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0103.197] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0103.197] lstrlenW (lpString=".dbf") returned 4 [0103.197] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0103.197] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0103.197] lstrlenW (lpString=".1cd") returned 4 [0103.197] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0103.197] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0103.197] lstrlenW (lpString=".jpg") returned 4 [0103.197] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0103.197] lstrcmpiW (lpString1=".xml", lpString2=".waifu") returned 1 [0103.197] lstrlenW (lpString="OneNoteMUI.xml") returned 14 [0103.197] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0103.198] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x26ff9fc | out: lpFileSize=0x26ff9fc*=1606) returned 1 [0103.198] CloseHandle (hObject=0x168) returned 1 [0103.198] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml")) returned 0x2020 [0103.199] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0103.200] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0103.200] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0103.200] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0103.200] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0103.200] GetLastError () returned 0x0 [0103.200] ReadFile (in: hFile=0x168, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x646, lpOverlapped=0x0) returned 1 [0103.201] WriteFile (in: hFile=0x180, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x650, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0x650, lpOverlapped=0x0) returned 1 [0103.201] ReadFile (in: hFile=0x168, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x0, lpOverlapped=0x0) returned 1 [0103.201] WriteFile (in: hFile=0x180, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0xf0, lpOverlapped=0x0) returned 1 [0103.202] SetEndOfFile (hFile=0x180) returned 1 [0103.202] CloseHandle (hObject=0x180) returned 1 [0103.202] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0103.202] SetEndOfFile (hFile=0x168) returned 1 [0103.203] CloseHandle (hObject=0x168) returned 1 [0103.203] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x2020) returned 1 [0103.203] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml")) returned 1 [0103.204] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0103.204] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0103.204] lstrlenW (lpString=".doc") returned 4 [0103.204] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0103.204] lstrlenW (lpString=".docx") returned 5 [0103.204] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0103.204] lstrlenW (lpString=".pdf") returned 4 [0103.204] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0103.204] lstrlenW (lpString=".xls") returned 4 [0103.204] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0103.204] lstrlenW (lpString=".xlsx") returned 5 [0103.204] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0103.204] lstrlenW (lpString=".ppt") returned 4 [0103.204] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0103.204] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0103.204] lstrlenW (lpString=".zip") returned 4 [0103.204] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0103.204] lstrlenW (lpString=".rar") returned 4 [0103.204] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0103.204] lstrlenW (lpString=".bz2") returned 4 [0103.204] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0103.204] lstrlenW (lpString=".7z") returned 3 [0103.204] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0103.204] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0103.204] lstrlenW (lpString=".dbf") returned 4 [0103.204] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0103.204] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0103.204] lstrlenW (lpString=".1cd") returned 4 [0103.204] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0103.204] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0103.204] lstrlenW (lpString=".jpg") returned 4 [0103.204] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0103.204] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0103.204] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0103.204] lstrlenW (lpString=".doc") returned 4 [0103.204] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0103.204] lstrlenW (lpString=".docx") returned 5 [0103.204] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0103.204] lstrlenW (lpString=".pdf") returned 4 [0103.204] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0103.204] lstrlenW (lpString=".xls") returned 4 [0103.204] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0103.205] lstrlenW (lpString=".xlsx") returned 5 [0103.205] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0103.205] lstrlenW (lpString=".ppt") returned 4 [0103.205] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0103.205] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0103.205] lstrlenW (lpString=".zip") returned 4 [0103.205] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0103.205] lstrlenW (lpString=".rar") returned 4 [0103.205] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0103.205] lstrlenW (lpString=".bz2") returned 4 [0103.205] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0103.205] lstrlenW (lpString=".7z") returned 3 [0103.205] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0103.205] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0103.205] lstrlenW (lpString=".dbf") returned 4 [0103.205] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0103.205] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0103.205] lstrlenW (lpString=".1cd") returned 4 [0103.205] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0103.205] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0103.205] lstrlenW (lpString=".jpg") returned 4 [0103.205] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0103.205] lstrcmpiW (lpString1=".xml", lpString2=".waifu") returned 1 [0103.205] lstrlenW (lpString="Setup.xml") returned 9 [0103.205] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0103.206] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x26ff9fc | out: lpFileSize=0x26ff9fc*=1988) returned 1 [0103.206] CloseHandle (hObject=0x168) returned 1 [0103.206] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0103.206] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0103.206] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0103.206] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0103.206] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0103.206] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0103.206] GetLastError () returned 0x0 [0103.206] ReadFile (in: hFile=0x168, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x7c4, lpOverlapped=0x0) returned 1 [0103.207] WriteFile (in: hFile=0x180, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x7d0, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0x7d0, lpOverlapped=0x0) returned 1 [0103.208] ReadFile (in: hFile=0x168, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x0, lpOverlapped=0x0) returned 1 [0103.208] WriteFile (in: hFile=0x180, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0xe6, lpOverlapped=0x0) returned 1 [0103.208] SetEndOfFile (hFile=0x180) returned 1 [0103.208] CloseHandle (hObject=0x180) returned 1 [0103.209] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0103.209] SetEndOfFile (hFile=0x168) returned 1 [0103.209] CloseHandle (hObject=0x168) returned 1 [0103.209] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x2020) returned 1 [0103.210] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0103.210] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0103.210] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0103.210] lstrlenW (lpString=".doc") returned 4 [0103.210] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0103.210] lstrlenW (lpString=".docx") returned 5 [0103.210] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0103.210] lstrlenW (lpString=".pdf") returned 4 [0103.210] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0103.210] lstrlenW (lpString=".xls") returned 4 [0103.210] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0103.210] lstrlenW (lpString=".xlsx") returned 5 [0103.210] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0103.210] lstrlenW (lpString=".ppt") returned 4 [0103.210] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0103.210] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0103.210] lstrlenW (lpString=".zip") returned 4 [0103.210] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0103.210] lstrlenW (lpString=".rar") returned 4 [0103.210] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0103.210] lstrlenW (lpString=".bz2") returned 4 [0103.210] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0103.210] lstrlenW (lpString=".7z") returned 3 [0103.210] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0103.210] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0103.210] lstrlenW (lpString=".dbf") returned 4 [0103.210] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0103.210] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0103.210] lstrlenW (lpString=".1cd") returned 4 [0103.210] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0103.210] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0103.210] lstrlenW (lpString=".jpg") returned 4 [0103.210] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0103.210] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0103.210] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0103.210] lstrlenW (lpString=".doc") returned 4 [0103.210] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0103.210] lstrlenW (lpString=".docx") returned 5 [0103.210] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0103.210] lstrlenW (lpString=".pdf") returned 4 [0103.210] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0103.210] lstrlenW (lpString=".xls") returned 4 [0103.210] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0103.211] lstrlenW (lpString=".xlsx") returned 5 [0103.211] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0103.211] lstrlenW (lpString=".ppt") returned 4 [0103.211] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0103.211] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0103.211] lstrlenW (lpString=".zip") returned 4 [0103.211] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0103.211] lstrlenW (lpString=".rar") returned 4 [0103.211] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0103.211] lstrlenW (lpString=".bz2") returned 4 [0103.211] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0103.211] lstrlenW (lpString=".7z") returned 3 [0103.211] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0103.211] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0103.211] lstrlenW (lpString=".dbf") returned 4 [0103.211] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0103.211] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0103.211] lstrlenW (lpString=".1cd") returned 4 [0103.211] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0103.211] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0103.211] lstrlenW (lpString=".jpg") returned 4 [0103.211] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0103.211] lstrcmpiW (lpString1=".xml", lpString2=".waifu") returned 1 [0103.211] lstrlenW (lpString="ProjectMUI.xml") returned 14 [0103.211] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0103.212] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x26ff9fc | out: lpFileSize=0x26ff9fc*=1452) returned 1 [0103.212] CloseHandle (hObject=0x168) returned 1 [0103.474] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml")) returned 0x2020 [0103.495] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0103.495] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0103.495] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0103.495] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0103.495] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0103.495] GetLastError () returned 0x0 [0103.495] ReadFile (in: hFile=0x198, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x5ac, lpOverlapped=0x0) returned 1 [0103.496] WriteFile (in: hFile=0x19c, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0x5b0, lpOverlapped=0x0) returned 1 [0103.497] ReadFile (in: hFile=0x198, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x0, lpOverlapped=0x0) returned 1 [0103.497] WriteFile (in: hFile=0x19c, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0xf0, lpOverlapped=0x0) returned 1 [0103.497] SetEndOfFile (hFile=0x19c) returned 1 [0103.497] CloseHandle (hObject=0x19c) returned 1 [0103.498] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0103.498] SetEndOfFile (hFile=0x198) returned 1 [0103.498] CloseHandle (hObject=0x198) returned 1 [0103.498] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x2020) returned 1 [0103.499] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml")) returned 1 [0103.499] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0103.499] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0103.499] lstrlenW (lpString=".doc") returned 4 [0103.499] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0103.499] lstrlenW (lpString=".docx") returned 5 [0103.499] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0103.499] lstrlenW (lpString=".pdf") returned 4 [0103.499] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0103.499] lstrlenW (lpString=".xls") returned 4 [0103.499] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0103.499] lstrlenW (lpString=".xlsx") returned 5 [0103.499] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0103.499] lstrlenW (lpString=".ppt") returned 4 [0103.499] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0103.499] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0103.499] lstrlenW (lpString=".zip") returned 4 [0103.499] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0103.499] lstrlenW (lpString=".rar") returned 4 [0103.499] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0103.499] lstrlenW (lpString=".bz2") returned 4 [0103.499] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0103.499] lstrlenW (lpString=".7z") returned 3 [0103.499] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0103.499] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0103.499] lstrlenW (lpString=".dbf") returned 4 [0103.499] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0103.499] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0103.499] lstrlenW (lpString=".1cd") returned 4 [0103.499] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0103.499] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0103.499] lstrlenW (lpString=".jpg") returned 4 [0103.499] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0103.499] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0103.499] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0103.499] lstrlenW (lpString=".doc") returned 4 [0103.499] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0103.499] lstrlenW (lpString=".docx") returned 5 [0103.499] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0103.499] lstrlenW (lpString=".pdf") returned 4 [0103.499] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0103.500] lstrlenW (lpString=".xls") returned 4 [0103.500] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0103.500] lstrlenW (lpString=".xlsx") returned 5 [0103.500] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0103.500] lstrlenW (lpString=".ppt") returned 4 [0103.500] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0103.500] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0103.500] lstrlenW (lpString=".zip") returned 4 [0103.500] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0103.500] lstrlenW (lpString=".rar") returned 4 [0103.500] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0103.500] lstrlenW (lpString=".bz2") returned 4 [0103.500] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0103.500] lstrlenW (lpString=".7z") returned 3 [0103.500] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0103.500] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0103.500] lstrlenW (lpString=".dbf") returned 4 [0103.500] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0103.500] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0103.500] lstrlenW (lpString=".1cd") returned 4 [0103.500] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0103.500] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0103.500] lstrlenW (lpString=".jpg") returned 4 [0103.500] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0103.500] lstrcmpiW (lpString1=".xml", lpString2=".waifu") returned 1 [0103.500] lstrlenW (lpString="Setup.xml") returned 9 [0103.500] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0103.500] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x26ff9fc | out: lpFileSize=0x26ff9fc*=9352) returned 1 [0103.500] CloseHandle (hObject=0x198) returned 1 [0103.500] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0103.501] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0103.501] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0103.501] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0103.501] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0103.501] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0103.501] GetLastError () returned 0x0 [0103.501] ReadFile (in: hFile=0x198, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x2488, lpOverlapped=0x0) returned 1 [0103.502] WriteFile (in: hFile=0x19c, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x2490, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0x2490, lpOverlapped=0x0) returned 1 [0103.503] ReadFile (in: hFile=0x198, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x0, lpOverlapped=0x0) returned 1 [0103.503] WriteFile (in: hFile=0x19c, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0xe6, lpOverlapped=0x0) returned 1 [0103.503] SetEndOfFile (hFile=0x19c) returned 1 [0103.503] CloseHandle (hObject=0x19c) returned 1 [0103.503] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0103.503] SetEndOfFile (hFile=0x198) returned 1 [0103.504] CloseHandle (hObject=0x198) returned 1 [0103.504] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x2020) returned 1 [0103.504] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0103.504] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0103.504] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0103.504] lstrlenW (lpString=".doc") returned 4 [0103.504] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0103.504] lstrlenW (lpString=".docx") returned 5 [0103.504] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0103.504] lstrlenW (lpString=".pdf") returned 4 [0103.504] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0103.504] lstrlenW (lpString=".xls") returned 4 [0103.504] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0103.504] lstrlenW (lpString=".xlsx") returned 5 [0103.504] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0103.504] lstrlenW (lpString=".ppt") returned 4 [0103.505] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0103.505] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0103.505] lstrlenW (lpString=".zip") returned 4 [0103.505] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0103.505] lstrlenW (lpString=".rar") returned 4 [0103.505] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0103.505] lstrlenW (lpString=".bz2") returned 4 [0103.505] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0103.505] lstrlenW (lpString=".7z") returned 3 [0103.505] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0103.505] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0103.505] lstrlenW (lpString=".dbf") returned 4 [0103.505] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0103.505] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0103.505] lstrlenW (lpString=".1cd") returned 4 [0103.505] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0103.505] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0103.505] lstrlenW (lpString=".jpg") returned 4 [0103.505] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0103.505] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0103.505] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0103.505] lstrlenW (lpString=".doc") returned 4 [0103.505] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0103.505] lstrlenW (lpString=".docx") returned 5 [0103.505] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0103.505] lstrlenW (lpString=".pdf") returned 4 [0103.505] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0103.505] lstrlenW (lpString=".xls") returned 4 [0103.505] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0103.505] lstrlenW (lpString=".xlsx") returned 5 [0103.505] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0103.505] lstrlenW (lpString=".ppt") returned 4 [0103.505] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0103.505] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0103.505] lstrlenW (lpString=".zip") returned 4 [0103.505] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0103.505] lstrlenW (lpString=".rar") returned 4 [0103.505] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0103.505] lstrlenW (lpString=".bz2") returned 4 [0103.505] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0103.505] lstrlenW (lpString=".7z") returned 3 [0103.505] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0103.505] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0103.505] lstrlenW (lpString=".dbf") returned 4 [0103.505] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0103.505] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0103.505] lstrlenW (lpString=".1cd") returned 4 [0103.505] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0103.505] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0103.505] lstrlenW (lpString=".jpg") returned 4 [0103.505] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0103.506] lstrcmpiW (lpString1=".xml", lpString2=".waifu") returned 1 [0103.506] lstrlenW (lpString="AccessMUI.xml") returned 13 [0103.506] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0103.507] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x26ff9fc | out: lpFileSize=0x26ff9fc*=1349) returned 1 [0103.507] CloseHandle (hObject=0x198) returned 1 [0103.507] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml")) returned 0x2020 [0103.508] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0103.508] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0103.509] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0103.509] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0103.509] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0103.509] GetLastError () returned 0x0 [0103.509] ReadFile (in: hFile=0x198, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x545, lpOverlapped=0x0) returned 1 [0103.510] WriteFile (in: hFile=0x19c, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0x550, lpOverlapped=0x0) returned 1 [0103.510] ReadFile (in: hFile=0x198, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x0, lpOverlapped=0x0) returned 1 [0103.511] WriteFile (in: hFile=0x19c, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0xee, lpOverlapped=0x0) returned 1 [0103.511] SetEndOfFile (hFile=0x19c) returned 1 [0103.511] CloseHandle (hObject=0x19c) returned 1 [0103.511] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0103.511] SetEndOfFile (hFile=0x198) returned 1 [0103.512] CloseHandle (hObject=0x198) returned 1 [0103.512] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x2020) returned 1 [0103.512] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml")) returned 1 [0103.512] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0103.512] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0103.512] lstrlenW (lpString=".doc") returned 4 [0103.512] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0103.512] lstrlenW (lpString=".docx") returned 5 [0103.512] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0103.512] lstrlenW (lpString=".pdf") returned 4 [0103.512] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0103.512] lstrlenW (lpString=".xls") returned 4 [0103.512] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0103.512] lstrlenW (lpString=".xlsx") returned 5 [0103.512] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0103.512] lstrlenW (lpString=".ppt") returned 4 [0103.512] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0103.512] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0103.512] lstrlenW (lpString=".zip") returned 4 [0103.513] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0103.513] lstrlenW (lpString=".rar") returned 4 [0103.513] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0103.513] lstrlenW (lpString=".bz2") returned 4 [0103.513] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0103.513] lstrlenW (lpString=".7z") returned 3 [0103.513] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0103.513] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0103.513] lstrlenW (lpString=".dbf") returned 4 [0103.513] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0103.513] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0103.513] lstrlenW (lpString=".1cd") returned 4 [0103.513] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0103.513] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0103.513] lstrlenW (lpString=".jpg") returned 4 [0103.513] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0103.513] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0103.513] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0103.513] lstrlenW (lpString=".doc") returned 4 [0103.513] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0103.513] lstrlenW (lpString=".docx") returned 5 [0103.513] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0103.513] lstrlenW (lpString=".pdf") returned 4 [0103.513] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0103.513] lstrlenW (lpString=".xls") returned 4 [0103.513] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0103.513] lstrlenW (lpString=".xlsx") returned 5 [0103.513] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0103.513] lstrlenW (lpString=".ppt") returned 4 [0103.513] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0103.513] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0103.513] lstrlenW (lpString=".zip") returned 4 [0103.513] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0103.513] lstrlenW (lpString=".rar") returned 4 [0103.513] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0103.513] lstrlenW (lpString=".bz2") returned 4 [0103.513] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0103.513] lstrlenW (lpString=".7z") returned 3 [0103.513] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0103.513] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0103.513] lstrlenW (lpString=".dbf") returned 4 [0103.513] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0103.513] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0103.513] lstrlenW (lpString=".1cd") returned 4 [0103.513] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0103.513] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0103.513] lstrlenW (lpString=".jpg") returned 4 [0103.513] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0103.513] lstrcmpiW (lpString1=".xml", lpString2=".waifu") returned 1 [0103.514] lstrlenW (lpString="branding.xml") returned 12 [0103.514] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0103.514] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x26ff9fc | out: lpFileSize=0x26ff9fc*=596341) returned 1 [0103.514] CloseHandle (hObject=0x198) returned 1 [0103.514] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml")) returned 0x2020 [0103.514] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0103.514] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0103.514] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0103.514] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0103.514] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0103.514] GetLastError () returned 0x0 [0103.514] ReadFile (in: hFile=0x198, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x91975, lpOverlapped=0x0) returned 1 [0103.524] WriteFile (in: hFile=0x19c, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x91980, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0x91980, lpOverlapped=0x0) returned 1 [0103.528] ReadFile (in: hFile=0x198, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x0, lpOverlapped=0x0) returned 1 [0103.528] WriteFile (in: hFile=0x19c, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0xec, lpOverlapped=0x0) returned 1 [0103.528] SetEndOfFile (hFile=0x19c) returned 1 [0103.529] CloseHandle (hObject=0x19c) returned 1 [0103.532] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0103.532] SetEndOfFile (hFile=0x198) returned 1 [0103.855] CloseHandle (hObject=0x198) returned 1 [0103.874] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x2020) returned 1 [0103.889] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml")) returned 1 [0103.889] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0103.889] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0103.889] lstrlenW (lpString=".doc") returned 4 [0103.889] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0103.889] lstrlenW (lpString=".docx") returned 5 [0103.889] lstrcmpiW (lpString1=".docx", lpString2="g.xml") returned -1 [0103.889] lstrlenW (lpString=".pdf") returned 4 [0103.889] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0103.889] lstrlenW (lpString=".xls") returned 4 [0103.889] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0103.889] lstrlenW (lpString=".xlsx") returned 5 [0103.889] lstrcmpiW (lpString1=".xlsx", lpString2="g.xml") returned -1 [0103.889] lstrlenW (lpString=".ppt") returned 4 [0103.889] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0103.889] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0103.889] lstrlenW (lpString=".zip") returned 4 [0103.889] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0103.889] lstrlenW (lpString=".rar") returned 4 [0103.889] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0103.889] lstrlenW (lpString=".bz2") returned 4 [0103.889] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0103.889] lstrlenW (lpString=".7z") returned 3 [0103.889] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0103.889] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0103.889] lstrlenW (lpString=".dbf") returned 4 [0103.889] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0103.889] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0103.889] lstrlenW (lpString=".1cd") returned 4 [0103.889] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0103.890] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0103.890] lstrlenW (lpString=".jpg") returned 4 [0103.890] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0103.890] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0103.890] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0103.890] lstrlenW (lpString=".doc") returned 4 [0103.890] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0103.890] lstrlenW (lpString=".docx") returned 5 [0103.890] lstrcmpiW (lpString1=".docx", lpString2="g.xml") returned -1 [0103.890] lstrlenW (lpString=".pdf") returned 4 [0103.890] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0103.890] lstrlenW (lpString=".xls") returned 4 [0103.890] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0103.890] lstrlenW (lpString=".xlsx") returned 5 [0103.890] lstrcmpiW (lpString1=".xlsx", lpString2="g.xml") returned -1 [0103.890] lstrlenW (lpString=".ppt") returned 4 [0103.890] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0103.890] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0103.890] lstrlenW (lpString=".zip") returned 4 [0103.890] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0103.890] lstrlenW (lpString=".rar") returned 4 [0103.890] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0103.890] lstrlenW (lpString=".bz2") returned 4 [0103.890] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0103.890] lstrlenW (lpString=".7z") returned 3 [0103.890] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0103.890] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0103.890] lstrlenW (lpString=".dbf") returned 4 [0103.890] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0103.890] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0103.890] lstrlenW (lpString=".1cd") returned 4 [0103.890] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0103.890] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0103.890] lstrlenW (lpString=".jpg") returned 4 [0103.890] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0103.890] lstrcmpiW (lpString1=".xml", lpString2=".waifu") returned 1 [0103.890] lstrlenW (lpString="Office32WW.xml") returned 14 [0103.890] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0103.891] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x26ff9fc | out: lpFileSize=0x26ff9fc*=4274) returned 1 [0103.891] CloseHandle (hObject=0x198) returned 1 [0103.891] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml")) returned 0x2020 [0103.891] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0103.891] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0103.891] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0103.891] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0103.891] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0103.891] GetLastError () returned 0x0 [0103.891] ReadFile (in: hFile=0x198, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x10b2, lpOverlapped=0x0) returned 1 [0103.979] WriteFile (in: hFile=0x17c, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x10c0, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0x10c0, lpOverlapped=0x0) returned 1 [0104.525] ReadFile (in: hFile=0x198, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x0, lpOverlapped=0x0) returned 1 [0104.525] WriteFile (in: hFile=0x17c, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0xf0, lpOverlapped=0x0) returned 1 [0104.525] SetEndOfFile (hFile=0x17c) returned 1 [0104.525] CloseHandle (hObject=0x17c) returned 1 [0104.525] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0104.525] SetEndOfFile (hFile=0x198) returned 1 [0104.526] CloseHandle (hObject=0x198) returned 1 [0104.526] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x2020) returned 1 [0104.526] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml")) returned 1 [0104.526] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0104.526] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0104.526] lstrlenW (lpString=".doc") returned 4 [0104.526] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0104.526] lstrlenW (lpString=".docx") returned 5 [0104.526] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0104.526] lstrlenW (lpString=".pdf") returned 4 [0104.526] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0104.526] lstrlenW (lpString=".xls") returned 4 [0104.526] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0104.527] lstrlenW (lpString=".xlsx") returned 5 [0104.527] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0104.527] lstrlenW (lpString=".ppt") returned 4 [0104.527] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0104.527] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0104.527] lstrlenW (lpString=".zip") returned 4 [0104.527] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0104.527] lstrlenW (lpString=".rar") returned 4 [0104.527] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0104.527] lstrlenW (lpString=".bz2") returned 4 [0104.527] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0104.527] lstrlenW (lpString=".7z") returned 3 [0104.527] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0104.527] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0104.527] lstrlenW (lpString=".dbf") returned 4 [0104.527] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0104.527] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0104.527] lstrlenW (lpString=".1cd") returned 4 [0104.527] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0104.527] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0104.527] lstrlenW (lpString=".jpg") returned 4 [0104.527] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0104.527] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0104.527] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0104.527] lstrlenW (lpString=".doc") returned 4 [0104.527] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0104.527] lstrlenW (lpString=".docx") returned 5 [0104.527] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0104.527] lstrlenW (lpString=".pdf") returned 4 [0104.527] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0104.527] lstrlenW (lpString=".xls") returned 4 [0104.527] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0104.527] lstrlenW (lpString=".xlsx") returned 5 [0104.527] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0104.527] lstrlenW (lpString=".ppt") returned 4 [0104.527] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0104.527] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0104.527] lstrlenW (lpString=".zip") returned 4 [0104.527] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0104.527] lstrlenW (lpString=".rar") returned 4 [0104.527] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0104.527] lstrlenW (lpString=".bz2") returned 4 [0104.527] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0104.527] lstrlenW (lpString=".7z") returned 3 [0104.527] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0104.527] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0104.527] lstrlenW (lpString=".dbf") returned 4 [0104.527] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0104.527] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0104.527] lstrlenW (lpString=".1cd") returned 4 [0104.527] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0104.527] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0104.527] lstrlenW (lpString=".jpg") returned 4 [0104.528] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0104.528] lstrcmpiW (lpString1=".PNG", lpString2=".waifu") returned -1 [0104.528] lstrlenW (lpString="MS.PNG") returned 6 [0104.528] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0104.528] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x26ff9fc | out: lpFileSize=0x26ff9fc*=1682) returned 1 [0104.528] CloseHandle (hObject=0x198) returned 1 [0104.528] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png")) returned 0x20 [0104.528] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0104.528] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0104.528] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0104.528] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0104.528] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0104.528] GetLastError () returned 0x0 [0104.528] ReadFile (in: hFile=0x198, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x692, lpOverlapped=0x0) returned 1 [0104.529] WriteFile (in: hFile=0x17c, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x6a0, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0x6a0, lpOverlapped=0x0) returned 1 [0104.530] ReadFile (in: hFile=0x198, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x0, lpOverlapped=0x0) returned 1 [0104.530] WriteFile (in: hFile=0x17c, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0xe0, lpOverlapped=0x0) returned 1 [0104.530] SetEndOfFile (hFile=0x17c) returned 1 [0104.530] CloseHandle (hObject=0x17c) returned 1 [0104.530] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0104.530] SetEndOfFile (hFile=0x198) returned 1 [0104.531] CloseHandle (hObject=0x198) returned 1 [0104.531] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0104.531] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png")) returned 1 [0104.531] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0104.531] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0104.531] lstrlenW (lpString=".doc") returned 4 [0104.531] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0104.531] lstrlenW (lpString=".docx") returned 5 [0104.531] lstrcmpiW (lpString1=".docx", lpString2="S.PNG") returned -1 [0104.531] lstrlenW (lpString=".pdf") returned 4 [0104.531] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0104.531] lstrlenW (lpString=".xls") returned 4 [0104.532] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0104.532] lstrlenW (lpString=".xlsx") returned 5 [0104.532] lstrcmpiW (lpString1=".xlsx", lpString2="S.PNG") returned -1 [0104.532] lstrlenW (lpString=".ppt") returned 4 [0104.532] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0104.532] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0104.532] lstrlenW (lpString=".zip") returned 4 [0104.532] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0104.532] lstrlenW (lpString=".rar") returned 4 [0104.532] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0104.532] lstrlenW (lpString=".bz2") returned 4 [0104.532] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0104.532] lstrlenW (lpString=".7z") returned 3 [0104.532] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0104.532] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0104.532] lstrlenW (lpString=".dbf") returned 4 [0104.532] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0104.532] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0104.532] lstrlenW (lpString=".1cd") returned 4 [0104.532] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0104.532] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0104.532] lstrlenW (lpString=".jpg") returned 4 [0104.532] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0104.532] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0104.532] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0104.532] lstrlenW (lpString=".doc") returned 4 [0104.532] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0104.532] lstrlenW (lpString=".docx") returned 5 [0104.532] lstrcmpiW (lpString1=".docx", lpString2="S.PNG") returned -1 [0104.532] lstrlenW (lpString=".pdf") returned 4 [0104.532] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0104.532] lstrlenW (lpString=".xls") returned 4 [0104.532] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0104.532] lstrlenW (lpString=".xlsx") returned 5 [0104.532] lstrcmpiW (lpString1=".xlsx", lpString2="S.PNG") returned -1 [0104.532] lstrlenW (lpString=".ppt") returned 4 [0104.532] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0104.532] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0104.532] lstrlenW (lpString=".zip") returned 4 [0104.532] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0104.532] lstrlenW (lpString=".rar") returned 4 [0104.532] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0104.532] lstrlenW (lpString=".bz2") returned 4 [0104.532] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0104.532] lstrlenW (lpString=".7z") returned 3 [0104.532] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0104.532] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0104.532] lstrlenW (lpString=".dbf") returned 4 [0104.532] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0104.532] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0104.532] lstrlenW (lpString=".1cd") returned 4 [0104.532] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0104.533] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0104.533] lstrlenW (lpString=".jpg") returned 4 [0104.533] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0104.533] lstrcmpiW (lpString1=".xml", lpString2=".waifu") returned 1 [0104.533] lstrlenW (lpString="Alphabet.xml") returned 12 [0104.533] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0104.533] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x26ff9fc | out: lpFileSize=0x26ff9fc*=791686) returned 1 [0104.533] CloseHandle (hObject=0x198) returned 1 [0104.533] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml")) returned 0x20 [0104.533] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0104.534] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0104.534] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0104.534] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0104.534] lstrlenW (lpString=".doc") returned 4 [0104.534] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0104.534] lstrlenW (lpString=".docx") returned 5 [0104.534] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0104.534] lstrlenW (lpString=".pdf") returned 4 [0104.534] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0104.534] lstrlenW (lpString=".xls") returned 4 [0104.534] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0104.534] lstrlenW (lpString=".xlsx") returned 5 [0104.534] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0104.534] lstrlenW (lpString=".ppt") returned 4 [0104.534] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0104.534] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0104.534] lstrlenW (lpString=".zip") returned 4 [0104.534] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0104.534] lstrlenW (lpString=".rar") returned 4 [0104.534] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0104.534] lstrlenW (lpString=".bz2") returned 4 [0104.534] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0104.534] lstrlenW (lpString=".7z") returned 3 [0104.534] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0104.534] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0104.534] lstrlenW (lpString=".dbf") returned 4 [0104.534] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0104.534] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0104.534] lstrlenW (lpString=".1cd") returned 4 [0104.534] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0104.534] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0104.534] lstrlenW (lpString=".jpg") returned 4 [0104.534] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0104.534] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0104.534] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0104.534] lstrlenW (lpString=".doc") returned 4 [0104.534] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0104.534] lstrlenW (lpString=".docx") returned 5 [0104.534] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0104.534] lstrlenW (lpString=".pdf") returned 4 [0104.534] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0104.534] lstrlenW (lpString=".xls") returned 4 [0104.534] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0104.534] lstrlenW (lpString=".xlsx") returned 5 [0104.534] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0104.534] lstrlenW (lpString=".ppt") returned 4 [0104.534] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0104.534] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0104.534] lstrlenW (lpString=".zip") returned 4 [0104.534] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0104.535] lstrlenW (lpString=".rar") returned 4 [0104.535] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0104.535] lstrlenW (lpString=".bz2") returned 4 [0104.535] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0104.535] lstrlenW (lpString=".7z") returned 3 [0104.535] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0104.535] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0104.535] lstrlenW (lpString=".dbf") returned 4 [0104.535] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0104.535] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0104.535] lstrlenW (lpString=".1cd") returned 4 [0104.535] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0104.535] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0104.535] lstrlenW (lpString=".jpg") returned 4 [0104.535] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0104.535] lstrcmpiW (lpString1=".xml", lpString2=".waifu") returned 1 [0104.535] lstrlenW (lpString="Content.xml") returned 11 [0104.535] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0104.535] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x26ff9fc | out: lpFileSize=0x26ff9fc*=27045) returned 1 [0104.535] CloseHandle (hObject=0x198) returned 1 [0104.535] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml")) returned 0x20 [0104.535] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0104.535] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0104.535] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0104.535] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0104.535] lstrlenW (lpString=".doc") returned 4 [0104.535] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0104.535] lstrlenW (lpString=".docx") returned 5 [0104.536] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0104.536] lstrlenW (lpString=".pdf") returned 4 [0104.536] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0104.536] lstrlenW (lpString=".xls") returned 4 [0104.536] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0104.536] lstrlenW (lpString=".xlsx") returned 5 [0104.536] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0104.536] lstrlenW (lpString=".ppt") returned 4 [0104.536] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0104.536] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0104.536] lstrlenW (lpString=".zip") returned 4 [0104.536] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0104.536] lstrlenW (lpString=".rar") returned 4 [0104.536] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0104.536] lstrlenW (lpString=".bz2") returned 4 [0104.536] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0104.536] lstrlenW (lpString=".7z") returned 3 [0104.536] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0104.536] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0104.536] lstrlenW (lpString=".dbf") returned 4 [0104.536] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0104.536] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0104.536] lstrlenW (lpString=".1cd") returned 4 [0104.536] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0104.536] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0104.536] lstrlenW (lpString=".jpg") returned 4 [0104.536] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0104.536] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0104.536] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0104.536] lstrlenW (lpString=".doc") returned 4 [0104.536] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0104.536] lstrlenW (lpString=".docx") returned 5 [0104.536] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0104.536] lstrlenW (lpString=".pdf") returned 4 [0104.536] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0104.536] lstrlenW (lpString=".xls") returned 4 [0104.536] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0104.536] lstrlenW (lpString=".xlsx") returned 5 [0104.536] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0104.536] lstrlenW (lpString=".ppt") returned 4 [0104.536] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0104.536] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0104.536] lstrlenW (lpString=".zip") returned 4 [0104.536] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0104.536] lstrlenW (lpString=".rar") returned 4 [0104.536] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0104.536] lstrlenW (lpString=".bz2") returned 4 [0104.536] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0104.536] lstrlenW (lpString=".7z") returned 3 [0104.536] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0104.536] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0104.536] lstrlenW (lpString=".dbf") returned 4 [0104.537] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0104.537] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0104.537] lstrlenW (lpString=".1cd") returned 4 [0104.537] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0104.537] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0104.537] lstrlenW (lpString=".jpg") returned 4 [0104.537] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0104.537] lstrcmpiW (lpString1=".avi", lpString2=".waifu") returned -1 [0104.537] lstrlenW (lpString="boxed-correct.avi") returned 17 [0104.537] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0104.538] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x26ff9fc | out: lpFileSize=0x26ff9fc*=89600) returned 1 [0104.538] CloseHandle (hObject=0x198) returned 1 [0104.538] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi")) returned 0x20 [0104.538] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0104.538] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0104.538] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0104.538] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0104.538] lstrlenW (lpString=".doc") returned 4 [0104.538] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0104.538] lstrlenW (lpString=".docx") returned 5 [0104.538] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0104.538] lstrlenW (lpString=".pdf") returned 4 [0104.538] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0104.538] lstrlenW (lpString=".xls") returned 4 [0104.538] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0104.538] lstrlenW (lpString=".xlsx") returned 5 [0104.538] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0104.538] lstrlenW (lpString=".ppt") returned 4 [0104.538] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0104.538] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0104.538] lstrlenW (lpString=".zip") returned 4 [0104.538] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0104.538] lstrlenW (lpString=".rar") returned 4 [0104.538] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0104.538] lstrlenW (lpString=".bz2") returned 4 [0104.538] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0104.538] lstrlenW (lpString=".7z") returned 3 [0104.538] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0104.539] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0104.539] lstrlenW (lpString=".dbf") returned 4 [0104.539] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0104.539] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0104.539] lstrlenW (lpString=".1cd") returned 4 [0104.539] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0104.539] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0104.539] lstrlenW (lpString=".jpg") returned 4 [0104.539] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0104.539] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0104.539] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0104.539] lstrlenW (lpString=".doc") returned 4 [0104.539] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0104.539] lstrlenW (lpString=".docx") returned 5 [0104.539] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0104.539] lstrlenW (lpString=".pdf") returned 4 [0104.539] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0104.539] lstrlenW (lpString=".xls") returned 4 [0104.539] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0104.539] lstrlenW (lpString=".xlsx") returned 5 [0104.539] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0104.539] lstrlenW (lpString=".ppt") returned 4 [0104.539] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0104.539] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0104.539] lstrlenW (lpString=".zip") returned 4 [0104.539] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0104.539] lstrlenW (lpString=".rar") returned 4 [0104.539] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0104.539] lstrlenW (lpString=".bz2") returned 4 [0104.539] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0104.539] lstrlenW (lpString=".7z") returned 3 [0104.539] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0104.539] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0104.539] lstrlenW (lpString=".dbf") returned 4 [0104.539] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0104.539] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0104.539] lstrlenW (lpString=".1cd") returned 4 [0104.539] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0104.539] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0104.539] lstrlenW (lpString=".jpg") returned 4 [0104.539] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0104.539] lstrcmpiW (lpString1=".avi", lpString2=".waifu") returned -1 [0104.539] lstrlenW (lpString="boxed-delete.avi") returned 16 [0104.539] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0104.540] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x26ff9fc | out: lpFileSize=0x26ff9fc*=31744) returned 1 [0104.540] CloseHandle (hObject=0x198) returned 1 [0104.540] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi")) returned 0x20 [0104.540] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0104.540] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0104.540] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0104.540] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0104.540] lstrlenW (lpString=".doc") returned 4 [0104.540] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0104.540] lstrlenW (lpString=".docx") returned 5 [0104.540] lstrcmpiW (lpString1=".docx", lpString2="e.avi") returned -1 [0104.540] lstrlenW (lpString=".pdf") returned 4 [0104.540] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0104.540] lstrlenW (lpString=".xls") returned 4 [0104.540] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0104.540] lstrlenW (lpString=".xlsx") returned 5 [0104.540] lstrcmpiW (lpString1=".xlsx", lpString2="e.avi") returned -1 [0104.540] lstrlenW (lpString=".ppt") returned 4 [0104.540] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0104.540] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0104.540] lstrlenW (lpString=".zip") returned 4 [0104.540] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0104.540] lstrlenW (lpString=".rar") returned 4 [0104.541] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0104.541] lstrlenW (lpString=".bz2") returned 4 [0104.541] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0104.541] lstrlenW (lpString=".7z") returned 3 [0104.541] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0104.541] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0104.541] lstrlenW (lpString=".dbf") returned 4 [0104.541] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0104.541] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0104.541] lstrlenW (lpString=".1cd") returned 4 [0104.541] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0104.541] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0104.541] lstrlenW (lpString=".jpg") returned 4 [0104.541] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0104.541] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0104.541] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0104.541] lstrlenW (lpString=".doc") returned 4 [0104.541] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0104.541] lstrlenW (lpString=".docx") returned 5 [0104.541] lstrcmpiW (lpString1=".docx", lpString2="e.avi") returned -1 [0104.541] lstrlenW (lpString=".pdf") returned 4 [0104.541] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0104.541] lstrlenW (lpString=".xls") returned 4 [0104.541] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0104.541] lstrlenW (lpString=".xlsx") returned 5 [0104.541] lstrcmpiW (lpString1=".xlsx", lpString2="e.avi") returned -1 [0104.541] lstrlenW (lpString=".ppt") returned 4 [0104.541] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0104.541] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0104.541] lstrlenW (lpString=".zip") returned 4 [0104.541] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0104.541] lstrlenW (lpString=".rar") returned 4 [0104.541] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0104.541] lstrlenW (lpString=".bz2") returned 4 [0104.541] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0104.541] lstrlenW (lpString=".7z") returned 3 [0104.541] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0104.541] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0104.541] lstrlenW (lpString=".dbf") returned 4 [0104.541] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0104.541] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0104.541] lstrlenW (lpString=".1cd") returned 4 [0104.541] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0104.541] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0104.541] lstrlenW (lpString=".jpg") returned 4 [0104.541] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0104.541] lstrcmpiW (lpString1=".avi", lpString2=".waifu") returned -1 [0104.542] lstrlenW (lpString="boxed-join.avi") returned 14 [0104.542] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0104.542] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x26ff9fc | out: lpFileSize=0x26ff9fc*=33280) returned 1 [0104.542] CloseHandle (hObject=0x198) returned 1 [0104.542] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi")) returned 0x20 [0104.542] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0104.542] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0104.542] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0104.542] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0104.542] lstrlenW (lpString=".doc") returned 4 [0104.542] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0104.542] lstrlenW (lpString=".docx") returned 5 [0104.542] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1 [0104.542] lstrlenW (lpString=".pdf") returned 4 [0104.542] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0104.542] lstrlenW (lpString=".xls") returned 4 [0104.542] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0104.542] lstrlenW (lpString=".xlsx") returned 5 [0104.542] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1 [0104.542] lstrlenW (lpString=".ppt") returned 4 [0104.542] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0104.542] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0104.542] lstrlenW (lpString=".zip") returned 4 [0104.542] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0104.542] lstrlenW (lpString=".rar") returned 4 [0104.542] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0104.542] lstrlenW (lpString=".bz2") returned 4 [0104.542] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0104.542] lstrlenW (lpString=".7z") returned 3 [0104.542] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0104.542] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0104.542] lstrlenW (lpString=".dbf") returned 4 [0104.542] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0104.542] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0104.542] lstrlenW (lpString=".1cd") returned 4 [0104.542] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0104.542] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0104.542] lstrlenW (lpString=".jpg") returned 4 [0104.543] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0104.543] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0104.543] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0104.543] lstrlenW (lpString=".doc") returned 4 [0104.543] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0104.543] lstrlenW (lpString=".docx") returned 5 [0104.543] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1 [0104.543] lstrlenW (lpString=".pdf") returned 4 [0104.543] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0104.543] lstrlenW (lpString=".xls") returned 4 [0104.543] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0104.543] lstrlenW (lpString=".xlsx") returned 5 [0104.543] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1 [0104.543] lstrlenW (lpString=".ppt") returned 4 [0104.543] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0104.543] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0104.543] lstrlenW (lpString=".zip") returned 4 [0104.543] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0104.543] lstrlenW (lpString=".rar") returned 4 [0104.543] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0104.543] lstrlenW (lpString=".bz2") returned 4 [0104.543] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0104.543] lstrlenW (lpString=".7z") returned 3 [0104.543] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0104.543] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0104.543] lstrlenW (lpString=".dbf") returned 4 [0104.543] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0104.543] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0104.543] lstrlenW (lpString=".1cd") returned 4 [0104.543] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0104.543] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0104.543] lstrlenW (lpString=".jpg") returned 4 [0104.543] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0104.543] lstrcmpiW (lpString1=".avi", lpString2=".waifu") returned -1 [0104.543] lstrlenW (lpString="boxed-split.avi") returned 15 [0104.543] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0104.543] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x26ff9fc | out: lpFileSize=0x26ff9fc*=62976) returned 1 [0104.543] CloseHandle (hObject=0x198) returned 1 [0104.543] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi")) returned 0x20 [0104.544] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0104.544] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0104.544] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0104.544] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0104.544] lstrlenW (lpString=".doc") returned 4 [0104.544] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0104.544] lstrlenW (lpString=".docx") returned 5 [0104.544] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0104.544] lstrlenW (lpString=".pdf") returned 4 [0104.544] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0104.544] lstrlenW (lpString=".xls") returned 4 [0104.544] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0104.544] lstrlenW (lpString=".xlsx") returned 5 [0104.544] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0104.544] lstrlenW (lpString=".ppt") returned 4 [0104.544] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0104.544] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0104.544] lstrlenW (lpString=".zip") returned 4 [0104.544] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0104.544] lstrlenW (lpString=".rar") returned 4 [0104.544] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0104.544] lstrlenW (lpString=".bz2") returned 4 [0104.544] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0104.544] lstrlenW (lpString=".7z") returned 3 [0104.544] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0104.544] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0104.544] lstrlenW (lpString=".dbf") returned 4 [0104.544] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0104.545] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0 [0104.559] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruklm.dat"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruklm.dat.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0 [0104.559] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruksh.dat"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruksh.dat.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0 [0104.559] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0 [0104.559] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0 [0106.288] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0106.288] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0106.288] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmuiset.xml.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0106.289] GetLastError () returned 0x0 [0106.289] ReadFile (in: hFile=0x16c, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x333, lpOverlapped=0x0) returned 1 [0106.530] WriteFile (in: hFile=0x1c8, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0x340, lpOverlapped=0x0) returned 1 [0106.530] ReadFile (in: hFile=0x16c, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x0, lpOverlapped=0x0) returned 1 [0106.530] WriteFile (in: hFile=0x1c8, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0xf4, lpOverlapped=0x0) returned 1 [0106.530] SetEndOfFile (hFile=0x1c8) returned 1 [0106.531] CloseHandle (hObject=0x1c8) returned 1 [0106.531] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0106.531] SetEndOfFile (hFile=0x16c) returned 1 [0106.532] CloseHandle (hObject=0x16c) returned 1 [0106.532] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0106.532] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmuiset.xml")) returned 1 [0106.532] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0106.532] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0106.532] lstrlenW (lpString=".doc") returned 4 [0106.532] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0106.532] lstrlenW (lpString=".docx") returned 5 [0106.532] lstrcmpiW (lpString1=".docx", lpString2="t.XML") returned -1 [0106.532] lstrlenW (lpString=".pdf") returned 4 [0106.532] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0106.532] lstrlenW (lpString=".xls") returned 4 [0106.532] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0106.532] lstrlenW (lpString=".xlsx") returned 5 [0106.532] lstrcmpiW (lpString1=".xlsx", lpString2="t.XML") returned -1 [0106.532] lstrlenW (lpString=".ppt") returned 4 [0106.532] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0106.532] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0106.532] lstrlenW (lpString=".zip") returned 4 [0106.532] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0106.532] lstrlenW (lpString=".rar") returned 4 [0106.532] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0106.532] lstrlenW (lpString=".bz2") returned 4 [0106.532] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0106.532] lstrlenW (lpString=".7z") returned 3 [0106.532] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0106.533] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0106.533] lstrlenW (lpString=".dbf") returned 4 [0106.533] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0106.533] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0106.533] lstrlenW (lpString=".1cd") returned 4 [0106.533] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0106.533] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0106.533] lstrlenW (lpString=".jpg") returned 4 [0106.533] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0106.533] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0106.533] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0106.533] lstrlenW (lpString=".doc") returned 4 [0106.533] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0106.533] lstrlenW (lpString=".docx") returned 5 [0106.533] lstrcmpiW (lpString1=".docx", lpString2="t.XML") returned -1 [0106.533] lstrlenW (lpString=".pdf") returned 4 [0106.533] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0106.533] lstrlenW (lpString=".xls") returned 4 [0106.533] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0106.533] lstrlenW (lpString=".xlsx") returned 5 [0106.533] lstrcmpiW (lpString1=".xlsx", lpString2="t.XML") returned -1 [0106.533] lstrlenW (lpString=".ppt") returned 4 [0106.533] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0106.533] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0106.533] lstrlenW (lpString=".zip") returned 4 [0106.533] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0106.533] lstrlenW (lpString=".rar") returned 4 [0106.533] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0106.533] lstrlenW (lpString=".bz2") returned 4 [0106.533] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0106.533] lstrlenW (lpString=".7z") returned 3 [0106.533] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0106.533] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0106.533] lstrlenW (lpString=".dbf") returned 4 [0106.533] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0106.533] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0106.533] lstrlenW (lpString=".1cd") returned 4 [0106.533] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0106.533] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0106.533] lstrlenW (lpString=".jpg") returned 4 [0106.533] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0106.533] lstrcmpiW (lpString1=".XML", lpString2=".waifu") returned 1 [0106.533] lstrlenW (lpString="SETUP.XML") returned 9 [0106.533] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0107.668] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x26ff9fc | out: lpFileSize=0x26ff9fc*=5884) returned 1 [0107.668] CloseHandle (hObject=0x1dc) returned 1 [0107.668] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\setup.xml")) returned 0x20 [0107.669] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\setup.xml.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0107.669] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0107.669] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0107.669] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0107.669] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\setup.xml.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0107.806] GetLastError () returned 0x0 [0107.806] ReadFile (in: hFile=0x1dc, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x16fc, lpOverlapped=0x0) returned 1 [0107.878] WriteFile (in: hFile=0x1cc, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x1700, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0x1700, lpOverlapped=0x0) returned 1 [0107.879] ReadFile (in: hFile=0x1dc, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x0, lpOverlapped=0x0) returned 1 [0107.879] WriteFile (in: hFile=0x1cc, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0xe6, lpOverlapped=0x0) returned 1 [0107.879] SetEndOfFile (hFile=0x1cc) returned 1 [0107.879] CloseHandle (hObject=0x1cc) returned 1 [0107.879] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0107.879] SetEndOfFile (hFile=0x1dc) returned 1 [0107.880] CloseHandle (hObject=0x1dc) returned 1 [0107.880] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0107.880] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\setup.xml")) returned 1 [0107.880] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104 [0107.880] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104 [0107.880] lstrlenW (lpString=".doc") returned 4 [0107.880] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0107.881] lstrlenW (lpString=".docx") returned 5 [0107.881] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0107.881] lstrlenW (lpString=".pdf") returned 4 [0107.881] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0107.881] lstrlenW (lpString=".xls") returned 4 [0107.881] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0107.881] lstrlenW (lpString=".xlsx") returned 5 [0107.881] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0107.881] lstrlenW (lpString=".ppt") returned 4 [0107.881] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0107.881] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104 [0107.881] lstrlenW (lpString=".zip") returned 4 [0107.881] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0107.881] lstrlenW (lpString=".rar") returned 4 [0107.881] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0107.881] lstrlenW (lpString=".bz2") returned 4 [0107.881] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0107.881] lstrlenW (lpString=".7z") returned 3 [0107.881] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0107.881] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104 [0107.881] lstrlenW (lpString=".dbf") returned 4 [0107.881] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0107.881] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104 [0107.881] lstrlenW (lpString=".1cd") returned 4 [0107.881] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0107.881] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104 [0107.881] lstrlenW (lpString=".jpg") returned 4 [0107.881] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0107.881] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104 [0107.881] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104 [0107.881] lstrlenW (lpString=".doc") returned 4 [0107.881] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0107.881] lstrlenW (lpString=".docx") returned 5 [0107.881] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0107.881] lstrlenW (lpString=".pdf") returned 4 [0107.881] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0107.881] lstrlenW (lpString=".xls") returned 4 [0107.881] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0107.881] lstrlenW (lpString=".xlsx") returned 5 [0107.881] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0107.881] lstrlenW (lpString=".ppt") returned 4 [0107.881] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0107.881] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104 [0107.881] lstrlenW (lpString=".zip") returned 4 [0107.881] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0107.881] lstrlenW (lpString=".rar") returned 4 [0107.881] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0107.881] lstrlenW (lpString=".bz2") returned 4 [0107.881] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0107.881] lstrlenW (lpString=".7z") returned 3 [0107.881] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0107.882] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104 [0107.882] lstrlenW (lpString=".dbf") returned 4 [0107.882] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0107.882] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104 [0107.882] lstrlenW (lpString=".1cd") returned 4 [0107.882] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0107.882] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104 [0107.882] lstrlenW (lpString=".jpg") returned 4 [0107.882] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0107.882] lstrcmpiW (lpString1=".XML", lpString2=".waifu") returned 1 [0107.882] lstrlenW (lpString="SETUP.XML") returned 9 [0107.882] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0107.889] GetFileSizeEx (in: hFile=0x1cc, lpFileSize=0x26ff9fc | out: lpFileSize=0x26ff9fc*=20577) returned 1 [0107.889] CloseHandle (hObject=0x1cc) returned 1 [0107.889] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\setup.xml")) returned 0x20 [0107.889] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\setup.xml.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0107.889] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0107.889] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0107.889] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0107.889] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\setup.xml.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0107.889] GetLastError () returned 0x0 [0107.889] ReadFile (in: hFile=0x1cc, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x5061, lpOverlapped=0x0) returned 1 [0107.896] WriteFile (in: hFile=0x1d0, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x5070, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0x5070, lpOverlapped=0x0) returned 1 [0107.897] ReadFile (in: hFile=0x1cc, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x0, lpOverlapped=0x0) returned 1 [0107.897] WriteFile (in: hFile=0x1d0, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0xe6, lpOverlapped=0x0) returned 1 [0107.897] SetEndOfFile (hFile=0x1d0) returned 1 [0108.142] CloseHandle (hObject=0x1d0) returned 1 [0108.281] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0108.281] SetEndOfFile (hFile=0x1cc) returned 1 [0108.454] CloseHandle (hObject=0x1cc) returned 1 [0108.454] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0108.454] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\setup.xml")) returned 1 [0108.455] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96 [0108.455] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96 [0108.455] lstrlenW (lpString=".doc") returned 4 [0108.455] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0108.455] lstrlenW (lpString=".docx") returned 5 [0108.455] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0108.455] lstrlenW (lpString=".pdf") returned 4 [0108.455] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0108.455] lstrlenW (lpString=".xls") returned 4 [0108.455] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0108.455] lstrlenW (lpString=".xlsx") returned 5 [0108.455] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0108.455] lstrlenW (lpString=".ppt") returned 4 [0108.455] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0108.455] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96 [0108.455] lstrlenW (lpString=".zip") returned 4 [0108.455] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0108.455] lstrlenW (lpString=".rar") returned 4 [0108.455] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0108.455] lstrlenW (lpString=".bz2") returned 4 [0108.455] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0108.455] lstrlenW (lpString=".7z") returned 3 [0108.455] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0108.455] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96 [0108.455] lstrlenW (lpString=".dbf") returned 4 [0108.455] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0108.455] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96 [0108.455] lstrlenW (lpString=".1cd") returned 4 [0108.455] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0108.455] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96 [0108.455] lstrlenW (lpString=".jpg") returned 4 [0108.455] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0108.455] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96 [0108.455] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96 [0108.455] lstrlenW (lpString=".doc") returned 4 [0108.455] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0108.455] lstrlenW (lpString=".docx") returned 5 [0108.455] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0108.455] lstrlenW (lpString=".pdf") returned 4 [0108.455] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0108.456] lstrlenW (lpString=".xls") returned 4 [0108.456] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0108.456] lstrlenW (lpString=".xlsx") returned 5 [0108.456] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0108.456] lstrlenW (lpString=".ppt") returned 4 [0108.456] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0108.456] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96 [0108.456] lstrlenW (lpString=".zip") returned 4 [0108.456] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0108.456] lstrlenW (lpString=".rar") returned 4 [0108.456] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0108.456] lstrlenW (lpString=".bz2") returned 4 [0108.456] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0108.456] lstrlenW (lpString=".7z") returned 3 [0108.456] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0108.456] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96 [0108.456] lstrlenW (lpString=".dbf") returned 4 [0108.456] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0108.456] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96 [0108.456] lstrlenW (lpString=".1cd") returned 4 [0108.456] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0108.456] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96 [0108.456] lstrlenW (lpString=".jpg") returned 4 [0108.456] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0108.456] lstrcmpiW (lpString1=".htm", lpString2=".waifu") returned -1 [0108.456] lstrlenW (lpString="Bears.htm") returned 9 [0108.456] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0110.321] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x26ff9fc | out: lpFileSize=0x26ff9fc*=255) returned 1 [0110.321] CloseHandle (hObject=0x1d0) returned 1 [0110.321] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.htm")) returned 0x20 [0110.321] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.htm.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0110.321] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0110.322] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0110.322] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0110.322] lstrlenW (lpString=".doc") returned 4 [0110.322] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0110.322] lstrlenW (lpString=".docx") returned 5 [0110.322] lstrcmpiW (lpString1=".docx", lpString2="s.htm") returned -1 [0110.322] lstrlenW (lpString=".pdf") returned 4 [0110.322] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0110.322] lstrlenW (lpString=".xls") returned 4 [0110.322] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0110.322] lstrlenW (lpString=".xlsx") returned 5 [0110.322] lstrcmpiW (lpString1=".xlsx", lpString2="s.htm") returned -1 [0110.322] lstrlenW (lpString=".ppt") returned 4 [0110.322] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0110.322] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0110.322] lstrlenW (lpString=".zip") returned 4 [0110.322] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0110.322] lstrlenW (lpString=".rar") returned 4 [0110.322] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0110.322] lstrlenW (lpString=".bz2") returned 4 [0110.322] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0110.322] lstrlenW (lpString=".7z") returned 3 [0110.322] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0110.322] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0110.322] lstrlenW (lpString=".dbf") returned 4 [0110.322] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0110.322] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0110.322] lstrlenW (lpString=".1cd") returned 4 [0110.322] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1 [0110.322] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0110.322] lstrlenW (lpString=".jpg") returned 4 [0110.322] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1 [0110.323] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0110.323] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0110.323] lstrlenW (lpString=".doc") returned 4 [0110.323] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0110.323] lstrlenW (lpString=".docx") returned 5 [0110.323] lstrcmpiW (lpString1=".docx", lpString2="s.htm") returned -1 [0110.323] lstrlenW (lpString=".pdf") returned 4 [0110.323] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0110.323] lstrlenW (lpString=".xls") returned 4 [0110.323] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0110.323] lstrlenW (lpString=".xlsx") returned 5 [0110.323] lstrcmpiW (lpString1=".xlsx", lpString2="s.htm") returned -1 [0110.323] lstrlenW (lpString=".ppt") returned 4 [0110.323] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0110.323] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0110.323] lstrlenW (lpString=".zip") returned 4 [0110.323] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0110.323] lstrlenW (lpString=".rar") returned 4 [0110.323] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0110.323] lstrlenW (lpString=".bz2") returned 4 [0110.323] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0110.323] lstrlenW (lpString=".7z") returned 3 [0110.323] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0110.323] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0110.323] lstrlenW (lpString=".dbf") returned 4 [0110.323] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0110.323] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0110.323] lstrlenW (lpString=".1cd") returned 4 [0110.323] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1 [0110.323] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0110.323] lstrlenW (lpString=".jpg") returned 4 [0110.323] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1 [0110.323] lstrcmpiW (lpString1=".jpg", lpString2=".waifu") returned -1 [0110.324] lstrlenW (lpString="Bears.jpg") returned 9 [0110.324] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0110.332] GetFileSizeEx (in: hFile=0x1bc, lpFileSize=0x26ff9fc | out: lpFileSize=0x26ff9fc*=1074) returned 1 [0110.332] CloseHandle (hObject=0x1bc) returned 1 [0110.332] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.jpg")) returned 0x20 [0110.332] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.jpg.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0110.332] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0110.332] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0110.332] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0110.332] lstrlenW (lpString=".doc") returned 4 [0110.332] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0110.332] lstrlenW (lpString=".docx") returned 5 [0110.332] lstrcmpiW (lpString1=".docx", lpString2="s.jpg") returned -1 [0110.332] lstrlenW (lpString=".pdf") returned 4 [0110.332] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0110.332] lstrlenW (lpString=".xls") returned 4 [0110.332] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0110.332] lstrlenW (lpString=".xlsx") returned 5 [0110.332] lstrcmpiW (lpString1=".xlsx", lpString2="s.jpg") returned -1 [0110.333] lstrlenW (lpString=".ppt") returned 4 [0110.333] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0110.333] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0110.333] lstrlenW (lpString=".zip") returned 4 [0110.333] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0110.333] lstrlenW (lpString=".rar") returned 4 [0110.333] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0110.333] lstrlenW (lpString=".bz2") returned 4 [0110.333] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0110.333] lstrlenW (lpString=".7z") returned 3 [0110.333] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0110.333] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0110.333] lstrlenW (lpString=".dbf") returned 4 [0110.333] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0110.333] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0110.333] lstrlenW (lpString=".1cd") returned 4 [0110.333] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0110.333] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0110.333] lstrlenW (lpString=".jpg") returned 4 [0110.333] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0110.333] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0110.333] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0110.333] lstrlenW (lpString=".doc") returned 4 [0110.333] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0110.333] lstrlenW (lpString=".docx") returned 5 [0110.333] lstrcmpiW (lpString1=".docx", lpString2="s.jpg") returned -1 [0110.333] lstrlenW (lpString=".pdf") returned 4 [0110.333] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0110.333] lstrlenW (lpString=".xls") returned 4 [0110.333] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0110.333] lstrlenW (lpString=".xlsx") returned 5 [0110.333] lstrcmpiW (lpString1=".xlsx", lpString2="s.jpg") returned -1 [0110.333] lstrlenW (lpString=".ppt") returned 4 [0110.333] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0110.333] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0110.333] lstrlenW (lpString=".zip") returned 4 [0110.333] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0110.333] lstrlenW (lpString=".rar") returned 4 [0110.333] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0110.333] lstrlenW (lpString=".bz2") returned 4 [0110.333] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0110.333] lstrlenW (lpString=".7z") returned 3 [0110.333] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0110.333] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0110.333] lstrlenW (lpString=".dbf") returned 4 [0110.333] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0110.333] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0110.333] lstrlenW (lpString=".1cd") returned 4 [0110.333] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0110.333] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0110.334] lstrlenW (lpString=".jpg") returned 4 [0110.334] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0110.334] lstrcmpiW (lpString1=".gif", lpString2=".waifu") returned -1 [0110.334] lstrlenW (lpString="Cave_Drawings.gif") returned 17 [0110.334] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\cave_drawings.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0110.334] GetFileSizeEx (in: hFile=0x1bc, lpFileSize=0x26ff9fc | out: lpFileSize=0x26ff9fc*=4587) returned 1 [0110.334] CloseHandle (hObject=0x1bc) returned 1 [0110.334] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\cave_drawings.gif")) returned 0x20 [0110.334] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\cave_drawings.gif.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0110.334] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\cave_drawings.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0110.334] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0110.334] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0110.334] lstrlenW (lpString=".doc") returned 4 [0110.334] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0110.334] lstrlenW (lpString=".docx") returned 5 [0110.334] lstrcmpiW (lpString1=".docx", lpString2="s.gif") returned -1 [0110.334] lstrlenW (lpString=".pdf") returned 4 [0110.334] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0110.334] lstrlenW (lpString=".xls") returned 4 [0110.334] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0110.334] lstrlenW (lpString=".xlsx") returned 5 [0110.334] lstrcmpiW (lpString1=".xlsx", lpString2="s.gif") returned -1 [0110.334] lstrlenW (lpString=".ppt") returned 4 [0110.334] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0110.334] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0110.334] lstrlenW (lpString=".zip") returned 4 [0110.334] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0110.334] lstrlenW (lpString=".rar") returned 4 [0110.334] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0110.335] lstrlenW (lpString=".bz2") returned 4 [0110.335] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0110.335] lstrlenW (lpString=".7z") returned 3 [0110.335] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0110.335] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0110.335] lstrlenW (lpString=".dbf") returned 4 [0110.335] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0110.335] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0110.335] lstrlenW (lpString=".1cd") returned 4 [0110.335] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0110.335] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0110.335] lstrlenW (lpString=".jpg") returned 4 [0110.335] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0110.335] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0110.335] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0110.335] lstrlenW (lpString=".doc") returned 4 [0110.335] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0110.335] lstrlenW (lpString=".docx") returned 5 [0110.335] lstrcmpiW (lpString1=".docx", lpString2="s.gif") returned -1 [0110.335] lstrlenW (lpString=".pdf") returned 4 [0110.335] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0110.335] lstrlenW (lpString=".xls") returned 4 [0110.335] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0110.335] lstrlenW (lpString=".xlsx") returned 5 [0110.335] lstrcmpiW (lpString1=".xlsx", lpString2="s.gif") returned -1 [0110.335] lstrlenW (lpString=".ppt") returned 4 [0110.335] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0110.335] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0110.335] lstrlenW (lpString=".zip") returned 4 [0110.335] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0110.335] lstrlenW (lpString=".rar") returned 4 [0110.335] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0110.335] lstrlenW (lpString=".bz2") returned 4 [0110.335] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0110.335] lstrlenW (lpString=".7z") returned 3 [0110.335] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0110.335] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0110.335] lstrlenW (lpString=".dbf") returned 4 [0110.335] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0110.335] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0110.335] lstrlenW (lpString=".1cd") returned 4 [0110.335] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0110.335] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0110.335] lstrlenW (lpString=".jpg") returned 4 [0110.335] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0110.335] lstrcmpiW (lpString1=".gif", lpString2=".waifu") returned -1 [0110.336] lstrlenW (lpString="Connectivity.gif") returned 16 [0110.336] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\connectivity.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0110.336] GetFileSizeEx (in: hFile=0x1bc, lpFileSize=0x26ff9fc | out: lpFileSize=0x26ff9fc*=2319) returned 1 [0110.336] CloseHandle (hObject=0x1bc) returned 1 [0110.336] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\connectivity.gif")) returned 0x20 [0110.336] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\connectivity.gif.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0110.336] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\connectivity.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0110.336] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0110.336] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0110.336] lstrlenW (lpString=".doc") returned 4 [0110.336] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0110.336] lstrlenW (lpString=".docx") returned 5 [0110.336] lstrcmpiW (lpString1=".docx", lpString2="y.gif") returned -1 [0110.336] lstrlenW (lpString=".pdf") returned 4 [0110.336] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0110.336] lstrlenW (lpString=".xls") returned 4 [0110.336] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0110.336] lstrlenW (lpString=".xlsx") returned 5 [0110.336] lstrcmpiW (lpString1=".xlsx", lpString2="y.gif") returned -1 [0110.336] lstrlenW (lpString=".ppt") returned 4 [0110.336] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0110.336] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0110.336] lstrlenW (lpString=".zip") returned 4 [0110.336] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0110.336] lstrlenW (lpString=".rar") returned 4 [0110.336] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0110.336] lstrlenW (lpString=".bz2") returned 4 [0110.336] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0110.336] lstrlenW (lpString=".7z") returned 3 [0110.336] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0110.336] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0110.336] lstrlenW (lpString=".dbf") returned 4 [0110.336] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0110.336] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0110.336] lstrlenW (lpString=".1cd") returned 4 [0110.337] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0110.337] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0110.337] lstrlenW (lpString=".jpg") returned 4 [0110.337] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0110.337] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0110.337] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0110.337] lstrlenW (lpString=".doc") returned 4 [0110.337] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0110.337] lstrlenW (lpString=".docx") returned 5 [0110.337] lstrcmpiW (lpString1=".docx", lpString2="y.gif") returned -1 [0110.337] lstrlenW (lpString=".pdf") returned 4 [0110.337] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0110.337] lstrlenW (lpString=".xls") returned 4 [0110.337] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0110.337] lstrlenW (lpString=".xlsx") returned 5 [0110.337] lstrcmpiW (lpString1=".xlsx", lpString2="y.gif") returned -1 [0110.337] lstrlenW (lpString=".ppt") returned 4 [0110.337] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0110.337] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0110.337] lstrlenW (lpString=".zip") returned 4 [0110.337] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0110.337] lstrlenW (lpString=".rar") returned 4 [0110.337] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0110.337] lstrlenW (lpString=".bz2") returned 4 [0110.337] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0110.337] lstrlenW (lpString=".7z") returned 3 [0110.337] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0110.337] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0110.337] lstrlenW (lpString=".dbf") returned 4 [0110.337] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0110.337] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0110.337] lstrlenW (lpString=".1cd") returned 4 [0110.337] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0110.337] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0110.337] lstrlenW (lpString=".jpg") returned 4 [0110.337] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0110.337] lstrcmpiW (lpString1=".ini", lpString2=".waifu") returned -1 [0110.337] lstrlenW (lpString="Desktop.ini") returned 11 [0110.337] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0110.338] GetFileSizeEx (in: hFile=0x1bc, lpFileSize=0x26ff9fc | out: lpFileSize=0x26ff9fc*=645) returned 1 [0110.338] CloseHandle (hObject=0x1bc) returned 1 [0110.338] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini")) returned 0x26 [0110.338] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0110.338] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0110.338] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0110.338] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0110.338] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0110.338] GetLastError () returned 0x0 [0110.338] ReadFile (in: hFile=0x1bc, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x285, lpOverlapped=0x0) returned 1 [0110.340] WriteFile (in: hFile=0x1d0, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0x290, lpOverlapped=0x0) returned 1 [0110.341] ReadFile (in: hFile=0x1bc, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x0, lpOverlapped=0x0) returned 1 [0110.341] WriteFile (in: hFile=0x1d0, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0xea, lpOverlapped=0x0) returned 1 [0110.341] SetEndOfFile (hFile=0x1d0) returned 1 [0110.341] CloseHandle (hObject=0x1d0) returned 1 [0110.341] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0110.341] SetEndOfFile (hFile=0x1bc) returned 1 [0110.342] CloseHandle (hObject=0x1bc) returned 1 [0110.342] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x26) returned 1 [0110.342] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini")) returned 1 [0110.342] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0110.342] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0110.342] lstrlenW (lpString=".doc") returned 4 [0110.342] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0110.342] lstrlenW (lpString=".docx") returned 5 [0110.342] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0110.342] lstrlenW (lpString=".pdf") returned 4 [0110.342] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0110.342] lstrlenW (lpString=".xls") returned 4 [0110.342] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0110.342] lstrlenW (lpString=".xlsx") returned 5 [0110.343] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0110.343] lstrlenW (lpString=".ppt") returned 4 [0110.343] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0110.343] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0110.343] lstrlenW (lpString=".zip") returned 4 [0110.343] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0110.343] lstrlenW (lpString=".rar") returned 4 [0110.343] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0110.343] lstrlenW (lpString=".bz2") returned 4 [0110.343] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0110.343] lstrlenW (lpString=".7z") returned 3 [0110.343] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0110.343] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0110.343] lstrlenW (lpString=".dbf") returned 4 [0110.343] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0110.343] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0110.343] lstrlenW (lpString=".1cd") returned 4 [0110.343] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0110.343] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0110.343] lstrlenW (lpString=".jpg") returned 4 [0110.343] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0110.343] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0110.343] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0110.343] lstrlenW (lpString=".doc") returned 4 [0110.343] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0110.343] lstrlenW (lpString=".docx") returned 5 [0110.343] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0110.343] lstrlenW (lpString=".pdf") returned 4 [0110.343] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0110.343] lstrlenW (lpString=".xls") returned 4 [0110.343] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0110.343] lstrlenW (lpString=".xlsx") returned 5 [0110.343] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0110.343] lstrlenW (lpString=".ppt") returned 4 [0110.343] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0110.343] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0110.343] lstrlenW (lpString=".zip") returned 4 [0110.343] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0110.343] lstrlenW (lpString=".rar") returned 4 [0110.343] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0110.343] lstrlenW (lpString=".bz2") returned 4 [0110.343] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0110.343] lstrlenW (lpString=".7z") returned 3 [0110.343] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0110.343] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0110.343] lstrlenW (lpString=".dbf") returned 4 [0110.343] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0110.343] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0110.343] lstrlenW (lpString=".1cd") returned 4 [0110.343] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0110.343] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0110.344] lstrlenW (lpString=".jpg") returned 4 [0110.344] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0110.344] lstrcmpiW (lpString1=".emf", lpString2=".waifu") returned -1 [0110.344] lstrlenW (lpString="Dotted_Lines.emf") returned 16 [0110.344] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\dotted_lines.emf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0110.344] GetFileSizeEx (in: hFile=0x1bc, lpFileSize=0x26ff9fc | out: lpFileSize=0x26ff9fc*=3792) returned 1 [0110.344] CloseHandle (hObject=0x1bc) returned 1 [0110.345] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\dotted_lines.emf")) returned 0x20 [0110.345] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\dotted_lines.emf.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0110.345] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\dotted_lines.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0110.345] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0110.345] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0110.345] lstrlenW (lpString=".doc") returned 4 [0110.345] lstrcmpiW (lpString1=".doc", lpString2=".emf") returned -1 [0110.345] lstrlenW (lpString=".docx") returned 5 [0110.345] lstrcmpiW (lpString1=".docx", lpString2="s.emf") returned -1 [0110.345] lstrlenW (lpString=".pdf") returned 4 [0110.345] lstrcmpiW (lpString1=".pdf", lpString2=".emf") returned 1 [0110.345] lstrlenW (lpString=".xls") returned 4 [0110.345] lstrcmpiW (lpString1=".xls", lpString2=".emf") returned 1 [0110.345] lstrlenW (lpString=".xlsx") returned 5 [0110.345] lstrcmpiW (lpString1=".xlsx", lpString2="s.emf") returned -1 [0110.345] lstrlenW (lpString=".ppt") returned 4 [0110.345] lstrcmpiW (lpString1=".ppt", lpString2=".emf") returned 1 [0110.345] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0110.345] lstrlenW (lpString=".zip") returned 4 [0110.345] lstrcmpiW (lpString1=".zip", lpString2=".emf") returned 1 [0110.345] lstrlenW (lpString=".rar") returned 4 [0110.345] lstrcmpiW (lpString1=".rar", lpString2=".emf") returned 1 [0110.345] lstrlenW (lpString=".bz2") returned 4 [0110.345] lstrcmpiW (lpString1=".bz2", lpString2=".emf") returned -1 [0110.345] lstrlenW (lpString=".7z") returned 3 [0110.345] lstrcmpiW (lpString1=".7z", lpString2="emf") returned -1 [0110.345] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0110.345] lstrlenW (lpString=".dbf") returned 4 [0110.345] lstrcmpiW (lpString1=".dbf", lpString2=".emf") returned -1 [0110.345] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0110.345] lstrlenW (lpString=".1cd") returned 4 [0110.345] lstrcmpiW (lpString1=".1cd", lpString2=".emf") returned -1 [0110.345] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0110.345] lstrlenW (lpString=".jpg") returned 4 [0110.345] lstrcmpiW (lpString1=".jpg", lpString2=".emf") returned 1 [0110.345] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0110.345] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0110.345] lstrlenW (lpString=".doc") returned 4 [0110.345] lstrcmpiW (lpString1=".doc", lpString2=".emf") returned -1 [0110.345] lstrlenW (lpString=".docx") returned 5 [0110.345] lstrcmpiW (lpString1=".docx", lpString2="s.emf") returned -1 [0110.345] lstrlenW (lpString=".pdf") returned 4 [0110.346] lstrcmpiW (lpString1=".pdf", lpString2=".emf") returned 1 [0110.346] lstrlenW (lpString=".xls") returned 4 [0110.346] lstrcmpiW (lpString1=".xls", lpString2=".emf") returned 1 [0110.346] lstrlenW (lpString=".xlsx") returned 5 [0110.346] lstrcmpiW (lpString1=".xlsx", lpString2="s.emf") returned -1 [0110.346] lstrlenW (lpString=".ppt") returned 4 [0110.346] lstrcmpiW (lpString1=".ppt", lpString2=".emf") returned 1 [0110.346] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0110.346] lstrlenW (lpString=".zip") returned 4 [0110.346] lstrcmpiW (lpString1=".zip", lpString2=".emf") returned 1 [0110.346] lstrlenW (lpString=".rar") returned 4 [0110.346] lstrcmpiW (lpString1=".rar", lpString2=".emf") returned 1 [0110.346] lstrlenW (lpString=".bz2") returned 4 [0110.346] lstrcmpiW (lpString1=".bz2", lpString2=".emf") returned -1 [0110.346] lstrlenW (lpString=".7z") returned 3 [0110.346] lstrcmpiW (lpString1=".7z", lpString2="emf") returned -1 [0110.346] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0110.346] lstrlenW (lpString=".dbf") returned 4 [0110.346] lstrcmpiW (lpString1=".dbf", lpString2=".emf") returned -1 [0110.346] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0110.346] lstrlenW (lpString=".1cd") returned 4 [0110.346] lstrcmpiW (lpString1=".1cd", lpString2=".emf") returned -1 [0110.346] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0110.346] lstrlenW (lpString=".jpg") returned 4 [0110.346] lstrcmpiW (lpString1=".jpg", lpString2=".emf") returned 1 [0110.346] lstrcmpiW (lpString1=".htm", lpString2=".waifu") returned -1 [0110.346] lstrlenW (lpString="Garden.htm") returned 10 [0110.346] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0110.346] GetFileSizeEx (in: hFile=0x1bc, lpFileSize=0x26ff9fc | out: lpFileSize=0x26ff9fc*=231) returned 1 [0110.346] CloseHandle (hObject=0x1bc) returned 1 [0110.346] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.htm")) returned 0x20 [0110.346] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.htm.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0110.346] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0110.347] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0110.347] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0110.347] lstrlenW (lpString=".doc") returned 4 [0110.347] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0110.347] lstrlenW (lpString=".docx") returned 5 [0110.347] lstrcmpiW (lpString1=".docx", lpString2="n.htm") returned -1 [0110.347] lstrlenW (lpString=".pdf") returned 4 [0110.347] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0110.347] lstrlenW (lpString=".xls") returned 4 [0110.347] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0110.347] lstrlenW (lpString=".xlsx") returned 5 [0110.347] lstrcmpiW (lpString1=".xlsx", lpString2="n.htm") returned -1 [0110.347] lstrlenW (lpString=".ppt") returned 4 [0110.347] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0110.347] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0110.347] lstrlenW (lpString=".zip") returned 4 [0110.347] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0110.347] lstrlenW (lpString=".rar") returned 4 [0110.347] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0110.347] lstrlenW (lpString=".bz2") returned 4 [0110.347] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0110.347] lstrlenW (lpString=".7z") returned 3 [0110.347] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0110.347] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0110.347] lstrlenW (lpString=".dbf") returned 4 [0110.347] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0110.347] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0110.347] lstrlenW (lpString=".1cd") returned 4 [0110.347] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1 [0110.347] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0110.347] lstrlenW (lpString=".jpg") returned 4 [0110.347] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1 [0110.347] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0110.347] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0110.347] lstrlenW (lpString=".doc") returned 4 [0110.347] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0110.347] lstrlenW (lpString=".docx") returned 5 [0110.347] lstrcmpiW (lpString1=".docx", lpString2="n.htm") returned -1 [0110.347] lstrlenW (lpString=".pdf") returned 4 [0110.347] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0110.347] lstrlenW (lpString=".xls") returned 4 [0110.347] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0110.347] lstrlenW (lpString=".xlsx") returned 5 [0110.347] lstrcmpiW (lpString1=".xlsx", lpString2="n.htm") returned -1 [0110.347] lstrlenW (lpString=".ppt") returned 4 [0110.347] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0110.347] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0110.347] lstrlenW (lpString=".zip") returned 4 [0110.348] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0110.348] lstrlenW (lpString=".rar") returned 4 [0110.348] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0110.348] lstrlenW (lpString=".bz2") returned 4 [0110.348] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0110.348] lstrlenW (lpString=".7z") returned 3 [0110.348] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0110.348] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0110.348] lstrlenW (lpString=".dbf") returned 4 [0110.348] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0110.348] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0110.348] lstrlenW (lpString=".1cd") returned 4 [0110.348] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1 [0110.348] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0110.348] lstrlenW (lpString=".jpg") returned 4 [0110.348] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1 [0110.348] lstrcmpiW (lpString1=".jpg", lpString2=".waifu") returned -1 [0110.348] lstrlenW (lpString="Garden.jpg") returned 10 [0110.348] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0110.348] GetFileSizeEx (in: hFile=0x1bc, lpFileSize=0x26ff9fc | out: lpFileSize=0x26ff9fc*=23871) returned 1 [0110.348] CloseHandle (hObject=0x1bc) returned 1 [0110.348] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.jpg")) returned 0x20 [0110.348] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.jpg.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0110.348] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0110.348] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0110.348] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0110.348] lstrlenW (lpString=".doc") returned 4 [0110.348] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0110.348] lstrlenW (lpString=".docx") returned 5 [0110.348] lstrcmpiW (lpString1=".docx", lpString2="n.jpg") returned -1 [0110.349] lstrlenW (lpString=".pdf") returned 4 [0110.349] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0110.349] lstrlenW (lpString=".xls") returned 4 [0110.349] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0110.349] lstrlenW (lpString=".xlsx") returned 5 [0110.349] lstrcmpiW (lpString1=".xlsx", lpString2="n.jpg") returned -1 [0110.349] lstrlenW (lpString=".ppt") returned 4 [0110.349] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0110.349] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0110.349] lstrlenW (lpString=".zip") returned 4 [0110.349] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0110.349] lstrlenW (lpString=".rar") returned 4 [0110.349] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0110.349] lstrlenW (lpString=".bz2") returned 4 [0110.349] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0110.349] lstrlenW (lpString=".7z") returned 3 [0110.349] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0110.349] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0110.349] lstrlenW (lpString=".dbf") returned 4 [0110.349] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0110.349] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0110.349] lstrlenW (lpString=".1cd") returned 4 [0110.349] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0110.349] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0110.349] lstrlenW (lpString=".jpg") returned 4 [0110.349] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0110.349] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0110.349] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0110.349] lstrlenW (lpString=".doc") returned 4 [0110.349] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0110.349] lstrlenW (lpString=".docx") returned 5 [0110.349] lstrcmpiW (lpString1=".docx", lpString2="n.jpg") returned -1 [0110.349] lstrlenW (lpString=".pdf") returned 4 [0110.349] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0110.349] lstrlenW (lpString=".xls") returned 4 [0110.349] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0110.349] lstrlenW (lpString=".xlsx") returned 5 [0110.349] lstrcmpiW (lpString1=".xlsx", lpString2="n.jpg") returned -1 [0110.349] lstrlenW (lpString=".ppt") returned 4 [0110.349] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0110.349] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0110.349] lstrlenW (lpString=".zip") returned 4 [0110.349] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0110.349] lstrlenW (lpString=".rar") returned 4 [0110.349] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0110.349] lstrlenW (lpString=".bz2") returned 4 [0110.349] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0110.349] lstrlenW (lpString=".7z") returned 3 [0110.350] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0110.350] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0110.350] lstrlenW (lpString=".dbf") returned 4 [0110.350] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0110.350] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0110.350] lstrlenW (lpString=".1cd") returned 4 [0110.350] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0110.350] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0110.350] lstrlenW (lpString=".jpg") returned 4 [0110.350] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0110.350] lstrcmpiW (lpString1=".emf", lpString2=".waifu") returned -1 [0110.350] lstrlenW (lpString="Genko_1.emf") returned 11 [0110.350] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_1.emf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0111.551] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x26ff9fc | out: lpFileSize=0x26ff9fc*=5524) returned 1 [0111.551] CloseHandle (hObject=0x1a0) returned 1 [0111.551] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_1.emf")) returned 0x20 [0111.551] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_1.emf.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0111.551] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_1.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0111.551] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0111.551] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0111.551] lstrlenW (lpString=".doc") returned 4 [0111.552] lstrcmpiW (lpString1=".doc", lpString2=".emf") returned -1 [0111.552] lstrlenW (lpString=".docx") returned 5 [0111.552] lstrcmpiW (lpString1=".docx", lpString2="1.emf") returned -1 [0111.552] lstrlenW (lpString=".pdf") returned 4 [0111.552] lstrcmpiW (lpString1=".pdf", lpString2=".emf") returned 1 [0111.552] lstrlenW (lpString=".xls") returned 4 [0111.552] lstrcmpiW (lpString1=".xls", lpString2=".emf") returned 1 [0111.552] lstrlenW (lpString=".xlsx") returned 5 [0111.552] lstrcmpiW (lpString1=".xlsx", lpString2="1.emf") returned -1 [0111.552] lstrlenW (lpString=".ppt") returned 4 [0111.552] lstrcmpiW (lpString1=".ppt", lpString2=".emf") returned 1 [0111.552] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0111.552] lstrlenW (lpString=".zip") returned 4 [0111.552] lstrcmpiW (lpString1=".zip", lpString2=".emf") returned 1 [0111.552] lstrlenW (lpString=".rar") returned 4 [0111.552] lstrcmpiW (lpString1=".rar", lpString2=".emf") returned 1 [0111.552] lstrlenW (lpString=".bz2") returned 4 [0111.552] lstrcmpiW (lpString1=".bz2", lpString2=".emf") returned -1 [0111.552] lstrlenW (lpString=".7z") returned 3 [0111.552] lstrcmpiW (lpString1=".7z", lpString2="emf") returned -1 [0111.552] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0111.552] lstrlenW (lpString=".dbf") returned 4 [0111.552] lstrcmpiW (lpString1=".dbf", lpString2=".emf") returned -1 [0111.552] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0111.552] lstrlenW (lpString=".1cd") returned 4 [0111.552] lstrcmpiW (lpString1=".1cd", lpString2=".emf") returned -1 [0111.552] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0111.552] lstrlenW (lpString=".jpg") returned 4 [0111.552] lstrcmpiW (lpString1=".jpg", lpString2=".emf") returned 1 [0111.552] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0111.552] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0111.552] lstrlenW (lpString=".doc") returned 4 [0111.552] lstrcmpiW (lpString1=".doc", lpString2=".emf") returned -1 [0111.552] lstrlenW (lpString=".docx") returned 5 [0111.552] lstrcmpiW (lpString1=".docx", lpString2="1.emf") returned -1 [0111.552] lstrlenW (lpString=".pdf") returned 4 [0111.552] lstrcmpiW (lpString1=".pdf", lpString2=".emf") returned 1 [0111.552] lstrlenW (lpString=".xls") returned 4 [0111.552] lstrcmpiW (lpString1=".xls", lpString2=".emf") returned 1 [0111.552] lstrlenW (lpString=".xlsx") returned 5 [0111.552] lstrcmpiW (lpString1=".xlsx", lpString2="1.emf") returned -1 [0111.552] lstrlenW (lpString=".ppt") returned 4 [0111.552] lstrcmpiW (lpString1=".ppt", lpString2=".emf") returned 1 [0111.552] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0111.553] lstrlenW (lpString=".zip") returned 4 [0111.553] lstrcmpiW (lpString1=".zip", lpString2=".emf") returned 1 [0111.553] lstrlenW (lpString=".rar") returned 4 [0111.553] lstrcmpiW (lpString1=".rar", lpString2=".emf") returned 1 [0111.553] lstrlenW (lpString=".bz2") returned 4 [0111.553] lstrcmpiW (lpString1=".bz2", lpString2=".emf") returned -1 [0111.553] lstrlenW (lpString=".7z") returned 3 [0111.553] lstrcmpiW (lpString1=".7z", lpString2="emf") returned -1 [0111.553] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0111.553] lstrlenW (lpString=".dbf") returned 4 [0111.553] lstrcmpiW (lpString1=".dbf", lpString2=".emf") returned -1 [0111.553] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0111.553] lstrlenW (lpString=".1cd") returned 4 [0111.553] lstrcmpiW (lpString1=".1cd", lpString2=".emf") returned -1 [0111.553] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0111.553] lstrlenW (lpString=".jpg") returned 4 [0111.553] lstrcmpiW (lpString1=".jpg", lpString2=".emf") returned 1 [0111.553] lstrcmpiW (lpString1=".GIF", lpString2=".waifu") returned -1 [0111.553] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0111.553] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0111.723] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x26ff9fc | out: lpFileSize=0x26ff9fc*=2848) returned 1 [0111.723] CloseHandle (hObject=0x1d8) returned 1 [0111.723] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\preview.gif")) returned 0x20 [0111.723] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\preview.gif.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0111.723] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0111.723] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0111.723] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0111.723] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\preview.gif.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0111.725] GetLastError () returned 0x0 [0111.725] ReadFile (in: hFile=0x1d8, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0xb20, lpOverlapped=0x0) returned 1 [0111.726] WriteFile (in: hFile=0x180, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xb30, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0xb30, lpOverlapped=0x0) returned 1 [0111.726] ReadFile (in: hFile=0x1d8, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x0, lpOverlapped=0x0) returned 1 [0111.726] WriteFile (in: hFile=0x180, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0xea, lpOverlapped=0x0) returned 1 [0111.726] SetEndOfFile (hFile=0x180) returned 1 [0111.727] CloseHandle (hObject=0x180) returned 1 [0111.727] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0111.727] SetEndOfFile (hFile=0x1d8) returned 1 [0111.727] CloseHandle (hObject=0x1d8) returned 1 [0111.727] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0111.727] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\preview.gif")) returned 1 [0111.728] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72 [0111.728] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72 [0111.728] lstrlenW (lpString=".doc") returned 4 [0111.728] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0111.728] lstrlenW (lpString=".docx") returned 5 [0111.728] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0111.728] lstrlenW (lpString=".pdf") returned 4 [0111.728] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0111.728] lstrlenW (lpString=".xls") returned 4 [0111.728] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0111.728] lstrlenW (lpString=".xlsx") returned 5 [0111.728] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0111.728] lstrlenW (lpString=".ppt") returned 4 [0111.728] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0111.728] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72 [0111.728] lstrlenW (lpString=".zip") returned 4 [0111.728] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0111.728] lstrlenW (lpString=".rar") returned 4 [0111.728] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0111.728] lstrlenW (lpString=".bz2") returned 4 [0111.728] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0111.728] lstrlenW (lpString=".7z") returned 3 [0111.728] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0111.728] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72 [0111.728] lstrlenW (lpString=".dbf") returned 4 [0111.728] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0111.728] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72 [0111.728] lstrlenW (lpString=".1cd") returned 4 [0111.728] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0111.728] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72 [0111.728] lstrlenW (lpString=".jpg") returned 4 [0111.728] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0111.728] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72 [0111.728] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72 [0111.728] lstrlenW (lpString=".doc") returned 4 [0111.728] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0111.728] lstrlenW (lpString=".docx") returned 5 [0111.728] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0111.728] lstrlenW (lpString=".pdf") returned 4 [0111.729] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0111.729] lstrlenW (lpString=".xls") returned 4 [0111.729] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0111.729] lstrlenW (lpString=".xlsx") returned 5 [0111.729] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0111.729] lstrlenW (lpString=".ppt") returned 4 [0111.729] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0111.729] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72 [0111.729] lstrlenW (lpString=".zip") returned 4 [0111.729] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0111.729] lstrlenW (lpString=".rar") returned 4 [0111.729] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0111.729] lstrlenW (lpString=".bz2") returned 4 [0111.729] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0111.729] lstrlenW (lpString=".7z") returned 3 [0111.729] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0111.729] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72 [0111.729] lstrlenW (lpString=".dbf") returned 4 [0111.729] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0111.729] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72 [0111.729] lstrlenW (lpString=".1cd") returned 4 [0111.729] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0111.729] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72 [0111.729] lstrlenW (lpString=".jpg") returned 4 [0111.729] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0111.729] lstrcmpiW (lpString1=".GIF", lpString2=".waifu") returned -1 [0111.729] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0111.729] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0111.730] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x26ff9fc | out: lpFileSize=0x26ff9fc*=2181) returned 1 [0111.730] CloseHandle (hObject=0x1d8) returned 1 [0111.730] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\preview.gif")) returned 0x20 [0111.730] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\preview.gif.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0111.730] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0111.730] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0111.730] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0111.730] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\preview.gif.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0111.732] GetLastError () returned 0x0 [0111.732] ReadFile (in: hFile=0x1d8, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x885, lpOverlapped=0x0) returned 1 [0111.733] WriteFile (in: hFile=0x180, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x890, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0x890, lpOverlapped=0x0) returned 1 [0111.733] ReadFile (in: hFile=0x1d8, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x0, lpOverlapped=0x0) returned 1 [0111.733] WriteFile (in: hFile=0x180, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0xea, lpOverlapped=0x0) returned 1 [0111.733] SetEndOfFile (hFile=0x180) returned 1 [0111.734] CloseHandle (hObject=0x180) returned 1 [0111.734] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0111.734] SetEndOfFile (hFile=0x1d8) returned 1 [0111.734] CloseHandle (hObject=0x1d8) returned 1 [0111.734] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0111.734] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\preview.gif")) returned 1 [0111.735] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74 [0111.735] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74 [0111.735] lstrlenW (lpString=".doc") returned 4 [0111.735] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0111.735] lstrlenW (lpString=".docx") returned 5 [0111.735] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0111.735] lstrlenW (lpString=".pdf") returned 4 [0111.735] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0111.735] lstrlenW (lpString=".xls") returned 4 [0111.735] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0111.735] lstrlenW (lpString=".xlsx") returned 5 [0111.735] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0111.735] lstrlenW (lpString=".ppt") returned 4 [0111.735] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0111.735] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74 [0111.735] lstrlenW (lpString=".zip") returned 4 [0111.735] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0111.735] lstrlenW (lpString=".rar") returned 4 [0111.735] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0111.735] lstrlenW (lpString=".bz2") returned 4 [0111.735] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0111.735] lstrlenW (lpString=".7z") returned 3 [0111.735] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0111.735] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74 [0111.735] lstrlenW (lpString=".dbf") returned 4 [0111.735] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0111.735] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74 [0111.735] lstrlenW (lpString=".1cd") returned 4 [0111.735] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0111.735] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74 [0111.735] lstrlenW (lpString=".jpg") returned 4 [0111.735] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0111.735] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74 [0111.735] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74 [0111.735] lstrlenW (lpString=".doc") returned 4 [0111.735] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0111.735] lstrlenW (lpString=".docx") returned 5 [0111.735] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0111.735] lstrlenW (lpString=".pdf") returned 4 [0111.735] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0111.735] lstrlenW (lpString=".xls") returned 4 [0111.735] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0111.735] lstrlenW (lpString=".xlsx") returned 5 [0111.736] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0111.736] lstrlenW (lpString=".ppt") returned 4 [0111.736] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0111.736] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74 [0111.736] lstrlenW (lpString=".zip") returned 4 [0111.736] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0111.736] lstrlenW (lpString=".rar") returned 4 [0111.736] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0111.736] lstrlenW (lpString=".bz2") returned 4 [0111.736] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0111.736] lstrlenW (lpString=".7z") returned 3 [0111.736] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0111.736] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74 [0111.736] lstrlenW (lpString=".dbf") returned 4 [0111.736] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0111.736] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74 [0111.736] lstrlenW (lpString=".1cd") returned 4 [0111.736] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0111.736] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74 [0111.736] lstrlenW (lpString=".jpg") returned 4 [0111.736] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0111.736] lstrcmpiW (lpString1=".PNG", lpString2=".waifu") returned -1 [0111.736] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0111.736] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0111.737] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x26ff9fc | out: lpFileSize=0x26ff9fc*=20627) returned 1 [0111.737] CloseHandle (hObject=0x1d8) returned 1 [0111.737] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\thmbnail.png")) returned 0x20 [0111.737] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\thmbnail.png.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0111.737] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0111.737] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0111.737] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0111.737] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\thmbnail.png.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0111.738] GetLastError () returned 0x0 [0111.738] ReadFile (in: hFile=0x1d8, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x5093, lpOverlapped=0x0) returned 1 [0111.739] WriteFile (in: hFile=0x180, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x50a0, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0x50a0, lpOverlapped=0x0) returned 1 [0111.740] ReadFile (in: hFile=0x1d8, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x0, lpOverlapped=0x0) returned 1 [0111.740] WriteFile (in: hFile=0x180, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0xec, lpOverlapped=0x0) returned 1 [0111.740] SetEndOfFile (hFile=0x180) returned 1 [0111.740] CloseHandle (hObject=0x180) returned 1 [0111.740] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0111.740] SetEndOfFile (hFile=0x1d8) returned 1 [0111.741] CloseHandle (hObject=0x1d8) returned 1 [0111.741] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0111.741] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\thmbnail.png")) returned 1 [0111.741] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75 [0111.741] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75 [0111.742] lstrlenW (lpString=".doc") returned 4 [0111.742] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0111.742] lstrlenW (lpString=".docx") returned 5 [0111.742] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0111.742] lstrlenW (lpString=".pdf") returned 4 [0111.742] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0111.742] lstrlenW (lpString=".xls") returned 4 [0111.742] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0111.742] lstrlenW (lpString=".xlsx") returned 5 [0111.742] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0111.742] lstrlenW (lpString=".ppt") returned 4 [0111.742] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0111.742] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75 [0111.742] lstrlenW (lpString=".zip") returned 4 [0111.742] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0111.742] lstrlenW (lpString=".rar") returned 4 [0111.742] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0111.742] lstrlenW (lpString=".bz2") returned 4 [0111.742] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0111.742] lstrlenW (lpString=".7z") returned 3 [0111.742] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0111.742] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75 [0111.742] lstrlenW (lpString=".dbf") returned 4 [0111.742] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0111.742] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75 [0111.742] lstrlenW (lpString=".1cd") returned 4 [0111.742] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0111.742] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75 [0111.742] lstrlenW (lpString=".jpg") returned 4 [0111.742] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0111.742] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75 [0111.742] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75 [0111.742] lstrlenW (lpString=".doc") returned 4 [0111.742] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0111.742] lstrlenW (lpString=".docx") returned 5 [0111.742] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0111.742] lstrlenW (lpString=".pdf") returned 4 [0111.742] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0111.743] lstrlenW (lpString=".xls") returned 4 [0111.743] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0111.743] lstrlenW (lpString=".xlsx") returned 5 [0111.743] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0111.743] lstrlenW (lpString=".ppt") returned 4 [0111.743] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0111.743] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75 [0111.743] lstrlenW (lpString=".zip") returned 4 [0111.743] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0111.743] lstrlenW (lpString=".rar") returned 4 [0111.743] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0111.743] lstrlenW (lpString=".bz2") returned 4 [0111.743] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0111.743] lstrlenW (lpString=".7z") returned 3 [0111.743] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0111.743] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75 [0111.743] lstrlenW (lpString=".dbf") returned 4 [0111.743] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0111.743] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75 [0111.743] lstrlenW (lpString=".1cd") returned 4 [0111.743] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0111.743] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75 [0111.743] lstrlenW (lpString=".jpg") returned 4 [0111.743] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0111.743] lstrcmpiW (lpString1=".GIF", lpString2=".waifu") returned -1 [0111.743] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0111.743] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0111.743] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x26ff9fc | out: lpFileSize=0x26ff9fc*=1560) returned 1 [0111.743] CloseHandle (hObject=0x1d8) returned 1 [0111.744] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\preview.gif")) returned 0x20 [0111.744] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\preview.gif.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0111.744] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0111.744] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0111.744] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0111.744] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\preview.gif.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0111.745] GetLastError () returned 0x0 [0111.745] ReadFile (in: hFile=0x1d8, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x618, lpOverlapped=0x0) returned 1 [0111.747] WriteFile (in: hFile=0x1e8, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x620, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0x620, lpOverlapped=0x0) returned 1 [0111.748] ReadFile (in: hFile=0x1d8, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x0, lpOverlapped=0x0) returned 1 [0111.748] WriteFile (in: hFile=0x1e8, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0xea, lpOverlapped=0x0) returned 1 [0111.748] SetEndOfFile (hFile=0x1e8) returned 1 [0111.748] CloseHandle (hObject=0x1e8) returned 1 [0111.748] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0111.748] SetEndOfFile (hFile=0x1d8) returned 1 [0111.748] CloseHandle (hObject=0x1d8) returned 1 [0111.748] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0111.749] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\preview.gif")) returned 1 [0111.749] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76 [0111.749] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76 [0111.749] lstrlenW (lpString=".doc") returned 4 [0111.749] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0111.749] lstrlenW (lpString=".docx") returned 5 [0111.749] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0111.749] lstrlenW (lpString=".pdf") returned 4 [0111.749] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0111.749] lstrlenW (lpString=".xls") returned 4 [0111.749] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0111.749] lstrlenW (lpString=".xlsx") returned 5 [0111.749] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0111.749] lstrlenW (lpString=".ppt") returned 4 [0111.749] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0111.749] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76 [0111.749] lstrlenW (lpString=".zip") returned 4 [0111.749] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0111.749] lstrlenW (lpString=".rar") returned 4 [0111.749] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0111.749] lstrlenW (lpString=".bz2") returned 4 [0111.749] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0111.749] lstrlenW (lpString=".7z") returned 3 [0111.749] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0111.749] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76 [0111.749] lstrlenW (lpString=".dbf") returned 4 [0111.749] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0111.749] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76 [0111.749] lstrlenW (lpString=".1cd") returned 4 [0111.749] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0111.749] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76 [0111.749] lstrlenW (lpString=".jpg") returned 4 [0111.749] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0111.750] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76 [0111.750] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76 [0111.750] lstrlenW (lpString=".doc") returned 4 [0111.750] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0111.750] lstrlenW (lpString=".docx") returned 5 [0111.750] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0111.750] lstrlenW (lpString=".pdf") returned 4 [0111.750] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0111.750] lstrlenW (lpString=".xls") returned 4 [0111.750] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0111.750] lstrlenW (lpString=".xlsx") returned 5 [0111.750] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0111.750] lstrlenW (lpString=".ppt") returned 4 [0111.750] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0111.750] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76 [0111.750] lstrlenW (lpString=".zip") returned 4 [0111.750] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0111.750] lstrlenW (lpString=".rar") returned 4 [0111.750] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0111.750] lstrlenW (lpString=".bz2") returned 4 [0111.750] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0111.750] lstrlenW (lpString=".7z") returned 3 [0111.750] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0111.750] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76 [0111.750] lstrlenW (lpString=".dbf") returned 4 [0111.750] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0111.750] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76 [0111.750] lstrlenW (lpString=".1cd") returned 4 [0111.750] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0111.750] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76 [0111.750] lstrlenW (lpString=".jpg") returned 4 [0111.750] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0111.750] lstrcmpiW (lpString1=".PNG", lpString2=".waifu") returned -1 [0111.750] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0111.750] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0111.751] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x26ff9fc | out: lpFileSize=0x26ff9fc*=33009) returned 1 [0111.751] CloseHandle (hObject=0x1d8) returned 1 [0111.751] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\thmbnail.png")) returned 0x20 [0111.751] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\thmbnail.png.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0111.751] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0111.751] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0111.751] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0111.751] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\thmbnail.png.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0111.751] GetLastError () returned 0x0 [0111.751] ReadFile (in: hFile=0x1d8, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x80f1, lpOverlapped=0x0) returned 1 [0111.753] WriteFile (in: hFile=0x1e8, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x8100, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0x8100, lpOverlapped=0x0) returned 1 [0111.753] ReadFile (in: hFile=0x1d8, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x0, lpOverlapped=0x0) returned 1 [0111.753] WriteFile (in: hFile=0x1e8, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0xec, lpOverlapped=0x0) returned 1 [0111.753] SetEndOfFile (hFile=0x1e8) returned 1 [0111.754] CloseHandle (hObject=0x1e8) returned 1 [0111.754] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0111.754] SetEndOfFile (hFile=0x1d8) returned 1 [0111.754] CloseHandle (hObject=0x1d8) returned 1 [0111.754] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0111.755] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\thmbnail.png")) returned 1 [0111.755] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77 [0111.755] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77 [0111.755] lstrlenW (lpString=".doc") returned 4 [0111.755] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0111.755] lstrlenW (lpString=".docx") returned 5 [0111.755] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0111.755] lstrlenW (lpString=".pdf") returned 4 [0111.755] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0111.755] lstrlenW (lpString=".xls") returned 4 [0111.755] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0111.755] lstrlenW (lpString=".xlsx") returned 5 [0111.755] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0111.755] lstrlenW (lpString=".ppt") returned 4 [0111.755] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0111.755] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77 [0111.755] lstrlenW (lpString=".zip") returned 4 [0111.755] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0111.755] lstrlenW (lpString=".rar") returned 4 [0111.755] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0111.755] lstrlenW (lpString=".bz2") returned 4 [0111.755] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0111.755] lstrlenW (lpString=".7z") returned 3 [0111.755] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0111.755] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77 [0111.755] lstrlenW (lpString=".dbf") returned 4 [0111.755] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0111.755] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77 [0111.755] lstrlenW (lpString=".1cd") returned 4 [0111.755] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0111.755] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77 [0111.755] lstrlenW (lpString=".jpg") returned 4 [0111.755] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0111.755] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77 [0111.755] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77 [0111.755] lstrlenW (lpString=".doc") returned 4 [0111.755] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0111.755] lstrlenW (lpString=".docx") returned 5 [0111.755] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0111.755] lstrlenW (lpString=".pdf") returned 4 [0111.755] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0111.755] lstrlenW (lpString=".xls") returned 4 [0111.756] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0111.756] lstrlenW (lpString=".xlsx") returned 5 [0111.756] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0111.756] lstrlenW (lpString=".ppt") returned 4 [0111.756] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0111.756] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77 [0111.756] lstrlenW (lpString=".zip") returned 4 [0111.756] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0111.756] lstrlenW (lpString=".rar") returned 4 [0111.756] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0111.756] lstrlenW (lpString=".bz2") returned 4 [0111.756] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0111.756] lstrlenW (lpString=".7z") returned 3 [0111.756] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0111.756] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77 [0111.756] lstrlenW (lpString=".dbf") returned 4 [0111.756] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0111.756] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77 [0111.756] lstrlenW (lpString=".1cd") returned 4 [0111.756] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0111.756] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77 [0111.756] lstrlenW (lpString=".jpg") returned 4 [0111.756] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0111.756] lstrcmpiW (lpString1=".GIF", lpString2=".waifu") returned -1 [0111.756] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0111.756] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0111.756] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x26ff9fc | out: lpFileSize=0x26ff9fc*=1925) returned 1 [0111.756] CloseHandle (hObject=0x1d8) returned 1 [0111.756] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\preview.gif")) returned 0x20 [0111.757] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\preview.gif.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0111.757] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0111.757] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0111.757] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0111.757] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\preview.gif.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0111.758] GetLastError () returned 0x0 [0111.758] ReadFile (in: hFile=0x1d8, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x785, lpOverlapped=0x0) returned 1 [0111.991] WriteFile (in: hFile=0x1e8, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x790, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0x790, lpOverlapped=0x0) returned 1 [0112.184] ReadFile (in: hFile=0x1d8, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x0, lpOverlapped=0x0) returned 1 [0112.184] WriteFile (in: hFile=0x1e8, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0xea, lpOverlapped=0x0) returned 1 [0112.184] SetEndOfFile (hFile=0x1e8) returned 1 [0112.184] CloseHandle (hObject=0x1e8) returned 1 [0112.184] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0112.184] SetEndOfFile (hFile=0x1d8) returned 1 [0112.185] CloseHandle (hObject=0x1d8) returned 1 [0112.185] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0112.185] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\preview.gif")) returned 1 [0112.185] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76 [0112.185] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76 [0112.185] lstrlenW (lpString=".doc") returned 4 [0112.185] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0112.185] lstrlenW (lpString=".docx") returned 5 [0112.185] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0112.185] lstrlenW (lpString=".pdf") returned 4 [0112.185] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0112.185] lstrlenW (lpString=".xls") returned 4 [0112.185] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0112.185] lstrlenW (lpString=".xlsx") returned 5 [0112.185] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0112.185] lstrlenW (lpString=".ppt") returned 4 [0112.185] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0112.185] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76 [0112.185] lstrlenW (lpString=".zip") returned 4 [0112.185] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0112.185] lstrlenW (lpString=".rar") returned 4 [0112.185] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0112.185] lstrlenW (lpString=".bz2") returned 4 [0112.185] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0112.185] lstrlenW (lpString=".7z") returned 3 [0112.186] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0112.186] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76 [0112.186] lstrlenW (lpString=".dbf") returned 4 [0112.186] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0112.186] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76 [0112.186] lstrlenW (lpString=".1cd") returned 4 [0112.186] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0112.186] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76 [0112.186] lstrlenW (lpString=".jpg") returned 4 [0112.186] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0112.186] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76 [0112.186] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76 [0112.186] lstrlenW (lpString=".doc") returned 4 [0112.186] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0112.186] lstrlenW (lpString=".docx") returned 5 [0112.186] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0112.186] lstrlenW (lpString=".pdf") returned 4 [0112.186] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0112.186] lstrlenW (lpString=".xls") returned 4 [0112.186] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0112.186] lstrlenW (lpString=".xlsx") returned 5 [0112.186] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0112.186] lstrlenW (lpString=".ppt") returned 4 [0112.186] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0112.186] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76 [0112.186] lstrlenW (lpString=".zip") returned 4 [0112.186] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0112.186] lstrlenW (lpString=".rar") returned 4 [0112.186] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0112.186] lstrlenW (lpString=".bz2") returned 4 [0112.186] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0112.186] lstrlenW (lpString=".7z") returned 3 [0112.186] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0112.186] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76 [0112.186] lstrlenW (lpString=".dbf") returned 4 [0112.186] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0112.186] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76 [0112.186] lstrlenW (lpString=".1cd") returned 4 [0112.186] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0112.186] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76 [0112.186] lstrlenW (lpString=".jpg") returned 4 [0112.186] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0112.186] lstrcmpiW (lpString1=".GIF", lpString2=".waifu") returned -1 [0112.186] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0112.186] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0112.187] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x26ff9fc | out: lpFileSize=0x26ff9fc*=1293) returned 1 [0112.187] CloseHandle (hObject=0x1d8) returned 1 [0112.187] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\preview.gif")) returned 0x20 [0112.187] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\preview.gif.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0112.187] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0112.187] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0112.187] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0112.187] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\preview.gif.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0112.436] GetLastError () returned 0x0 [0112.436] ReadFile (in: hFile=0x1d8, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x50d, lpOverlapped=0x0) returned 1 [0112.584] WriteFile (in: hFile=0x1e0, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x510, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0x510, lpOverlapped=0x0) returned 1 [0112.585] ReadFile (in: hFile=0x1d8, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x0, lpOverlapped=0x0) returned 1 [0112.585] WriteFile (in: hFile=0x1e0, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0xea, lpOverlapped=0x0) returned 1 [0112.585] SetEndOfFile (hFile=0x1e0) returned 1 [0112.585] CloseHandle (hObject=0x1e0) returned 1 [0112.585] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0112.585] SetEndOfFile (hFile=0x1d8) returned 1 [0112.586] CloseHandle (hObject=0x1d8) returned 1 [0112.586] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0112.586] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\preview.gif")) returned 1 [0112.586] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 75 [0112.586] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 75 [0112.586] lstrlenW (lpString=".doc") returned 4 [0112.586] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0112.586] lstrlenW (lpString=".docx") returned 5 [0112.586] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0112.586] lstrlenW (lpString=".pdf") returned 4 [0112.586] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0112.586] lstrlenW (lpString=".xls") returned 4 [0112.587] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0112.587] lstrlenW (lpString=".xlsx") returned 5 [0112.587] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0112.587] lstrlenW (lpString=".ppt") returned 4 [0112.587] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0112.587] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 75 [0112.587] lstrlenW (lpString=".zip") returned 4 [0112.587] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0112.587] lstrlenW (lpString=".rar") returned 4 [0112.587] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0112.587] lstrlenW (lpString=".bz2") returned 4 [0112.587] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0112.587] lstrlenW (lpString=".7z") returned 3 [0112.587] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0112.587] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 75 [0112.587] lstrlenW (lpString=".dbf") returned 4 [0112.587] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0112.587] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 75 [0112.587] lstrlenW (lpString=".1cd") returned 4 [0112.587] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0112.587] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 75 [0112.587] lstrlenW (lpString=".jpg") returned 4 [0112.587] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0112.587] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 75 [0112.587] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 75 [0112.587] lstrlenW (lpString=".doc") returned 4 [0112.587] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0112.587] lstrlenW (lpString=".docx") returned 5 [0112.587] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0112.587] lstrlenW (lpString=".pdf") returned 4 [0112.587] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0112.587] lstrlenW (lpString=".xls") returned 4 [0112.587] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0112.587] lstrlenW (lpString=".xlsx") returned 5 [0112.587] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0112.587] lstrlenW (lpString=".ppt") returned 4 [0112.587] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0112.587] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 75 [0112.587] lstrlenW (lpString=".zip") returned 4 [0112.587] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0112.587] lstrlenW (lpString=".rar") returned 4 [0112.587] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0112.587] lstrlenW (lpString=".bz2") returned 4 [0112.587] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0112.587] lstrlenW (lpString=".7z") returned 3 [0112.587] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0112.587] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 75 [0112.587] lstrlenW (lpString=".dbf") returned 4 [0112.587] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0112.588] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 75 [0112.588] lstrlenW (lpString=".1cd") returned 4 [0112.588] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0112.588] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 75 [0112.588] lstrlenW (lpString=".jpg") returned 4 [0112.588] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0112.588] lstrcmpiW (lpString1=".GIF", lpString2=".waifu") returned -1 [0112.588] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0112.588] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0112.588] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x26ff9fc | out: lpFileSize=0x26ff9fc*=3957) returned 1 [0112.588] CloseHandle (hObject=0x1d8) returned 1 [0112.588] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\preview.gif")) returned 0x20 [0112.588] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\preview.gif.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0112.588] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0112.588] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0112.589] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0112.589] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\preview.gif.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0112.925] GetLastError () returned 0x0 [0112.925] ReadFile (in: hFile=0x1d8, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0xf75, lpOverlapped=0x0) returned 1 [0112.927] WriteFile (in: hFile=0x1f0, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xf80, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0xf80, lpOverlapped=0x0) returned 1 [0112.927] ReadFile (in: hFile=0x1d8, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x0, lpOverlapped=0x0) returned 1 [0112.928] WriteFile (in: hFile=0x1f0, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0xea, lpOverlapped=0x0) returned 1 [0112.928] SetEndOfFile (hFile=0x1f0) returned 1 [0112.928] CloseHandle (hObject=0x1f0) returned 1 [0112.928] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0112.928] SetEndOfFile (hFile=0x1d8) returned 1 [0112.929] CloseHandle (hObject=0x1d8) returned 1 [0112.929] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0112.929] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\preview.gif")) returned 1 [0112.929] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned 76 [0112.929] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned 76 [0112.929] lstrlenW (lpString=".doc") returned 4 [0112.929] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0112.929] lstrlenW (lpString=".docx") returned 5 [0112.929] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0112.929] lstrlenW (lpString=".pdf") returned 4 [0112.930] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0112.930] lstrlenW (lpString=".xls") returned 4 [0112.930] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0112.930] lstrlenW (lpString=".xlsx") returned 5 [0112.930] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0112.930] lstrlenW (lpString=".ppt") returned 4 [0112.930] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0112.930] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned 76 [0112.930] lstrlenW (lpString=".zip") returned 4 [0112.930] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0112.930] lstrlenW (lpString=".rar") returned 4 [0112.930] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0112.930] lstrlenW (lpString=".bz2") returned 4 [0112.930] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0112.930] lstrlenW (lpString=".7z") returned 3 [0112.930] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0112.930] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned 76 [0112.930] lstrlenW (lpString=".dbf") returned 4 [0112.930] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0112.930] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned 76 [0112.930] lstrlenW (lpString=".1cd") returned 4 [0112.930] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0112.930] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned 76 [0112.930] lstrlenW (lpString=".jpg") returned 4 [0112.930] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0112.930] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned 76 [0112.930] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned 76 [0112.930] lstrlenW (lpString=".doc") returned 4 [0112.930] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0112.930] lstrlenW (lpString=".docx") returned 5 [0112.930] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0112.930] lstrlenW (lpString=".pdf") returned 4 [0112.930] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0112.930] lstrlenW (lpString=".xls") returned 4 [0112.930] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0112.931] lstrlenW (lpString=".xlsx") returned 5 [0112.931] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0112.931] lstrlenW (lpString=".ppt") returned 4 [0112.931] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0112.931] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned 76 [0112.931] lstrlenW (lpString=".zip") returned 4 [0112.931] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0112.931] lstrlenW (lpString=".rar") returned 4 [0112.931] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0112.931] lstrlenW (lpString=".bz2") returned 4 [0112.931] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0112.931] lstrlenW (lpString=".7z") returned 3 [0112.931] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0112.931] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned 76 [0112.931] lstrlenW (lpString=".dbf") returned 4 [0112.931] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0112.931] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned 76 [0112.931] lstrlenW (lpString=".1cd") returned 4 [0112.931] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0112.931] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned 76 [0112.931] lstrlenW (lpString=".jpg") returned 4 [0112.931] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0112.931] lstrcmpiW (lpString1=".GIF", lpString2=".waifu") returned -1 [0112.931] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0112.931] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0112.932] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x26ff9fc | out: lpFileSize=0x26ff9fc*=1347) returned 1 [0112.932] CloseHandle (hObject=0x1d8) returned 1 [0112.932] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\preview.gif")) returned 0x20 [0112.933] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\preview.gif.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0112.933] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0112.933] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0112.933] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0112.933] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\preview.gif.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0112.934] GetLastError () returned 0x0 [0112.934] ReadFile (in: hFile=0x1d8, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x543, lpOverlapped=0x0) returned 1 [0112.937] WriteFile (in: hFile=0x1e0, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0x550, lpOverlapped=0x0) returned 1 [0112.937] ReadFile (in: hFile=0x1d8, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x0, lpOverlapped=0x0) returned 1 [0112.937] WriteFile (in: hFile=0x1e0, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0xea, lpOverlapped=0x0) returned 1 [0112.937] SetEndOfFile (hFile=0x1e0) returned 1 [0112.938] CloseHandle (hObject=0x1e0) returned 1 [0112.938] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0112.938] SetEndOfFile (hFile=0x1d8) returned 1 [0112.938] CloseHandle (hObject=0x1d8) returned 1 [0112.939] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0112.939] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\preview.gif")) returned 1 [0112.939] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75 [0112.939] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75 [0112.939] lstrlenW (lpString=".doc") returned 4 [0112.939] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0112.939] lstrlenW (lpString=".docx") returned 5 [0112.939] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0112.939] lstrlenW (lpString=".pdf") returned 4 [0112.939] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0112.939] lstrlenW (lpString=".xls") returned 4 [0112.939] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0112.939] lstrlenW (lpString=".xlsx") returned 5 [0112.939] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0112.939] lstrlenW (lpString=".ppt") returned 4 [0112.939] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0112.939] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75 [0112.940] lstrlenW (lpString=".zip") returned 4 [0112.940] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0112.940] lstrlenW (lpString=".rar") returned 4 [0112.940] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0112.940] lstrlenW (lpString=".bz2") returned 4 [0112.940] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0112.940] lstrlenW (lpString=".7z") returned 3 [0112.940] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0112.940] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75 [0112.940] lstrlenW (lpString=".dbf") returned 4 [0112.940] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0112.940] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75 [0112.940] lstrlenW (lpString=".1cd") returned 4 [0112.940] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0112.940] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75 [0112.940] lstrlenW (lpString=".jpg") returned 4 [0112.940] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0112.940] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75 [0112.940] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75 [0112.940] lstrlenW (lpString=".doc") returned 4 [0112.940] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0112.940] lstrlenW (lpString=".docx") returned 5 [0112.940] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0112.940] lstrlenW (lpString=".pdf") returned 4 [0112.940] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0112.940] lstrlenW (lpString=".xls") returned 4 [0112.940] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0112.940] lstrlenW (lpString=".xlsx") returned 5 [0112.940] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0112.940] lstrlenW (lpString=".ppt") returned 4 [0112.940] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0112.940] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75 [0112.940] lstrlenW (lpString=".zip") returned 4 [0112.940] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0112.940] lstrlenW (lpString=".rar") returned 4 [0112.941] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0112.941] lstrlenW (lpString=".bz2") returned 4 [0112.941] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0112.941] lstrlenW (lpString=".7z") returned 3 [0112.941] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0112.941] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75 [0112.941] lstrlenW (lpString=".dbf") returned 4 [0112.941] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0112.941] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75 [0112.941] lstrlenW (lpString=".1cd") returned 4 [0112.941] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0112.941] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75 [0112.941] lstrlenW (lpString=".jpg") returned 4 [0112.941] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0112.941] lstrcmpiW (lpString1=".PNG", lpString2=".waifu") returned -1 [0112.941] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0112.941] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0112.941] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x26ff9fc | out: lpFileSize=0x26ff9fc*=32403) returned 1 [0112.941] CloseHandle (hObject=0x1d8) returned 1 [0112.942] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\thmbnail.png")) returned 0x20 [0112.942] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\thmbnail.png.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0112.942] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0112.942] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0112.942] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0112.942] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\thmbnail.png.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0112.942] GetLastError () returned 0x0 [0112.942] ReadFile (in: hFile=0x1d8, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x7e93, lpOverlapped=0x0) returned 1 [0112.944] WriteFile (in: hFile=0x1e0, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x7ea0, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0x7ea0, lpOverlapped=0x0) returned 1 [0112.945] ReadFile (in: hFile=0x1d8, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x0, lpOverlapped=0x0) returned 1 [0112.945] WriteFile (in: hFile=0x1e0, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0xec, lpOverlapped=0x0) returned 1 [0112.945] SetEndOfFile (hFile=0x1e0) returned 1 [0112.945] CloseHandle (hObject=0x1e0) returned 1 [0112.945] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0112.945] SetEndOfFile (hFile=0x1d8) returned 1 [0112.946] CloseHandle (hObject=0x1d8) returned 1 [0112.946] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0112.946] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\thmbnail.png")) returned 1 [0112.947] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76 [0112.947] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76 [0112.947] lstrlenW (lpString=".doc") returned 4 [0112.947] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0112.947] lstrlenW (lpString=".docx") returned 5 [0112.947] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0112.947] lstrlenW (lpString=".pdf") returned 4 [0112.947] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0112.947] lstrlenW (lpString=".xls") returned 4 [0112.947] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0112.947] lstrlenW (lpString=".xlsx") returned 5 [0112.947] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0112.947] lstrlenW (lpString=".ppt") returned 4 [0112.947] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0112.947] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76 [0112.947] lstrlenW (lpString=".zip") returned 4 [0112.947] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0112.947] lstrlenW (lpString=".rar") returned 4 [0112.947] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0112.947] lstrlenW (lpString=".bz2") returned 4 [0112.947] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0112.947] lstrlenW (lpString=".7z") returned 3 [0112.947] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0112.947] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76 [0112.947] lstrlenW (lpString=".dbf") returned 4 [0112.947] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0112.947] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76 [0112.947] lstrlenW (lpString=".1cd") returned 4 [0112.947] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0112.947] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76 [0112.947] lstrlenW (lpString=".jpg") returned 4 [0112.947] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0112.948] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76 [0112.948] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76 [0112.948] lstrlenW (lpString=".doc") returned 4 [0112.948] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0112.948] lstrlenW (lpString=".docx") returned 5 [0112.948] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0112.948] lstrlenW (lpString=".pdf") returned 4 [0112.948] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0112.948] lstrlenW (lpString=".xls") returned 4 [0112.948] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0112.948] lstrlenW (lpString=".xlsx") returned 5 [0112.948] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0112.948] lstrlenW (lpString=".ppt") returned 4 [0112.948] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0112.948] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76 [0112.948] lstrlenW (lpString=".zip") returned 4 [0112.948] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0112.948] lstrlenW (lpString=".rar") returned 4 [0112.948] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0112.948] lstrlenW (lpString=".bz2") returned 4 [0112.948] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0112.948] lstrlenW (lpString=".7z") returned 3 [0112.948] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0112.948] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76 [0112.948] lstrlenW (lpString=".dbf") returned 4 [0112.948] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0112.948] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76 [0112.948] lstrlenW (lpString=".1cd") returned 4 [0112.948] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0112.948] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76 [0112.948] lstrlenW (lpString=".jpg") returned 4 [0112.948] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0112.949] lstrcmpiW (lpString1=".GIF", lpString2=".waifu") returned -1 [0112.949] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0112.949] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0112.949] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x26ff9fc | out: lpFileSize=0x26ff9fc*=1347) returned 1 [0112.949] CloseHandle (hObject=0x1d8) returned 1 [0112.949] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\preview.gif")) returned 0x20 [0112.950] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\preview.gif.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0112.950] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0112.950] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0112.950] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0112.950] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\preview.gif.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0112.952] GetLastError () returned 0x0 [0112.952] ReadFile (in: hFile=0x1d8, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x543, lpOverlapped=0x0) returned 1 [0112.953] WriteFile (in: hFile=0x1e0, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0x550, lpOverlapped=0x0) returned 1 [0112.954] ReadFile (in: hFile=0x1d8, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x0, lpOverlapped=0x0) returned 1 [0112.954] WriteFile (in: hFile=0x1e0, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0xea, lpOverlapped=0x0) returned 1 [0112.954] SetEndOfFile (hFile=0x1e0) returned 1 [0112.954] CloseHandle (hObject=0x1e0) returned 1 [0112.954] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0112.954] SetEndOfFile (hFile=0x1d8) returned 1 [0112.955] CloseHandle (hObject=0x1d8) returned 1 [0112.955] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0112.955] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\preview.gif")) returned 1 [0112.955] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72 [0112.955] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72 [0112.956] lstrlenW (lpString=".doc") returned 4 [0112.956] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0112.956] lstrlenW (lpString=".docx") returned 5 [0112.956] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0112.956] lstrlenW (lpString=".pdf") returned 4 [0112.956] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0112.956] lstrlenW (lpString=".xls") returned 4 [0112.956] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0112.956] lstrlenW (lpString=".xlsx") returned 5 [0112.956] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0112.956] lstrlenW (lpString=".ppt") returned 4 [0112.956] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0112.956] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72 [0112.956] lstrlenW (lpString=".zip") returned 4 [0112.956] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0112.956] lstrlenW (lpString=".rar") returned 4 [0112.956] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0112.956] lstrlenW (lpString=".bz2") returned 4 [0112.956] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0112.956] lstrlenW (lpString=".7z") returned 3 [0112.956] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0112.956] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72 [0112.956] lstrlenW (lpString=".dbf") returned 4 [0112.956] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0112.956] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72 [0112.956] lstrlenW (lpString=".1cd") returned 4 [0112.956] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0112.956] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72 [0112.956] lstrlenW (lpString=".jpg") returned 4 [0112.956] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0112.956] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72 [0112.956] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72 [0112.956] lstrlenW (lpString=".doc") returned 4 [0112.956] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0112.956] lstrlenW (lpString=".docx") returned 5 [0112.956] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0112.957] lstrlenW (lpString=".pdf") returned 4 [0112.957] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0112.957] lstrlenW (lpString=".xls") returned 4 [0112.957] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0112.957] lstrlenW (lpString=".xlsx") returned 5 [0112.957] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0112.957] lstrlenW (lpString=".ppt") returned 4 [0112.957] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0112.957] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72 [0112.957] lstrlenW (lpString=".zip") returned 4 [0112.957] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0112.957] lstrlenW (lpString=".rar") returned 4 [0112.957] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0112.957] lstrlenW (lpString=".bz2") returned 4 [0112.957] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0112.957] lstrlenW (lpString=".7z") returned 3 [0112.957] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0112.957] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72 [0112.957] lstrlenW (lpString=".dbf") returned 4 [0112.957] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0112.957] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72 [0112.957] lstrlenW (lpString=".1cd") returned 4 [0112.957] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0112.957] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72 [0112.957] lstrlenW (lpString=".jpg") returned 4 [0112.957] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0112.957] lstrcmpiW (lpString1=".PNG", lpString2=".waifu") returned -1 [0112.957] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0112.957] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0112.958] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x26ff9fc | out: lpFileSize=0x26ff9fc*=26402) returned 1 [0112.958] CloseHandle (hObject=0x1d8) returned 1 [0112.958] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\thmbnail.png")) returned 0x20 [0112.958] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\thmbnail.png.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0112.958] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0112.958] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0112.958] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0112.958] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\thmbnail.png.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0112.959] GetLastError () returned 0x0 [0112.959] ReadFile (in: hFile=0x1d8, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x6722, lpOverlapped=0x0) returned 1 [0112.960] WriteFile (in: hFile=0x1e0, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x6730, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0x6730, lpOverlapped=0x0) returned 1 [0112.961] ReadFile (in: hFile=0x1d8, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x0, lpOverlapped=0x0) returned 1 [0112.961] WriteFile (in: hFile=0x1e0, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0xec, lpOverlapped=0x0) returned 1 [0112.961] SetEndOfFile (hFile=0x1e0) returned 1 [0112.961] CloseHandle (hObject=0x1e0) returned 1 [0112.961] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0112.961] SetEndOfFile (hFile=0x1d8) returned 1 [0112.962] CloseHandle (hObject=0x1d8) returned 1 [0112.962] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0113.080] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\thmbnail.png")) returned 1 [0113.080] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned 73 [0113.080] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned 73 [0113.080] lstrlenW (lpString=".doc") returned 4 [0113.080] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0113.080] lstrlenW (lpString=".docx") returned 5 [0113.080] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0113.080] lstrlenW (lpString=".pdf") returned 4 [0113.080] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0113.080] lstrlenW (lpString=".xls") returned 4 [0113.080] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0113.080] lstrlenW (lpString=".xlsx") returned 5 [0113.080] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0113.080] lstrlenW (lpString=".ppt") returned 4 [0113.080] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0113.080] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned 73 [0113.080] lstrlenW (lpString=".zip") returned 4 [0113.080] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0113.080] lstrlenW (lpString=".rar") returned 4 [0113.080] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0113.080] lstrlenW (lpString=".bz2") returned 4 [0113.080] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0113.080] lstrlenW (lpString=".7z") returned 3 [0113.080] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0113.080] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned 73 [0113.080] lstrlenW (lpString=".dbf") returned 4 [0113.080] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0113.080] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned 73 [0113.080] lstrlenW (lpString=".1cd") returned 4 [0113.080] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0113.080] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned 73 [0113.080] lstrlenW (lpString=".jpg") returned 4 [0113.080] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0113.080] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned 73 [0113.080] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned 73 [0113.080] lstrlenW (lpString=".doc") returned 4 [0113.080] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0113.080] lstrlenW (lpString=".docx") returned 5 [0113.080] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0113.080] lstrlenW (lpString=".pdf") returned 4 [0113.080] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0113.081] lstrlenW (lpString=".xls") returned 4 [0113.081] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0113.081] lstrlenW (lpString=".xlsx") returned 5 [0113.081] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0113.081] lstrlenW (lpString=".ppt") returned 4 [0113.081] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0113.081] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned 73 [0113.081] lstrlenW (lpString=".zip") returned 4 [0113.081] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0113.081] lstrlenW (lpString=".rar") returned 4 [0113.081] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0113.081] lstrlenW (lpString=".bz2") returned 4 [0113.081] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0113.081] lstrlenW (lpString=".7z") returned 3 [0113.081] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0113.081] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned 73 [0113.081] lstrlenW (lpString=".dbf") returned 4 [0113.081] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0113.081] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned 73 [0113.081] lstrlenW (lpString=".1cd") returned 4 [0113.081] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0113.081] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned 73 [0113.081] lstrlenW (lpString=".jpg") returned 4 [0113.081] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0113.081] lstrcmpiW (lpString1=".PNG", lpString2=".waifu") returned -1 [0113.081] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0113.081] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0113.865] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x26ff9fc | out: lpFileSize=0x26ff9fc*=32433) returned 1 [0113.865] CloseHandle (hObject=0x1c0) returned 1 [0113.877] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\thmbnail.png")) returned 0x20 [0113.877] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\thmbnail.png.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0113.877] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0113.878] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0113.878] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0113.878] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\thmbnail.png.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0113.878] GetLastError () returned 0x0 [0113.878] ReadFile (in: hFile=0x1d8, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x7eb1, lpOverlapped=0x0) returned 1 [0113.879] WriteFile (in: hFile=0x1c0, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x7ec0, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0x7ec0, lpOverlapped=0x0) returned 1 [0113.880] ReadFile (in: hFile=0x1d8, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x0, lpOverlapped=0x0) returned 1 [0113.880] WriteFile (in: hFile=0x1c0, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0xec, lpOverlapped=0x0) returned 1 [0113.880] SetEndOfFile (hFile=0x1c0) returned 1 [0113.880] CloseHandle (hObject=0x1c0) returned 1 [0113.880] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0113.880] SetEndOfFile (hFile=0x1d8) returned 1 [0113.881] CloseHandle (hObject=0x1d8) returned 1 [0113.881] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0113.881] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\thmbnail.png")) returned 1 [0113.881] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 77 [0113.881] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 77 [0113.881] lstrlenW (lpString=".doc") returned 4 [0113.881] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0113.881] lstrlenW (lpString=".docx") returned 5 [0113.881] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0113.881] lstrlenW (lpString=".pdf") returned 4 [0113.881] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0113.881] lstrlenW (lpString=".xls") returned 4 [0113.881] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0113.881] lstrlenW (lpString=".xlsx") returned 5 [0113.881] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0113.881] lstrlenW (lpString=".ppt") returned 4 [0113.881] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0113.882] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 77 [0113.882] lstrlenW (lpString=".zip") returned 4 [0113.882] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0113.882] lstrlenW (lpString=".rar") returned 4 [0113.882] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0113.882] lstrlenW (lpString=".bz2") returned 4 [0113.882] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0113.882] lstrlenW (lpString=".7z") returned 3 [0113.882] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0113.882] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 77 [0113.882] lstrlenW (lpString=".dbf") returned 4 [0113.882] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0113.882] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 77 [0113.882] lstrlenW (lpString=".1cd") returned 4 [0113.882] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0113.882] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 77 [0113.882] lstrlenW (lpString=".jpg") returned 4 [0113.882] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0113.882] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 77 [0113.882] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 77 [0113.882] lstrlenW (lpString=".doc") returned 4 [0113.882] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0113.882] lstrlenW (lpString=".docx") returned 5 [0113.882] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0113.882] lstrlenW (lpString=".pdf") returned 4 [0113.882] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0113.882] lstrlenW (lpString=".xls") returned 4 [0113.882] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0113.882] lstrlenW (lpString=".xlsx") returned 5 [0113.882] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0113.882] lstrlenW (lpString=".ppt") returned 4 [0113.882] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0113.882] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 77 [0113.882] lstrlenW (lpString=".zip") returned 4 [0113.882] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0113.882] lstrlenW (lpString=".rar") returned 4 [0113.882] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0113.882] lstrlenW (lpString=".bz2") returned 4 [0113.882] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0113.882] lstrlenW (lpString=".7z") returned 3 [0113.882] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0113.882] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 77 [0113.882] lstrlenW (lpString=".dbf") returned 4 [0113.882] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0113.882] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 77 [0113.882] lstrlenW (lpString=".1cd") returned 4 [0113.882] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0113.882] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 77 [0113.882] lstrlenW (lpString=".jpg") returned 4 [0113.882] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0113.883] lstrcmpiW (lpString1=".PNG", lpString2=".waifu") returned -1 [0113.883] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0113.883] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0114.072] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x26ff9fc | out: lpFileSize=0x26ff9fc*=19485) returned 1 [0114.072] CloseHandle (hObject=0x200) returned 1 [0114.074] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\thmbnail.png")) returned 0x20 [0114.074] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\thmbnail.png.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0114.074] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0114.075] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0114.075] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0114.075] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\thmbnail.png.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0114.075] GetLastError () returned 0x0 [0114.075] ReadFile (in: hFile=0x200, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x4c1d, lpOverlapped=0x0) returned 1 [0114.076] WriteFile (in: hFile=0x1d8, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x4c20, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0x4c20, lpOverlapped=0x0) returned 1 [0114.080] ReadFile (in: hFile=0x200, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x0, lpOverlapped=0x0) returned 1 [0114.080] WriteFile (in: hFile=0x1d8, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0xec, lpOverlapped=0x0) returned 1 [0114.080] SetEndOfFile (hFile=0x1d8) returned 1 [0114.080] CloseHandle (hObject=0x1d8) returned 1 [0114.080] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0114.080] SetEndOfFile (hFile=0x200) returned 1 [0114.081] CloseHandle (hObject=0x200) returned 1 [0114.081] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0114.081] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\thmbnail.png")) returned 1 [0114.081] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73 [0114.082] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73 [0114.082] lstrlenW (lpString=".doc") returned 4 [0114.082] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0114.082] lstrlenW (lpString=".docx") returned 5 [0114.082] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0114.082] lstrlenW (lpString=".pdf") returned 4 [0114.082] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0114.082] lstrlenW (lpString=".xls") returned 4 [0114.082] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0114.082] lstrlenW (lpString=".xlsx") returned 5 [0114.082] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0114.082] lstrlenW (lpString=".ppt") returned 4 [0114.082] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0114.082] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73 [0114.082] lstrlenW (lpString=".zip") returned 4 [0114.082] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0114.082] lstrlenW (lpString=".rar") returned 4 [0114.082] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0114.082] lstrlenW (lpString=".bz2") returned 4 [0114.082] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0114.082] lstrlenW (lpString=".7z") returned 3 [0114.082] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0114.082] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73 [0114.082] lstrlenW (lpString=".dbf") returned 4 [0114.082] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0114.082] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73 [0114.082] lstrlenW (lpString=".1cd") returned 4 [0114.082] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0114.082] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73 [0114.082] lstrlenW (lpString=".jpg") returned 4 [0114.082] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0114.082] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73 [0114.082] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73 [0114.082] lstrlenW (lpString=".doc") returned 4 [0114.082] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0114.082] lstrlenW (lpString=".docx") returned 5 [0114.082] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0114.082] lstrlenW (lpString=".pdf") returned 4 [0114.082] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0114.082] lstrlenW (lpString=".xls") returned 4 [0114.082] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0114.082] lstrlenW (lpString=".xlsx") returned 5 [0114.082] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0114.082] lstrlenW (lpString=".ppt") returned 4 [0114.082] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0114.082] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73 [0114.082] lstrlenW (lpString=".zip") returned 4 [0114.082] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0114.082] lstrlenW (lpString=".rar") returned 4 [0114.082] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0114.083] lstrlenW (lpString=".bz2") returned 4 [0114.083] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0114.083] lstrlenW (lpString=".7z") returned 3 [0114.083] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0114.083] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73 [0114.083] lstrlenW (lpString=".dbf") returned 4 [0114.083] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0114.083] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73 [0114.083] lstrlenW (lpString=".1cd") returned 4 [0114.083] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0114.083] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73 [0114.083] lstrlenW (lpString=".jpg") returned 4 [0114.083] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0114.092] lstrcmpiW (lpString1=".GIF", lpString2=".waifu") returned -1 [0114.092] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0114.092] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0114.093] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x26ff9fc | out: lpFileSize=0x26ff9fc*=1364) returned 1 [0114.093] CloseHandle (hObject=0x20c) returned 1 [0114.093] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\preview.gif")) returned 0x20 [0114.093] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\preview.gif.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0114.093] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0114.093] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0114.093] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0114.093] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\preview.gif.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0114.455] GetLastError () returned 0x0 [0114.455] ReadFile (in: hFile=0x20c, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x554, lpOverlapped=0x0) returned 1 [0114.457] WriteFile (in: hFile=0x1f0, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x560, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0x560, lpOverlapped=0x0) returned 1 [0114.457] ReadFile (in: hFile=0x20c, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x0, lpOverlapped=0x0) returned 1 [0114.457] WriteFile (in: hFile=0x1f0, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0xea, lpOverlapped=0x0) returned 1 [0114.458] SetEndOfFile (hFile=0x1f0) returned 1 [0114.458] CloseHandle (hObject=0x1f0) returned 1 [0114.458] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0114.458] SetEndOfFile (hFile=0x20c) returned 1 [0114.459] CloseHandle (hObject=0x20c) returned 1 [0114.459] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0114.459] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\preview.gif")) returned 1 [0114.459] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75 [0114.459] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75 [0114.459] lstrlenW (lpString=".doc") returned 4 [0114.459] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0114.459] lstrlenW (lpString=".docx") returned 5 [0114.459] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0114.459] lstrlenW (lpString=".pdf") returned 4 [0114.459] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0114.459] lstrlenW (lpString=".xls") returned 4 [0114.459] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0114.460] lstrlenW (lpString=".xlsx") returned 5 [0114.460] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0114.460] lstrlenW (lpString=".ppt") returned 4 [0114.460] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0114.460] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75 [0114.460] lstrlenW (lpString=".zip") returned 4 [0114.460] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0114.460] lstrlenW (lpString=".rar") returned 4 [0114.460] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0114.460] lstrlenW (lpString=".bz2") returned 4 [0114.460] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0114.460] lstrlenW (lpString=".7z") returned 3 [0114.460] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0114.460] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75 [0114.460] lstrlenW (lpString=".dbf") returned 4 [0114.460] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0114.460] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75 [0114.460] lstrlenW (lpString=".1cd") returned 4 [0114.460] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0114.460] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75 [0114.460] lstrlenW (lpString=".jpg") returned 4 [0114.460] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0114.460] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75 [0114.460] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75 [0114.460] lstrlenW (lpString=".doc") returned 4 [0114.460] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0114.460] lstrlenW (lpString=".docx") returned 5 [0114.460] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0114.461] lstrlenW (lpString=".pdf") returned 4 [0114.461] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0114.461] lstrlenW (lpString=".xls") returned 4 [0114.461] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0114.461] lstrlenW (lpString=".xlsx") returned 5 [0114.461] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0114.461] lstrlenW (lpString=".ppt") returned 4 [0114.461] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0114.461] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75 [0114.461] lstrlenW (lpString=".zip") returned 4 [0114.461] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0114.461] lstrlenW (lpString=".rar") returned 4 [0114.461] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0114.461] lstrlenW (lpString=".bz2") returned 4 [0114.461] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0114.461] lstrlenW (lpString=".7z") returned 3 [0114.461] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0114.461] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75 [0114.461] lstrlenW (lpString=".dbf") returned 4 [0114.461] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0114.461] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75 [0114.461] lstrlenW (lpString=".1cd") returned 4 [0114.461] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0114.461] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75 [0114.461] lstrlenW (lpString=".jpg") returned 4 [0114.461] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0114.461] lstrcmpiW (lpString1=".GIF", lpString2=".waifu") returned -1 [0114.461] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0114.461] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0114.462] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x26ff9fc | out: lpFileSize=0x26ff9fc*=1423) returned 1 [0114.462] CloseHandle (hObject=0x20c) returned 1 [0114.462] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\preview.gif")) returned 0x20 [0114.462] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\preview.gif.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0114.462] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0114.462] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0114.462] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0114.462] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\preview.gif.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0114.464] GetLastError () returned 0x0 [0114.464] ReadFile (in: hFile=0x20c, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x58f, lpOverlapped=0x0) returned 1 [0114.465] WriteFile (in: hFile=0x1f0, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x590, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0x590, lpOverlapped=0x0) returned 1 [0114.466] ReadFile (in: hFile=0x20c, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x0, lpOverlapped=0x0) returned 1 [0114.466] WriteFile (in: hFile=0x1f0, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0xea, lpOverlapped=0x0) returned 1 [0114.466] SetEndOfFile (hFile=0x1f0) returned 1 [0114.466] CloseHandle (hObject=0x1f0) returned 1 [0114.467] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0114.467] SetEndOfFile (hFile=0x20c) returned 1 [0114.467] CloseHandle (hObject=0x20c) returned 1 [0114.467] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0114.468] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\preview.gif")) returned 1 [0114.468] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned 75 [0114.468] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned 75 [0114.468] lstrlenW (lpString=".doc") returned 4 [0114.468] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0114.468] lstrlenW (lpString=".docx") returned 5 [0114.468] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0114.468] lstrlenW (lpString=".pdf") returned 4 [0114.468] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0114.468] lstrlenW (lpString=".xls") returned 4 [0114.468] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0114.468] lstrlenW (lpString=".xlsx") returned 5 [0114.468] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0114.468] lstrlenW (lpString=".ppt") returned 4 [0114.468] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0114.468] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned 75 [0114.468] lstrlenW (lpString=".zip") returned 4 [0114.468] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0114.468] lstrlenW (lpString=".rar") returned 4 [0114.468] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0114.468] lstrlenW (lpString=".bz2") returned 4 [0114.469] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0114.469] lstrlenW (lpString=".7z") returned 3 [0114.469] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0114.469] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned 75 [0114.469] lstrlenW (lpString=".dbf") returned 4 [0114.469] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0114.469] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned 75 [0114.469] lstrlenW (lpString=".1cd") returned 4 [0114.469] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0114.469] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned 75 [0114.469] lstrlenW (lpString=".jpg") returned 4 [0114.469] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0114.469] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned 75 [0114.469] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned 75 [0114.469] lstrlenW (lpString=".doc") returned 4 [0114.469] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0114.469] lstrlenW (lpString=".docx") returned 5 [0114.469] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0114.469] lstrlenW (lpString=".pdf") returned 4 [0114.469] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0114.469] lstrlenW (lpString=".xls") returned 4 [0114.469] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0114.469] lstrlenW (lpString=".xlsx") returned 5 [0114.469] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0114.469] lstrlenW (lpString=".ppt") returned 4 [0114.469] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0114.469] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned 75 [0114.469] lstrlenW (lpString=".zip") returned 4 [0114.469] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0114.469] lstrlenW (lpString=".rar") returned 4 [0114.469] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0114.469] lstrlenW (lpString=".bz2") returned 4 [0114.469] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0114.469] lstrlenW (lpString=".7z") returned 3 [0114.469] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0114.470] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned 75 [0114.470] lstrlenW (lpString=".dbf") returned 4 [0114.470] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0114.470] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned 75 [0114.470] lstrlenW (lpString=".1cd") returned 4 [0114.470] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0114.470] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned 75 [0114.470] lstrlenW (lpString=".jpg") returned 4 [0114.470] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0114.470] lstrcmpiW (lpString1=".PNG", lpString2=".waifu") returned -1 [0114.470] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0114.470] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0114.470] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x26ff9fc | out: lpFileSize=0x26ff9fc*=15737) returned 1 [0114.470] CloseHandle (hObject=0x20c) returned 1 [0114.470] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\thmbnail.png")) returned 0x20 [0114.471] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\thmbnail.png.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0114.471] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0114.471] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0114.471] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0114.471] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\thmbnail.png.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0114.471] GetLastError () returned 0x0 [0114.471] ReadFile (in: hFile=0x20c, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x3d79, lpOverlapped=0x0) returned 1 [0114.473] WriteFile (in: hFile=0x1f0, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x3d80, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0x3d80, lpOverlapped=0x0) returned 1 [0114.474] ReadFile (in: hFile=0x20c, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x0, lpOverlapped=0x0) returned 1 [0114.474] WriteFile (in: hFile=0x1f0, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0xec, lpOverlapped=0x0) returned 1 [0114.474] SetEndOfFile (hFile=0x1f0) returned 1 [0114.474] CloseHandle (hObject=0x1f0) returned 1 [0114.474] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0114.474] SetEndOfFile (hFile=0x20c) returned 1 [0114.475] CloseHandle (hObject=0x20c) returned 1 [0114.475] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0114.475] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\thmbnail.png")) returned 1 [0114.476] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG") returned 76 [0114.476] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG") returned 76 [0114.476] lstrlenW (lpString=".doc") returned 4 [0114.476] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0114.476] lstrlenW (lpString=".docx") returned 5 [0114.476] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0114.476] lstrlenW (lpString=".pdf") returned 4 [0114.476] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0114.476] lstrlenW (lpString=".xls") returned 4 [0114.476] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0114.476] lstrlenW (lpString=".xlsx") returned 5 [0114.476] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0114.476] lstrlenW (lpString=".ppt") returned 4 [0114.476] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0114.476] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG") returned 76 [0114.476] lstrlenW (lpString=".zip") returned 4 [0114.476] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0114.476] lstrlenW (lpString=".rar") returned 4 [0114.476] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0114.476] lstrlenW (lpString=".bz2") returned 4 [0114.476] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0114.477] lstrlenW (lpString=".7z") returned 3 [0114.477] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0114.477] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG") returned 76 [0114.477] lstrlenW (lpString=".dbf") returned 4 [0114.477] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0114.477] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG") returned 76 [0114.477] lstrlenW (lpString=".1cd") returned 4 [0114.477] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0114.477] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG") returned 76 [0114.477] lstrlenW (lpString=".jpg") returned 4 [0114.477] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0114.477] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG") returned 76 [0114.477] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG") returned 76 [0114.477] lstrlenW (lpString=".doc") returned 4 [0114.477] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0114.477] lstrlenW (lpString=".docx") returned 5 [0114.477] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0114.477] lstrlenW (lpString=".pdf") returned 4 [0114.477] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0114.477] lstrlenW (lpString=".xls") returned 4 [0114.477] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0114.477] lstrlenW (lpString=".xlsx") returned 5 [0114.477] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0114.477] lstrlenW (lpString=".ppt") returned 4 [0114.477] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0114.477] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG") returned 76 [0114.477] lstrlenW (lpString=".zip") returned 4 [0114.477] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0114.477] lstrlenW (lpString=".rar") returned 4 [0114.477] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0114.477] lstrlenW (lpString=".bz2") returned 4 [0114.477] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0114.477] lstrlenW (lpString=".7z") returned 3 [0114.477] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0114.477] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG") returned 76 [0114.478] lstrlenW (lpString=".dbf") returned 4 [0114.478] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0114.478] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG") returned 76 [0114.478] lstrlenW (lpString=".1cd") returned 4 [0114.478] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0114.478] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG") returned 76 [0114.478] lstrlenW (lpString=".jpg") returned 4 [0114.478] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0114.478] lstrcmpiW (lpString1=".GIF", lpString2=".waifu") returned -1 [0114.478] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0114.478] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0114.478] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x26ff9fc | out: lpFileSize=0x26ff9fc*=3970) returned 1 [0114.478] CloseHandle (hObject=0x20c) returned 1 [0114.478] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\preview.gif")) returned 0x20 [0114.479] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\preview.gif.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0114.479] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0114.479] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0114.479] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0114.479] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\preview.gif.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0114.480] GetLastError () returned 0x0 [0114.480] ReadFile (in: hFile=0x20c, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0xf82, lpOverlapped=0x0) returned 1 [0114.481] WriteFile (in: hFile=0x1f0, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xf90, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0xf90, lpOverlapped=0x0) returned 1 [0114.482] ReadFile (in: hFile=0x20c, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x0, lpOverlapped=0x0) returned 1 [0114.482] WriteFile (in: hFile=0x1f0, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0xea, lpOverlapped=0x0) returned 1 [0114.482] SetEndOfFile (hFile=0x1f0) returned 1 [0114.482] CloseHandle (hObject=0x1f0) returned 1 [0114.482] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0114.482] SetEndOfFile (hFile=0x20c) returned 1 [0114.483] CloseHandle (hObject=0x20c) returned 1 [0114.483] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0114.483] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\preview.gif")) returned 1 [0114.483] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned 76 [0114.483] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned 76 [0114.483] lstrlenW (lpString=".doc") returned 4 [0114.483] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0114.483] lstrlenW (lpString=".docx") returned 5 [0114.484] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0114.484] lstrlenW (lpString=".pdf") returned 4 [0114.484] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0114.484] lstrlenW (lpString=".xls") returned 4 [0114.484] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0114.484] lstrlenW (lpString=".xlsx") returned 5 [0114.484] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0114.484] lstrlenW (lpString=".ppt") returned 4 [0114.484] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0114.484] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned 76 [0114.484] lstrlenW (lpString=".zip") returned 4 [0114.484] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0114.484] lstrlenW (lpString=".rar") returned 4 [0114.484] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0114.484] lstrlenW (lpString=".bz2") returned 4 [0114.484] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0114.484] lstrlenW (lpString=".7z") returned 3 [0114.484] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0114.484] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned 76 [0114.484] lstrlenW (lpString=".dbf") returned 4 [0114.484] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0114.484] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned 76 [0114.484] lstrlenW (lpString=".1cd") returned 4 [0114.484] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0114.484] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned 76 [0114.484] lstrlenW (lpString=".jpg") returned 4 [0114.484] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0114.484] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned 76 [0114.484] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned 76 [0114.484] lstrlenW (lpString=".doc") returned 4 [0114.484] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0114.484] lstrlenW (lpString=".docx") returned 5 [0114.484] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0114.484] lstrlenW (lpString=".pdf") returned 4 [0114.484] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0114.484] lstrlenW (lpString=".xls") returned 4 [0114.484] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0114.484] lstrlenW (lpString=".xlsx") returned 5 [0114.484] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0114.484] lstrlenW (lpString=".ppt") returned 4 [0114.484] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0114.484] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned 76 [0114.484] lstrlenW (lpString=".zip") returned 4 [0114.484] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0114.484] lstrlenW (lpString=".rar") returned 4 [0114.484] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0114.484] lstrlenW (lpString=".bz2") returned 4 [0114.484] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0114.484] lstrlenW (lpString=".7z") returned 3 [0114.484] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0114.485] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned 76 [0114.485] lstrlenW (lpString=".dbf") returned 4 [0114.485] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0114.485] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned 76 [0114.485] lstrlenW (lpString=".1cd") returned 4 [0114.485] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0114.485] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned 76 [0114.485] lstrlenW (lpString=".jpg") returned 4 [0114.485] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0114.485] lstrcmpiW (lpString1=".PNG", lpString2=".waifu") returned -1 [0114.485] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0114.485] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0114.485] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x26ff9fc | out: lpFileSize=0x26ff9fc*=53115) returned 1 [0114.485] CloseHandle (hObject=0x20c) returned 1 [0114.485] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\thmbnail.png")) returned 0x20 [0114.486] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\thmbnail.png.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0114.486] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0114.486] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0114.486] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0114.486] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\thmbnail.png.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0114.486] GetLastError () returned 0x0 [0114.486] ReadFile (in: hFile=0x20c, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0xcf7b, lpOverlapped=0x0) returned 1 [0114.489] WriteFile (in: hFile=0x1f0, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xcf80, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0xcf80, lpOverlapped=0x0) returned 1 [0114.490] ReadFile (in: hFile=0x20c, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x0, lpOverlapped=0x0) returned 1 [0114.490] WriteFile (in: hFile=0x1f0, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0xec, lpOverlapped=0x0) returned 1 [0114.490] SetEndOfFile (hFile=0x1f0) returned 1 [0114.491] CloseHandle (hObject=0x1f0) returned 1 [0114.491] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0114.491] SetEndOfFile (hFile=0x20c) returned 1 [0114.496] CloseHandle (hObject=0x20c) returned 1 [0114.496] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0114.497] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\thmbnail.png")) returned 1 [0114.497] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned 77 [0114.497] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned 77 [0114.497] lstrlenW (lpString=".doc") returned 4 [0114.497] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0114.497] lstrlenW (lpString=".docx") returned 5 [0114.497] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0114.497] lstrlenW (lpString=".pdf") returned 4 [0114.497] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0114.497] lstrlenW (lpString=".xls") returned 4 [0114.497] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0114.497] lstrlenW (lpString=".xlsx") returned 5 [0114.497] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0114.497] lstrlenW (lpString=".ppt") returned 4 [0114.497] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0114.497] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned 77 [0114.497] lstrlenW (lpString=".zip") returned 4 [0114.497] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0114.497] lstrlenW (lpString=".rar") returned 4 [0114.497] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0114.497] lstrlenW (lpString=".bz2") returned 4 [0114.497] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0114.497] lstrlenW (lpString=".7z") returned 3 [0114.497] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0114.497] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned 77 [0114.497] lstrlenW (lpString=".dbf") returned 4 [0114.497] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0114.497] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned 77 [0114.497] lstrlenW (lpString=".1cd") returned 4 [0114.497] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0114.497] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned 77 [0114.497] lstrlenW (lpString=".jpg") returned 4 [0114.497] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0114.497] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned 77 [0114.497] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned 77 [0114.497] lstrlenW (lpString=".doc") returned 4 [0114.497] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0114.497] lstrlenW (lpString=".docx") returned 5 [0114.497] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0114.497] lstrlenW (lpString=".pdf") returned 4 [0114.498] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0114.498] lstrlenW (lpString=".xls") returned 4 [0114.498] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0114.498] lstrlenW (lpString=".xlsx") returned 5 [0114.498] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0114.498] lstrlenW (lpString=".ppt") returned 4 [0114.498] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0114.498] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned 77 [0114.498] lstrlenW (lpString=".zip") returned 4 [0114.498] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0114.498] lstrlenW (lpString=".rar") returned 4 [0114.498] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0114.498] lstrlenW (lpString=".bz2") returned 4 [0114.498] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0114.498] lstrlenW (lpString=".7z") returned 3 [0114.498] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0114.498] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned 77 [0114.498] lstrlenW (lpString=".dbf") returned 4 [0114.498] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0114.498] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned 77 [0114.498] lstrlenW (lpString=".1cd") returned 4 [0114.498] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0114.498] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned 77 [0114.498] lstrlenW (lpString=".jpg") returned 4 [0114.498] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0114.498] lstrcmpiW (lpString1=".GIF", lpString2=".waifu") returned -1 [0114.498] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0114.498] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0114.498] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x26ff9fc | out: lpFileSize=0x26ff9fc*=2604) returned 1 [0114.498] CloseHandle (hObject=0x20c) returned 1 [0114.499] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\preview.gif")) returned 0x20 [0114.499] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\preview.gif.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0114.499] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0114.499] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0114.499] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0114.499] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\preview.gif.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0114.500] GetLastError () returned 0x0 [0114.500] ReadFile (in: hFile=0x20c, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0xa2c, lpOverlapped=0x0) returned 1 [0114.501] WriteFile (in: hFile=0x1fc, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xa30, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0xa30, lpOverlapped=0x0) returned 1 [0114.501] ReadFile (in: hFile=0x20c, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x0, lpOverlapped=0x0) returned 1 [0114.502] WriteFile (in: hFile=0x1fc, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0xea, lpOverlapped=0x0) returned 1 [0114.502] SetEndOfFile (hFile=0x1fc) returned 1 [0114.502] CloseHandle (hObject=0x1fc) returned 1 [0114.502] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0114.502] SetEndOfFile (hFile=0x20c) returned 1 [0114.503] CloseHandle (hObject=0x20c) returned 1 [0114.503] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0114.503] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\preview.gif")) returned 1 [0114.503] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF") returned 74 [0114.503] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF") returned 74 [0114.503] lstrlenW (lpString=".doc") returned 4 [0114.503] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0114.503] lstrlenW (lpString=".docx") returned 5 [0114.503] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0114.503] lstrlenW (lpString=".pdf") returned 4 [0114.503] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0114.503] lstrlenW (lpString=".xls") returned 4 [0114.503] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0114.503] lstrlenW (lpString=".xlsx") returned 5 [0114.503] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0114.503] lstrlenW (lpString=".ppt") returned 4 [0114.503] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0114.503] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF") returned 74 [0114.503] lstrlenW (lpString=".zip") returned 4 [0114.503] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0114.503] lstrlenW (lpString=".rar") returned 4 [0114.503] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0114.503] lstrlenW (lpString=".bz2") returned 4 [0114.503] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0114.503] lstrlenW (lpString=".7z") returned 3 [0114.504] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0114.504] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF") returned 74 [0114.504] lstrlenW (lpString=".dbf") returned 4 [0114.504] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0114.504] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF") returned 74 [0114.504] lstrlenW (lpString=".1cd") returned 4 [0114.504] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0114.504] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF") returned 74 [0114.504] lstrlenW (lpString=".jpg") returned 4 [0114.504] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0114.504] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF") returned 74 [0114.504] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF") returned 74 [0114.504] lstrlenW (lpString=".doc") returned 4 [0114.504] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0114.504] lstrlenW (lpString=".docx") returned 5 [0114.504] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0114.504] lstrlenW (lpString=".pdf") returned 4 [0114.504] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0114.504] lstrlenW (lpString=".xls") returned 4 [0114.504] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0114.504] lstrlenW (lpString=".xlsx") returned 5 [0114.504] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0114.504] lstrlenW (lpString=".ppt") returned 4 [0114.504] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0114.504] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF") returned 74 [0114.504] lstrlenW (lpString=".zip") returned 4 [0114.504] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0114.504] lstrlenW (lpString=".rar") returned 4 [0114.504] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0114.504] lstrlenW (lpString=".bz2") returned 4 [0114.504] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0114.504] lstrlenW (lpString=".7z") returned 3 [0114.504] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0114.504] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF") returned 74 [0114.504] lstrlenW (lpString=".dbf") returned 4 [0114.504] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0114.504] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF") returned 74 [0114.504] lstrlenW (lpString=".1cd") returned 4 [0114.504] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0114.504] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF") returned 74 [0114.504] lstrlenW (lpString=".jpg") returned 4 [0114.504] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0114.504] lstrcmpiW (lpString1=".PNG", lpString2=".waifu") returned -1 [0114.504] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0114.505] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0114.505] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x26ff9fc | out: lpFileSize=0x26ff9fc*=31975) returned 1 [0114.505] CloseHandle (hObject=0x20c) returned 1 [0114.505] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\thmbnail.png")) returned 0x20 [0114.505] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\thmbnail.png.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0114.506] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0114.506] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0114.506] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0114.506] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\thmbnail.png.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0114.506] GetLastError () returned 0x0 [0114.506] ReadFile (in: hFile=0x20c, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x7ce7, lpOverlapped=0x0) returned 1 [0114.508] WriteFile (in: hFile=0x1fc, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x7cf0, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0x7cf0, lpOverlapped=0x0) returned 1 [0114.509] ReadFile (in: hFile=0x20c, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x0, lpOverlapped=0x0) returned 1 [0114.509] WriteFile (in: hFile=0x1fc, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0xec, lpOverlapped=0x0) returned 1 [0114.509] SetEndOfFile (hFile=0x1fc) returned 1 [0114.509] CloseHandle (hObject=0x1fc) returned 1 [0114.509] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0114.509] SetEndOfFile (hFile=0x20c) returned 1 [0114.510] CloseHandle (hObject=0x20c) returned 1 [0114.510] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0114.510] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\thmbnail.png")) returned 1 [0114.510] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG") returned 75 [0114.510] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG") returned 75 [0114.510] lstrlenW (lpString=".doc") returned 4 [0114.510] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0114.510] lstrlenW (lpString=".docx") returned 5 [0114.510] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0114.510] lstrlenW (lpString=".pdf") returned 4 [0114.510] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0114.510] lstrlenW (lpString=".xls") returned 4 [0114.510] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0114.510] lstrlenW (lpString=".xlsx") returned 5 [0114.510] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0114.510] lstrlenW (lpString=".ppt") returned 4 [0114.510] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0114.510] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG") returned 75 [0114.510] lstrlenW (lpString=".zip") returned 4 [0114.510] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0114.510] lstrlenW (lpString=".rar") returned 4 [0114.510] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0114.510] lstrlenW (lpString=".bz2") returned 4 [0114.510] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0114.511] lstrlenW (lpString=".7z") returned 3 [0114.511] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0114.511] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG") returned 75 [0114.511] lstrlenW (lpString=".dbf") returned 4 [0114.511] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0114.511] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG") returned 75 [0114.511] lstrlenW (lpString=".1cd") returned 4 [0114.511] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0114.511] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG") returned 75 [0114.511] lstrlenW (lpString=".jpg") returned 4 [0114.511] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0114.511] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG") returned 75 [0114.511] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG") returned 75 [0114.511] lstrlenW (lpString=".doc") returned 4 [0114.511] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0114.511] lstrlenW (lpString=".docx") returned 5 [0114.511] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0114.511] lstrlenW (lpString=".pdf") returned 4 [0114.511] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0114.511] lstrlenW (lpString=".xls") returned 4 [0114.511] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0114.511] lstrlenW (lpString=".xlsx") returned 5 [0114.511] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0114.511] lstrlenW (lpString=".ppt") returned 4 [0114.511] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0114.511] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG") returned 75 [0114.511] lstrlenW (lpString=".zip") returned 4 [0114.511] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0114.511] lstrlenW (lpString=".rar") returned 4 [0114.511] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0114.511] lstrlenW (lpString=".bz2") returned 4 [0114.511] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0114.511] lstrlenW (lpString=".7z") returned 3 [0114.511] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0114.511] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG") returned 75 [0114.511] lstrlenW (lpString=".dbf") returned 4 [0114.511] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0114.511] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG") returned 75 [0114.511] lstrlenW (lpString=".1cd") returned 4 [0114.511] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0114.511] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG") returned 75 [0114.511] lstrlenW (lpString=".jpg") returned 4 [0114.511] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0114.511] lstrcmpiW (lpString1=".GIF", lpString2=".waifu") returned -1 [0114.512] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0114.512] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0114.512] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x26ff9fc | out: lpFileSize=0x26ff9fc*=4100) returned 1 [0114.512] CloseHandle (hObject=0x20c) returned 1 [0114.512] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\preview.gif")) returned 0x20 [0114.512] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\preview.gif.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0114.512] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0114.512] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0114.512] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0114.512] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\preview.gif.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0114.910] GetLastError () returned 0x0 [0114.915] ReadFile (in: hFile=0x20c, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x1004, lpOverlapped=0x0) returned 1 [0114.916] WriteFile (in: hFile=0x1f0, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x1010, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0x1010, lpOverlapped=0x0) returned 1 [0114.917] ReadFile (in: hFile=0x20c, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x0, lpOverlapped=0x0) returned 1 [0114.917] WriteFile (in: hFile=0x1f0, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0xea, lpOverlapped=0x0) returned 1 [0114.917] SetEndOfFile (hFile=0x1f0) returned 1 [0114.917] CloseHandle (hObject=0x1f0) returned 1 [0114.917] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0114.917] SetEndOfFile (hFile=0x20c) returned 1 [0114.918] CloseHandle (hObject=0x20c) returned 1 [0114.918] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0114.918] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\preview.gif")) returned 1 [0114.918] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF") returned 75 [0114.918] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF") returned 75 [0114.918] lstrlenW (lpString=".doc") returned 4 [0114.918] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0114.918] lstrlenW (lpString=".docx") returned 5 [0114.918] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0114.918] lstrlenW (lpString=".pdf") returned 4 [0114.918] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0114.918] lstrlenW (lpString=".xls") returned 4 [0114.918] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0114.918] lstrlenW (lpString=".xlsx") returned 5 [0114.918] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0114.918] lstrlenW (lpString=".ppt") returned 4 [0114.918] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0114.918] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF") returned 75 [0114.918] lstrlenW (lpString=".zip") returned 4 [0114.918] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0114.918] lstrlenW (lpString=".rar") returned 4 [0114.919] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0114.919] lstrlenW (lpString=".bz2") returned 4 [0114.919] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0114.919] lstrlenW (lpString=".7z") returned 3 [0114.919] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0114.919] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF") returned 75 [0114.919] lstrlenW (lpString=".dbf") returned 4 [0114.919] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0114.919] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF") returned 75 [0114.919] lstrlenW (lpString=".1cd") returned 4 [0114.919] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0114.919] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF") returned 75 [0114.919] lstrlenW (lpString=".jpg") returned 4 [0114.919] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0114.919] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF") returned 75 [0114.919] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF") returned 75 [0114.919] lstrlenW (lpString=".doc") returned 4 [0114.919] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0114.919] lstrlenW (lpString=".docx") returned 5 [0114.919] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0114.919] lstrlenW (lpString=".pdf") returned 4 [0114.919] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0114.919] lstrlenW (lpString=".xls") returned 4 [0114.919] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0114.919] lstrlenW (lpString=".xlsx") returned 5 [0114.919] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0114.919] lstrlenW (lpString=".ppt") returned 4 [0114.919] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0114.919] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF") returned 75 [0114.919] lstrlenW (lpString=".zip") returned 4 [0114.919] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0114.919] lstrlenW (lpString=".rar") returned 4 [0114.919] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0114.919] lstrlenW (lpString=".bz2") returned 4 [0114.919] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0114.919] lstrlenW (lpString=".7z") returned 3 [0114.919] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0114.919] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF") returned 75 [0114.919] lstrlenW (lpString=".dbf") returned 4 [0114.919] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0114.919] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF") returned 75 [0114.919] lstrlenW (lpString=".1cd") returned 4 [0114.919] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0114.919] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF") returned 75 [0114.919] lstrlenW (lpString=".jpg") returned 4 [0114.919] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0114.920] lstrcmpiW (lpString1=".PNG", lpString2=".waifu") returned -1 [0114.920] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0114.920] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0115.225] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x26ff9fc | out: lpFileSize=0x26ff9fc*=18380) returned 1 [0115.226] CloseHandle (hObject=0x1c0) returned 1 [0115.226] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\thmbnail.png")) returned 0x20 [0115.226] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\thmbnail.png.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0115.226] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0115.226] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0115.226] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0115.226] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\thmbnail.png.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0115.226] GetLastError () returned 0x0 [0115.227] ReadFile (in: hFile=0x1c0, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x47cc, lpOverlapped=0x0) returned 1 [0115.228] WriteFile (in: hFile=0x20c, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x47d0, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0x47d0, lpOverlapped=0x0) returned 1 [0115.229] ReadFile (in: hFile=0x1c0, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x0, lpOverlapped=0x0) returned 1 [0115.229] WriteFile (in: hFile=0x20c, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0xec, lpOverlapped=0x0) returned 1 [0115.229] SetEndOfFile (hFile=0x20c) returned 1 [0115.229] CloseHandle (hObject=0x20c) returned 1 [0115.229] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0115.229] SetEndOfFile (hFile=0x1c0) returned 1 [0115.230] CloseHandle (hObject=0x1c0) returned 1 [0115.230] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0115.230] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\thmbnail.png")) returned 1 [0115.230] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG") returned 75 [0115.230] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG") returned 75 [0115.230] lstrlenW (lpString=".doc") returned 4 [0115.230] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0115.230] lstrlenW (lpString=".docx") returned 5 [0115.231] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0115.231] lstrlenW (lpString=".pdf") returned 4 [0115.231] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0115.231] lstrlenW (lpString=".xls") returned 4 [0115.231] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0115.231] lstrlenW (lpString=".xlsx") returned 5 [0115.231] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0115.231] lstrlenW (lpString=".ppt") returned 4 [0115.231] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0115.231] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG") returned 75 [0115.231] lstrlenW (lpString=".zip") returned 4 [0115.231] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0115.231] lstrlenW (lpString=".rar") returned 4 [0115.231] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0115.231] lstrlenW (lpString=".bz2") returned 4 [0115.231] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0115.231] lstrlenW (lpString=".7z") returned 3 [0115.231] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0115.231] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG") returned 75 [0115.231] lstrlenW (lpString=".dbf") returned 4 [0115.231] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0115.231] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG") returned 75 [0115.231] lstrlenW (lpString=".1cd") returned 4 [0115.231] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0115.231] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG") returned 75 [0115.231] lstrlenW (lpString=".jpg") returned 4 [0115.231] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0115.231] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG") returned 75 [0115.231] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG") returned 75 [0115.231] lstrlenW (lpString=".doc") returned 4 [0115.231] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0115.231] lstrlenW (lpString=".docx") returned 5 [0115.231] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0115.231] lstrlenW (lpString=".pdf") returned 4 [0115.231] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0115.231] lstrlenW (lpString=".xls") returned 4 [0115.231] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0115.231] lstrlenW (lpString=".xlsx") returned 5 [0115.231] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0115.231] lstrlenW (lpString=".ppt") returned 4 [0115.231] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0115.231] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG") returned 75 [0115.231] lstrlenW (lpString=".zip") returned 4 [0115.231] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0115.231] lstrlenW (lpString=".rar") returned 4 [0115.231] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0115.231] lstrlenW (lpString=".bz2") returned 4 [0115.231] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0115.231] lstrlenW (lpString=".7z") returned 3 [0115.231] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0115.231] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG") returned 75 [0115.231] lstrlenW (lpString=".dbf") returned 4 [0115.231] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0115.232] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG") returned 75 [0115.232] lstrlenW (lpString=".1cd") returned 4 [0115.232] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0115.232] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG") returned 75 [0115.232] lstrlenW (lpString=".jpg") returned 4 [0115.232] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0115.232] lstrcmpiW (lpString1=".CHM", lpString2=".waifu") returned -1 [0115.232] lstrlenW (lpString="VBCN6.CHM") returned 9 [0115.232] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbcn6.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0115.232] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x26ff9fc | out: lpFileSize=0x26ff9fc*=109718) returned 1 [0115.232] CloseHandle (hObject=0x1c0) returned 1 [0115.232] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbcn6.chm")) returned 0x20 [0115.232] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbcn6.chm.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0115.232] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbcn6.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0115.232] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0115.232] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0115.232] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbcn6.chm.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0115.233] GetLastError () returned 0x0 [0115.233] ReadFile (in: hFile=0x1c0, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x1ac96, lpOverlapped=0x0) returned 1 [0115.238] WriteFile (in: hFile=0x20c, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x1aca0, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0x1aca0, lpOverlapped=0x0) returned 1 [0115.239] ReadFile (in: hFile=0x1c0, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x0, lpOverlapped=0x0) returned 1 [0115.239] WriteFile (in: hFile=0x20c, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0xe6, lpOverlapped=0x0) returned 1 [0115.239] SetEndOfFile (hFile=0x20c) returned 1 [0115.239] CloseHandle (hObject=0x20c) returned 1 [0115.239] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0115.239] SetEndOfFile (hFile=0x1c0) returned 1 [0115.240] CloseHandle (hObject=0x1c0) returned 1 [0115.240] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0115.240] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbcn6.chm")) returned 1 [0115.240] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM") returned 70 [0115.241] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM") returned 70 [0115.241] lstrlenW (lpString=".doc") returned 4 [0115.241] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0115.241] lstrlenW (lpString=".docx") returned 5 [0115.241] lstrcmpiW (lpString1=".docx", lpString2="6.CHM") returned -1 [0115.241] lstrlenW (lpString=".pdf") returned 4 [0115.241] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0115.241] lstrlenW (lpString=".xls") returned 4 [0115.241] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0115.241] lstrlenW (lpString=".xlsx") returned 5 [0115.241] lstrcmpiW (lpString1=".xlsx", lpString2="6.CHM") returned -1 [0115.241] lstrlenW (lpString=".ppt") returned 4 [0115.241] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0115.241] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM") returned 70 [0115.241] lstrlenW (lpString=".zip") returned 4 [0115.241] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0115.241] lstrlenW (lpString=".rar") returned 4 [0115.241] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0115.241] lstrlenW (lpString=".bz2") returned 4 [0115.241] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0115.241] lstrlenW (lpString=".7z") returned 3 [0115.241] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0115.241] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM") returned 70 [0115.241] lstrlenW (lpString=".dbf") returned 4 [0115.241] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0115.241] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM") returned 70 [0115.241] lstrlenW (lpString=".1cd") returned 4 [0115.241] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0115.241] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM") returned 70 [0115.241] lstrlenW (lpString=".jpg") returned 4 [0115.241] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0115.241] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM") returned 70 [0115.241] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM") returned 70 [0115.241] lstrlenW (lpString=".doc") returned 4 [0115.241] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0115.241] lstrlenW (lpString=".docx") returned 5 [0115.241] lstrcmpiW (lpString1=".docx", lpString2="6.CHM") returned -1 [0115.241] lstrlenW (lpString=".pdf") returned 4 [0115.241] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0115.241] lstrlenW (lpString=".xls") returned 4 [0115.241] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0115.241] lstrlenW (lpString=".xlsx") returned 5 [0115.241] lstrcmpiW (lpString1=".xlsx", lpString2="6.CHM") returned -1 [0115.241] lstrlenW (lpString=".ppt") returned 4 [0115.241] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0115.241] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM") returned 70 [0115.241] lstrlenW (lpString=".zip") returned 4 [0115.241] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0115.241] lstrlenW (lpString=".rar") returned 4 [0115.241] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0115.241] lstrlenW (lpString=".bz2") returned 4 [0115.242] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0115.242] lstrlenW (lpString=".7z") returned 3 [0115.242] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0115.242] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM") returned 70 [0115.242] lstrlenW (lpString=".dbf") returned 4 [0115.242] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0115.242] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM") returned 70 [0115.242] lstrlenW (lpString=".1cd") returned 4 [0115.242] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0115.242] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM") returned 70 [0115.242] lstrlenW (lpString=".jpg") returned 4 [0115.242] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0115.242] lstrcmpiW (lpString1=".CHM", lpString2=".waifu") returned -1 [0115.242] lstrlenW (lpString="VBENDF98.CHM") returned 12 [0115.242] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbendf98.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0115.243] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x26ff9fc | out: lpFileSize=0x26ff9fc*=72031) returned 1 [0115.243] CloseHandle (hObject=0x1c0) returned 1 [0115.243] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbendf98.chm")) returned 0x20 [0115.243] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbendf98.chm.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0115.243] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbendf98.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0115.243] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0115.243] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0115.243] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbendf98.chm.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0115.243] GetLastError () returned 0x0 [0115.243] ReadFile (in: hFile=0x1c0, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x1195f, lpOverlapped=0x0) returned 1 [0115.245] WriteFile (in: hFile=0x20c, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x11960, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0x11960, lpOverlapped=0x0) returned 1 [0115.246] ReadFile (in: hFile=0x1c0, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x0, lpOverlapped=0x0) returned 1 [0115.246] WriteFile (in: hFile=0x20c, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0xec, lpOverlapped=0x0) returned 1 [0115.246] SetEndOfFile (hFile=0x20c) returned 1 [0115.246] CloseHandle (hObject=0x20c) returned 1 [0115.246] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0115.247] SetEndOfFile (hFile=0x1c0) returned 1 [0115.247] CloseHandle (hObject=0x1c0) returned 1 [0115.247] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0115.247] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbendf98.chm")) returned 1 [0115.247] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM") returned 73 [0115.248] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM") returned 73 [0115.248] lstrlenW (lpString=".doc") returned 4 [0115.248] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0115.248] lstrlenW (lpString=".docx") returned 5 [0115.248] lstrcmpiW (lpString1=".docx", lpString2="8.CHM") returned -1 [0115.248] lstrlenW (lpString=".pdf") returned 4 [0115.248] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0115.248] lstrlenW (lpString=".xls") returned 4 [0115.248] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0115.248] lstrlenW (lpString=".xlsx") returned 5 [0115.248] lstrcmpiW (lpString1=".xlsx", lpString2="8.CHM") returned -1 [0115.248] lstrlenW (lpString=".ppt") returned 4 [0115.248] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0115.248] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM") returned 73 [0115.248] lstrlenW (lpString=".zip") returned 4 [0115.248] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0115.248] lstrlenW (lpString=".rar") returned 4 [0115.248] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0115.248] lstrlenW (lpString=".bz2") returned 4 [0115.248] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0115.248] lstrlenW (lpString=".7z") returned 3 [0115.248] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0115.248] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM") returned 73 [0115.248] lstrlenW (lpString=".dbf") returned 4 [0115.248] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0115.248] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM") returned 73 [0115.248] lstrlenW (lpString=".1cd") returned 4 [0115.248] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0115.248] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM") returned 73 [0115.248] lstrlenW (lpString=".jpg") returned 4 [0115.248] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0115.248] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM") returned 73 [0115.248] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM") returned 73 [0115.248] lstrlenW (lpString=".doc") returned 4 [0115.248] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0115.248] lstrlenW (lpString=".docx") returned 5 [0115.248] lstrcmpiW (lpString1=".docx", lpString2="8.CHM") returned -1 [0115.248] lstrlenW (lpString=".pdf") returned 4 [0115.248] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0115.248] lstrlenW (lpString=".xls") returned 4 [0115.248] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0115.248] lstrlenW (lpString=".xlsx") returned 5 [0115.248] lstrcmpiW (lpString1=".xlsx", lpString2="8.CHM") returned -1 [0115.248] lstrlenW (lpString=".ppt") returned 4 [0115.248] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0115.248] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM") returned 73 [0115.248] lstrlenW (lpString=".zip") returned 4 [0115.248] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0115.248] lstrlenW (lpString=".rar") returned 4 [0115.248] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0115.248] lstrlenW (lpString=".bz2") returned 4 [0115.249] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0115.249] lstrlenW (lpString=".7z") returned 3 [0115.249] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0115.249] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM") returned 73 [0115.249] lstrlenW (lpString=".dbf") returned 4 [0115.249] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0115.249] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM") returned 73 [0115.249] lstrlenW (lpString=".1cd") returned 4 [0115.249] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0115.249] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM") returned 73 [0115.249] lstrlenW (lpString=".jpg") returned 4 [0115.249] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0115.249] lstrcmpiW (lpString1=".CHM", lpString2=".waifu") returned -1 [0115.249] lstrlenW (lpString="VBHW6.CHM") returned 9 [0115.249] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbhw6.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0115.249] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x26ff9fc | out: lpFileSize=0x26ff9fc*=58026) returned 1 [0115.249] CloseHandle (hObject=0x1c0) returned 1 [0115.249] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbhw6.chm")) returned 0x20 [0115.249] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbhw6.chm.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0115.249] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbhw6.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0115.249] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0115.249] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0115.249] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbhw6.chm.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0115.250] GetLastError () returned 0x0 [0115.250] ReadFile (in: hFile=0x1c0, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0xe2aa, lpOverlapped=0x0) returned 1 [0115.251] WriteFile (in: hFile=0x20c, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xe2b0, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0xe2b0, lpOverlapped=0x0) returned 1 [0115.253] ReadFile (in: hFile=0x1c0, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x0, lpOverlapped=0x0) returned 1 [0115.253] WriteFile (in: hFile=0x20c, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0xe6, lpOverlapped=0x0) returned 1 [0115.253] SetEndOfFile (hFile=0x20c) returned 1 [0115.253] CloseHandle (hObject=0x20c) returned 1 [0115.253] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0115.253] SetEndOfFile (hFile=0x1c0) returned 1 [0115.254] CloseHandle (hObject=0x1c0) returned 1 [0115.254] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0115.254] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbhw6.chm")) returned 1 [0115.254] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM") returned 70 [0115.254] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM") returned 70 [0115.254] lstrlenW (lpString=".doc") returned 4 [0115.254] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0115.254] lstrlenW (lpString=".docx") returned 5 [0115.254] lstrcmpiW (lpString1=".docx", lpString2="6.CHM") returned -1 [0115.254] lstrlenW (lpString=".pdf") returned 4 [0115.254] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0115.254] lstrlenW (lpString=".xls") returned 4 [0115.254] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0115.254] lstrlenW (lpString=".xlsx") returned 5 [0115.254] lstrcmpiW (lpString1=".xlsx", lpString2="6.CHM") returned -1 [0115.254] lstrlenW (lpString=".ppt") returned 4 [0115.254] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0115.254] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM") returned 70 [0115.254] lstrlenW (lpString=".zip") returned 4 [0115.254] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0115.254] lstrlenW (lpString=".rar") returned 4 [0115.254] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0115.254] lstrlenW (lpString=".bz2") returned 4 [0115.254] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0115.254] lstrlenW (lpString=".7z") returned 3 [0115.254] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0115.254] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM") returned 70 [0115.254] lstrlenW (lpString=".dbf") returned 4 [0115.254] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0115.255] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM") returned 70 [0115.255] lstrlenW (lpString=".1cd") returned 4 [0115.255] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0115.255] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM") returned 70 [0115.255] lstrlenW (lpString=".jpg") returned 4 [0115.255] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0115.255] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM") returned 70 [0115.255] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM") returned 70 [0115.255] lstrlenW (lpString=".doc") returned 4 [0115.255] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0115.255] lstrlenW (lpString=".docx") returned 5 [0115.255] lstrcmpiW (lpString1=".docx", lpString2="6.CHM") returned -1 [0115.255] lstrlenW (lpString=".pdf") returned 4 [0115.255] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0115.255] lstrlenW (lpString=".xls") returned 4 [0115.255] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0115.255] lstrlenW (lpString=".xlsx") returned 5 [0115.255] lstrcmpiW (lpString1=".xlsx", lpString2="6.CHM") returned -1 [0115.255] lstrlenW (lpString=".ppt") returned 4 [0115.255] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0115.255] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM") returned 70 [0115.255] lstrlenW (lpString=".zip") returned 4 [0115.255] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0115.255] lstrlenW (lpString=".rar") returned 4 [0115.255] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0115.255] lstrlenW (lpString=".bz2") returned 4 [0115.255] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0115.255] lstrlenW (lpString=".7z") returned 3 [0115.255] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0115.255] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM") returned 70 [0115.255] lstrlenW (lpString=".dbf") returned 4 [0115.255] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0115.255] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM") returned 70 [0115.255] lstrlenW (lpString=".1cd") returned 4 [0115.255] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0115.255] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM") returned 70 [0115.255] lstrlenW (lpString=".jpg") returned 4 [0115.255] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0115.255] lstrcmpiW (lpString1=".CHM", lpString2=".waifu") returned -1 [0115.255] lstrlenW (lpString="VBLR6.CHM") returned 9 [0115.255] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vblr6.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0115.256] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x26ff9fc | out: lpFileSize=0x26ff9fc*=944994) returned 1 [0115.256] CloseHandle (hObject=0x1c0) returned 1 [0115.256] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vblr6.chm")) returned 0x20 [0115.256] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vblr6.chm.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0115.256] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vblr6.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0115.256] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0115.256] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0115.256] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vblr6.chm.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0115.256] GetLastError () returned 0x0 [0115.256] ReadFile (in: hFile=0x1c0, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0xe6b62, lpOverlapped=0x0) returned 1 [0115.271] WriteFile (in: hFile=0x20c, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xe6b70, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0xe6b70, lpOverlapped=0x0) returned 1 [0115.278] ReadFile (in: hFile=0x1c0, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x0, lpOverlapped=0x0) returned 1 [0115.278] WriteFile (in: hFile=0x20c, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0xe6, lpOverlapped=0x0) returned 1 [0115.279] SetEndOfFile (hFile=0x20c) returned 1 [0115.279] CloseHandle (hObject=0x20c) returned 1 [0115.279] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0115.279] SetEndOfFile (hFile=0x1c0) returned 1 [0115.281] CloseHandle (hObject=0x1c0) returned 1 [0115.281] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0115.281] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vblr6.chm")) returned 1 [0115.282] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM") returned 70 [0115.282] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM") returned 70 [0115.282] lstrlenW (lpString=".doc") returned 4 [0115.282] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0115.282] lstrlenW (lpString=".docx") returned 5 [0115.282] lstrcmpiW (lpString1=".docx", lpString2="6.CHM") returned -1 [0115.282] lstrlenW (lpString=".pdf") returned 4 [0115.282] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0115.282] lstrlenW (lpString=".xls") returned 4 [0115.282] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0115.282] lstrlenW (lpString=".xlsx") returned 5 [0115.282] lstrcmpiW (lpString1=".xlsx", lpString2="6.CHM") returned -1 [0115.282] lstrlenW (lpString=".ppt") returned 4 [0115.282] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0115.282] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM") returned 70 [0115.282] lstrlenW (lpString=".zip") returned 4 [0115.282] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0115.282] lstrlenW (lpString=".rar") returned 4 [0115.282] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0115.282] lstrlenW (lpString=".bz2") returned 4 [0115.282] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0115.282] lstrlenW (lpString=".7z") returned 3 [0115.282] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0115.282] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM") returned 70 [0115.282] lstrlenW (lpString=".dbf") returned 4 [0115.282] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0115.282] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM") returned 70 [0115.282] lstrlenW (lpString=".1cd") returned 4 [0115.282] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0115.282] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM") returned 70 [0115.282] lstrlenW (lpString=".jpg") returned 4 [0115.282] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0115.282] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM") returned 70 [0115.282] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM") returned 70 [0115.282] lstrlenW (lpString=".doc") returned 4 [0115.282] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0115.282] lstrlenW (lpString=".docx") returned 5 [0115.282] lstrcmpiW (lpString1=".docx", lpString2="6.CHM") returned -1 [0115.282] lstrlenW (lpString=".pdf") returned 4 [0115.282] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0115.282] lstrlenW (lpString=".xls") returned 4 [0115.282] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0115.282] lstrlenW (lpString=".xlsx") returned 5 [0115.282] lstrcmpiW (lpString1=".xlsx", lpString2="6.CHM") returned -1 [0115.282] lstrlenW (lpString=".ppt") returned 4 [0115.282] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0115.282] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM") returned 70 [0115.282] lstrlenW (lpString=".zip") returned 4 [0115.282] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0115.283] lstrlenW (lpString=".rar") returned 4 [0115.283] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0115.283] lstrlenW (lpString=".bz2") returned 4 [0115.283] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0115.283] lstrlenW (lpString=".7z") returned 3 [0115.283] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0115.283] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM") returned 70 [0115.283] lstrlenW (lpString=".dbf") returned 4 [0115.283] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0115.283] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM") returned 70 [0115.283] lstrlenW (lpString=".1cd") returned 4 [0115.283] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0115.283] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM") returned 70 [0115.283] lstrlenW (lpString=".jpg") returned 4 [0115.283] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0115.283] lstrcmpiW (lpString1=".CHM", lpString2=".waifu") returned -1 [0115.283] lstrlenW (lpString="VBOB6.CHM") returned 9 [0115.283] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbob6.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0115.283] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x26ff9fc | out: lpFileSize=0x26ff9fc*=123956) returned 1 [0115.283] CloseHandle (hObject=0x1c0) returned 1 [0115.283] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbob6.chm")) returned 0x20 [0115.283] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbob6.chm.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0115.283] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbob6.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0115.284] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0115.284] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0115.284] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbob6.chm.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0115.284] GetLastError () returned 0x0 [0115.284] ReadFile (in: hFile=0x1c0, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x1e434, lpOverlapped=0x0) returned 1 [0115.287] WriteFile (in: hFile=0x20c, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x1e440, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0x1e440, lpOverlapped=0x0) returned 1 [0115.288] ReadFile (in: hFile=0x1c0, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x0, lpOverlapped=0x0) returned 1 [0115.288] WriteFile (in: hFile=0x20c, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0xe6, lpOverlapped=0x0) returned 1 [0115.288] SetEndOfFile (hFile=0x20c) returned 1 [0115.289] CloseHandle (hObject=0x20c) returned 1 [0115.289] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0115.289] SetEndOfFile (hFile=0x1c0) returned 1 [0115.289] CloseHandle (hObject=0x1c0) returned 1 [0115.289] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0115.290] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbob6.chm")) returned 1 [0115.290] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM") returned 70 [0115.290] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM") returned 70 [0115.290] lstrlenW (lpString=".doc") returned 4 [0115.290] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0115.290] lstrlenW (lpString=".docx") returned 5 [0115.290] lstrcmpiW (lpString1=".docx", lpString2="6.CHM") returned -1 [0115.290] lstrlenW (lpString=".pdf") returned 4 [0115.290] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0115.290] lstrlenW (lpString=".xls") returned 4 [0115.290] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0115.290] lstrlenW (lpString=".xlsx") returned 5 [0115.290] lstrcmpiW (lpString1=".xlsx", lpString2="6.CHM") returned -1 [0115.290] lstrlenW (lpString=".ppt") returned 4 [0115.290] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0115.290] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM") returned 70 [0115.290] lstrlenW (lpString=".zip") returned 4 [0115.290] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0115.290] lstrlenW (lpString=".rar") returned 4 [0115.290] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0115.290] lstrlenW (lpString=".bz2") returned 4 [0115.290] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0115.290] lstrlenW (lpString=".7z") returned 3 [0115.290] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0115.290] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM") returned 70 [0115.290] lstrlenW (lpString=".dbf") returned 4 [0115.290] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0115.290] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM") returned 70 [0115.290] lstrlenW (lpString=".1cd") returned 4 [0115.290] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0115.290] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM") returned 70 [0115.290] lstrlenW (lpString=".jpg") returned 4 [0115.290] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0115.290] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM") returned 70 [0115.290] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM") returned 70 [0115.290] lstrlenW (lpString=".doc") returned 4 [0115.290] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0115.290] lstrlenW (lpString=".docx") returned 5 [0115.290] lstrcmpiW (lpString1=".docx", lpString2="6.CHM") returned -1 [0115.290] lstrlenW (lpString=".pdf") returned 4 [0115.290] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0115.290] lstrlenW (lpString=".xls") returned 4 [0115.290] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0115.291] lstrlenW (lpString=".xlsx") returned 5 [0115.291] lstrcmpiW (lpString1=".xlsx", lpString2="6.CHM") returned -1 [0115.291] lstrlenW (lpString=".ppt") returned 4 [0115.291] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0115.291] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM") returned 70 [0115.291] lstrlenW (lpString=".zip") returned 4 [0115.291] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0115.291] lstrlenW (lpString=".rar") returned 4 [0115.291] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0115.291] lstrlenW (lpString=".bz2") returned 4 [0115.291] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0115.291] lstrlenW (lpString=".7z") returned 3 [0115.291] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0115.291] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM") returned 70 [0115.291] lstrlenW (lpString=".dbf") returned 4 [0115.291] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0115.291] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM") returned 70 [0115.291] lstrlenW (lpString=".1cd") returned 4 [0115.291] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0115.291] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM") returned 70 [0115.291] lstrlenW (lpString=".jpg") returned 4 [0115.291] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0115.291] lstrcmpiW (lpString1=".CHM", lpString2=".waifu") returned -1 [0115.291] lstrlenW (lpString="VBUI6.CHM") returned 9 [0115.291] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbui6.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0115.292] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x26ff9fc | out: lpFileSize=0x26ff9fc*=416918) returned 1 [0115.292] CloseHandle (hObject=0x1c0) returned 1 [0115.292] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbui6.chm")) returned 0x20 [0115.292] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbui6.chm.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0115.292] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbui6.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0115.292] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0115.292] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0115.292] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbui6.chm.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0115.292] GetLastError () returned 0x0 [0115.292] ReadFile (in: hFile=0x1c0, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x65c96, lpOverlapped=0x0) returned 1 [0115.300] WriteFile (in: hFile=0x20c, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x65ca0, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0x65ca0, lpOverlapped=0x0) returned 1 [0115.304] ReadFile (in: hFile=0x1c0, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x0, lpOverlapped=0x0) returned 1 [0115.304] WriteFile (in: hFile=0x20c, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0xe6, lpOverlapped=0x0) returned 1 [0115.304] SetEndOfFile (hFile=0x20c) returned 1 [0115.304] CloseHandle (hObject=0x20c) returned 1 [0115.304] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0115.304] SetEndOfFile (hFile=0x1c0) returned 1 [0115.306] CloseHandle (hObject=0x1c0) returned 1 [0115.306] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0115.306] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbui6.chm")) returned 1 [0115.306] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM") returned 70 [0115.306] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM") returned 70 [0115.306] lstrlenW (lpString=".doc") returned 4 [0115.306] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0115.306] lstrlenW (lpString=".docx") returned 5 [0115.306] lstrcmpiW (lpString1=".docx", lpString2="6.CHM") returned -1 [0115.306] lstrlenW (lpString=".pdf") returned 4 [0115.306] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0115.306] lstrlenW (lpString=".xls") returned 4 [0115.306] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0115.306] lstrlenW (lpString=".xlsx") returned 5 [0115.306] lstrcmpiW (lpString1=".xlsx", lpString2="6.CHM") returned -1 [0115.306] lstrlenW (lpString=".ppt") returned 4 [0115.306] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0115.306] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM") returned 70 [0115.306] lstrlenW (lpString=".zip") returned 4 [0115.306] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0115.306] lstrlenW (lpString=".rar") returned 4 [0115.306] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0115.306] lstrlenW (lpString=".bz2") returned 4 [0115.306] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0115.306] lstrlenW (lpString=".7z") returned 3 [0115.306] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0115.306] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM") returned 70 [0115.306] lstrlenW (lpString=".dbf") returned 4 [0115.307] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0115.307] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM") returned 70 [0115.307] lstrlenW (lpString=".1cd") returned 4 [0115.307] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0115.307] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM") returned 70 [0115.307] lstrlenW (lpString=".jpg") returned 4 [0115.307] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0115.307] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM") returned 70 [0115.307] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM") returned 70 [0115.307] lstrlenW (lpString=".doc") returned 4 [0115.307] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0115.307] lstrlenW (lpString=".docx") returned 5 [0115.307] lstrcmpiW (lpString1=".docx", lpString2="6.CHM") returned -1 [0115.307] lstrlenW (lpString=".pdf") returned 4 [0115.307] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0115.307] lstrlenW (lpString=".xls") returned 4 [0115.307] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0115.307] lstrlenW (lpString=".xlsx") returned 5 [0115.307] lstrcmpiW (lpString1=".xlsx", lpString2="6.CHM") returned -1 [0115.307] lstrlenW (lpString=".ppt") returned 4 [0115.307] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0115.307] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM") returned 70 [0115.307] lstrlenW (lpString=".zip") returned 4 [0115.307] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0115.307] lstrlenW (lpString=".rar") returned 4 [0115.307] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0115.307] lstrlenW (lpString=".bz2") returned 4 [0115.307] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0115.307] lstrlenW (lpString=".7z") returned 3 [0115.307] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0115.307] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM") returned 70 [0115.307] lstrlenW (lpString=".dbf") returned 4 [0115.307] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0115.307] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM") returned 70 [0115.307] lstrlenW (lpString=".1cd") returned 4 [0115.307] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0115.307] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM") returned 70 [0115.307] lstrlenW (lpString=".jpg") returned 4 [0115.307] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0115.309] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0115.309] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0115.309] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.config.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0115.309] GetLastError () returned 0x0 [0115.309] ReadFile (in: hFile=0x1c0, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x2cc, lpOverlapped=0x0) returned 1 [0115.310] WriteFile (in: hFile=0x20c, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0x2d0, lpOverlapped=0x0) returned 1 [0115.311] ReadFile (in: hFile=0x1c0, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x0, lpOverlapped=0x0) returned 1 [0115.311] WriteFile (in: hFile=0x20c, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0xfc, lpOverlapped=0x0) returned 1 [0115.311] SetEndOfFile (hFile=0x20c) returned 1 [0115.311] CloseHandle (hObject=0x20c) returned 1 [0115.311] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0115.311] SetEndOfFile (hFile=0x1c0) returned 1 [0115.311] CloseHandle (hObject=0x1c0) returned 1 [0115.312] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0115.312] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.config")) returned 1 [0115.312] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config") returned 77 [0115.312] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config") returned 77 [0115.312] lstrlenW (lpString=".doc") returned 4 [0115.312] lstrcmpiW (lpString1=".doc", lpString2="nfig") returned -1 [0115.312] lstrlenW (lpString=".docx") returned 5 [0115.312] lstrcmpiW (lpString1=".docx", lpString2="onfig") returned -1 [0115.312] lstrlenW (lpString=".pdf") returned 4 [0115.312] lstrcmpiW (lpString1=".pdf", lpString2="nfig") returned -1 [0115.312] lstrlenW (lpString=".xls") returned 4 [0115.312] lstrcmpiW (lpString1=".xls", lpString2="nfig") returned -1 [0115.312] lstrlenW (lpString=".xlsx") returned 5 [0115.312] lstrcmpiW (lpString1=".xlsx", lpString2="onfig") returned -1 [0115.312] lstrlenW (lpString=".ppt") returned 4 [0115.312] lstrcmpiW (lpString1=".ppt", lpString2="nfig") returned -1 [0115.312] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config") returned 77 [0115.312] lstrlenW (lpString=".zip") returned 4 [0115.312] lstrcmpiW (lpString1=".zip", lpString2="nfig") returned -1 [0115.312] lstrlenW (lpString=".rar") returned 4 [0115.312] lstrcmpiW (lpString1=".rar", lpString2="nfig") returned -1 [0115.312] lstrlenW (lpString=".bz2") returned 4 [0115.313] lstrcmpiW (lpString1=".bz2", lpString2="nfig") returned -1 [0115.313] lstrlenW (lpString=".7z") returned 3 [0115.313] lstrcmpiW (lpString1=".7z", lpString2="fig") returned -1 [0115.313] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config") returned 77 [0115.313] lstrlenW (lpString=".dbf") returned 4 [0115.313] lstrcmpiW (lpString1=".dbf", lpString2="nfig") returned -1 [0115.313] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config") returned 77 [0115.313] lstrlenW (lpString=".1cd") returned 4 [0115.313] lstrcmpiW (lpString1=".1cd", lpString2="nfig") returned -1 [0115.313] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config") returned 77 [0115.313] lstrlenW (lpString=".jpg") returned 4 [0115.313] lstrcmpiW (lpString1=".jpg", lpString2="nfig") returned -1 [0115.313] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0115.313] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0115.313] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\1033\\fpext.msg.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0115.314] GetLastError () returned 0x0 [0115.314] ReadFile (in: hFile=0x1c0, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x296a5, lpOverlapped=0x0) returned 1 [0115.317] WriteFile (in: hFile=0x20c, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x296b0, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0x296b0, lpOverlapped=0x0) returned 1 [0115.319] ReadFile (in: hFile=0x1c0, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x0, lpOverlapped=0x0) returned 1 [0115.319] WriteFile (in: hFile=0x20c, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0xe6, lpOverlapped=0x0) returned 1 [0115.319] SetEndOfFile (hFile=0x20c) returned 1 [0115.319] CloseHandle (hObject=0x20c) returned 1 [0115.319] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0115.319] SetEndOfFile (hFile=0x1c0) returned 1 [0115.320] CloseHandle (hObject=0x1c0) returned 1 [0115.320] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0115.320] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\1033\\fpext.msg")) returned 1 [0115.320] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG") returned 90 [0115.320] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG") returned 90 [0115.320] lstrlenW (lpString=".doc") returned 4 [0115.320] lstrcmpiW (lpString1=".doc", lpString2=".MSG") returned -1 [0115.320] lstrlenW (lpString=".docx") returned 5 [0115.320] lstrcmpiW (lpString1=".docx", lpString2="T.MSG") returned -1 [0115.320] lstrlenW (lpString=".pdf") returned 4 [0115.320] lstrcmpiW (lpString1=".pdf", lpString2=".MSG") returned 1 [0115.320] lstrlenW (lpString=".xls") returned 4 [0115.320] lstrcmpiW (lpString1=".xls", lpString2=".MSG") returned 1 [0115.320] lstrlenW (lpString=".xlsx") returned 5 [0115.321] lstrcmpiW (lpString1=".xlsx", lpString2="T.MSG") returned -1 [0115.321] lstrlenW (lpString=".ppt") returned 4 [0115.321] lstrcmpiW (lpString1=".ppt", lpString2=".MSG") returned 1 [0115.321] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG") returned 90 [0115.321] lstrlenW (lpString=".zip") returned 4 [0115.321] lstrcmpiW (lpString1=".zip", lpString2=".MSG") returned 1 [0115.321] lstrlenW (lpString=".rar") returned 4 [0115.321] lstrcmpiW (lpString1=".rar", lpString2=".MSG") returned 1 [0115.321] lstrlenW (lpString=".bz2") returned 4 [0115.321] lstrcmpiW (lpString1=".bz2", lpString2=".MSG") returned -1 [0115.321] lstrlenW (lpString=".7z") returned 3 [0115.321] lstrcmpiW (lpString1=".7z", lpString2="MSG") returned -1 [0115.321] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG") returned 90 [0115.321] lstrlenW (lpString=".dbf") returned 4 [0115.321] lstrcmpiW (lpString1=".dbf", lpString2=".MSG") returned -1 [0115.321] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG") returned 90 [0115.321] lstrlenW (lpString=".1cd") returned 4 [0115.321] lstrcmpiW (lpString1=".1cd", lpString2=".MSG") returned -1 [0115.321] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG") returned 90 [0115.321] lstrlenW (lpString=".jpg") returned 4 [0115.321] lstrcmpiW (lpString1=".jpg", lpString2=".MSG") returned -1 [0115.325] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0115.325] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0115.325] CreateFileW (lpFileName="C:\\Program Files\\desktop.ini.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\desktop.ini.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0115.325] GetLastError () returned 0x0 [0115.325] ReadFile (in: hFile=0x1c0, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0xae, lpOverlapped=0x0) returned 1 [0115.326] WriteFile (in: hFile=0x20c, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0xb0, lpOverlapped=0x0) returned 1 [0115.327] ReadFile (in: hFile=0x1c0, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x0, lpOverlapped=0x0) returned 1 [0115.327] WriteFile (in: hFile=0x20c, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0xea, lpOverlapped=0x0) returned 1 [0115.327] SetEndOfFile (hFile=0x20c) returned 1 [0115.327] CloseHandle (hObject=0x20c) returned 1 [0115.327] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0115.327] SetEndOfFile (hFile=0x1c0) returned 1 [0115.328] CloseHandle (hObject=0x1c0) returned 1 [0115.328] SetFileAttributesW (lpFileName="C:\\Program Files\\desktop.ini.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x26) returned 1 [0115.328] DeleteFileW (lpFileName="C:\\Program Files\\desktop.ini" (normalized: "c:\\program files\\desktop.ini")) returned 1 [0115.328] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0115.328] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0115.328] lstrlenW (lpString=".doc") returned 4 [0115.328] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0115.328] lstrlenW (lpString=".docx") returned 5 [0115.328] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0115.328] lstrlenW (lpString=".pdf") returned 4 [0115.328] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0115.328] lstrlenW (lpString=".xls") returned 4 [0115.328] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0115.328] lstrlenW (lpString=".xlsx") returned 5 [0115.328] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0115.328] lstrlenW (lpString=".ppt") returned 4 [0115.328] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0115.328] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0115.328] lstrlenW (lpString=".zip") returned 4 [0115.328] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0115.328] lstrlenW (lpString=".rar") returned 4 [0115.328] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0115.329] lstrlenW (lpString=".bz2") returned 4 [0115.329] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0115.329] lstrlenW (lpString=".7z") returned 3 [0115.329] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0115.329] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0115.329] lstrlenW (lpString=".dbf") returned 4 [0115.329] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0115.329] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0115.329] lstrlenW (lpString=".1cd") returned 4 [0115.329] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0115.329] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0115.329] lstrlenW (lpString=".jpg") returned 4 [0115.329] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0116.332] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_page.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page.wmv.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_page.wmv.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0 [0116.332] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page.wmv") returned 70 [0116.332] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page.wmv") returned 70 [0116.332] lstrlenW (lpString=".doc") returned 4 [0116.332] lstrcmpiW (lpString1=".doc", lpString2=".wmv") returned -1 [0116.332] lstrlenW (lpString=".docx") returned 5 [0116.332] lstrcmpiW (lpString1=".docx", lpString2="e.wmv") returned -1 [0116.332] lstrlenW (lpString=".pdf") returned 4 [0116.332] lstrcmpiW (lpString1=".pdf", lpString2=".wmv") returned -1 [0116.332] lstrlenW (lpString=".xls") returned 4 [0116.332] lstrcmpiW (lpString1=".xls", lpString2=".wmv") returned 1 [0116.332] lstrlenW (lpString=".xlsx") returned 5 [0116.332] lstrcmpiW (lpString1=".xlsx", lpString2="e.wmv") returned -1 [0116.332] lstrlenW (lpString=".ppt") returned 4 [0116.332] lstrcmpiW (lpString1=".ppt", lpString2=".wmv") returned -1 [0116.332] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page.wmv") returned 70 [0116.332] lstrlenW (lpString=".zip") returned 4 [0116.332] lstrcmpiW (lpString1=".zip", lpString2=".wmv") returned 1 [0116.332] lstrlenW (lpString=".rar") returned 4 [0116.332] lstrcmpiW (lpString1=".rar", lpString2=".wmv") returned -1 [0116.332] lstrlenW (lpString=".bz2") returned 4 [0116.332] lstrcmpiW (lpString1=".bz2", lpString2=".wmv") returned -1 [0116.332] lstrlenW (lpString=".7z") returned 3 [0116.332] lstrcmpiW (lpString1=".7z", lpString2="wmv") returned -1 [0116.332] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page.wmv") returned 70 [0116.332] lstrlenW (lpString=".dbf") returned 4 [0116.332] lstrcmpiW (lpString1=".dbf", lpString2=".wmv") returned -1 [0116.332] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page.wmv") returned 70 [0116.332] lstrlenW (lpString=".1cd") returned 4 [0116.332] lstrcmpiW (lpString1=".1cd", lpString2=".wmv") returned -1 [0116.332] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page.wmv") returned 70 [0116.332] lstrlenW (lpString=".jpg") returned 4 [0116.333] lstrcmpiW (lpString1=".jpg", lpString2=".wmv") returned -1 [0116.333] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_page_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page_PAL.wmv.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_page_pal.wmv.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0 [0116.333] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page_PAL.wmv") returned 74 [0116.333] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page_PAL.wmv") returned 74 [0116.333] lstrlenW (lpString=".doc") returned 4 [0116.333] lstrcmpiW (lpString1=".doc", lpString2=".wmv") returned -1 [0116.333] lstrlenW (lpString=".docx") returned 5 [0116.333] lstrcmpiW (lpString1=".docx", lpString2="L.wmv") returned -1 [0116.333] lstrlenW (lpString=".pdf") returned 4 [0116.333] lstrcmpiW (lpString1=".pdf", lpString2=".wmv") returned -1 [0116.333] lstrlenW (lpString=".xls") returned 4 [0116.333] lstrcmpiW (lpString1=".xls", lpString2=".wmv") returned 1 [0116.333] lstrlenW (lpString=".xlsx") returned 5 [0116.333] lstrcmpiW (lpString1=".xlsx", lpString2="L.wmv") returned -1 [0116.333] lstrlenW (lpString=".ppt") returned 4 [0116.333] lstrcmpiW (lpString1=".ppt", lpString2=".wmv") returned -1 [0116.333] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page_PAL.wmv") returned 74 [0116.333] lstrlenW (lpString=".zip") returned 4 [0116.333] lstrcmpiW (lpString1=".zip", lpString2=".wmv") returned 1 [0116.333] lstrlenW (lpString=".rar") returned 4 [0116.333] lstrcmpiW (lpString1=".rar", lpString2=".wmv") returned -1 [0116.333] lstrlenW (lpString=".bz2") returned 4 [0116.333] lstrcmpiW (lpString1=".bz2", lpString2=".wmv") returned -1 [0116.333] lstrlenW (lpString=".7z") returned 3 [0116.333] lstrcmpiW (lpString1=".7z", lpString2="wmv") returned -1 [0116.333] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page_PAL.wmv") returned 74 [0116.333] lstrlenW (lpString=".dbf") returned 4 [0116.333] lstrcmpiW (lpString1=".dbf", lpString2=".wmv") returned -1 [0116.333] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page_PAL.wmv") returned 74 [0116.333] lstrlenW (lpString=".1cd") returned 4 [0116.333] lstrcmpiW (lpString1=".1cd", lpString2=".wmv") returned -1 [0116.333] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page_PAL.wmv") returned 74 [0116.333] lstrlenW (lpString=".jpg") returned 4 [0116.333] lstrcmpiW (lpString1=".jpg", lpString2=".wmv") returned -1 [0116.649] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0116.649] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0116.649] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\as80.xsl.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0116.650] GetLastError () returned 0x0 [0116.650] ReadFile (in: hFile=0x164, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x4360, lpOverlapped=0x0) returned 1 [0116.759] WriteFile (in: hFile=0x180, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x4370, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0x4370, lpOverlapped=0x0) returned 1 [0116.759] ReadFile (in: hFile=0x164, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x0, lpOverlapped=0x0) returned 1 [0116.759] WriteFile (in: hFile=0x180, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0xe4, lpOverlapped=0x0) returned 1 [0116.759] SetEndOfFile (hFile=0x180) returned 1 [0116.760] CloseHandle (hObject=0x180) returned 1 [0116.760] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0116.761] SetEndOfFile (hFile=0x164) returned 1 [0116.761] CloseHandle (hObject=0x164) returned 1 [0116.761] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0116.761] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\as80.xsl")) returned 1 [0116.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl") returned 76 [0116.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl") returned 76 [0116.848] lstrlenW (lpString=".doc") returned 4 [0116.848] lstrcmpiW (lpString1=".doc", lpString2=".xsl") returned -1 [0116.848] lstrlenW (lpString=".docx") returned 5 [0116.848] lstrcmpiW (lpString1=".docx", lpString2="0.xsl") returned -1 [0116.848] lstrlenW (lpString=".pdf") returned 4 [0116.848] lstrcmpiW (lpString1=".pdf", lpString2=".xsl") returned -1 [0116.848] lstrlenW (lpString=".xls") returned 4 [0116.848] lstrcmpiW (lpString1=".xls", lpString2=".xsl") returned -1 [0116.848] lstrlenW (lpString=".xlsx") returned 5 [0116.848] lstrcmpiW (lpString1=".xlsx", lpString2="0.xsl") returned -1 [0116.848] lstrlenW (lpString=".ppt") returned 4 [0116.848] lstrcmpiW (lpString1=".ppt", lpString2=".xsl") returned -1 [0116.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl") returned 76 [0116.848] lstrlenW (lpString=".zip") returned 4 [0116.848] lstrcmpiW (lpString1=".zip", lpString2=".xsl") returned 1 [0116.848] lstrlenW (lpString=".rar") returned 4 [0116.848] lstrcmpiW (lpString1=".rar", lpString2=".xsl") returned -1 [0116.848] lstrlenW (lpString=".bz2") returned 4 [0116.848] lstrcmpiW (lpString1=".bz2", lpString2=".xsl") returned -1 [0116.848] lstrlenW (lpString=".7z") returned 3 [0116.848] lstrcmpiW (lpString1=".7z", lpString2="xsl") returned -1 [0116.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl") returned 76 [0116.848] lstrlenW (lpString=".dbf") returned 4 [0116.848] lstrcmpiW (lpString1=".dbf", lpString2=".xsl") returned -1 [0116.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl") returned 76 [0116.848] lstrlenW (lpString=".1cd") returned 4 [0116.848] lstrcmpiW (lpString1=".1cd", lpString2=".xsl") returned -1 [0116.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl") returned 76 [0116.848] lstrlenW (lpString=".jpg") returned 4 [0116.848] lstrcmpiW (lpString1=".jpg", lpString2=".xsl") returned -1 [0117.522] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0117.522] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0117.522] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql90.xsl.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0117.523] GetLastError () returned 0x0 [0117.523] ReadFile (in: hFile=0x1f4, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x9a5b, lpOverlapped=0x0) returned 1 [0117.625] WriteFile (in: hFile=0x218, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x9a60, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0x9a60, lpOverlapped=0x0) returned 1 [0117.626] ReadFile (in: hFile=0x1f4, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x0, lpOverlapped=0x0) returned 1 [0117.626] WriteFile (in: hFile=0x218, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0xe6, lpOverlapped=0x0) returned 1 [0117.626] SetEndOfFile (hFile=0x218) returned 1 [0117.626] CloseHandle (hObject=0x218) returned 1 [0117.627] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0117.627] SetEndOfFile (hFile=0x1f4) returned 1 [0117.627] CloseHandle (hObject=0x1f4) returned 1 [0117.628] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0117.628] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql90.xsl")) returned 1 [0117.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl") returned 77 [0117.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl") returned 77 [0117.628] lstrlenW (lpString=".doc") returned 4 [0117.628] lstrcmpiW (lpString1=".doc", lpString2=".xsl") returned -1 [0117.628] lstrlenW (lpString=".docx") returned 5 [0117.628] lstrcmpiW (lpString1=".docx", lpString2="0.xsl") returned -1 [0117.628] lstrlenW (lpString=".pdf") returned 4 [0117.628] lstrcmpiW (lpString1=".pdf", lpString2=".xsl") returned -1 [0117.628] lstrlenW (lpString=".xls") returned 4 [0117.628] lstrcmpiW (lpString1=".xls", lpString2=".xsl") returned -1 [0117.628] lstrlenW (lpString=".xlsx") returned 5 [0117.628] lstrcmpiW (lpString1=".xlsx", lpString2="0.xsl") returned -1 [0117.628] lstrlenW (lpString=".ppt") returned 4 [0117.628] lstrcmpiW (lpString1=".ppt", lpString2=".xsl") returned -1 [0117.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl") returned 77 [0117.628] lstrlenW (lpString=".zip") returned 4 [0117.628] lstrcmpiW (lpString1=".zip", lpString2=".xsl") returned 1 [0117.628] lstrlenW (lpString=".rar") returned 4 [0117.628] lstrcmpiW (lpString1=".rar", lpString2=".xsl") returned -1 [0117.628] lstrlenW (lpString=".bz2") returned 4 [0117.628] lstrcmpiW (lpString1=".bz2", lpString2=".xsl") returned -1 [0117.629] lstrlenW (lpString=".7z") returned 3 [0117.629] lstrcmpiW (lpString1=".7z", lpString2="xsl") returned -1 [0117.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl") returned 77 [0117.629] lstrlenW (lpString=".dbf") returned 4 [0117.629] lstrcmpiW (lpString1=".dbf", lpString2=".xsl") returned -1 [0117.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl") returned 77 [0117.629] lstrlenW (lpString=".1cd") returned 4 [0117.629] lstrcmpiW (lpString1=".1cd", lpString2=".xsl") returned -1 [0117.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl") returned 77 [0117.629] lstrlenW (lpString=".jpg") returned 4 [0117.629] lstrcmpiW (lpString1=".jpg", lpString2=".xsl") returned -1 [0117.629] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0117.629] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0117.629] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00040_.gif.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0117.629] GetLastError () returned 0x0 [0117.629] ReadFile (in: hFile=0x1f4, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x1fa1, lpOverlapped=0x0) returned 1 [0117.642] WriteFile (in: hFile=0x218, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x1fb0, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0x1fb0, lpOverlapped=0x0) returned 1 [0117.643] ReadFile (in: hFile=0x1f4, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x0, lpOverlapped=0x0) returned 1 [0117.643] WriteFile (in: hFile=0x218, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0xec, lpOverlapped=0x0) returned 1 [0117.644] SetEndOfFile (hFile=0x218) returned 1 [0117.644] CloseHandle (hObject=0x218) returned 1 [0117.644] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0117.644] SetEndOfFile (hFile=0x1f4) returned 1 [0117.645] CloseHandle (hObject=0x1f4) returned 1 [0117.645] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0117.645] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00040_.gif")) returned 1 [0117.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 63 [0117.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 63 [0117.645] lstrlenW (lpString=".doc") returned 4 [0117.645] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0117.645] lstrlenW (lpString=".docx") returned 5 [0117.645] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0117.645] lstrlenW (lpString=".pdf") returned 4 [0117.645] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0117.645] lstrlenW (lpString=".xls") returned 4 [0117.645] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0117.645] lstrlenW (lpString=".xlsx") returned 5 [0117.645] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0117.645] lstrlenW (lpString=".ppt") returned 4 [0117.645] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0117.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 63 [0117.645] lstrlenW (lpString=".zip") returned 4 [0117.645] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0117.645] lstrlenW (lpString=".rar") returned 4 [0117.645] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0117.645] lstrlenW (lpString=".bz2") returned 4 [0117.645] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0117.645] lstrlenW (lpString=".7z") returned 3 [0117.646] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0117.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 63 [0117.646] lstrlenW (lpString=".dbf") returned 4 [0117.646] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0117.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 63 [0117.646] lstrlenW (lpString=".1cd") returned 4 [0117.646] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0117.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 63 [0117.646] lstrlenW (lpString=".jpg") returned 4 [0117.646] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0117.646] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x26ff9fc | out: lpFileSize=0x26ff9fc*=11891) returned 1 [0117.646] CloseHandle (hObject=0x1f4) returned 1 [0117.646] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00057_.gif")) returned 0x20 [0117.646] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00057_.gif.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0117.646] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00057_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0117.646] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0117.646] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0117.646] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00057_.gif.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0117.647] GetLastError () returned 0x0 [0117.647] ReadFile (in: hFile=0x1f4, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x2e73, lpOverlapped=0x0) returned 1 [0117.679] WriteFile (in: hFile=0x218, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x2e80, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0x2e80, lpOverlapped=0x0) returned 1 [0117.679] ReadFile (in: hFile=0x1f4, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x0, lpOverlapped=0x0) returned 1 [0117.679] WriteFile (in: hFile=0x218, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0xec, lpOverlapped=0x0) returned 1 [0117.680] SetEndOfFile (hFile=0x218) returned 1 [0117.680] CloseHandle (hObject=0x218) returned 1 [0117.680] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0117.680] SetEndOfFile (hFile=0x1f4) returned 1 [0117.680] CloseHandle (hObject=0x1f4) returned 1 [0117.680] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0117.681] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00057_.gif")) returned 1 [0117.681] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 63 [0117.681] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 63 [0117.681] lstrlenW (lpString=".doc") returned 4 [0117.681] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0117.681] lstrlenW (lpString=".docx") returned 5 [0117.681] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0117.681] lstrlenW (lpString=".pdf") returned 4 [0117.681] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0117.681] lstrlenW (lpString=".xls") returned 4 [0117.681] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0117.681] lstrlenW (lpString=".xlsx") returned 5 [0117.681] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0117.681] lstrlenW (lpString=".ppt") returned 4 [0117.681] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0117.681] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 63 [0117.681] lstrlenW (lpString=".zip") returned 4 [0117.681] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0117.681] lstrlenW (lpString=".rar") returned 4 [0117.681] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0117.681] lstrlenW (lpString=".bz2") returned 4 [0117.681] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0117.681] lstrlenW (lpString=".7z") returned 3 [0117.681] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0117.681] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 63 [0117.681] lstrlenW (lpString=".dbf") returned 4 [0117.681] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0117.681] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 63 [0117.681] lstrlenW (lpString=".1cd") returned 4 [0117.681] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0117.681] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 63 [0117.681] lstrlenW (lpString=".jpg") returned 4 [0117.681] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0117.682] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x26ff9fc | out: lpFileSize=0x26ff9fc*=3484) returned 1 [0117.682] CloseHandle (hObject=0x1f4) returned 1 [0117.682] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00120_.gif")) returned 0x20 [0117.682] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00120_.gif.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0117.682] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00120_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0117.682] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0117.682] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0117.682] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00120_.gif.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0117.682] GetLastError () returned 0x0 [0117.682] ReadFile (in: hFile=0x1f4, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0xd9c, lpOverlapped=0x0) returned 1 [0117.698] WriteFile (in: hFile=0x218, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xda0, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0xda0, lpOverlapped=0x0) returned 1 [0117.699] ReadFile (in: hFile=0x1f4, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x0, lpOverlapped=0x0) returned 1 [0117.699] WriteFile (in: hFile=0x218, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0xec, lpOverlapped=0x0) returned 1 [0117.699] SetEndOfFile (hFile=0x218) returned 1 [0117.699] CloseHandle (hObject=0x218) returned 1 [0117.699] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0117.699] SetEndOfFile (hFile=0x1f4) returned 1 [0117.700] CloseHandle (hObject=0x1f4) returned 1 [0117.700] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0117.700] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00120_.gif")) returned 1 [0117.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 63 [0117.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 63 [0117.700] lstrlenW (lpString=".doc") returned 4 [0117.700] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0117.700] lstrlenW (lpString=".docx") returned 5 [0117.700] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0117.700] lstrlenW (lpString=".pdf") returned 4 [0117.700] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0117.700] lstrlenW (lpString=".xls") returned 4 [0117.700] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0117.700] lstrlenW (lpString=".xlsx") returned 5 [0117.700] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0117.700] lstrlenW (lpString=".ppt") returned 4 [0117.701] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0117.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 63 [0117.701] lstrlenW (lpString=".zip") returned 4 [0117.701] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0117.701] lstrlenW (lpString=".rar") returned 4 [0117.701] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0117.701] lstrlenW (lpString=".bz2") returned 4 [0117.701] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0117.701] lstrlenW (lpString=".7z") returned 3 [0117.701] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0117.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 63 [0117.701] lstrlenW (lpString=".dbf") returned 4 [0117.701] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0117.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 63 [0117.701] lstrlenW (lpString=".1cd") returned 4 [0117.701] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0117.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 63 [0117.701] lstrlenW (lpString=".jpg") returned 4 [0117.701] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0117.701] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x26ff9fc | out: lpFileSize=0x26ff9fc*=12482) returned 1 [0117.701] CloseHandle (hObject=0x1f4) returned 1 [0117.701] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00129_.gif")) returned 0x20 [0117.701] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00129_.gif.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0117.701] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00129_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0117.702] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0117.702] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0117.702] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00129_.gif.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0117.702] GetLastError () returned 0x0 [0117.702] ReadFile (in: hFile=0x1f4, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x30c2, lpOverlapped=0x0) returned 1 [0117.772] WriteFile (in: hFile=0x218, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x30d0, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0x30d0, lpOverlapped=0x0) returned 1 [0117.773] ReadFile (in: hFile=0x1f4, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x0, lpOverlapped=0x0) returned 1 [0117.773] WriteFile (in: hFile=0x218, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0xec, lpOverlapped=0x0) returned 1 [0117.773] SetEndOfFile (hFile=0x218) returned 1 [0117.773] CloseHandle (hObject=0x218) returned 1 [0117.773] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0117.773] SetEndOfFile (hFile=0x1f4) returned 1 [0117.773] CloseHandle (hObject=0x1f4) returned 1 [0117.774] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0117.774] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00129_.gif")) returned 1 [0117.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 63 [0117.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 63 [0117.774] lstrlenW (lpString=".doc") returned 4 [0117.774] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0117.774] lstrlenW (lpString=".docx") returned 5 [0117.774] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0117.774] lstrlenW (lpString=".pdf") returned 4 [0117.774] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0117.774] lstrlenW (lpString=".xls") returned 4 [0117.774] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0117.774] lstrlenW (lpString=".xlsx") returned 5 [0117.774] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0117.774] lstrlenW (lpString=".ppt") returned 4 [0117.774] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0117.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 63 [0117.774] lstrlenW (lpString=".zip") returned 4 [0117.774] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0117.774] lstrlenW (lpString=".rar") returned 4 [0117.774] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0117.774] lstrlenW (lpString=".bz2") returned 4 [0117.774] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0117.774] lstrlenW (lpString=".7z") returned 3 [0117.774] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0117.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 63 [0117.774] lstrlenW (lpString=".dbf") returned 4 [0117.774] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0117.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 63 [0117.774] lstrlenW (lpString=".1cd") returned 4 [0117.774] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0117.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 63 [0117.775] lstrlenW (lpString=".jpg") returned 4 [0117.775] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0117.786] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x26ff9fc | out: lpFileSize=0x26ff9fc*=6984) returned 1 [0117.787] CloseHandle (hObject=0x20c) returned 1 [0117.787] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00163_.gif")) returned 0x20 [0117.787] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00163_.gif.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0117.787] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00163_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0117.787] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0117.787] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0117.787] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00163_.gif.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0117.788] GetLastError () returned 0x0 [0117.788] ReadFile (in: hFile=0x20c, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x1b48, lpOverlapped=0x0) returned 1 [0117.797] WriteFile (in: hFile=0x1f4, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x1b50, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0x1b50, lpOverlapped=0x0) returned 1 [0117.797] ReadFile (in: hFile=0x20c, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x0, lpOverlapped=0x0) returned 1 [0117.797] WriteFile (in: hFile=0x1f4, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0xec, lpOverlapped=0x0) returned 1 [0117.797] SetEndOfFile (hFile=0x1f4) returned 1 [0117.797] CloseHandle (hObject=0x1f4) returned 1 [0117.798] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0117.798] SetEndOfFile (hFile=0x20c) returned 1 [0117.798] CloseHandle (hObject=0x20c) returned 1 [0117.798] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0117.799] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00163_.gif")) returned 1 [0117.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 63 [0117.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 63 [0117.805] lstrlenW (lpString=".doc") returned 4 [0117.805] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0117.805] lstrlenW (lpString=".docx") returned 5 [0117.805] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0117.805] lstrlenW (lpString=".pdf") returned 4 [0117.805] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0117.805] lstrlenW (lpString=".xls") returned 4 [0117.805] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0117.805] lstrlenW (lpString=".xlsx") returned 5 [0117.805] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0117.805] lstrlenW (lpString=".ppt") returned 4 [0117.805] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0117.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 63 [0117.805] lstrlenW (lpString=".zip") returned 4 [0117.805] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0117.805] lstrlenW (lpString=".rar") returned 4 [0117.805] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0117.805] lstrlenW (lpString=".bz2") returned 4 [0117.805] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0117.805] lstrlenW (lpString=".7z") returned 3 [0117.805] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0117.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 63 [0117.805] lstrlenW (lpString=".dbf") returned 4 [0117.805] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0117.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 63 [0117.805] lstrlenW (lpString=".1cd") returned 4 [0117.805] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0117.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 63 [0117.805] lstrlenW (lpString=".jpg") returned 4 [0117.805] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0117.806] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0117.806] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0117.806] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00169_.gif.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0117.806] GetLastError () returned 0x0 [0117.806] ReadFile (in: hFile=0x164, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x14ff, lpOverlapped=0x0) returned 1 [0117.833] WriteFile (in: hFile=0x1f0, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x1500, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0x1500, lpOverlapped=0x0) returned 1 [0117.839] ReadFile (in: hFile=0x164, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x0, lpOverlapped=0x0) returned 1 [0117.839] WriteFile (in: hFile=0x1f0, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0xec, lpOverlapped=0x0) returned 1 [0117.839] SetEndOfFile (hFile=0x1f0) returned 1 [0117.839] CloseHandle (hObject=0x1f0) returned 1 [0117.839] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0117.839] SetEndOfFile (hFile=0x164) returned 1 [0117.840] CloseHandle (hObject=0x164) returned 1 [0117.840] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0117.840] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00169_.gif")) returned 1 [0117.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 63 [0117.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 63 [0117.841] lstrlenW (lpString=".doc") returned 4 [0117.841] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0117.841] lstrlenW (lpString=".docx") returned 5 [0117.841] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0117.841] lstrlenW (lpString=".pdf") returned 4 [0117.841] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0117.841] lstrlenW (lpString=".xls") returned 4 [0117.841] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0117.841] lstrlenW (lpString=".xlsx") returned 5 [0117.841] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0117.841] lstrlenW (lpString=".ppt") returned 4 [0117.841] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0117.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 63 [0117.841] lstrlenW (lpString=".zip") returned 4 [0117.841] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0117.841] lstrlenW (lpString=".rar") returned 4 [0117.841] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0117.841] lstrlenW (lpString=".bz2") returned 4 [0117.841] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0117.841] lstrlenW (lpString=".7z") returned 3 [0117.841] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0117.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 63 [0117.841] lstrlenW (lpString=".dbf") returned 4 [0117.841] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0117.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 63 [0117.841] lstrlenW (lpString=".1cd") returned 4 [0117.841] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0117.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 63 [0117.841] lstrlenW (lpString=".jpg") returned 4 [0117.841] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0117.841] GetFileSizeEx (in: hFile=0x164, lpFileSize=0x26ff9fc | out: lpFileSize=0x26ff9fc*=3966) returned 1 [0117.841] CloseHandle (hObject=0x164) returned 1 [0117.842] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00174_.gif")) returned 0x20 [0117.842] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00174_.gif.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0117.842] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00174_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0117.842] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0117.842] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0117.842] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00174_.gif.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0117.842] GetLastError () returned 0x0 [0117.842] ReadFile (in: hFile=0x164, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0xf7e, lpOverlapped=0x0) returned 1 [0117.851] WriteFile (in: hFile=0x1f0, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xf80, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0xf80, lpOverlapped=0x0) returned 1 [0117.852] ReadFile (in: hFile=0x164, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x0, lpOverlapped=0x0) returned 1 [0117.852] WriteFile (in: hFile=0x1f0, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0xec, lpOverlapped=0x0) returned 1 [0117.852] SetEndOfFile (hFile=0x1f0) returned 1 [0117.852] CloseHandle (hObject=0x1f0) returned 1 [0117.852] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0117.852] SetEndOfFile (hFile=0x164) returned 1 [0117.853] CloseHandle (hObject=0x164) returned 1 [0117.853] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0117.853] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00174_.gif")) returned 1 [0117.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 63 [0117.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 63 [0117.853] lstrlenW (lpString=".doc") returned 4 [0117.853] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0117.853] lstrlenW (lpString=".docx") returned 5 [0117.853] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0117.853] lstrlenW (lpString=".pdf") returned 4 [0117.853] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0117.853] lstrlenW (lpString=".xls") returned 4 [0117.853] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0117.853] lstrlenW (lpString=".xlsx") returned 5 [0117.853] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0117.853] lstrlenW (lpString=".ppt") returned 4 [0117.853] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0117.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 63 [0117.853] lstrlenW (lpString=".zip") returned 4 [0117.853] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0117.853] lstrlenW (lpString=".rar") returned 4 [0117.853] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0117.853] lstrlenW (lpString=".bz2") returned 4 [0117.853] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0117.853] lstrlenW (lpString=".7z") returned 3 [0117.853] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0117.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 63 [0117.854] lstrlenW (lpString=".dbf") returned 4 [0117.854] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0117.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 63 [0117.854] lstrlenW (lpString=".1cd") returned 4 [0117.854] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0117.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 63 [0117.854] lstrlenW (lpString=".jpg") returned 4 [0117.854] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0117.854] GetFileSizeEx (in: hFile=0x164, lpFileSize=0x26ff9fc | out: lpFileSize=0x26ff9fc*=3120) returned 1 [0117.854] CloseHandle (hObject=0x164) returned 1 [0117.854] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00176_.gif")) returned 0x20 [0117.854] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00176_.gif.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0117.854] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00176_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0117.854] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0117.854] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0117.854] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00176_.gif.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0117.855] GetLastError () returned 0x0 [0117.855] ReadFile (in: hFile=0x164, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0xc30, lpOverlapped=0x0) returned 1 [0117.870] WriteFile (in: hFile=0x1f0, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xc40, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0xc40, lpOverlapped=0x0) returned 1 [0117.871] ReadFile (in: hFile=0x164, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x0, lpOverlapped=0x0) returned 1 [0117.871] WriteFile (in: hFile=0x1f0, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0xec, lpOverlapped=0x0) returned 1 [0117.871] SetEndOfFile (hFile=0x1f0) returned 1 [0117.871] CloseHandle (hObject=0x1f0) returned 1 [0117.871] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0117.871] SetEndOfFile (hFile=0x164) returned 1 [0117.872] CloseHandle (hObject=0x164) returned 1 [0117.872] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0117.872] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00176_.gif")) returned 1 [0117.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 63 [0117.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 63 [0117.872] lstrlenW (lpString=".doc") returned 4 [0117.872] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0117.872] lstrlenW (lpString=".docx") returned 5 [0117.872] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0117.872] lstrlenW (lpString=".pdf") returned 4 [0117.872] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0117.872] lstrlenW (lpString=".xls") returned 4 [0117.873] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0117.873] lstrlenW (lpString=".xlsx") returned 5 [0117.873] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0117.873] lstrlenW (lpString=".ppt") returned 4 [0117.873] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0117.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 63 [0117.873] lstrlenW (lpString=".zip") returned 4 [0117.873] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0117.873] lstrlenW (lpString=".rar") returned 4 [0117.873] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0117.873] lstrlenW (lpString=".bz2") returned 4 [0117.873] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0117.873] lstrlenW (lpString=".7z") returned 3 [0117.873] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0117.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 63 [0117.873] lstrlenW (lpString=".dbf") returned 4 [0117.873] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0117.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 63 [0117.873] lstrlenW (lpString=".1cd") returned 4 [0117.873] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0117.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 63 [0117.873] lstrlenW (lpString=".jpg") returned 4 [0117.873] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0117.873] GetFileSizeEx (in: hFile=0x164, lpFileSize=0x26ff9fc | out: lpFileSize=0x26ff9fc*=20578) returned 1 [0117.873] CloseHandle (hObject=0x164) returned 1 [0117.873] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00853_.wmf")) returned 0x20 [0117.873] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00853_.wmf.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0117.873] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00853_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0117.874] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0117.874] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0117.874] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00853_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0117.874] GetLastError () returned 0x0 [0117.874] ReadFile (in: hFile=0x164, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x5062, lpOverlapped=0x0) returned 1 [0117.937] WriteFile (in: hFile=0x1f0, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x5070, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0x5070, lpOverlapped=0x0) returned 1 [0117.938] ReadFile (in: hFile=0x164, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x0, lpOverlapped=0x0) returned 1 [0117.938] WriteFile (in: hFile=0x1f0, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0xec, lpOverlapped=0x0) returned 1 [0117.938] SetEndOfFile (hFile=0x1f0) returned 1 [0117.953] CloseHandle (hObject=0x1f0) returned 1 [0117.953] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0117.953] SetEndOfFile (hFile=0x164) returned 1 [0117.954] CloseHandle (hObject=0x164) returned 1 [0117.954] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0117.954] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00853_.wmf")) returned 1 [0117.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 63 [0117.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 63 [0117.963] lstrlenW (lpString=".doc") returned 4 [0117.963] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0117.963] lstrlenW (lpString=".docx") returned 5 [0117.963] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0117.963] lstrlenW (lpString=".pdf") returned 4 [0117.963] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0117.963] lstrlenW (lpString=".xls") returned 4 [0117.963] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0117.963] lstrlenW (lpString=".xlsx") returned 5 [0117.963] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0117.963] lstrlenW (lpString=".ppt") returned 4 [0117.963] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0117.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 63 [0117.963] lstrlenW (lpString=".zip") returned 4 [0117.963] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0117.963] lstrlenW (lpString=".rar") returned 4 [0117.963] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0117.963] lstrlenW (lpString=".bz2") returned 4 [0117.963] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0117.963] lstrlenW (lpString=".7z") returned 3 [0117.963] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0117.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 63 [0117.963] lstrlenW (lpString=".dbf") returned 4 [0117.963] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0117.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 63 [0117.963] lstrlenW (lpString=".1cd") returned 4 [0117.964] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0117.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 63 [0117.964] lstrlenW (lpString=".jpg") returned 4 [0117.964] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0117.964] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0117.964] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0117.964] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01039_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0117.964] GetLastError () returned 0x0 [0117.964] ReadFile (in: hFile=0x1f4, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0xd10, lpOverlapped=0x0) returned 1 [0118.168] WriteFile (in: hFile=0x1e0, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xd20, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0xd20, lpOverlapped=0x0) returned 1 [0118.169] ReadFile (in: hFile=0x1f4, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x0, lpOverlapped=0x0) returned 1 [0118.169] WriteFile (in: hFile=0x1e0, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0xec, lpOverlapped=0x0) returned 1 [0118.169] SetEndOfFile (hFile=0x1e0) returned 1 [0118.169] CloseHandle (hObject=0x1e0) returned 1 [0118.169] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0118.169] SetEndOfFile (hFile=0x1f4) returned 1 [0118.170] CloseHandle (hObject=0x1f4) returned 1 [0118.170] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0118.170] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01039_.wmf")) returned 1 [0118.170] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 63 [0118.170] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 63 [0118.170] lstrlenW (lpString=".doc") returned 4 [0118.170] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0118.170] lstrlenW (lpString=".docx") returned 5 [0118.170] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0118.170] lstrlenW (lpString=".pdf") returned 4 [0118.170] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0118.170] lstrlenW (lpString=".xls") returned 4 [0118.170] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0118.170] lstrlenW (lpString=".xlsx") returned 5 [0118.170] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0118.170] lstrlenW (lpString=".ppt") returned 4 [0118.170] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0118.170] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 63 [0118.170] lstrlenW (lpString=".zip") returned 4 [0118.171] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0118.171] lstrlenW (lpString=".rar") returned 4 [0118.171] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0118.171] lstrlenW (lpString=".bz2") returned 4 [0118.171] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0118.171] lstrlenW (lpString=".7z") returned 3 [0118.171] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0118.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 63 [0118.171] lstrlenW (lpString=".dbf") returned 4 [0118.171] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0118.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 63 [0118.171] lstrlenW (lpString=".1cd") returned 4 [0118.171] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0118.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 63 [0118.171] lstrlenW (lpString=".jpg") returned 4 [0118.171] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0118.183] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0118.183] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0118.183] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01173_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0118.183] GetLastError () returned 0x0 [0118.183] ReadFile (in: hFile=0x1f4, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x66dc, lpOverlapped=0x0) returned 1 [0118.389] WriteFile (in: hFile=0x1e0, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x66e0, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0x66e0, lpOverlapped=0x0) returned 1 [0118.890] ReadFile (in: hFile=0x1f4, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x0, lpOverlapped=0x0) returned 1 [0118.890] WriteFile (in: hFile=0x1e0, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0xec, lpOverlapped=0x0) returned 1 [0118.890] SetEndOfFile (hFile=0x1e0) returned 1 [0118.969] CloseHandle (hObject=0x1e0) returned 1 [0118.969] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0118.969] SetEndOfFile (hFile=0x1f4) returned 1 [0118.970] CloseHandle (hObject=0x1f4) returned 1 [0118.970] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0118.970] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01173_.wmf")) returned 1 [0118.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 63 [0118.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 63 [0118.970] lstrlenW (lpString=".doc") returned 4 [0118.970] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0118.970] lstrlenW (lpString=".docx") returned 5 [0118.970] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0118.971] lstrlenW (lpString=".pdf") returned 4 [0118.971] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0118.971] lstrlenW (lpString=".xls") returned 4 [0118.971] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0118.971] lstrlenW (lpString=".xlsx") returned 5 [0118.971] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0118.971] lstrlenW (lpString=".ppt") returned 4 [0118.971] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0118.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 63 [0118.971] lstrlenW (lpString=".zip") returned 4 [0118.971] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0118.971] lstrlenW (lpString=".rar") returned 4 [0118.971] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0118.971] lstrlenW (lpString=".bz2") returned 4 [0118.971] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0118.971] lstrlenW (lpString=".7z") returned 3 [0118.971] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0118.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 63 [0118.971] lstrlenW (lpString=".dbf") returned 4 [0118.971] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0118.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 63 [0118.971] lstrlenW (lpString=".1cd") returned 4 [0118.971] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0118.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 63 [0118.971] lstrlenW (lpString=".jpg") returned 4 [0118.971] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0118.993] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x26ff9fc | out: lpFileSize=0x26ff9fc*=3012) returned 1 [0118.993] CloseHandle (hObject=0x1f4) returned 1 [0118.993] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01218_.wmf")) returned 0x20 [0118.993] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01218_.wmf.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0118.993] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01218_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0118.993] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0118.993] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0118.993] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01218_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0118.994] GetLastError () returned 0x0 [0118.994] ReadFile (in: hFile=0x1f4, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0xbc4, lpOverlapped=0x0) returned 1 [0119.088] WriteFile (in: hFile=0x1e0, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xbd0, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0xbd0, lpOverlapped=0x0) returned 1 [0119.088] ReadFile (in: hFile=0x1f4, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x0, lpOverlapped=0x0) returned 1 [0119.088] WriteFile (in: hFile=0x1e0, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0xec, lpOverlapped=0x0) returned 1 [0119.089] SetEndOfFile (hFile=0x1e0) returned 1 [0119.089] CloseHandle (hObject=0x1e0) returned 1 [0119.089] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0119.089] SetEndOfFile (hFile=0x1f4) returned 1 [0119.089] CloseHandle (hObject=0x1f4) returned 1 [0119.089] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0119.090] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01218_.wmf")) returned 1 [0119.090] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 63 [0119.090] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 63 [0119.090] lstrlenW (lpString=".doc") returned 4 [0119.090] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0119.090] lstrlenW (lpString=".docx") returned 5 [0119.090] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0119.090] lstrlenW (lpString=".pdf") returned 4 [0119.090] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0119.090] lstrlenW (lpString=".xls") returned 4 [0119.090] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0119.090] lstrlenW (lpString=".xlsx") returned 5 [0119.090] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0119.090] lstrlenW (lpString=".ppt") returned 4 [0119.090] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0119.090] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 63 [0119.090] lstrlenW (lpString=".zip") returned 4 [0119.090] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0119.090] lstrlenW (lpString=".rar") returned 4 [0119.090] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0119.090] lstrlenW (lpString=".bz2") returned 4 [0119.090] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0119.090] lstrlenW (lpString=".7z") returned 3 [0119.090] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0119.090] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 63 [0119.090] lstrlenW (lpString=".dbf") returned 4 [0119.090] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0119.090] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 63 [0119.090] lstrlenW (lpString=".1cd") returned 4 [0119.090] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0119.090] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 63 [0119.090] lstrlenW (lpString=".jpg") returned 4 [0119.091] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0119.160] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x26ff9fc | out: lpFileSize=0x26ff9fc*=2636) returned 1 [0119.160] CloseHandle (hObject=0x1f4) returned 1 [0119.160] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04174_.wmf")) returned 0x20 [0119.160] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04174_.wmf.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0119.160] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04174_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0119.160] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0119.160] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0119.160] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04174_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0119.160] GetLastError () returned 0x0 [0119.161] ReadFile (in: hFile=0x1f4, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0xa4c, lpOverlapped=0x0) returned 1 [0119.269] WriteFile (in: hFile=0x1e0, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xa50, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0xa50, lpOverlapped=0x0) returned 1 [0119.269] ReadFile (in: hFile=0x1f4, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x0, lpOverlapped=0x0) returned 1 [0119.270] WriteFile (in: hFile=0x1e0, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0xec, lpOverlapped=0x0) returned 1 [0119.270] SetEndOfFile (hFile=0x1e0) returned 1 [0119.465] CloseHandle (hObject=0x1e0) returned 1 [0119.465] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0119.465] SetEndOfFile (hFile=0x1f4) returned 1 [0119.466] CloseHandle (hObject=0x1f4) returned 1 [0119.466] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0119.466] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04174_.wmf")) returned 1 [0119.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 63 [0119.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 63 [0119.504] lstrlenW (lpString=".doc") returned 4 [0119.504] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0119.504] lstrlenW (lpString=".docx") returned 5 [0119.504] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0119.504] lstrlenW (lpString=".pdf") returned 4 [0119.504] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0119.504] lstrlenW (lpString=".xls") returned 4 [0119.504] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0119.504] lstrlenW (lpString=".xlsx") returned 5 [0119.504] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0119.504] lstrlenW (lpString=".ppt") returned 4 [0119.504] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0119.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 63 [0119.504] lstrlenW (lpString=".zip") returned 4 [0119.504] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0119.504] lstrlenW (lpString=".rar") returned 4 [0119.504] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0119.504] lstrlenW (lpString=".bz2") returned 4 [0119.504] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0119.504] lstrlenW (lpString=".7z") returned 3 [0119.504] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0119.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 63 [0119.504] lstrlenW (lpString=".dbf") returned 4 [0119.504] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0119.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 63 [0119.504] lstrlenW (lpString=".1cd") returned 4 [0119.504] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0119.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 63 [0119.504] lstrlenW (lpString=".jpg") returned 4 [0119.504] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0119.515] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x26ff9fc | out: lpFileSize=0x26ff9fc*=2492) returned 1 [0119.515] CloseHandle (hObject=0x170) returned 1 [0119.515] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04323_.wmf")) returned 0x20 [0119.515] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04323_.wmf.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0119.515] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04323_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0119.515] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0119.516] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0119.516] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04323_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0119.517] GetLastError () returned 0x0 [0119.517] ReadFile (in: hFile=0x170, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x9bc, lpOverlapped=0x0) returned 1 [0119.577] WriteFile (in: hFile=0x1f0, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x9c0, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0x9c0, lpOverlapped=0x0) returned 1 [0119.578] ReadFile (in: hFile=0x170, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x0, lpOverlapped=0x0) returned 1 [0119.578] WriteFile (in: hFile=0x1f0, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0xec, lpOverlapped=0x0) returned 1 [0119.578] SetEndOfFile (hFile=0x1f0) returned 1 [0119.578] CloseHandle (hObject=0x1f0) returned 1 [0119.578] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0119.578] SetEndOfFile (hFile=0x170) returned 1 [0119.579] CloseHandle (hObject=0x170) returned 1 [0119.579] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0119.579] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04323_.wmf")) returned 1 [0119.579] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 63 [0119.579] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 63 [0119.579] lstrlenW (lpString=".doc") returned 4 [0119.579] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0119.579] lstrlenW (lpString=".docx") returned 5 [0119.579] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0119.579] lstrlenW (lpString=".pdf") returned 4 [0119.580] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0119.580] lstrlenW (lpString=".xls") returned 4 [0119.580] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0119.580] lstrlenW (lpString=".xlsx") returned 5 [0119.580] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0119.580] lstrlenW (lpString=".ppt") returned 4 [0119.580] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0119.580] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 63 [0119.580] lstrlenW (lpString=".zip") returned 4 [0119.580] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0119.580] lstrlenW (lpString=".rar") returned 4 [0119.580] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0119.580] lstrlenW (lpString=".bz2") returned 4 [0119.580] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0119.580] lstrlenW (lpString=".7z") returned 3 [0119.580] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0119.580] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 63 [0119.580] lstrlenW (lpString=".dbf") returned 4 [0119.580] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0119.580] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 63 [0119.580] lstrlenW (lpString=".1cd") returned 4 [0119.580] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0119.580] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 63 [0119.580] lstrlenW (lpString=".jpg") returned 4 [0119.580] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0119.580] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x26ff9fc | out: lpFileSize=0x26ff9fc*=4808) returned 1 [0119.580] CloseHandle (hObject=0x170) returned 1 [0119.580] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04369_.wmf")) returned 0x20 [0119.581] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04369_.wmf.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0119.581] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04369_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0119.581] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0119.581] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0119.581] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04369_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0119.581] GetLastError () returned 0x0 [0119.581] ReadFile (in: hFile=0x170, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x12c8, lpOverlapped=0x0) returned 1 [0119.601] WriteFile (in: hFile=0x1f0, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x12d0, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0x12d0, lpOverlapped=0x0) returned 1 [0119.602] ReadFile (in: hFile=0x170, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x0, lpOverlapped=0x0) returned 1 [0119.602] WriteFile (in: hFile=0x1f0, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0xec, lpOverlapped=0x0) returned 1 [0119.602] SetEndOfFile (hFile=0x1f0) returned 1 [0119.602] CloseHandle (hObject=0x1f0) returned 1 [0119.602] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0119.602] SetEndOfFile (hFile=0x170) returned 1 [0119.603] CloseHandle (hObject=0x170) returned 1 [0119.603] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0119.603] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04369_.wmf")) returned 1 [0119.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 63 [0119.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 63 [0119.603] lstrlenW (lpString=".doc") returned 4 [0119.603] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0119.603] lstrlenW (lpString=".docx") returned 5 [0119.603] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0119.603] lstrlenW (lpString=".pdf") returned 4 [0119.603] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0119.603] lstrlenW (lpString=".xls") returned 4 [0119.603] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0119.603] lstrlenW (lpString=".xlsx") returned 5 [0119.604] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0119.604] lstrlenW (lpString=".ppt") returned 4 [0119.604] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0119.604] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 63 [0119.604] lstrlenW (lpString=".zip") returned 4 [0119.604] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0119.604] lstrlenW (lpString=".rar") returned 4 [0119.604] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0119.604] lstrlenW (lpString=".bz2") returned 4 [0119.604] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0119.604] lstrlenW (lpString=".7z") returned 3 [0119.604] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0119.604] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 63 [0119.604] lstrlenW (lpString=".dbf") returned 4 [0119.604] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0119.604] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 63 [0119.604] lstrlenW (lpString=".1cd") returned 4 [0119.604] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0119.604] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 63 [0119.604] lstrlenW (lpString=".jpg") returned 4 [0119.604] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0119.604] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x26ff9fc | out: lpFileSize=0x26ff9fc*=4996) returned 1 [0119.604] CloseHandle (hObject=0x170) returned 1 [0119.604] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04384_.wmf")) returned 0x20 [0119.604] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04384_.wmf.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0119.604] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04384_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0119.605] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0119.605] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0119.605] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04384_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0119.605] GetLastError () returned 0x0 [0119.605] ReadFile (in: hFile=0x170, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x1384, lpOverlapped=0x0) returned 1 [0119.610] WriteFile (in: hFile=0x1f0, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x1390, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0x1390, lpOverlapped=0x0) returned 1 [0119.611] ReadFile (in: hFile=0x170, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x0, lpOverlapped=0x0) returned 1 [0119.611] WriteFile (in: hFile=0x1f0, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0xec, lpOverlapped=0x0) returned 1 [0119.611] SetEndOfFile (hFile=0x1f0) returned 1 [0119.611] CloseHandle (hObject=0x1f0) returned 1 [0119.611] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0119.611] SetEndOfFile (hFile=0x170) returned 1 [0119.612] CloseHandle (hObject=0x170) returned 1 [0119.612] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0119.612] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04384_.wmf")) returned 1 [0119.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 63 [0119.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 63 [0119.612] lstrlenW (lpString=".doc") returned 4 [0119.612] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0119.612] lstrlenW (lpString=".docx") returned 5 [0119.612] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0119.612] lstrlenW (lpString=".pdf") returned 4 [0119.612] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0119.612] lstrlenW (lpString=".xls") returned 4 [0119.612] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0119.612] lstrlenW (lpString=".xlsx") returned 5 [0119.612] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0119.612] lstrlenW (lpString=".ppt") returned 4 [0119.612] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0119.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 63 [0119.612] lstrlenW (lpString=".zip") returned 4 [0119.612] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0119.613] lstrlenW (lpString=".rar") returned 4 [0119.613] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0119.613] lstrlenW (lpString=".bz2") returned 4 [0119.613] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0119.613] lstrlenW (lpString=".7z") returned 3 [0119.613] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0119.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 63 [0119.613] lstrlenW (lpString=".dbf") returned 4 [0119.613] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0119.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 63 [0119.613] lstrlenW (lpString=".1cd") returned 4 [0119.613] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0119.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 63 [0119.613] lstrlenW (lpString=".jpg") returned 4 [0119.613] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0119.613] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x26ff9fc | out: lpFileSize=0x26ff9fc*=5004) returned 1 [0119.613] CloseHandle (hObject=0x170) returned 1 [0119.613] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04385_.wmf")) returned 0x20 [0119.613] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04385_.wmf.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0119.614] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04385_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0119.614] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0119.614] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0119.614] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04385_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0119.614] GetLastError () returned 0x0 [0119.614] ReadFile (in: hFile=0x170, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x138c, lpOverlapped=0x0) returned 1 [0119.648] WriteFile (in: hFile=0x1f0, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x1390, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0x1390, lpOverlapped=0x0) returned 1 [0119.648] ReadFile (in: hFile=0x170, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x0, lpOverlapped=0x0) returned 1 [0119.648] WriteFile (in: hFile=0x1f0, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0xec, lpOverlapped=0x0) returned 1 [0119.649] SetEndOfFile (hFile=0x1f0) returned 1 [0119.680] CloseHandle (hObject=0x1f0) returned 1 [0119.680] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0119.680] SetEndOfFile (hFile=0x170) returned 1 [0119.681] CloseHandle (hObject=0x170) returned 1 [0119.682] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0119.682] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04385_.wmf")) returned 1 [0119.682] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 63 [0119.682] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 63 [0119.682] lstrlenW (lpString=".doc") returned 4 [0119.682] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0119.682] lstrlenW (lpString=".docx") returned 5 [0119.682] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0119.683] lstrlenW (lpString=".pdf") returned 4 [0119.683] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0119.683] lstrlenW (lpString=".xls") returned 4 [0119.683] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0119.683] lstrlenW (lpString=".xlsx") returned 5 [0119.683] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0119.683] lstrlenW (lpString=".ppt") returned 4 [0119.683] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0119.683] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 63 [0119.683] lstrlenW (lpString=".zip") returned 4 [0119.683] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0119.683] lstrlenW (lpString=".rar") returned 4 [0119.683] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0119.683] lstrlenW (lpString=".bz2") returned 4 [0119.683] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0119.683] lstrlenW (lpString=".7z") returned 3 [0119.683] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0119.683] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 63 [0119.683] lstrlenW (lpString=".dbf") returned 4 [0119.683] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0119.683] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 63 [0119.683] lstrlenW (lpString=".1cd") returned 4 [0119.683] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0119.683] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 63 [0119.683] lstrlenW (lpString=".jpg") returned 4 [0119.683] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0119.683] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x26ff9fc | out: lpFileSize=0x26ff9fc*=11636) returned 1 [0119.683] CloseHandle (hObject=0x170) returned 1 [0119.683] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00155_.wmf")) returned 0x20 [0119.684] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00155_.wmf.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0119.684] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00155_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0119.684] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0119.684] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0119.684] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00155_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0119.684] GetLastError () returned 0x0 [0119.684] ReadFile (in: hFile=0x170, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x2d74, lpOverlapped=0x0) returned 1 [0119.820] WriteFile (in: hFile=0x1f0, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x2d80, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0x2d80, lpOverlapped=0x0) returned 1 [0119.821] ReadFile (in: hFile=0x170, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x0, lpOverlapped=0x0) returned 1 [0119.821] WriteFile (in: hFile=0x1f0, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0xec, lpOverlapped=0x0) returned 1 [0119.821] SetEndOfFile (hFile=0x1f0) returned 1 [0119.821] CloseHandle (hObject=0x1f0) returned 1 [0119.821] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0119.821] SetEndOfFile (hFile=0x170) returned 1 [0119.822] CloseHandle (hObject=0x170) returned 1 [0119.822] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0119.822] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00155_.wmf")) returned 1 [0119.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 63 [0119.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 63 [0119.823] lstrlenW (lpString=".doc") returned 4 [0119.823] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0119.823] lstrlenW (lpString=".docx") returned 5 [0119.823] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0119.823] lstrlenW (lpString=".pdf") returned 4 [0119.823] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0119.823] lstrlenW (lpString=".xls") returned 4 [0119.823] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0119.823] lstrlenW (lpString=".xlsx") returned 5 [0119.823] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0119.823] lstrlenW (lpString=".ppt") returned 4 [0119.823] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0119.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 63 [0119.823] lstrlenW (lpString=".zip") returned 4 [0119.823] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0119.823] lstrlenW (lpString=".rar") returned 4 [0119.823] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0119.823] lstrlenW (lpString=".bz2") returned 4 [0119.823] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0119.823] lstrlenW (lpString=".7z") returned 3 [0119.823] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0119.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 63 [0119.823] lstrlenW (lpString=".dbf") returned 4 [0119.823] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0119.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 63 [0119.823] lstrlenW (lpString=".1cd") returned 4 [0119.823] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0119.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 63 [0119.823] lstrlenW (lpString=".jpg") returned 4 [0119.824] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0119.824] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x26ff9fc | out: lpFileSize=0x26ff9fc*=47996) returned 1 [0119.824] CloseHandle (hObject=0x170) returned 1 [0119.824] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08808_.wmf")) returned 0x20 [0119.824] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08808_.wmf.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0119.824] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08808_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0119.824] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0119.824] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0119.824] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08808_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0119.825] GetLastError () returned 0x0 [0119.825] ReadFile (in: hFile=0x170, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0xbb7c, lpOverlapped=0x0) returned 1 [0119.858] WriteFile (in: hFile=0x1f0, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xbb80, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0xbb80, lpOverlapped=0x0) returned 1 [0119.859] ReadFile (in: hFile=0x170, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x0, lpOverlapped=0x0) returned 1 [0119.859] WriteFile (in: hFile=0x1f0, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0xec, lpOverlapped=0x0) returned 1 [0119.859] SetEndOfFile (hFile=0x1f0) returned 1 [0119.859] CloseHandle (hObject=0x1f0) returned 1 [0119.859] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0119.859] SetEndOfFile (hFile=0x170) returned 1 [0119.860] CloseHandle (hObject=0x170) returned 1 [0119.860] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0119.860] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08808_.wmf")) returned 1 [0119.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 63 [0119.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 63 [0119.860] lstrlenW (lpString=".doc") returned 4 [0119.860] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0119.860] lstrlenW (lpString=".docx") returned 5 [0119.860] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0119.860] lstrlenW (lpString=".pdf") returned 4 [0119.860] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0119.860] lstrlenW (lpString=".xls") returned 4 [0119.860] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0119.861] lstrlenW (lpString=".xlsx") returned 5 [0119.861] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0119.861] lstrlenW (lpString=".ppt") returned 4 [0119.861] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0119.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 63 [0119.861] lstrlenW (lpString=".zip") returned 4 [0119.861] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0119.861] lstrlenW (lpString=".rar") returned 4 [0119.861] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0119.861] lstrlenW (lpString=".bz2") returned 4 [0119.861] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0119.861] lstrlenW (lpString=".7z") returned 3 [0119.861] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0119.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 63 [0119.861] lstrlenW (lpString=".dbf") returned 4 [0119.861] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0119.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 63 [0119.861] lstrlenW (lpString=".1cd") returned 4 [0119.861] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0119.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 63 [0119.861] lstrlenW (lpString=".jpg") returned 4 [0119.861] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0119.861] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x26ff9fc | out: lpFileSize=0x26ff9fc*=14540) returned 1 [0119.861] CloseHandle (hObject=0x170) returned 1 [0119.861] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09194_.wmf")) returned 0x20 [0119.861] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09194_.wmf.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0119.861] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09194_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0119.862] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0119.862] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0119.862] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09194_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0119.862] GetLastError () returned 0x0 [0119.862] ReadFile (in: hFile=0x170, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x38cc, lpOverlapped=0x0) returned 1 [0120.007] WriteFile (in: hFile=0x1f0, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x38d0, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0x38d0, lpOverlapped=0x0) returned 1 [0120.009] ReadFile (in: hFile=0x170, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x0, lpOverlapped=0x0) returned 1 [0120.009] WriteFile (in: hFile=0x1f0, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0xec, lpOverlapped=0x0) returned 1 [0120.009] SetEndOfFile (hFile=0x1f0) returned 1 [0120.076] CloseHandle (hObject=0x1f0) returned 1 [0120.076] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0120.076] SetEndOfFile (hFile=0x170) returned 1 [0120.076] CloseHandle (hObject=0x170) returned 1 [0120.077] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0120.077] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09194_.wmf")) returned 1 [0120.077] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 63 [0120.077] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 63 [0120.077] lstrlenW (lpString=".doc") returned 4 [0120.077] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0120.077] lstrlenW (lpString=".docx") returned 5 [0120.077] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0120.077] lstrlenW (lpString=".pdf") returned 4 [0120.077] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0120.077] lstrlenW (lpString=".xls") returned 4 [0120.077] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0120.077] lstrlenW (lpString=".xlsx") returned 5 [0120.077] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0120.077] lstrlenW (lpString=".ppt") returned 4 [0120.077] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0120.077] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 63 [0120.077] lstrlenW (lpString=".zip") returned 4 [0120.077] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0120.077] lstrlenW (lpString=".rar") returned 4 [0120.077] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0120.077] lstrlenW (lpString=".bz2") returned 4 [0120.077] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0120.077] lstrlenW (lpString=".7z") returned 3 [0120.077] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0120.077] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 63 [0120.077] lstrlenW (lpString=".dbf") returned 4 [0120.077] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0120.077] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 63 [0120.077] lstrlenW (lpString=".1cd") returned 4 [0120.077] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0120.077] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 63 [0120.077] lstrlenW (lpString=".jpg") returned 4 [0120.077] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0120.162] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0120.162] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0120.162] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19828_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0120.162] GetLastError () returned 0x0 [0120.162] ReadFile (in: hFile=0x194, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x2244, lpOverlapped=0x0) returned 1 [0120.239] WriteFile (in: hFile=0x22c, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x2250, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0x2250, lpOverlapped=0x0) returned 1 [0120.240] ReadFile (in: hFile=0x194, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x0, lpOverlapped=0x0) returned 1 [0120.240] WriteFile (in: hFile=0x22c, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0xec, lpOverlapped=0x0) returned 1 [0120.240] SetEndOfFile (hFile=0x22c) returned 1 [0120.240] CloseHandle (hObject=0x22c) returned 1 [0120.240] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0120.240] SetEndOfFile (hFile=0x194) returned 1 [0120.244] CloseHandle (hObject=0x194) returned 1 [0120.244] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0120.244] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19828_.wmf")) returned 1 [0120.245] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 63 [0120.245] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 63 [0120.245] lstrlenW (lpString=".doc") returned 4 [0120.245] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0120.245] lstrlenW (lpString=".docx") returned 5 [0120.245] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0120.245] lstrlenW (lpString=".pdf") returned 4 [0120.245] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0120.245] lstrlenW (lpString=".xls") returned 4 [0120.245] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0120.245] lstrlenW (lpString=".xlsx") returned 5 [0120.245] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0120.245] lstrlenW (lpString=".ppt") returned 4 [0120.245] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0120.245] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 63 [0120.245] lstrlenW (lpString=".zip") returned 4 [0120.245] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0120.245] lstrlenW (lpString=".rar") returned 4 [0120.245] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0120.245] lstrlenW (lpString=".bz2") returned 4 [0120.245] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0120.245] lstrlenW (lpString=".7z") returned 3 [0120.245] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0120.245] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 63 [0120.245] lstrlenW (lpString=".dbf") returned 4 [0120.245] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0120.245] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 63 [0120.245] lstrlenW (lpString=".1cd") returned 4 [0120.245] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0120.245] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 63 [0120.245] lstrlenW (lpString=".jpg") returned 4 [0120.245] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0120.441] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x26ff9fc | out: lpFileSize=0x26ff9fc*=12520) returned 1 [0120.441] CloseHandle (hObject=0x1f0) returned 1 [0120.441] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00008_.wmf")) returned 0x20 [0120.441] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00008_.wmf.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0120.441] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00008_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0120.441] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0120.441] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0120.441] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00008_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0120.441] GetLastError () returned 0x0 [0120.442] ReadFile (in: hFile=0x1f0, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x30e8, lpOverlapped=0x0) returned 1 [0120.458] WriteFile (in: hFile=0x1e0, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x30f0, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0x30f0, lpOverlapped=0x0) returned 1 [0120.458] ReadFile (in: hFile=0x1f0, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x0, lpOverlapped=0x0) returned 1 [0120.458] WriteFile (in: hFile=0x1e0, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0xec, lpOverlapped=0x0) returned 1 [0120.458] SetEndOfFile (hFile=0x1e0) returned 1 [0120.473] CloseHandle (hObject=0x1e0) returned 1 [0120.473] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0120.473] SetEndOfFile (hFile=0x1f0) returned 1 [0120.474] CloseHandle (hObject=0x1f0) returned 1 [0120.474] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0120.474] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00008_.wmf")) returned 1 [0120.476] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 63 [0120.476] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 63 [0120.476] lstrlenW (lpString=".doc") returned 4 [0120.476] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0120.476] lstrlenW (lpString=".docx") returned 5 [0120.476] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0120.476] lstrlenW (lpString=".pdf") returned 4 [0120.476] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0120.476] lstrlenW (lpString=".xls") returned 4 [0120.476] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0120.476] lstrlenW (lpString=".xlsx") returned 5 [0120.476] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0120.476] lstrlenW (lpString=".ppt") returned 4 [0120.477] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0120.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 63 [0120.477] lstrlenW (lpString=".zip") returned 4 [0120.477] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0120.477] lstrlenW (lpString=".rar") returned 4 [0120.477] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0120.477] lstrlenW (lpString=".bz2") returned 4 [0120.477] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0120.477] lstrlenW (lpString=".7z") returned 3 [0120.477] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0120.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 63 [0120.477] lstrlenW (lpString=".dbf") returned 4 [0120.477] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0120.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 63 [0120.477] lstrlenW (lpString=".1cd") returned 4 [0120.477] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0120.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 63 [0120.477] lstrlenW (lpString=".jpg") returned 4 [0120.477] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0120.477] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x26ff9fc | out: lpFileSize=0x26ff9fc*=10146) returned 1 [0120.477] CloseHandle (hObject=0x1f0) returned 1 [0120.477] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00122_.wmf")) returned 0x20 [0120.477] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00122_.wmf.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0120.477] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00122_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0120.478] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0120.478] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0120.478] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00122_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0120.478] GetLastError () returned 0x0 [0120.479] ReadFile (in: hFile=0x1f0, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x27a2, lpOverlapped=0x0) returned 1 [0120.571] WriteFile (in: hFile=0x1fc, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x27b0, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0x27b0, lpOverlapped=0x0) returned 1 [0120.572] ReadFile (in: hFile=0x1f0, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x0, lpOverlapped=0x0) returned 1 [0120.572] WriteFile (in: hFile=0x1fc, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0xec, lpOverlapped=0x0) returned 1 [0120.572] SetEndOfFile (hFile=0x1fc) returned 1 [0120.572] CloseHandle (hObject=0x1fc) returned 1 [0120.572] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0120.572] SetEndOfFile (hFile=0x1f0) returned 1 [0120.578] CloseHandle (hObject=0x1f0) returned 1 [0120.578] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0120.580] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00122_.wmf")) returned 1 [0120.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 63 [0120.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 63 [0120.583] lstrlenW (lpString=".doc") returned 4 [0120.583] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0120.583] lstrlenW (lpString=".docx") returned 5 [0120.583] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0120.583] lstrlenW (lpString=".pdf") returned 4 [0120.583] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0120.583] lstrlenW (lpString=".xls") returned 4 [0120.583] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0120.583] lstrlenW (lpString=".xlsx") returned 5 [0120.584] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0120.584] lstrlenW (lpString=".ppt") returned 4 [0120.584] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0120.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 63 [0120.584] lstrlenW (lpString=".zip") returned 4 [0120.584] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0120.584] lstrlenW (lpString=".rar") returned 4 [0120.584] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0120.584] lstrlenW (lpString=".bz2") returned 4 [0120.584] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0120.584] lstrlenW (lpString=".7z") returned 3 [0120.584] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0120.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 63 [0120.584] lstrlenW (lpString=".dbf") returned 4 [0120.584] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0120.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 63 [0120.584] lstrlenW (lpString=".1cd") returned 4 [0120.584] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0120.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 63 [0120.584] lstrlenW (lpString=".jpg") returned 4 [0120.584] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0120.586] SetFilePointerEx (in: hFile=0x224, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0120.586] SetFilePointerEx (in: hFile=0x224, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0120.586] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00194_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0120.586] GetLastError () returned 0x0 [0120.586] ReadFile (in: hFile=0x224, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0xf92, lpOverlapped=0x0) returned 1 [0120.598] WriteFile (in: hFile=0x19c, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xfa0, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0xfa0, lpOverlapped=0x0) returned 1 [0120.599] ReadFile (in: hFile=0x224, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x0, lpOverlapped=0x0) returned 1 [0120.599] WriteFile (in: hFile=0x19c, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0xec, lpOverlapped=0x0) returned 1 [0120.599] SetEndOfFile (hFile=0x19c) returned 1 [0120.599] CloseHandle (hObject=0x19c) returned 1 [0120.599] SetFilePointerEx (in: hFile=0x224, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0120.599] SetEndOfFile (hFile=0x224) returned 1 [0120.600] CloseHandle (hObject=0x224) returned 1 [0120.600] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0120.600] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00194_.wmf")) returned 1 [0120.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 63 [0120.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 63 [0120.600] lstrlenW (lpString=".doc") returned 4 [0120.600] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0120.600] lstrlenW (lpString=".docx") returned 5 [0120.600] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0120.601] lstrlenW (lpString=".pdf") returned 4 [0120.601] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0120.601] lstrlenW (lpString=".xls") returned 4 [0120.601] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0120.601] lstrlenW (lpString=".xlsx") returned 5 [0120.601] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0120.601] lstrlenW (lpString=".ppt") returned 4 [0120.601] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0120.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 63 [0120.601] lstrlenW (lpString=".zip") returned 4 [0120.601] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0120.601] lstrlenW (lpString=".rar") returned 4 [0120.601] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0120.601] lstrlenW (lpString=".bz2") returned 4 [0120.601] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0120.601] lstrlenW (lpString=".7z") returned 3 [0120.601] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0120.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 63 [0120.601] lstrlenW (lpString=".dbf") returned 4 [0120.601] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0120.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 63 [0120.601] lstrlenW (lpString=".1cd") returned 4 [0120.601] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0120.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 63 [0120.601] lstrlenW (lpString=".jpg") returned 4 [0120.601] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0120.601] GetFileSizeEx (in: hFile=0x224, lpFileSize=0x26ff9fc | out: lpFileSize=0x26ff9fc*=4024) returned 1 [0120.601] CloseHandle (hObject=0x224) returned 1 [0120.601] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00242_.wmf")) returned 0x20 [0120.601] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00242_.wmf.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0120.601] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00242_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x224 [0120.602] SetFilePointerEx (in: hFile=0x224, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0120.602] SetFilePointerEx (in: hFile=0x224, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0120.602] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00242_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0120.602] GetLastError () returned 0x0 [0120.602] ReadFile (in: hFile=0x224, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0xfb8, lpOverlapped=0x0) returned 1 [0120.615] WriteFile (in: hFile=0x19c, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xfc0, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0xfc0, lpOverlapped=0x0) returned 1 [0120.616] ReadFile (in: hFile=0x224, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x0, lpOverlapped=0x0) returned 1 [0120.616] WriteFile (in: hFile=0x19c, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0xec, lpOverlapped=0x0) returned 1 [0120.616] SetEndOfFile (hFile=0x19c) returned 1 [0120.616] CloseHandle (hObject=0x19c) returned 1 [0120.616] SetFilePointerEx (in: hFile=0x224, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0120.616] SetEndOfFile (hFile=0x224) returned 1 [0120.617] CloseHandle (hObject=0x224) returned 1 [0120.617] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0120.617] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00242_.wmf")) returned 1 [0120.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 63 [0120.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 63 [0120.617] lstrlenW (lpString=".doc") returned 4 [0120.617] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0120.617] lstrlenW (lpString=".docx") returned 5 [0120.617] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0120.617] lstrlenW (lpString=".pdf") returned 4 [0120.617] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0120.617] lstrlenW (lpString=".xls") returned 4 [0120.617] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0120.617] lstrlenW (lpString=".xlsx") returned 5 [0120.617] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0120.617] lstrlenW (lpString=".ppt") returned 4 [0120.617] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0120.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 63 [0120.617] lstrlenW (lpString=".zip") returned 4 [0120.617] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0120.617] lstrlenW (lpString=".rar") returned 4 [0120.617] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0120.617] lstrlenW (lpString=".bz2") returned 4 [0120.617] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0120.618] lstrlenW (lpString=".7z") returned 3 [0120.618] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0120.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 63 [0120.618] lstrlenW (lpString=".dbf") returned 4 [0120.618] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0120.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 63 [0120.618] lstrlenW (lpString=".1cd") returned 4 [0120.618] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0120.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 63 [0120.618] lstrlenW (lpString=".jpg") returned 4 [0120.618] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0120.618] GetFileSizeEx (in: hFile=0x224, lpFileSize=0x26ff9fc | out: lpFileSize=0x26ff9fc*=1536) returned 1 [0120.618] CloseHandle (hObject=0x224) returned 1 [0120.618] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00248_.wmf")) returned 0x20 [0120.618] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00248_.wmf.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0120.618] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00248_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x224 [0120.618] SetFilePointerEx (in: hFile=0x224, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0120.618] SetFilePointerEx (in: hFile=0x224, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0120.619] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00248_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0120.619] GetLastError () returned 0x0 [0120.619] ReadFile (in: hFile=0x224, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x600, lpOverlapped=0x0) returned 1 [0120.620] WriteFile (in: hFile=0x19c, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x610, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0x610, lpOverlapped=0x0) returned 1 [0120.620] ReadFile (in: hFile=0x224, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x0, lpOverlapped=0x0) returned 1 [0120.621] WriteFile (in: hFile=0x19c, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0xec, lpOverlapped=0x0) returned 1 [0120.621] SetEndOfFile (hFile=0x19c) returned 1 [0120.621] CloseHandle (hObject=0x19c) returned 1 [0120.621] SetFilePointerEx (in: hFile=0x224, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0120.621] SetEndOfFile (hFile=0x224) returned 1 [0120.621] CloseHandle (hObject=0x224) returned 1 [0120.621] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0120.622] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00248_.wmf")) returned 1 [0120.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 63 [0120.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 63 [0120.622] lstrlenW (lpString=".doc") returned 4 [0120.622] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0120.622] lstrlenW (lpString=".docx") returned 5 [0120.622] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0120.622] lstrlenW (lpString=".pdf") returned 4 [0120.622] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0120.622] lstrlenW (lpString=".xls") returned 4 [0120.622] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0120.622] lstrlenW (lpString=".xlsx") returned 5 [0120.622] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0120.622] lstrlenW (lpString=".ppt") returned 4 [0120.622] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0120.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 63 [0120.622] lstrlenW (lpString=".zip") returned 4 [0120.622] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0120.622] lstrlenW (lpString=".rar") returned 4 [0120.622] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0120.622] lstrlenW (lpString=".bz2") returned 4 [0120.622] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0120.622] lstrlenW (lpString=".7z") returned 3 [0120.622] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0120.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 63 [0120.622] lstrlenW (lpString=".dbf") returned 4 [0120.622] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0120.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 63 [0120.622] lstrlenW (lpString=".1cd") returned 4 [0120.622] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0120.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 63 [0120.622] lstrlenW (lpString=".jpg") returned 4 [0120.622] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0120.623] GetFileSizeEx (in: hFile=0x224, lpFileSize=0x26ff9fc | out: lpFileSize=0x26ff9fc*=4708) returned 1 [0120.623] CloseHandle (hObject=0x224) returned 1 [0120.623] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00252_.wmf")) returned 0x20 [0120.623] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00252_.wmf.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0120.623] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00252_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x224 [0120.623] SetFilePointerEx (in: hFile=0x224, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0120.623] SetFilePointerEx (in: hFile=0x224, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0120.623] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00252_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0120.623] GetLastError () returned 0x0 [0120.623] ReadFile (in: hFile=0x224, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x1264, lpOverlapped=0x0) returned 1 [0120.625] WriteFile (in: hFile=0x19c, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x1270, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0x1270, lpOverlapped=0x0) returned 1 [0120.625] ReadFile (in: hFile=0x224, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x0, lpOverlapped=0x0) returned 1 [0120.625] WriteFile (in: hFile=0x19c, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0xec, lpOverlapped=0x0) returned 1 [0120.625] SetEndOfFile (hFile=0x19c) returned 1 [0120.626] CloseHandle (hObject=0x19c) returned 1 [0120.626] SetFilePointerEx (in: hFile=0x224, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0120.626] SetEndOfFile (hFile=0x224) returned 1 [0120.627] CloseHandle (hObject=0x224) returned 1 [0120.627] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0120.627] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00252_.wmf")) returned 1 [0120.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 63 [0120.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 63 [0120.627] lstrlenW (lpString=".doc") returned 4 [0120.627] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0120.627] lstrlenW (lpString=".docx") returned 5 [0120.627] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0120.627] lstrlenW (lpString=".pdf") returned 4 [0120.627] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0120.627] lstrlenW (lpString=".xls") returned 4 [0120.627] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0120.627] lstrlenW (lpString=".xlsx") returned 5 [0120.627] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0120.627] lstrlenW (lpString=".ppt") returned 4 [0120.627] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0120.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 63 [0120.627] lstrlenW (lpString=".zip") returned 4 [0120.627] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0120.627] lstrlenW (lpString=".rar") returned 4 [0120.627] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0120.627] lstrlenW (lpString=".bz2") returned 4 [0120.627] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0120.627] lstrlenW (lpString=".7z") returned 3 [0120.627] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0120.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 63 [0120.627] lstrlenW (lpString=".dbf") returned 4 [0120.627] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0120.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 63 [0120.627] lstrlenW (lpString=".1cd") returned 4 [0120.627] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0120.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 63 [0120.627] lstrlenW (lpString=".jpg") returned 4 [0120.628] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0120.630] GetFileSizeEx (in: hFile=0x224, lpFileSize=0x26ff9fc | out: lpFileSize=0x26ff9fc*=1736) returned 1 [0120.630] CloseHandle (hObject=0x224) returned 1 [0120.630] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00254_.wmf")) returned 0x20 [0120.630] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00254_.wmf.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0120.630] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00254_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x224 [0120.630] SetFilePointerEx (in: hFile=0x224, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0120.631] SetFilePointerEx (in: hFile=0x224, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0120.631] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00254_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0120.631] GetLastError () returned 0x0 [0120.631] ReadFile (in: hFile=0x224, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x6c8, lpOverlapped=0x0) returned 1 [0120.639] WriteFile (in: hFile=0x19c, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x6d0, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0x6d0, lpOverlapped=0x0) returned 1 [0120.639] ReadFile (in: hFile=0x224, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x0, lpOverlapped=0x0) returned 1 [0120.640] WriteFile (in: hFile=0x19c, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0xec, lpOverlapped=0x0) returned 1 [0120.640] SetEndOfFile (hFile=0x19c) returned 1 [0120.640] CloseHandle (hObject=0x19c) returned 1 [0120.640] SetFilePointerEx (in: hFile=0x224, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0120.640] SetEndOfFile (hFile=0x224) returned 1 [0120.640] CloseHandle (hObject=0x224) returned 1 [0120.640] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0120.641] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00254_.wmf")) returned 1 [0120.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 63 [0120.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 63 [0120.641] lstrlenW (lpString=".doc") returned 4 [0120.641] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0120.641] lstrlenW (lpString=".docx") returned 5 [0120.641] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0120.641] lstrlenW (lpString=".pdf") returned 4 [0120.641] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0120.641] lstrlenW (lpString=".xls") returned 4 [0120.641] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0120.641] lstrlenW (lpString=".xlsx") returned 5 [0120.641] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0120.641] lstrlenW (lpString=".ppt") returned 4 [0120.641] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0120.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 63 [0120.641] lstrlenW (lpString=".zip") returned 4 [0120.641] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0120.641] lstrlenW (lpString=".rar") returned 4 [0120.641] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0120.641] lstrlenW (lpString=".bz2") returned 4 [0120.641] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0120.641] lstrlenW (lpString=".7z") returned 3 [0120.641] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0120.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 63 [0120.641] lstrlenW (lpString=".dbf") returned 4 [0120.641] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0120.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 63 [0120.641] lstrlenW (lpString=".1cd") returned 4 [0120.641] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0120.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 63 [0120.641] lstrlenW (lpString=".jpg") returned 4 [0120.641] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0120.642] GetFileSizeEx (in: hFile=0x224, lpFileSize=0x26ff9fc | out: lpFileSize=0x26ff9fc*=2556) returned 1 [0120.642] CloseHandle (hObject=0x224) returned 1 [0120.642] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00262_.wmf")) returned 0x20 [0120.642] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00262_.wmf.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0120.642] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00262_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x224 [0120.643] SetFilePointerEx (in: hFile=0x224, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0120.643] SetFilePointerEx (in: hFile=0x224, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0120.643] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00262_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0120.643] GetLastError () returned 0x0 [0120.643] ReadFile (in: hFile=0x224, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x9fc, lpOverlapped=0x0) returned 1 [0120.644] WriteFile (in: hFile=0x19c, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xa00, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0xa00, lpOverlapped=0x0) returned 1 [0120.644] ReadFile (in: hFile=0x224, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x0, lpOverlapped=0x0) returned 1 [0120.644] WriteFile (in: hFile=0x19c, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0xec, lpOverlapped=0x0) returned 1 [0120.645] SetEndOfFile (hFile=0x19c) returned 1 [0120.645] CloseHandle (hObject=0x19c) returned 1 [0120.645] SetFilePointerEx (in: hFile=0x224, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0120.645] SetEndOfFile (hFile=0x224) returned 1 [0120.645] CloseHandle (hObject=0x224) returned 1 [0120.646] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0120.646] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00262_.wmf")) returned 1 [0120.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 63 [0120.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 63 [0120.646] lstrlenW (lpString=".doc") returned 4 [0120.646] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0120.646] lstrlenW (lpString=".docx") returned 5 [0120.646] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0120.646] lstrlenW (lpString=".pdf") returned 4 [0120.646] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0120.646] lstrlenW (lpString=".xls") returned 4 [0120.646] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0120.646] lstrlenW (lpString=".xlsx") returned 5 [0120.646] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0120.646] lstrlenW (lpString=".ppt") returned 4 [0120.646] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0120.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 63 [0120.646] lstrlenW (lpString=".zip") returned 4 [0120.646] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0120.646] lstrlenW (lpString=".rar") returned 4 [0120.646] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0120.646] lstrlenW (lpString=".bz2") returned 4 [0120.646] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0120.646] lstrlenW (lpString=".7z") returned 3 [0120.646] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0120.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 63 [0120.646] lstrlenW (lpString=".dbf") returned 4 [0120.646] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0120.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 63 [0120.646] lstrlenW (lpString=".1cd") returned 4 [0120.646] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0120.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 63 [0120.646] lstrlenW (lpString=".jpg") returned 4 [0120.646] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0120.647] GetFileSizeEx (in: hFile=0x224, lpFileSize=0x26ff9fc | out: lpFileSize=0x26ff9fc*=5752) returned 1 [0120.647] CloseHandle (hObject=0x224) returned 1 [0120.647] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00265_.wmf")) returned 0x20 [0120.647] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00265_.wmf.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0120.647] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00265_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x224 [0120.647] SetFilePointerEx (in: hFile=0x224, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0120.647] SetFilePointerEx (in: hFile=0x224, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0120.647] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00265_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0120.647] GetLastError () returned 0x0 [0120.647] ReadFile (in: hFile=0x224, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x1678, lpOverlapped=0x0) returned 1 [0120.674] WriteFile (in: hFile=0x19c, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x1680, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0x1680, lpOverlapped=0x0) returned 1 [0120.675] ReadFile (in: hFile=0x224, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x0, lpOverlapped=0x0) returned 1 [0120.675] WriteFile (in: hFile=0x19c, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0xec, lpOverlapped=0x0) returned 1 [0120.675] SetEndOfFile (hFile=0x19c) returned 1 [0120.675] CloseHandle (hObject=0x19c) returned 1 [0120.675] SetFilePointerEx (in: hFile=0x224, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0120.675] SetEndOfFile (hFile=0x224) returned 1 [0120.675] CloseHandle (hObject=0x224) returned 1 [0120.676] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0120.676] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00265_.wmf")) returned 1 [0120.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 63 [0120.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 63 [0120.676] lstrlenW (lpString=".doc") returned 4 [0120.676] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0120.676] lstrlenW (lpString=".docx") returned 5 [0120.676] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0120.676] lstrlenW (lpString=".pdf") returned 4 [0120.676] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0120.676] lstrlenW (lpString=".xls") returned 4 [0120.676] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0120.676] lstrlenW (lpString=".xlsx") returned 5 [0120.676] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0120.676] lstrlenW (lpString=".ppt") returned 4 [0120.676] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0120.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 63 [0120.676] lstrlenW (lpString=".zip") returned 4 [0120.676] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0120.676] lstrlenW (lpString=".rar") returned 4 [0120.676] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0120.676] lstrlenW (lpString=".bz2") returned 4 [0120.676] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0120.676] lstrlenW (lpString=".7z") returned 3 [0120.676] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0120.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 63 [0120.676] lstrlenW (lpString=".dbf") returned 4 [0120.677] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0120.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 63 [0120.677] lstrlenW (lpString=".1cd") returned 4 [0120.677] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0120.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 63 [0120.677] lstrlenW (lpString=".jpg") returned 4 [0120.677] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0120.677] GetFileSizeEx (in: hFile=0x224, lpFileSize=0x26ff9fc | out: lpFileSize=0x26ff9fc*=2644) returned 1 [0120.677] CloseHandle (hObject=0x224) returned 1 [0120.677] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00267_.wmf")) returned 0x20 [0120.677] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00267_.wmf.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0120.677] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00267_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x224 [0120.677] SetFilePointerEx (in: hFile=0x224, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0120.677] SetFilePointerEx (in: hFile=0x224, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0120.677] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00267_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0120.678] GetLastError () returned 0x0 [0120.678] ReadFile (in: hFile=0x224, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0xa54, lpOverlapped=0x0) returned 1 [0120.716] WriteFile (in: hFile=0x19c, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xa60, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0xa60, lpOverlapped=0x0) returned 1 [0120.717] ReadFile (in: hFile=0x224, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x0, lpOverlapped=0x0) returned 1 [0120.717] WriteFile (in: hFile=0x19c, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0xec, lpOverlapped=0x0) returned 1 [0120.720] SetEndOfFile (hFile=0x19c) returned 1 [0120.720] CloseHandle (hObject=0x19c) returned 1 [0120.720] SetFilePointerEx (in: hFile=0x224, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0120.720] SetEndOfFile (hFile=0x224) returned 1 [0120.721] CloseHandle (hObject=0x224) returned 1 [0120.721] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0120.721] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00267_.wmf")) returned 1 [0120.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 63 [0120.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 63 [0120.721] lstrlenW (lpString=".doc") returned 4 [0120.721] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0120.721] lstrlenW (lpString=".docx") returned 5 [0120.721] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0120.721] lstrlenW (lpString=".pdf") returned 4 [0120.721] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0120.724] lstrlenW (lpString=".xls") returned 4 [0120.724] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0120.724] lstrlenW (lpString=".xlsx") returned 5 [0120.724] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0120.724] lstrlenW (lpString=".ppt") returned 4 [0120.724] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0120.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 63 [0120.724] lstrlenW (lpString=".zip") returned 4 [0120.724] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0120.724] lstrlenW (lpString=".rar") returned 4 [0120.724] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0120.724] lstrlenW (lpString=".bz2") returned 4 [0120.724] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0120.724] lstrlenW (lpString=".7z") returned 3 [0120.724] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0120.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 63 [0120.724] lstrlenW (lpString=".dbf") returned 4 [0120.724] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0120.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 63 [0120.724] lstrlenW (lpString=".1cd") returned 4 [0120.724] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0120.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 63 [0120.724] lstrlenW (lpString=".jpg") returned 4 [0120.724] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0120.725] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x26ff9fc | out: lpFileSize=0x26ff9fc*=27050) returned 1 [0120.725] CloseHandle (hObject=0x194) returned 1 [0120.725] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00392_.wmf")) returned 0x20 [0120.725] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00392_.wmf.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0120.725] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00392_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0120.725] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0120.725] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0120.725] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00392_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0120.725] GetLastError () returned 0x0 [0120.725] ReadFile (in: hFile=0x194, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x69aa, lpOverlapped=0x0) returned 1 [0120.732] WriteFile (in: hFile=0x22c, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x69b0, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0x69b0, lpOverlapped=0x0) returned 1 [0120.733] ReadFile (in: hFile=0x194, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x0, lpOverlapped=0x0) returned 1 [0120.733] WriteFile (in: hFile=0x22c, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0xec, lpOverlapped=0x0) returned 1 [0120.733] SetEndOfFile (hFile=0x22c) returned 1 [0120.733] CloseHandle (hObject=0x22c) returned 1 [0120.733] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0120.733] SetEndOfFile (hFile=0x194) returned 1 [0120.734] CloseHandle (hObject=0x194) returned 1 [0120.734] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0120.734] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00392_.wmf")) returned 1 [0120.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 63 [0120.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 63 [0120.734] lstrlenW (lpString=".doc") returned 4 [0120.734] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0120.734] lstrlenW (lpString=".docx") returned 5 [0120.734] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0120.734] lstrlenW (lpString=".pdf") returned 4 [0120.734] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0120.734] lstrlenW (lpString=".xls") returned 4 [0120.734] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0120.734] lstrlenW (lpString=".xlsx") returned 5 [0120.734] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0120.734] lstrlenW (lpString=".ppt") returned 4 [0120.735] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0120.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 63 [0120.735] lstrlenW (lpString=".zip") returned 4 [0120.735] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0120.735] lstrlenW (lpString=".rar") returned 4 [0120.735] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0120.735] lstrlenW (lpString=".bz2") returned 4 [0120.735] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0120.735] lstrlenW (lpString=".7z") returned 3 [0120.735] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0120.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 63 [0120.735] lstrlenW (lpString=".dbf") returned 4 [0120.735] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0120.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 63 [0120.735] lstrlenW (lpString=".1cd") returned 4 [0120.735] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0120.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 63 [0120.735] lstrlenW (lpString=".jpg") returned 4 [0120.735] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0120.735] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x26ff9fc | out: lpFileSize=0x26ff9fc*=6996) returned 1 [0120.735] CloseHandle (hObject=0x194) returned 1 [0120.735] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00524_.wmf")) returned 0x20 [0120.735] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00524_.wmf.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0120.735] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00524_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0120.735] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0120.735] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0120.736] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00524_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0120.736] GetLastError () returned 0x0 [0120.736] ReadFile (in: hFile=0x194, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x1b54, lpOverlapped=0x0) returned 1 [0120.746] WriteFile (in: hFile=0x22c, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x1b60, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0x1b60, lpOverlapped=0x0) returned 1 [0120.746] ReadFile (in: hFile=0x194, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x0, lpOverlapped=0x0) returned 1 [0120.747] WriteFile (in: hFile=0x22c, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0xec, lpOverlapped=0x0) returned 1 [0120.747] SetEndOfFile (hFile=0x22c) returned 1 [0120.747] CloseHandle (hObject=0x22c) returned 1 [0120.747] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0120.747] SetEndOfFile (hFile=0x194) returned 1 [0120.747] CloseHandle (hObject=0x194) returned 1 [0120.747] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0120.748] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00524_.wmf")) returned 1 [0120.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 63 [0120.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 63 [0120.748] lstrlenW (lpString=".doc") returned 4 [0120.748] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0120.748] lstrlenW (lpString=".docx") returned 5 [0120.748] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0120.748] lstrlenW (lpString=".pdf") returned 4 [0120.748] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0120.748] lstrlenW (lpString=".xls") returned 4 [0120.748] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0120.748] lstrlenW (lpString=".xlsx") returned 5 [0120.748] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0120.748] lstrlenW (lpString=".ppt") returned 4 [0120.748] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0120.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 63 [0120.748] lstrlenW (lpString=".zip") returned 4 [0120.748] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0120.748] lstrlenW (lpString=".rar") returned 4 [0120.748] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0120.748] lstrlenW (lpString=".bz2") returned 4 [0120.748] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0120.748] lstrlenW (lpString=".7z") returned 3 [0120.748] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0120.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 63 [0120.748] lstrlenW (lpString=".dbf") returned 4 [0120.748] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0120.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 63 [0120.748] lstrlenW (lpString=".1cd") returned 4 [0120.748] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0120.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 63 [0120.748] lstrlenW (lpString=".jpg") returned 4 [0120.748] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0120.749] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x26ff9fc | out: lpFileSize=0x26ff9fc*=11500) returned 1 [0120.749] CloseHandle (hObject=0x194) returned 1 [0120.749] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00648_.wmf")) returned 0x20 [0120.749] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00648_.wmf.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0120.749] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00648_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0120.749] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0120.749] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0120.749] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00648_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0120.749] GetLastError () returned 0x0 [0120.749] ReadFile (in: hFile=0x194, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x2cec, lpOverlapped=0x0) returned 1 [0120.759] WriteFile (in: hFile=0x22c, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x2cf0, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0x2cf0, lpOverlapped=0x0) returned 1 [0120.760] ReadFile (in: hFile=0x194, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x0, lpOverlapped=0x0) returned 1 [0120.760] WriteFile (in: hFile=0x22c, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0xec, lpOverlapped=0x0) returned 1 [0120.760] SetEndOfFile (hFile=0x22c) returned 1 [0120.760] CloseHandle (hObject=0x22c) returned 1 [0120.760] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0120.760] SetEndOfFile (hFile=0x194) returned 1 [0120.761] CloseHandle (hObject=0x194) returned 1 [0120.761] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0120.761] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00648_.wmf")) returned 1 [0120.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 63 [0120.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 63 [0120.761] lstrlenW (lpString=".doc") returned 4 [0120.761] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0120.761] lstrlenW (lpString=".docx") returned 5 [0120.761] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0120.761] lstrlenW (lpString=".pdf") returned 4 [0120.761] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0120.761] lstrlenW (lpString=".xls") returned 4 [0120.761] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0120.761] lstrlenW (lpString=".xlsx") returned 5 [0120.761] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0120.761] lstrlenW (lpString=".ppt") returned 4 [0120.761] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0120.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 63 [0120.761] lstrlenW (lpString=".zip") returned 4 [0120.761] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0120.761] lstrlenW (lpString=".rar") returned 4 [0120.761] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0120.761] lstrlenW (lpString=".bz2") returned 4 [0120.761] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0120.761] lstrlenW (lpString=".7z") returned 3 [0120.761] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0120.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 63 [0120.761] lstrlenW (lpString=".dbf") returned 4 [0120.761] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0120.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 63 [0120.761] lstrlenW (lpString=".1cd") returned 4 [0120.761] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0120.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 63 [0120.761] lstrlenW (lpString=".jpg") returned 4 [0120.761] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0120.800] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0120.801] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0120.801] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00932_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0120.801] GetLastError () returned 0x0 [0120.801] ReadFile (in: hFile=0x1e4, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x4c14, lpOverlapped=0x0) returned 1 [0120.816] WriteFile (in: hFile=0x194, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x4c20, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0x4c20, lpOverlapped=0x0) returned 1 [0120.817] ReadFile (in: hFile=0x1e4, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x0, lpOverlapped=0x0) returned 1 [0120.817] WriteFile (in: hFile=0x194, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0xec, lpOverlapped=0x0) returned 1 [0120.817] SetEndOfFile (hFile=0x194) returned 1 [0120.817] CloseHandle (hObject=0x194) returned 1 [0120.817] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0120.817] SetEndOfFile (hFile=0x1e4) returned 1 [0120.818] CloseHandle (hObject=0x1e4) returned 1 [0120.818] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0120.818] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00932_.wmf")) returned 1 [0120.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 63 [0120.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 63 [0120.819] lstrlenW (lpString=".doc") returned 4 [0120.819] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0120.819] lstrlenW (lpString=".docx") returned 5 [0120.819] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0120.819] lstrlenW (lpString=".pdf") returned 4 [0120.819] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0120.819] lstrlenW (lpString=".xls") returned 4 [0120.819] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0120.819] lstrlenW (lpString=".xlsx") returned 5 [0120.819] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0120.819] lstrlenW (lpString=".ppt") returned 4 [0120.819] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0120.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 63 [0120.819] lstrlenW (lpString=".zip") returned 4 [0120.819] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0120.819] lstrlenW (lpString=".rar") returned 4 [0120.819] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0120.819] lstrlenW (lpString=".bz2") returned 4 [0120.819] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0120.819] lstrlenW (lpString=".7z") returned 3 [0120.819] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0120.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 63 [0120.819] lstrlenW (lpString=".dbf") returned 4 [0120.819] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0120.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 63 [0120.820] lstrlenW (lpString=".1cd") returned 4 [0120.820] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0120.820] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 63 [0120.820] lstrlenW (lpString=".jpg") returned 4 [0120.820] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0120.820] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x26ff9fc | out: lpFileSize=0x26ff9fc*=7974) returned 1 [0120.820] CloseHandle (hObject=0x1e4) returned 1 [0120.820] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00092_.wmf")) returned 0x20 [0120.820] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00092_.wmf.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0120.820] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00092_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0120.820] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0120.821] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0120.821] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00092_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0120.821] GetLastError () returned 0x0 [0120.821] ReadFile (in: hFile=0x1e4, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x1f26, lpOverlapped=0x0) returned 1 [0120.876] WriteFile (in: hFile=0x194, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x1f30, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0x1f30, lpOverlapped=0x0) returned 1 [0120.877] ReadFile (in: hFile=0x1e4, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x0, lpOverlapped=0x0) returned 1 [0120.877] WriteFile (in: hFile=0x194, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0xec, lpOverlapped=0x0) returned 1 [0120.877] SetEndOfFile (hFile=0x194) returned 1 [0120.877] CloseHandle (hObject=0x194) returned 1 [0120.877] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0120.877] SetEndOfFile (hFile=0x1e4) returned 1 [0120.879] CloseHandle (hObject=0x1e4) returned 1 [0120.879] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0120.879] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00092_.wmf")) returned 1 [0120.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 63 [0120.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 63 [0120.879] lstrlenW (lpString=".doc") returned 4 [0120.879] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0120.880] lstrlenW (lpString=".docx") returned 5 [0120.880] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0120.880] lstrlenW (lpString=".pdf") returned 4 [0120.880] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0120.880] lstrlenW (lpString=".xls") returned 4 [0120.880] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0120.880] lstrlenW (lpString=".xlsx") returned 5 [0120.880] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0120.880] lstrlenW (lpString=".ppt") returned 4 [0120.880] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0120.880] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 63 [0120.880] lstrlenW (lpString=".zip") returned 4 [0120.880] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0120.880] lstrlenW (lpString=".rar") returned 4 [0120.880] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0120.880] lstrlenW (lpString=".bz2") returned 4 [0120.880] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0120.880] lstrlenW (lpString=".7z") returned 3 [0120.880] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0120.880] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 63 [0120.880] lstrlenW (lpString=".dbf") returned 4 [0120.880] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0120.880] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 63 [0120.880] lstrlenW (lpString=".1cd") returned 4 [0120.880] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0120.880] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 63 [0120.880] lstrlenW (lpString=".jpg") returned 4 [0120.880] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0120.881] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x26ff9fc | out: lpFileSize=0x26ff9fc*=1712) returned 1 [0120.881] CloseHandle (hObject=0x1e4) returned 1 [0120.881] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00145_.wmf")) returned 0x20 [0120.881] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00145_.wmf.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0120.881] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00145_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0120.881] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0120.881] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0120.881] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00145_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0120.881] GetLastError () returned 0x0 [0120.881] ReadFile (in: hFile=0x1e4, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x6b0, lpOverlapped=0x0) returned 1 [0120.888] WriteFile (in: hFile=0x194, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x6c0, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0x6c0, lpOverlapped=0x0) returned 1 [0120.888] ReadFile (in: hFile=0x1e4, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x0, lpOverlapped=0x0) returned 1 [0120.888] WriteFile (in: hFile=0x194, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0xec, lpOverlapped=0x0) returned 1 [0120.889] SetEndOfFile (hFile=0x194) returned 1 [0120.889] CloseHandle (hObject=0x194) returned 1 [0120.889] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0120.889] SetEndOfFile (hFile=0x1e4) returned 1 [0120.889] CloseHandle (hObject=0x1e4) returned 1 [0120.889] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0120.890] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00145_.wmf")) returned 1 [0120.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 63 [0120.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 63 [0120.890] lstrlenW (lpString=".doc") returned 4 [0120.890] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0120.890] lstrlenW (lpString=".docx") returned 5 [0120.890] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0120.890] lstrlenW (lpString=".pdf") returned 4 [0120.890] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0120.890] lstrlenW (lpString=".xls") returned 4 [0120.890] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0120.890] lstrlenW (lpString=".xlsx") returned 5 [0120.890] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0120.890] lstrlenW (lpString=".ppt") returned 4 [0120.890] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0120.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 63 [0120.890] lstrlenW (lpString=".zip") returned 4 [0120.890] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0120.890] lstrlenW (lpString=".rar") returned 4 [0120.890] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0120.890] lstrlenW (lpString=".bz2") returned 4 [0120.890] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0120.890] lstrlenW (lpString=".7z") returned 3 [0120.890] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0120.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 63 [0120.890] lstrlenW (lpString=".dbf") returned 4 [0120.890] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0120.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 63 [0120.890] lstrlenW (lpString=".1cd") returned 4 [0120.890] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0120.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 63 [0120.890] lstrlenW (lpString=".jpg") returned 4 [0120.890] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0120.890] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x26ff9fc | out: lpFileSize=0x26ff9fc*=4976) returned 1 [0120.891] CloseHandle (hObject=0x1e4) returned 1 [0120.891] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00184_.wmf")) returned 0x20 [0120.891] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00184_.wmf.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0120.891] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00184_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0120.891] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0120.891] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0120.891] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00184_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0120.891] GetLastError () returned 0x0 [0120.891] ReadFile (in: hFile=0x1e4, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x1370, lpOverlapped=0x0) returned 1 [0120.913] WriteFile (in: hFile=0x194, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x1380, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0x1380, lpOverlapped=0x0) returned 1 [0120.914] ReadFile (in: hFile=0x1e4, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x0, lpOverlapped=0x0) returned 1 [0120.914] WriteFile (in: hFile=0x194, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0xec, lpOverlapped=0x0) returned 1 [0120.914] SetEndOfFile (hFile=0x194) returned 1 [0120.914] CloseHandle (hObject=0x194) returned 1 [0120.914] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0120.915] SetEndOfFile (hFile=0x1e4) returned 1 [0120.915] CloseHandle (hObject=0x1e4) returned 1 [0120.915] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0120.915] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00184_.wmf")) returned 1 [0120.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 63 [0120.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 63 [0120.916] lstrlenW (lpString=".doc") returned 4 [0120.916] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0120.916] lstrlenW (lpString=".docx") returned 5 [0120.916] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0120.916] lstrlenW (lpString=".pdf") returned 4 [0120.916] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0120.916] lstrlenW (lpString=".xls") returned 4 [0120.916] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0120.916] lstrlenW (lpString=".xlsx") returned 5 [0120.916] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0120.916] lstrlenW (lpString=".ppt") returned 4 [0120.916] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0120.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 63 [0120.916] lstrlenW (lpString=".zip") returned 4 [0120.916] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0120.916] lstrlenW (lpString=".rar") returned 4 [0120.916] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0120.916] lstrlenW (lpString=".bz2") returned 4 [0120.916] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0120.916] lstrlenW (lpString=".7z") returned 3 [0120.916] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0120.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 63 [0120.916] lstrlenW (lpString=".dbf") returned 4 [0120.916] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0120.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 63 [0120.916] lstrlenW (lpString=".1cd") returned 4 [0120.916] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0120.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 63 [0120.916] lstrlenW (lpString=".jpg") returned 4 [0120.916] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0120.916] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x26ff9fc | out: lpFileSize=0x26ff9fc*=1588) returned 1 [0120.916] CloseHandle (hObject=0x1e4) returned 1 [0120.916] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00224_.wmf")) returned 0x20 [0120.917] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00224_.wmf.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0120.917] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00224_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0120.917] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0120.917] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0120.917] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00224_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0120.917] GetLastError () returned 0x0 [0120.917] ReadFile (in: hFile=0x1e4, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x634, lpOverlapped=0x0) returned 1 [0120.964] WriteFile (in: hFile=0x194, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x640, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0x640, lpOverlapped=0x0) returned 1 [0120.965] ReadFile (in: hFile=0x1e4, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x0, lpOverlapped=0x0) returned 1 [0120.965] WriteFile (in: hFile=0x194, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0xec, lpOverlapped=0x0) returned 1 [0120.966] SetEndOfFile (hFile=0x194) returned 1 [0120.966] CloseHandle (hObject=0x194) returned 1 [0120.966] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0120.966] SetEndOfFile (hFile=0x1e4) returned 1 [0120.966] CloseHandle (hObject=0x1e4) returned 1 [0120.966] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0120.966] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00224_.wmf")) returned 1 [0120.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 63 [0120.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 63 [0120.967] lstrlenW (lpString=".doc") returned 4 [0120.967] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0120.967] lstrlenW (lpString=".docx") returned 5 [0120.967] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0120.967] lstrlenW (lpString=".pdf") returned 4 [0120.967] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0120.967] lstrlenW (lpString=".xls") returned 4 [0120.967] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0120.967] lstrlenW (lpString=".xlsx") returned 5 [0120.967] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0120.967] lstrlenW (lpString=".ppt") returned 4 [0120.967] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0120.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 63 [0120.967] lstrlenW (lpString=".zip") returned 4 [0120.967] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0120.967] lstrlenW (lpString=".rar") returned 4 [0120.967] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0120.967] lstrlenW (lpString=".bz2") returned 4 [0120.967] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0120.967] lstrlenW (lpString=".7z") returned 3 [0120.967] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0120.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 63 [0120.967] lstrlenW (lpString=".dbf") returned 4 [0120.967] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0120.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 63 [0120.967] lstrlenW (lpString=".1cd") returned 4 [0120.967] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0120.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 63 [0120.967] lstrlenW (lpString=".jpg") returned 4 [0120.967] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0120.967] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x26ff9fc | out: lpFileSize=0x26ff9fc*=1676) returned 1 [0120.967] CloseHandle (hObject=0x1e4) returned 1 [0120.968] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00443_.wmf")) returned 0x20 [0120.968] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00443_.wmf.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0120.968] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00443_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0120.968] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0120.968] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0120.968] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00443_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0120.968] GetLastError () returned 0x0 [0120.968] ReadFile (in: hFile=0x1e4, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x68c, lpOverlapped=0x0) returned 1 [0121.161] WriteFile (in: hFile=0x194, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x690, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0x690, lpOverlapped=0x0) returned 1 [0121.161] ReadFile (in: hFile=0x1e4, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x0, lpOverlapped=0x0) returned 1 [0121.161] WriteFile (in: hFile=0x194, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0xec, lpOverlapped=0x0) returned 1 [0121.161] SetEndOfFile (hFile=0x194) returned 1 [0121.161] CloseHandle (hObject=0x194) returned 1 [0121.162] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0121.162] SetEndOfFile (hFile=0x1e4) returned 1 [0121.162] CloseHandle (hObject=0x1e4) returned 1 [0121.162] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0121.162] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00443_.wmf")) returned 1 [0121.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 63 [0121.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 63 [0121.162] lstrlenW (lpString=".doc") returned 4 [0121.162] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0121.162] lstrlenW (lpString=".docx") returned 5 [0121.163] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0121.163] lstrlenW (lpString=".pdf") returned 4 [0121.163] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0121.163] lstrlenW (lpString=".xls") returned 4 [0121.163] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0121.163] lstrlenW (lpString=".xlsx") returned 5 [0121.163] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0121.163] lstrlenW (lpString=".ppt") returned 4 [0121.163] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0121.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 63 [0121.163] lstrlenW (lpString=".zip") returned 4 [0121.163] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0121.163] lstrlenW (lpString=".rar") returned 4 [0121.163] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0121.163] lstrlenW (lpString=".bz2") returned 4 [0121.163] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0121.163] lstrlenW (lpString=".7z") returned 3 [0121.163] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0121.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 63 [0121.163] lstrlenW (lpString=".dbf") returned 4 [0121.163] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0121.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 63 [0121.163] lstrlenW (lpString=".1cd") returned 4 [0121.163] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0121.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 63 [0121.163] lstrlenW (lpString=".jpg") returned 4 [0121.163] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0121.246] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x26ff9fc | out: lpFileSize=0x26ff9fc*=3564) returned 1 [0121.246] CloseHandle (hObject=0x1ec) returned 1 [0121.247] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cg1606.wmf")) returned 0x20 [0121.247] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cg1606.wmf.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0121.247] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cg1606.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0121.247] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0121.247] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0121.247] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cg1606.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0121.248] GetLastError () returned 0x0 [0121.248] ReadFile (in: hFile=0x1ec, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0xdec, lpOverlapped=0x0) returned 1 [0121.264] WriteFile (in: hFile=0x1a0, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xdf0, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0xdf0, lpOverlapped=0x0) returned 1 [0121.265] ReadFile (in: hFile=0x1ec, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x0, lpOverlapped=0x0) returned 1 [0121.265] WriteFile (in: hFile=0x1a0, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0xe8, lpOverlapped=0x0) returned 1 [0121.265] SetEndOfFile (hFile=0x1a0) returned 1 [0121.265] CloseHandle (hObject=0x1a0) returned 1 [0121.266] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0121.266] SetEndOfFile (hFile=0x1ec) returned 1 [0121.267] CloseHandle (hObject=0x1ec) returned 1 [0121.267] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0121.267] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cg1606.wmf")) returned 1 [0121.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF") returned 61 [0121.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF") returned 61 [0121.267] lstrlenW (lpString=".doc") returned 4 [0121.267] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0121.267] lstrlenW (lpString=".docx") returned 5 [0121.267] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0121.267] lstrlenW (lpString=".pdf") returned 4 [0121.267] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0121.267] lstrlenW (lpString=".xls") returned 4 [0121.267] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0121.267] lstrlenW (lpString=".xlsx") returned 5 [0121.267] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0121.267] lstrlenW (lpString=".ppt") returned 4 [0121.267] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0121.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF") returned 61 [0121.268] lstrlenW (lpString=".zip") returned 4 [0121.268] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0121.268] lstrlenW (lpString=".rar") returned 4 [0121.268] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0121.268] lstrlenW (lpString=".bz2") returned 4 [0121.268] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0121.268] lstrlenW (lpString=".7z") returned 3 [0121.268] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0121.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF") returned 61 [0121.268] lstrlenW (lpString=".dbf") returned 4 [0121.268] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0121.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF") returned 61 [0121.268] lstrlenW (lpString=".1cd") returned 4 [0121.268] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0121.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF") returned 61 [0121.268] lstrlenW (lpString=".jpg") returned 4 [0121.268] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0121.269] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x26ff9fc | out: lpFileSize=0x26ff9fc*=5270) returned 1 [0121.269] CloseHandle (hObject=0x1ec) returned 1 [0121.269] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\crane.wmf")) returned 0x20 [0121.269] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\crane.wmf.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0121.269] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\crane.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0121.270] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0121.270] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0121.270] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\crane.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0121.270] GetLastError () returned 0x0 [0121.270] ReadFile (in: hFile=0x1ec, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x1496, lpOverlapped=0x0) returned 1 [0121.372] WriteFile (in: hFile=0x1a0, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x14a0, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0x14a0, lpOverlapped=0x0) returned 1 [0121.372] ReadFile (in: hFile=0x1ec, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x0, lpOverlapped=0x0) returned 1 [0121.373] WriteFile (in: hFile=0x1a0, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0xe6, lpOverlapped=0x0) returned 1 [0121.373] SetEndOfFile (hFile=0x1a0) returned 1 [0121.392] CloseHandle (hObject=0x1a0) returned 1 [0121.392] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0121.392] SetEndOfFile (hFile=0x1ec) returned 1 [0121.393] CloseHandle (hObject=0x1ec) returned 1 [0121.393] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0121.393] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\crane.wmf")) returned 1 [0121.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF") returned 60 [0121.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF") returned 60 [0121.393] lstrlenW (lpString=".doc") returned 4 [0121.393] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0121.393] lstrlenW (lpString=".docx") returned 5 [0121.393] lstrcmpiW (lpString1=".docx", lpString2="E.WMF") returned -1 [0121.393] lstrlenW (lpString=".pdf") returned 4 [0121.393] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0121.393] lstrlenW (lpString=".xls") returned 4 [0121.393] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0121.393] lstrlenW (lpString=".xlsx") returned 5 [0121.393] lstrcmpiW (lpString1=".xlsx", lpString2="E.WMF") returned -1 [0121.393] lstrlenW (lpString=".ppt") returned 4 [0121.393] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0121.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF") returned 60 [0121.393] lstrlenW (lpString=".zip") returned 4 [0121.393] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0121.393] lstrlenW (lpString=".rar") returned 4 [0121.393] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0121.393] lstrlenW (lpString=".bz2") returned 4 [0121.393] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0121.393] lstrlenW (lpString=".7z") returned 3 [0121.393] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0121.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF") returned 60 [0121.393] lstrlenW (lpString=".dbf") returned 4 [0121.393] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0121.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF") returned 60 [0121.394] lstrlenW (lpString=".1cd") returned 4 [0121.394] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0121.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF") returned 60 [0121.394] lstrlenW (lpString=".jpg") returned 4 [0121.394] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0121.395] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x26ff9fc | out: lpFileSize=0x26ff9fc*=8256) returned 1 [0121.395] CloseHandle (hObject=0x1ec) returned 1 [0121.395] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00121_.wmf")) returned 0x20 [0121.395] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00121_.wmf.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0121.395] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00121_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0121.395] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0121.395] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0121.395] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00121_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0121.395] GetLastError () returned 0x0 [0121.395] ReadFile (in: hFile=0x1ec, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x2040, lpOverlapped=0x0) returned 1 [0121.403] WriteFile (in: hFile=0x1a0, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x2050, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0x2050, lpOverlapped=0x0) returned 1 [0121.404] ReadFile (in: hFile=0x1ec, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x0, lpOverlapped=0x0) returned 1 [0121.404] WriteFile (in: hFile=0x1a0, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0xec, lpOverlapped=0x0) returned 1 [0121.404] SetEndOfFile (hFile=0x1a0) returned 1 [0121.404] CloseHandle (hObject=0x1a0) returned 1 [0121.404] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0121.404] SetEndOfFile (hFile=0x1ec) returned 1 [0121.405] CloseHandle (hObject=0x1ec) returned 1 [0121.405] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0121.405] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00121_.wmf")) returned 1 [0121.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF") returned 63 [0121.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF") returned 63 [0121.405] lstrlenW (lpString=".doc") returned 4 [0121.405] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0121.405] lstrlenW (lpString=".docx") returned 5 [0121.405] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0121.405] lstrlenW (lpString=".pdf") returned 4 [0121.405] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0121.405] lstrlenW (lpString=".xls") returned 4 [0121.405] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0121.405] lstrlenW (lpString=".xlsx") returned 5 [0121.405] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0121.405] lstrlenW (lpString=".ppt") returned 4 [0121.405] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0121.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF") returned 63 [0121.405] lstrlenW (lpString=".zip") returned 4 [0121.405] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0121.405] lstrlenW (lpString=".rar") returned 4 [0121.405] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0121.405] lstrlenW (lpString=".bz2") returned 4 [0121.405] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0121.405] lstrlenW (lpString=".7z") returned 3 [0121.405] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0121.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF") returned 63 [0121.405] lstrlenW (lpString=".dbf") returned 4 [0121.405] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0121.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF") returned 63 [0121.405] lstrlenW (lpString=".1cd") returned 4 [0121.405] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0121.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF") returned 63 [0121.406] lstrlenW (lpString=".jpg") returned 4 [0121.406] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0121.406] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x26ff9fc | out: lpFileSize=0x26ff9fc*=29628) returned 1 [0121.406] CloseHandle (hObject=0x1ec) returned 1 [0121.406] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00234_.wmf")) returned 0x20 [0121.406] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00234_.wmf.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0121.406] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00234_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0121.406] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0121.406] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0121.406] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00234_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0121.406] GetLastError () returned 0x0 [0121.407] ReadFile (in: hFile=0x1ec, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x73bc, lpOverlapped=0x0) returned 1 [0121.502] WriteFile (in: hFile=0x1a0, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x73c0, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0x73c0, lpOverlapped=0x0) returned 1 [0121.503] ReadFile (in: hFile=0x1ec, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x0, lpOverlapped=0x0) returned 1 [0121.503] WriteFile (in: hFile=0x1a0, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0xec, lpOverlapped=0x0) returned 1 [0121.503] SetEndOfFile (hFile=0x1a0) returned 1 [0121.503] CloseHandle (hObject=0x1a0) returned 1 [0121.503] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0121.503] SetEndOfFile (hFile=0x1ec) returned 1 [0121.504] CloseHandle (hObject=0x1ec) returned 1 [0121.504] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0121.504] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00234_.wmf")) returned 1 [0121.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 63 [0121.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 63 [0121.504] lstrlenW (lpString=".doc") returned 4 [0121.504] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0121.504] lstrlenW (lpString=".docx") returned 5 [0121.504] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0121.504] lstrlenW (lpString=".pdf") returned 4 [0121.504] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0121.504] lstrlenW (lpString=".xls") returned 4 [0121.504] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0121.504] lstrlenW (lpString=".xlsx") returned 5 [0121.504] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0121.504] lstrlenW (lpString=".ppt") returned 4 [0121.504] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0121.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 63 [0121.504] lstrlenW (lpString=".zip") returned 4 [0121.504] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0121.504] lstrlenW (lpString=".rar") returned 4 [0121.504] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0121.504] lstrlenW (lpString=".bz2") returned 4 [0121.504] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0121.504] lstrlenW (lpString=".7z") returned 3 [0121.504] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0121.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 63 [0121.504] lstrlenW (lpString=".dbf") returned 4 [0121.504] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0121.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 63 [0121.504] lstrlenW (lpString=".1cd") returned 4 [0121.504] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0121.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 63 [0121.505] lstrlenW (lpString=".jpg") returned 4 [0121.505] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0121.505] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x26ff9fc | out: lpFileSize=0x26ff9fc*=7828) returned 1 [0121.505] CloseHandle (hObject=0x1ec) returned 1 [0121.505] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00407_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00407_.wmf")) returned 0x20 [0121.505] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00407_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00407_.wmf.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0121.505] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00407_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00407_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0121.505] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0121.505] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0121.505] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00407_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00407_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0121.506] GetLastError () returned 0x0 [0121.506] ReadFile (in: hFile=0x1ec, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x1e94, lpOverlapped=0x0) returned 1 [0121.531] WriteFile (in: hFile=0x1a0, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x1ea0, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0x1ea0, lpOverlapped=0x0) returned 1 [0121.532] ReadFile (in: hFile=0x1ec, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x0, lpOverlapped=0x0) returned 1 [0121.532] WriteFile (in: hFile=0x1a0, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0xec, lpOverlapped=0x0) returned 1 [0121.532] SetEndOfFile (hFile=0x1a0) returned 1 [0121.532] CloseHandle (hObject=0x1a0) returned 1 [0121.532] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0121.532] SetEndOfFile (hFile=0x1ec) returned 1 [0121.532] CloseHandle (hObject=0x1ec) returned 1 [0121.533] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00407_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0121.533] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00407_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00407_.wmf")) returned 1 [0121.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00407_.WMF") returned 63 [0121.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00407_.WMF") returned 63 [0121.555] lstrlenW (lpString=".doc") returned 4 [0121.555] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0121.555] lstrlenW (lpString=".docx") returned 5 [0121.555] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0121.555] lstrlenW (lpString=".pdf") returned 4 [0121.555] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0121.555] lstrlenW (lpString=".xls") returned 4 [0121.555] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0121.555] lstrlenW (lpString=".xlsx") returned 5 [0121.555] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0121.555] lstrlenW (lpString=".ppt") returned 4 [0121.555] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0121.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00407_.WMF") returned 63 [0121.555] lstrlenW (lpString=".zip") returned 4 [0121.555] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0121.555] lstrlenW (lpString=".rar") returned 4 [0121.555] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0121.555] lstrlenW (lpString=".bz2") returned 4 [0121.555] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0121.555] lstrlenW (lpString=".7z") returned 3 [0121.555] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0121.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00407_.WMF") returned 63 [0121.555] lstrlenW (lpString=".dbf") returned 4 [0121.555] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0121.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00407_.WMF") returned 63 [0121.555] lstrlenW (lpString=".1cd") returned 4 [0121.555] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0121.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00407_.WMF") returned 63 [0121.555] lstrlenW (lpString=".jpg") returned 4 [0121.555] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0121.555] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0121.556] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0121.556] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00705_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00705_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0121.582] GetLastError () returned 0x0 [0121.582] ReadFile (in: hFile=0x164, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x600c, lpOverlapped=0x0) returned 1 [0121.622] WriteFile (in: hFile=0x1f8, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x6010, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0x6010, lpOverlapped=0x0) returned 1 [0121.628] ReadFile (in: hFile=0x164, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x0, lpOverlapped=0x0) returned 1 [0121.628] WriteFile (in: hFile=0x1f8, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0xec, lpOverlapped=0x0) returned 1 [0121.628] SetEndOfFile (hFile=0x1f8) returned 1 [0121.629] CloseHandle (hObject=0x1f8) returned 1 [0121.629] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0121.629] SetEndOfFile (hFile=0x164) returned 1 [0121.629] CloseHandle (hObject=0x164) returned 1 [0121.629] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00705_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0121.629] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00705_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00705_.wmf")) returned 1 [0121.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 63 [0121.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 63 [0121.630] lstrlenW (lpString=".doc") returned 4 [0121.630] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0121.630] lstrlenW (lpString=".docx") returned 5 [0121.630] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0121.630] lstrlenW (lpString=".pdf") returned 4 [0121.630] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0121.630] lstrlenW (lpString=".xls") returned 4 [0121.630] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0121.630] lstrlenW (lpString=".xlsx") returned 5 [0121.630] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0121.630] lstrlenW (lpString=".ppt") returned 4 [0121.630] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0121.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 63 [0121.630] lstrlenW (lpString=".zip") returned 4 [0121.630] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0121.630] lstrlenW (lpString=".rar") returned 4 [0121.630] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0121.630] lstrlenW (lpString=".bz2") returned 4 [0121.630] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0121.630] lstrlenW (lpString=".7z") returned 3 [0121.630] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0121.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 63 [0121.630] lstrlenW (lpString=".dbf") returned 4 [0121.630] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0121.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 63 [0121.630] lstrlenW (lpString=".1cd") returned 4 [0121.630] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0121.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 63 [0121.630] lstrlenW (lpString=".jpg") returned 4 [0121.630] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0121.761] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0121.763] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0121.764] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01139_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01139_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0121.764] GetLastError () returned 0x0 [0121.764] ReadFile (in: hFile=0x1e0, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0xe30, lpOverlapped=0x0) returned 1 [0121.770] WriteFile (in: hFile=0x194, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xe40, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0xe40, lpOverlapped=0x0) returned 1 [0121.772] ReadFile (in: hFile=0x1e0, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x0, lpOverlapped=0x0) returned 1 [0121.772] WriteFile (in: hFile=0x194, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0xec, lpOverlapped=0x0) returned 1 [0121.772] SetEndOfFile (hFile=0x194) returned 1 [0121.936] CloseHandle (hObject=0x194) returned 1 [0121.936] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0121.936] SetEndOfFile (hFile=0x1e0) returned 1 [0121.936] CloseHandle (hObject=0x1e0) returned 1 [0121.936] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01139_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0121.936] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01139_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01139_.wmf")) returned 1 [0121.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 63 [0121.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 63 [0121.962] lstrlenW (lpString=".doc") returned 4 [0121.962] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0121.962] lstrlenW (lpString=".docx") returned 5 [0121.962] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0121.962] lstrlenW (lpString=".pdf") returned 4 [0121.962] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0121.962] lstrlenW (lpString=".xls") returned 4 [0121.962] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0121.962] lstrlenW (lpString=".xlsx") returned 5 [0121.962] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0121.963] lstrlenW (lpString=".ppt") returned 4 [0121.963] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0121.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 63 [0121.963] lstrlenW (lpString=".zip") returned 4 [0121.963] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0121.963] lstrlenW (lpString=".rar") returned 4 [0121.963] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0121.963] lstrlenW (lpString=".bz2") returned 4 [0121.963] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0121.963] lstrlenW (lpString=".7z") returned 3 [0121.963] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0121.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 63 [0121.963] lstrlenW (lpString=".dbf") returned 4 [0121.963] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0121.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 63 [0121.963] lstrlenW (lpString=".1cd") returned 4 [0121.963] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0121.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 63 [0121.963] lstrlenW (lpString=".jpg") returned 4 [0121.963] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0121.985] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0121.985] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0121.985] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01171_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0121.985] GetLastError () returned 0x0 [0121.985] ReadFile (in: hFile=0x19c, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x804, lpOverlapped=0x0) returned 1 [0121.986] WriteFile (in: hFile=0x194, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x810, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0x810, lpOverlapped=0x0) returned 1 [0121.987] ReadFile (in: hFile=0x19c, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x0, lpOverlapped=0x0) returned 1 [0121.987] WriteFile (in: hFile=0x194, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0xec, lpOverlapped=0x0) returned 1 [0121.987] SetEndOfFile (hFile=0x194) returned 1 [0121.987] CloseHandle (hObject=0x194) returned 1 [0121.987] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0121.987] SetEndOfFile (hFile=0x19c) returned 1 [0121.987] CloseHandle (hObject=0x19c) returned 1 [0121.987] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0121.988] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01171_.wmf")) returned 1 [0121.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 63 [0121.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 63 [0121.988] lstrlenW (lpString=".doc") returned 4 [0121.988] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0121.988] lstrlenW (lpString=".docx") returned 5 [0121.988] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0121.988] lstrlenW (lpString=".pdf") returned 4 [0121.988] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0121.988] lstrlenW (lpString=".xls") returned 4 [0121.988] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0121.988] lstrlenW (lpString=".xlsx") returned 5 [0121.988] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0121.988] lstrlenW (lpString=".ppt") returned 4 [0121.988] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0121.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 63 [0121.988] lstrlenW (lpString=".zip") returned 4 [0121.988] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0121.988] lstrlenW (lpString=".rar") returned 4 [0121.988] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0121.988] lstrlenW (lpString=".bz2") returned 4 [0121.988] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0121.990] lstrlenW (lpString=".7z") returned 3 [0121.990] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0121.990] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 63 [0121.990] lstrlenW (lpString=".dbf") returned 4 [0121.990] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0121.990] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 63 [0121.990] lstrlenW (lpString=".1cd") returned 4 [0121.990] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0121.990] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 63 [0121.990] lstrlenW (lpString=".jpg") returned 4 [0121.990] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0121.993] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0121.993] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0121.994] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01173_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0121.994] GetLastError () returned 0x0 [0121.994] ReadFile (in: hFile=0x21c, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x70c, lpOverlapped=0x0) returned 1 [0122.011] WriteFile (in: hFile=0x1ec, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x710, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0x710, lpOverlapped=0x0) returned 1 [0122.012] ReadFile (in: hFile=0x21c, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x0, lpOverlapped=0x0) returned 1 [0122.012] WriteFile (in: hFile=0x1ec, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0xec, lpOverlapped=0x0) returned 1 [0122.012] SetEndOfFile (hFile=0x1ec) returned 1 [0122.012] CloseHandle (hObject=0x1ec) returned 1 [0122.012] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0122.013] SetEndOfFile (hFile=0x21c) returned 1 [0122.013] CloseHandle (hObject=0x21c) returned 1 [0122.013] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0122.013] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01173_.wmf")) returned 1 [0122.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 63 [0122.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 63 [0122.014] lstrlenW (lpString=".doc") returned 4 [0122.014] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0122.014] lstrlenW (lpString=".docx") returned 5 [0122.014] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0122.014] lstrlenW (lpString=".pdf") returned 4 [0122.014] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0122.014] lstrlenW (lpString=".xls") returned 4 [0122.014] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0122.014] lstrlenW (lpString=".xlsx") returned 5 [0122.014] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0122.014] lstrlenW (lpString=".ppt") returned 4 [0122.014] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0122.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 63 [0122.014] lstrlenW (lpString=".zip") returned 4 [0122.014] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0122.014] lstrlenW (lpString=".rar") returned 4 [0122.014] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0122.014] lstrlenW (lpString=".bz2") returned 4 [0122.014] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0122.014] lstrlenW (lpString=".7z") returned 3 [0122.014] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0122.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 63 [0122.014] lstrlenW (lpString=".dbf") returned 4 [0122.014] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0122.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 63 [0122.014] lstrlenW (lpString=".1cd") returned 4 [0122.014] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0122.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 63 [0122.014] lstrlenW (lpString=".jpg") returned 4 [0122.014] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0122.015] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0122.015] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0122.015] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01178_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01178_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0122.015] GetLastError () returned 0x0 [0122.015] ReadFile (in: hFile=0x21c, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0xed4, lpOverlapped=0x0) returned 1 [0122.028] WriteFile (in: hFile=0x1ec, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xee0, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0xee0, lpOverlapped=0x0) returned 1 [0122.028] ReadFile (in: hFile=0x21c, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x0, lpOverlapped=0x0) returned 1 [0122.028] WriteFile (in: hFile=0x1ec, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0xec, lpOverlapped=0x0) returned 1 [0122.028] SetEndOfFile (hFile=0x1ec) returned 1 [0122.029] CloseHandle (hObject=0x1ec) returned 1 [0122.029] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0122.029] SetEndOfFile (hFile=0x21c) returned 1 [0122.030] CloseHandle (hObject=0x21c) returned 1 [0122.030] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01178_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0122.030] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01178_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01178_.wmf")) returned 1 [0122.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 63 [0122.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 63 [0122.031] lstrlenW (lpString=".doc") returned 4 [0122.031] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0122.031] lstrlenW (lpString=".docx") returned 5 [0122.031] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0122.031] lstrlenW (lpString=".pdf") returned 4 [0122.031] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0122.031] lstrlenW (lpString=".xls") returned 4 [0122.031] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0122.031] lstrlenW (lpString=".xlsx") returned 5 [0122.031] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0122.031] lstrlenW (lpString=".ppt") returned 4 [0122.031] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0122.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 63 [0122.031] lstrlenW (lpString=".zip") returned 4 [0122.031] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0122.031] lstrlenW (lpString=".rar") returned 4 [0122.031] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0122.031] lstrlenW (lpString=".bz2") returned 4 [0122.031] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0122.031] lstrlenW (lpString=".7z") returned 3 [0122.031] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0122.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 63 [0122.031] lstrlenW (lpString=".dbf") returned 4 [0122.031] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0122.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 63 [0122.031] lstrlenW (lpString=".1cd") returned 4 [0122.031] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0122.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 63 [0122.031] lstrlenW (lpString=".jpg") returned 4 [0122.031] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0122.031] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0122.032] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0122.032] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01182_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0122.032] GetLastError () returned 0x0 [0122.032] ReadFile (in: hFile=0x21c, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0xbb4, lpOverlapped=0x0) returned 1 [0122.163] WriteFile (in: hFile=0x1ec, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xbc0, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0xbc0, lpOverlapped=0x0) returned 1 [0122.165] ReadFile (in: hFile=0x21c, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x0, lpOverlapped=0x0) returned 1 [0122.165] WriteFile (in: hFile=0x1ec, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0xec, lpOverlapped=0x0) returned 1 [0122.165] SetEndOfFile (hFile=0x1ec) returned 1 [0122.165] CloseHandle (hObject=0x1ec) returned 1 [0122.165] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0122.165] SetEndOfFile (hFile=0x21c) returned 1 [0122.166] CloseHandle (hObject=0x21c) returned 1 [0122.166] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0122.166] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01182_.wmf")) returned 1 [0122.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 63 [0122.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 63 [0122.167] lstrlenW (lpString=".doc") returned 4 [0122.167] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0122.167] lstrlenW (lpString=".docx") returned 5 [0122.167] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0122.167] lstrlenW (lpString=".pdf") returned 4 [0122.167] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0122.167] lstrlenW (lpString=".xls") returned 4 [0122.167] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0122.168] lstrlenW (lpString=".xlsx") returned 5 [0122.168] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0122.168] lstrlenW (lpString=".ppt") returned 4 [0122.168] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0122.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 63 [0122.168] lstrlenW (lpString=".zip") returned 4 [0122.168] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0122.168] lstrlenW (lpString=".rar") returned 4 [0122.168] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0122.168] lstrlenW (lpString=".bz2") returned 4 [0122.168] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0122.168] lstrlenW (lpString=".7z") returned 3 [0122.168] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0122.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 63 [0122.168] lstrlenW (lpString=".dbf") returned 4 [0122.168] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0122.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 63 [0122.168] lstrlenW (lpString=".1cd") returned 4 [0122.168] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0122.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 63 [0122.168] lstrlenW (lpString=".jpg") returned 4 [0122.168] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0122.358] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0122.358] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0122.358] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01366_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01366_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0122.358] GetLastError () returned 0x0 [0122.358] ReadFile (in: hFile=0x1f8, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x6e8, lpOverlapped=0x0) returned 1 [0122.427] WriteFile (in: hFile=0x20c, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x6f0, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0x6f0, lpOverlapped=0x0) returned 1 [0122.428] ReadFile (in: hFile=0x1f8, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x0, lpOverlapped=0x0) returned 1 [0122.428] WriteFile (in: hFile=0x20c, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0xec, lpOverlapped=0x0) returned 1 [0122.428] SetEndOfFile (hFile=0x20c) returned 1 [0122.429] CloseHandle (hObject=0x20c) returned 1 [0122.429] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0122.429] SetEndOfFile (hFile=0x1f8) returned 1 [0122.429] CloseHandle (hObject=0x1f8) returned 1 [0122.429] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01366_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0122.429] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01366_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01366_.wmf")) returned 1 [0122.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 63 [0122.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 63 [0122.430] lstrlenW (lpString=".doc") returned 4 [0122.430] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0122.430] lstrlenW (lpString=".docx") returned 5 [0122.430] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0122.430] lstrlenW (lpString=".pdf") returned 4 [0122.430] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0122.430] lstrlenW (lpString=".xls") returned 4 [0122.430] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0122.430] lstrlenW (lpString=".xlsx") returned 5 [0122.430] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0122.430] lstrlenW (lpString=".ppt") returned 4 [0122.430] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0122.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 63 [0122.430] lstrlenW (lpString=".zip") returned 4 [0122.430] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0122.430] lstrlenW (lpString=".rar") returned 4 [0122.430] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0122.430] lstrlenW (lpString=".bz2") returned 4 [0122.430] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0122.430] lstrlenW (lpString=".7z") returned 3 [0122.430] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0122.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 63 [0122.430] lstrlenW (lpString=".dbf") returned 4 [0122.430] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0122.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 63 [0122.430] lstrlenW (lpString=".1cd") returned 4 [0122.430] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0122.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 63 [0122.431] lstrlenW (lpString=".jpg") returned 4 [0122.431] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0122.431] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0122.431] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0122.431] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00184_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0122.431] GetLastError () returned 0x0 [0122.432] ReadFile (in: hFile=0x1f8, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x1b2e, lpOverlapped=0x0) returned 1 [0122.484] WriteFile (in: hFile=0x20c, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x1b30, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0x1b30, lpOverlapped=0x0) returned 1 [0122.485] ReadFile (in: hFile=0x1f8, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x0, lpOverlapped=0x0) returned 1 [0122.485] WriteFile (in: hFile=0x20c, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0xec, lpOverlapped=0x0) returned 1 [0122.485] SetEndOfFile (hFile=0x20c) returned 1 [0122.485] CloseHandle (hObject=0x20c) returned 1 [0122.485] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0122.485] SetEndOfFile (hFile=0x1f8) returned 1 [0122.486] CloseHandle (hObject=0x1f8) returned 1 [0122.486] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0122.486] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00184_.wmf")) returned 1 [0122.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 63 [0122.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 63 [0122.487] lstrlenW (lpString=".doc") returned 4 [0122.487] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0122.487] lstrlenW (lpString=".docx") returned 5 [0122.487] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0122.487] lstrlenW (lpString=".pdf") returned 4 [0122.487] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0122.487] lstrlenW (lpString=".xls") returned 4 [0122.487] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0122.487] lstrlenW (lpString=".xlsx") returned 5 [0122.487] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0122.487] lstrlenW (lpString=".ppt") returned 4 [0122.487] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0122.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 63 [0122.487] lstrlenW (lpString=".zip") returned 4 [0122.487] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0122.487] lstrlenW (lpString=".rar") returned 4 [0122.487] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0122.487] lstrlenW (lpString=".bz2") returned 4 [0122.487] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0122.487] lstrlenW (lpString=".7z") returned 3 [0122.487] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0122.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 63 [0122.487] lstrlenW (lpString=".dbf") returned 4 [0122.487] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0122.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 63 [0122.487] lstrlenW (lpString=".1cd") returned 4 [0122.490] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0122.492] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 63 [0122.492] lstrlenW (lpString=".jpg") returned 4 [0122.492] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0122.492] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0122.493] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0122.493] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00319_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0122.493] GetLastError () returned 0x0 [0122.493] ReadFile (in: hFile=0x1f8, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x8e8, lpOverlapped=0x0) returned 1 [0122.528] WriteFile (in: hFile=0x20c, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x8f0, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0x8f0, lpOverlapped=0x0) returned 1 [0122.529] ReadFile (in: hFile=0x1f8, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x0, lpOverlapped=0x0) returned 1 [0122.529] WriteFile (in: hFile=0x20c, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0xec, lpOverlapped=0x0) returned 1 [0122.529] SetEndOfFile (hFile=0x20c) returned 1 [0122.529] CloseHandle (hObject=0x20c) returned 1 [0122.529] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0122.529] SetEndOfFile (hFile=0x1f8) returned 1 [0122.529] CloseHandle (hObject=0x1f8) returned 1 [0122.530] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0122.530] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00319_.wmf")) returned 1 [0122.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 63 [0122.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 63 [0122.530] lstrlenW (lpString=".doc") returned 4 [0122.530] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0122.530] lstrlenW (lpString=".docx") returned 5 [0122.530] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0122.530] lstrlenW (lpString=".pdf") returned 4 [0122.530] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0122.530] lstrlenW (lpString=".xls") returned 4 [0122.530] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0122.530] lstrlenW (lpString=".xlsx") returned 5 [0122.530] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0122.530] lstrlenW (lpString=".ppt") returned 4 [0122.530] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0122.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 63 [0122.530] lstrlenW (lpString=".zip") returned 4 [0122.530] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0122.530] lstrlenW (lpString=".rar") returned 4 [0122.530] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0122.531] lstrlenW (lpString=".bz2") returned 4 [0122.531] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0122.531] lstrlenW (lpString=".7z") returned 3 [0122.531] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0122.531] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 63 [0122.531] lstrlenW (lpString=".dbf") returned 4 [0122.531] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0122.531] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 63 [0122.531] lstrlenW (lpString=".1cd") returned 4 [0122.531] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0122.531] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 63 [0122.531] lstrlenW (lpString=".jpg") returned 4 [0122.531] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0122.547] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0122.547] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0122.547] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00902_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0122.547] GetLastError () returned 0x0 [0122.547] ReadFile (in: hFile=0x21c, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x1f08, lpOverlapped=0x0) returned 1 [0122.583] WriteFile (in: hFile=0x218, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x1f10, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0x1f10, lpOverlapped=0x0) returned 1 [0122.584] ReadFile (in: hFile=0x21c, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x0, lpOverlapped=0x0) returned 1 [0122.584] WriteFile (in: hFile=0x218, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0xec, lpOverlapped=0x0) returned 1 [0122.584] SetEndOfFile (hFile=0x218) returned 1 [0122.584] CloseHandle (hObject=0x218) returned 1 [0122.584] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0122.584] SetEndOfFile (hFile=0x21c) returned 1 [0122.585] CloseHandle (hObject=0x21c) returned 1 [0122.585] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0122.585] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00902_.wmf")) returned 1 [0122.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 63 [0122.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 63 [0122.585] lstrlenW (lpString=".doc") returned 4 [0122.585] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0122.585] lstrlenW (lpString=".docx") returned 5 [0122.585] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0122.585] lstrlenW (lpString=".pdf") returned 4 [0122.586] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0122.586] lstrlenW (lpString=".xls") returned 4 [0122.586] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0122.586] lstrlenW (lpString=".xlsx") returned 5 [0122.586] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0122.586] lstrlenW (lpString=".ppt") returned 4 [0122.586] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0122.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 63 [0122.586] lstrlenW (lpString=".zip") returned 4 [0122.586] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0122.586] lstrlenW (lpString=".rar") returned 4 [0122.586] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0122.586] lstrlenW (lpString=".bz2") returned 4 [0122.586] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0122.586] lstrlenW (lpString=".7z") returned 3 [0122.586] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0122.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 63 [0122.586] lstrlenW (lpString=".dbf") returned 4 [0122.586] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0122.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 63 [0122.586] lstrlenW (lpString=".1cd") returned 4 [0122.586] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0122.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 63 [0122.586] lstrlenW (lpString=".jpg") returned 4 [0122.586] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0122.586] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0122.586] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0122.587] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00086_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0122.587] GetLastError () returned 0x0 [0122.587] ReadFile (in: hFile=0x21c, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x721c, lpOverlapped=0x0) returned 1 [0122.643] WriteFile (in: hFile=0x218, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x7220, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0x7220, lpOverlapped=0x0) returned 1 [0122.644] ReadFile (in: hFile=0x21c, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x0, lpOverlapped=0x0) returned 1 [0122.644] WriteFile (in: hFile=0x218, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0xec, lpOverlapped=0x0) returned 1 [0122.644] SetEndOfFile (hFile=0x218) returned 1 [0122.644] CloseHandle (hObject=0x218) returned 1 [0122.644] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0122.644] SetEndOfFile (hFile=0x21c) returned 1 [0122.645] CloseHandle (hObject=0x21c) returned 1 [0122.645] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0122.645] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00086_.wmf")) returned 1 [0122.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 63 [0122.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 63 [0122.645] lstrlenW (lpString=".doc") returned 4 [0122.645] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0122.645] lstrlenW (lpString=".docx") returned 5 [0122.645] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0122.645] lstrlenW (lpString=".pdf") returned 4 [0122.645] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0122.645] lstrlenW (lpString=".xls") returned 4 [0122.645] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0122.645] lstrlenW (lpString=".xlsx") returned 5 [0122.645] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0122.645] lstrlenW (lpString=".ppt") returned 4 [0122.645] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0122.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 63 [0122.645] lstrlenW (lpString=".zip") returned 4 [0122.645] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0122.645] lstrlenW (lpString=".rar") returned 4 [0122.645] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0122.645] lstrlenW (lpString=".bz2") returned 4 [0122.645] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0122.646] lstrlenW (lpString=".7z") returned 3 [0122.646] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0122.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 63 [0122.646] lstrlenW (lpString=".dbf") returned 4 [0122.646] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0122.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 63 [0122.646] lstrlenW (lpString=".1cd") returned 4 [0122.646] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0122.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 63 [0122.646] lstrlenW (lpString=".jpg") returned 4 [0122.646] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0122.646] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0122.646] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0122.646] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00296_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0122.647] GetLastError () returned 0x0 [0122.647] ReadFile (in: hFile=0x21c, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x3df0, lpOverlapped=0x0) returned 1 [0122.658] WriteFile (in: hFile=0x218, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x3e00, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0x3e00, lpOverlapped=0x0) returned 1 [0122.659] ReadFile (in: hFile=0x21c, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x0, lpOverlapped=0x0) returned 1 [0122.659] WriteFile (in: hFile=0x218, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0xec, lpOverlapped=0x0) returned 1 [0122.659] SetEndOfFile (hFile=0x218) returned 1 [0122.659] CloseHandle (hObject=0x218) returned 1 [0122.659] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0122.659] SetEndOfFile (hFile=0x21c) returned 1 [0122.660] CloseHandle (hObject=0x21c) returned 1 [0122.660] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0122.660] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00296_.wmf")) returned 1 [0122.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 63 [0122.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 63 [0122.660] lstrlenW (lpString=".doc") returned 4 [0122.660] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0122.660] lstrlenW (lpString=".docx") returned 5 [0122.660] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0122.660] lstrlenW (lpString=".pdf") returned 4 [0122.660] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0122.660] lstrlenW (lpString=".xls") returned 4 [0122.660] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0122.660] lstrlenW (lpString=".xlsx") returned 5 [0122.660] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0122.660] lstrlenW (lpString=".ppt") returned 4 [0122.660] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0122.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 63 [0122.660] lstrlenW (lpString=".zip") returned 4 [0122.660] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0122.660] lstrlenW (lpString=".rar") returned 4 [0122.661] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0122.661] lstrlenW (lpString=".bz2") returned 4 [0122.661] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0122.661] lstrlenW (lpString=".7z") returned 3 [0122.661] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0122.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 63 [0122.661] lstrlenW (lpString=".dbf") returned 4 [0122.661] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0122.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 63 [0122.661] lstrlenW (lpString=".1cd") returned 4 [0122.661] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0122.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 63 [0122.661] lstrlenW (lpString=".jpg") returned 4 [0122.661] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0122.661] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0122.661] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0122.661] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00336_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00336_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0122.662] GetLastError () returned 0x0 [0122.662] ReadFile (in: hFile=0x21c, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x17b4, lpOverlapped=0x0) returned 1 [0122.693] WriteFile (in: hFile=0x218, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x17c0, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0x17c0, lpOverlapped=0x0) returned 1 [0122.694] ReadFile (in: hFile=0x21c, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x0, lpOverlapped=0x0) returned 1 [0122.694] WriteFile (in: hFile=0x218, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0xec, lpOverlapped=0x0) returned 1 [0122.694] SetEndOfFile (hFile=0x218) returned 1 [0122.694] CloseHandle (hObject=0x218) returned 1 [0122.694] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0122.694] SetEndOfFile (hFile=0x21c) returned 1 [0122.694] CloseHandle (hObject=0x21c) returned 1 [0122.694] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00336_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0122.695] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00336_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00336_.wmf")) returned 1 [0122.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00336_.WMF") returned 63 [0122.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00336_.WMF") returned 63 [0122.695] lstrlenW (lpString=".doc") returned 4 [0122.695] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0122.695] lstrlenW (lpString=".docx") returned 5 [0122.695] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0122.695] lstrlenW (lpString=".pdf") returned 4 [0122.695] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0122.695] lstrlenW (lpString=".xls") returned 4 [0122.695] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0122.695] lstrlenW (lpString=".xlsx") returned 5 [0122.695] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0122.695] lstrlenW (lpString=".ppt") returned 4 [0122.695] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0122.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00336_.WMF") returned 63 [0122.695] lstrlenW (lpString=".zip") returned 4 [0122.695] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0122.695] lstrlenW (lpString=".rar") returned 4 [0122.695] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0122.695] lstrlenW (lpString=".bz2") returned 4 [0122.695] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0122.695] lstrlenW (lpString=".7z") returned 3 [0122.695] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0122.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00336_.WMF") returned 63 [0122.703] lstrlenW (lpString=".dbf") returned 4 [0122.703] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0122.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00336_.WMF") returned 63 [0122.703] lstrlenW (lpString=".1cd") returned 4 [0122.703] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0122.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00336_.WMF") returned 63 [0122.703] lstrlenW (lpString=".jpg") returned 4 [0122.703] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0122.703] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0122.703] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0122.703] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00369_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00369_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0122.704] GetLastError () returned 0x0 [0122.704] ReadFile (in: hFile=0x21c, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x2168, lpOverlapped=0x0) returned 1 [0122.744] WriteFile (in: hFile=0x218, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x2170, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0x2170, lpOverlapped=0x0) returned 1 [0122.745] ReadFile (in: hFile=0x21c, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x0, lpOverlapped=0x0) returned 1 [0122.745] WriteFile (in: hFile=0x218, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0xec, lpOverlapped=0x0) returned 1 [0122.745] SetEndOfFile (hFile=0x218) returned 1 [0122.745] CloseHandle (hObject=0x218) returned 1 [0122.745] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0122.745] SetEndOfFile (hFile=0x21c) returned 1 [0122.746] CloseHandle (hObject=0x21c) returned 1 [0122.746] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00369_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0122.746] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00369_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00369_.wmf")) returned 1 [0122.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00369_.WMF") returned 63 [0122.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00369_.WMF") returned 63 [0122.746] lstrlenW (lpString=".doc") returned 4 [0122.746] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0122.746] lstrlenW (lpString=".docx") returned 5 [0122.746] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0122.747] lstrlenW (lpString=".pdf") returned 4 [0122.747] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0122.747] lstrlenW (lpString=".xls") returned 4 [0122.747] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0122.747] lstrlenW (lpString=".xlsx") returned 5 [0122.747] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0122.747] lstrlenW (lpString=".ppt") returned 4 [0122.747] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0122.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00369_.WMF") returned 63 [0122.747] lstrlenW (lpString=".zip") returned 4 [0122.747] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0122.747] lstrlenW (lpString=".rar") returned 4 [0122.747] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0122.747] lstrlenW (lpString=".bz2") returned 4 [0122.747] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0122.747] lstrlenW (lpString=".7z") returned 3 [0122.747] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0122.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00369_.WMF") returned 63 [0122.747] lstrlenW (lpString=".dbf") returned 4 [0122.747] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0122.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00369_.WMF") returned 63 [0122.747] lstrlenW (lpString=".1cd") returned 4 [0122.747] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0122.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00369_.WMF") returned 63 [0122.747] lstrlenW (lpString=".jpg") returned 4 [0122.747] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0122.747] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0122.747] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0122.747] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00403_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00403_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0122.748] GetLastError () returned 0x0 [0122.748] ReadFile (in: hFile=0x21c, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x1ec6, lpOverlapped=0x0) returned 1 [0122.762] WriteFile (in: hFile=0x218, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x1ed0, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0x1ed0, lpOverlapped=0x0) returned 1 [0122.763] ReadFile (in: hFile=0x21c, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x0, lpOverlapped=0x0) returned 1 [0122.763] WriteFile (in: hFile=0x218, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0xec, lpOverlapped=0x0) returned 1 [0122.763] SetEndOfFile (hFile=0x218) returned 1 [0122.763] CloseHandle (hObject=0x218) returned 1 [0122.764] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0122.764] SetEndOfFile (hFile=0x21c) returned 1 [0122.764] CloseHandle (hObject=0x21c) returned 1 [0122.765] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00403_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0122.765] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00403_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00403_.wmf")) returned 1 [0122.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00403_.WMF") returned 63 [0122.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00403_.WMF") returned 63 [0122.765] lstrlenW (lpString=".doc") returned 4 [0122.765] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0122.765] lstrlenW (lpString=".docx") returned 5 [0122.765] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0122.765] lstrlenW (lpString=".pdf") returned 4 [0122.765] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0122.765] lstrlenW (lpString=".xls") returned 4 [0122.765] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0122.765] lstrlenW (lpString=".xlsx") returned 5 [0122.765] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0122.766] lstrlenW (lpString=".ppt") returned 4 [0122.766] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0122.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00403_.WMF") returned 63 [0122.766] lstrlenW (lpString=".zip") returned 4 [0122.766] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0122.766] lstrlenW (lpString=".rar") returned 4 [0122.766] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0122.766] lstrlenW (lpString=".bz2") returned 4 [0122.766] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0122.766] lstrlenW (lpString=".7z") returned 3 [0122.766] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0122.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00403_.WMF") returned 63 [0122.766] lstrlenW (lpString=".dbf") returned 4 [0122.766] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0122.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00403_.WMF") returned 63 [0122.766] lstrlenW (lpString=".1cd") returned 4 [0122.766] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0122.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00403_.WMF") returned 63 [0122.766] lstrlenW (lpString=".jpg") returned 4 [0122.766] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0122.766] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0122.766] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0122.767] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00419_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00419_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0122.767] GetLastError () returned 0x0 [0122.767] ReadFile (in: hFile=0x21c, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x400c, lpOverlapped=0x0) returned 1 [0122.795] WriteFile (in: hFile=0x218, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x4010, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0x4010, lpOverlapped=0x0) returned 1 [0122.796] ReadFile (in: hFile=0x21c, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x0, lpOverlapped=0x0) returned 1 [0122.796] WriteFile (in: hFile=0x218, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0xec, lpOverlapped=0x0) returned 1 [0122.797] SetEndOfFile (hFile=0x218) returned 1 [0122.797] CloseHandle (hObject=0x218) returned 1 [0122.797] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0122.797] SetEndOfFile (hFile=0x21c) returned 1 [0122.797] CloseHandle (hObject=0x21c) returned 1 [0122.798] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00419_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0122.798] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00419_.wmf")) returned 1 [0122.798] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00419_.WMF") returned 63 [0122.798] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00419_.WMF") returned 63 [0122.798] lstrlenW (lpString=".doc") returned 4 [0122.798] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0122.798] lstrlenW (lpString=".docx") returned 5 [0122.798] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0122.798] lstrlenW (lpString=".pdf") returned 4 [0122.798] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0122.798] lstrlenW (lpString=".xls") returned 4 [0122.798] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0122.798] lstrlenW (lpString=".xlsx") returned 5 [0122.798] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0122.799] lstrlenW (lpString=".ppt") returned 4 [0122.799] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0122.799] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00419_.WMF") returned 63 [0122.799] lstrlenW (lpString=".zip") returned 4 [0122.799] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0122.799] lstrlenW (lpString=".rar") returned 4 [0122.799] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0122.799] lstrlenW (lpString=".bz2") returned 4 [0122.799] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0122.799] lstrlenW (lpString=".7z") returned 3 [0122.799] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0122.799] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00419_.WMF") returned 63 [0122.799] lstrlenW (lpString=".dbf") returned 4 [0122.799] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0122.799] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00419_.WMF") returned 63 [0122.799] lstrlenW (lpString=".1cd") returned 4 [0122.799] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0122.799] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00419_.WMF") returned 63 [0122.799] lstrlenW (lpString=".jpg") returned 4 [0122.799] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0122.804] GetFileSizeEx (in: hFile=0x21c, lpFileSize=0x26ff9fc | out: lpFileSize=0x26ff9fc*=2108) returned 1 [0122.804] CloseHandle (hObject=0x21c) returned 1 [0122.804] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00435_.wmf")) returned 0x20 [0122.804] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00435_.wmf.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0122.804] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00435_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0122.804] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0122.804] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0122.804] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00435_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0122.805] GetLastError () returned 0x0 [0122.805] ReadFile (in: hFile=0x21c, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x83c, lpOverlapped=0x0) returned 1 [0122.906] WriteFile (in: hFile=0x218, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x840, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0x840, lpOverlapped=0x0) returned 1 [0122.906] ReadFile (in: hFile=0x21c, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x0, lpOverlapped=0x0) returned 1 [0122.907] WriteFile (in: hFile=0x218, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0xec, lpOverlapped=0x0) returned 1 [0122.907] SetEndOfFile (hFile=0x218) returned 1 [0122.907] CloseHandle (hObject=0x218) returned 1 [0122.907] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0122.907] SetEndOfFile (hFile=0x21c) returned 1 [0122.907] CloseHandle (hObject=0x21c) returned 1 [0122.907] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0122.908] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00435_.wmf")) returned 1 [0122.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 63 [0122.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 63 [0122.908] lstrlenW (lpString=".doc") returned 4 [0122.908] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0122.908] lstrlenW (lpString=".docx") returned 5 [0122.908] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0122.908] lstrlenW (lpString=".pdf") returned 4 [0122.908] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0122.908] lstrlenW (lpString=".xls") returned 4 [0122.908] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0122.908] lstrlenW (lpString=".xlsx") returned 5 [0122.908] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0122.908] lstrlenW (lpString=".ppt") returned 4 [0122.908] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0122.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 63 [0122.908] lstrlenW (lpString=".zip") returned 4 [0122.908] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0122.908] lstrlenW (lpString=".rar") returned 4 [0122.908] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0122.908] lstrlenW (lpString=".bz2") returned 4 [0122.908] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0122.908] lstrlenW (lpString=".7z") returned 3 [0122.908] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0122.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 63 [0122.908] lstrlenW (lpString=".dbf") returned 4 [0122.908] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0122.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 63 [0122.908] lstrlenW (lpString=".1cd") returned 4 [0122.908] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0122.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 63 [0122.908] lstrlenW (lpString=".jpg") returned 4 [0122.908] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0122.909] GetFileSizeEx (in: hFile=0x21c, lpFileSize=0x26ff9fc | out: lpFileSize=0x26ff9fc*=8926) returned 1 [0122.918] CloseHandle (hObject=0x21c) returned 1 [0122.918] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00455_.wmf")) returned 0x20 [0122.918] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00455_.wmf.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0122.918] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00455_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0122.918] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0122.918] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0122.918] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00455_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0122.919] GetLastError () returned 0x0 [0122.919] ReadFile (in: hFile=0x21c, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x22de, lpOverlapped=0x0) returned 1 [0122.942] WriteFile (in: hFile=0x218, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x22e0, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0x22e0, lpOverlapped=0x0) returned 1 [0122.943] ReadFile (in: hFile=0x21c, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x0, lpOverlapped=0x0) returned 1 [0122.943] WriteFile (in: hFile=0x218, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0xec, lpOverlapped=0x0) returned 1 [0122.943] SetEndOfFile (hFile=0x218) returned 1 [0122.943] CloseHandle (hObject=0x218) returned 1 [0122.943] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0122.943] SetEndOfFile (hFile=0x21c) returned 1 [0122.944] CloseHandle (hObject=0x21c) returned 1 [0122.944] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0122.944] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00455_.wmf")) returned 1 [0122.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 63 [0122.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 63 [0122.944] lstrlenW (lpString=".doc") returned 4 [0122.944] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0122.944] lstrlenW (lpString=".docx") returned 5 [0122.944] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0122.944] lstrlenW (lpString=".pdf") returned 4 [0122.944] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0122.944] lstrlenW (lpString=".xls") returned 4 [0122.944] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0122.944] lstrlenW (lpString=".xlsx") returned 5 [0122.944] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0122.944] lstrlenW (lpString=".ppt") returned 4 [0122.944] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0122.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 63 [0122.944] lstrlenW (lpString=".zip") returned 4 [0122.944] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0122.945] lstrlenW (lpString=".rar") returned 4 [0122.945] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0122.945] lstrlenW (lpString=".bz2") returned 4 [0122.945] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0122.945] lstrlenW (lpString=".7z") returned 3 [0122.945] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0122.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 63 [0122.945] lstrlenW (lpString=".dbf") returned 4 [0122.945] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0122.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 63 [0122.945] lstrlenW (lpString=".1cd") returned 4 [0122.945] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0122.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 63 [0122.945] lstrlenW (lpString=".jpg") returned 4 [0122.945] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0122.945] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0122.945] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0122.945] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00543_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00543_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0122.946] GetLastError () returned 0x0 [0122.946] ReadFile (in: hFile=0x21c, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x5c0, lpOverlapped=0x0) returned 1 [0122.999] WriteFile (in: hFile=0x218, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x5d0, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0x5d0, lpOverlapped=0x0) returned 1 [0122.999] ReadFile (in: hFile=0x21c, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x0, lpOverlapped=0x0) returned 1 [0122.999] WriteFile (in: hFile=0x218, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0xec, lpOverlapped=0x0) returned 1 [0122.999] SetEndOfFile (hFile=0x218) returned 1 [0122.999] CloseHandle (hObject=0x218) returned 1 [0122.999] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0122.999] SetEndOfFile (hFile=0x21c) returned 1 [0123.000] CloseHandle (hObject=0x21c) returned 1 [0123.000] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00543_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0123.000] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00543_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00543_.wmf")) returned 1 [0123.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 63 [0123.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 63 [0123.001] lstrlenW (lpString=".doc") returned 4 [0123.001] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0123.001] lstrlenW (lpString=".docx") returned 5 [0123.001] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0123.001] lstrlenW (lpString=".pdf") returned 4 [0123.001] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0123.001] lstrlenW (lpString=".xls") returned 4 [0123.001] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0123.001] lstrlenW (lpString=".xlsx") returned 5 [0123.001] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0123.001] lstrlenW (lpString=".ppt") returned 4 [0123.001] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0123.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 63 [0123.001] lstrlenW (lpString=".zip") returned 4 [0123.001] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0123.001] lstrlenW (lpString=".rar") returned 4 [0123.001] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0123.001] lstrlenW (lpString=".bz2") returned 4 [0123.001] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0123.001] lstrlenW (lpString=".7z") returned 3 [0123.001] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0123.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 63 [0123.001] lstrlenW (lpString=".dbf") returned 4 [0123.001] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0123.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 63 [0123.001] lstrlenW (lpString=".1cd") returned 4 [0123.001] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0123.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 63 [0123.001] lstrlenW (lpString=".jpg") returned 4 [0123.001] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0123.002] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0123.002] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0123.002] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00775_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00775_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0123.002] GetLastError () returned 0x0 [0123.002] ReadFile (in: hFile=0x21c, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x2b90, lpOverlapped=0x0) returned 1 [0123.026] WriteFile (in: hFile=0x218, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x2ba0, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0x2ba0, lpOverlapped=0x0) returned 1 [0123.027] ReadFile (in: hFile=0x21c, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x0, lpOverlapped=0x0) returned 1 [0123.027] WriteFile (in: hFile=0x218, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0xec, lpOverlapped=0x0) returned 1 [0123.027] SetEndOfFile (hFile=0x218) returned 1 [0123.027] CloseHandle (hObject=0x218) returned 1 [0123.027] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0123.027] SetEndOfFile (hFile=0x21c) returned 1 [0123.027] CloseHandle (hObject=0x21c) returned 1 [0123.027] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00775_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0123.028] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00775_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00775_.wmf")) returned 1 [0123.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 63 [0123.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 63 [0123.047] lstrlenW (lpString=".doc") returned 4 [0123.047] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0123.047] lstrlenW (lpString=".docx") returned 5 [0123.047] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0123.047] lstrlenW (lpString=".pdf") returned 4 [0123.047] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0123.048] lstrlenW (lpString=".xls") returned 4 [0123.048] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0123.048] lstrlenW (lpString=".xlsx") returned 5 [0123.048] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0123.048] lstrlenW (lpString=".ppt") returned 4 [0123.048] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0123.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 63 [0123.048] lstrlenW (lpString=".zip") returned 4 [0123.048] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0123.048] lstrlenW (lpString=".rar") returned 4 [0123.048] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0123.048] lstrlenW (lpString=".bz2") returned 4 [0123.048] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0123.048] lstrlenW (lpString=".7z") returned 3 [0123.048] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0123.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 63 [0123.048] lstrlenW (lpString=".dbf") returned 4 [0123.048] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0123.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 63 [0123.048] lstrlenW (lpString=".1cd") returned 4 [0123.048] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0123.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 63 [0123.048] lstrlenW (lpString=".jpg") returned 4 [0123.048] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0123.049] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0123.049] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0123.049] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00965_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00965_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0123.049] GetLastError () returned 0x0 [0123.049] ReadFile (in: hFile=0x208, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x3b3c, lpOverlapped=0x0) returned 1 [0123.177] WriteFile (in: hFile=0x230, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x3b40, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0x3b40, lpOverlapped=0x0) returned 1 [0123.177] ReadFile (in: hFile=0x208, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x0, lpOverlapped=0x0) returned 1 [0123.177] WriteFile (in: hFile=0x230, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0xec, lpOverlapped=0x0) returned 1 [0123.177] SetEndOfFile (hFile=0x230) returned 1 [0123.177] CloseHandle (hObject=0x230) returned 1 [0123.178] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0123.178] SetEndOfFile (hFile=0x208) returned 1 [0123.178] CloseHandle (hObject=0x208) returned 1 [0123.178] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00965_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0123.178] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00965_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00965_.wmf")) returned 1 [0123.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 63 [0123.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 63 [0123.179] lstrlenW (lpString=".doc") returned 4 [0123.179] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0123.179] lstrlenW (lpString=".docx") returned 5 [0123.179] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0123.179] lstrlenW (lpString=".pdf") returned 4 [0123.179] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0123.179] lstrlenW (lpString=".xls") returned 4 [0123.179] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0123.179] lstrlenW (lpString=".xlsx") returned 5 [0123.179] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0123.179] lstrlenW (lpString=".ppt") returned 4 [0123.179] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0123.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 63 [0123.179] lstrlenW (lpString=".zip") returned 4 [0123.179] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0123.179] lstrlenW (lpString=".rar") returned 4 [0123.179] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0123.179] lstrlenW (lpString=".bz2") returned 4 [0123.179] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0123.179] lstrlenW (lpString=".7z") returned 3 [0123.179] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0123.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 63 [0123.179] lstrlenW (lpString=".dbf") returned 4 [0123.179] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0123.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 63 [0123.179] lstrlenW (lpString=".1cd") returned 4 [0123.179] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0123.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 63 [0123.179] lstrlenW (lpString=".jpg") returned 4 [0123.179] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0123.180] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0123.180] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0123.180] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01548_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01548_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0123.180] GetLastError () returned 0x0 [0123.180] ReadFile (in: hFile=0x208, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x284c, lpOverlapped=0x0) returned 1 [0123.250] WriteFile (in: hFile=0x230, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x2850, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0x2850, lpOverlapped=0x0) returned 1 [0123.251] ReadFile (in: hFile=0x208, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x0, lpOverlapped=0x0) returned 1 [0123.251] WriteFile (in: hFile=0x230, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0xec, lpOverlapped=0x0) returned 1 [0123.251] SetEndOfFile (hFile=0x230) returned 1 [0123.268] CloseHandle (hObject=0x230) returned 1 [0123.278] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0123.278] SetEndOfFile (hFile=0x208) returned 1 [0123.279] CloseHandle (hObject=0x208) returned 1 [0123.279] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01548_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0123.279] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01548_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01548_.wmf")) returned 1 [0123.279] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 63 [0123.279] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 63 [0123.280] lstrlenW (lpString=".doc") returned 4 [0123.280] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0123.280] lstrlenW (lpString=".docx") returned 5 [0123.280] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0123.280] lstrlenW (lpString=".pdf") returned 4 [0123.280] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0123.280] lstrlenW (lpString=".xls") returned 4 [0123.280] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0123.280] lstrlenW (lpString=".xlsx") returned 5 [0123.280] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0123.280] lstrlenW (lpString=".ppt") returned 4 [0123.280] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0123.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 63 [0123.280] lstrlenW (lpString=".zip") returned 4 [0123.280] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0123.280] lstrlenW (lpString=".rar") returned 4 [0123.280] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0123.280] lstrlenW (lpString=".bz2") returned 4 [0123.280] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0123.280] lstrlenW (lpString=".7z") returned 3 [0123.280] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0123.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 63 [0123.280] lstrlenW (lpString=".dbf") returned 4 [0123.280] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0123.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 63 [0123.280] lstrlenW (lpString=".1cd") returned 4 [0123.280] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0123.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 63 [0123.280] lstrlenW (lpString=".jpg") returned 4 [0123.280] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0123.284] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0123.284] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0123.284] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01659_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01659_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0123.284] GetLastError () returned 0x0 [0123.284] ReadFile (in: hFile=0x23c, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x79cc, lpOverlapped=0x0) returned 1 [0123.289] WriteFile (in: hFile=0x180, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x79d0, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0x79d0, lpOverlapped=0x0) returned 1 [0123.290] ReadFile (in: hFile=0x23c, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x0, lpOverlapped=0x0) returned 1 [0123.290] WriteFile (in: hFile=0x180, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0xec, lpOverlapped=0x0) returned 1 [0123.291] SetEndOfFile (hFile=0x180) returned 1 [0123.291] CloseHandle (hObject=0x180) returned 1 [0123.291] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0123.291] SetEndOfFile (hFile=0x23c) returned 1 [0123.291] CloseHandle (hObject=0x23c) returned 1 [0123.292] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01659_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0123.292] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01659_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01659_.wmf")) returned 1 [0123.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01659_.WMF") returned 63 [0123.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01659_.WMF") returned 63 [0123.292] lstrlenW (lpString=".doc") returned 4 [0123.292] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0123.292] lstrlenW (lpString=".docx") returned 5 [0123.292] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0123.292] lstrlenW (lpString=".pdf") returned 4 [0123.292] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0123.292] lstrlenW (lpString=".xls") returned 4 [0123.292] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0123.292] lstrlenW (lpString=".xlsx") returned 5 [0123.292] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0123.292] lstrlenW (lpString=".ppt") returned 4 [0123.292] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0123.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01659_.WMF") returned 63 [0123.293] lstrlenW (lpString=".zip") returned 4 [0123.293] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0123.293] lstrlenW (lpString=".rar") returned 4 [0123.293] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0123.293] lstrlenW (lpString=".bz2") returned 4 [0123.293] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0123.293] lstrlenW (lpString=".7z") returned 3 [0123.293] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0123.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01659_.WMF") returned 63 [0123.293] lstrlenW (lpString=".dbf") returned 4 [0123.293] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0123.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01659_.WMF") returned 63 [0123.293] lstrlenW (lpString=".1cd") returned 4 [0123.293] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0123.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01659_.WMF") returned 63 [0123.293] lstrlenW (lpString=".jpg") returned 4 [0123.293] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0123.293] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0123.293] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0123.293] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02068_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02068_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0123.294] GetLastError () returned 0x0 [0123.294] ReadFile (in: hFile=0x23c, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x9b8, lpOverlapped=0x0) returned 1 [0123.309] WriteFile (in: hFile=0x180, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x9c0, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0x9c0, lpOverlapped=0x0) returned 1 [0123.311] ReadFile (in: hFile=0x23c, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x0, lpOverlapped=0x0) returned 1 [0123.311] WriteFile (in: hFile=0x180, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0xec, lpOverlapped=0x0) returned 1 [0123.311] SetEndOfFile (hFile=0x180) returned 1 [0123.311] CloseHandle (hObject=0x180) returned 1 [0123.316] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0123.316] SetEndOfFile (hFile=0x23c) returned 1 [0123.317] CloseHandle (hObject=0x23c) returned 1 [0123.317] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02068_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0123.317] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02068_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02068_.wmf")) returned 1 [0123.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02068_.WMF") returned 63 [0123.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02068_.WMF") returned 63 [0123.317] lstrlenW (lpString=".doc") returned 4 [0123.317] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0123.317] lstrlenW (lpString=".docx") returned 5 [0123.318] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0123.318] lstrlenW (lpString=".pdf") returned 4 [0123.318] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0123.318] lstrlenW (lpString=".xls") returned 4 [0123.318] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0123.318] lstrlenW (lpString=".xlsx") returned 5 [0123.318] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0123.318] lstrlenW (lpString=".ppt") returned 4 [0123.318] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0123.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02068_.WMF") returned 63 [0123.318] lstrlenW (lpString=".zip") returned 4 [0123.318] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0123.318] lstrlenW (lpString=".rar") returned 4 [0123.318] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0123.318] lstrlenW (lpString=".bz2") returned 4 [0123.318] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0123.318] lstrlenW (lpString=".7z") returned 3 [0123.318] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0123.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02068_.WMF") returned 63 [0123.318] lstrlenW (lpString=".dbf") returned 4 [0123.318] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0123.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02068_.WMF") returned 63 [0123.318] lstrlenW (lpString=".1cd") returned 4 [0123.318] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0123.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02068_.WMF") returned 63 [0123.318] lstrlenW (lpString=".jpg") returned 4 [0123.318] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0123.318] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0123.318] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0123.318] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02075_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02075_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0123.319] GetLastError () returned 0x0 [0123.319] ReadFile (in: hFile=0x23c, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x112c, lpOverlapped=0x0) returned 1 [0123.334] WriteFile (in: hFile=0x180, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x1130, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0x1130, lpOverlapped=0x0) returned 1 [0123.362] ReadFile (in: hFile=0x23c, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x0, lpOverlapped=0x0) returned 1 [0123.362] WriteFile (in: hFile=0x180, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0xec, lpOverlapped=0x0) returned 1 [0123.362] SetEndOfFile (hFile=0x180) returned 1 [0123.362] CloseHandle (hObject=0x180) returned 1 [0123.362] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0123.362] SetEndOfFile (hFile=0x23c) returned 1 [0123.363] CloseHandle (hObject=0x23c) returned 1 [0123.363] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02075_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0123.363] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02075_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02075_.wmf")) returned 1 [0123.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02075_.WMF") returned 63 [0123.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02075_.WMF") returned 63 [0123.363] lstrlenW (lpString=".doc") returned 4 [0123.363] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0123.363] lstrlenW (lpString=".docx") returned 5 [0123.363] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0123.363] lstrlenW (lpString=".pdf") returned 4 [0123.363] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0123.364] lstrlenW (lpString=".xls") returned 4 [0123.364] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0123.364] lstrlenW (lpString=".xlsx") returned 5 [0123.364] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0123.364] lstrlenW (lpString=".ppt") returned 4 [0123.364] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0123.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02075_.WMF") returned 63 [0123.364] lstrlenW (lpString=".zip") returned 4 [0123.364] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0123.364] lstrlenW (lpString=".rar") returned 4 [0123.364] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0123.364] lstrlenW (lpString=".bz2") returned 4 [0123.364] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0123.364] lstrlenW (lpString=".7z") returned 3 [0123.364] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0123.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02075_.WMF") returned 63 [0123.364] lstrlenW (lpString=".dbf") returned 4 [0123.364] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0123.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02075_.WMF") returned 63 [0123.364] lstrlenW (lpString=".1cd") returned 4 [0123.364] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0123.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02075_.WMF") returned 63 [0123.364] lstrlenW (lpString=".jpg") returned 4 [0123.364] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0123.364] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0123.364] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0123.364] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02141_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02141_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0123.365] GetLastError () returned 0x0 [0123.365] ReadFile (in: hFile=0x23c, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0xa4c, lpOverlapped=0x0) returned 1 [0123.439] WriteFile (in: hFile=0x180, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xa50, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0xa50, lpOverlapped=0x0) returned 1 [0124.000] ReadFile (in: hFile=0x23c, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x0, lpOverlapped=0x0) returned 1 [0124.000] WriteFile (in: hFile=0x180, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0xec, lpOverlapped=0x0) returned 1 [0124.000] SetEndOfFile (hFile=0x180) returned 1 [0124.001] CloseHandle (hObject=0x180) returned 1 [0124.001] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0124.001] SetEndOfFile (hFile=0x23c) returned 1 [0124.002] CloseHandle (hObject=0x23c) returned 1 [0124.002] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02141_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0124.002] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02141_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02141_.wmf")) returned 1 [0124.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02141_.WMF") returned 63 [0124.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02141_.WMF") returned 63 [0124.003] lstrlenW (lpString=".doc") returned 4 [0124.003] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0124.003] lstrlenW (lpString=".docx") returned 5 [0124.003] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0124.003] lstrlenW (lpString=".pdf") returned 4 [0124.003] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0124.003] lstrlenW (lpString=".xls") returned 4 [0124.003] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0124.003] lstrlenW (lpString=".xlsx") returned 5 [0124.003] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0124.003] lstrlenW (lpString=".ppt") returned 4 [0124.003] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0124.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02141_.WMF") returned 63 [0124.003] lstrlenW (lpString=".zip") returned 4 [0124.003] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0124.003] lstrlenW (lpString=".rar") returned 4 [0124.003] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0124.003] lstrlenW (lpString=".bz2") returned 4 [0124.003] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0124.003] lstrlenW (lpString=".7z") returned 3 [0124.003] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0124.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02141_.WMF") returned 63 [0124.003] lstrlenW (lpString=".dbf") returned 4 [0124.003] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0124.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02141_.WMF") returned 63 [0124.003] lstrlenW (lpString=".1cd") returned 4 [0124.003] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0124.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02141_.WMF") returned 63 [0124.003] lstrlenW (lpString=".jpg") returned 4 [0124.003] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0124.003] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0124.003] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0124.004] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02153_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02153_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0124.004] GetLastError () returned 0x0 [0124.004] ReadFile (in: hFile=0x23c, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x1510, lpOverlapped=0x0) returned 1 [0124.006] WriteFile (in: hFile=0x180, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x1520, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0x1520, lpOverlapped=0x0) returned 1 [0124.007] ReadFile (in: hFile=0x23c, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x0, lpOverlapped=0x0) returned 1 [0124.007] WriteFile (in: hFile=0x180, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0xec, lpOverlapped=0x0) returned 1 [0124.007] SetEndOfFile (hFile=0x180) returned 1 [0124.007] CloseHandle (hObject=0x180) returned 1 [0124.007] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0124.007] SetEndOfFile (hFile=0x23c) returned 1 [0124.008] CloseHandle (hObject=0x23c) returned 1 [0124.008] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02153_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0124.008] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02153_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02153_.wmf")) returned 1 [0124.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02153_.WMF") returned 63 [0124.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02153_.WMF") returned 63 [0124.008] lstrlenW (lpString=".doc") returned 4 [0124.008] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0124.008] lstrlenW (lpString=".docx") returned 5 [0124.008] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0124.008] lstrlenW (lpString=".pdf") returned 4 [0124.008] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0124.008] lstrlenW (lpString=".xls") returned 4 [0124.008] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0124.008] lstrlenW (lpString=".xlsx") returned 5 [0124.008] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0124.008] lstrlenW (lpString=".ppt") returned 4 [0124.008] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0124.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02153_.WMF") returned 63 [0124.008] lstrlenW (lpString=".zip") returned 4 [0124.008] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0124.008] lstrlenW (lpString=".rar") returned 4 [0124.008] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0124.008] lstrlenW (lpString=".bz2") returned 4 [0124.008] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0124.008] lstrlenW (lpString=".7z") returned 3 [0124.008] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0124.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02153_.WMF") returned 63 [0124.008] lstrlenW (lpString=".dbf") returned 4 [0124.008] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0124.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02153_.WMF") returned 63 [0124.009] lstrlenW (lpString=".1cd") returned 4 [0124.009] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0124.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02153_.WMF") returned 63 [0124.009] lstrlenW (lpString=".jpg") returned 4 [0124.009] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0124.009] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0124.009] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0124.009] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02158_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02158_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0124.010] GetLastError () returned 0x0 [0124.010] ReadFile (in: hFile=0x23c, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x670, lpOverlapped=0x0) returned 1 [0124.018] WriteFile (in: hFile=0x180, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x680, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0x680, lpOverlapped=0x0) returned 1 [0124.019] ReadFile (in: hFile=0x23c, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x0, lpOverlapped=0x0) returned 1 [0124.019] WriteFile (in: hFile=0x180, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0xec, lpOverlapped=0x0) returned 1 [0124.019] SetEndOfFile (hFile=0x180) returned 1 [0124.019] CloseHandle (hObject=0x180) returned 1 [0124.019] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0124.019] SetEndOfFile (hFile=0x23c) returned 1 [0124.020] CloseHandle (hObject=0x23c) returned 1 [0124.020] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02158_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0124.020] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02158_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02158_.wmf")) returned 1 [0124.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02158_.WMF") returned 63 [0124.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02158_.WMF") returned 63 [0124.020] lstrlenW (lpString=".doc") returned 4 [0124.020] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0124.020] lstrlenW (lpString=".docx") returned 5 [0124.020] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0124.020] lstrlenW (lpString=".pdf") returned 4 [0124.021] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0124.021] lstrlenW (lpString=".xls") returned 4 [0124.021] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0124.021] lstrlenW (lpString=".xlsx") returned 5 [0124.021] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0124.021] lstrlenW (lpString=".ppt") returned 4 [0124.021] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0124.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02158_.WMF") returned 63 [0124.021] lstrlenW (lpString=".zip") returned 4 [0124.021] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0124.021] lstrlenW (lpString=".rar") returned 4 [0124.021] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0124.021] lstrlenW (lpString=".bz2") returned 4 [0124.021] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0124.021] lstrlenW (lpString=".7z") returned 3 [0124.021] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0124.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02158_.WMF") returned 63 [0124.021] lstrlenW (lpString=".dbf") returned 4 [0124.021] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0124.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02158_.WMF") returned 63 [0124.021] lstrlenW (lpString=".1cd") returned 4 [0124.021] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0124.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02158_.WMF") returned 63 [0124.021] lstrlenW (lpString=".jpg") returned 4 [0124.021] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0124.021] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0124.021] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0124.021] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02161_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02161_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0124.022] GetLastError () returned 0x0 [0124.022] ReadFile (in: hFile=0x23c, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0xc38, lpOverlapped=0x0) returned 1 [0124.200] WriteFile (in: hFile=0x180, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xc40, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0xc40, lpOverlapped=0x0) returned 1 [0124.201] ReadFile (in: hFile=0x23c, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x0, lpOverlapped=0x0) returned 1 [0124.201] WriteFile (in: hFile=0x180, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0xec, lpOverlapped=0x0) returned 1 [0124.201] SetEndOfFile (hFile=0x180) returned 1 [0124.232] CloseHandle (hObject=0x180) returned 1 [0124.232] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0124.232] SetEndOfFile (hFile=0x23c) returned 1 [0124.233] CloseHandle (hObject=0x23c) returned 1 [0124.233] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02161_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0124.233] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02161_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02161_.wmf")) returned 1 [0124.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02161_.WMF") returned 63 [0124.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02161_.WMF") returned 63 [0124.302] lstrlenW (lpString=".doc") returned 4 [0124.302] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0124.302] lstrlenW (lpString=".docx") returned 5 [0124.302] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0124.302] lstrlenW (lpString=".pdf") returned 4 [0124.302] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0124.302] lstrlenW (lpString=".xls") returned 4 [0124.302] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0124.302] lstrlenW (lpString=".xlsx") returned 5 [0124.302] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0124.302] lstrlenW (lpString=".ppt") returned 4 [0124.302] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0124.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02161_.WMF") returned 63 [0124.302] lstrlenW (lpString=".zip") returned 4 [0124.302] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0124.302] lstrlenW (lpString=".rar") returned 4 [0124.302] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0124.302] lstrlenW (lpString=".bz2") returned 4 [0124.302] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0124.302] lstrlenW (lpString=".7z") returned 3 [0124.302] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0124.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02161_.WMF") returned 63 [0124.302] lstrlenW (lpString=".dbf") returned 4 [0124.302] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0124.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02161_.WMF") returned 63 [0124.302] lstrlenW (lpString=".1cd") returned 4 [0124.302] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0124.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02161_.WMF") returned 63 [0124.302] lstrlenW (lpString=".jpg") returned 4 [0124.302] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0124.353] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0124.353] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0124.353] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00235_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00235_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x258 [0124.353] GetLastError () returned 0x0 [0124.353] ReadFile (in: hFile=0x254, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x402, lpOverlapped=0x0) returned 1 [0124.499] WriteFile (in: hFile=0x258, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x410, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0x410, lpOverlapped=0x0) returned 1 [0124.647] ReadFile (in: hFile=0x254, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x0, lpOverlapped=0x0) returned 1 [0124.647] WriteFile (in: hFile=0x258, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0xec, lpOverlapped=0x0) returned 1 [0124.647] SetEndOfFile (hFile=0x258) returned 1 [0124.647] CloseHandle (hObject=0x258) returned 1 [0124.647] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0124.647] SetEndOfFile (hFile=0x254) returned 1 [0124.648] CloseHandle (hObject=0x254) returned 1 [0124.648] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00235_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0124.648] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00235_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00235_.wmf")) returned 1 [0124.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 63 [0124.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 63 [0124.648] lstrlenW (lpString=".doc") returned 4 [0124.648] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0124.648] lstrlenW (lpString=".docx") returned 5 [0124.648] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0124.648] lstrlenW (lpString=".pdf") returned 4 [0124.648] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0124.648] lstrlenW (lpString=".xls") returned 4 [0124.648] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0124.648] lstrlenW (lpString=".xlsx") returned 5 [0124.648] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0124.648] lstrlenW (lpString=".ppt") returned 4 [0124.648] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0124.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 63 [0124.649] lstrlenW (lpString=".zip") returned 4 [0124.649] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0124.649] lstrlenW (lpString=".rar") returned 4 [0124.649] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0124.649] lstrlenW (lpString=".bz2") returned 4 [0124.649] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0124.649] lstrlenW (lpString=".7z") returned 3 [0124.649] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0124.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 63 [0124.649] lstrlenW (lpString=".dbf") returned 4 [0124.649] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0124.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 63 [0124.649] lstrlenW (lpString=".1cd") returned 4 [0124.649] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0124.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 63 [0124.649] lstrlenW (lpString=".jpg") returned 4 [0124.649] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0124.649] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0124.649] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0124.649] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00526_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00526_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x258 [0124.650] GetLastError () returned 0x0 [0124.650] ReadFile (in: hFile=0x254, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x34e2, lpOverlapped=0x0) returned 1 [0124.709] WriteFile (in: hFile=0x258, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x34f0, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0x34f0, lpOverlapped=0x0) returned 1 [0124.710] ReadFile (in: hFile=0x254, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x0, lpOverlapped=0x0) returned 1 [0124.710] WriteFile (in: hFile=0x258, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0xec, lpOverlapped=0x0) returned 1 [0124.710] SetEndOfFile (hFile=0x258) returned 1 [0124.752] CloseHandle (hObject=0x258) returned 1 [0124.752] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0124.752] SetEndOfFile (hFile=0x254) returned 1 [0124.753] CloseHandle (hObject=0x254) returned 1 [0124.753] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00526_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0124.753] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00526_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00526_.wmf")) returned 1 [0124.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00526_.WMF") returned 63 [0124.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00526_.WMF") returned 63 [0124.754] lstrlenW (lpString=".doc") returned 4 [0124.754] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0124.754] lstrlenW (lpString=".docx") returned 5 [0124.754] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0124.754] lstrlenW (lpString=".pdf") returned 4 [0124.754] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0124.754] lstrlenW (lpString=".xls") returned 4 [0124.754] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0124.754] lstrlenW (lpString=".xlsx") returned 5 [0124.754] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0124.754] lstrlenW (lpString=".ppt") returned 4 [0124.754] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0124.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00526_.WMF") returned 63 [0124.754] lstrlenW (lpString=".zip") returned 4 [0124.754] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0124.754] lstrlenW (lpString=".rar") returned 4 [0124.754] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0124.754] lstrlenW (lpString=".bz2") returned 4 [0124.754] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0124.754] lstrlenW (lpString=".7z") returned 3 [0124.754] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0124.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00526_.WMF") returned 63 [0124.754] lstrlenW (lpString=".dbf") returned 4 [0124.754] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0124.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00526_.WMF") returned 63 [0124.754] lstrlenW (lpString=".1cd") returned 4 [0124.754] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0124.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00526_.WMF") returned 63 [0124.754] lstrlenW (lpString=".jpg") returned 4 [0124.754] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0124.755] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0124.755] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0124.755] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00546_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00546_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x258 [0124.755] GetLastError () returned 0x0 [0124.755] ReadFile (in: hFile=0x254, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0xe86, lpOverlapped=0x0) returned 1 [0124.811] WriteFile (in: hFile=0x258, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xe90, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0xe90, lpOverlapped=0x0) returned 1 [0124.823] ReadFile (in: hFile=0x254, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x0, lpOverlapped=0x0) returned 1 [0124.823] WriteFile (in: hFile=0x258, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0xec, lpOverlapped=0x0) returned 1 [0124.823] SetEndOfFile (hFile=0x258) returned 1 [0124.824] CloseHandle (hObject=0x258) returned 1 [0124.824] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0124.824] SetEndOfFile (hFile=0x254) returned 1 [0124.825] CloseHandle (hObject=0x254) returned 1 [0124.825] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00546_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0124.825] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00546_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00546_.wmf")) returned 1 [0124.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00546_.WMF") returned 63 [0124.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00546_.WMF") returned 63 [0124.825] lstrlenW (lpString=".doc") returned 4 [0124.825] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0124.825] lstrlenW (lpString=".docx") returned 5 [0124.826] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0124.826] lstrlenW (lpString=".pdf") returned 4 [0124.826] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0124.826] lstrlenW (lpString=".xls") returned 4 [0124.826] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0124.826] lstrlenW (lpString=".xlsx") returned 5 [0124.826] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0124.826] lstrlenW (lpString=".ppt") returned 4 [0124.826] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0124.826] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00546_.WMF") returned 63 [0124.826] lstrlenW (lpString=".zip") returned 4 [0124.826] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0124.826] lstrlenW (lpString=".rar") returned 4 [0124.826] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0124.826] lstrlenW (lpString=".bz2") returned 4 [0124.826] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0124.826] lstrlenW (lpString=".7z") returned 3 [0124.826] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0124.826] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00546_.WMF") returned 63 [0124.826] lstrlenW (lpString=".dbf") returned 4 [0124.826] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0124.826] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00546_.WMF") returned 63 [0124.826] lstrlenW (lpString=".1cd") returned 4 [0124.826] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0124.826] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00546_.WMF") returned 63 [0124.826] lstrlenW (lpString=".jpg") returned 4 [0124.826] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0124.826] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x26ff9fc | out: lpFileSize=0x26ff9fc*=10644) returned 1 [0124.826] CloseHandle (hObject=0x254) returned 1 [0124.827] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00623_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00623_.wmf")) returned 0x20 [0124.827] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00623_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00623_.wmf.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0124.827] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00623_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00623_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0124.827] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0124.827] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0124.828] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00623_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00623_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x258 [0124.828] GetLastError () returned 0x0 [0124.828] ReadFile (in: hFile=0x254, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x2994, lpOverlapped=0x0) returned 1 [0124.857] WriteFile (in: hFile=0x258, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x29a0, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0x29a0, lpOverlapped=0x0) returned 1 [0124.858] ReadFile (in: hFile=0x254, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x0, lpOverlapped=0x0) returned 1 [0124.858] WriteFile (in: hFile=0x258, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0xec, lpOverlapped=0x0) returned 1 [0124.858] SetEndOfFile (hFile=0x258) returned 1 [0124.858] CloseHandle (hObject=0x258) returned 1 [0124.858] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0124.858] SetEndOfFile (hFile=0x254) returned 1 [0124.859] CloseHandle (hObject=0x254) returned 1 [0124.859] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00623_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0124.859] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00623_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00623_.wmf")) returned 1 [0124.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 63 [0124.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 63 [0124.859] lstrlenW (lpString=".doc") returned 4 [0124.859] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0124.859] lstrlenW (lpString=".docx") returned 5 [0124.859] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0124.859] lstrlenW (lpString=".pdf") returned 4 [0124.859] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0124.859] lstrlenW (lpString=".xls") returned 4 [0124.859] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0124.859] lstrlenW (lpString=".xlsx") returned 5 [0124.859] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0124.859] lstrlenW (lpString=".ppt") returned 4 [0124.860] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0124.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 63 [0124.860] lstrlenW (lpString=".zip") returned 4 [0124.860] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0124.860] lstrlenW (lpString=".rar") returned 4 [0124.860] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0124.860] lstrlenW (lpString=".bz2") returned 4 [0124.860] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0124.860] lstrlenW (lpString=".7z") returned 3 [0124.860] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0124.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 63 [0124.860] lstrlenW (lpString=".dbf") returned 4 [0124.860] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0124.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 63 [0124.860] lstrlenW (lpString=".1cd") returned 4 [0124.860] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0124.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 63 [0124.860] lstrlenW (lpString=".jpg") returned 4 [0124.860] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0124.861] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0124.861] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0124.861] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00636_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00636_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x258 [0124.862] GetLastError () returned 0x0 [0124.862] ReadFile (in: hFile=0x254, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x620, lpOverlapped=0x0) returned 1 [0124.936] WriteFile (in: hFile=0x258, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x630, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0x630, lpOverlapped=0x0) returned 1 [0124.937] ReadFile (in: hFile=0x254, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x0, lpOverlapped=0x0) returned 1 [0124.937] WriteFile (in: hFile=0x258, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0xec, lpOverlapped=0x0) returned 1 [0124.937] SetEndOfFile (hFile=0x258) returned 1 [0124.937] CloseHandle (hObject=0x258) returned 1 [0124.937] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0124.937] SetEndOfFile (hFile=0x254) returned 1 [0124.938] CloseHandle (hObject=0x254) returned 1 [0124.938] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00636_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0124.938] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00636_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00636_.wmf")) returned 1 [0124.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00636_.WMF") returned 63 [0124.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00636_.WMF") returned 63 [0124.938] lstrlenW (lpString=".doc") returned 4 [0124.938] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0124.938] lstrlenW (lpString=".docx") returned 5 [0124.938] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0124.938] lstrlenW (lpString=".pdf") returned 4 [0124.938] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0124.938] lstrlenW (lpString=".xls") returned 4 [0124.938] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0124.938] lstrlenW (lpString=".xlsx") returned 5 [0124.938] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0124.938] lstrlenW (lpString=".ppt") returned 4 [0124.938] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0124.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00636_.WMF") returned 63 [0124.938] lstrlenW (lpString=".zip") returned 4 [0124.938] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0124.938] lstrlenW (lpString=".rar") returned 4 [0124.939] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0124.939] lstrlenW (lpString=".bz2") returned 4 [0124.939] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0124.939] lstrlenW (lpString=".7z") returned 3 [0124.939] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0124.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00636_.WMF") returned 63 [0124.939] lstrlenW (lpString=".dbf") returned 4 [0124.939] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0124.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00636_.WMF") returned 63 [0124.939] lstrlenW (lpString=".1cd") returned 4 [0124.939] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0124.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00636_.WMF") returned 63 [0124.939] lstrlenW (lpString=".jpg") returned 4 [0124.939] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0124.939] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0124.939] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0124.939] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00685_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00685_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x258 [0124.940] GetLastError () returned 0x0 [0124.940] ReadFile (in: hFile=0x254, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0xfc0, lpOverlapped=0x0) returned 1 [0124.941] WriteFile (in: hFile=0x258, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xfd0, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0xfd0, lpOverlapped=0x0) returned 1 [0124.941] ReadFile (in: hFile=0x254, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x0, lpOverlapped=0x0) returned 1 [0124.942] WriteFile (in: hFile=0x258, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0xec, lpOverlapped=0x0) returned 1 [0124.942] SetEndOfFile (hFile=0x258) returned 1 [0124.942] CloseHandle (hObject=0x258) returned 1 [0124.942] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0124.942] SetEndOfFile (hFile=0x254) returned 1 [0124.942] CloseHandle (hObject=0x254) returned 1 [0124.942] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00685_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0124.943] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00685_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00685_.wmf")) returned 1 [0124.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 63 [0124.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 63 [0124.943] lstrlenW (lpString=".doc") returned 4 [0124.943] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0124.943] lstrlenW (lpString=".docx") returned 5 [0124.943] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0124.943] lstrlenW (lpString=".pdf") returned 4 [0124.943] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0124.944] lstrlenW (lpString=".xls") returned 4 [0124.944] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0124.944] lstrlenW (lpString=".xlsx") returned 5 [0124.944] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0124.944] lstrlenW (lpString=".ppt") returned 4 [0124.944] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0124.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 63 [0124.944] lstrlenW (lpString=".zip") returned 4 [0124.944] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0124.944] lstrlenW (lpString=".rar") returned 4 [0124.944] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0124.944] lstrlenW (lpString=".bz2") returned 4 [0124.944] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0124.944] lstrlenW (lpString=".7z") returned 3 [0124.944] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0124.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 63 [0124.944] lstrlenW (lpString=".dbf") returned 4 [0124.944] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0124.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 63 [0124.944] lstrlenW (lpString=".1cd") returned 4 [0124.944] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0124.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 63 [0124.944] lstrlenW (lpString=".jpg") returned 4 [0124.944] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0124.944] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x26ff9fc | out: lpFileSize=0x26ff9fc*=4340) returned 1 [0124.944] CloseHandle (hObject=0x254) returned 1 [0124.944] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00687_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00687_.wmf")) returned 0x20 [0124.944] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00687_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00687_.wmf.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0124.944] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00687_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00687_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0124.945] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0124.945] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0124.945] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00687_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00687_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x258 [0124.945] GetLastError () returned 0x0 [0124.945] ReadFile (in: hFile=0x254, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x10f4, lpOverlapped=0x0) returned 1 [0124.975] WriteFile (in: hFile=0x258, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x1100, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0x1100, lpOverlapped=0x0) returned 1 [0124.975] ReadFile (in: hFile=0x254, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x0, lpOverlapped=0x0) returned 1 [0124.976] WriteFile (in: hFile=0x258, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0xec, lpOverlapped=0x0) returned 1 [0124.976] SetEndOfFile (hFile=0x258) returned 1 [0124.976] CloseHandle (hObject=0x258) returned 1 [0124.976] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0124.976] SetEndOfFile (hFile=0x254) returned 1 [0124.976] CloseHandle (hObject=0x254) returned 1 [0124.976] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00687_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0124.977] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00687_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00687_.wmf")) returned 1 [0124.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 63 [0124.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 63 [0124.977] lstrlenW (lpString=".doc") returned 4 [0124.977] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0124.977] lstrlenW (lpString=".docx") returned 5 [0124.977] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0124.977] lstrlenW (lpString=".pdf") returned 4 [0124.977] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0124.977] lstrlenW (lpString=".xls") returned 4 [0124.977] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0124.977] lstrlenW (lpString=".xlsx") returned 5 [0124.977] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0124.977] lstrlenW (lpString=".ppt") returned 4 [0124.977] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0124.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 63 [0124.977] lstrlenW (lpString=".zip") returned 4 [0124.977] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0124.977] lstrlenW (lpString=".rar") returned 4 [0124.977] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0124.977] lstrlenW (lpString=".bz2") returned 4 [0124.977] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0124.977] lstrlenW (lpString=".7z") returned 3 [0124.977] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0124.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 63 [0124.977] lstrlenW (lpString=".dbf") returned 4 [0124.977] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0124.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 63 [0124.977] lstrlenW (lpString=".1cd") returned 4 [0124.977] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0124.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 63 [0124.977] lstrlenW (lpString=".jpg") returned 4 [0124.977] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0124.978] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0124.978] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0124.978] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01015_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01015_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x258 [0124.979] GetLastError () returned 0x0 [0124.979] ReadFile (in: hFile=0x254, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x47c, lpOverlapped=0x0) returned 1 [0125.009] WriteFile (in: hFile=0x258, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x480, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0x480, lpOverlapped=0x0) returned 1 [0125.010] ReadFile (in: hFile=0x254, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x0, lpOverlapped=0x0) returned 1 [0125.010] WriteFile (in: hFile=0x258, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0xec, lpOverlapped=0x0) returned 1 [0125.010] SetEndOfFile (hFile=0x258) returned 1 [0125.019] CloseHandle (hObject=0x258) returned 1 [0125.019] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0125.019] SetEndOfFile (hFile=0x254) returned 1 [0125.019] CloseHandle (hObject=0x254) returned 1 [0125.019] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01015_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0125.020] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01015_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01015_.wmf")) returned 1 [0125.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 63 [0125.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 63 [0125.020] lstrlenW (lpString=".doc") returned 4 [0125.020] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0125.020] lstrlenW (lpString=".docx") returned 5 [0125.020] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0125.020] lstrlenW (lpString=".pdf") returned 4 [0125.020] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0125.020] lstrlenW (lpString=".xls") returned 4 [0125.020] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0125.020] lstrlenW (lpString=".xlsx") returned 5 [0125.020] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0125.020] lstrlenW (lpString=".ppt") returned 4 [0125.020] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0125.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 63 [0125.020] lstrlenW (lpString=".zip") returned 4 [0125.020] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0125.020] lstrlenW (lpString=".rar") returned 4 [0125.020] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0125.020] lstrlenW (lpString=".bz2") returned 4 [0125.020] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0125.020] lstrlenW (lpString=".7z") returned 3 [0125.020] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0125.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 63 [0125.020] lstrlenW (lpString=".dbf") returned 4 [0125.020] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0125.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 63 [0125.020] lstrlenW (lpString=".1cd") returned 4 [0125.020] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0125.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 63 [0125.020] lstrlenW (lpString=".jpg") returned 4 [0125.021] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0125.021] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0125.021] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0125.021] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01461_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01461_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x258 [0125.021] GetLastError () returned 0x0 [0125.022] ReadFile (in: hFile=0x254, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x1746, lpOverlapped=0x0) returned 1 [0125.076] WriteFile (in: hFile=0x258, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x1750, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0x1750, lpOverlapped=0x0) returned 1 [0125.077] ReadFile (in: hFile=0x254, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x0, lpOverlapped=0x0) returned 1 [0125.077] WriteFile (in: hFile=0x258, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0xec, lpOverlapped=0x0) returned 1 [0125.077] SetEndOfFile (hFile=0x258) returned 1 [0125.077] CloseHandle (hObject=0x258) returned 1 [0125.077] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0125.077] SetEndOfFile (hFile=0x254) returned 1 [0125.077] CloseHandle (hObject=0x254) returned 1 [0125.077] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01461_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0125.078] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01461_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01461_.wmf")) returned 1 [0125.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 63 [0125.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 63 [0125.078] lstrlenW (lpString=".doc") returned 4 [0125.078] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0125.078] lstrlenW (lpString=".docx") returned 5 [0125.078] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0125.078] lstrlenW (lpString=".pdf") returned 4 [0125.078] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0125.078] lstrlenW (lpString=".xls") returned 4 [0125.078] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0125.078] lstrlenW (lpString=".xlsx") returned 5 [0125.078] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0125.078] lstrlenW (lpString=".ppt") returned 4 [0125.078] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0125.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 63 [0125.078] lstrlenW (lpString=".zip") returned 4 [0125.078] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0125.078] lstrlenW (lpString=".rar") returned 4 [0125.078] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0125.078] lstrlenW (lpString=".bz2") returned 4 [0125.078] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0125.078] lstrlenW (lpString=".7z") returned 3 [0125.078] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0125.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 63 [0125.079] lstrlenW (lpString=".dbf") returned 4 [0125.079] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0125.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 63 [0125.079] lstrlenW (lpString=".1cd") returned 4 [0125.079] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0125.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 63 [0125.079] lstrlenW (lpString=".jpg") returned 4 [0125.079] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0125.079] GetFileSizeEx (in: hFile=0x254, lpFileSize=0x26ff9fc | out: lpFileSize=0x26ff9fc*=7932) returned 1 [0125.079] CloseHandle (hObject=0x254) returned 1 [0125.080] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02282_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02282_.wmf")) returned 0x20 [0125.080] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02282_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02282_.wmf.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0125.080] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02282_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02282_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0125.080] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0125.080] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0125.080] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02282_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02282_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x258 [0125.081] GetLastError () returned 0x0 [0125.081] ReadFile (in: hFile=0x254, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x1efc, lpOverlapped=0x0) returned 1 [0125.137] WriteFile (in: hFile=0x258, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x1f00, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0x1f00, lpOverlapped=0x0) returned 1 [0125.138] ReadFile (in: hFile=0x254, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x0, lpOverlapped=0x0) returned 1 [0125.138] WriteFile (in: hFile=0x258, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0xec, lpOverlapped=0x0) returned 1 [0125.138] SetEndOfFile (hFile=0x258) returned 1 [0125.138] CloseHandle (hObject=0x258) returned 1 [0125.138] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0125.138] SetEndOfFile (hFile=0x254) returned 1 [0125.139] CloseHandle (hObject=0x254) returned 1 [0125.139] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02282_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0125.139] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02282_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02282_.wmf")) returned 1 [0125.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 63 [0125.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 63 [0125.141] lstrlenW (lpString=".doc") returned 4 [0125.141] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0125.141] lstrlenW (lpString=".docx") returned 5 [0125.141] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0125.141] lstrlenW (lpString=".pdf") returned 4 [0125.141] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0125.141] lstrlenW (lpString=".xls") returned 4 [0125.141] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0125.141] lstrlenW (lpString=".xlsx") returned 5 [0125.141] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0125.141] lstrlenW (lpString=".ppt") returned 4 [0125.141] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0125.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 63 [0125.141] lstrlenW (lpString=".zip") returned 4 [0125.141] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0125.141] lstrlenW (lpString=".rar") returned 4 [0125.141] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0125.141] lstrlenW (lpString=".bz2") returned 4 [0125.141] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0125.141] lstrlenW (lpString=".7z") returned 3 [0125.141] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0125.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 63 [0125.141] lstrlenW (lpString=".dbf") returned 4 [0125.141] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0125.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 63 [0125.142] lstrlenW (lpString=".1cd") returned 4 [0125.142] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0125.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 63 [0125.142] lstrlenW (lpString=".jpg") returned 4 [0125.142] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0125.142] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0125.142] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0125.142] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02312_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02312_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x258 [0125.142] GetLastError () returned 0x0 [0125.142] ReadFile (in: hFile=0x254, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x136a, lpOverlapped=0x0) returned 1 [0125.325] WriteFile (in: hFile=0x258, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x1370, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0x1370, lpOverlapped=0x0) returned 1 [0125.325] ReadFile (in: hFile=0x254, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x0, lpOverlapped=0x0) returned 1 [0125.325] WriteFile (in: hFile=0x258, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0xec, lpOverlapped=0x0) returned 1 [0125.325] SetEndOfFile (hFile=0x258) returned 1 [0125.326] CloseHandle (hObject=0x258) returned 1 [0125.326] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0125.326] SetEndOfFile (hFile=0x254) returned 1 [0125.326] CloseHandle (hObject=0x254) returned 1 [0125.326] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02312_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0125.326] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02312_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02312_.wmf")) returned 1 [0125.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 63 [0125.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 63 [0125.380] lstrlenW (lpString=".doc") returned 4 [0125.380] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0125.380] lstrlenW (lpString=".docx") returned 5 [0125.380] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0125.380] lstrlenW (lpString=".pdf") returned 4 [0125.380] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0125.380] lstrlenW (lpString=".xls") returned 4 [0125.380] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0125.380] lstrlenW (lpString=".xlsx") returned 5 [0125.380] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0125.380] lstrlenW (lpString=".ppt") returned 4 [0125.380] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0125.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 63 [0125.380] lstrlenW (lpString=".zip") returned 4 [0125.380] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0125.380] lstrlenW (lpString=".rar") returned 4 [0125.380] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0125.380] lstrlenW (lpString=".bz2") returned 4 [0125.380] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0125.380] lstrlenW (lpString=".7z") returned 3 [0125.380] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0125.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 63 [0125.380] lstrlenW (lpString=".dbf") returned 4 [0125.380] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0125.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 63 [0125.380] lstrlenW (lpString=".1cd") returned 4 [0125.381] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0125.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 63 [0125.381] lstrlenW (lpString=".jpg") returned 4 [0125.381] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0125.392] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0125.392] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0125.392] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00116_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00116_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0125.392] GetLastError () returned 0x0 [0125.392] ReadFile (in: hFile=0x1ec, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x3dec, lpOverlapped=0x0) returned 1 [0125.402] WriteFile (in: hFile=0x168, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x3df0, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0x3df0, lpOverlapped=0x0) returned 1 [0125.403] ReadFile (in: hFile=0x1ec, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x0, lpOverlapped=0x0) returned 1 [0125.403] WriteFile (in: hFile=0x168, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0xec, lpOverlapped=0x0) returned 1 [0125.403] SetEndOfFile (hFile=0x168) returned 1 [0125.403] CloseHandle (hObject=0x168) returned 1 [0125.403] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0125.403] SetEndOfFile (hFile=0x1ec) returned 1 [0125.404] CloseHandle (hObject=0x1ec) returned 1 [0125.404] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00116_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0125.404] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00116_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00116_.wmf")) returned 1 [0125.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 63 [0125.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 63 [0125.405] lstrlenW (lpString=".doc") returned 4 [0125.405] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0125.405] lstrlenW (lpString=".docx") returned 5 [0125.405] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0125.405] lstrlenW (lpString=".pdf") returned 4 [0125.405] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0125.405] lstrlenW (lpString=".xls") returned 4 [0125.405] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0125.405] lstrlenW (lpString=".xlsx") returned 5 [0125.405] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0125.405] lstrlenW (lpString=".ppt") returned 4 [0125.405] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0125.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 63 [0125.405] lstrlenW (lpString=".zip") returned 4 [0125.405] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0125.405] lstrlenW (lpString=".rar") returned 4 [0125.405] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0125.405] lstrlenW (lpString=".bz2") returned 4 [0125.405] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0125.405] lstrlenW (lpString=".7z") returned 3 [0125.405] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0125.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 63 [0125.405] lstrlenW (lpString=".dbf") returned 4 [0125.405] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0125.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 63 [0125.405] lstrlenW (lpString=".1cd") returned 4 [0125.405] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0125.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 63 [0125.405] lstrlenW (lpString=".jpg") returned 4 [0125.405] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0125.405] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0125.405] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0125.405] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00172_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00172_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0125.406] GetLastError () returned 0x0 [0125.406] ReadFile (in: hFile=0x1ec, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0xb10, lpOverlapped=0x0) returned 1 [0125.802] WriteFile (in: hFile=0x168, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xb20, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0xb20, lpOverlapped=0x0) returned 1 [0125.803] ReadFile (in: hFile=0x1ec, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x0, lpOverlapped=0x0) returned 1 [0125.803] WriteFile (in: hFile=0x168, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0xec, lpOverlapped=0x0) returned 1 [0125.803] SetEndOfFile (hFile=0x168) returned 1 [0125.803] CloseHandle (hObject=0x168) returned 1 [0125.803] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0125.803] SetEndOfFile (hFile=0x1ec) returned 1 [0125.803] CloseHandle (hObject=0x1ec) returned 1 [0125.803] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00172_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0125.804] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00172_.wmf")) returned 1 [0125.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 63 [0125.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 63 [0125.806] lstrlenW (lpString=".doc") returned 4 [0125.806] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0125.806] lstrlenW (lpString=".docx") returned 5 [0125.806] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0125.806] lstrlenW (lpString=".pdf") returned 4 [0125.806] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0125.806] lstrlenW (lpString=".xls") returned 4 [0125.806] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0125.806] lstrlenW (lpString=".xlsx") returned 5 [0125.806] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0125.806] lstrlenW (lpString=".ppt") returned 4 [0125.806] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0125.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 63 [0125.806] lstrlenW (lpString=".zip") returned 4 [0125.806] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0125.806] lstrlenW (lpString=".rar") returned 4 [0125.806] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0125.806] lstrlenW (lpString=".bz2") returned 4 [0125.806] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0125.806] lstrlenW (lpString=".7z") returned 3 [0125.806] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0125.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 63 [0125.806] lstrlenW (lpString=".dbf") returned 4 [0125.806] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0125.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 63 [0125.806] lstrlenW (lpString=".1cd") returned 4 [0125.806] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0125.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 63 [0125.806] lstrlenW (lpString=".jpg") returned 4 [0125.806] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0126.021] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0126.021] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0126.021] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00343_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00343_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x234 [0126.022] GetLastError () returned 0x0 [0126.022] ReadFile (in: hFile=0x1f8, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x764, lpOverlapped=0x0) returned 1 [0126.035] WriteFile (in: hFile=0x234, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x770, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0x770, lpOverlapped=0x0) returned 1 [0126.036] ReadFile (in: hFile=0x1f8, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x0, lpOverlapped=0x0) returned 1 [0126.036] WriteFile (in: hFile=0x234, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0xec, lpOverlapped=0x0) returned 1 [0126.036] SetEndOfFile (hFile=0x234) returned 1 [0126.036] CloseHandle (hObject=0x234) returned 1 [0126.036] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0126.036] SetEndOfFile (hFile=0x1f8) returned 1 [0126.037] CloseHandle (hObject=0x1f8) returned 1 [0126.037] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00343_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0126.037] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00343_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00343_.wmf")) returned 1 [0126.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00343_.WMF") returned 63 [0126.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00343_.WMF") returned 63 [0126.037] lstrlenW (lpString=".doc") returned 4 [0126.037] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0126.037] lstrlenW (lpString=".docx") returned 5 [0126.037] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0126.037] lstrlenW (lpString=".pdf") returned 4 [0126.037] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0126.037] lstrlenW (lpString=".xls") returned 4 [0126.037] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0126.037] lstrlenW (lpString=".xlsx") returned 5 [0126.037] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0126.038] lstrlenW (lpString=".ppt") returned 4 [0126.038] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0126.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00343_.WMF") returned 63 [0126.038] lstrlenW (lpString=".zip") returned 4 [0126.038] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0126.038] lstrlenW (lpString=".rar") returned 4 [0126.038] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0126.038] lstrlenW (lpString=".bz2") returned 4 [0126.038] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0126.038] lstrlenW (lpString=".7z") returned 3 [0126.038] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0126.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00343_.WMF") returned 63 [0126.038] lstrlenW (lpString=".dbf") returned 4 [0126.038] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0126.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00343_.WMF") returned 63 [0126.038] lstrlenW (lpString=".1cd") returned 4 [0126.038] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0126.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00343_.WMF") returned 63 [0126.038] lstrlenW (lpString=".jpg") returned 4 [0126.038] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0126.038] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x26ff9fc | out: lpFileSize=0x26ff9fc*=1928) returned 1 [0126.038] CloseHandle (hObject=0x1f8) returned 1 [0126.038] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00351_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00351_.wmf")) returned 0x20 [0126.038] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00351_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00351_.wmf.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0126.038] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00351_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00351_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0126.039] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0126.039] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0126.039] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00351_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00351_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x234 [0126.039] GetLastError () returned 0x0 [0126.039] ReadFile (in: hFile=0x1f8, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x788, lpOverlapped=0x0) returned 1 [0126.051] WriteFile (in: hFile=0x234, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x790, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0x790, lpOverlapped=0x0) returned 1 [0126.052] ReadFile (in: hFile=0x1f8, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x0, lpOverlapped=0x0) returned 1 [0126.052] WriteFile (in: hFile=0x234, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0xec, lpOverlapped=0x0) returned 1 [0126.052] SetEndOfFile (hFile=0x234) returned 1 [0126.052] CloseHandle (hObject=0x234) returned 1 [0126.052] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0126.052] SetEndOfFile (hFile=0x1f8) returned 1 [0126.053] CloseHandle (hObject=0x1f8) returned 1 [0126.053] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00351_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0126.053] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00351_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00351_.wmf")) returned 1 [0126.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00351_.WMF") returned 63 [0126.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00351_.WMF") returned 63 [0126.053] lstrlenW (lpString=".doc") returned 4 [0126.053] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0126.053] lstrlenW (lpString=".docx") returned 5 [0126.053] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0126.053] lstrlenW (lpString=".pdf") returned 4 [0126.053] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0126.053] lstrlenW (lpString=".xls") returned 4 [0126.053] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0126.053] lstrlenW (lpString=".xlsx") returned 5 [0126.053] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0126.053] lstrlenW (lpString=".ppt") returned 4 [0126.053] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0126.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00351_.WMF") returned 63 [0126.053] lstrlenW (lpString=".zip") returned 4 [0126.053] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0126.053] lstrlenW (lpString=".rar") returned 4 [0126.053] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0126.053] lstrlenW (lpString=".bz2") returned 4 [0126.053] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0126.053] lstrlenW (lpString=".7z") returned 3 [0126.053] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0126.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00351_.WMF") returned 63 [0126.053] lstrlenW (lpString=".dbf") returned 4 [0126.053] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0126.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00351_.WMF") returned 63 [0126.053] lstrlenW (lpString=".1cd") returned 4 [0126.053] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0126.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00351_.WMF") returned 63 [0126.054] lstrlenW (lpString=".jpg") returned 4 [0126.054] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0126.062] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0126.062] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0126.062] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00915_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00915_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0126.063] GetLastError () returned 0x0 [0126.063] ReadFile (in: hFile=0x16c, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x31cc, lpOverlapped=0x0) returned 1 [0126.147] WriteFile (in: hFile=0x1f8, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x31d0, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0x31d0, lpOverlapped=0x0) returned 1 [0126.148] ReadFile (in: hFile=0x16c, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x26ff9b4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x26ff9b4*=0x0, lpOverlapped=0x0) returned 1 [0126.148] WriteFile (in: hFile=0x1f8, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x26ff77c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x26ff77c*=0xec, lpOverlapped=0x0) returned 1 [0126.148] SetEndOfFile (hFile=0x1f8) returned 1 [0126.148] CloseHandle (hObject=0x1f8) returned 1 [0126.148] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x26ff9a8 | out: lpNewFilePointer=0x0) returned 1 [0126.149] SetEndOfFile (hFile=0x16c) returned 1 [0126.149] CloseHandle (hObject=0x16c) returned 1 [0126.149] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00915_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0126.149] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00915_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00915_.wmf")) returned 1 [0126.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00915_.WMF") returned 63 [0126.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00915_.WMF") returned 63 [0126.150] lstrlenW (lpString=".doc") returned 4 [0126.150] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0126.150] lstrlenW (lpString=".docx") returned 5 [0126.150] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0126.150] lstrlenW (lpString=".pdf") returned 4 [0126.150] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0126.150] lstrlenW (lpString=".xls") returned 4 [0126.150] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0126.150] lstrlenW (lpString=".xlsx") returned 5 [0126.150] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0126.150] lstrlenW (lpString=".ppt") returned 4 [0126.150] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0126.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00915_.WMF") returned 63 [0126.150] lstrlenW (lpString=".zip") returned 4 [0126.150] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0126.150] lstrlenW (lpString=".rar") returned 4 [0126.150] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0126.150] lstrlenW (lpString=".bz2") returned 4 [0126.151] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0126.151] lstrlenW (lpString=".7z") returned 3 [0126.151] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0126.151] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00915_.WMF") returned 63 [0126.151] lstrlenW (lpString=".dbf") returned 4 [0126.151] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0126.151] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00915_.WMF") returned 63 [0126.151] lstrlenW (lpString=".1cd") returned 4 [0126.151] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0126.151] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00915_.WMF") returned 63 [0126.151] lstrlenW (lpString=".jpg") returned 4 [0126.151] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 Thread: id = 27 os_tid = 0xb9c [0102.636] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x757c0000 [0102.636] GetProcAddress (hModule=0x757c0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x757ed650 [0102.636] Wow64DisableWow64FsRedirection (in: OldValue=0x292f980 | out: OldValue=0x292f980*=0x0) returned 1 [0102.636] lstrlenW (lpString="kernel32.dll") returned 12 [0102.636] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0102.636] Sleep (dwMilliseconds=0x64) [0102.826] lstrlenW (lpString="BCD") returned 3 [0102.826] CreateFileW (lpFileName="C:\\Boot\\BCD" (normalized: "c:\\boot\\bcd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0102.826] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0102.826] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0102.826] lstrlenW (lpString=".doc") returned 4 [0102.826] lstrcmpiW (lpString1=".doc", lpString2="\\BCD") returned -1 [0102.826] lstrlenW (lpString=".docx") returned 5 [0102.826] lstrcmpiW (lpString1=".docx", lpString2="t\\BCD") returned -1 [0102.826] lstrlenW (lpString=".pdf") returned 4 [0102.826] lstrcmpiW (lpString1=".pdf", lpString2="\\BCD") returned -1 [0102.826] lstrlenW (lpString=".xls") returned 4 [0102.826] lstrcmpiW (lpString1=".xls", lpString2="\\BCD") returned -1 [0102.826] lstrlenW (lpString=".xlsx") returned 5 [0102.826] lstrcmpiW (lpString1=".xlsx", lpString2="t\\BCD") returned -1 [0102.826] lstrlenW (lpString=".ppt") returned 4 [0102.826] lstrcmpiW (lpString1=".ppt", lpString2="\\BCD") returned -1 [0102.826] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0102.827] lstrlenW (lpString=".zip") returned 4 [0102.827] lstrcmpiW (lpString1=".zip", lpString2="\\BCD") returned -1 [0102.827] lstrlenW (lpString=".rar") returned 4 [0102.827] lstrcmpiW (lpString1=".rar", lpString2="\\BCD") returned -1 [0102.827] lstrlenW (lpString=".bz2") returned 4 [0102.827] lstrcmpiW (lpString1=".bz2", lpString2="\\BCD") returned -1 [0102.827] lstrlenW (lpString=".7z") returned 3 [0102.827] lstrcmpiW (lpString1=".7z", lpString2="BCD") returned -1 [0102.827] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0102.827] lstrlenW (lpString=".dbf") returned 4 [0102.827] lstrcmpiW (lpString1=".dbf", lpString2="\\BCD") returned -1 [0102.827] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0102.827] lstrlenW (lpString=".1cd") returned 4 [0102.827] lstrcmpiW (lpString1=".1cd", lpString2="\\BCD") returned -1 [0102.827] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0102.827] lstrlenW (lpString=".jpg") returned 4 [0102.827] lstrcmpiW (lpString1=".jpg", lpString2="\\BCD") returned -1 [0102.827] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0102.827] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0102.827] lstrlenW (lpString=".doc") returned 4 [0102.827] lstrcmpiW (lpString1=".doc", lpString2="\\BCD") returned -1 [0102.827] lstrlenW (lpString=".docx") returned 5 [0102.827] lstrcmpiW (lpString1=".docx", lpString2="t\\BCD") returned -1 [0102.827] lstrlenW (lpString=".pdf") returned 4 [0102.827] lstrcmpiW (lpString1=".pdf", lpString2="\\BCD") returned -1 [0102.827] lstrlenW (lpString=".xls") returned 4 [0102.827] lstrcmpiW (lpString1=".xls", lpString2="\\BCD") returned -1 [0102.827] lstrlenW (lpString=".xlsx") returned 5 [0102.827] lstrcmpiW (lpString1=".xlsx", lpString2="t\\BCD") returned -1 [0102.827] lstrlenW (lpString=".ppt") returned 4 [0102.827] lstrcmpiW (lpString1=".ppt", lpString2="\\BCD") returned -1 [0102.827] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0102.827] lstrlenW (lpString=".zip") returned 4 [0102.827] lstrcmpiW (lpString1=".zip", lpString2="\\BCD") returned -1 [0102.827] lstrlenW (lpString=".rar") returned 4 [0102.827] lstrcmpiW (lpString1=".rar", lpString2="\\BCD") returned -1 [0102.827] lstrlenW (lpString=".bz2") returned 4 [0102.827] lstrcmpiW (lpString1=".bz2", lpString2="\\BCD") returned -1 [0102.827] lstrlenW (lpString=".7z") returned 3 [0102.827] lstrcmpiW (lpString1=".7z", lpString2="BCD") returned -1 [0102.827] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0102.827] lstrlenW (lpString=".dbf") returned 4 [0102.827] lstrcmpiW (lpString1=".dbf", lpString2="\\BCD") returned -1 [0102.827] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0102.827] lstrlenW (lpString=".1cd") returned 4 [0102.827] lstrcmpiW (lpString1=".1cd", lpString2="\\BCD") returned -1 [0102.827] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0102.827] lstrlenW (lpString=".jpg") returned 4 [0102.827] lstrcmpiW (lpString1=".jpg", lpString2="\\BCD") returned -1 [0102.828] lstrcmpiW (lpString1=".LOG1", lpString2=".waifu") returned -1 [0102.828] lstrlenW (lpString="BCD.LOG1") returned 8 [0102.828] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG1" (normalized: "c:\\boot\\bcd.log1"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0102.828] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x292f944 | out: lpFileSize=0x292f944*=0) returned 1 [0102.828] CloseHandle (hObject=0x18c) returned 1 [0102.828] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0102.828] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0102.828] lstrlenW (lpString=".doc") returned 4 [0102.828] lstrcmpiW (lpString1=".doc", lpString2="LOG1") returned -1 [0102.828] lstrlenW (lpString=".docx") returned 5 [0102.828] lstrcmpiW (lpString1=".docx", lpString2=".LOG1") returned -1 [0102.828] lstrlenW (lpString=".pdf") returned 4 [0102.828] lstrcmpiW (lpString1=".pdf", lpString2="LOG1") returned -1 [0102.828] lstrlenW (lpString=".xls") returned 4 [0102.828] lstrcmpiW (lpString1=".xls", lpString2="LOG1") returned -1 [0102.828] lstrlenW (lpString=".xlsx") returned 5 [0102.828] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG1") returned 1 [0102.828] lstrlenW (lpString=".ppt") returned 4 [0102.828] lstrcmpiW (lpString1=".ppt", lpString2="LOG1") returned -1 [0102.828] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0102.828] lstrlenW (lpString=".zip") returned 4 [0102.828] lstrcmpiW (lpString1=".zip", lpString2="LOG1") returned -1 [0102.828] lstrlenW (lpString=".rar") returned 4 [0102.828] lstrcmpiW (lpString1=".rar", lpString2="LOG1") returned -1 [0102.828] lstrlenW (lpString=".bz2") returned 4 [0102.828] lstrcmpiW (lpString1=".bz2", lpString2="LOG1") returned -1 [0102.828] lstrlenW (lpString=".7z") returned 3 [0102.828] lstrcmpiW (lpString1=".7z", lpString2="OG1") returned -1 [0102.828] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0102.828] lstrlenW (lpString=".dbf") returned 4 [0102.828] lstrcmpiW (lpString1=".dbf", lpString2="LOG1") returned -1 [0102.828] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0102.828] lstrlenW (lpString=".1cd") returned 4 [0102.828] lstrcmpiW (lpString1=".1cd", lpString2="LOG1") returned -1 [0102.829] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0102.829] lstrlenW (lpString=".jpg") returned 4 [0102.829] lstrcmpiW (lpString1=".jpg", lpString2="LOG1") returned -1 [0102.829] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0102.829] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0102.829] lstrlenW (lpString=".doc") returned 4 [0102.829] lstrcmpiW (lpString1=".doc", lpString2="LOG1") returned -1 [0102.829] lstrlenW (lpString=".docx") returned 5 [0102.829] lstrcmpiW (lpString1=".docx", lpString2=".LOG1") returned -1 [0102.829] lstrlenW (lpString=".pdf") returned 4 [0102.829] lstrcmpiW (lpString1=".pdf", lpString2="LOG1") returned -1 [0102.829] lstrlenW (lpString=".xls") returned 4 [0102.829] lstrcmpiW (lpString1=".xls", lpString2="LOG1") returned -1 [0102.829] lstrlenW (lpString=".xlsx") returned 5 [0102.829] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG1") returned 1 [0102.829] lstrlenW (lpString=".ppt") returned 4 [0102.829] lstrcmpiW (lpString1=".ppt", lpString2="LOG1") returned -1 [0102.829] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0102.829] lstrlenW (lpString=".zip") returned 4 [0102.829] lstrcmpiW (lpString1=".zip", lpString2="LOG1") returned -1 [0102.829] lstrlenW (lpString=".rar") returned 4 [0102.829] lstrcmpiW (lpString1=".rar", lpString2="LOG1") returned -1 [0102.829] lstrlenW (lpString=".bz2") returned 4 [0102.829] lstrcmpiW (lpString1=".bz2", lpString2="LOG1") returned -1 [0102.829] lstrlenW (lpString=".7z") returned 3 [0102.829] lstrcmpiW (lpString1=".7z", lpString2="OG1") returned -1 [0102.829] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0102.829] lstrlenW (lpString=".dbf") returned 4 [0102.829] lstrcmpiW (lpString1=".dbf", lpString2="LOG1") returned -1 [0102.829] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0102.829] lstrlenW (lpString=".1cd") returned 4 [0102.829] lstrcmpiW (lpString1=".1cd", lpString2="LOG1") returned -1 [0102.829] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0102.829] lstrlenW (lpString=".jpg") returned 4 [0102.829] lstrcmpiW (lpString1=".jpg", lpString2="LOG1") returned -1 [0102.829] lstrcmpiW (lpString1=".LOG2", lpString2=".waifu") returned -1 [0102.829] lstrlenW (lpString="BCD.LOG2") returned 8 [0102.829] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG2" (normalized: "c:\\boot\\bcd.log2"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0102.829] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x292f944 | out: lpFileSize=0x292f944*=0) returned 1 [0102.830] CloseHandle (hObject=0x18c) returned 1 [0102.830] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0102.830] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0102.830] lstrlenW (lpString=".doc") returned 4 [0102.830] lstrcmpiW (lpString1=".doc", lpString2="LOG2") returned -1 [0102.830] lstrlenW (lpString=".docx") returned 5 [0102.830] lstrcmpiW (lpString1=".docx", lpString2=".LOG2") returned -1 [0102.830] lstrlenW (lpString=".pdf") returned 4 [0102.830] lstrcmpiW (lpString1=".pdf", lpString2="LOG2") returned -1 [0102.830] lstrlenW (lpString=".xls") returned 4 [0102.830] lstrcmpiW (lpString1=".xls", lpString2="LOG2") returned -1 [0102.830] lstrlenW (lpString=".xlsx") returned 5 [0102.830] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG2") returned 1 [0102.830] lstrlenW (lpString=".ppt") returned 4 [0102.830] lstrcmpiW (lpString1=".ppt", lpString2="LOG2") returned -1 [0102.830] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0102.830] lstrlenW (lpString=".zip") returned 4 [0102.830] lstrcmpiW (lpString1=".zip", lpString2="LOG2") returned -1 [0102.830] lstrlenW (lpString=".rar") returned 4 [0102.830] lstrcmpiW (lpString1=".rar", lpString2="LOG2") returned -1 [0102.830] lstrlenW (lpString=".bz2") returned 4 [0102.830] lstrcmpiW (lpString1=".bz2", lpString2="LOG2") returned -1 [0102.830] lstrlenW (lpString=".7z") returned 3 [0102.830] lstrcmpiW (lpString1=".7z", lpString2="OG2") returned -1 [0102.830] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0102.830] lstrlenW (lpString=".dbf") returned 4 [0102.830] lstrcmpiW (lpString1=".dbf", lpString2="LOG2") returned -1 [0102.830] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0102.830] lstrlenW (lpString=".1cd") returned 4 [0102.830] lstrcmpiW (lpString1=".1cd", lpString2="LOG2") returned -1 [0102.830] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0102.830] lstrlenW (lpString=".jpg") returned 4 [0102.830] lstrcmpiW (lpString1=".jpg", lpString2="LOG2") returned -1 [0102.830] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0102.830] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0102.830] lstrlenW (lpString=".doc") returned 4 [0102.830] lstrcmpiW (lpString1=".doc", lpString2="LOG2") returned -1 [0102.830] lstrlenW (lpString=".docx") returned 5 [0102.830] lstrcmpiW (lpString1=".docx", lpString2=".LOG2") returned -1 [0102.830] lstrlenW (lpString=".pdf") returned 4 [0102.830] lstrcmpiW (lpString1=".pdf", lpString2="LOG2") returned -1 [0102.830] lstrlenW (lpString=".xls") returned 4 [0102.830] lstrcmpiW (lpString1=".xls", lpString2="LOG2") returned -1 [0102.830] lstrlenW (lpString=".xlsx") returned 5 [0102.830] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG2") returned 1 [0102.830] lstrlenW (lpString=".ppt") returned 4 [0102.830] lstrcmpiW (lpString1=".ppt", lpString2="LOG2") returned -1 [0102.830] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0102.831] lstrlenW (lpString=".zip") returned 4 [0102.831] lstrcmpiW (lpString1=".zip", lpString2="LOG2") returned -1 [0102.831] lstrlenW (lpString=".rar") returned 4 [0102.831] lstrcmpiW (lpString1=".rar", lpString2="LOG2") returned -1 [0102.831] lstrlenW (lpString=".bz2") returned 4 [0102.831] lstrcmpiW (lpString1=".bz2", lpString2="LOG2") returned -1 [0102.831] lstrlenW (lpString=".7z") returned 3 [0102.831] lstrcmpiW (lpString1=".7z", lpString2="OG2") returned -1 [0102.831] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0102.831] lstrlenW (lpString=".dbf") returned 4 [0102.831] lstrcmpiW (lpString1=".dbf", lpString2="LOG2") returned -1 [0102.831] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0102.831] lstrlenW (lpString=".1cd") returned 4 [0102.831] lstrcmpiW (lpString1=".1cd", lpString2="LOG2") returned -1 [0102.831] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0102.831] lstrlenW (lpString=".jpg") returned 4 [0102.831] lstrcmpiW (lpString1=".jpg", lpString2="LOG2") returned -1 [0102.831] lstrcmpiW (lpString1=".mui", lpString2=".waifu") returned -1 [0102.831] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0102.831] CreateFileW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0102.831] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x292f944 | out: lpFileSize=0x292f944*=89168) returned 1 [0102.831] CloseHandle (hObject=0x18c) returned 1 [0102.831] GetFileAttributesW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui")) returned 0x20 [0102.831] GetFileAttributesW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0102.831] CreateFileW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0102.831] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0102.831] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0102.831] lstrlenW (lpString=".doc") returned 4 [0102.831] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0102.831] lstrlenW (lpString=".docx") returned 5 [0102.831] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0102.831] lstrlenW (lpString=".pdf") returned 4 [0102.832] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0102.832] lstrlenW (lpString=".xls") returned 4 [0102.832] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0102.832] lstrlenW (lpString=".xlsx") returned 5 [0102.832] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0102.832] lstrlenW (lpString=".ppt") returned 4 [0102.832] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0102.832] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0102.832] lstrlenW (lpString=".zip") returned 4 [0102.832] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0102.832] lstrlenW (lpString=".rar") returned 4 [0102.832] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0102.832] lstrlenW (lpString=".bz2") returned 4 [0102.832] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0102.832] lstrlenW (lpString=".7z") returned 3 [0102.832] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0102.832] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0102.832] lstrlenW (lpString=".dbf") returned 4 [0102.832] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0102.832] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0102.832] lstrlenW (lpString=".1cd") returned 4 [0102.832] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0102.832] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0102.832] lstrlenW (lpString=".jpg") returned 4 [0102.832] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0102.832] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0102.832] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0102.832] lstrlenW (lpString=".doc") returned 4 [0102.832] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0102.832] lstrlenW (lpString=".docx") returned 5 [0102.832] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0102.832] lstrlenW (lpString=".pdf") returned 4 [0102.832] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0102.832] lstrlenW (lpString=".xls") returned 4 [0102.832] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0102.832] lstrlenW (lpString=".xlsx") returned 5 [0102.832] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0102.832] lstrlenW (lpString=".ppt") returned 4 [0102.832] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0102.832] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0102.832] lstrlenW (lpString=".zip") returned 4 [0102.832] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0102.832] lstrlenW (lpString=".rar") returned 4 [0102.832] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0102.832] lstrlenW (lpString=".bz2") returned 4 [0102.832] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0102.832] lstrlenW (lpString=".7z") returned 3 [0102.832] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0102.832] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0102.832] lstrlenW (lpString=".dbf") returned 4 [0102.833] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0102.833] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0102.833] lstrlenW (lpString=".1cd") returned 4 [0102.833] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0102.833] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0102.833] lstrlenW (lpString=".jpg") returned 4 [0102.833] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0102.833] lstrcmpiW (lpString1=".mui", lpString2=".waifu") returned -1 [0102.833] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0102.833] CreateFileW (lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0102.833] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x292f944 | out: lpFileSize=0x292f944*=87616) returned 1 [0102.833] CloseHandle (hObject=0x18c) returned 1 [0102.833] GetFileAttributesW (lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui")) returned 0x20 [0102.833] GetFileAttributesW (lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0102.833] CreateFileW (lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0102.833] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0102.833] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0102.833] lstrlenW (lpString=".doc") returned 4 [0102.833] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0102.833] lstrlenW (lpString=".docx") returned 5 [0102.833] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0102.833] lstrlenW (lpString=".pdf") returned 4 [0102.833] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0102.833] lstrlenW (lpString=".xls") returned 4 [0102.833] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0102.833] lstrlenW (lpString=".xlsx") returned 5 [0102.833] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0102.833] lstrlenW (lpString=".ppt") returned 4 [0102.833] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0102.833] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0102.833] lstrlenW (lpString=".zip") returned 4 [0102.833] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0102.833] lstrlenW (lpString=".rar") returned 4 [0102.834] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0102.834] lstrlenW (lpString=".bz2") returned 4 [0102.834] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0102.834] lstrlenW (lpString=".7z") returned 3 [0102.834] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0102.834] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0102.834] lstrlenW (lpString=".dbf") returned 4 [0102.834] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0102.834] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0102.834] lstrlenW (lpString=".1cd") returned 4 [0102.834] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0102.834] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0102.834] lstrlenW (lpString=".jpg") returned 4 [0102.834] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0102.834] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0102.834] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0102.834] lstrlenW (lpString=".doc") returned 4 [0102.834] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0102.834] lstrlenW (lpString=".docx") returned 5 [0102.834] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0102.834] lstrlenW (lpString=".pdf") returned 4 [0102.834] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0102.834] lstrlenW (lpString=".xls") returned 4 [0102.834] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0102.834] lstrlenW (lpString=".xlsx") returned 5 [0102.834] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0102.834] lstrlenW (lpString=".ppt") returned 4 [0102.834] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0102.834] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0102.834] lstrlenW (lpString=".zip") returned 4 [0102.834] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0102.834] lstrlenW (lpString=".rar") returned 4 [0102.834] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0102.834] lstrlenW (lpString=".bz2") returned 4 [0102.834] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0102.834] lstrlenW (lpString=".7z") returned 3 [0102.834] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0102.834] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0102.834] lstrlenW (lpString=".dbf") returned 4 [0102.834] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0102.834] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0102.834] lstrlenW (lpString=".1cd") returned 4 [0102.834] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0102.834] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0102.834] lstrlenW (lpString=".jpg") returned 4 [0102.834] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0102.834] lstrcmpiW (lpString1=".mui", lpString2=".waifu") returned -1 [0102.835] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0102.835] CreateFileW (lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0102.835] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x292f944 | out: lpFileSize=0x292f944*=91712) returned 1 [0102.835] CloseHandle (hObject=0x18c) returned 1 [0102.835] GetFileAttributesW (lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui")) returned 0x20 [0102.835] GetFileAttributesW (lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0102.835] CreateFileW (lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0102.835] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0102.835] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0102.835] lstrlenW (lpString=".doc") returned 4 [0102.835] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0102.835] lstrlenW (lpString=".docx") returned 5 [0102.835] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0102.835] lstrlenW (lpString=".pdf") returned 4 [0102.835] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0102.835] lstrlenW (lpString=".xls") returned 4 [0102.835] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0102.835] lstrlenW (lpString=".xlsx") returned 5 [0102.835] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0102.835] lstrlenW (lpString=".ppt") returned 4 [0102.835] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0102.835] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0102.835] lstrlenW (lpString=".zip") returned 4 [0102.835] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0102.835] lstrlenW (lpString=".rar") returned 4 [0102.835] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0102.835] lstrlenW (lpString=".bz2") returned 4 [0102.835] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0102.835] lstrlenW (lpString=".7z") returned 3 [0102.835] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0102.835] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0102.835] lstrlenW (lpString=".dbf") returned 4 [0102.835] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0102.835] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0102.835] lstrlenW (lpString=".1cd") returned 4 [0102.835] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0102.835] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0102.835] lstrlenW (lpString=".jpg") returned 4 [0102.836] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0102.836] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0102.836] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0102.836] lstrlenW (lpString=".doc") returned 4 [0102.836] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0102.836] lstrlenW (lpString=".docx") returned 5 [0102.836] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0102.836] lstrlenW (lpString=".pdf") returned 4 [0102.836] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0102.836] lstrlenW (lpString=".xls") returned 4 [0102.836] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0102.836] lstrlenW (lpString=".xlsx") returned 5 [0102.836] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0102.836] lstrlenW (lpString=".ppt") returned 4 [0102.836] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0102.836] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0102.836] lstrlenW (lpString=".zip") returned 4 [0102.836] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0102.836] lstrlenW (lpString=".rar") returned 4 [0102.836] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0102.836] lstrlenW (lpString=".bz2") returned 4 [0102.836] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0102.836] lstrlenW (lpString=".7z") returned 3 [0102.836] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0102.836] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0102.836] lstrlenW (lpString=".dbf") returned 4 [0102.836] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0102.836] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0102.836] lstrlenW (lpString=".1cd") returned 4 [0102.836] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0102.836] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0102.836] lstrlenW (lpString=".jpg") returned 4 [0102.836] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0102.836] lstrcmpiW (lpString1=".mui", lpString2=".waifu") returned -1 [0102.836] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0102.836] CreateFileW (lpFileName="C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0102.836] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x292f944 | out: lpFileSize=0x292f944*=94800) returned 1 [0102.836] CloseHandle (hObject=0x18c) returned 1 [0102.837] GetFileAttributesW (lpFileName="C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui")) returned 0x20 [0102.837] GetFileAttributesW (lpFileName="C:\\Boot\\el-GR\\bootmgr.exe.mui.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0102.837] CreateFileW (lpFileName="C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0102.837] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0102.837] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0102.837] lstrlenW (lpString=".doc") returned 4 [0102.837] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0102.837] lstrlenW (lpString=".docx") returned 5 [0102.837] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0102.837] lstrlenW (lpString=".pdf") returned 4 [0102.837] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0102.837] lstrlenW (lpString=".xls") returned 4 [0102.837] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0102.837] lstrlenW (lpString=".xlsx") returned 5 [0102.837] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0102.837] lstrlenW (lpString=".ppt") returned 4 [0102.837] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0102.837] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0102.837] lstrlenW (lpString=".zip") returned 4 [0102.837] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0102.837] lstrlenW (lpString=".rar") returned 4 [0102.837] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0102.837] lstrlenW (lpString=".bz2") returned 4 [0102.837] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0102.837] lstrlenW (lpString=".7z") returned 3 [0102.837] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0102.838] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\chs_boot.ttf" (normalized: "c:\\boot\\fonts\\chs_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\chs_boot.ttf.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\boot\\fonts\\chs_boot.ttf.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0 [0103.213] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\cht_boot.ttf" (normalized: "c:\\boot\\fonts\\cht_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\cht_boot.ttf.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\boot\\fonts\\cht_boot.ttf.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0 [0103.214] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x292f944 | out: lpFileSize=0x292f944*=2503680) returned 1 [0103.214] CloseHandle (hObject=0x168) returned 1 [0103.214] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.msi")) returned 0x2020 [0103.214] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.msi.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0103.214] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.msi.id-9c354b42.[darknes@420blaze.it].waifu")) returned 1 [0103.214] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.msi.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0103.214] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x292f694 | out: lpNewFilePointer=0x0) returned 1 [0103.214] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x292f654 | out: lpNewFilePointer=0x0) returned 1 [0103.215] ReadFile (in: hFile=0x168, lpBuffer=0x3be0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x292f660, lpOverlapped=0x0 | out: lpBuffer=0x3be0058*, lpNumberOfBytesRead=0x292f660*=0x40000, lpOverlapped=0x0) returned 1 [0103.339] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0xcbc00, lpNewFilePointer=0x0, dwMoveMethod=0x292f654 | out: lpNewFilePointer=0x0) returned 1 [0103.339] ReadFile (in: hFile=0x168, lpBuffer=0x3c20058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x292f660, lpOverlapped=0x0 | out: lpBuffer=0x3c20058*, lpNumberOfBytesRead=0x292f660*=0x40000, lpOverlapped=0x0) returned 1 [0103.343] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x292f694 | out: lpNewFilePointer=0xffffffff) returned 1 [0103.343] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x223400, lpNewFilePointer=0x0, dwMoveMethod=0x292f654 | out: lpNewFilePointer=0x0) returned 1 [0103.343] ReadFile (in: hFile=0x168, lpBuffer=0x3c60058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x292f660, lpOverlapped=0x0 | out: lpBuffer=0x3c60058*, lpNumberOfBytesRead=0x292f660*=0x40000, lpOverlapped=0x0) returned 1 [0103.357] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x292f8f0 | out: lpNewFilePointer=0x0) returned 1 [0103.357] WriteFile (in: hFile=0x168, lpBuffer=0x3be0020*, nNumberOfBytesToWrite=0xc010e, lpNumberOfBytesWritten=0x292f6d8, lpOverlapped=0x0 | out: lpBuffer=0x3be0020*, lpNumberOfBytesWritten=0x292f6d8*=0xc010e, lpOverlapped=0x0) returned 1 [0103.410] SetEndOfFile (hFile=0x168) returned 1 [0103.410] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x292f6a4 | out: lpNewFilePointer=0x0) returned 1 [0103.410] WriteFile (in: hFile=0x168, lpBuffer=0x44d40a0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x292f6b0, lpOverlapped=0x0 | out: lpBuffer=0x44d40a0*, lpNumberOfBytesWritten=0x292f6b0*=0x40000, lpOverlapped=0x0) returned 1 [0103.411] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0xcbc00, lpNewFilePointer=0x0, dwMoveMethod=0x292f6a4 | out: lpNewFilePointer=0x0) returned 1 [0103.411] WriteFile (in: hFile=0x168, lpBuffer=0x44d40a0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x292f6b0, lpOverlapped=0x0 | out: lpBuffer=0x44d40a0*, lpNumberOfBytesWritten=0x292f6b0*=0x40000, lpOverlapped=0x0) returned 1 [0103.413] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x223400, lpNewFilePointer=0x0, dwMoveMethod=0x292f6a4 | out: lpNewFilePointer=0x0) returned 1 [0103.413] WriteFile (in: hFile=0x168, lpBuffer=0x44d40a0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x292f6b0, lpOverlapped=0x0 | out: lpBuffer=0x44d40a0*, lpNumberOfBytesWritten=0x292f6b0*=0x40000, lpOverlapped=0x0) returned 1 [0103.415] CloseHandle (hObject=0x168) returned 1 [0104.100] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x2020) returned 1 [0104.100] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0104.100] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0104.100] lstrlenW (lpString=".doc") returned 4 [0104.100] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0104.100] lstrlenW (lpString=".docx") returned 5 [0104.100] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0104.100] lstrlenW (lpString=".pdf") returned 4 [0104.100] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0104.100] lstrlenW (lpString=".xls") returned 4 [0104.100] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0104.100] lstrlenW (lpString=".xlsx") returned 5 [0104.100] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0104.100] lstrlenW (lpString=".ppt") returned 4 [0104.100] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0104.100] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0104.100] lstrlenW (lpString=".zip") returned 4 [0104.100] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0104.100] lstrlenW (lpString=".rar") returned 4 [0104.100] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0104.100] lstrlenW (lpString=".bz2") returned 4 [0104.100] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0104.100] lstrlenW (lpString=".7z") returned 3 [0104.100] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0104.100] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0104.100] lstrlenW (lpString=".dbf") returned 4 [0104.100] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0104.100] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0104.101] lstrlenW (lpString=".1cd") returned 4 [0104.101] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0104.101] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0104.101] lstrlenW (lpString=".jpg") returned 4 [0104.101] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0104.101] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0104.101] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0104.101] lstrlenW (lpString=".doc") returned 4 [0104.101] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0104.101] lstrlenW (lpString=".docx") returned 5 [0104.101] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0104.101] lstrlenW (lpString=".pdf") returned 4 [0104.101] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0104.101] lstrlenW (lpString=".xls") returned 4 [0104.101] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0104.101] lstrlenW (lpString=".xlsx") returned 5 [0104.101] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0104.101] lstrlenW (lpString=".ppt") returned 4 [0104.101] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0104.101] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0104.101] lstrlenW (lpString=".zip") returned 4 [0104.101] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0104.101] lstrlenW (lpString=".rar") returned 4 [0104.101] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0104.101] lstrlenW (lpString=".bz2") returned 4 [0104.101] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0104.101] lstrlenW (lpString=".7z") returned 3 [0104.101] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0104.101] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0104.101] lstrlenW (lpString=".dbf") returned 4 [0104.101] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0104.101] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0104.101] lstrlenW (lpString=".1cd") returned 4 [0104.101] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0104.101] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0104.101] lstrlenW (lpString=".jpg") returned 4 [0104.101] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0104.101] lstrcmpiW (lpString1=".cab", lpString2=".waifu") returned -1 [0104.101] lstrlenW (lpString="PubLR.cab") returned 9 [0104.101] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0104.102] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x292f944 | out: lpFileSize=0x292f944*=9958388) returned 1 [0104.102] CloseHandle (hObject=0x168) returned 1 [0104.102] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publr.cab")) returned 0x2020 [0104.102] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publr.cab.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0104.102] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publr.cab.id-9c354b42.[darknes@420blaze.it].waifu")) returned 1 [0104.102] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publr.cab.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0104.102] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x292f694 | out: lpNewFilePointer=0x0) returned 1 [0104.102] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x292f654 | out: lpNewFilePointer=0x0) returned 1 [0104.102] ReadFile (in: hFile=0x168, lpBuffer=0x3be0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x292f660, lpOverlapped=0x0 | out: lpBuffer=0x3be0058*, lpNumberOfBytesRead=0x292f660*=0x40000, lpOverlapped=0x0) returned 1 [0104.197] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x32a6a6, lpNewFilePointer=0x0, dwMoveMethod=0x292f654 | out: lpNewFilePointer=0x0) returned 1 [0104.197] ReadFile (in: hFile=0x168, lpBuffer=0x3c20058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x292f660, lpOverlapped=0x0 | out: lpBuffer=0x3c20058*, lpNumberOfBytesRead=0x292f660*=0x40000, lpOverlapped=0x0) returned 1 [0104.363] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x292f694 | out: lpNewFilePointer=0xffffffff) returned 1 [0104.363] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x93f3f4, lpNewFilePointer=0x0, dwMoveMethod=0x292f654 | out: lpNewFilePointer=0x0) returned 1 [0104.363] ReadFile (in: hFile=0x168, lpBuffer=0x3c60058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x292f660, lpOverlapped=0x0 | out: lpBuffer=0x3c60058*, lpNumberOfBytesRead=0x292f660*=0x40000, lpOverlapped=0x0) returned 1 [0104.378] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x292f8f0 | out: lpNewFilePointer=0x0) returned 1 [0104.378] WriteFile (in: hFile=0x168, lpBuffer=0x3be0020*, nNumberOfBytesToWrite=0xc00fe, lpNumberOfBytesWritten=0x292f6d8, lpOverlapped=0x0 | out: lpBuffer=0x3be0020*, lpNumberOfBytesWritten=0x292f6d8*=0xc00fe, lpOverlapped=0x0) returned 1 [0104.385] SetEndOfFile (hFile=0x168) returned 1 [0104.387] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x292f6a4 | out: lpNewFilePointer=0x0) returned 1 [0104.387] WriteFile (in: hFile=0x168, lpBuffer=0x45250c0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x292f6b0, lpOverlapped=0x0 | out: lpBuffer=0x45250c0*, lpNumberOfBytesWritten=0x292f6b0*=0x40000, lpOverlapped=0x0) returned 1 [0104.388] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x32a6a6, lpNewFilePointer=0x0, dwMoveMethod=0x292f6a4 | out: lpNewFilePointer=0x0) returned 1 [0104.388] WriteFile (in: hFile=0x168, lpBuffer=0x45250c0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x292f6b0, lpOverlapped=0x0 | out: lpBuffer=0x45250c0*, lpNumberOfBytesWritten=0x292f6b0*=0x40000, lpOverlapped=0x0) returned 1 [0104.391] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x93f3f4, lpNewFilePointer=0x0, dwMoveMethod=0x292f6a4 | out: lpNewFilePointer=0x0) returned 1 [0104.391] WriteFile (in: hFile=0x168, lpBuffer=0x45250c0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x292f6b0, lpOverlapped=0x0 | out: lpBuffer=0x45250c0*, lpNumberOfBytesWritten=0x292f6b0*=0x40000, lpOverlapped=0x0) returned 1 [0104.393] CloseHandle (hObject=0x168) returned 1 [0105.388] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x2020) returned 1 [0105.388] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0105.388] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0105.388] lstrlenW (lpString=".doc") returned 4 [0105.388] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0105.388] lstrlenW (lpString=".docx") returned 5 [0105.388] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0105.388] lstrlenW (lpString=".pdf") returned 4 [0105.388] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0105.388] lstrlenW (lpString=".xls") returned 4 [0105.388] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0105.388] lstrlenW (lpString=".xlsx") returned 5 [0105.388] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0105.388] lstrlenW (lpString=".ppt") returned 4 [0105.388] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0105.388] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0105.388] lstrlenW (lpString=".zip") returned 4 [0105.388] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0105.388] lstrlenW (lpString=".rar") returned 4 [0105.388] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0105.388] lstrlenW (lpString=".bz2") returned 4 [0105.388] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0105.388] lstrlenW (lpString=".7z") returned 3 [0105.388] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0105.388] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0105.388] lstrlenW (lpString=".dbf") returned 4 [0105.388] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0105.388] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0105.388] lstrlenW (lpString=".1cd") returned 4 [0105.388] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0105.388] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0105.388] lstrlenW (lpString=".jpg") returned 4 [0105.388] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0105.389] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0105.389] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0105.389] lstrlenW (lpString=".doc") returned 4 [0105.389] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0105.389] lstrlenW (lpString=".docx") returned 5 [0105.389] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0105.389] lstrlenW (lpString=".pdf") returned 4 [0105.389] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0105.389] lstrlenW (lpString=".xls") returned 4 [0105.389] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0105.389] lstrlenW (lpString=".xlsx") returned 5 [0105.389] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0105.389] lstrlenW (lpString=".ppt") returned 4 [0105.389] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0105.389] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0105.389] lstrlenW (lpString=".zip") returned 4 [0105.389] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0105.389] lstrlenW (lpString=".rar") returned 4 [0105.389] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0105.389] lstrlenW (lpString=".bz2") returned 4 [0105.389] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0105.389] lstrlenW (lpString=".7z") returned 3 [0105.389] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0105.389] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0105.389] lstrlenW (lpString=".dbf") returned 4 [0105.389] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0105.389] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0105.389] lstrlenW (lpString=".1cd") returned 4 [0105.389] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0105.389] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0105.389] lstrlenW (lpString=".jpg") returned 4 [0105.389] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0105.389] lstrcmpiW (lpString1=".msi", lpString2=".waifu") returned -1 [0105.389] lstrlenW (lpString="WordMUI.msi") returned 11 [0105.389] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0105.390] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x292f944 | out: lpFileSize=0x292f944*=2522624) returned 1 [0105.390] CloseHandle (hObject=0x194) returned 1 [0105.390] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.msi")) returned 0x2020 [0105.390] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.msi.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0105.390] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.msi.id-9c354b42.[darknes@420blaze.it].waifu")) returned 1 [0105.390] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.msi.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0105.390] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x292f694 | out: lpNewFilePointer=0x0) returned 1 [0105.390] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x292f654 | out: lpNewFilePointer=0x0) returned 1 [0105.390] ReadFile (in: hFile=0x194, lpBuffer=0x3be0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x292f660, lpOverlapped=0x0 | out: lpBuffer=0x3be0058*, lpNumberOfBytesRead=0x292f660*=0x40000, lpOverlapped=0x0) returned 1 [0105.393] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0xcd4aa, lpNewFilePointer=0x0, dwMoveMethod=0x292f654 | out: lpNewFilePointer=0x0) returned 1 [0105.393] ReadFile (in: hFile=0x194, lpBuffer=0x3c20058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x292f660, lpOverlapped=0x0 | out: lpBuffer=0x3c20058*, lpNumberOfBytesRead=0x292f660*=0x40000, lpOverlapped=0x0) returned 1 [0105.397] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x292f694 | out: lpNewFilePointer=0xffffffff) returned 1 [0105.397] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x227e00, lpNewFilePointer=0x0, dwMoveMethod=0x292f654 | out: lpNewFilePointer=0x0) returned 1 [0105.397] ReadFile (in: hFile=0x194, lpBuffer=0x3c60058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x292f660, lpOverlapped=0x0 | out: lpBuffer=0x3c60058*, lpNumberOfBytesRead=0x292f660*=0x40000, lpOverlapped=0x0) returned 1 [0105.410] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x292f8f0 | out: lpNewFilePointer=0x0) returned 1 [0105.410] WriteFile (in: hFile=0x194, lpBuffer=0x3be0020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x292f6d8, lpOverlapped=0x0 | out: lpBuffer=0x3be0020*, lpNumberOfBytesWritten=0x292f6d8*=0xc0102, lpOverlapped=0x0) returned 1 [0105.417] SetEndOfFile (hFile=0x194) returned 1 [0105.418] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x292f6a4 | out: lpNewFilePointer=0x0) returned 1 [0105.418] WriteFile (in: hFile=0x194, lpBuffer=0x45240b8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x292f6b0, lpOverlapped=0x0 | out: lpBuffer=0x45240b8*, lpNumberOfBytesWritten=0x292f6b0*=0x40000, lpOverlapped=0x0) returned 1 [0105.419] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0xcd4aa, lpNewFilePointer=0x0, dwMoveMethod=0x292f6a4 | out: lpNewFilePointer=0x0) returned 1 [0105.419] WriteFile (in: hFile=0x194, lpBuffer=0x45240b8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x292f6b0, lpOverlapped=0x0 | out: lpBuffer=0x45240b8*, lpNumberOfBytesWritten=0x292f6b0*=0x40000, lpOverlapped=0x0) returned 1 [0105.422] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x227e00, lpNewFilePointer=0x0, dwMoveMethod=0x292f6a4 | out: lpNewFilePointer=0x0) returned 1 [0105.422] WriteFile (in: hFile=0x194, lpBuffer=0x45240b8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x292f6b0, lpOverlapped=0x0 | out: lpBuffer=0x45240b8*, lpNumberOfBytesWritten=0x292f6b0*=0x40000, lpOverlapped=0x0) returned 1 [0105.423] CloseHandle (hObject=0x194) returned 1 [0105.886] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x2020) returned 1 [0105.886] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0105.886] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0105.886] lstrlenW (lpString=".doc") returned 4 [0105.886] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0105.886] lstrlenW (lpString=".docx") returned 5 [0105.886] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0105.886] lstrlenW (lpString=".pdf") returned 4 [0105.886] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0105.886] lstrlenW (lpString=".xls") returned 4 [0105.886] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0105.886] lstrlenW (lpString=".xlsx") returned 5 [0105.886] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0105.886] lstrlenW (lpString=".ppt") returned 4 [0105.887] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0105.887] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0105.887] lstrlenW (lpString=".zip") returned 4 [0105.887] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0105.887] lstrlenW (lpString=".rar") returned 4 [0105.887] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0105.887] lstrlenW (lpString=".bz2") returned 4 [0105.887] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0105.887] lstrlenW (lpString=".7z") returned 3 [0105.887] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0105.887] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0105.887] lstrlenW (lpString=".dbf") returned 4 [0105.887] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0105.887] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0105.887] lstrlenW (lpString=".1cd") returned 4 [0105.887] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0105.887] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0105.887] lstrlenW (lpString=".jpg") returned 4 [0105.887] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0105.887] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0105.887] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0105.887] lstrlenW (lpString=".doc") returned 4 [0105.887] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0105.887] lstrlenW (lpString=".docx") returned 5 [0105.887] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0105.887] lstrlenW (lpString=".pdf") returned 4 [0105.887] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0105.887] lstrlenW (lpString=".xls") returned 4 [0105.887] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0105.887] lstrlenW (lpString=".xlsx") returned 5 [0105.887] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0105.887] lstrlenW (lpString=".ppt") returned 4 [0105.887] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0105.887] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0105.887] lstrlenW (lpString=".zip") returned 4 [0105.887] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0105.887] lstrlenW (lpString=".rar") returned 4 [0105.887] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0105.887] lstrlenW (lpString=".bz2") returned 4 [0105.887] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0105.887] lstrlenW (lpString=".7z") returned 3 [0105.887] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0105.887] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0105.887] lstrlenW (lpString=".dbf") returned 4 [0105.887] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0105.887] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0105.887] lstrlenW (lpString=".1cd") returned 4 [0105.887] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0105.887] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0105.887] lstrlenW (lpString=".jpg") returned 4 [0105.887] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0105.888] lstrcmpiW (lpString1=".msi", lpString2=".waifu") returned -1 [0105.888] lstrlenW (lpString="Proof.msi") returned 9 [0105.888] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0106.203] GetFileSizeEx (in: hFile=0x1c4, lpFileSize=0x292f944 | out: lpFileSize=0x292f944*=881152) returned 1 [0106.204] CloseHandle (hObject=0x1c4) returned 1 [0106.205] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.msi")) returned 0x2020 [0106.205] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.msi.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0106.205] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0106.205] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x292f8f0 | out: lpNewFilePointer=0x0) returned 1 [0106.205] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x292f8f0 | out: lpNewFilePointer=0x0) returned 1 [0106.205] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.msi.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c8 [0106.205] GetLastError () returned 0x0 [0106.205] ReadFile (in: hFile=0x1c4, lpBuffer=0x3be0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x292f8fc, lpOverlapped=0x0 | out: lpBuffer=0x3be0020*, lpNumberOfBytesRead=0x292f8fc*=0xd7200, lpOverlapped=0x0) returned 1 [0106.219] WriteFile (in: hFile=0x1c8, lpBuffer=0x3be0020*, nNumberOfBytesToWrite=0xd7210, lpNumberOfBytesWritten=0x292f6c4, lpOverlapped=0x0 | out: lpBuffer=0x3be0020*, lpNumberOfBytesWritten=0x292f6c4*=0xd7210, lpOverlapped=0x0) returned 1 [0106.226] ReadFile (in: hFile=0x1c4, lpBuffer=0x3be0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x292f8fc, lpOverlapped=0x0 | out: lpBuffer=0x3be0020*, lpNumberOfBytesRead=0x292f8fc*=0x0, lpOverlapped=0x0) returned 1 [0106.226] WriteFile (in: hFile=0x1c8, lpBuffer=0x3be0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x292f6c4, lpOverlapped=0x0 | out: lpBuffer=0x3be0020*, lpNumberOfBytesWritten=0x292f6c4*=0xe6, lpOverlapped=0x0) returned 1 [0106.226] SetEndOfFile (hFile=0x1c8) returned 1 [0106.227] CloseHandle (hObject=0x1c8) returned 1 [0106.232] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x292f8f0 | out: lpNewFilePointer=0x0) returned 1 [0106.232] SetEndOfFile (hFile=0x1c4) returned 1 [0106.234] CloseHandle (hObject=0x1c4) returned 1 [0106.234] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x2020) returned 1 [0106.234] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.msi")) returned 1 [0106.234] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81 [0106.234] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81 [0106.234] lstrlenW (lpString=".doc") returned 4 [0106.234] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0106.234] lstrlenW (lpString=".docx") returned 5 [0106.234] lstrcmpiW (lpString1=".docx", lpString2="f.msi") returned -1 [0106.234] lstrlenW (lpString=".pdf") returned 4 [0106.234] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0106.234] lstrlenW (lpString=".xls") returned 4 [0106.234] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0106.234] lstrlenW (lpString=".xlsx") returned 5 [0106.234] lstrcmpiW (lpString1=".xlsx", lpString2="f.msi") returned -1 [0106.234] lstrlenW (lpString=".ppt") returned 4 [0106.234] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0106.234] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81 [0106.234] lstrlenW (lpString=".zip") returned 4 [0106.234] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0106.234] lstrlenW (lpString=".rar") returned 4 [0106.234] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0106.234] lstrlenW (lpString=".bz2") returned 4 [0106.234] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0106.234] lstrlenW (lpString=".7z") returned 3 [0106.234] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0106.234] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81 [0106.234] lstrlenW (lpString=".dbf") returned 4 [0106.234] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0106.235] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81 [0106.235] lstrlenW (lpString=".1cd") returned 4 [0106.235] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0106.235] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81 [0106.235] lstrlenW (lpString=".jpg") returned 4 [0106.235] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0106.235] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81 [0106.235] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81 [0106.235] lstrlenW (lpString=".doc") returned 4 [0106.235] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0106.235] lstrlenW (lpString=".docx") returned 5 [0106.235] lstrcmpiW (lpString1=".docx", lpString2="f.msi") returned -1 [0106.235] lstrlenW (lpString=".pdf") returned 4 [0106.235] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0106.235] lstrlenW (lpString=".xls") returned 4 [0106.235] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0106.235] lstrlenW (lpString=".xlsx") returned 5 [0106.235] lstrcmpiW (lpString1=".xlsx", lpString2="f.msi") returned -1 [0106.235] lstrlenW (lpString=".ppt") returned 4 [0106.235] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0106.235] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81 [0106.235] lstrlenW (lpString=".zip") returned 4 [0106.235] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0106.235] lstrlenW (lpString=".rar") returned 4 [0106.235] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0106.235] lstrlenW (lpString=".bz2") returned 4 [0106.235] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0106.235] lstrlenW (lpString=".7z") returned 3 [0106.235] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0106.235] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81 [0106.235] lstrlenW (lpString=".dbf") returned 4 [0106.235] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0106.235] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81 [0106.235] lstrlenW (lpString=".1cd") returned 4 [0106.235] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0106.235] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81 [0106.235] lstrlenW (lpString=".jpg") returned 4 [0106.235] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0106.235] lstrcmpiW (lpString1=".cab", lpString2=".waifu") returned -1 [0106.235] lstrlenW (lpString="Proof.cab") returned 9 [0106.235] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0106.236] GetFileSizeEx (in: hFile=0x1c4, lpFileSize=0x292f944 | out: lpFileSize=0x292f944*=21064532) returned 1 [0106.236] CloseHandle (hObject=0x1c4) returned 1 [0106.236] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.cab")) returned 0x2020 [0106.236] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.cab.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0106.236] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.cab.id-9c354b42.[darknes@420blaze.it].waifu")) returned 1 [0107.582] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.cab.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0107.582] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x292f694 | out: lpNewFilePointer=0x0) returned 1 [0107.582] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x292f654 | out: lpNewFilePointer=0x0) returned 1 [0107.582] ReadFile (in: hFile=0x1c4, lpBuffer=0x3be0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x292f660, lpOverlapped=0x0 | out: lpBuffer=0x3be0058*, lpNumberOfBytesRead=0x292f660*=0x40000, lpOverlapped=0x0) returned 1 [0107.587] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x6b23c6, lpNewFilePointer=0x0, dwMoveMethod=0x292f654 | out: lpNewFilePointer=0x0) returned 1 [0107.587] ReadFile (in: hFile=0x1c4, lpBuffer=0x3c20058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x292f660, lpOverlapped=0x0 | out: lpBuffer=0x3c20058*, lpNumberOfBytesRead=0x292f660*=0x40000, lpOverlapped=0x0) returned 1 [0107.599] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x292f694 | out: lpNewFilePointer=0xffffffff) returned 1 [0107.599] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x13d6b54, lpNewFilePointer=0x0, dwMoveMethod=0x292f654 | out: lpNewFilePointer=0x0) returned 1 [0107.599] ReadFile (in: hFile=0x1c4, lpBuffer=0x3c60058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x292f660, lpOverlapped=0x0 | out: lpBuffer=0x3c60058*, lpNumberOfBytesRead=0x292f660*=0x40000, lpOverlapped=0x0) returned 1 [0107.617] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x292f8f0 | out: lpNewFilePointer=0x0) returned 1 [0107.617] WriteFile (in: hFile=0x1c4, lpBuffer=0x3be0020*, nNumberOfBytesToWrite=0xc00fe, lpNumberOfBytesWritten=0x292f6d8, lpOverlapped=0x0 | out: lpBuffer=0x3be0020*, lpNumberOfBytesWritten=0x292f6d8*=0xc00fe, lpOverlapped=0x0) returned 1 [0107.624] SetEndOfFile (hFile=0x1c4) returned 1 [0107.627] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x292f6a4 | out: lpNewFilePointer=0x0) returned 1 [0108.075] WriteFile (in: hFile=0x1c4, lpBuffer=0x44b2070*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x292f6b0, lpOverlapped=0x0 | out: lpBuffer=0x44b2070*, lpNumberOfBytesWritten=0x292f6b0*=0x40000, lpOverlapped=0x0) returned 1 [0108.090] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x6b23c6, lpNewFilePointer=0x0, dwMoveMethod=0x292f6a4 | out: lpNewFilePointer=0x0) returned 1 [0108.090] WriteFile (in: hFile=0x1c4, lpBuffer=0x44b2070*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x292f6b0, lpOverlapped=0x0 | out: lpBuffer=0x44b2070*, lpNumberOfBytesWritten=0x292f6b0*=0x40000, lpOverlapped=0x0) returned 1 [0108.091] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x13d6b54, lpNewFilePointer=0x0, dwMoveMethod=0x292f6a4 | out: lpNewFilePointer=0x0) returned 1 [0108.091] WriteFile (in: hFile=0x1c4, lpBuffer=0x44b2070*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x292f6b0, lpOverlapped=0x0 | out: lpBuffer=0x44b2070*, lpNumberOfBytesWritten=0x292f6b0*=0x40000, lpOverlapped=0x0) returned 1 [0108.093] CloseHandle (hObject=0x1c4) returned 1 [0110.395] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x2020) returned 1 [0110.395] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0110.395] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0110.395] lstrlenW (lpString=".doc") returned 4 [0110.395] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0110.395] lstrlenW (lpString=".docx") returned 5 [0110.395] lstrcmpiW (lpString1=".docx", lpString2="f.cab") returned -1 [0110.395] lstrlenW (lpString=".pdf") returned 4 [0110.395] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0110.395] lstrlenW (lpString=".xls") returned 4 [0110.395] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0110.395] lstrlenW (lpString=".xlsx") returned 5 [0110.395] lstrcmpiW (lpString1=".xlsx", lpString2="f.cab") returned -1 [0110.395] lstrlenW (lpString=".ppt") returned 4 [0110.395] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0110.395] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0110.396] lstrlenW (lpString=".zip") returned 4 [0110.396] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0110.396] lstrlenW (lpString=".rar") returned 4 [0110.396] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0110.396] lstrlenW (lpString=".bz2") returned 4 [0110.396] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0110.396] lstrlenW (lpString=".7z") returned 3 [0110.396] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0110.396] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0110.396] lstrlenW (lpString=".dbf") returned 4 [0110.396] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0110.396] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0110.396] lstrlenW (lpString=".1cd") returned 4 [0110.396] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0110.396] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0110.396] lstrlenW (lpString=".jpg") returned 4 [0110.396] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0110.396] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0110.396] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0110.396] lstrlenW (lpString=".doc") returned 4 [0110.396] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0110.396] lstrlenW (lpString=".docx") returned 5 [0110.396] lstrcmpiW (lpString1=".docx", lpString2="f.cab") returned -1 [0110.396] lstrlenW (lpString=".pdf") returned 4 [0110.396] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0110.396] lstrlenW (lpString=".xls") returned 4 [0110.396] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0110.396] lstrlenW (lpString=".xlsx") returned 5 [0110.396] lstrcmpiW (lpString1=".xlsx", lpString2="f.cab") returned -1 [0110.396] lstrlenW (lpString=".ppt") returned 4 [0110.396] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0110.396] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0110.396] lstrlenW (lpString=".zip") returned 4 [0110.396] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0110.396] lstrlenW (lpString=".rar") returned 4 [0110.396] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0110.396] lstrlenW (lpString=".bz2") returned 4 [0110.396] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0110.396] lstrlenW (lpString=".7z") returned 3 [0110.396] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0110.396] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0110.396] lstrlenW (lpString=".dbf") returned 4 [0110.397] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0110.397] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0110.397] lstrlenW (lpString=".1cd") returned 4 [0110.397] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0110.397] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0110.397] lstrlenW (lpString=".jpg") returned 4 [0110.397] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0110.397] lstrcmpiW (lpString1=".msi", lpString2=".waifu") returned -1 [0110.397] lstrlenW (lpString="VisioMUI.msi") returned 12 [0110.397] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0110.397] GetFileSizeEx (in: hFile=0x1c4, lpFileSize=0x292f944 | out: lpFileSize=0x292f944*=2797568) returned 1 [0110.397] CloseHandle (hObject=0x1c4) returned 1 [0110.397] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.msi")) returned 0x2020 [0110.397] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.msi.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0110.398] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.msi.id-9c354b42.[darknes@420blaze.it].waifu")) returned 1 [0110.398] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.msi.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0110.398] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x292f694 | out: lpNewFilePointer=0x0) returned 1 [0110.398] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x292f654 | out: lpNewFilePointer=0x0) returned 1 [0110.398] ReadFile (in: hFile=0x1c4, lpBuffer=0x3be0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x292f660, lpOverlapped=0x0 | out: lpBuffer=0x3be0058*, lpNumberOfBytesRead=0x292f660*=0x40000, lpOverlapped=0x0) returned 1 [0110.401] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0xe3aaa, lpNewFilePointer=0x0, dwMoveMethod=0x292f654 | out: lpNewFilePointer=0x0) returned 1 [0110.401] ReadFile (in: hFile=0x1c4, lpBuffer=0x3c20058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x292f660, lpOverlapped=0x0 | out: lpBuffer=0x3c20058*, lpNumberOfBytesRead=0x292f660*=0x40000, lpOverlapped=0x0) returned 1 [0110.405] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x292f694 | out: lpNewFilePointer=0xffffffff) returned 1 [0110.405] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x26b000, lpNewFilePointer=0x0, dwMoveMethod=0x292f654 | out: lpNewFilePointer=0x0) returned 1 [0110.405] ReadFile (in: hFile=0x1c4, lpBuffer=0x3c60058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x292f660, lpOverlapped=0x0 | out: lpBuffer=0x3c60058*, lpNumberOfBytesRead=0x292f660*=0x40000, lpOverlapped=0x0) returned 1 [0110.420] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x292f8f0 | out: lpNewFilePointer=0x0) returned 1 [0110.420] WriteFile (in: hFile=0x1c4, lpBuffer=0x3be0020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x292f6d8, lpOverlapped=0x0 | out: lpBuffer=0x3be0020*, lpNumberOfBytesWritten=0x292f6d8*=0xc0104, lpOverlapped=0x0) returned 1 [0110.428] SetEndOfFile (hFile=0x1c4) returned 1 [0110.429] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x292f6a4 | out: lpNewFilePointer=0x0) returned 1 [0110.429] WriteFile (in: hFile=0x1c4, lpBuffer=0x45640c0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x292f6b0, lpOverlapped=0x0 | out: lpBuffer=0x45640c0*, lpNumberOfBytesWritten=0x292f6b0*=0x40000, lpOverlapped=0x0) returned 1 [0110.430] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0xe3aaa, lpNewFilePointer=0x0, dwMoveMethod=0x292f6a4 | out: lpNewFilePointer=0x0) returned 1 [0110.430] WriteFile (in: hFile=0x1c4, lpBuffer=0x45640c0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x292f6b0, lpOverlapped=0x0 | out: lpBuffer=0x45640c0*, lpNumberOfBytesWritten=0x292f6b0*=0x40000, lpOverlapped=0x0) returned 1 [0110.433] SetFilePointerEx (in: hFile=0x1c4, liDistanceToMove=0x26b000, lpNewFilePointer=0x0, dwMoveMethod=0x292f6a4 | out: lpNewFilePointer=0x0) returned 1 [0110.433] WriteFile (in: hFile=0x1c4, lpBuffer=0x45640c0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x292f6b0, lpOverlapped=0x0 | out: lpBuffer=0x45640c0*, lpNumberOfBytesWritten=0x292f6b0*=0x40000, lpOverlapped=0x0) returned 1 [0110.434] CloseHandle (hObject=0x1c4) returned 1 [0110.434] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x2020) returned 1 [0110.435] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0110.435] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0110.435] lstrlenW (lpString=".doc") returned 4 [0110.435] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0110.435] lstrlenW (lpString=".docx") returned 5 [0110.435] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0110.435] lstrlenW (lpString=".pdf") returned 4 [0110.435] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0110.435] lstrlenW (lpString=".xls") returned 4 [0110.435] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0110.435] lstrlenW (lpString=".xlsx") returned 5 [0110.435] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0110.435] lstrlenW (lpString=".ppt") returned 4 [0110.435] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0110.435] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0110.435] lstrlenW (lpString=".zip") returned 4 [0110.435] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0110.435] lstrlenW (lpString=".rar") returned 4 [0110.435] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0110.435] lstrlenW (lpString=".bz2") returned 4 [0110.435] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0110.435] lstrlenW (lpString=".7z") returned 3 [0110.435] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0110.435] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0110.435] lstrlenW (lpString=".dbf") returned 4 [0110.435] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0110.769] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0110.769] lstrlenW (lpString=".1cd") returned 4 [0110.769] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0110.769] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0110.769] lstrlenW (lpString=".jpg") returned 4 [0110.769] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0110.769] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0110.769] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0110.769] lstrlenW (lpString=".doc") returned 4 [0110.769] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0110.769] lstrlenW (lpString=".docx") returned 5 [0110.769] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0110.769] lstrlenW (lpString=".pdf") returned 4 [0110.769] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0110.769] lstrlenW (lpString=".xls") returned 4 [0110.769] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0110.769] lstrlenW (lpString=".xlsx") returned 5 [0110.770] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0110.770] lstrlenW (lpString=".ppt") returned 4 [0110.770] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0110.770] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0110.770] lstrlenW (lpString=".zip") returned 4 [0110.770] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0110.770] lstrlenW (lpString=".rar") returned 4 [0110.770] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0110.770] lstrlenW (lpString=".bz2") returned 4 [0110.770] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0110.770] lstrlenW (lpString=".7z") returned 3 [0110.770] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0110.770] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0110.770] lstrlenW (lpString=".dbf") returned 4 [0110.770] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0110.770] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0110.770] lstrlenW (lpString=".1cd") returned 4 [0110.770] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0110.770] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0110.770] lstrlenW (lpString=".jpg") returned 4 [0110.770] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0110.770] lstrcmpiW (lpString1=".cab", lpString2=".waifu") returned -1 [0110.771] lstrlenW (lpString="ProjLR.cab") returned 10 [0110.771] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projlr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0111.427] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x292f944 | out: lpFileSize=0x292f944*=8265165) returned 1 [0111.427] CloseHandle (hObject=0x1e4) returned 1 [0111.427] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projlr.cab")) returned 0x2020 [0111.427] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projlr.cab.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0111.427] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projlr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projlr.cab.id-9c354b42.[darknes@420blaze.it].waifu")) returned 1 [0111.427] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projlr.cab.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0111.427] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x292f694 | out: lpNewFilePointer=0x0) returned 1 [0111.427] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x292f654 | out: lpNewFilePointer=0x0) returned 1 [0111.427] ReadFile (in: hFile=0x1e4, lpBuffer=0x3be0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x292f660, lpOverlapped=0x0 | out: lpBuffer=0x3be0058*, lpNumberOfBytesRead=0x292f660*=0x40000, lpOverlapped=0x0) returned 1 [0111.430] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x2a09ef, lpNewFilePointer=0x0, dwMoveMethod=0x292f654 | out: lpNewFilePointer=0x0) returned 1 [0111.430] ReadFile (in: hFile=0x1e4, lpBuffer=0x3c20058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x292f660, lpOverlapped=0x0 | out: lpBuffer=0x3c20058*, lpNumberOfBytesRead=0x292f660*=0x40000, lpOverlapped=0x0) returned 1 [0111.433] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x292f694 | out: lpNewFilePointer=0xffffffff) returned 1 [0111.433] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x7a1dcd, lpNewFilePointer=0x0, dwMoveMethod=0x292f654 | out: lpNewFilePointer=0x0) returned 1 [0111.433] ReadFile (in: hFile=0x1e4, lpBuffer=0x3c60058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x292f660, lpOverlapped=0x0 | out: lpBuffer=0x3c60058*, lpNumberOfBytesRead=0x292f660*=0x40000, lpOverlapped=0x0) returned 1 [0111.447] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x292f8f0 | out: lpNewFilePointer=0x0) returned 1 [0111.447] WriteFile (in: hFile=0x1e4, lpBuffer=0x3be0020*, nNumberOfBytesToWrite=0xc0100, lpNumberOfBytesWritten=0x292f6d8, lpOverlapped=0x0 | out: lpBuffer=0x3be0020*, lpNumberOfBytesWritten=0x292f6d8*=0xc0100, lpOverlapped=0x0) returned 1 [0111.457] SetEndOfFile (hFile=0x1e4) returned 1 [0111.457] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x292f6a4 | out: lpNewFilePointer=0x0) returned 1 [0111.457] WriteFile (in: hFile=0x1e4, lpBuffer=0x44b2070*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x292f6b0, lpOverlapped=0x0 | out: lpBuffer=0x44b2070*, lpNumberOfBytesWritten=0x292f6b0*=0x40000, lpOverlapped=0x0) returned 1 [0111.458] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x2a09ef, lpNewFilePointer=0x0, dwMoveMethod=0x292f6a4 | out: lpNewFilePointer=0x0) returned 1 [0111.458] WriteFile (in: hFile=0x1e4, lpBuffer=0x44b2070*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x292f6b0, lpOverlapped=0x0 | out: lpBuffer=0x44b2070*, lpNumberOfBytesWritten=0x292f6b0*=0x40000, lpOverlapped=0x0) returned 1 [0111.459] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x7a1dcd, lpNewFilePointer=0x0, dwMoveMethod=0x292f6a4 | out: lpNewFilePointer=0x0) returned 1 [0111.459] WriteFile (in: hFile=0x1e4, lpBuffer=0x44b2070*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x292f6b0, lpOverlapped=0x0 | out: lpBuffer=0x44b2070*, lpNumberOfBytesWritten=0x292f6b0*=0x40000, lpOverlapped=0x0) returned 1 [0111.461] CloseHandle (hObject=0x1e4) returned 1 [0111.461] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x2020) returned 1 [0111.461] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73 [0111.461] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73 [0111.461] lstrlenW (lpString=".doc") returned 4 [0111.461] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0111.461] lstrlenW (lpString=".docx") returned 5 [0111.461] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0111.461] lstrlenW (lpString=".pdf") returned 4 [0111.461] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0111.461] lstrlenW (lpString=".xls") returned 4 [0111.461] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0111.461] lstrlenW (lpString=".xlsx") returned 5 [0111.461] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0111.462] lstrlenW (lpString=".ppt") returned 4 [0111.462] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0111.462] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73 [0111.462] lstrlenW (lpString=".zip") returned 4 [0111.462] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0111.462] lstrlenW (lpString=".rar") returned 4 [0111.462] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0111.462] lstrlenW (lpString=".bz2") returned 4 [0111.462] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0111.462] lstrlenW (lpString=".7z") returned 3 [0111.462] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0111.462] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73 [0111.462] lstrlenW (lpString=".dbf") returned 4 [0111.462] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0111.462] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73 [0111.462] lstrlenW (lpString=".1cd") returned 4 [0111.462] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0111.462] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73 [0111.462] lstrlenW (lpString=".jpg") returned 4 [0111.462] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0111.462] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73 [0111.462] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73 [0111.462] lstrlenW (lpString=".doc") returned 4 [0111.462] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0111.462] lstrlenW (lpString=".docx") returned 5 [0111.462] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0111.462] lstrlenW (lpString=".pdf") returned 4 [0111.462] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0111.462] lstrlenW (lpString=".xls") returned 4 [0111.462] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0111.462] lstrlenW (lpString=".xlsx") returned 5 [0111.462] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0111.462] lstrlenW (lpString=".ppt") returned 4 [0111.462] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0111.462] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73 [0111.462] lstrlenW (lpString=".zip") returned 4 [0111.462] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0111.462] lstrlenW (lpString=".rar") returned 4 [0111.462] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0111.462] lstrlenW (lpString=".bz2") returned 4 [0111.462] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0111.462] lstrlenW (lpString=".7z") returned 3 [0111.462] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0111.462] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73 [0111.462] lstrlenW (lpString=".dbf") returned 4 [0111.462] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0111.462] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73 [0111.462] lstrlenW (lpString=".1cd") returned 4 [0111.462] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0111.462] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73 [0111.463] lstrlenW (lpString=".jpg") returned 4 [0111.463] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0111.463] lstrcmpiW (lpString1=".exe", lpString2=".waifu") returned -1 [0111.463] lstrlenW (lpString="dwtrig20.exe") returned 12 [0111.463] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwtrig20.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0111.463] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x292f944 | out: lpFileSize=0x292f944*=519584) returned 1 [0111.463] CloseHandle (hObject=0x1e4) returned 1 [0111.463] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwtrig20.exe")) returned 0x2020 [0111.463] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwtrig20.exe.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0111.463] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwtrig20.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0111.463] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x292f8f0 | out: lpNewFilePointer=0x0) returned 1 [0111.463] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x292f8f0 | out: lpNewFilePointer=0x0) returned 1 [0111.463] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwtrig20.exe.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0111.880] GetLastError () returned 0x0 [0111.880] ReadFile (in: hFile=0x1e4, lpBuffer=0x3be0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x292f8fc, lpOverlapped=0x0 | out: lpBuffer=0x3be0020*, lpNumberOfBytesRead=0x292f8fc*=0x7eda0, lpOverlapped=0x0) returned 1 [0111.889] WriteFile (in: hFile=0x1e0, lpBuffer=0x3be0020*, nNumberOfBytesToWrite=0x7edb0, lpNumberOfBytesWritten=0x292f6c4, lpOverlapped=0x0 | out: lpBuffer=0x3be0020*, lpNumberOfBytesWritten=0x292f6c4*=0x7edb0, lpOverlapped=0x0) returned 1 [0112.139] ReadFile (in: hFile=0x1e4, lpBuffer=0x3be0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x292f8fc, lpOverlapped=0x0 | out: lpBuffer=0x3be0020*, lpNumberOfBytesRead=0x292f8fc*=0x0, lpOverlapped=0x0) returned 1 [0112.139] WriteFile (in: hFile=0x1e0, lpBuffer=0x3be0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x292f6c4, lpOverlapped=0x0 | out: lpBuffer=0x3be0020*, lpNumberOfBytesWritten=0x292f6c4*=0xec, lpOverlapped=0x0) returned 1 [0112.139] SetEndOfFile (hFile=0x1e0) returned 1 [0112.140] CloseHandle (hObject=0x1e0) returned 1 [0112.140] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x292f8f0 | out: lpNewFilePointer=0x0) returned 1 [0112.140] SetEndOfFile (hFile=0x1e4) returned 1 [0112.152] CloseHandle (hObject=0x1e4) returned 1 [0112.153] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x2020) returned 1 [0112.153] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwtrig20.exe")) returned 1 [0112.153] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75 [0112.153] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75 [0112.153] lstrlenW (lpString=".doc") returned 4 [0112.153] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0112.153] lstrlenW (lpString=".docx") returned 5 [0112.153] lstrcmpiW (lpString1=".docx", lpString2="0.exe") returned -1 [0112.153] lstrlenW (lpString=".pdf") returned 4 [0112.153] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0112.153] lstrlenW (lpString=".xls") returned 4 [0112.153] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0112.153] lstrlenW (lpString=".xlsx") returned 5 [0112.153] lstrcmpiW (lpString1=".xlsx", lpString2="0.exe") returned -1 [0112.153] lstrlenW (lpString=".ppt") returned 4 [0112.153] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0112.153] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75 [0112.153] lstrlenW (lpString=".zip") returned 4 [0112.153] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0112.153] lstrlenW (lpString=".rar") returned 4 [0112.153] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0112.153] lstrlenW (lpString=".bz2") returned 4 [0112.153] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0112.153] lstrlenW (lpString=".7z") returned 3 [0112.153] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0112.154] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75 [0112.154] lstrlenW (lpString=".dbf") returned 4 [0112.154] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0112.154] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75 [0112.154] lstrlenW (lpString=".1cd") returned 4 [0112.154] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0112.154] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75 [0112.154] lstrlenW (lpString=".jpg") returned 4 [0112.154] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0112.154] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75 [0112.154] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75 [0112.154] lstrlenW (lpString=".doc") returned 4 [0112.154] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0112.154] lstrlenW (lpString=".docx") returned 5 [0112.154] lstrcmpiW (lpString1=".docx", lpString2="0.exe") returned -1 [0112.154] lstrlenW (lpString=".pdf") returned 4 [0112.154] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0112.154] lstrlenW (lpString=".xls") returned 4 [0112.154] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0112.154] lstrlenW (lpString=".xlsx") returned 5 [0112.154] lstrcmpiW (lpString1=".xlsx", lpString2="0.exe") returned -1 [0112.154] lstrlenW (lpString=".ppt") returned 4 [0112.154] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0112.154] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75 [0112.154] lstrlenW (lpString=".zip") returned 4 [0112.154] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0112.154] lstrlenW (lpString=".rar") returned 4 [0112.154] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0112.154] lstrlenW (lpString=".bz2") returned 4 [0112.154] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0112.154] lstrlenW (lpString=".7z") returned 3 [0112.154] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0112.154] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75 [0112.154] lstrlenW (lpString=".dbf") returned 4 [0112.154] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0112.154] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75 [0112.154] lstrlenW (lpString=".1cd") returned 4 [0112.154] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0112.154] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75 [0112.154] lstrlenW (lpString=".jpg") returned 4 [0112.154] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0112.154] lstrcmpiW (lpString1=".cab", lpString2=".waifu") returned -1 [0112.154] lstrlenW (lpString="AccLR.cab") returned 9 [0112.155] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\acclr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0112.155] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x292f944 | out: lpFileSize=0x292f944*=28016276) returned 1 [0112.155] CloseHandle (hObject=0x1e4) returned 1 [0112.155] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\acclr.cab")) returned 0x2020 [0112.155] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\acclr.cab.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0112.155] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\acclr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\acclr.cab.id-9c354b42.[darknes@420blaze.it].waifu")) returned 1 [0112.156] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\acclr.cab.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0112.156] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x292f694 | out: lpNewFilePointer=0x0) returned 1 [0112.156] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x292f654 | out: lpNewFilePointer=0x0) returned 1 [0112.156] ReadFile (in: hFile=0x1e4, lpBuffer=0x3be0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x292f660, lpOverlapped=0x0 | out: lpBuffer=0x3be0058*, lpNumberOfBytesRead=0x292f660*=0x40000, lpOverlapped=0x0) returned 1 [0112.160] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x8e7f86, lpNewFilePointer=0x0, dwMoveMethod=0x292f654 | out: lpNewFilePointer=0x0) returned 1 [0112.160] ReadFile (in: hFile=0x1e4, lpBuffer=0x3c20058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x292f660, lpOverlapped=0x0 | out: lpBuffer=0x3c20058*, lpNumberOfBytesRead=0x292f660*=0x40000, lpOverlapped=0x0) returned 1 [0112.163] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x292f694 | out: lpNewFilePointer=0xffffffff) returned 1 [0112.163] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x1a77e94, lpNewFilePointer=0x0, dwMoveMethod=0x292f654 | out: lpNewFilePointer=0x0) returned 1 [0112.163] ReadFile (in: hFile=0x1e4, lpBuffer=0x3c60058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x292f660, lpOverlapped=0x0 | out: lpBuffer=0x3c60058*, lpNumberOfBytesRead=0x292f660*=0x40000, lpOverlapped=0x0) returned 1 [0112.175] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x292f8f0 | out: lpNewFilePointer=0x0) returned 1 [0112.175] WriteFile (in: hFile=0x1e4, lpBuffer=0x3be0020*, nNumberOfBytesToWrite=0xc00fe, lpNumberOfBytesWritten=0x292f6d8, lpOverlapped=0x0 | out: lpBuffer=0x3be0020*, lpNumberOfBytesWritten=0x292f6d8*=0xc00fe, lpOverlapped=0x0) returned 1 [0112.311] SetEndOfFile (hFile=0x1e4) returned 1 [0112.314] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x292f6a4 | out: lpNewFilePointer=0x0) returned 1 [0112.314] WriteFile (in: hFile=0x1e4, lpBuffer=0x44b2070*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x292f6b0, lpOverlapped=0x0 | out: lpBuffer=0x44b2070*, lpNumberOfBytesWritten=0x292f6b0*=0x40000, lpOverlapped=0x0) returned 1 [0112.384] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x8e7f86, lpNewFilePointer=0x0, dwMoveMethod=0x292f6a4 | out: lpNewFilePointer=0x0) returned 1 [0112.384] WriteFile (in: hFile=0x1e4, lpBuffer=0x44b2070*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x292f6b0, lpOverlapped=0x0 | out: lpBuffer=0x44b2070*, lpNumberOfBytesWritten=0x292f6b0*=0x40000, lpOverlapped=0x0) returned 1 [0112.385] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x1a77e94, lpNewFilePointer=0x0, dwMoveMethod=0x292f6a4 | out: lpNewFilePointer=0x0) returned 1 [0112.385] WriteFile (in: hFile=0x1e4, lpBuffer=0x44b2070*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x292f6b0, lpOverlapped=0x0 | out: lpBuffer=0x44b2070*, lpNumberOfBytesWritten=0x292f6b0*=0x40000, lpOverlapped=0x0) returned 1 [0112.389] CloseHandle (hObject=0x1e4) returned 1 [0112.389] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x2020) returned 1 [0112.389] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85 [0112.389] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85 [0112.389] lstrlenW (lpString=".doc") returned 4 [0112.389] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0112.389] lstrlenW (lpString=".docx") returned 5 [0112.389] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0112.389] lstrlenW (lpString=".pdf") returned 4 [0112.390] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0112.390] lstrlenW (lpString=".xls") returned 4 [0112.390] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0112.390] lstrlenW (lpString=".xlsx") returned 5 [0112.390] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0112.390] lstrlenW (lpString=".ppt") returned 4 [0112.390] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0112.390] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85 [0112.390] lstrlenW (lpString=".zip") returned 4 [0112.390] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0112.390] lstrlenW (lpString=".rar") returned 4 [0112.390] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0112.390] lstrlenW (lpString=".bz2") returned 4 [0112.390] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0112.390] lstrlenW (lpString=".7z") returned 3 [0112.390] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0112.390] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85 [0112.390] lstrlenW (lpString=".dbf") returned 4 [0112.390] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0112.390] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85 [0112.390] lstrlenW (lpString=".1cd") returned 4 [0112.390] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0112.390] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85 [0112.390] lstrlenW (lpString=".jpg") returned 4 [0112.390] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0112.390] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85 [0112.390] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85 [0112.390] lstrlenW (lpString=".doc") returned 4 [0112.390] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0112.390] lstrlenW (lpString=".docx") returned 5 [0112.390] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0112.390] lstrlenW (lpString=".pdf") returned 4 [0112.390] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0112.390] lstrlenW (lpString=".xls") returned 4 [0112.390] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0112.390] lstrlenW (lpString=".xlsx") returned 5 [0112.390] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0112.390] lstrlenW (lpString=".ppt") returned 4 [0112.390] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0112.390] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85 [0112.390] lstrlenW (lpString=".zip") returned 4 [0112.390] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0112.390] lstrlenW (lpString=".rar") returned 4 [0112.390] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0112.390] lstrlenW (lpString=".bz2") returned 4 [0112.390] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0112.390] lstrlenW (lpString=".7z") returned 3 [0112.390] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0112.390] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85 [0112.390] lstrlenW (lpString=".dbf") returned 4 [0112.390] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0112.391] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85 [0112.391] lstrlenW (lpString=".1cd") returned 4 [0112.391] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0112.391] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85 [0112.391] lstrlenW (lpString=".jpg") returned 4 [0112.391] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0112.391] lstrcmpiW (lpString1=".dll", lpString2=".waifu") returned -1 [0112.391] lstrlenW (lpString="osetup.dll") returned 10 [0112.391] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\osetup.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0112.391] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x292f944 | out: lpFileSize=0x292f944*=7378792) returned 1 [0112.391] CloseHandle (hObject=0x1e4) returned 1 [0112.391] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\osetup.dll")) returned 0x2020 [0112.391] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\osetup.dll.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0112.391] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\osetup.dll"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\osetup.dll.id-9c354b42.[darknes@420blaze.it].waifu")) returned 1 [0112.392] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\osetup.dll.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0112.392] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x292f694 | out: lpNewFilePointer=0x0) returned 1 [0112.392] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x292f654 | out: lpNewFilePointer=0x0) returned 1 [0112.392] ReadFile (in: hFile=0x1e4, lpBuffer=0x3be0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x292f660, lpOverlapped=0x0 | out: lpBuffer=0x3be0058*, lpNumberOfBytesRead=0x292f660*=0x40000, lpOverlapped=0x0) returned 1 [0112.395] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x2587cd, lpNewFilePointer=0x0, dwMoveMethod=0x292f654 | out: lpNewFilePointer=0x0) returned 1 [0112.395] ReadFile (in: hFile=0x1e4, lpBuffer=0x3c20058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x292f660, lpOverlapped=0x0 | out: lpBuffer=0x3c20058*, lpNumberOfBytesRead=0x292f660*=0x40000, lpOverlapped=0x0) returned 1 [0112.440] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x292f694 | out: lpNewFilePointer=0xffffffff) returned 1 [0112.440] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x6c9768, lpNewFilePointer=0x0, dwMoveMethod=0x292f654 | out: lpNewFilePointer=0x0) returned 1 [0112.440] ReadFile (in: hFile=0x1e4, lpBuffer=0x3c60058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x292f660, lpOverlapped=0x0 | out: lpBuffer=0x3c60058*, lpNumberOfBytesRead=0x292f660*=0x40000, lpOverlapped=0x0) returned 1 [0112.539] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x292f8f0 | out: lpNewFilePointer=0x0) returned 1 [0112.540] WriteFile (in: hFile=0x1e4, lpBuffer=0x3be0020*, nNumberOfBytesToWrite=0xc0100, lpNumberOfBytesWritten=0x292f6d8, lpOverlapped=0x0 | out: lpBuffer=0x3be0020*, lpNumberOfBytesWritten=0x292f6d8*=0xc0100, lpOverlapped=0x0) returned 1 [0112.546] SetEndOfFile (hFile=0x1e4) returned 1 [0112.548] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x292f6a4 | out: lpNewFilePointer=0x0) returned 1 [0112.548] WriteFile (in: hFile=0x1e4, lpBuffer=0x45840d0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x292f6b0, lpOverlapped=0x0 | out: lpBuffer=0x45840d0*, lpNumberOfBytesWritten=0x292f6b0*=0x40000, lpOverlapped=0x0) returned 1 [0112.549] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x2587cd, lpNewFilePointer=0x0, dwMoveMethod=0x292f6a4 | out: lpNewFilePointer=0x0) returned 1 [0112.549] WriteFile (in: hFile=0x1e4, lpBuffer=0x45840d0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x292f6b0, lpOverlapped=0x0 | out: lpBuffer=0x45840d0*, lpNumberOfBytesWritten=0x292f6b0*=0x40000, lpOverlapped=0x0) returned 1 [0112.550] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x6c9768, lpNewFilePointer=0x0, dwMoveMethod=0x292f6a4 | out: lpNewFilePointer=0x0) returned 1 [0112.550] WriteFile (in: hFile=0x1e4, lpBuffer=0x45840d0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x292f6b0, lpOverlapped=0x0 | out: lpBuffer=0x45840d0*, lpNumberOfBytesWritten=0x292f6b0*=0x40000, lpOverlapped=0x0) returned 1 [0112.551] CloseHandle (hObject=0x1e4) returned 1 [0112.552] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x2020) returned 1 [0112.552] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0112.552] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0112.552] lstrlenW (lpString=".doc") returned 4 [0112.552] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0112.552] lstrlenW (lpString=".docx") returned 5 [0112.552] lstrcmpiW (lpString1=".docx", lpString2="p.dll") returned -1 [0112.552] lstrlenW (lpString=".pdf") returned 4 [0112.552] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0112.552] lstrlenW (lpString=".xls") returned 4 [0112.552] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0112.552] lstrlenW (lpString=".xlsx") returned 5 [0112.552] lstrcmpiW (lpString1=".xlsx", lpString2="p.dll") returned -1 [0112.552] lstrlenW (lpString=".ppt") returned 4 [0112.552] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0112.552] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0112.552] lstrlenW (lpString=".zip") returned 4 [0112.552] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0112.552] lstrlenW (lpString=".rar") returned 4 [0112.552] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0112.552] lstrlenW (lpString=".bz2") returned 4 [0112.552] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0112.552] lstrlenW (lpString=".7z") returned 3 [0112.552] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0112.552] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0112.552] lstrlenW (lpString=".dbf") returned 4 [0112.552] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0112.552] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0112.552] lstrlenW (lpString=".1cd") returned 4 [0112.552] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0112.552] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0112.552] lstrlenW (lpString=".jpg") returned 4 [0112.552] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0112.552] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0112.553] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0112.553] lstrlenW (lpString=".doc") returned 4 [0112.553] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0112.553] lstrlenW (lpString=".docx") returned 5 [0112.553] lstrcmpiW (lpString1=".docx", lpString2="p.dll") returned -1 [0112.553] lstrlenW (lpString=".pdf") returned 4 [0112.553] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0112.553] lstrlenW (lpString=".xls") returned 4 [0112.553] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0112.553] lstrlenW (lpString=".xlsx") returned 5 [0112.553] lstrcmpiW (lpString1=".xlsx", lpString2="p.dll") returned -1 [0112.553] lstrlenW (lpString=".ppt") returned 4 [0112.553] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0112.553] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0112.553] lstrlenW (lpString=".zip") returned 4 [0112.553] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0112.553] lstrlenW (lpString=".rar") returned 4 [0112.553] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0112.553] lstrlenW (lpString=".bz2") returned 4 [0112.553] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0112.553] lstrlenW (lpString=".7z") returned 3 [0112.553] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0112.553] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0112.553] lstrlenW (lpString=".dbf") returned 4 [0112.553] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0112.553] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0112.553] lstrlenW (lpString=".1cd") returned 4 [0112.553] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0112.553] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0112.553] lstrlenW (lpString=".jpg") returned 4 [0112.553] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0112.553] lstrcmpiW (lpString1=".msi", lpString2=".waifu") returned -1 [0112.553] lstrlenW (lpString="ProPlusrWW.msi") returned 14 [0112.553] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0112.553] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x292f944 | out: lpFileSize=0x292f944*=27532288) returned 1 [0112.554] CloseHandle (hObject=0x1e4) returned 1 [0112.554] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.msi")) returned 0x2020 [0112.554] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.msi.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0112.554] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.msi.id-9c354b42.[darknes@420blaze.it].waifu")) returned 1 [0112.554] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.msi.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0112.554] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x292f694 | out: lpNewFilePointer=0x0) returned 1 [0112.554] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x292f654 | out: lpNewFilePointer=0x0) returned 1 [0112.554] ReadFile (in: hFile=0x1e4, lpBuffer=0x3be0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x292f660, lpOverlapped=0x0 | out: lpBuffer=0x3be0058*, lpNumberOfBytesRead=0x292f660*=0x40000, lpOverlapped=0x0) returned 1 [0112.858] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x8c0955, lpNewFilePointer=0x0, dwMoveMethod=0x292f654 | out: lpNewFilePointer=0x0) returned 1 [0112.858] ReadFile (in: hFile=0x1e4, lpBuffer=0x3c20058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x292f660, lpOverlapped=0x0 | out: lpBuffer=0x3c20058*, lpNumberOfBytesRead=0x292f660*=0x40000, lpOverlapped=0x0) returned 1 [0112.908] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x292f694 | out: lpNewFilePointer=0xffffffff) returned 1 [0112.908] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x1a01c00, lpNewFilePointer=0x0, dwMoveMethod=0x292f654 | out: lpNewFilePointer=0x0) returned 1 [0112.908] ReadFile (in: hFile=0x1e4, lpBuffer=0x3c60058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x292f660, lpOverlapped=0x0 | out: lpBuffer=0x3c60058*, lpNumberOfBytesRead=0x292f660*=0x40000, lpOverlapped=0x0) returned 1 [0112.979] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x292f8f0 | out: lpNewFilePointer=0x0) returned 1 [0112.980] WriteFile (in: hFile=0x1e4, lpBuffer=0x3be0020*, nNumberOfBytesToWrite=0xc0108, lpNumberOfBytesWritten=0x292f6d8, lpOverlapped=0x0 | out: lpBuffer=0x3be0020*, lpNumberOfBytesWritten=0x292f6d8*=0xc0108, lpOverlapped=0x0) returned 1 [0112.987] SetEndOfFile (hFile=0x1e4) returned 1 [0112.989] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x292f6a4 | out: lpNewFilePointer=0x0) returned 1 [0112.989] WriteFile (in: hFile=0x1e4, lpBuffer=0x45840d0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x292f6b0, lpOverlapped=0x0 | out: lpBuffer=0x45840d0*, lpNumberOfBytesWritten=0x292f6b0*=0x40000, lpOverlapped=0x0) returned 1 [0112.990] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x8c0955, lpNewFilePointer=0x0, dwMoveMethod=0x292f6a4 | out: lpNewFilePointer=0x0) returned 1 [0112.990] WriteFile (in: hFile=0x1e4, lpBuffer=0x45840d0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x292f6b0, lpOverlapped=0x0 | out: lpBuffer=0x45840d0*, lpNumberOfBytesWritten=0x292f6b0*=0x40000, lpOverlapped=0x0) returned 1 [0112.991] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x1a01c00, lpNewFilePointer=0x0, dwMoveMethod=0x292f6a4 | out: lpNewFilePointer=0x0) returned 1 [0112.991] WriteFile (in: hFile=0x1e4, lpBuffer=0x45840d0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x292f6b0, lpOverlapped=0x0 | out: lpBuffer=0x45840d0*, lpNumberOfBytesWritten=0x292f6b0*=0x40000, lpOverlapped=0x0) returned 1 [0112.992] CloseHandle (hObject=0x1e4) returned 1 [0112.993] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x2020) returned 1 [0112.993] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77 [0112.993] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77 [0112.993] lstrlenW (lpString=".doc") returned 4 [0112.993] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0112.993] lstrlenW (lpString=".docx") returned 5 [0112.993] lstrcmpiW (lpString1=".docx", lpString2="W.msi") returned -1 [0112.993] lstrlenW (lpString=".pdf") returned 4 [0112.993] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0112.993] lstrlenW (lpString=".xls") returned 4 [0112.993] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0112.993] lstrlenW (lpString=".xlsx") returned 5 [0112.993] lstrcmpiW (lpString1=".xlsx", lpString2="W.msi") returned -1 [0112.993] lstrlenW (lpString=".ppt") returned 4 [0112.993] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0112.993] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77 [0112.993] lstrlenW (lpString=".zip") returned 4 [0112.993] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0112.993] lstrlenW (lpString=".rar") returned 4 [0112.993] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0112.993] lstrlenW (lpString=".bz2") returned 4 [0112.993] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0112.993] lstrlenW (lpString=".7z") returned 3 [0112.993] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0112.993] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77 [0112.993] lstrlenW (lpString=".dbf") returned 4 [0112.993] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0112.993] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77 [0112.993] lstrlenW (lpString=".1cd") returned 4 [0112.993] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0112.993] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77 [0112.993] lstrlenW (lpString=".jpg") returned 4 [0112.993] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0113.115] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77 [0113.115] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77 [0113.115] lstrlenW (lpString=".doc") returned 4 [0113.115] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0113.115] lstrlenW (lpString=".docx") returned 5 [0113.115] lstrcmpiW (lpString1=".docx", lpString2="W.msi") returned -1 [0113.115] lstrlenW (lpString=".pdf") returned 4 [0113.115] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0113.115] lstrlenW (lpString=".xls") returned 4 [0113.115] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0113.115] lstrlenW (lpString=".xlsx") returned 5 [0113.115] lstrcmpiW (lpString1=".xlsx", lpString2="W.msi") returned -1 [0113.115] lstrlenW (lpString=".ppt") returned 4 [0113.115] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0113.115] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77 [0113.115] lstrlenW (lpString=".zip") returned 4 [0113.115] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0113.115] lstrlenW (lpString=".rar") returned 4 [0113.115] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0113.115] lstrlenW (lpString=".bz2") returned 4 [0113.115] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0113.115] lstrlenW (lpString=".7z") returned 3 [0113.115] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0113.115] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77 [0113.115] lstrlenW (lpString=".dbf") returned 4 [0113.115] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0113.115] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77 [0113.115] lstrlenW (lpString=".1cd") returned 4 [0113.115] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0113.115] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77 [0113.115] lstrlenW (lpString=".jpg") returned 4 [0113.115] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0113.116] lstrcmpiW (lpString1=".exe", lpString2=".waifu") returned -1 [0113.116] lstrlenW (lpString="setup.exe") returned 9 [0113.116] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0113.174] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x292f944 | out: lpFileSize=0x292f944*=1377656) returned 1 [0113.174] CloseHandle (hObject=0x1e8) returned 1 [0113.174] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.exe")) returned 0x2020 [0113.174] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.exe.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0113.174] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0113.174] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x292f8f0 | out: lpNewFilePointer=0x0) returned 1 [0113.174] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x292f8f0 | out: lpNewFilePointer=0x0) returned 1 [0113.174] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.exe.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0113.190] GetLastError () returned 0x0 [0113.190] ReadFile (in: hFile=0x1e8, lpBuffer=0x3be0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x292f8fc, lpOverlapped=0x0 | out: lpBuffer=0x3be0020*, lpNumberOfBytesRead=0x292f8fc*=0xffff0, lpOverlapped=0x0) returned 1 [0113.205] WriteFile (in: hFile=0x1fc, lpBuffer=0x3be0020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x292f6c4, lpOverlapped=0x0 | out: lpBuffer=0x3be0020*, lpNumberOfBytesWritten=0x292f6c4*=0xffff0, lpOverlapped=0x0) returned 1 [0113.213] ReadFile (in: hFile=0x1e8, lpBuffer=0x3be0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x292f8fc, lpOverlapped=0x0 | out: lpBuffer=0x3be0020*, lpNumberOfBytesRead=0x292f8fc*=0x50588, lpOverlapped=0x0) returned 1 [0113.223] WriteFile (in: hFile=0x1fc, lpBuffer=0x3be0020*, nNumberOfBytesToWrite=0x50590, lpNumberOfBytesWritten=0x292f6c4, lpOverlapped=0x0 | out: lpBuffer=0x3be0020*, lpNumberOfBytesWritten=0x292f6c4*=0x50590, lpOverlapped=0x0) returned 1 [0113.926] ReadFile (in: hFile=0x1e8, lpBuffer=0x3be0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x292f8fc, lpOverlapped=0x0 | out: lpBuffer=0x3be0020*, lpNumberOfBytesRead=0x292f8fc*=0x0, lpOverlapped=0x0) returned 1 [0113.926] WriteFile (in: hFile=0x1fc, lpBuffer=0x3be0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x292f6c4, lpOverlapped=0x0 | out: lpBuffer=0x3be0020*, lpNumberOfBytesWritten=0x292f6c4*=0xe6, lpOverlapped=0x0) returned 1 [0113.926] SetEndOfFile (hFile=0x1fc) returned 1 [0113.926] CloseHandle (hObject=0x1fc) returned 1 [0113.926] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x292f8f0 | out: lpNewFilePointer=0x0) returned 1 [0113.926] SetEndOfFile (hFile=0x1e8) returned 1 [0113.928] CloseHandle (hObject=0x1e8) returned 1 [0113.928] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x2020) returned 1 [0113.928] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.exe")) returned 1 [0113.928] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0113.928] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0113.928] lstrlenW (lpString=".doc") returned 4 [0113.928] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0113.928] lstrlenW (lpString=".docx") returned 5 [0113.928] lstrcmpiW (lpString1=".docx", lpString2="p.exe") returned -1 [0113.928] lstrlenW (lpString=".pdf") returned 4 [0113.928] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0113.928] lstrlenW (lpString=".xls") returned 4 [0113.928] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0113.928] lstrlenW (lpString=".xlsx") returned 5 [0113.928] lstrcmpiW (lpString1=".xlsx", lpString2="p.exe") returned -1 [0113.928] lstrlenW (lpString=".ppt") returned 4 [0113.928] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0113.928] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0113.928] lstrlenW (lpString=".zip") returned 4 [0113.928] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0113.928] lstrlenW (lpString=".rar") returned 4 [0113.928] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0113.928] lstrlenW (lpString=".bz2") returned 4 [0113.928] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0113.928] lstrlenW (lpString=".7z") returned 3 [0113.928] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0113.928] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0113.928] lstrlenW (lpString=".dbf") returned 4 [0113.928] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0113.928] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0113.929] lstrlenW (lpString=".1cd") returned 4 [0113.929] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0113.929] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0113.929] lstrlenW (lpString=".jpg") returned 4 [0113.929] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0113.929] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0113.929] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0113.929] lstrlenW (lpString=".doc") returned 4 [0113.929] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0113.929] lstrlenW (lpString=".docx") returned 5 [0113.929] lstrcmpiW (lpString1=".docx", lpString2="p.exe") returned -1 [0113.929] lstrlenW (lpString=".pdf") returned 4 [0113.929] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0113.929] lstrlenW (lpString=".xls") returned 4 [0113.929] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0113.929] lstrlenW (lpString=".xlsx") returned 5 [0113.929] lstrcmpiW (lpString1=".xlsx", lpString2="p.exe") returned -1 [0113.929] lstrlenW (lpString=".ppt") returned 4 [0113.929] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0113.929] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0113.929] lstrlenW (lpString=".zip") returned 4 [0113.929] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0113.929] lstrlenW (lpString=".rar") returned 4 [0113.929] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0113.929] lstrlenW (lpString=".bz2") returned 4 [0113.929] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0113.929] lstrlenW (lpString=".7z") returned 3 [0113.929] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0113.929] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0113.929] lstrlenW (lpString=".dbf") returned 4 [0113.929] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0113.929] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0113.929] lstrlenW (lpString=".1cd") returned 4 [0113.929] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0113.929] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0113.929] lstrlenW (lpString=".jpg") returned 4 [0113.929] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0113.929] lstrcmpiW (lpString1=".cab", lpString2=".waifu") returned -1 [0113.929] lstrlenW (lpString="OWOW32WW.cab") returned 12 [0113.929] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\owow32ww.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0113.975] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x292f944 | out: lpFileSize=0x292f944*=36233052) returned 1 [0113.975] CloseHandle (hObject=0x194) returned 1 [0113.975] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\owow32ww.cab")) returned 0x2020 [0113.975] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\owow32ww.cab.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0113.975] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\owow32ww.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\owow32ww.cab.id-9c354b42.[darknes@420blaze.it].waifu")) returned 1 [0113.976] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\owow32ww.cab.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0113.976] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x292f694 | out: lpNewFilePointer=0x0) returned 1 [0113.976] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x292f654 | out: lpNewFilePointer=0x0) returned 1 [0113.976] ReadFile (in: hFile=0x194, lpBuffer=0x3be0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x292f660, lpOverlapped=0x0 | out: lpBuffer=0x3be0058*, lpNumberOfBytesRead=0x292f660*=0x40000, lpOverlapped=0x0) returned 1 [0113.979] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0xb84a74, lpNewFilePointer=0x0, dwMoveMethod=0x292f654 | out: lpNewFilePointer=0x0) returned 1 [0113.979] ReadFile (in: hFile=0x194, lpBuffer=0x3c20058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x292f660, lpOverlapped=0x0 | out: lpBuffer=0x3c20058*, lpNumberOfBytesRead=0x292f660*=0x40000, lpOverlapped=0x0) returned 1 [0113.981] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x292f694 | out: lpNewFilePointer=0xffffffff) returned 1 [0113.981] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x224df5c, lpNewFilePointer=0x0, dwMoveMethod=0x292f654 | out: lpNewFilePointer=0x0) returned 1 [0113.981] ReadFile (in: hFile=0x194, lpBuffer=0x3c60058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x292f660, lpOverlapped=0x0 | out: lpBuffer=0x3c60058*, lpNumberOfBytesRead=0x292f660*=0x40000, lpOverlapped=0x0) returned 1 [0113.995] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x292f8f0 | out: lpNewFilePointer=0x0) returned 1 [0113.995] WriteFile (in: hFile=0x194, lpBuffer=0x3be0020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x292f6d8, lpOverlapped=0x0 | out: lpBuffer=0x3be0020*, lpNumberOfBytesWritten=0x292f6d8*=0xc0104, lpOverlapped=0x0) returned 1 [0114.002] SetEndOfFile (hFile=0x194) returned 1 [0114.005] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x292f6a4 | out: lpNewFilePointer=0x0) returned 1 [0114.005] WriteFile (in: hFile=0x194, lpBuffer=0x44c2078*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x292f6b0, lpOverlapped=0x0 | out: lpBuffer=0x44c2078*, lpNumberOfBytesWritten=0x292f6b0*=0x40000, lpOverlapped=0x0) returned 1 [0114.005] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0xb84a74, lpNewFilePointer=0x0, dwMoveMethod=0x292f6a4 | out: lpNewFilePointer=0x0) returned 1 [0114.005] WriteFile (in: hFile=0x194, lpBuffer=0x44c2078*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x292f6b0, lpOverlapped=0x0 | out: lpBuffer=0x44c2078*, lpNumberOfBytesWritten=0x292f6b0*=0x40000, lpOverlapped=0x0) returned 1 [0114.006] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x224df5c, lpNewFilePointer=0x0, dwMoveMethod=0x292f6a4 | out: lpNewFilePointer=0x0) returned 1 [0114.006] WriteFile (in: hFile=0x194, lpBuffer=0x44c2078*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x292f6b0, lpOverlapped=0x0 | out: lpBuffer=0x44c2078*, lpNumberOfBytesWritten=0x292f6b0*=0x40000, lpOverlapped=0x0) returned 1 [0114.099] CloseHandle (hObject=0x194) returned 1 [0114.100] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x2020) returned 1 [0114.100] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0114.100] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0114.100] lstrlenW (lpString=".doc") returned 4 [0114.100] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0114.100] lstrlenW (lpString=".docx") returned 5 [0114.100] lstrcmpiW (lpString1=".docx", lpString2="W.cab") returned -1 [0114.100] lstrlenW (lpString=".pdf") returned 4 [0114.100] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0114.100] lstrlenW (lpString=".xls") returned 4 [0114.100] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0114.100] lstrlenW (lpString=".xlsx") returned 5 [0114.100] lstrcmpiW (lpString1=".xlsx", lpString2="W.cab") returned -1 [0114.100] lstrlenW (lpString=".ppt") returned 4 [0114.100] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0114.100] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0114.100] lstrlenW (lpString=".zip") returned 4 [0114.100] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0114.100] lstrlenW (lpString=".rar") returned 4 [0114.100] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0114.100] lstrlenW (lpString=".bz2") returned 4 [0114.100] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0114.100] lstrlenW (lpString=".7z") returned 3 [0114.100] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0114.100] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0114.100] lstrlenW (lpString=".dbf") returned 4 [0114.100] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0114.100] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0114.100] lstrlenW (lpString=".1cd") returned 4 [0114.100] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0114.100] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0114.100] lstrlenW (lpString=".jpg") returned 4 [0114.101] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0114.101] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0114.101] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0114.101] lstrlenW (lpString=".doc") returned 4 [0114.101] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0114.101] lstrlenW (lpString=".docx") returned 5 [0114.101] lstrcmpiW (lpString1=".docx", lpString2="W.cab") returned -1 [0114.101] lstrlenW (lpString=".pdf") returned 4 [0114.101] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0114.101] lstrlenW (lpString=".xls") returned 4 [0114.101] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0114.101] lstrlenW (lpString=".xlsx") returned 5 [0114.101] lstrcmpiW (lpString1=".xlsx", lpString2="W.cab") returned -1 [0114.101] lstrlenW (lpString=".ppt") returned 4 [0114.101] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0114.101] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0114.101] lstrlenW (lpString=".zip") returned 4 [0114.101] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0114.101] lstrlenW (lpString=".rar") returned 4 [0114.101] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0114.101] lstrlenW (lpString=".bz2") returned 4 [0114.101] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0114.101] lstrlenW (lpString=".7z") returned 3 [0114.101] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0114.101] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0114.101] lstrlenW (lpString=".dbf") returned 4 [0114.101] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0114.101] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0114.101] lstrlenW (lpString=".1cd") returned 4 [0114.101] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0114.101] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0114.101] lstrlenW (lpString=".jpg") returned 4 [0114.101] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0114.101] lstrcmpiW (lpString1=".msi", lpString2=".waifu") returned -1 [0114.101] lstrlenW (lpString="PrjProrWW.msi") returned 13 [0114.101] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0114.119] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x292f944 | out: lpFileSize=0x292f944*=10798080) returned 1 [0114.119] CloseHandle (hObject=0x1d8) returned 1 [0114.119] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.msi")) returned 0x2020 [0114.119] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.msi.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0114.119] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.msi.id-9c354b42.[darknes@420blaze.it].waifu")) returned 1 [0114.120] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.msi.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0114.120] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x292f694 | out: lpNewFilePointer=0x0) returned 1 [0114.120] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x292f654 | out: lpNewFilePointer=0x0) returned 1 [0114.120] ReadFile (in: hFile=0x1d8, lpBuffer=0x3be0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x292f660, lpOverlapped=0x0 | out: lpBuffer=0x3be0058*, lpNumberOfBytesRead=0x292f660*=0x40000, lpOverlapped=0x0) returned 1 [0114.123] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x36ec00, lpNewFilePointer=0x0, dwMoveMethod=0x292f654 | out: lpNewFilePointer=0x0) returned 1 [0114.123] ReadFile (in: hFile=0x1d8, lpBuffer=0x3c20058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x292f660, lpOverlapped=0x0 | out: lpBuffer=0x3c20058*, lpNumberOfBytesRead=0x292f660*=0x40000, lpOverlapped=0x0) returned 1 [0114.125] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x292f694 | out: lpNewFilePointer=0xffffffff) returned 1 [0114.125] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0xa0c400, lpNewFilePointer=0x0, dwMoveMethod=0x292f654 | out: lpNewFilePointer=0x0) returned 1 [0114.125] ReadFile (in: hFile=0x1d8, lpBuffer=0x3c60058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x292f660, lpOverlapped=0x0 | out: lpBuffer=0x3c60058*, lpNumberOfBytesRead=0x292f660*=0x40000, lpOverlapped=0x0) returned 1 [0114.139] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x292f8f0 | out: lpNewFilePointer=0x0) returned 1 [0114.139] WriteFile (in: hFile=0x1d8, lpBuffer=0x3be0020*, nNumberOfBytesToWrite=0xc0106, lpNumberOfBytesWritten=0x292f6d8, lpOverlapped=0x0 | out: lpBuffer=0x3be0020*, lpNumberOfBytesWritten=0x292f6d8*=0xc0106, lpOverlapped=0x0) returned 1 [0114.147] SetEndOfFile (hFile=0x1d8) returned 1 [0114.149] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x292f6a4 | out: lpNewFilePointer=0x0) returned 1 [0114.149] WriteFile (in: hFile=0x1d8, lpBuffer=0x44c2078*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x292f6b0, lpOverlapped=0x0 | out: lpBuffer=0x44c2078*, lpNumberOfBytesWritten=0x292f6b0*=0x40000, lpOverlapped=0x0) returned 1 [0114.150] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x36ec00, lpNewFilePointer=0x0, dwMoveMethod=0x292f6a4 | out: lpNewFilePointer=0x0) returned 1 [0114.150] WriteFile (in: hFile=0x1d8, lpBuffer=0x44c2078*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x292f6b0, lpOverlapped=0x0 | out: lpBuffer=0x44c2078*, lpNumberOfBytesWritten=0x292f6b0*=0x40000, lpOverlapped=0x0) returned 1 [0114.151] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0xa0c400, lpNewFilePointer=0x0, dwMoveMethod=0x292f6a4 | out: lpNewFilePointer=0x0) returned 1 [0114.151] WriteFile (in: hFile=0x1d8, lpBuffer=0x44c2078*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x292f6b0, lpOverlapped=0x0 | out: lpBuffer=0x44c2078*, lpNumberOfBytesWritten=0x292f6b0*=0x40000, lpOverlapped=0x0) returned 1 [0114.153] CloseHandle (hObject=0x1d8) returned 1 [0114.154] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x2020) returned 1 [0114.154] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi") returned 76 [0114.154] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi") returned 76 [0114.154] lstrlenW (lpString=".doc") returned 4 [0114.154] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0114.154] lstrlenW (lpString=".docx") returned 5 [0114.154] lstrcmpiW (lpString1=".docx", lpString2="W.msi") returned -1 [0114.154] lstrlenW (lpString=".pdf") returned 4 [0114.154] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0114.154] lstrlenW (lpString=".xls") returned 4 [0114.154] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0114.154] lstrlenW (lpString=".xlsx") returned 5 [0114.154] lstrcmpiW (lpString1=".xlsx", lpString2="W.msi") returned -1 [0114.154] lstrlenW (lpString=".ppt") returned 4 [0114.154] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0114.154] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi") returned 76 [0114.154] lstrlenW (lpString=".zip") returned 4 [0114.154] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0114.154] lstrlenW (lpString=".rar") returned 4 [0114.154] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0114.154] lstrlenW (lpString=".bz2") returned 4 [0114.154] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0114.154] lstrlenW (lpString=".7z") returned 3 [0114.154] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0114.154] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi") returned 76 [0114.154] lstrlenW (lpString=".dbf") returned 4 [0114.154] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0114.154] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi") returned 76 [0114.154] lstrlenW (lpString=".1cd") returned 4 [0114.154] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0114.154] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi") returned 76 [0114.154] lstrlenW (lpString=".jpg") returned 4 [0114.154] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0114.154] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi") returned 76 [0114.154] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi") returned 76 [0114.154] lstrlenW (lpString=".doc") returned 4 [0114.154] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0114.154] lstrlenW (lpString=".docx") returned 5 [0114.154] lstrcmpiW (lpString1=".docx", lpString2="W.msi") returned -1 [0114.154] lstrlenW (lpString=".pdf") returned 4 [0114.155] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0114.155] lstrlenW (lpString=".xls") returned 4 [0114.155] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0114.155] lstrlenW (lpString=".xlsx") returned 5 [0114.155] lstrcmpiW (lpString1=".xlsx", lpString2="W.msi") returned -1 [0114.155] lstrlenW (lpString=".ppt") returned 4 [0114.155] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0114.155] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi") returned 76 [0114.155] lstrlenW (lpString=".zip") returned 4 [0114.155] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0114.155] lstrlenW (lpString=".rar") returned 4 [0114.155] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0114.155] lstrlenW (lpString=".bz2") returned 4 [0114.155] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0114.155] lstrlenW (lpString=".7z") returned 3 [0114.155] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0114.155] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi") returned 76 [0114.155] lstrlenW (lpString=".dbf") returned 4 [0114.155] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0114.155] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi") returned 76 [0114.155] lstrlenW (lpString=".1cd") returned 4 [0114.155] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0114.155] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi") returned 76 [0114.155] lstrlenW (lpString=".jpg") returned 4 [0114.155] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0114.155] lstrcmpiW (lpString1=".cab", lpString2=".waifu") returned -1 [0114.155] lstrlenW (lpString="PrjPrrWW.cab") returned 12 [0114.155] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprrww.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0114.155] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x292f944 | out: lpFileSize=0x292f944*=162970271) returned 1 [0114.155] CloseHandle (hObject=0x1d8) returned 1 [0114.155] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprrww.cab")) returned 0x2020 [0114.155] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprrww.cab.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0114.156] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprrww.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprrww.cab.id-9c354b42.[darknes@420blaze.it].waifu")) returned 1 [0114.156] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprrww.cab.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0114.156] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x292f694 | out: lpNewFilePointer=0x0) returned 1 [0114.156] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x292f654 | out: lpNewFilePointer=0x0) returned 1 [0114.156] ReadFile (in: hFile=0x1d8, lpBuffer=0x3be0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x292f660, lpOverlapped=0x0 | out: lpBuffer=0x3be0058*, lpNumberOfBytesRead=0x292f660*=0x40000, lpOverlapped=0x0) returned 1 [0114.164] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x33ce8df, lpNewFilePointer=0x0, dwMoveMethod=0x292f654 | out: lpNewFilePointer=0x0) returned 1 [0114.164] ReadFile (in: hFile=0x1d8, lpBuffer=0x3c20058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x292f660, lpOverlapped=0x0 | out: lpBuffer=0x3c20058*, lpNumberOfBytesRead=0x292f660*=0x40000, lpOverlapped=0x0) returned 1 [0114.167] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x292f694 | out: lpNewFilePointer=0xffffffff) returned 1 [0114.167] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x9b2ba9f, lpNewFilePointer=0x0, dwMoveMethod=0x292f654 | out: lpNewFilePointer=0x0) returned 1 [0114.167] ReadFile (in: hFile=0x1d8, lpBuffer=0x3c60058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x292f660, lpOverlapped=0x0 | out: lpBuffer=0x3c60058*, lpNumberOfBytesRead=0x292f660*=0x40000, lpOverlapped=0x0) returned 1 [0114.181] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x292f8f0 | out: lpNewFilePointer=0x0) returned 1 [0114.181] WriteFile (in: hFile=0x1d8, lpBuffer=0x3be0020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x292f6d8, lpOverlapped=0x0 | out: lpBuffer=0x3be0020*, lpNumberOfBytesWritten=0x292f6d8*=0xc0104, lpOverlapped=0x0) returned 1 [0114.188] SetEndOfFile (hFile=0x1d8) returned 1 [0114.189] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x292f6a4 | out: lpNewFilePointer=0x0) returned 1 [0114.189] WriteFile (in: hFile=0x1d8, lpBuffer=0x44c2078*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x292f6b0, lpOverlapped=0x0 | out: lpBuffer=0x44c2078*, lpNumberOfBytesWritten=0x292f6b0*=0x40000, lpOverlapped=0x0) returned 1 [0114.189] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x33ce8df, lpNewFilePointer=0x0, dwMoveMethod=0x292f6a4 | out: lpNewFilePointer=0x0) returned 1 [0114.189] WriteFile (in: hFile=0x1d8, lpBuffer=0x44c2078*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x292f6b0, lpOverlapped=0x0 | out: lpBuffer=0x44c2078*, lpNumberOfBytesWritten=0x292f6b0*=0x40000, lpOverlapped=0x0) returned 1 [0114.191] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x9b2ba9f, lpNewFilePointer=0x0, dwMoveMethod=0x292f6a4 | out: lpNewFilePointer=0x0) returned 1 [0114.191] WriteFile (in: hFile=0x1d8, lpBuffer=0x44c2078*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x292f6b0, lpOverlapped=0x0 | out: lpBuffer=0x44c2078*, lpNumberOfBytesWritten=0x292f6b0*=0x40000, lpOverlapped=0x0) returned 1 [0114.192] CloseHandle (hObject=0x1d8) returned 1 [0114.192] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x2020) returned 1 [0114.192] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab") returned 75 [0114.192] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab") returned 75 [0114.192] lstrlenW (lpString=".doc") returned 4 [0114.192] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0114.192] lstrlenW (lpString=".docx") returned 5 [0114.192] lstrcmpiW (lpString1=".docx", lpString2="W.cab") returned -1 [0114.192] lstrlenW (lpString=".pdf") returned 4 [0114.193] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0114.193] lstrlenW (lpString=".xls") returned 4 [0114.193] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0114.193] lstrlenW (lpString=".xlsx") returned 5 [0114.193] lstrcmpiW (lpString1=".xlsx", lpString2="W.cab") returned -1 [0114.193] lstrlenW (lpString=".ppt") returned 4 [0114.193] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0114.193] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab") returned 75 [0114.193] lstrlenW (lpString=".zip") returned 4 [0114.193] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0114.193] lstrlenW (lpString=".rar") returned 4 [0114.193] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0114.193] lstrlenW (lpString=".bz2") returned 4 [0114.193] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0114.193] lstrlenW (lpString=".7z") returned 3 [0114.193] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0114.193] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab") returned 75 [0114.193] lstrlenW (lpString=".dbf") returned 4 [0114.193] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0114.193] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab") returned 75 [0114.193] lstrlenW (lpString=".1cd") returned 4 [0114.193] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0114.193] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab") returned 75 [0114.193] lstrlenW (lpString=".jpg") returned 4 [0114.193] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0114.193] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab") returned 75 [0114.193] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab") returned 75 [0114.193] lstrlenW (lpString=".doc") returned 4 [0114.193] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0114.193] lstrlenW (lpString=".docx") returned 5 [0114.193] lstrcmpiW (lpString1=".docx", lpString2="W.cab") returned -1 [0114.193] lstrlenW (lpString=".pdf") returned 4 [0114.193] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0114.193] lstrlenW (lpString=".xls") returned 4 [0114.193] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0114.193] lstrlenW (lpString=".xlsx") returned 5 [0114.193] lstrcmpiW (lpString1=".xlsx", lpString2="W.cab") returned -1 [0114.193] lstrlenW (lpString=".ppt") returned 4 [0114.193] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0114.193] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab") returned 75 [0114.193] lstrlenW (lpString=".zip") returned 4 [0114.193] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0114.193] lstrlenW (lpString=".rar") returned 4 [0114.193] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0114.193] lstrlenW (lpString=".bz2") returned 4 [0114.193] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0114.193] lstrlenW (lpString=".7z") returned 3 [0114.193] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0114.193] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab") returned 75 [0114.193] lstrlenW (lpString=".dbf") returned 4 [0114.193] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0114.193] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab") returned 75 [0114.194] lstrlenW (lpString=".1cd") returned 4 [0114.194] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0114.194] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab") returned 75 [0114.194] lstrlenW (lpString=".jpg") returned 4 [0114.194] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0114.194] lstrcmpiW (lpString1=".exe", lpString2=".waifu") returned -1 [0114.194] lstrlenW (lpString="setup.exe") returned 9 [0114.194] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0114.194] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x292f944 | out: lpFileSize=0x292f944*=1377656) returned 1 [0114.194] CloseHandle (hObject=0x1d8) returned 1 [0114.194] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.exe")) returned 0x2020 [0114.194] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.exe.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0114.194] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0114.194] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x292f8f0 | out: lpNewFilePointer=0x0) returned 1 [0114.194] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x292f8f0 | out: lpNewFilePointer=0x0) returned 1 [0114.194] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.exe.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0114.195] GetLastError () returned 0x0 [0114.195] ReadFile (in: hFile=0x1d8, lpBuffer=0x3be0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x292f8fc, lpOverlapped=0x0 | out: lpBuffer=0x3be0020*, lpNumberOfBytesRead=0x292f8fc*=0xffff0, lpOverlapped=0x0) returned 1 [0114.216] WriteFile (in: hFile=0x194, lpBuffer=0x3be0020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x292f6c4, lpOverlapped=0x0 | out: lpBuffer=0x3be0020*, lpNumberOfBytesWritten=0x292f6c4*=0xffff0, lpOverlapped=0x0) returned 1 [0114.225] ReadFile (in: hFile=0x1d8, lpBuffer=0x3be0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x292f8fc, lpOverlapped=0x0 | out: lpBuffer=0x3be0020*, lpNumberOfBytesRead=0x292f8fc*=0x50588, lpOverlapped=0x0) returned 1 [0114.231] WriteFile (in: hFile=0x194, lpBuffer=0x3be0020*, nNumberOfBytesToWrite=0x50590, lpNumberOfBytesWritten=0x292f6c4, lpOverlapped=0x0 | out: lpBuffer=0x3be0020*, lpNumberOfBytesWritten=0x292f6c4*=0x50590, lpOverlapped=0x0) returned 1 [0114.235] ReadFile (in: hFile=0x1d8, lpBuffer=0x3be0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x292f8fc, lpOverlapped=0x0 | out: lpBuffer=0x3be0020*, lpNumberOfBytesRead=0x292f8fc*=0x0, lpOverlapped=0x0) returned 1 [0114.235] WriteFile (in: hFile=0x194, lpBuffer=0x3be0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x292f6c4, lpOverlapped=0x0 | out: lpBuffer=0x3be0020*, lpNumberOfBytesWritten=0x292f6c4*=0xe6, lpOverlapped=0x0) returned 1 [0114.235] SetEndOfFile (hFile=0x194) returned 1 [0114.236] CloseHandle (hObject=0x194) returned 1 [0114.236] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x292f8f0 | out: lpNewFilePointer=0x0) returned 1 [0114.236] SetEndOfFile (hFile=0x1d8) returned 1 [0114.237] CloseHandle (hObject=0x1d8) returned 1 [0114.237] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x2020) returned 1 [0114.237] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.exe")) returned 1 [0114.237] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0114.237] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0114.237] lstrlenW (lpString=".doc") returned 4 [0114.237] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0114.238] lstrlenW (lpString=".docx") returned 5 [0114.238] lstrcmpiW (lpString1=".docx", lpString2="p.exe") returned -1 [0114.238] lstrlenW (lpString=".pdf") returned 4 [0114.238] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0114.238] lstrlenW (lpString=".xls") returned 4 [0114.238] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0114.238] lstrlenW (lpString=".xlsx") returned 5 [0114.238] lstrcmpiW (lpString1=".xlsx", lpString2="p.exe") returned -1 [0114.238] lstrlenW (lpString=".ppt") returned 4 [0114.238] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0114.238] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0114.238] lstrlenW (lpString=".zip") returned 4 [0114.238] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0114.238] lstrlenW (lpString=".rar") returned 4 [0114.238] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0114.238] lstrlenW (lpString=".bz2") returned 4 [0114.238] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0114.238] lstrlenW (lpString=".7z") returned 3 [0114.238] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0114.238] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0114.238] lstrlenW (lpString=".dbf") returned 4 [0114.238] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0114.238] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0114.238] lstrlenW (lpString=".1cd") returned 4 [0114.238] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0114.238] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0114.238] lstrlenW (lpString=".jpg") returned 4 [0114.238] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0114.238] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0114.238] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0114.238] lstrlenW (lpString=".doc") returned 4 [0114.238] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0114.238] lstrlenW (lpString=".docx") returned 5 [0114.238] lstrcmpiW (lpString1=".docx", lpString2="p.exe") returned -1 [0114.238] lstrlenW (lpString=".pdf") returned 4 [0114.238] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0114.238] lstrlenW (lpString=".xls") returned 4 [0114.238] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0114.238] lstrlenW (lpString=".xlsx") returned 5 [0114.238] lstrcmpiW (lpString1=".xlsx", lpString2="p.exe") returned -1 [0114.238] lstrlenW (lpString=".ppt") returned 4 [0114.238] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0114.238] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0114.238] lstrlenW (lpString=".zip") returned 4 [0114.238] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0114.238] lstrlenW (lpString=".rar") returned 4 [0114.238] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0114.238] lstrlenW (lpString=".bz2") returned 4 [0114.238] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0114.238] lstrlenW (lpString=".7z") returned 3 [0114.238] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0114.238] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0114.239] lstrlenW (lpString=".dbf") returned 4 [0114.239] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0114.239] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0114.239] lstrlenW (lpString=".1cd") returned 4 [0114.239] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0114.239] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0114.239] lstrlenW (lpString=".jpg") returned 4 [0114.239] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0114.239] lstrcmpiW (lpString1=".msi", lpString2=".waifu") returned -1 [0114.239] lstrlenW (lpString="Office32WW.msi") returned 14 [0114.239] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0114.239] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x292f944 | out: lpFileSize=0x292f944*=1992192) returned 1 [0114.239] CloseHandle (hObject=0x1d8) returned 1 [0114.239] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.msi")) returned 0x2020 [0114.239] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.msi.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0114.239] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.msi.id-9c354b42.[darknes@420blaze.it].waifu")) returned 1 [0114.240] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.msi.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0114.240] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x292f694 | out: lpNewFilePointer=0x0) returned 1 [0114.240] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x292f654 | out: lpNewFilePointer=0x0) returned 1 [0114.240] ReadFile (in: hFile=0x1d8, lpBuffer=0x3be0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x292f660, lpOverlapped=0x0 | out: lpBuffer=0x3be0058*, lpNumberOfBytesRead=0x292f660*=0x40000, lpOverlapped=0x0) returned 1 [0114.243] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0xa2200, lpNewFilePointer=0x0, dwMoveMethod=0x292f654 | out: lpNewFilePointer=0x0) returned 1 [0114.243] ReadFile (in: hFile=0x1d8, lpBuffer=0x3c20058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x292f660, lpOverlapped=0x0 | out: lpBuffer=0x3c20058*, lpNumberOfBytesRead=0x292f660*=0x40000, lpOverlapped=0x0) returned 1 [0114.245] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x292f694 | out: lpNewFilePointer=0xffffffff) returned 1 [0114.245] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x1a6600, lpNewFilePointer=0x0, dwMoveMethod=0x292f654 | out: lpNewFilePointer=0x0) returned 1 [0114.245] ReadFile (in: hFile=0x1d8, lpBuffer=0x3c60058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x292f660, lpOverlapped=0x0 | out: lpBuffer=0x3c60058*, lpNumberOfBytesRead=0x292f660*=0x40000, lpOverlapped=0x0) returned 1 [0114.260] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x292f8f0 | out: lpNewFilePointer=0x0) returned 1 [0114.260] WriteFile (in: hFile=0x1d8, lpBuffer=0x3be0020*, nNumberOfBytesToWrite=0xc0108, lpNumberOfBytesWritten=0x292f6d8, lpOverlapped=0x0 | out: lpBuffer=0x3be0020*, lpNumberOfBytesWritten=0x292f6d8*=0xc0108, lpOverlapped=0x0) returned 1 [0114.273] SetEndOfFile (hFile=0x1d8) returned 1 [0114.273] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x292f6a4 | out: lpNewFilePointer=0x0) returned 1 [0114.273] WriteFile (in: hFile=0x1d8, lpBuffer=0x44c2078*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x292f6b0, lpOverlapped=0x0 | out: lpBuffer=0x44c2078*, lpNumberOfBytesWritten=0x292f6b0*=0x40000, lpOverlapped=0x0) returned 1 [0114.274] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0xa2200, lpNewFilePointer=0x0, dwMoveMethod=0x292f6a4 | out: lpNewFilePointer=0x0) returned 1 [0114.274] WriteFile (in: hFile=0x1d8, lpBuffer=0x44c2078*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x292f6b0, lpOverlapped=0x0 | out: lpBuffer=0x44c2078*, lpNumberOfBytesWritten=0x292f6b0*=0x40000, lpOverlapped=0x0) returned 1 [0114.276] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x1a6600, lpNewFilePointer=0x0, dwMoveMethod=0x292f6a4 | out: lpNewFilePointer=0x0) returned 1 [0114.276] WriteFile (in: hFile=0x1d8, lpBuffer=0x44c2078*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x292f6b0, lpOverlapped=0x0 | out: lpBuffer=0x44c2078*, lpNumberOfBytesWritten=0x292f6b0*=0x40000, lpOverlapped=0x0) returned 1 [0114.277] CloseHandle (hObject=0x1d8) returned 1 [0114.277] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x2020) returned 1 [0114.277] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0114.277] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0114.277] lstrlenW (lpString=".doc") returned 4 [0114.277] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0114.277] lstrlenW (lpString=".docx") returned 5 [0114.277] lstrcmpiW (lpString1=".docx", lpString2="W.msi") returned -1 [0114.277] lstrlenW (lpString=".pdf") returned 4 [0114.277] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0114.277] lstrlenW (lpString=".xls") returned 4 [0114.277] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0114.277] lstrlenW (lpString=".xlsx") returned 5 [0114.277] lstrcmpiW (lpString1=".xlsx", lpString2="W.msi") returned -1 [0114.277] lstrlenW (lpString=".ppt") returned 4 [0114.277] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0114.278] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0114.278] lstrlenW (lpString=".zip") returned 4 [0114.278] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0114.278] lstrlenW (lpString=".rar") returned 4 [0114.278] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0114.278] lstrlenW (lpString=".bz2") returned 4 [0114.278] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0114.278] lstrlenW (lpString=".7z") returned 3 [0114.278] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0114.278] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0114.278] lstrlenW (lpString=".dbf") returned 4 [0114.278] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0114.278] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0114.278] lstrlenW (lpString=".1cd") returned 4 [0114.278] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0114.278] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0114.278] lstrlenW (lpString=".jpg") returned 4 [0114.278] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0114.278] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0114.278] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0114.278] lstrlenW (lpString=".doc") returned 4 [0114.278] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0114.278] lstrlenW (lpString=".docx") returned 5 [0114.278] lstrcmpiW (lpString1=".docx", lpString2="W.msi") returned -1 [0114.278] lstrlenW (lpString=".pdf") returned 4 [0114.278] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0114.278] lstrlenW (lpString=".xls") returned 4 [0114.278] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0114.278] lstrlenW (lpString=".xlsx") returned 5 [0114.278] lstrcmpiW (lpString1=".xlsx", lpString2="W.msi") returned -1 [0114.278] lstrlenW (lpString=".ppt") returned 4 [0114.278] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0114.278] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0114.278] lstrlenW (lpString=".zip") returned 4 [0114.278] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0114.278] lstrlenW (lpString=".rar") returned 4 [0114.278] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0114.278] lstrlenW (lpString=".bz2") returned 4 [0114.278] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0114.278] lstrlenW (lpString=".7z") returned 3 [0114.278] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0114.278] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0114.278] lstrlenW (lpString=".dbf") returned 4 [0114.278] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0114.278] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0114.278] lstrlenW (lpString=".1cd") returned 4 [0114.278] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0114.278] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0114.278] lstrlenW (lpString=".jpg") returned 4 [0114.278] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0114.279] lstrcmpiW (lpString1=".exe", lpString2=".waifu") returned -1 [0114.279] lstrlenW (lpString="ose.exe") returned 7 [0114.279] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\ose.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0114.492] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x292f944 | out: lpFileSize=0x292f944*=174440) returned 1 [0114.492] CloseHandle (hObject=0x1ec) returned 1 [0114.492] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\ose.exe")) returned 0x2020 [0114.492] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\ose.exe.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0114.492] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\ose.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0114.492] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x292f8f0 | out: lpNewFilePointer=0x0) returned 1 [0114.492] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x292f8f0 | out: lpNewFilePointer=0x0) returned 1 [0114.492] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\ose.exe.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0114.959] GetLastError () returned 0x0 [0114.959] ReadFile (in: hFile=0x1ec, lpBuffer=0x3be0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x292f8fc, lpOverlapped=0x0 | out: lpBuffer=0x3be0020*, lpNumberOfBytesRead=0x292f8fc*=0x2a968, lpOverlapped=0x0) returned 1 [0114.963] WriteFile (in: hFile=0x1e4, lpBuffer=0x3be0020*, nNumberOfBytesToWrite=0x2a970, lpNumberOfBytesWritten=0x292f6c4, lpOverlapped=0x0 | out: lpBuffer=0x3be0020*, lpNumberOfBytesWritten=0x292f6c4*=0x2a970, lpOverlapped=0x0) returned 1 [0114.964] ReadFile (in: hFile=0x1ec, lpBuffer=0x3be0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x292f8fc, lpOverlapped=0x0 | out: lpBuffer=0x3be0020*, lpNumberOfBytesRead=0x292f8fc*=0x0, lpOverlapped=0x0) returned 1 [0114.964] WriteFile (in: hFile=0x1e4, lpBuffer=0x3be0020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x292f6c4, lpOverlapped=0x0 | out: lpBuffer=0x3be0020*, lpNumberOfBytesWritten=0x292f6c4*=0xe2, lpOverlapped=0x0) returned 1 [0114.964] SetEndOfFile (hFile=0x1e4) returned 1 [0114.965] CloseHandle (hObject=0x1e4) returned 1 [0114.965] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x292f8f0 | out: lpNewFilePointer=0x0) returned 1 [0114.965] SetEndOfFile (hFile=0x1ec) returned 1 [0114.965] CloseHandle (hObject=0x1ec) returned 1 [0114.965] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x2020) returned 1 [0114.966] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\ose.exe")) returned 1 [0114.966] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0114.966] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0114.966] lstrlenW (lpString=".doc") returned 4 [0114.966] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0114.966] lstrlenW (lpString=".docx") returned 5 [0114.966] lstrcmpiW (lpString1=".docx", lpString2="e.exe") returned -1 [0114.966] lstrlenW (lpString=".pdf") returned 4 [0114.966] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0114.966] lstrlenW (lpString=".xls") returned 4 [0114.966] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0114.966] lstrlenW (lpString=".xlsx") returned 5 [0114.966] lstrcmpiW (lpString1=".xlsx", lpString2="e.exe") returned -1 [0114.966] lstrlenW (lpString=".ppt") returned 4 [0114.966] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0114.966] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0114.966] lstrlenW (lpString=".zip") returned 4 [0114.966] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0114.966] lstrlenW (lpString=".rar") returned 4 [0114.966] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0114.966] lstrlenW (lpString=".bz2") returned 4 [0114.966] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0114.966] lstrlenW (lpString=".7z") returned 3 [0114.966] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0114.966] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0114.966] lstrlenW (lpString=".dbf") returned 4 [0114.966] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0114.966] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0114.966] lstrlenW (lpString=".1cd") returned 4 [0114.966] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0114.966] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0114.966] lstrlenW (lpString=".jpg") returned 4 [0114.966] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0114.967] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0114.967] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0114.967] lstrlenW (lpString=".doc") returned 4 [0114.967] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0114.967] lstrlenW (lpString=".docx") returned 5 [0114.967] lstrcmpiW (lpString1=".docx", lpString2="e.exe") returned -1 [0114.967] lstrlenW (lpString=".pdf") returned 4 [0114.967] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0114.967] lstrlenW (lpString=".xls") returned 4 [0114.967] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0114.967] lstrlenW (lpString=".xlsx") returned 5 [0114.967] lstrcmpiW (lpString1=".xlsx", lpString2="e.exe") returned -1 [0114.967] lstrlenW (lpString=".ppt") returned 4 [0114.967] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0114.967] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0114.967] lstrlenW (lpString=".zip") returned 4 [0114.967] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0114.967] lstrlenW (lpString=".rar") returned 4 [0114.967] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0114.967] lstrlenW (lpString=".bz2") returned 4 [0114.967] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0114.967] lstrlenW (lpString=".7z") returned 3 [0114.967] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0114.967] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0114.967] lstrlenW (lpString=".dbf") returned 4 [0114.967] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0114.967] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0114.967] lstrlenW (lpString=".1cd") returned 4 [0114.967] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0114.967] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0114.967] lstrlenW (lpString=".jpg") returned 4 [0114.967] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0114.967] lstrcmpiW (lpString1=".exe", lpString2=".waifu") returned -1 [0114.967] lstrlenW (lpString="intel-metadata-rich.exe") returned 23 [0114.967] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\intel-metadata-rich.exe" (normalized: "c:\\program files\\common files\\intel-metadata-rich.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0114.968] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x292f944 | out: lpFileSize=0x292f944*=75264) returned 1 [0114.968] CloseHandle (hObject=0x1ec) returned 1 [0114.968] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\intel-metadata-rich.exe" (normalized: "c:\\program files\\common files\\intel-metadata-rich.exe")) returned 0x20 [0114.968] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\intel-metadata-rich.exe.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\intel-metadata-rich.exe.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0114.968] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\intel-metadata-rich.exe" (normalized: "c:\\program files\\common files\\intel-metadata-rich.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0114.968] lstrlenW (lpString="C:\\Program Files\\Common Files\\intel-metadata-rich.exe") returned 53 [0114.968] lstrlenW (lpString="C:\\Program Files\\Common Files\\intel-metadata-rich.exe") returned 53 [0114.968] lstrlenW (lpString=".doc") returned 4 [0114.968] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0114.968] lstrlenW (lpString=".docx") returned 5 [0114.968] lstrcmpiW (lpString1=".docx", lpString2="h.exe") returned -1 [0114.968] lstrlenW (lpString=".pdf") returned 4 [0114.968] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0114.968] lstrlenW (lpString=".xls") returned 4 [0114.968] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0114.968] lstrlenW (lpString=".xlsx") returned 5 [0114.968] lstrcmpiW (lpString1=".xlsx", lpString2="h.exe") returned -1 [0114.968] lstrlenW (lpString=".ppt") returned 4 [0114.968] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0114.968] lstrlenW (lpString="C:\\Program Files\\Common Files\\intel-metadata-rich.exe") returned 53 [0114.968] lstrlenW (lpString=".zip") returned 4 [0114.968] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0114.968] lstrlenW (lpString=".rar") returned 4 [0114.968] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0114.968] lstrlenW (lpString=".bz2") returned 4 [0114.968] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0114.968] lstrlenW (lpString=".7z") returned 3 [0114.968] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0114.969] lstrlenW (lpString="C:\\Program Files\\Common Files\\intel-metadata-rich.exe") returned 53 [0114.969] lstrlenW (lpString=".dbf") returned 4 [0114.969] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0114.969] lstrlenW (lpString="C:\\Program Files\\Common Files\\intel-metadata-rich.exe") returned 53 [0114.969] lstrlenW (lpString=".1cd") returned 4 [0114.969] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0114.969] lstrlenW (lpString="C:\\Program Files\\Common Files\\intel-metadata-rich.exe") returned 53 [0114.969] lstrlenW (lpString=".jpg") returned 4 [0114.969] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0114.969] lstrlenW (lpString="C:\\Program Files\\Common Files\\intel-metadata-rich.exe") returned 53 [0114.969] lstrlenW (lpString="C:\\Program Files\\Common Files\\intel-metadata-rich.exe") returned 53 [0114.969] lstrlenW (lpString=".doc") returned 4 [0114.969] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0114.969] lstrlenW (lpString=".docx") returned 5 [0114.969] lstrcmpiW (lpString1=".docx", lpString2="h.exe") returned -1 [0114.969] lstrlenW (lpString=".pdf") returned 4 [0114.969] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0114.969] lstrlenW (lpString=".xls") returned 4 [0114.969] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0114.969] lstrlenW (lpString=".xlsx") returned 5 [0114.969] lstrcmpiW (lpString1=".xlsx", lpString2="h.exe") returned -1 [0114.969] lstrlenW (lpString=".ppt") returned 4 [0114.969] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0114.969] lstrlenW (lpString="C:\\Program Files\\Common Files\\intel-metadata-rich.exe") returned 53 [0114.969] lstrlenW (lpString=".zip") returned 4 [0114.969] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0114.969] lstrlenW (lpString=".rar") returned 4 [0114.969] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0114.969] lstrlenW (lpString=".bz2") returned 4 [0114.969] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0114.969] lstrlenW (lpString=".7z") returned 3 [0114.969] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0114.969] lstrlenW (lpString="C:\\Program Files\\Common Files\\intel-metadata-rich.exe") returned 53 [0114.969] lstrlenW (lpString=".dbf") returned 4 [0114.969] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0114.969] lstrlenW (lpString="C:\\Program Files\\Common Files\\intel-metadata-rich.exe") returned 53 [0114.969] lstrlenW (lpString=".1cd") returned 4 [0114.969] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0114.969] lstrlenW (lpString="C:\\Program Files\\Common Files\\intel-metadata-rich.exe") returned 53 [0114.969] lstrlenW (lpString=".jpg") returned 4 [0114.969] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0114.969] lstrcmpiW (lpString1=".DLL", lpString2=".waifu") returned -1 [0114.969] lstrlenW (lpString="DBGHELP.DLL") returned 11 [0114.969] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dbghelp.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0115.974] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x292f944 | out: lpFileSize=0x292f944*=1369952) returned 1 [0115.974] CloseHandle (hObject=0x1d8) returned 1 [0115.974] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dbghelp.dll")) returned 0x20 [0115.974] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dbghelp.dll.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0115.974] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dbghelp.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0115.974] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x292f8f0 | out: lpNewFilePointer=0x0) returned 1 [0115.975] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x292f8f0 | out: lpNewFilePointer=0x0) returned 1 [0115.975] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dbghelp.dll.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0116.013] GetLastError () returned 0x0 [0116.013] ReadFile (in: hFile=0x1d8, lpBuffer=0x3be0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x292f8fc, lpOverlapped=0x0 | out: lpBuffer=0x3be0020*, lpNumberOfBytesRead=0x292f8fc*=0xffff0, lpOverlapped=0x0) returned 1 [0116.040] WriteFile (in: hFile=0x1fc, lpBuffer=0x3be0020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x292f6c4, lpOverlapped=0x0 | out: lpBuffer=0x3be0020*, lpNumberOfBytesWritten=0x292f6c4*=0xffff0, lpOverlapped=0x0) returned 1 [0116.101] ReadFile (in: hFile=0x1d8, lpBuffer=0x3be0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x292f8fc, lpOverlapped=0x0 | out: lpBuffer=0x3be0020*, lpNumberOfBytesRead=0x292f8fc*=0x4e770, lpOverlapped=0x0) returned 1 [0116.106] WriteFile (in: hFile=0x1fc, lpBuffer=0x3be0020*, nNumberOfBytesToWrite=0x4e780, lpNumberOfBytesWritten=0x292f6c4, lpOverlapped=0x0 | out: lpBuffer=0x3be0020*, lpNumberOfBytesWritten=0x292f6c4*=0x4e780, lpOverlapped=0x0) returned 1 [0116.114] ReadFile (in: hFile=0x1d8, lpBuffer=0x3be0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x292f8fc, lpOverlapped=0x0 | out: lpBuffer=0x3be0020*, lpNumberOfBytesRead=0x292f8fc*=0x0, lpOverlapped=0x0) returned 1 [0116.154] WriteFile (in: hFile=0x1fc, lpBuffer=0x3be0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x292f6c4, lpOverlapped=0x0 | out: lpBuffer=0x3be0020*, lpNumberOfBytesWritten=0x292f6c4*=0xea, lpOverlapped=0x0) returned 1 [0116.154] SetEndOfFile (hFile=0x1fc) returned 1 [0116.154] CloseHandle (hObject=0x1fc) returned 1 [0116.155] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x292f8f0 | out: lpNewFilePointer=0x0) returned 1 [0116.155] SetEndOfFile (hFile=0x1d8) returned 1 [0116.156] CloseHandle (hObject=0x1d8) returned 1 [0116.156] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0116.157] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dbghelp.dll")) returned 1 [0116.157] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL") returned 61 [0116.157] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL") returned 61 [0116.157] lstrlenW (lpString=".doc") returned 4 [0116.157] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0116.157] lstrlenW (lpString=".docx") returned 5 [0116.157] lstrcmpiW (lpString1=".docx", lpString2="P.DLL") returned -1 [0116.157] lstrlenW (lpString=".pdf") returned 4 [0116.157] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0116.157] lstrlenW (lpString=".xls") returned 4 [0116.157] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0116.157] lstrlenW (lpString=".xlsx") returned 5 [0116.157] lstrcmpiW (lpString1=".xlsx", lpString2="P.DLL") returned -1 [0116.157] lstrlenW (lpString=".ppt") returned 4 [0116.157] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0116.157] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL") returned 61 [0116.157] lstrlenW (lpString=".zip") returned 4 [0116.157] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0116.157] lstrlenW (lpString=".rar") returned 4 [0116.157] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0116.157] lstrlenW (lpString=".bz2") returned 4 [0116.157] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0116.157] lstrlenW (lpString=".7z") returned 3 [0116.157] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0116.157] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL") returned 61 [0116.157] lstrlenW (lpString=".dbf") returned 4 [0116.157] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0116.157] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL") returned 61 [0116.157] lstrlenW (lpString=".1cd") returned 4 [0116.157] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0116.157] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL") returned 61 [0116.157] lstrlenW (lpString=".jpg") returned 4 [0116.157] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0116.157] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL") returned 61 [0116.157] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL") returned 61 [0116.157] lstrlenW (lpString=".doc") returned 4 [0116.157] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0116.158] lstrlenW (lpString=".docx") returned 5 [0116.158] lstrcmpiW (lpString1=".docx", lpString2="P.DLL") returned -1 [0116.158] lstrlenW (lpString=".pdf") returned 4 [0116.158] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0116.158] lstrlenW (lpString=".xls") returned 4 [0116.158] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0116.158] lstrlenW (lpString=".xlsx") returned 5 [0116.158] lstrcmpiW (lpString1=".xlsx", lpString2="P.DLL") returned -1 [0116.158] lstrlenW (lpString=".ppt") returned 4 [0116.158] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0116.158] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL") returned 61 [0116.158] lstrlenW (lpString=".zip") returned 4 [0116.158] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0116.158] lstrlenW (lpString=".rar") returned 4 [0116.158] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0116.158] lstrlenW (lpString=".bz2") returned 4 [0116.158] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0116.158] lstrlenW (lpString=".7z") returned 3 [0116.158] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0116.158] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL") returned 61 [0116.158] lstrlenW (lpString=".dbf") returned 4 [0116.158] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0116.158] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL") returned 61 [0116.158] lstrlenW (lpString=".1cd") returned 4 [0116.158] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0116.158] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL") returned 61 [0116.158] lstrlenW (lpString=".jpg") returned 4 [0116.158] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0116.158] lstrcmpiW (lpString1=".FLT", lpString2=".waifu") returned -1 [0116.158] lstrlenW (lpString="WPGIMP32.FLT") returned 12 [0116.158] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\wpgimp32.flt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0116.189] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x292f944 | out: lpFileSize=0x292f944*=280448) returned 1 [0116.189] CloseHandle (hObject=0x1d8) returned 1 [0116.189] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\wpgimp32.flt")) returned 0x20 [0116.189] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\wpgimp32.flt.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0116.189] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\wpgimp32.flt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0116.189] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x292f8f0 | out: lpNewFilePointer=0x0) returned 1 [0116.189] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x292f8f0 | out: lpNewFilePointer=0x0) returned 1 [0116.189] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\wpgimp32.flt.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0116.189] GetLastError () returned 0x0 [0116.189] ReadFile (in: hFile=0x1d8, lpBuffer=0x3be0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x292f8fc, lpOverlapped=0x0 | out: lpBuffer=0x3be0020*, lpNumberOfBytesRead=0x292f8fc*=0x44780, lpOverlapped=0x0) returned 1 [0116.195] WriteFile (in: hFile=0x1fc, lpBuffer=0x3be0020*, nNumberOfBytesToWrite=0x44790, lpNumberOfBytesWritten=0x292f6c4, lpOverlapped=0x0 | out: lpBuffer=0x3be0020*, lpNumberOfBytesWritten=0x292f6c4*=0x44790, lpOverlapped=0x0) returned 1 [0116.198] ReadFile (in: hFile=0x1d8, lpBuffer=0x3be0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x292f8fc, lpOverlapped=0x0 | out: lpBuffer=0x3be0020*, lpNumberOfBytesRead=0x292f8fc*=0x0, lpOverlapped=0x0) returned 1 [0116.198] WriteFile (in: hFile=0x1fc, lpBuffer=0x3be0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x292f6c4, lpOverlapped=0x0 | out: lpBuffer=0x3be0020*, lpNumberOfBytesWritten=0x292f6c4*=0xec, lpOverlapped=0x0) returned 1 [0116.198] SetEndOfFile (hFile=0x1fc) returned 1 [0116.198] CloseHandle (hObject=0x1fc) returned 1 [0116.198] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x292f8f0 | out: lpNewFilePointer=0x0) returned 1 [0116.198] SetEndOfFile (hFile=0x1d8) returned 1 [0116.199] CloseHandle (hObject=0x1d8) returned 1 [0116.199] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0116.200] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\wpgimp32.flt")) returned 1 [0116.200] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT") returned 67 [0116.200] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT") returned 67 [0116.200] lstrlenW (lpString=".doc") returned 4 [0116.200] lstrcmpiW (lpString1=".doc", lpString2=".FLT") returned -1 [0116.200] lstrlenW (lpString=".docx") returned 5 [0116.200] lstrcmpiW (lpString1=".docx", lpString2="2.FLT") returned -1 [0116.200] lstrlenW (lpString=".pdf") returned 4 [0116.200] lstrcmpiW (lpString1=".pdf", lpString2=".FLT") returned 1 [0116.200] lstrlenW (lpString=".xls") returned 4 [0116.200] lstrcmpiW (lpString1=".xls", lpString2=".FLT") returned 1 [0116.200] lstrlenW (lpString=".xlsx") returned 5 [0116.200] lstrcmpiW (lpString1=".xlsx", lpString2="2.FLT") returned -1 [0116.200] lstrlenW (lpString=".ppt") returned 4 [0116.200] lstrcmpiW (lpString1=".ppt", lpString2=".FLT") returned 1 [0116.200] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT") returned 67 [0116.200] lstrlenW (lpString=".zip") returned 4 [0116.200] lstrcmpiW (lpString1=".zip", lpString2=".FLT") returned 1 [0116.200] lstrlenW (lpString=".rar") returned 4 [0116.200] lstrcmpiW (lpString1=".rar", lpString2=".FLT") returned 1 [0116.200] lstrlenW (lpString=".bz2") returned 4 [0116.200] lstrcmpiW (lpString1=".bz2", lpString2=".FLT") returned -1 [0116.200] lstrlenW (lpString=".7z") returned 3 [0116.200] lstrcmpiW (lpString1=".7z", lpString2="FLT") returned -1 [0116.200] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT") returned 67 [0116.200] lstrlenW (lpString=".dbf") returned 4 [0116.200] lstrcmpiW (lpString1=".dbf", lpString2=".FLT") returned -1 [0116.200] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT") returned 67 [0116.200] lstrlenW (lpString=".1cd") returned 4 [0116.200] lstrcmpiW (lpString1=".1cd", lpString2=".FLT") returned -1 [0116.200] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT") returned 67 [0116.200] lstrlenW (lpString=".jpg") returned 4 [0116.200] lstrcmpiW (lpString1=".jpg", lpString2=".FLT") returned 1 [0116.200] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT") returned 67 [0116.200] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT") returned 67 [0116.200] lstrlenW (lpString=".doc") returned 4 [0116.200] lstrcmpiW (lpString1=".doc", lpString2=".FLT") returned -1 [0116.201] lstrlenW (lpString=".docx") returned 5 [0116.201] lstrcmpiW (lpString1=".docx", lpString2="2.FLT") returned -1 [0116.201] lstrlenW (lpString=".pdf") returned 4 [0116.201] lstrcmpiW (lpString1=".pdf", lpString2=".FLT") returned 1 [0116.201] lstrlenW (lpString=".xls") returned 4 [0116.201] lstrcmpiW (lpString1=".xls", lpString2=".FLT") returned 1 [0116.201] lstrlenW (lpString=".xlsx") returned 5 [0116.201] lstrcmpiW (lpString1=".xlsx", lpString2="2.FLT") returned -1 [0116.201] lstrlenW (lpString=".ppt") returned 4 [0116.201] lstrcmpiW (lpString1=".ppt", lpString2=".FLT") returned 1 [0116.201] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT") returned 67 [0116.201] lstrlenW (lpString=".zip") returned 4 [0116.201] lstrcmpiW (lpString1=".zip", lpString2=".FLT") returned 1 [0116.201] lstrlenW (lpString=".rar") returned 4 [0116.201] lstrcmpiW (lpString1=".rar", lpString2=".FLT") returned 1 [0116.201] lstrlenW (lpString=".bz2") returned 4 [0116.201] lstrcmpiW (lpString1=".bz2", lpString2=".FLT") returned -1 [0116.201] lstrlenW (lpString=".7z") returned 3 [0116.201] lstrcmpiW (lpString1=".7z", lpString2="FLT") returned -1 [0116.201] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT") returned 67 [0116.201] lstrlenW (lpString=".dbf") returned 4 [0116.201] lstrcmpiW (lpString1=".dbf", lpString2=".FLT") returned -1 [0116.201] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT") returned 67 [0116.201] lstrlenW (lpString=".1cd") returned 4 [0116.201] lstrcmpiW (lpString1=".1cd", lpString2=".FLT") returned -1 [0116.201] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT") returned 67 [0116.201] lstrlenW (lpString=".jpg") returned 4 [0116.201] lstrcmpiW (lpString1=".jpg", lpString2=".FLT") returned 1 [0116.201] lstrcmpiW (lpString1=".dll", lpString2=".waifu") returned -1 [0116.201] lstrlenW (lpString="hxds.dll") returned 8 [0116.201] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\hxds.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0116.202] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x292f944 | out: lpFileSize=0x292f944*=1257984) returned 1 [0116.202] CloseHandle (hObject=0x1d8) returned 1 [0116.202] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\hxds.dll")) returned 0x20 [0116.202] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\hxds.dll.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0116.202] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\hxds.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0116.202] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x292f8f0 | out: lpNewFilePointer=0x0) returned 1 [0116.202] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x292f8f0 | out: lpNewFilePointer=0x0) returned 1 [0116.202] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\hxds.dll.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0116.203] GetLastError () returned 0x0 [0116.203] ReadFile (in: hFile=0x1d8, lpBuffer=0x3be0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x292f8fc, lpOverlapped=0x0 | out: lpBuffer=0x3be0020*, lpNumberOfBytesRead=0x292f8fc*=0xffff0, lpOverlapped=0x0) returned 1 [0116.230] WriteFile (in: hFile=0x1fc, lpBuffer=0x3be0020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x292f6c4, lpOverlapped=0x0 | out: lpBuffer=0x3be0020*, lpNumberOfBytesWritten=0x292f6c4*=0xffff0, lpOverlapped=0x0) returned 1 [0116.237] ReadFile (in: hFile=0x1d8, lpBuffer=0x3be0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x292f8fc, lpOverlapped=0x0 | out: lpBuffer=0x3be0020*, lpNumberOfBytesRead=0x292f8fc*=0x33210, lpOverlapped=0x0) returned 1 [0116.436] WriteFile (in: hFile=0x1fc, lpBuffer=0x3be0020*, nNumberOfBytesToWrite=0x33220, lpNumberOfBytesWritten=0x292f6c4, lpOverlapped=0x0 | out: lpBuffer=0x3be0020*, lpNumberOfBytesWritten=0x292f6c4*=0x33220, lpOverlapped=0x0) returned 1 [0116.439] ReadFile (in: hFile=0x1d8, lpBuffer=0x3be0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x292f8fc, lpOverlapped=0x0 | out: lpBuffer=0x3be0020*, lpNumberOfBytesRead=0x292f8fc*=0x0, lpOverlapped=0x0) returned 1 [0116.439] WriteFile (in: hFile=0x1fc, lpBuffer=0x3be0020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x292f6c4, lpOverlapped=0x0 | out: lpBuffer=0x3be0020*, lpNumberOfBytesWritten=0x292f6c4*=0xe4, lpOverlapped=0x0) returned 1 [0116.439] SetEndOfFile (hFile=0x1fc) returned 1 [0116.440] CloseHandle (hObject=0x1fc) returned 1 [0116.440] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x292f8f0 | out: lpNewFilePointer=0x0) returned 1 [0116.440] SetEndOfFile (hFile=0x1d8) returned 1 [0116.441] CloseHandle (hObject=0x1d8) returned 1 [0116.441] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0116.441] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\hxds.dll")) returned 1 [0116.441] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll") returned 60 [0116.441] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll") returned 60 [0116.441] lstrlenW (lpString=".doc") returned 4 [0116.441] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0116.441] lstrlenW (lpString=".docx") returned 5 [0116.441] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0116.441] lstrlenW (lpString=".pdf") returned 4 [0116.441] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0116.441] lstrlenW (lpString=".xls") returned 4 [0116.441] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0116.441] lstrlenW (lpString=".xlsx") returned 5 [0116.441] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0116.441] lstrlenW (lpString=".ppt") returned 4 [0116.441] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0116.441] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll") returned 60 [0116.441] lstrlenW (lpString=".zip") returned 4 [0116.441] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0116.441] lstrlenW (lpString=".rar") returned 4 [0116.441] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0116.441] lstrlenW (lpString=".bz2") returned 4 [0116.442] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0116.442] lstrlenW (lpString=".7z") returned 3 [0116.442] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0116.442] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll") returned 60 [0116.442] lstrlenW (lpString=".dbf") returned 4 [0116.442] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0116.442] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll") returned 60 [0116.442] lstrlenW (lpString=".1cd") returned 4 [0116.442] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0116.442] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll") returned 60 [0116.442] lstrlenW (lpString=".jpg") returned 4 [0116.442] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0116.442] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll") returned 60 [0116.442] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll") returned 60 [0116.442] lstrlenW (lpString=".doc") returned 4 [0116.442] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0116.442] lstrlenW (lpString=".docx") returned 5 [0116.442] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0116.442] lstrlenW (lpString=".pdf") returned 4 [0116.442] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0116.442] lstrlenW (lpString=".xls") returned 4 [0116.442] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0116.442] lstrlenW (lpString=".xlsx") returned 5 [0116.442] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0116.442] lstrlenW (lpString=".ppt") returned 4 [0116.442] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0116.442] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll") returned 60 [0116.442] lstrlenW (lpString=".zip") returned 4 [0116.442] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0116.442] lstrlenW (lpString=".rar") returned 4 [0116.442] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0116.442] lstrlenW (lpString=".bz2") returned 4 [0116.442] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0116.442] lstrlenW (lpString=".7z") returned 3 [0116.442] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0116.442] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll") returned 60 [0116.442] lstrlenW (lpString=".dbf") returned 4 [0116.442] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0116.442] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll") returned 60 [0116.442] lstrlenW (lpString=".1cd") returned 4 [0116.442] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0116.442] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll") returned 60 [0116.442] lstrlenW (lpString=".jpg") returned 4 [0116.442] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0116.442] lstrcmpiW (lpString1=".mui", lpString2=".waifu") returned -1 [0116.442] lstrlenW (lpString="mip.exe.mui") returned 11 [0116.443] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mip.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\mip.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0116.616] GetFileSizeEx (in: hFile=0x164, lpFileSize=0x292f944 | out: lpFileSize=0x292f944*=10240) returned 1 [0116.616] CloseHandle (hObject=0x164) returned 1 [0116.616] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mip.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\mip.exe.mui")) returned 0x20 [0116.616] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mip.exe.mui.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\mip.exe.mui.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0116.617] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mip.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\mip.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0116.617] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mip.exe.mui") returned 68 [0116.617] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mip.exe.mui") returned 68 [0116.617] lstrlenW (lpString=".doc") returned 4 [0116.617] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0116.617] lstrlenW (lpString=".docx") returned 5 [0116.617] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0116.617] lstrlenW (lpString=".pdf") returned 4 [0116.617] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0116.617] lstrlenW (lpString=".xls") returned 4 [0116.617] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0116.617] lstrlenW (lpString=".xlsx") returned 5 [0116.617] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0116.617] lstrlenW (lpString=".ppt") returned 4 [0116.617] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0116.617] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mip.exe.mui") returned 68 [0116.617] lstrlenW (lpString=".zip") returned 4 [0116.617] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0116.617] lstrlenW (lpString=".rar") returned 4 [0116.617] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0116.617] lstrlenW (lpString=".bz2") returned 4 [0116.617] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0116.617] lstrlenW (lpString=".7z") returned 3 [0116.617] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0116.617] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mip.exe.mui") returned 68 [0116.617] lstrlenW (lpString=".dbf") returned 4 [0116.617] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0116.617] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mip.exe.mui") returned 68 [0116.617] lstrlenW (lpString=".1cd") returned 4 [0116.617] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0116.617] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mip.exe.mui") returned 68 [0116.617] lstrlenW (lpString=".jpg") returned 4 [0116.617] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0116.618] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mip.exe.mui") returned 68 [0116.618] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mip.exe.mui") returned 68 [0116.618] lstrlenW (lpString=".doc") returned 4 [0116.618] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0116.618] lstrlenW (lpString=".docx") returned 5 [0116.618] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0116.618] lstrlenW (lpString=".pdf") returned 4 [0116.618] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0116.618] lstrlenW (lpString=".xls") returned 4 [0116.618] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0116.618] lstrlenW (lpString=".xlsx") returned 5 [0116.618] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0116.618] lstrlenW (lpString=".ppt") returned 4 [0116.618] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0116.618] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mip.exe.mui") returned 68 [0116.618] lstrlenW (lpString=".zip") returned 4 [0116.618] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0116.618] lstrlenW (lpString=".rar") returned 4 [0116.618] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0116.618] lstrlenW (lpString=".bz2") returned 4 [0116.618] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0116.618] lstrlenW (lpString=".7z") returned 3 [0116.618] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0116.618] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mip.exe.mui") returned 68 [0116.618] lstrlenW (lpString=".dbf") returned 4 [0116.618] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0116.618] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mip.exe.mui") returned 68 [0116.618] lstrlenW (lpString=".1cd") returned 4 [0116.618] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0116.618] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\mip.exe.mui") returned 68 [0116.618] lstrlenW (lpString=".jpg") returned 4 [0116.618] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0116.619] lstrcmpiW (lpString1=".mui", lpString2=".waifu") returned -1 [0116.619] lstrlenW (lpString="ShapeCollector.exe.mui") returned 22 [0116.619] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\ShapeCollector.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\shapecollector.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0116.619] GetFileSizeEx (in: hFile=0x164, lpFileSize=0x292f944 | out: lpFileSize=0x292f944*=43520) returned 1 [0116.619] CloseHandle (hObject=0x164) returned 1 [0116.619] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\ShapeCollector.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\shapecollector.exe.mui")) returned 0x20 [0116.619] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\ShapeCollector.exe.mui.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\shapecollector.exe.mui.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0116.619] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\ShapeCollector.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\shapecollector.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0116.619] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\ShapeCollector.exe.mui") returned 79 [0116.619] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\ShapeCollector.exe.mui") returned 79 [0116.619] lstrlenW (lpString=".doc") returned 4 [0116.619] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0116.619] lstrlenW (lpString=".docx") returned 5 [0116.619] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0116.619] lstrlenW (lpString=".pdf") returned 4 [0116.620] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0116.620] lstrlenW (lpString=".xls") returned 4 [0116.620] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0116.620] lstrlenW (lpString=".xlsx") returned 5 [0116.620] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0116.620] lstrlenW (lpString=".ppt") returned 4 [0116.620] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0116.620] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\ShapeCollector.exe.mui") returned 79 [0116.620] lstrlenW (lpString=".zip") returned 4 [0116.620] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0116.620] lstrlenW (lpString=".rar") returned 4 [0116.620] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0116.620] lstrlenW (lpString=".bz2") returned 4 [0116.620] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0116.620] lstrlenW (lpString=".7z") returned 3 [0116.620] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0116.620] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\ShapeCollector.exe.mui") returned 79 [0116.620] lstrlenW (lpString=".dbf") returned 4 [0116.620] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0116.620] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\ShapeCollector.exe.mui") returned 79 [0116.620] lstrlenW (lpString=".1cd") returned 4 [0116.620] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0116.620] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\ShapeCollector.exe.mui") returned 79 [0116.620] lstrlenW (lpString=".jpg") returned 4 [0116.620] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0116.620] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\ShapeCollector.exe.mui") returned 79 [0116.620] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\ShapeCollector.exe.mui") returned 79 [0116.620] lstrlenW (lpString=".doc") returned 4 [0116.620] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0116.620] lstrlenW (lpString=".docx") returned 5 [0116.620] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0116.620] lstrlenW (lpString=".pdf") returned 4 [0116.620] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0116.620] lstrlenW (lpString=".xls") returned 4 [0116.620] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0116.620] lstrlenW (lpString=".xlsx") returned 5 [0116.620] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0116.621] lstrlenW (lpString=".ppt") returned 4 [0116.621] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0116.621] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\ShapeCollector.exe.mui") returned 79 [0116.621] lstrlenW (lpString=".zip") returned 4 [0116.621] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0116.621] lstrlenW (lpString=".rar") returned 4 [0116.621] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0116.621] lstrlenW (lpString=".bz2") returned 4 [0116.621] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0116.621] lstrlenW (lpString=".7z") returned 3 [0116.621] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0116.621] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\ShapeCollector.exe.mui") returned 79 [0116.621] lstrlenW (lpString=".dbf") returned 4 [0116.621] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0116.621] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\ShapeCollector.exe.mui") returned 79 [0116.621] lstrlenW (lpString=".1cd") returned 4 [0116.621] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0116.621] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\ShapeCollector.exe.mui") returned 79 [0116.621] lstrlenW (lpString=".jpg") returned 4 [0116.621] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0116.621] lstrcmpiW (lpString1=".mui", lpString2=".waifu") returned -1 [0116.621] lstrlenW (lpString="tabskb.dll.mui") returned 14 [0116.621] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tabskb.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tabskb.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0116.623] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x292f944 | out: lpFileSize=0x292f944*=3072) returned 1 [0116.623] CloseHandle (hObject=0x16c) returned 1 [0116.623] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tabskb.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tabskb.dll.mui")) returned 0x20 [0116.623] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tabskb.dll.mui.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tabskb.dll.mui.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0116.623] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tabskb.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tabskb.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0116.623] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tabskb.dll.mui") returned 71 [0116.623] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tabskb.dll.mui") returned 71 [0116.623] lstrlenW (lpString=".doc") returned 4 [0116.623] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0116.623] lstrlenW (lpString=".docx") returned 5 [0116.623] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0116.623] lstrlenW (lpString=".pdf") returned 4 [0116.623] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0116.623] lstrlenW (lpString=".xls") returned 4 [0116.623] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0116.623] lstrlenW (lpString=".xlsx") returned 5 [0116.623] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0116.623] lstrlenW (lpString=".ppt") returned 4 [0116.623] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0116.624] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tabskb.dll.mui") returned 71 [0116.624] lstrlenW (lpString=".zip") returned 4 [0116.624] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0116.624] lstrlenW (lpString=".rar") returned 4 [0116.624] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0116.624] lstrlenW (lpString=".bz2") returned 4 [0116.624] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0116.624] lstrlenW (lpString=".7z") returned 3 [0116.624] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0116.624] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tabskb.dll.mui") returned 71 [0116.624] lstrlenW (lpString=".dbf") returned 4 [0116.624] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0116.624] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tabskb.dll.mui") returned 71 [0116.624] lstrlenW (lpString=".1cd") returned 4 [0116.624] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0116.624] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tabskb.dll.mui") returned 71 [0116.624] lstrlenW (lpString=".jpg") returned 4 [0116.624] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0116.624] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tabskb.dll.mui") returned 71 [0116.624] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tabskb.dll.mui") returned 71 [0116.624] lstrlenW (lpString=".doc") returned 4 [0116.624] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0116.624] lstrlenW (lpString=".docx") returned 5 [0116.624] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0116.624] lstrlenW (lpString=".pdf") returned 4 [0116.624] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0116.624] lstrlenW (lpString=".xls") returned 4 [0116.624] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0116.624] lstrlenW (lpString=".xlsx") returned 5 [0116.624] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0116.624] lstrlenW (lpString=".ppt") returned 4 [0116.624] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0116.624] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tabskb.dll.mui") returned 71 [0116.624] lstrlenW (lpString=".zip") returned 4 [0116.624] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0116.624] lstrlenW (lpString=".rar") returned 4 [0116.624] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0116.624] lstrlenW (lpString=".bz2") returned 4 [0116.625] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0116.625] lstrlenW (lpString=".7z") returned 3 [0116.625] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0116.625] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tabskb.dll.mui") returned 71 [0116.625] lstrlenW (lpString=".dbf") returned 4 [0116.625] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0116.625] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tabskb.dll.mui") returned 71 [0116.625] lstrlenW (lpString=".1cd") returned 4 [0116.625] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0116.625] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tabskb.dll.mui") returned 71 [0116.625] lstrlenW (lpString=".jpg") returned 4 [0116.625] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0116.625] lstrcmpiW (lpString1=".mui", lpString2=".waifu") returned -1 [0116.625] lstrlenW (lpString="TipBand.dll.mui") returned 15 [0116.625] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipBand.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipband.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0116.826] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x292f944 | out: lpFileSize=0x292f944*=3072) returned 1 [0116.826] CloseHandle (hObject=0x1f0) returned 1 [0116.826] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipBand.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipband.dll.mui")) returned 0x20 [0116.826] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipBand.dll.mui.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipband.dll.mui.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0116.826] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipBand.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipband.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0116.827] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipBand.dll.mui") returned 72 [0116.827] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipBand.dll.mui") returned 72 [0116.827] lstrlenW (lpString=".doc") returned 4 [0116.827] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0116.827] lstrlenW (lpString=".docx") returned 5 [0116.827] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0116.827] lstrlenW (lpString=".pdf") returned 4 [0116.827] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0116.827] lstrlenW (lpString=".xls") returned 4 [0116.827] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0116.827] lstrlenW (lpString=".xlsx") returned 5 [0116.827] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0116.827] lstrlenW (lpString=".ppt") returned 4 [0116.827] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0116.827] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipBand.dll.mui") returned 72 [0116.827] lstrlenW (lpString=".zip") returned 4 [0116.827] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0116.827] lstrlenW (lpString=".rar") returned 4 [0116.827] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0116.827] lstrlenW (lpString=".bz2") returned 4 [0116.827] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0116.827] lstrlenW (lpString=".7z") returned 3 [0116.827] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0116.827] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipBand.dll.mui") returned 72 [0116.827] lstrlenW (lpString=".dbf") returned 4 [0116.827] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0116.827] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipBand.dll.mui") returned 72 [0116.827] lstrlenW (lpString=".1cd") returned 4 [0116.827] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0116.827] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipBand.dll.mui") returned 72 [0116.827] lstrlenW (lpString=".jpg") returned 4 [0116.827] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0116.827] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipBand.dll.mui") returned 72 [0116.827] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipBand.dll.mui") returned 72 [0116.827] lstrlenW (lpString=".doc") returned 4 [0116.827] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0116.827] lstrlenW (lpString=".docx") returned 5 [0116.827] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0116.827] lstrlenW (lpString=".pdf") returned 4 [0116.827] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0116.827] lstrlenW (lpString=".xls") returned 4 [0116.827] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0116.827] lstrlenW (lpString=".xlsx") returned 5 [0116.827] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0116.827] lstrlenW (lpString=".ppt") returned 4 [0116.827] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0116.827] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipBand.dll.mui") returned 72 [0116.828] lstrlenW (lpString=".zip") returned 4 [0116.828] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0116.828] lstrlenW (lpString=".rar") returned 4 [0116.828] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0116.828] lstrlenW (lpString=".bz2") returned 4 [0116.828] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0116.828] lstrlenW (lpString=".7z") returned 3 [0116.828] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0116.828] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipBand.dll.mui") returned 72 [0116.828] lstrlenW (lpString=".dbf") returned 4 [0116.828] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0116.828] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipBand.dll.mui") returned 72 [0116.828] lstrlenW (lpString=".1cd") returned 4 [0116.828] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0116.828] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipBand.dll.mui") returned 72 [0116.828] lstrlenW (lpString=".jpg") returned 4 [0116.828] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0116.828] lstrcmpiW (lpString1=".mui", lpString2=".waifu") returned -1 [0116.828] lstrlenW (lpString="msinfo32.exe.mui") returned 16 [0116.828] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\en-us\\msinfo32.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0116.828] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x292f944 | out: lpFileSize=0x292f944*=26624) returned 1 [0116.828] CloseHandle (hObject=0x1f0) returned 1 [0116.829] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\en-us\\msinfo32.exe.mui")) returned 0x20 [0116.829] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\en-us\\msinfo32.exe.mui.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0116.829] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\en-us\\msinfo32.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0116.829] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui") returned 76 [0116.829] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui") returned 76 [0116.829] lstrlenW (lpString=".doc") returned 4 [0116.829] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0116.829] lstrlenW (lpString=".docx") returned 5 [0116.829] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0116.829] lstrlenW (lpString=".pdf") returned 4 [0116.829] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0116.829] lstrlenW (lpString=".xls") returned 4 [0116.829] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0116.829] lstrlenW (lpString=".xlsx") returned 5 [0116.829] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0116.829] lstrlenW (lpString=".ppt") returned 4 [0116.829] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0116.829] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui") returned 76 [0116.829] lstrlenW (lpString=".zip") returned 4 [0116.829] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0116.829] lstrlenW (lpString=".rar") returned 4 [0116.829] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0116.829] lstrlenW (lpString=".bz2") returned 4 [0116.829] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0116.829] lstrlenW (lpString=".7z") returned 3 [0116.829] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0116.829] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui") returned 76 [0116.829] lstrlenW (lpString=".dbf") returned 4 [0116.829] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0116.829] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui") returned 76 [0116.829] lstrlenW (lpString=".1cd") returned 4 [0116.839] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0116.839] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui") returned 76 [0116.839] lstrlenW (lpString=".jpg") returned 4 [0116.839] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0116.839] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui") returned 76 [0116.839] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui") returned 76 [0116.839] lstrlenW (lpString=".doc") returned 4 [0116.839] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0116.839] lstrlenW (lpString=".docx") returned 5 [0116.839] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0116.839] lstrlenW (lpString=".pdf") returned 4 [0116.839] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0116.839] lstrlenW (lpString=".xls") returned 4 [0116.839] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0116.839] lstrlenW (lpString=".xlsx") returned 5 [0116.839] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0116.839] lstrlenW (lpString=".ppt") returned 4 [0116.839] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0116.839] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui") returned 76 [0116.839] lstrlenW (lpString=".zip") returned 4 [0116.839] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0116.839] lstrlenW (lpString=".rar") returned 4 [0116.839] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0116.839] lstrlenW (lpString=".bz2") returned 4 [0116.839] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0116.839] lstrlenW (lpString=".7z") returned 3 [0116.839] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0116.839] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui") returned 76 [0116.839] lstrlenW (lpString=".dbf") returned 4 [0116.839] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0116.839] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui") returned 76 [0116.839] lstrlenW (lpString=".1cd") returned 4 [0116.839] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0116.839] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui") returned 76 [0116.839] lstrlenW (lpString=".jpg") returned 4 [0116.839] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0116.839] lstrcmpiW (lpString1=".exe", lpString2=".waifu") returned -1 [0116.839] lstrlenW (lpString="msinfo32.exe") returned 12 [0116.839] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\msinfo32.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\msinfo32.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0116.840] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x292f944 | out: lpFileSize=0x292f944*=378880) returned 1 [0116.840] CloseHandle (hObject=0x1d8) returned 1 [0116.840] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\msinfo32.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\msinfo32.exe")) returned 0x20 [0116.840] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\msinfo32.exe.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\msinfo32.exe.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0116.840] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\msinfo32.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\msinfo32.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0116.840] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\msinfo32.exe") returned 66 [0116.840] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\msinfo32.exe") returned 66 [0116.840] lstrlenW (lpString=".doc") returned 4 [0116.840] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0116.840] lstrlenW (lpString=".docx") returned 5 [0116.840] lstrcmpiW (lpString1=".docx", lpString2="2.exe") returned -1 [0116.840] lstrlenW (lpString=".pdf") returned 4 [0116.840] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0116.840] lstrlenW (lpString=".xls") returned 4 [0116.840] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0116.840] lstrlenW (lpString=".xlsx") returned 5 [0116.840] lstrcmpiW (lpString1=".xlsx", lpString2="2.exe") returned -1 [0116.840] lstrlenW (lpString=".ppt") returned 4 [0116.840] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0116.840] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\msinfo32.exe") returned 66 [0116.840] lstrlenW (lpString=".zip") returned 4 [0116.840] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0116.841] lstrlenW (lpString=".rar") returned 4 [0116.841] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0116.841] lstrlenW (lpString=".bz2") returned 4 [0116.841] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0116.841] lstrlenW (lpString=".7z") returned 3 [0116.841] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0116.841] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\msinfo32.exe") returned 66 [0116.841] lstrlenW (lpString=".dbf") returned 4 [0116.841] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0116.841] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x292f944 | out: lpFileSize=0x292f944*=198056) returned 1 [0116.841] CloseHandle (hObject=0x1d8) returned 1 [0116.841] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\aceintl.dll")) returned 0x20 [0116.841] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\aceintl.dll.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0116.841] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\aceintl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0116.841] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x292f8f0 | out: lpNewFilePointer=0x0) returned 1 [0116.841] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x292f8f0 | out: lpNewFilePointer=0x0) returned 1 [0116.841] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\aceintl.dll.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0116.842] GetLastError () returned 0x0 [0116.842] ReadFile (in: hFile=0x1d8, lpBuffer=0x3be0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x292f8fc, lpOverlapped=0x0 | out: lpBuffer=0x3be0020*, lpNumberOfBytesRead=0x292f8fc*=0x305a8, lpOverlapped=0x0) returned 1 [0117.335] WriteFile (in: hFile=0x1fc, lpBuffer=0x3be0020*, nNumberOfBytesToWrite=0x305b0, lpNumberOfBytesWritten=0x292f6c4, lpOverlapped=0x0 | out: lpBuffer=0x3be0020*, lpNumberOfBytesWritten=0x292f6c4*=0x305b0, lpOverlapped=0x0) returned 1 [0117.338] ReadFile (in: hFile=0x1d8, lpBuffer=0x3be0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x292f8fc, lpOverlapped=0x0 | out: lpBuffer=0x3be0020*, lpNumberOfBytesRead=0x292f8fc*=0x0, lpOverlapped=0x0) returned 1 [0117.338] WriteFile (in: hFile=0x1fc, lpBuffer=0x3be0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x292f6c4, lpOverlapped=0x0 | out: lpBuffer=0x3be0020*, lpNumberOfBytesWritten=0x292f6c4*=0xea, lpOverlapped=0x0) returned 1 [0117.338] SetEndOfFile (hFile=0x1fc) returned 1 [0117.338] CloseHandle (hObject=0x1fc) returned 1 [0117.338] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x292f8f0 | out: lpNewFilePointer=0x0) returned 1 [0117.339] SetEndOfFile (hFile=0x1d8) returned 1 [0117.340] CloseHandle (hObject=0x1d8) returned 1 [0117.340] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0117.340] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\aceintl.dll")) returned 1 [0117.340] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL") returned 72 [0117.340] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL") returned 72 [0117.340] lstrlenW (lpString=".doc") returned 4 [0117.341] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0117.341] lstrlenW (lpString=".docx") returned 5 [0117.341] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0117.341] lstrlenW (lpString=".pdf") returned 4 [0117.341] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0117.341] lstrlenW (lpString=".xls") returned 4 [0117.341] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0117.341] lstrlenW (lpString=".xlsx") returned 5 [0117.341] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0117.341] lstrlenW (lpString=".ppt") returned 4 [0117.341] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0117.341] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL") returned 72 [0117.341] lstrlenW (lpString=".zip") returned 4 [0117.341] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0117.341] lstrlenW (lpString=".rar") returned 4 [0117.341] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0117.341] lstrlenW (lpString=".bz2") returned 4 [0117.341] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0117.341] lstrlenW (lpString=".7z") returned 3 [0117.341] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0117.341] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL") returned 72 [0117.341] lstrlenW (lpString=".dbf") returned 4 [0117.341] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0117.341] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL") returned 72 [0117.341] lstrlenW (lpString=".1cd") returned 4 [0117.341] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0117.341] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL") returned 72 [0117.341] lstrlenW (lpString=".jpg") returned 4 [0117.342] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0117.342] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL") returned 72 [0117.342] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL") returned 72 [0117.342] lstrlenW (lpString=".doc") returned 4 [0117.342] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0117.342] lstrlenW (lpString=".docx") returned 5 [0117.342] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0117.342] lstrlenW (lpString=".pdf") returned 4 [0117.342] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0117.342] lstrlenW (lpString=".xls") returned 4 [0117.342] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0117.342] lstrlenW (lpString=".xlsx") returned 5 [0117.342] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0117.342] lstrlenW (lpString=".ppt") returned 4 [0117.342] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0117.342] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL") returned 72 [0117.342] lstrlenW (lpString=".zip") returned 4 [0117.342] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0117.342] lstrlenW (lpString=".rar") returned 4 [0117.342] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0117.342] lstrlenW (lpString=".bz2") returned 4 [0117.342] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0117.342] lstrlenW (lpString=".7z") returned 3 [0117.342] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0117.342] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL") returned 72 [0117.342] lstrlenW (lpString=".dbf") returned 4 [0117.342] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0117.342] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL") returned 72 [0117.343] lstrlenW (lpString=".1cd") returned 4 [0117.343] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0117.343] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL") returned 72 [0117.343] lstrlenW (lpString=".jpg") returned 4 [0117.343] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0117.343] lstrcmpiW (lpString1=".DLL", lpString2=".waifu") returned -1 [0117.343] lstrlenW (lpString="ACEWSTR.DLL") returned 11 [0117.343] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\acewstr.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0117.344] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x292f944 | out: lpFileSize=0x292f944*=862608) returned 1 [0117.344] CloseHandle (hObject=0x1d8) returned 1 [0117.344] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\acewstr.dll")) returned 0x20 [0117.344] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\acewstr.dll.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0117.344] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\acewstr.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0117.344] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x292f8f0 | out: lpNewFilePointer=0x0) returned 1 [0117.344] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x292f8f0 | out: lpNewFilePointer=0x0) returned 1 [0117.344] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\acewstr.dll.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0117.345] GetLastError () returned 0x0 [0117.345] ReadFile (in: hFile=0x1d8, lpBuffer=0x3be0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x292f8fc, lpOverlapped=0x0 | out: lpBuffer=0x3be0020*, lpNumberOfBytesRead=0x292f8fc*=0xd2990, lpOverlapped=0x0) returned 1 [0117.387] WriteFile (in: hFile=0x1fc, lpBuffer=0x3be0020*, nNumberOfBytesToWrite=0xd29a0, lpNumberOfBytesWritten=0x292f6c4, lpOverlapped=0x0 | out: lpBuffer=0x3be0020*, lpNumberOfBytesWritten=0x292f6c4*=0xd29a0, lpOverlapped=0x0) returned 1 [0117.396] ReadFile (in: hFile=0x1d8, lpBuffer=0x3be0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x292f8fc, lpOverlapped=0x0 | out: lpBuffer=0x3be0020*, lpNumberOfBytesRead=0x292f8fc*=0x0, lpOverlapped=0x0) returned 1 [0117.396] WriteFile (in: hFile=0x1fc, lpBuffer=0x3be0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x292f6c4, lpOverlapped=0x0 | out: lpBuffer=0x3be0020*, lpNumberOfBytesWritten=0x292f6c4*=0xea, lpOverlapped=0x0) returned 1 [0117.396] SetEndOfFile (hFile=0x1fc) returned 1 [0117.397] CloseHandle (hObject=0x1fc) returned 1 [0117.397] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x292f8f0 | out: lpNewFilePointer=0x0) returned 1 [0117.397] SetEndOfFile (hFile=0x1d8) returned 1 [0117.399] CloseHandle (hObject=0x1d8) returned 1 [0117.399] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0117.400] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\acewstr.dll")) returned 1 [0117.400] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL") returned 72 [0117.400] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL") returned 72 [0117.400] lstrlenW (lpString=".doc") returned 4 [0117.400] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0117.400] lstrlenW (lpString=".docx") returned 5 [0117.400] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1 [0117.400] lstrlenW (lpString=".pdf") returned 4 [0117.400] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0117.400] lstrlenW (lpString=".xls") returned 4 [0117.400] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0117.400] lstrlenW (lpString=".xlsx") returned 5 [0117.400] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1 [0117.400] lstrlenW (lpString=".ppt") returned 4 [0117.400] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0117.400] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL") returned 72 [0117.400] lstrlenW (lpString=".zip") returned 4 [0117.400] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0117.400] lstrlenW (lpString=".rar") returned 4 [0117.401] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0117.401] lstrlenW (lpString=".bz2") returned 4 [0117.401] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0117.401] lstrlenW (lpString=".7z") returned 3 [0117.401] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0117.401] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL") returned 72 [0117.401] lstrlenW (lpString=".dbf") returned 4 [0117.401] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0117.401] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL") returned 72 [0117.401] lstrlenW (lpString=".1cd") returned 4 [0117.401] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0117.401] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL") returned 72 [0117.401] lstrlenW (lpString=".jpg") returned 4 [0117.401] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0117.401] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL") returned 72 [0117.401] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL") returned 72 [0117.401] lstrlenW (lpString=".doc") returned 4 [0117.401] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0117.401] lstrlenW (lpString=".docx") returned 5 [0117.401] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1 [0117.401] lstrlenW (lpString=".pdf") returned 4 [0117.401] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0117.401] lstrlenW (lpString=".xls") returned 4 [0117.401] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0117.401] lstrlenW (lpString=".xlsx") returned 5 [0117.401] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1 [0117.401] lstrlenW (lpString=".ppt") returned 4 [0117.401] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0117.401] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL") returned 72 [0117.401] lstrlenW (lpString=".zip") returned 4 [0117.401] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0117.401] lstrlenW (lpString=".rar") returned 4 [0117.401] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0117.401] lstrlenW (lpString=".bz2") returned 4 [0117.401] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0117.401] lstrlenW (lpString=".7z") returned 3 [0117.402] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0117.402] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL") returned 72 [0117.402] lstrlenW (lpString=".dbf") returned 4 [0117.402] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0117.402] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL") returned 72 [0117.402] lstrlenW (lpString=".1cd") returned 4 [0117.402] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0117.402] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL") returned 72 [0117.402] lstrlenW (lpString=".jpg") returned 4 [0117.402] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0117.402] lstrcmpiW (lpString1=".DLL", lpString2=".waifu") returned -1 [0117.402] lstrlenW (lpString="MSOINTL.DLL") returned 11 [0117.402] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0117.519] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x292f944 | out: lpFileSize=0x292f944*=2528128) returned 1 [0117.519] CloseHandle (hObject=0x194) returned 1 [0117.519] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.dll")) returned 0x20 [0117.519] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.dll.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0117.520] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.dll.id-9c354b42.[darknes@420blaze.it].waifu")) returned 1 [0117.972] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.dll.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0117.972] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x292f694 | out: lpNewFilePointer=0x0) returned 1 [0117.972] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x292f654 | out: lpNewFilePointer=0x0) returned 1 [0117.972] ReadFile (in: hFile=0x194, lpBuffer=0x3be0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x292f660, lpOverlapped=0x0 | out: lpBuffer=0x3be0058*, lpNumberOfBytesRead=0x292f660*=0x40000, lpOverlapped=0x0) returned 1 [0118.222] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0xcdbd5, lpNewFilePointer=0x0, dwMoveMethod=0x292f654 | out: lpNewFilePointer=0x0) returned 1 [0118.222] ReadFile (in: hFile=0x194, lpBuffer=0x3c20058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x292f660, lpOverlapped=0x0 | out: lpBuffer=0x3c20058*, lpNumberOfBytesRead=0x292f660*=0x40000, lpOverlapped=0x0) returned 1 [0118.684] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x292f694 | out: lpNewFilePointer=0xffffffff) returned 1 [0118.684] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x229380, lpNewFilePointer=0x0, dwMoveMethod=0x292f654 | out: lpNewFilePointer=0x0) returned 1 [0118.684] ReadFile (in: hFile=0x194, lpBuffer=0x3c60058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x292f660, lpOverlapped=0x0 | out: lpBuffer=0x3c60058*, lpNumberOfBytesRead=0x292f660*=0x40000, lpOverlapped=0x0) returned 1 [0118.778] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x292f8f0 | out: lpNewFilePointer=0x0) returned 1 [0118.778] WriteFile (in: hFile=0x194, lpBuffer=0x3be0020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x292f6d8, lpOverlapped=0x0 | out: lpBuffer=0x3be0020*, lpNumberOfBytesWritten=0x292f6d8*=0xc0102, lpOverlapped=0x0) returned 1 [0118.947] SetEndOfFile (hFile=0x194) returned 1 [0118.949] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x292f6a4 | out: lpNewFilePointer=0x0) returned 1 [0118.949] WriteFile (in: hFile=0x194, lpBuffer=0x44c2078*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x292f6b0, lpOverlapped=0x0 | out: lpBuffer=0x44c2078*, lpNumberOfBytesWritten=0x292f6b0*=0x40000, lpOverlapped=0x0) returned 1 [0118.950] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0xcdbd5, lpNewFilePointer=0x0, dwMoveMethod=0x292f6a4 | out: lpNewFilePointer=0x0) returned 1 [0118.950] WriteFile (in: hFile=0x194, lpBuffer=0x44c2078*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x292f6b0, lpOverlapped=0x0 | out: lpBuffer=0x44c2078*, lpNumberOfBytesWritten=0x292f6b0*=0x40000, lpOverlapped=0x0) returned 1 [0118.954] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x229380, lpNewFilePointer=0x0, dwMoveMethod=0x292f6a4 | out: lpNewFilePointer=0x0) returned 1 [0118.954] WriteFile (in: hFile=0x194, lpBuffer=0x44c2078*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x292f6b0, lpOverlapped=0x0 | out: lpBuffer=0x44c2078*, lpNumberOfBytesWritten=0x292f6b0*=0x40000, lpOverlapped=0x0) returned 1 [0118.956] CloseHandle (hObject=0x194) returned 1 [0118.956] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0118.957] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL") returned 72 [0118.957] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL") returned 72 [0118.957] lstrlenW (lpString=".doc") returned 4 [0118.957] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0118.957] lstrlenW (lpString=".docx") returned 5 [0118.957] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0118.957] lstrlenW (lpString=".pdf") returned 4 [0118.957] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0118.957] lstrlenW (lpString=".xls") returned 4 [0118.957] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0118.957] lstrlenW (lpString=".xlsx") returned 5 [0118.957] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0118.957] lstrlenW (lpString=".ppt") returned 4 [0118.957] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0118.957] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL") returned 72 [0118.957] lstrlenW (lpString=".zip") returned 4 [0118.957] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0118.957] lstrlenW (lpString=".rar") returned 4 [0118.957] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0118.957] lstrlenW (lpString=".bz2") returned 4 [0118.957] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0118.957] lstrlenW (lpString=".7z") returned 3 [0118.957] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0118.957] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL") returned 72 [0118.957] lstrlenW (lpString=".dbf") returned 4 [0118.957] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0118.957] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL") returned 72 [0118.957] lstrlenW (lpString=".1cd") returned 4 [0118.957] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0118.957] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL") returned 72 [0118.957] lstrlenW (lpString=".jpg") returned 4 [0118.957] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0118.957] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL") returned 72 [0118.957] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL") returned 72 [0118.957] lstrlenW (lpString=".doc") returned 4 [0118.957] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0118.957] lstrlenW (lpString=".docx") returned 5 [0118.958] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0118.958] lstrlenW (lpString=".pdf") returned 4 [0118.958] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0118.958] lstrlenW (lpString=".xls") returned 4 [0118.958] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0118.958] lstrlenW (lpString=".xlsx") returned 5 [0118.958] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0118.958] lstrlenW (lpString=".ppt") returned 4 [0118.958] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0118.958] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL") returned 72 [0118.958] lstrlenW (lpString=".zip") returned 4 [0118.958] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0118.958] lstrlenW (lpString=".rar") returned 4 [0118.958] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0118.958] lstrlenW (lpString=".bz2") returned 4 [0118.958] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0118.958] lstrlenW (lpString=".7z") returned 3 [0118.958] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0118.958] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL") returned 72 [0118.958] lstrlenW (lpString=".dbf") returned 4 [0118.958] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0118.958] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL") returned 72 [0118.958] lstrlenW (lpString=".1cd") returned 4 [0118.958] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0118.958] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL") returned 72 [0118.958] lstrlenW (lpString=".jpg") returned 4 [0118.958] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0118.958] lstrcmpiW (lpString1=".DLL", lpString2=".waifu") returned -1 [0118.958] lstrlenW (lpString="ACEODEXL.DLL") returned 12 [0118.958] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodexl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0119.190] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x292f944 | out: lpFileSize=0x292f944*=15800) returned 1 [0119.190] CloseHandle (hObject=0x1ec) returned 1 [0119.190] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodexl.dll")) returned 0x20 [0119.190] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodexl.dll.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0119.190] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodexl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0119.190] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x292f8f0 | out: lpNewFilePointer=0x0) returned 1 [0119.190] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x292f8f0 | out: lpNewFilePointer=0x0) returned 1 [0119.191] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodexl.dll.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0119.191] GetLastError () returned 0x0 [0119.191] ReadFile (in: hFile=0x1ec, lpBuffer=0x3be0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x292f8fc, lpOverlapped=0x0 | out: lpBuffer=0x3be0020*, lpNumberOfBytesRead=0x292f8fc*=0x3db8, lpOverlapped=0x0) returned 1 [0119.192] WriteFile (in: hFile=0x1b0, lpBuffer=0x3be0020*, nNumberOfBytesToWrite=0x3dc0, lpNumberOfBytesWritten=0x292f6c4, lpOverlapped=0x0 | out: lpBuffer=0x3be0020*, lpNumberOfBytesWritten=0x292f6c4*=0x3dc0, lpOverlapped=0x0) returned 1 [0119.193] ReadFile (in: hFile=0x1ec, lpBuffer=0x3be0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x292f8fc, lpOverlapped=0x0 | out: lpBuffer=0x3be0020*, lpNumberOfBytesRead=0x292f8fc*=0x0, lpOverlapped=0x0) returned 1 [0119.193] WriteFile (in: hFile=0x1b0, lpBuffer=0x3be0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x292f6c4, lpOverlapped=0x0 | out: lpBuffer=0x3be0020*, lpNumberOfBytesWritten=0x292f6c4*=0xec, lpOverlapped=0x0) returned 1 [0119.193] SetEndOfFile (hFile=0x1b0) returned 1 [0119.193] CloseHandle (hObject=0x1b0) returned 1 [0119.193] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x292f8f0 | out: lpNewFilePointer=0x0) returned 1 [0119.193] SetEndOfFile (hFile=0x1ec) returned 1 [0119.194] CloseHandle (hObject=0x1ec) returned 1 [0119.194] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0119.194] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodexl.dll")) returned 1 [0119.194] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL") returned 68 [0119.194] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL") returned 68 [0119.194] lstrlenW (lpString=".doc") returned 4 [0119.194] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0119.194] lstrlenW (lpString=".docx") returned 5 [0119.194] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0119.194] lstrlenW (lpString=".pdf") returned 4 [0119.194] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0119.194] lstrlenW (lpString=".xls") returned 4 [0119.194] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0119.195] lstrlenW (lpString=".xlsx") returned 5 [0119.195] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0119.195] lstrlenW (lpString=".ppt") returned 4 [0119.195] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0119.195] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL") returned 68 [0119.195] lstrlenW (lpString=".zip") returned 4 [0119.195] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0119.195] lstrlenW (lpString=".rar") returned 4 [0119.195] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0119.195] lstrlenW (lpString=".bz2") returned 4 [0119.195] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0119.195] lstrlenW (lpString=".7z") returned 3 [0119.195] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0119.195] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL") returned 68 [0119.195] lstrlenW (lpString=".dbf") returned 4 [0119.195] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0119.195] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL") returned 68 [0119.195] lstrlenW (lpString=".1cd") returned 4 [0119.195] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0119.195] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL") returned 68 [0119.195] lstrlenW (lpString=".jpg") returned 4 [0119.195] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0119.195] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL") returned 68 [0119.195] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL") returned 68 [0119.195] lstrlenW (lpString=".doc") returned 4 [0119.195] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0119.195] lstrlenW (lpString=".docx") returned 5 [0119.195] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0119.195] lstrlenW (lpString=".pdf") returned 4 [0119.195] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0119.195] lstrlenW (lpString=".xls") returned 4 [0119.195] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0119.195] lstrlenW (lpString=".xlsx") returned 5 [0119.195] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0119.195] lstrlenW (lpString=".ppt") returned 4 [0119.195] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0119.195] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL") returned 68 [0119.195] lstrlenW (lpString=".zip") returned 4 [0119.195] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0119.195] lstrlenW (lpString=".rar") returned 4 [0119.195] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0119.195] lstrlenW (lpString=".bz2") returned 4 [0119.195] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0119.195] lstrlenW (lpString=".7z") returned 3 [0119.195] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0119.195] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL") returned 68 [0119.195] lstrlenW (lpString=".dbf") returned 4 [0119.195] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0119.195] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL") returned 68 [0119.195] lstrlenW (lpString=".1cd") returned 4 [0119.196] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0119.196] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL") returned 68 [0119.196] lstrlenW (lpString=".jpg") returned 4 [0119.196] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0119.196] lstrcmpiW (lpString1=".DLL", lpString2=".waifu") returned -1 [0119.196] lstrlenW (lpString="ACEODTXT.DLL") returned 12 [0119.196] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodtxt.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0119.196] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x292f944 | out: lpFileSize=0x292f944*=15800) returned 1 [0119.196] CloseHandle (hObject=0x1ec) returned 1 [0119.196] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodtxt.dll")) returned 0x20 [0119.196] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodtxt.dll.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0119.196] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodtxt.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0119.196] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x292f8f0 | out: lpNewFilePointer=0x0) returned 1 [0119.197] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x292f8f0 | out: lpNewFilePointer=0x0) returned 1 [0119.197] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodtxt.dll.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0119.197] GetLastError () returned 0x0 [0119.197] ReadFile (in: hFile=0x1ec, lpBuffer=0x3be0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x292f8fc, lpOverlapped=0x0 | out: lpBuffer=0x3be0020*, lpNumberOfBytesRead=0x292f8fc*=0x3db8, lpOverlapped=0x0) returned 1 [0119.229] WriteFile (in: hFile=0x1b0, lpBuffer=0x3be0020*, nNumberOfBytesToWrite=0x3dc0, lpNumberOfBytesWritten=0x292f6c4, lpOverlapped=0x0 | out: lpBuffer=0x3be0020*, lpNumberOfBytesWritten=0x292f6c4*=0x3dc0, lpOverlapped=0x0) returned 1 [0119.230] ReadFile (in: hFile=0x1ec, lpBuffer=0x3be0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x292f8fc, lpOverlapped=0x0 | out: lpBuffer=0x3be0020*, lpNumberOfBytesRead=0x292f8fc*=0x0, lpOverlapped=0x0) returned 1 [0119.230] WriteFile (in: hFile=0x1b0, lpBuffer=0x3be0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x292f6c4, lpOverlapped=0x0 | out: lpBuffer=0x3be0020*, lpNumberOfBytesWritten=0x292f6c4*=0xec, lpOverlapped=0x0) returned 1 [0119.230] SetEndOfFile (hFile=0x1b0) returned 1 [0119.276] CloseHandle (hObject=0x1b0) returned 1 [0119.276] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x292f8f0 | out: lpNewFilePointer=0x0) returned 1 [0119.276] SetEndOfFile (hFile=0x1ec) returned 1 [0119.277] CloseHandle (hObject=0x1ec) returned 1 [0119.277] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0119.277] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodtxt.dll")) returned 1 [0119.277] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL") returned 68 [0119.277] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL") returned 68 [0119.277] lstrlenW (lpString=".doc") returned 4 [0119.277] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0119.277] lstrlenW (lpString=".docx") returned 5 [0119.277] lstrcmpiW (lpString1=".docx", lpString2="T.DLL") returned -1 [0119.277] lstrlenW (lpString=".pdf") returned 4 [0119.277] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0119.277] lstrlenW (lpString=".xls") returned 4 [0119.277] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0119.277] lstrlenW (lpString=".xlsx") returned 5 [0119.277] lstrcmpiW (lpString1=".xlsx", lpString2="T.DLL") returned -1 [0119.277] lstrlenW (lpString=".ppt") returned 4 [0119.277] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0119.277] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL") returned 68 [0119.277] lstrlenW (lpString=".zip") returned 4 [0119.277] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0119.277] lstrlenW (lpString=".rar") returned 4 [0119.277] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0119.277] lstrlenW (lpString=".bz2") returned 4 [0119.277] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0119.278] lstrlenW (lpString=".7z") returned 3 [0119.278] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0119.278] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL") returned 68 [0119.278] lstrlenW (lpString=".dbf") returned 4 [0119.278] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0119.278] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL") returned 68 [0119.278] lstrlenW (lpString=".1cd") returned 4 [0119.278] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0119.278] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL") returned 68 [0119.278] lstrlenW (lpString=".jpg") returned 4 [0119.278] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0119.278] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL") returned 68 [0119.278] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL") returned 68 [0119.278] lstrlenW (lpString=".doc") returned 4 [0119.278] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0119.278] lstrlenW (lpString=".docx") returned 5 [0119.278] lstrcmpiW (lpString1=".docx", lpString2="T.DLL") returned -1 [0119.278] lstrlenW (lpString=".pdf") returned 4 [0119.278] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0119.278] lstrlenW (lpString=".xls") returned 4 [0119.278] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0119.278] lstrlenW (lpString=".xlsx") returned 5 [0119.278] lstrcmpiW (lpString1=".xlsx", lpString2="T.DLL") returned -1 [0119.278] lstrlenW (lpString=".ppt") returned 4 [0119.278] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0119.278] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL") returned 68 [0119.278] lstrlenW (lpString=".zip") returned 4 [0119.278] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0119.278] lstrlenW (lpString=".rar") returned 4 [0119.278] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0119.278] lstrlenW (lpString=".bz2") returned 4 [0119.278] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0119.278] lstrlenW (lpString=".7z") returned 3 [0119.278] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0119.278] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL") returned 68 [0119.278] lstrlenW (lpString=".dbf") returned 4 [0119.278] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0119.278] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL") returned 68 [0119.278] lstrlenW (lpString=".1cd") returned 4 [0119.278] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0119.278] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL") returned 68 [0119.278] lstrlenW (lpString=".jpg") returned 4 [0119.278] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0119.278] lstrcmpiW (lpString1=".DLL", lpString2=".waifu") returned -1 [0119.278] lstrlenW (lpString="ACERCLR.DLL") returned 11 [0119.279] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACERCLR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acerclr.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0119.280] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x292f944 | out: lpFileSize=0x292f944*=55744) returned 1 [0119.280] CloseHandle (hObject=0x1ec) returned 1 [0119.280] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACERCLR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acerclr.dll")) returned 0x20 [0119.281] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACERCLR.DLL.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acerclr.dll.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0119.281] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACERCLR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acerclr.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0119.281] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x292f8f0 | out: lpNewFilePointer=0x0) returned 1 [0119.281] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x292f8f0 | out: lpNewFilePointer=0x0) returned 1 [0119.281] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACERCLR.DLL.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acerclr.dll.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0119.281] GetLastError () returned 0x0 [0119.281] ReadFile (in: hFile=0x1ec, lpBuffer=0x3be0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x292f8fc, lpOverlapped=0x0 | out: lpBuffer=0x3be0020*, lpNumberOfBytesRead=0x292f8fc*=0xd9c0, lpOverlapped=0x0) returned 1 [0119.456] WriteFile (in: hFile=0x1b0, lpBuffer=0x3be0020*, nNumberOfBytesToWrite=0xd9d0, lpNumberOfBytesWritten=0x292f6c4, lpOverlapped=0x0 | out: lpBuffer=0x3be0020*, lpNumberOfBytesWritten=0x292f6c4*=0xd9d0, lpOverlapped=0x0) returned 1 [0119.457] ReadFile (in: hFile=0x1ec, lpBuffer=0x3be0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x292f8fc, lpOverlapped=0x0 | out: lpBuffer=0x3be0020*, lpNumberOfBytesRead=0x292f8fc*=0x0, lpOverlapped=0x0) returned 1 [0119.457] WriteFile (in: hFile=0x1b0, lpBuffer=0x3be0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x292f6c4, lpOverlapped=0x0 | out: lpBuffer=0x3be0020*, lpNumberOfBytesWritten=0x292f6c4*=0xea, lpOverlapped=0x0) returned 1 [0119.458] SetEndOfFile (hFile=0x1b0) returned 1 [0119.458] CloseHandle (hObject=0x1b0) returned 1 [0119.458] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x292f8f0 | out: lpNewFilePointer=0x0) returned 1 [0119.458] SetEndOfFile (hFile=0x1ec) returned 1 [0119.458] CloseHandle (hObject=0x1ec) returned 1 [0119.458] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACERCLR.DLL.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0119.459] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACERCLR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acerclr.dll")) returned 1 [0119.459] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACERCLR.DLL") returned 67 [0119.459] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACERCLR.DLL") returned 67 [0119.459] lstrlenW (lpString=".doc") returned 4 [0119.459] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0119.459] lstrlenW (lpString=".docx") returned 5 [0119.459] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1 [0119.459] lstrlenW (lpString=".pdf") returned 4 [0119.459] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0119.459] lstrlenW (lpString=".xls") returned 4 [0119.459] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0119.459] lstrlenW (lpString=".xlsx") returned 5 [0119.459] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1 [0119.459] lstrlenW (lpString=".ppt") returned 4 [0119.459] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0119.459] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACERCLR.DLL") returned 67 [0119.459] lstrlenW (lpString=".zip") returned 4 [0119.459] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0119.459] lstrlenW (lpString=".rar") returned 4 [0119.459] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0119.459] lstrlenW (lpString=".bz2") returned 4 [0119.459] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0119.459] lstrlenW (lpString=".7z") returned 3 [0119.459] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0119.460] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACERCLR.DLL") returned 67 [0119.460] lstrlenW (lpString=".dbf") returned 4 [0119.460] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0119.460] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACERCLR.DLL") returned 67 [0119.460] lstrlenW (lpString=".1cd") returned 4 [0119.460] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0119.460] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACERCLR.DLL") returned 67 [0119.460] lstrlenW (lpString=".jpg") returned 4 [0119.460] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0119.460] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACERCLR.DLL") returned 67 [0119.460] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACERCLR.DLL") returned 67 [0119.460] lstrlenW (lpString=".doc") returned 4 [0119.460] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0119.460] lstrlenW (lpString=".docx") returned 5 [0119.460] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1 [0119.460] lstrlenW (lpString=".pdf") returned 4 [0119.460] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0119.460] lstrlenW (lpString=".xls") returned 4 [0119.460] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0119.460] lstrlenW (lpString=".xlsx") returned 5 [0119.460] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1 [0119.460] lstrlenW (lpString=".ppt") returned 4 [0119.460] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0119.460] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACERCLR.DLL") returned 67 [0119.460] lstrlenW (lpString=".zip") returned 4 [0119.460] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0119.460] lstrlenW (lpString=".rar") returned 4 [0119.460] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0119.460] lstrlenW (lpString=".bz2") returned 4 [0119.460] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0119.460] lstrlenW (lpString=".7z") returned 3 [0119.460] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0119.460] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACERCLR.DLL") returned 67 [0119.460] lstrlenW (lpString=".dbf") returned 4 [0119.460] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0119.460] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACERCLR.DLL") returned 67 [0119.460] lstrlenW (lpString=".1cd") returned 4 [0119.460] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0119.460] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACERCLR.DLL") returned 67 [0119.460] lstrlenW (lpString=".jpg") returned 4 [0119.460] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0119.460] lstrcmpiW (lpString1=".dll", lpString2=".waifu") returned -1 [0119.460] lstrlenW (lpString="Csi.dll") returned 7 [0119.460] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Csi.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\csi.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0119.463] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x292f944 | out: lpFileSize=0x292f944*=5072816) returned 1 [0119.463] CloseHandle (hObject=0x1ec) returned 1 [0119.463] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Csi.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\csi.dll")) returned 0x20 [0119.463] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Csi.dll.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\csi.dll.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0119.463] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Csi.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\csi.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Csi.dll.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\csi.dll.id-9c354b42.[darknes@420blaze.it].waifu")) returned 1 [0119.464] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Csi.dll.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\csi.dll.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0119.464] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x292f694 | out: lpNewFilePointer=0x0) returned 1 [0119.464] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x292f654 | out: lpNewFilePointer=0x0) returned 1 [0119.464] ReadFile (in: hFile=0x1ec, lpBuffer=0x3be0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x292f660, lpOverlapped=0x0 | out: lpBuffer=0x3be0058*, lpNumberOfBytesRead=0x292f660*=0x40000, lpOverlapped=0x0) returned 1 [0120.180] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x19cd3a, lpNewFilePointer=0x0, dwMoveMethod=0x292f654 | out: lpNewFilePointer=0x0) returned 1 [0120.180] ReadFile (in: hFile=0x1ec, lpBuffer=0x3c20058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x292f660, lpOverlapped=0x0 | out: lpBuffer=0x3c20058*, lpNumberOfBytesRead=0x292f660*=0x40000, lpOverlapped=0x0) returned 1 [0120.284] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x292f694 | out: lpNewFilePointer=0xffffffff) returned 1 [0120.284] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x4967b0, lpNewFilePointer=0x0, dwMoveMethod=0x292f654 | out: lpNewFilePointer=0x0) returned 1 [0120.284] ReadFile (in: hFile=0x1ec, lpBuffer=0x3c60058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x292f660, lpOverlapped=0x0 | out: lpBuffer=0x3c60058*, lpNumberOfBytesRead=0x292f660*=0x40000, lpOverlapped=0x0) returned 1 [0120.334] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x292f8f0 | out: lpNewFilePointer=0x0) returned 1 [0120.334] WriteFile (in: hFile=0x1ec, lpBuffer=0x3be0020*, nNumberOfBytesToWrite=0xc00fa, lpNumberOfBytesWritten=0x292f6d8, lpOverlapped=0x0 | out: lpBuffer=0x3be0020*, lpNumberOfBytesWritten=0x292f6d8*=0xc00fa, lpOverlapped=0x0) returned 1 [0120.342] SetEndOfFile (hFile=0x1ec) returned 1 [0120.448] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x292f6a4 | out: lpNewFilePointer=0x0) returned 1 [0120.448] WriteFile (in: hFile=0x1ec, lpBuffer=0x44c2078*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x292f6b0, lpOverlapped=0x0 | out: lpBuffer=0x44c2078*, lpNumberOfBytesWritten=0x292f6b0*=0x40000, lpOverlapped=0x0) returned 1 [0120.449] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x19cd3a, lpNewFilePointer=0x0, dwMoveMethod=0x292f6a4 | out: lpNewFilePointer=0x0) returned 1 [0120.449] WriteFile (in: hFile=0x1ec, lpBuffer=0x44c2078*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x292f6b0, lpOverlapped=0x0 | out: lpBuffer=0x44c2078*, lpNumberOfBytesWritten=0x292f6b0*=0x40000, lpOverlapped=0x0) returned 1 [0120.451] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x4967b0, lpNewFilePointer=0x0, dwMoveMethod=0x292f6a4 | out: lpNewFilePointer=0x0) returned 1 [0120.451] WriteFile (in: hFile=0x1ec, lpBuffer=0x44c2078*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x292f6b0, lpOverlapped=0x0 | out: lpBuffer=0x44c2078*, lpNumberOfBytesWritten=0x292f6b0*=0x40000, lpOverlapped=0x0) returned 1 [0120.452] CloseHandle (hObject=0x1ec) returned 1 [0120.452] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Csi.dll.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0120.452] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Csi.dll") returned 63 [0120.452] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Csi.dll") returned 63 [0120.453] lstrlenW (lpString=".doc") returned 4 [0120.453] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0120.453] lstrlenW (lpString=".docx") returned 5 [0120.453] lstrcmpiW (lpString1=".docx", lpString2="i.dll") returned -1 [0120.453] lstrlenW (lpString=".pdf") returned 4 [0120.453] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0120.453] lstrlenW (lpString=".xls") returned 4 [0120.453] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0120.453] lstrlenW (lpString=".xlsx") returned 5 [0120.453] lstrcmpiW (lpString1=".xlsx", lpString2="i.dll") returned -1 [0120.453] lstrlenW (lpString=".ppt") returned 4 [0120.453] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0120.453] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Csi.dll") returned 63 [0120.453] lstrlenW (lpString=".zip") returned 4 [0120.453] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0120.453] lstrlenW (lpString=".rar") returned 4 [0120.453] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0120.453] lstrlenW (lpString=".bz2") returned 4 [0120.453] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0120.453] lstrlenW (lpString=".7z") returned 3 [0120.453] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0120.453] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Csi.dll") returned 63 [0120.453] lstrlenW (lpString=".dbf") returned 4 [0120.453] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0120.453] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Csi.dll") returned 63 [0120.453] lstrlenW (lpString=".1cd") returned 4 [0120.453] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0120.453] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Csi.dll") returned 63 [0120.453] lstrlenW (lpString=".jpg") returned 4 [0120.453] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0120.453] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Csi.dll") returned 63 [0120.453] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Csi.dll") returned 63 [0120.453] lstrlenW (lpString=".doc") returned 4 [0120.453] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0120.453] lstrlenW (lpString=".docx") returned 5 [0120.453] lstrcmpiW (lpString1=".docx", lpString2="i.dll") returned -1 [0120.453] lstrlenW (lpString=".pdf") returned 4 [0120.453] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0120.453] lstrlenW (lpString=".xls") returned 4 [0120.453] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0120.453] lstrlenW (lpString=".xlsx") returned 5 [0120.453] lstrcmpiW (lpString1=".xlsx", lpString2="i.dll") returned -1 [0120.453] lstrlenW (lpString=".ppt") returned 4 [0120.453] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0120.453] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Csi.dll") returned 63 [0120.453] lstrlenW (lpString=".zip") returned 4 [0120.453] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0120.453] lstrlenW (lpString=".rar") returned 4 [0120.453] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0120.453] lstrlenW (lpString=".bz2") returned 4 [0120.454] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0120.454] lstrlenW (lpString=".7z") returned 3 [0120.454] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0120.454] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Csi.dll") returned 63 [0120.454] lstrlenW (lpString=".dbf") returned 4 [0120.454] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0120.454] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Csi.dll") returned 63 [0120.454] lstrlenW (lpString=".1cd") returned 4 [0120.454] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0120.454] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Csi.dll") returned 63 [0120.454] lstrlenW (lpString=".jpg") returned 4 [0120.454] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0120.454] lstrcmpiW (lpString1=".exe", lpString2=".waifu") returned -1 [0120.454] lstrlenW (lpString="Oarpmany.exe") returned 12 [0120.454] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\oarpmany.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0120.499] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x292f944 | out: lpFileSize=0x292f944*=232840) returned 1 [0120.499] CloseHandle (hObject=0x1f8) returned 1 [0120.499] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\oarpmany.exe")) returned 0x20 [0120.499] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\oarpmany.exe.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0120.499] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\oarpmany.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0120.499] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x292f8f0 | out: lpNewFilePointer=0x0) returned 1 [0120.499] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x292f8f0 | out: lpNewFilePointer=0x0) returned 1 [0120.499] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\oarpmany.exe.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0120.500] GetLastError () returned 0x0 [0120.500] ReadFile (in: hFile=0x1f8, lpBuffer=0x3be0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x292f8fc, lpOverlapped=0x0 | out: lpBuffer=0x3be0020*, lpNumberOfBytesRead=0x292f8fc*=0x38d88, lpOverlapped=0x0) returned 1 [0120.512] WriteFile (in: hFile=0x1f4, lpBuffer=0x3be0020*, nNumberOfBytesToWrite=0x38d90, lpNumberOfBytesWritten=0x292f6c4, lpOverlapped=0x0 | out: lpBuffer=0x3be0020*, lpNumberOfBytesWritten=0x292f6c4*=0x38d90, lpOverlapped=0x0) returned 1 [0120.514] ReadFile (in: hFile=0x1f8, lpBuffer=0x3be0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x292f8fc, lpOverlapped=0x0 | out: lpBuffer=0x3be0020*, lpNumberOfBytesRead=0x292f8fc*=0x0, lpOverlapped=0x0) returned 1 [0120.514] WriteFile (in: hFile=0x1f4, lpBuffer=0x3be0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x292f6c4, lpOverlapped=0x0 | out: lpBuffer=0x3be0020*, lpNumberOfBytesWritten=0x292f6c4*=0xec, lpOverlapped=0x0) returned 1 [0120.514] SetEndOfFile (hFile=0x1f4) returned 1 [0120.514] CloseHandle (hObject=0x1f4) returned 1 [0120.514] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x292f8f0 | out: lpNewFilePointer=0x0) returned 1 [0120.514] SetEndOfFile (hFile=0x1f8) returned 1 [0120.515] CloseHandle (hObject=0x1f8) returned 1 [0120.515] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0120.515] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\oarpmany.exe")) returned 1 [0120.515] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe") returned 68 [0120.515] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe") returned 68 [0120.515] lstrlenW (lpString=".doc") returned 4 [0120.515] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0120.515] lstrlenW (lpString=".docx") returned 5 [0120.516] lstrcmpiW (lpString1=".docx", lpString2="y.exe") returned -1 [0120.516] lstrlenW (lpString=".pdf") returned 4 [0120.516] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0120.516] lstrlenW (lpString=".xls") returned 4 [0120.516] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0120.516] lstrlenW (lpString=".xlsx") returned 5 [0120.516] lstrcmpiW (lpString1=".xlsx", lpString2="y.exe") returned -1 [0120.516] lstrlenW (lpString=".ppt") returned 4 [0120.516] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0120.516] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe") returned 68 [0120.516] lstrlenW (lpString=".zip") returned 4 [0120.516] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0120.516] lstrlenW (lpString=".rar") returned 4 [0120.516] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0120.516] lstrlenW (lpString=".bz2") returned 4 [0120.516] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0120.516] lstrlenW (lpString=".7z") returned 3 [0120.516] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0120.516] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe") returned 68 [0120.516] lstrlenW (lpString=".dbf") returned 4 [0120.516] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0120.516] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe") returned 68 [0120.516] lstrlenW (lpString=".1cd") returned 4 [0120.516] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0120.516] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe") returned 68 [0120.516] lstrlenW (lpString=".jpg") returned 4 [0120.516] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0120.516] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe") returned 68 [0120.516] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe") returned 68 [0120.516] lstrlenW (lpString=".doc") returned 4 [0120.516] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0120.516] lstrlenW (lpString=".docx") returned 5 [0120.516] lstrcmpiW (lpString1=".docx", lpString2="y.exe") returned -1 [0120.516] lstrlenW (lpString=".pdf") returned 4 [0120.516] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0120.516] lstrlenW (lpString=".xls") returned 4 [0120.516] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0120.516] lstrlenW (lpString=".xlsx") returned 5 [0120.516] lstrcmpiW (lpString1=".xlsx", lpString2="y.exe") returned -1 [0120.516] lstrlenW (lpString=".ppt") returned 4 [0120.516] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0120.516] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe") returned 68 [0120.516] lstrlenW (lpString=".zip") returned 4 [0120.516] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0120.516] lstrlenW (lpString=".rar") returned 4 [0120.516] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0120.516] lstrlenW (lpString=".bz2") returned 4 [0120.516] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0120.516] lstrlenW (lpString=".7z") returned 3 [0120.516] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0120.516] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe") returned 68 [0120.517] lstrlenW (lpString=".dbf") returned 4 [0120.517] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0120.517] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe") returned 68 [0120.517] lstrlenW (lpString=".1cd") returned 4 [0120.517] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0120.517] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe") returned 68 [0120.517] lstrlenW (lpString=".jpg") returned 4 [0120.517] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0120.517] lstrcmpiW (lpString1=".DLL", lpString2=".waifu") returned -1 [0120.517] lstrlenW (lpString="BRANDING.DLL") returned 12 [0120.517] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0120.522] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x292f944 | out: lpFileSize=0x292f944*=15224) returned 1 [0120.522] CloseHandle (hObject=0x194) returned 1 [0120.522] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.dll")) returned 0x20 [0120.522] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.DLL.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.dll.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0120.522] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0120.522] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x292f8f0 | out: lpNewFilePointer=0x0) returned 1 [0120.522] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x292f8f0 | out: lpNewFilePointer=0x0) returned 1 [0120.522] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.DLL.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.dll.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0120.523] GetLastError () returned 0x0 [0120.523] ReadFile (in: hFile=0x194, lpBuffer=0x3be0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x292f8fc, lpOverlapped=0x0 | out: lpBuffer=0x3be0020*, lpNumberOfBytesRead=0x292f8fc*=0x3b78, lpOverlapped=0x0) returned 1 [0120.670] WriteFile (in: hFile=0x22c, lpBuffer=0x3be0020*, nNumberOfBytesToWrite=0x3b80, lpNumberOfBytesWritten=0x292f6c4, lpOverlapped=0x0 | out: lpBuffer=0x3be0020*, lpNumberOfBytesWritten=0x292f6c4*=0x3b80, lpOverlapped=0x0) returned 1 [0120.671] ReadFile (in: hFile=0x194, lpBuffer=0x3be0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x292f8fc, lpOverlapped=0x0 | out: lpBuffer=0x3be0020*, lpNumberOfBytesRead=0x292f8fc*=0x0, lpOverlapped=0x0) returned 1 [0120.671] WriteFile (in: hFile=0x22c, lpBuffer=0x3be0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x292f6c4, lpOverlapped=0x0 | out: lpBuffer=0x3be0020*, lpNumberOfBytesWritten=0x292f6c4*=0xec, lpOverlapped=0x0) returned 1 [0120.671] SetEndOfFile (hFile=0x22c) returned 1 [0120.671] CloseHandle (hObject=0x22c) returned 1 [0120.671] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x292f8f0 | out: lpNewFilePointer=0x0) returned 1 [0120.671] SetEndOfFile (hFile=0x194) returned 1 [0120.671] CloseHandle (hObject=0x194) returned 1 [0120.672] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.DLL.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0120.672] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.dll")) returned 1 [0120.672] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.DLL") returned 105 [0120.672] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.DLL") returned 105 [0120.672] lstrlenW (lpString=".doc") returned 4 [0120.672] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0120.672] lstrlenW (lpString=".docx") returned 5 [0120.672] lstrcmpiW (lpString1=".docx", lpString2="G.DLL") returned -1 [0120.672] lstrlenW (lpString=".pdf") returned 4 [0120.672] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0120.672] lstrlenW (lpString=".xls") returned 4 [0120.672] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0120.672] lstrlenW (lpString=".xlsx") returned 5 [0120.672] lstrcmpiW (lpString1=".xlsx", lpString2="G.DLL") returned -1 [0120.672] lstrlenW (lpString=".ppt") returned 4 [0120.672] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0120.672] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.DLL") returned 105 [0120.672] lstrlenW (lpString=".zip") returned 4 [0120.672] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0120.672] lstrlenW (lpString=".rar") returned 4 [0120.672] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0120.672] lstrlenW (lpString=".bz2") returned 4 [0120.672] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0120.672] lstrlenW (lpString=".7z") returned 3 [0120.672] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0120.672] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.DLL") returned 105 [0120.672] lstrlenW (lpString=".dbf") returned 4 [0120.672] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0120.672] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.DLL") returned 105 [0120.672] lstrlenW (lpString=".1cd") returned 4 [0120.672] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0120.672] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.DLL") returned 105 [0120.673] lstrlenW (lpString=".jpg") returned 4 [0120.673] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0120.673] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.DLL") returned 105 [0120.673] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.DLL") returned 105 [0120.673] lstrlenW (lpString=".doc") returned 4 [0120.673] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0120.673] lstrlenW (lpString=".docx") returned 5 [0120.673] lstrcmpiW (lpString1=".docx", lpString2="G.DLL") returned -1 [0120.673] lstrlenW (lpString=".pdf") returned 4 [0120.673] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0120.673] lstrlenW (lpString=".xls") returned 4 [0120.673] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0120.673] lstrlenW (lpString=".xlsx") returned 5 [0120.673] lstrcmpiW (lpString1=".xlsx", lpString2="G.DLL") returned -1 [0120.673] lstrlenW (lpString=".ppt") returned 4 [0120.673] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0120.673] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.DLL") returned 105 [0120.673] lstrlenW (lpString=".zip") returned 4 [0120.673] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0120.673] lstrlenW (lpString=".rar") returned 4 [0120.673] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0120.673] lstrlenW (lpString=".bz2") returned 4 [0120.673] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0120.673] lstrlenW (lpString=".7z") returned 3 [0120.673] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0120.673] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.DLL") returned 105 [0120.673] lstrlenW (lpString=".dbf") returned 4 [0120.673] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0120.673] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.DLL") returned 105 [0120.673] lstrlenW (lpString=".1cd") returned 4 [0120.673] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0120.673] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.DLL") returned 105 [0120.673] lstrlenW (lpString=".jpg") returned 4 [0120.673] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0120.673] lstrcmpiW (lpString1=".dll", lpString2=".waifu") returned -1 [0120.673] lstrlenW (lpString="pidgenx.dll") returned 11 [0120.673] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pidgenx.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\pidgenx.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0120.686] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x292f944 | out: lpFileSize=0x292f944*=1463568) returned 1 [0120.686] CloseHandle (hObject=0x1fc) returned 1 [0120.686] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pidgenx.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\pidgenx.dll")) returned 0x20 [0120.686] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pidgenx.dll.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\pidgenx.dll.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0120.686] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pidgenx.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\pidgenx.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0120.686] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x292f8f0 | out: lpNewFilePointer=0x0) returned 1 [0120.686] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x292f8f0 | out: lpNewFilePointer=0x0) returned 1 [0120.686] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pidgenx.dll.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\pidgenx.dll.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0120.686] GetLastError () returned 0x0 [0120.686] ReadFile (in: hFile=0x1fc, lpBuffer=0x3be0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x292f8fc, lpOverlapped=0x0 | out: lpBuffer=0x3be0020*, lpNumberOfBytesRead=0x292f8fc*=0xffff0, lpOverlapped=0x0) returned 1 [0120.790] WriteFile (in: hFile=0x218, lpBuffer=0x3be0020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x292f6c4, lpOverlapped=0x0 | out: lpBuffer=0x3be0020*, lpNumberOfBytesWritten=0x292f6c4*=0xffff0, lpOverlapped=0x0) returned 1 [0120.848] ReadFile (in: hFile=0x1fc, lpBuffer=0x3be0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x292f8fc, lpOverlapped=0x0 | out: lpBuffer=0x3be0020*, lpNumberOfBytesRead=0x292f8fc*=0x65520, lpOverlapped=0x0) returned 1 [0120.855] WriteFile (in: hFile=0x218, lpBuffer=0x3be0020*, nNumberOfBytesToWrite=0x65530, lpNumberOfBytesWritten=0x292f6c4, lpOverlapped=0x0 | out: lpBuffer=0x3be0020*, lpNumberOfBytesWritten=0x292f6c4*=0x65530, lpOverlapped=0x0) returned 1 [0120.864] ReadFile (in: hFile=0x1fc, lpBuffer=0x3be0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x292f8fc, lpOverlapped=0x0 | out: lpBuffer=0x3be0020*, lpNumberOfBytesRead=0x292f8fc*=0x0, lpOverlapped=0x0) returned 1 [0120.864] WriteFile (in: hFile=0x218, lpBuffer=0x3be0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x292f6c4, lpOverlapped=0x0 | out: lpBuffer=0x3be0020*, lpNumberOfBytesWritten=0x292f6c4*=0xea, lpOverlapped=0x0) returned 1 [0120.864] SetEndOfFile (hFile=0x218) returned 1 [0120.864] CloseHandle (hObject=0x218) returned 1 [0120.864] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x292f8f0 | out: lpNewFilePointer=0x0) returned 1 [0120.864] SetEndOfFile (hFile=0x1fc) returned 1 [0120.865] CloseHandle (hObject=0x1fc) returned 1 [0120.866] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pidgenx.dll.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0120.866] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pidgenx.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\pidgenx.dll")) returned 1 [0120.866] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pidgenx.dll") returned 91 [0120.866] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pidgenx.dll") returned 91 [0120.866] lstrlenW (lpString=".doc") returned 4 [0120.866] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0120.866] lstrlenW (lpString=".docx") returned 5 [0120.866] lstrcmpiW (lpString1=".docx", lpString2="x.dll") returned -1 [0120.866] lstrlenW (lpString=".pdf") returned 4 [0120.866] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0120.866] lstrlenW (lpString=".xls") returned 4 [0120.866] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0120.866] lstrlenW (lpString=".xlsx") returned 5 [0120.866] lstrcmpiW (lpString1=".xlsx", lpString2="x.dll") returned -1 [0120.866] lstrlenW (lpString=".ppt") returned 4 [0120.866] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0120.866] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pidgenx.dll") returned 91 [0120.866] lstrlenW (lpString=".zip") returned 4 [0120.866] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0120.866] lstrlenW (lpString=".rar") returned 4 [0120.866] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0120.866] lstrlenW (lpString=".bz2") returned 4 [0120.866] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0120.866] lstrlenW (lpString=".7z") returned 3 [0120.866] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0120.866] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pidgenx.dll") returned 91 [0120.866] lstrlenW (lpString=".dbf") returned 4 [0120.866] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0120.866] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pidgenx.dll") returned 91 [0120.866] lstrlenW (lpString=".1cd") returned 4 [0120.866] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0120.866] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pidgenx.dll") returned 91 [0120.866] lstrlenW (lpString=".jpg") returned 4 [0120.866] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0120.866] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pidgenx.dll") returned 91 [0120.866] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pidgenx.dll") returned 91 [0120.867] lstrlenW (lpString=".doc") returned 4 [0120.867] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0120.867] lstrlenW (lpString=".docx") returned 5 [0120.867] lstrcmpiW (lpString1=".docx", lpString2="x.dll") returned -1 [0120.867] lstrlenW (lpString=".pdf") returned 4 [0120.867] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0120.867] lstrlenW (lpString=".xls") returned 4 [0120.867] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0120.867] lstrlenW (lpString=".xlsx") returned 5 [0120.867] lstrcmpiW (lpString1=".xlsx", lpString2="x.dll") returned -1 [0120.867] lstrlenW (lpString=".ppt") returned 4 [0120.867] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0120.867] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pidgenx.dll") returned 91 [0120.867] lstrlenW (lpString=".zip") returned 4 [0120.867] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0120.867] lstrlenW (lpString=".rar") returned 4 [0120.867] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0120.867] lstrlenW (lpString=".bz2") returned 4 [0120.867] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0120.867] lstrlenW (lpString=".7z") returned 3 [0120.867] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0120.867] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pidgenx.dll") returned 91 [0120.867] lstrlenW (lpString=".dbf") returned 4 [0120.867] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0120.867] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pidgenx.dll") returned 91 [0120.867] lstrlenW (lpString=".1cd") returned 4 [0120.867] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0120.867] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pidgenx.dll") returned 91 [0120.867] lstrlenW (lpString=".jpg") returned 4 [0120.867] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0120.867] lstrcmpiW (lpString1=".exe", lpString2=".waifu") returned -1 [0120.867] lstrlenW (lpString="Setup.exe") returned 9 [0120.867] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Setup.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\setup.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0120.875] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x292f944 | out: lpFileSize=0x292f944*=1377144) returned 1 [0120.875] CloseHandle (hObject=0x1fc) returned 1 [0120.875] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Setup.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\setup.exe")) returned 0x20 [0120.875] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Setup.exe.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\setup.exe.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0120.875] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Setup.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\setup.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0120.875] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x292f8f0 | out: lpNewFilePointer=0x0) returned 1 [0120.875] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x292f8f0 | out: lpNewFilePointer=0x0) returned 1 [0120.875] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Setup.exe.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\setup.exe.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0120.876] GetLastError () returned 0x0 [0120.876] ReadFile (in: hFile=0x1fc, lpBuffer=0x3be0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x292f8fc, lpOverlapped=0x0 | out: lpBuffer=0x3be0020*, lpNumberOfBytesRead=0x292f8fc*=0xffff0, lpOverlapped=0x0) returned 1 [0120.983] WriteFile (in: hFile=0x218, lpBuffer=0x3be0020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x292f6c4, lpOverlapped=0x0 | out: lpBuffer=0x3be0020*, lpNumberOfBytesWritten=0x292f6c4*=0xffff0, lpOverlapped=0x0) returned 1 [0120.995] ReadFile (in: hFile=0x1fc, lpBuffer=0x3be0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x292f8fc, lpOverlapped=0x0 | out: lpBuffer=0x3be0020*, lpNumberOfBytesRead=0x292f8fc*=0x50388, lpOverlapped=0x0) returned 1 [0121.203] WriteFile (in: hFile=0x218, lpBuffer=0x3be0020*, nNumberOfBytesToWrite=0x50390, lpNumberOfBytesWritten=0x292f6c4, lpOverlapped=0x0 | out: lpBuffer=0x3be0020*, lpNumberOfBytesWritten=0x292f6c4*=0x50390, lpOverlapped=0x0) returned 1 [0121.221] ReadFile (in: hFile=0x1fc, lpBuffer=0x3be0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x292f8fc, lpOverlapped=0x0 | out: lpBuffer=0x3be0020*, lpNumberOfBytesRead=0x292f8fc*=0x0, lpOverlapped=0x0) returned 1 [0121.221] WriteFile (in: hFile=0x218, lpBuffer=0x3be0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x292f6c4, lpOverlapped=0x0 | out: lpBuffer=0x3be0020*, lpNumberOfBytesWritten=0x292f6c4*=0xe6, lpOverlapped=0x0) returned 1 [0121.221] SetEndOfFile (hFile=0x218) returned 1 [0121.221] CloseHandle (hObject=0x218) returned 1 [0121.221] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x292f8f0 | out: lpNewFilePointer=0x0) returned 1 [0121.221] SetEndOfFile (hFile=0x1fc) returned 1 [0121.223] CloseHandle (hObject=0x1fc) returned 1 [0121.223] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Setup.exe.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0121.223] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Setup.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\setup.exe")) returned 1 [0121.223] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Setup.exe") returned 89 [0121.223] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Setup.exe") returned 89 [0121.223] lstrlenW (lpString=".doc") returned 4 [0121.223] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0121.223] lstrlenW (lpString=".docx") returned 5 [0121.223] lstrcmpiW (lpString1=".docx", lpString2="p.exe") returned -1 [0121.223] lstrlenW (lpString=".pdf") returned 4 [0121.224] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0121.224] lstrlenW (lpString=".xls") returned 4 [0121.224] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0121.224] lstrlenW (lpString=".xlsx") returned 5 [0121.224] lstrcmpiW (lpString1=".xlsx", lpString2="p.exe") returned -1 [0121.224] lstrlenW (lpString=".ppt") returned 4 [0121.224] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0121.224] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Setup.exe") returned 89 [0121.224] lstrlenW (lpString=".zip") returned 4 [0121.224] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0121.224] lstrlenW (lpString=".rar") returned 4 [0121.224] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0121.224] lstrlenW (lpString=".bz2") returned 4 [0121.224] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0121.224] lstrlenW (lpString=".7z") returned 3 [0121.224] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0121.224] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Setup.exe") returned 89 [0121.224] lstrlenW (lpString=".dbf") returned 4 [0121.224] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0121.224] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Setup.exe") returned 89 [0121.224] lstrlenW (lpString=".1cd") returned 4 [0121.224] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0121.224] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Setup.exe") returned 89 [0121.224] lstrlenW (lpString=".jpg") returned 4 [0121.224] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0121.224] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Setup.exe") returned 89 [0121.224] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Setup.exe") returned 89 [0121.224] lstrlenW (lpString=".doc") returned 4 [0121.224] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0121.224] lstrlenW (lpString=".docx") returned 5 [0121.224] lstrcmpiW (lpString1=".docx", lpString2="p.exe") returned -1 [0121.224] lstrlenW (lpString=".pdf") returned 4 [0121.224] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0121.224] lstrlenW (lpString=".xls") returned 4 [0121.224] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0121.224] lstrlenW (lpString=".xlsx") returned 5 [0121.224] lstrcmpiW (lpString1=".xlsx", lpString2="p.exe") returned -1 [0121.224] lstrlenW (lpString=".ppt") returned 4 [0121.224] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0121.224] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Setup.exe") returned 89 [0121.224] lstrlenW (lpString=".zip") returned 4 [0121.224] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0121.224] lstrlenW (lpString=".rar") returned 4 [0121.224] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0121.224] lstrlenW (lpString=".bz2") returned 4 [0121.224] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0121.224] lstrlenW (lpString=".7z") returned 3 [0121.224] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0121.224] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Setup.exe") returned 89 [0121.224] lstrlenW (lpString=".dbf") returned 4 [0121.224] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0121.225] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Setup.exe") returned 89 [0121.225] lstrlenW (lpString=".1cd") returned 4 [0121.225] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0121.225] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Setup.exe") returned 89 [0121.225] lstrlenW (lpString=".jpg") returned 4 [0121.225] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0121.225] lstrcmpiW (lpString1=".DLL", lpString2=".waifu") returned -1 [0121.225] lstrlenW (lpString="PRJRES.DLL") returned 10 [0121.225] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PRJRES.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\prjres.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0121.466] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x292f944 | out: lpFileSize=0x292f944*=3943312) returned 1 [0121.466] CloseHandle (hObject=0x218) returned 1 [0121.466] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PRJRES.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\prjres.dll")) returned 0x20 [0121.466] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PRJRES.DLL.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\prjres.dll.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0121.466] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PRJRES.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\prjres.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PRJRES.DLL.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\prjres.dll.id-9c354b42.[darknes@420blaze.it].waifu")) returned 1 [0121.467] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PRJRES.DLL.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\prjres.dll.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0121.467] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x292f694 | out: lpNewFilePointer=0x0) returned 1 [0121.467] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x292f654 | out: lpNewFilePointer=0x0) returned 1 [0121.467] ReadFile (in: hFile=0x218, lpBuffer=0x3be0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x292f660, lpOverlapped=0x0 | out: lpBuffer=0x3be0058*, lpNumberOfBytesRead=0x292f660*=0x40000, lpOverlapped=0x0) returned 1 [0121.533] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x140e85, lpNewFilePointer=0x0, dwMoveMethod=0x292f654 | out: lpNewFilePointer=0x0) returned 1 [0121.533] ReadFile (in: hFile=0x218, lpBuffer=0x3c20058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x292f660, lpOverlapped=0x0 | out: lpBuffer=0x3c20058*, lpNumberOfBytesRead=0x292f660*=0x40000, lpOverlapped=0x0) returned 1 [0121.549] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x292f694 | out: lpNewFilePointer=0xffffffff) returned 1 [0121.549] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x382b90, lpNewFilePointer=0x0, dwMoveMethod=0x292f654 | out: lpNewFilePointer=0x0) returned 1 [0121.549] ReadFile (in: hFile=0x218, lpBuffer=0x3c60058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x292f660, lpOverlapped=0x0 | out: lpBuffer=0x3c60058*, lpNumberOfBytesRead=0x292f660*=0x40000, lpOverlapped=0x0) returned 1 [0121.602] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x292f8f0 | out: lpNewFilePointer=0x0) returned 1 [0121.602] WriteFile (in: hFile=0x218, lpBuffer=0x3be0020*, nNumberOfBytesToWrite=0xc0100, lpNumberOfBytesWritten=0x292f6d8, lpOverlapped=0x0 | out: lpBuffer=0x3be0020*, lpNumberOfBytesWritten=0x292f6d8*=0xc0100, lpOverlapped=0x0) returned 1 [0121.611] SetEndOfFile (hFile=0x218) returned 1 [0121.613] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x292f6a4 | out: lpNewFilePointer=0x0) returned 1 [0121.613] WriteFile (in: hFile=0x218, lpBuffer=0x44b2070*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x292f6b0, lpOverlapped=0x0 | out: lpBuffer=0x44b2070*, lpNumberOfBytesWritten=0x292f6b0*=0x40000, lpOverlapped=0x0) returned 1 [0121.614] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x140e85, lpNewFilePointer=0x0, dwMoveMethod=0x292f6a4 | out: lpNewFilePointer=0x0) returned 1 [0121.615] WriteFile (in: hFile=0x218, lpBuffer=0x44b2070*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x292f6b0, lpOverlapped=0x0 | out: lpBuffer=0x44b2070*, lpNumberOfBytesWritten=0x292f6b0*=0x40000, lpOverlapped=0x0) returned 1 [0121.616] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x382b90, lpNewFilePointer=0x0, dwMoveMethod=0x292f6a4 | out: lpNewFilePointer=0x0) returned 1 [0121.616] WriteFile (in: hFile=0x218, lpBuffer=0x44b2070*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x292f6b0, lpOverlapped=0x0 | out: lpBuffer=0x44b2070*, lpNumberOfBytesWritten=0x292f6b0*=0x40000, lpOverlapped=0x0) returned 1 [0121.617] CloseHandle (hObject=0x218) returned 1 [0121.617] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PRJRES.DLL.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0121.618] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PRJRES.DLL") returned 66 [0121.618] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PRJRES.DLL") returned 66 [0121.618] lstrlenW (lpString=".doc") returned 4 [0121.618] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0121.618] lstrlenW (lpString=".docx") returned 5 [0121.618] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0121.618] lstrlenW (lpString=".pdf") returned 4 [0121.618] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0121.618] lstrlenW (lpString=".xls") returned 4 [0121.618] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0121.618] lstrlenW (lpString=".xlsx") returned 5 [0121.618] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0121.618] lstrlenW (lpString=".ppt") returned 4 [0121.618] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0121.618] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PRJRES.DLL") returned 66 [0121.618] lstrlenW (lpString=".zip") returned 4 [0121.618] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0121.618] lstrlenW (lpString=".rar") returned 4 [0121.618] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0121.618] lstrlenW (lpString=".bz2") returned 4 [0121.618] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0121.618] lstrlenW (lpString=".7z") returned 3 [0121.618] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0121.618] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PRJRES.DLL") returned 66 [0121.618] lstrlenW (lpString=".dbf") returned 4 [0121.618] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0121.618] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PRJRES.DLL") returned 66 [0121.618] lstrlenW (lpString=".1cd") returned 4 [0121.618] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0121.618] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PRJRES.DLL") returned 66 [0121.618] lstrlenW (lpString=".jpg") returned 4 [0121.618] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0121.618] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PRJRES.DLL") returned 66 [0121.618] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PRJRES.DLL") returned 66 [0121.618] lstrlenW (lpString=".doc") returned 4 [0121.618] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0121.618] lstrlenW (lpString=".docx") returned 5 [0121.618] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0121.618] lstrlenW (lpString=".pdf") returned 4 [0121.618] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0121.618] lstrlenW (lpString=".xls") returned 4 [0121.618] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0121.618] lstrlenW (lpString=".xlsx") returned 5 [0121.618] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0121.618] lstrlenW (lpString=".ppt") returned 4 [0121.618] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0121.618] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PRJRES.DLL") returned 66 [0121.618] lstrlenW (lpString=".zip") returned 4 [0121.619] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0121.619] lstrlenW (lpString=".rar") returned 4 [0121.619] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0121.619] lstrlenW (lpString=".bz2") returned 4 [0121.619] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0121.619] lstrlenW (lpString=".7z") returned 3 [0121.619] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0121.619] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PRJRES.DLL") returned 66 [0121.619] lstrlenW (lpString=".dbf") returned 4 [0121.619] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0121.619] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PRJRES.DLL") returned 66 [0121.619] lstrlenW (lpString=".1cd") returned 4 [0121.619] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0121.619] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PRJRES.DLL") returned 66 [0121.619] lstrlenW (lpString=".jpg") returned 4 [0121.619] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0121.619] lstrcmpiW (lpString1=".DLL", lpString2=".waifu") returned -1 [0121.619] lstrlenW (lpString="VBAJET32.DLL") returned 12 [0121.619] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\VBAJET32.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\vbajet32.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0121.619] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x292f944 | out: lpFileSize=0x292f944*=49488) returned 1 [0121.619] CloseHandle (hObject=0x218) returned 1 [0121.619] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\VBAJET32.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\vbajet32.dll")) returned 0x20 [0121.620] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\VBAJET32.DLL.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\vbajet32.dll.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0121.620] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\VBAJET32.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\vbajet32.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0121.620] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x292f8f0 | out: lpNewFilePointer=0x0) returned 1 [0121.620] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x292f8f0 | out: lpNewFilePointer=0x0) returned 1 [0121.620] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\VBAJET32.DLL.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\vbajet32.dll.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0121.620] GetLastError () returned 0x0 [0121.620] ReadFile (in: hFile=0x218, lpBuffer=0x3be0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x292f8fc, lpOverlapped=0x0 | out: lpBuffer=0x3be0020*, lpNumberOfBytesRead=0x292f8fc*=0xc150, lpOverlapped=0x0) returned 1 [0121.774] WriteFile (in: hFile=0x22c, lpBuffer=0x3be0020*, nNumberOfBytesToWrite=0xc160, lpNumberOfBytesWritten=0x292f6c4, lpOverlapped=0x0 | out: lpBuffer=0x3be0020*, lpNumberOfBytesWritten=0x292f6c4*=0xc160, lpOverlapped=0x0) returned 1 [0121.776] ReadFile (in: hFile=0x218, lpBuffer=0x3be0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x292f8fc, lpOverlapped=0x0 | out: lpBuffer=0x3be0020*, lpNumberOfBytesRead=0x292f8fc*=0x0, lpOverlapped=0x0) returned 1 [0121.776] WriteFile (in: hFile=0x22c, lpBuffer=0x3be0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x292f6c4, lpOverlapped=0x0 | out: lpBuffer=0x3be0020*, lpNumberOfBytesWritten=0x292f6c4*=0xec, lpOverlapped=0x0) returned 1 [0121.776] SetEndOfFile (hFile=0x22c) returned 1 [0121.776] CloseHandle (hObject=0x22c) returned 1 [0121.776] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x292f8f0 | out: lpNewFilePointer=0x0) returned 1 [0121.776] SetEndOfFile (hFile=0x218) returned 1 [0121.776] CloseHandle (hObject=0x218) returned 1 [0121.776] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\VBAJET32.DLL.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0121.777] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\VBAJET32.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\vbajet32.dll")) returned 1 [0121.777] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\VBAJET32.DLL") returned 68 [0121.777] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\VBAJET32.DLL") returned 68 [0121.777] lstrlenW (lpString=".doc") returned 4 [0121.777] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0121.777] lstrlenW (lpString=".docx") returned 5 [0121.777] lstrcmpiW (lpString1=".docx", lpString2="2.DLL") returned -1 [0121.777] lstrlenW (lpString=".pdf") returned 4 [0121.777] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0121.777] lstrlenW (lpString=".xls") returned 4 [0121.777] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0121.777] lstrlenW (lpString=".xlsx") returned 5 [0121.777] lstrcmpiW (lpString1=".xlsx", lpString2="2.DLL") returned -1 [0121.777] lstrlenW (lpString=".ppt") returned 4 [0121.777] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0121.777] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\VBAJET32.DLL") returned 68 [0121.777] lstrlenW (lpString=".zip") returned 4 [0121.777] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0121.777] lstrlenW (lpString=".rar") returned 4 [0121.777] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0121.777] lstrlenW (lpString=".bz2") returned 4 [0121.777] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0121.777] lstrlenW (lpString=".7z") returned 3 [0121.777] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0121.777] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\VBAJET32.DLL") returned 68 [0121.777] lstrlenW (lpString=".dbf") returned 4 [0121.777] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0121.777] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\VBAJET32.DLL") returned 68 [0121.777] lstrlenW (lpString=".1cd") returned 4 [0121.777] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0121.777] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\VBAJET32.DLL") returned 68 [0121.777] lstrlenW (lpString=".jpg") returned 4 [0121.777] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0121.778] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\VBAJET32.DLL") returned 68 [0121.778] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\VBAJET32.DLL") returned 68 [0121.778] lstrlenW (lpString=".doc") returned 4 [0121.778] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0121.778] lstrlenW (lpString=".docx") returned 5 [0121.778] lstrcmpiW (lpString1=".docx", lpString2="2.DLL") returned -1 [0121.778] lstrlenW (lpString=".pdf") returned 4 [0121.778] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0121.778] lstrlenW (lpString=".xls") returned 4 [0121.778] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0121.778] lstrlenW (lpString=".xlsx") returned 5 [0121.778] lstrcmpiW (lpString1=".xlsx", lpString2="2.DLL") returned -1 [0121.778] lstrlenW (lpString=".ppt") returned 4 [0121.778] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0121.778] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\VBAJET32.DLL") returned 68 [0121.778] lstrlenW (lpString=".zip") returned 4 [0121.778] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0121.778] lstrlenW (lpString=".rar") returned 4 [0121.778] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0121.778] lstrlenW (lpString=".bz2") returned 4 [0121.778] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0121.778] lstrlenW (lpString=".7z") returned 3 [0121.778] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0121.778] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\VBAJET32.DLL") returned 68 [0121.778] lstrlenW (lpString=".dbf") returned 4 [0121.778] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0121.778] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\VBAJET32.DLL") returned 68 [0121.778] lstrlenW (lpString=".1cd") returned 4 [0121.778] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0121.778] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\VBAJET32.DLL") returned 68 [0121.778] lstrlenW (lpString=".jpg") returned 4 [0121.778] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0121.778] lstrcmpiW (lpString1=".xrm-ms", lpString2=".waifu") returned 1 [0121.778] lstrlenW (lpString="osppobjs-spp-plugin-manifest-signed.xrm-ms") returned 42 [0121.778] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0121.932] GetFileSizeEx (in: hFile=0x228, lpFileSize=0x292f944 | out: lpFileSize=0x292f944*=11646) returned 1 [0121.932] CloseHandle (hObject=0x228) returned 1 [0121.932] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms")) returned 0x20 [0121.932] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0121.933] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0121.933] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x292f8f0 | out: lpNewFilePointer=0x0) returned 1 [0121.933] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x292f8f0 | out: lpNewFilePointer=0x0) returned 1 [0121.933] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0121.933] GetLastError () returned 0x0 [0121.933] ReadFile (in: hFile=0x228, lpBuffer=0x3be0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x292f8fc, lpOverlapped=0x0 | out: lpBuffer=0x3be0020*, lpNumberOfBytesRead=0x292f8fc*=0x2d7e, lpOverlapped=0x0) returned 1 [0121.981] WriteFile (in: hFile=0x19c, lpBuffer=0x3be0020*, nNumberOfBytesToWrite=0x2d80, lpNumberOfBytesWritten=0x292f6c4, lpOverlapped=0x0 | out: lpBuffer=0x3be0020*, lpNumberOfBytesWritten=0x292f6c4*=0x2d80, lpOverlapped=0x0) returned 1 [0121.982] ReadFile (in: hFile=0x228, lpBuffer=0x3be0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x292f8fc, lpOverlapped=0x0 | out: lpBuffer=0x3be0020*, lpNumberOfBytesRead=0x292f8fc*=0x0, lpOverlapped=0x0) returned 1 [0121.982] WriteFile (in: hFile=0x19c, lpBuffer=0x3be0020*, nNumberOfBytesToWrite=0x128, lpNumberOfBytesWritten=0x292f6c4, lpOverlapped=0x0 | out: lpBuffer=0x3be0020*, lpNumberOfBytesWritten=0x292f6c4*=0x128, lpOverlapped=0x0) returned 1 [0121.982] SetEndOfFile (hFile=0x19c) returned 1 [0121.982] CloseHandle (hObject=0x19c) returned 1 [0121.982] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x292f8f0 | out: lpNewFilePointer=0x0) returned 1 [0121.982] SetEndOfFile (hFile=0x228) returned 1 [0121.983] CloseHandle (hObject=0x228) returned 1 [0121.983] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0121.983] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms")) returned 1 [0122.043] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms") returned 122 [0122.043] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms") returned 122 [0122.043] lstrlenW (lpString=".doc") returned 4 [0122.043] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0122.044] lstrlenW (lpString=".docx") returned 5 [0122.044] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0122.044] lstrlenW (lpString=".pdf") returned 4 [0122.044] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0122.044] lstrlenW (lpString=".xls") returned 4 [0122.044] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0122.044] lstrlenW (lpString=".xlsx") returned 5 [0122.044] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0122.044] lstrlenW (lpString=".ppt") returned 4 [0122.044] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0122.044] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms") returned 122 [0122.044] lstrlenW (lpString=".zip") returned 4 [0122.044] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0122.044] lstrlenW (lpString=".rar") returned 4 [0122.044] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0122.044] lstrlenW (lpString=".bz2") returned 4 [0122.044] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0122.044] lstrlenW (lpString=".7z") returned 3 [0122.044] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0122.044] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms") returned 122 [0122.044] lstrlenW (lpString=".dbf") returned 4 [0122.044] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0122.044] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms") returned 122 [0122.044] lstrlenW (lpString=".1cd") returned 4 [0122.044] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0122.044] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms") returned 122 [0122.044] lstrlenW (lpString=".jpg") returned 4 [0122.044] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0122.044] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms") returned 122 [0122.044] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms") returned 122 [0122.044] lstrlenW (lpString=".doc") returned 4 [0122.044] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0122.044] lstrlenW (lpString=".docx") returned 5 [0122.044] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0122.044] lstrlenW (lpString=".pdf") returned 4 [0122.044] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0122.044] lstrlenW (lpString=".xls") returned 4 [0122.044] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0122.044] lstrlenW (lpString=".xlsx") returned 5 [0122.044] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0122.044] lstrlenW (lpString=".ppt") returned 4 [0122.044] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0122.044] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms") returned 122 [0122.044] lstrlenW (lpString=".zip") returned 4 [0122.044] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0122.044] lstrlenW (lpString=".rar") returned 4 [0122.044] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0122.044] lstrlenW (lpString=".bz2") returned 4 [0122.044] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0122.044] lstrlenW (lpString=".7z") returned 3 [0122.044] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0122.045] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms") returned 122 [0122.045] lstrlenW (lpString=".dbf") returned 4 [0122.045] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0122.045] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms") returned 122 [0122.045] lstrlenW (lpString=".1cd") returned 4 [0122.045] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0122.045] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms") returned 122 [0122.045] lstrlenW (lpString=".jpg") returned 4 [0122.045] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0122.045] lstrcmpiW (lpString1=".EXE", lpString2=".waifu") returned -1 [0122.045] lstrlenW (lpString="OSPPSVC.EXE") returned 11 [0122.045] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppsvc.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0122.045] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x292f944 | out: lpFileSize=0x292f944*=4925184) returned 1 [0122.045] CloseHandle (hObject=0x1e0) returned 1 [0122.045] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppsvc.exe")) returned 0x20 [0122.045] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppsvc.exe.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0122.045] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppsvc.exe"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppsvc.exe.id-9c354b42.[darknes@420blaze.it].waifu")) returned 1 [0122.047] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppsvc.exe.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0122.047] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x292f694 | out: lpNewFilePointer=0x0) returned 1 [0122.047] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x292f654 | out: lpNewFilePointer=0x0) returned 1 [0122.047] ReadFile (in: hFile=0x1e0, lpBuffer=0x3be0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x292f660, lpOverlapped=0x0 | out: lpBuffer=0x3be0058*, lpNumberOfBytesRead=0x292f660*=0x40000, lpOverlapped=0x0) returned 1 [0122.332] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x190d00, lpNewFilePointer=0x0, dwMoveMethod=0x292f654 | out: lpNewFilePointer=0x0) returned 1 [0122.332] ReadFile (in: hFile=0x1e0, lpBuffer=0x3c20058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x292f660, lpOverlapped=0x0 | out: lpBuffer=0x3c20058*, lpNumberOfBytesRead=0x292f660*=0x40000, lpOverlapped=0x0) returned 1 [0122.462] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x292f694 | out: lpNewFilePointer=0xffffffff) returned 1 [0122.462] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x472700, lpNewFilePointer=0x0, dwMoveMethod=0x292f654 | out: lpNewFilePointer=0x0) returned 1 [0122.462] ReadFile (in: hFile=0x1e0, lpBuffer=0x3c60058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x292f660, lpOverlapped=0x0 | out: lpBuffer=0x3c60058*, lpNumberOfBytesRead=0x292f660*=0x40000, lpOverlapped=0x0) returned 1 [0122.608] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x292f8f0 | out: lpNewFilePointer=0x0) returned 1 [0122.609] WriteFile (in: hFile=0x1e0, lpBuffer=0x3be0020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x292f6d8, lpOverlapped=0x0 | out: lpBuffer=0x3be0020*, lpNumberOfBytesWritten=0x292f6d8*=0xc0102, lpOverlapped=0x0) returned 1 [0122.621] SetEndOfFile (hFile=0x1e0) returned 1 [0122.666] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x292f6a4 | out: lpNewFilePointer=0x0) returned 1 [0122.666] WriteFile (in: hFile=0x1e0, lpBuffer=0x4554008*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x292f6b0, lpOverlapped=0x0 | out: lpBuffer=0x4554008*, lpNumberOfBytesWritten=0x292f6b0*=0x40000, lpOverlapped=0x0) returned 1 [0122.667] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x190d00, lpNewFilePointer=0x0, dwMoveMethod=0x292f6a4 | out: lpNewFilePointer=0x0) returned 1 [0122.667] WriteFile (in: hFile=0x1e0, lpBuffer=0x4554008*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x292f6b0, lpOverlapped=0x0 | out: lpBuffer=0x4554008*, lpNumberOfBytesWritten=0x292f6b0*=0x40000, lpOverlapped=0x0) returned 1 [0122.669] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x472700, lpNewFilePointer=0x0, dwMoveMethod=0x292f6a4 | out: lpNewFilePointer=0x0) returned 1 [0122.669] WriteFile (in: hFile=0x1e0, lpBuffer=0x4554008*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x292f6b0, lpOverlapped=0x0 | out: lpBuffer=0x4554008*, lpNumberOfBytesWritten=0x292f6b0*=0x40000, lpOverlapped=0x0) returned 1 [0122.670] CloseHandle (hObject=0x1e0) returned 1 [0122.670] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0122.670] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE") returned 91 [0122.670] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE") returned 91 [0122.670] lstrlenW (lpString=".doc") returned 4 [0122.670] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0122.670] lstrlenW (lpString=".docx") returned 5 [0122.670] lstrcmpiW (lpString1=".docx", lpString2="C.EXE") returned -1 [0122.670] lstrlenW (lpString=".pdf") returned 4 [0122.670] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0122.671] lstrlenW (lpString=".xls") returned 4 [0122.671] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0122.671] lstrlenW (lpString=".xlsx") returned 5 [0122.671] lstrcmpiW (lpString1=".xlsx", lpString2="C.EXE") returned -1 [0122.671] lstrlenW (lpString=".ppt") returned 4 [0122.671] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0122.671] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE") returned 91 [0122.671] lstrlenW (lpString=".zip") returned 4 [0122.671] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0122.671] lstrlenW (lpString=".rar") returned 4 [0122.671] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0122.671] lstrlenW (lpString=".bz2") returned 4 [0122.671] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0122.671] lstrlenW (lpString=".7z") returned 3 [0122.671] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0122.671] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE") returned 91 [0122.671] lstrlenW (lpString=".dbf") returned 4 [0122.671] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0122.671] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE") returned 91 [0122.671] lstrlenW (lpString=".1cd") returned 4 [0122.671] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0122.671] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE") returned 91 [0122.671] lstrlenW (lpString=".jpg") returned 4 [0122.671] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0122.671] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE") returned 91 [0122.671] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE") returned 91 [0122.671] lstrlenW (lpString=".doc") returned 4 [0122.671] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0122.671] lstrlenW (lpString=".docx") returned 5 [0122.671] lstrcmpiW (lpString1=".docx", lpString2="C.EXE") returned -1 [0122.671] lstrlenW (lpString=".pdf") returned 4 [0122.671] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0122.671] lstrlenW (lpString=".xls") returned 4 [0122.671] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0122.671] lstrlenW (lpString=".xlsx") returned 5 [0122.671] lstrcmpiW (lpString1=".xlsx", lpString2="C.EXE") returned -1 [0122.671] lstrlenW (lpString=".ppt") returned 4 [0122.671] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0122.671] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE") returned 91 [0122.671] lstrlenW (lpString=".zip") returned 4 [0122.671] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0122.671] lstrlenW (lpString=".rar") returned 4 [0122.671] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0122.671] lstrlenW (lpString=".bz2") returned 4 [0122.671] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0122.671] lstrlenW (lpString=".7z") returned 3 [0122.671] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0122.671] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE") returned 91 [0122.671] lstrlenW (lpString=".dbf") returned 4 [0122.671] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0122.671] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE") returned 91 [0122.672] lstrlenW (lpString=".1cd") returned 4 [0122.672] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0122.672] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE") returned 91 [0122.672] lstrlenW (lpString=".jpg") returned 4 [0122.672] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0122.672] lstrcmpiW (lpString1=".DLL", lpString2=".waifu") returned -1 [0122.672] lstrlenW (lpString="FPLACE.DLL") returned 10 [0122.672] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPLACE.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fplace.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0122.672] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x292f944 | out: lpFileSize=0x292f944*=181120) returned 1 [0122.672] CloseHandle (hObject=0x1e0) returned 1 [0122.672] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPLACE.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fplace.dll")) returned 0x20 [0122.672] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPLACE.DLL.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fplace.dll.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0122.672] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPLACE.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fplace.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0122.672] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x292f8f0 | out: lpNewFilePointer=0x0) returned 1 [0122.672] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x292f8f0 | out: lpNewFilePointer=0x0) returned 1 [0122.672] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPLACE.DLL.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fplace.dll.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0122.673] GetLastError () returned 0x0 [0122.673] ReadFile (in: hFile=0x1e0, lpBuffer=0x3be0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x292f8fc, lpOverlapped=0x0 | out: lpBuffer=0x3be0020*, lpNumberOfBytesRead=0x292f8fc*=0x2c380, lpOverlapped=0x0) returned 1 [0122.726] WriteFile (in: hFile=0x16c, lpBuffer=0x3be0020*, nNumberOfBytesToWrite=0x2c390, lpNumberOfBytesWritten=0x292f6c4, lpOverlapped=0x0 | out: lpBuffer=0x3be0020*, lpNumberOfBytesWritten=0x292f6c4*=0x2c390, lpOverlapped=0x0) returned 1 [0122.727] ReadFile (in: hFile=0x1e0, lpBuffer=0x3be0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x292f8fc, lpOverlapped=0x0 | out: lpBuffer=0x3be0020*, lpNumberOfBytesRead=0x292f8fc*=0x0, lpOverlapped=0x0) returned 1 [0122.728] WriteFile (in: hFile=0x16c, lpBuffer=0x3be0020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x292f6c4, lpOverlapped=0x0 | out: lpBuffer=0x3be0020*, lpNumberOfBytesWritten=0x292f6c4*=0xe8, lpOverlapped=0x0) returned 1 [0122.728] SetEndOfFile (hFile=0x16c) returned 1 [0122.728] CloseHandle (hObject=0x16c) returned 1 [0122.728] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x292f8f0 | out: lpNewFilePointer=0x0) returned 1 [0122.728] SetEndOfFile (hFile=0x1e0) returned 1 [0122.729] CloseHandle (hObject=0x1e0) returned 1 [0122.729] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPLACE.DLL.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0122.729] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPLACE.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fplace.dll")) returned 1 [0122.729] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPLACE.DLL") returned 67 [0122.729] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPLACE.DLL") returned 67 [0122.729] lstrlenW (lpString=".doc") returned 4 [0122.729] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0122.729] lstrlenW (lpString=".docx") returned 5 [0122.729] lstrcmpiW (lpString1=".docx", lpString2="E.DLL") returned -1 [0122.729] lstrlenW (lpString=".pdf") returned 4 [0122.729] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0122.729] lstrlenW (lpString=".xls") returned 4 [0122.729] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0122.730] lstrlenW (lpString=".xlsx") returned 5 [0122.730] lstrcmpiW (lpString1=".xlsx", lpString2="E.DLL") returned -1 [0122.730] lstrlenW (lpString=".ppt") returned 4 [0122.730] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0122.730] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPLACE.DLL") returned 67 [0122.730] lstrlenW (lpString=".zip") returned 4 [0122.730] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0122.730] lstrlenW (lpString=".rar") returned 4 [0122.730] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0122.730] lstrlenW (lpString=".bz2") returned 4 [0122.730] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0122.730] lstrlenW (lpString=".7z") returned 3 [0122.730] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0122.730] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPLACE.DLL") returned 67 [0122.730] lstrlenW (lpString=".dbf") returned 4 [0122.730] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0122.730] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPLACE.DLL") returned 67 [0122.730] lstrlenW (lpString=".1cd") returned 4 [0122.730] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0122.730] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPLACE.DLL") returned 67 [0122.730] lstrlenW (lpString=".jpg") returned 4 [0122.730] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0122.730] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPLACE.DLL") returned 67 [0122.730] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPLACE.DLL") returned 67 [0122.730] lstrlenW (lpString=".doc") returned 4 [0122.730] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0122.730] lstrlenW (lpString=".docx") returned 5 [0122.730] lstrcmpiW (lpString1=".docx", lpString2="E.DLL") returned -1 [0122.730] lstrlenW (lpString=".pdf") returned 4 [0122.730] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0122.730] lstrlenW (lpString=".xls") returned 4 [0122.730] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0122.730] lstrlenW (lpString=".xlsx") returned 5 [0122.730] lstrcmpiW (lpString1=".xlsx", lpString2="E.DLL") returned -1 [0122.730] lstrlenW (lpString=".ppt") returned 4 [0122.730] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0122.730] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPLACE.DLL") returned 67 [0122.730] lstrlenW (lpString=".zip") returned 4 [0122.730] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0122.730] lstrlenW (lpString=".rar") returned 4 [0122.730] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0122.730] lstrlenW (lpString=".bz2") returned 4 [0122.730] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0122.730] lstrlenW (lpString=".7z") returned 3 [0122.730] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0122.730] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPLACE.DLL") returned 67 [0122.730] lstrlenW (lpString=".dbf") returned 4 [0122.730] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0122.730] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPLACE.DLL") returned 67 [0122.730] lstrlenW (lpString=".1cd") returned 4 [0122.730] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0122.731] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPLACE.DLL") returned 67 [0122.731] lstrlenW (lpString=".jpg") returned 4 [0122.731] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0122.731] lstrcmpiW (lpString1=".DLL", lpString2=".waifu") returned -1 [0122.731] lstrlenW (lpString="FSTOCK.DLL") returned 10 [0122.731] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FSTOCK.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fstock.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0122.731] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x292f944 | out: lpFileSize=0x292f944*=159104) returned 1 [0122.731] CloseHandle (hObject=0x1e0) returned 1 [0122.731] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FSTOCK.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fstock.dll")) returned 0x20 [0122.731] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FSTOCK.DLL.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fstock.dll.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0122.731] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FSTOCK.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fstock.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0122.731] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x292f8f0 | out: lpNewFilePointer=0x0) returned 1 [0122.731] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x292f8f0 | out: lpNewFilePointer=0x0) returned 1 [0122.731] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FSTOCK.DLL.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fstock.dll.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0122.732] GetLastError () returned 0x0 [0122.732] ReadFile (in: hFile=0x1e0, lpBuffer=0x3be0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x292f8fc, lpOverlapped=0x0 | out: lpBuffer=0x3be0020*, lpNumberOfBytesRead=0x292f8fc*=0x26d80, lpOverlapped=0x0) returned 1 [0122.802] WriteFile (in: hFile=0x16c, lpBuffer=0x3be0020*, nNumberOfBytesToWrite=0x26d90, lpNumberOfBytesWritten=0x292f6c4, lpOverlapped=0x0 | out: lpBuffer=0x3be0020*, lpNumberOfBytesWritten=0x292f6c4*=0x26d90, lpOverlapped=0x0) returned 1 [0122.803] ReadFile (in: hFile=0x1e0, lpBuffer=0x3be0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x292f8fc, lpOverlapped=0x0 | out: lpBuffer=0x3be0020*, lpNumberOfBytesRead=0x292f8fc*=0x0, lpOverlapped=0x0) returned 1 [0122.803] WriteFile (in: hFile=0x16c, lpBuffer=0x3be0020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x292f6c4, lpOverlapped=0x0 | out: lpBuffer=0x3be0020*, lpNumberOfBytesWritten=0x292f6c4*=0xe8, lpOverlapped=0x0) returned 1 [0122.803] SetEndOfFile (hFile=0x16c) returned 1 [0122.817] CloseHandle (hObject=0x16c) returned 1 [0122.817] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x292f8f0 | out: lpNewFilePointer=0x0) returned 1 [0122.817] SetEndOfFile (hFile=0x1e0) returned 1 [0122.817] CloseHandle (hObject=0x1e0) returned 1 [0122.817] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FSTOCK.DLL.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0122.817] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FSTOCK.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fstock.dll")) returned 1 [0122.818] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FSTOCK.DLL") returned 67 [0122.818] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FSTOCK.DLL") returned 67 [0122.818] lstrlenW (lpString=".doc") returned 4 [0122.818] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0122.818] lstrlenW (lpString=".docx") returned 5 [0122.818] lstrcmpiW (lpString1=".docx", lpString2="K.DLL") returned -1 [0122.818] lstrlenW (lpString=".pdf") returned 4 [0122.818] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0122.818] lstrlenW (lpString=".xls") returned 4 [0122.818] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0122.818] lstrlenW (lpString=".xlsx") returned 5 [0122.818] lstrcmpiW (lpString1=".xlsx", lpString2="K.DLL") returned -1 [0122.818] lstrlenW (lpString=".ppt") returned 4 [0122.818] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0122.818] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FSTOCK.DLL") returned 67 [0122.818] lstrlenW (lpString=".zip") returned 4 [0122.818] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0122.818] lstrlenW (lpString=".rar") returned 4 [0122.818] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0122.818] lstrlenW (lpString=".bz2") returned 4 [0122.818] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0122.818] lstrlenW (lpString=".7z") returned 3 [0122.818] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0122.818] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FSTOCK.DLL") returned 67 [0122.818] lstrlenW (lpString=".dbf") returned 4 [0122.818] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0122.818] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FSTOCK.DLL") returned 67 [0122.818] lstrlenW (lpString=".1cd") returned 4 [0122.818] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0122.818] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FSTOCK.DLL") returned 67 [0122.818] lstrlenW (lpString=".jpg") returned 4 [0122.818] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0122.818] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FSTOCK.DLL") returned 67 [0122.818] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FSTOCK.DLL") returned 67 [0122.818] lstrlenW (lpString=".doc") returned 4 [0122.818] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0122.818] lstrlenW (lpString=".docx") returned 5 [0122.818] lstrcmpiW (lpString1=".docx", lpString2="K.DLL") returned -1 [0122.818] lstrlenW (lpString=".pdf") returned 4 [0122.819] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0122.819] lstrlenW (lpString=".xls") returned 4 [0122.819] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0122.819] lstrlenW (lpString=".xlsx") returned 5 [0122.819] lstrcmpiW (lpString1=".xlsx", lpString2="K.DLL") returned -1 [0122.819] lstrlenW (lpString=".ppt") returned 4 [0122.819] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0122.819] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FSTOCK.DLL") returned 67 [0122.819] lstrlenW (lpString=".zip") returned 4 [0122.819] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0122.819] lstrlenW (lpString=".rar") returned 4 [0122.819] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0122.819] lstrlenW (lpString=".bz2") returned 4 [0122.819] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0122.819] lstrlenW (lpString=".7z") returned 3 [0122.819] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0122.819] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FSTOCK.DLL") returned 67 [0122.819] lstrlenW (lpString=".dbf") returned 4 [0122.819] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0122.819] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FSTOCK.DLL") returned 67 [0122.819] lstrlenW (lpString=".1cd") returned 4 [0122.819] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0122.819] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FSTOCK.DLL") returned 67 [0122.819] lstrlenW (lpString=".jpg") returned 4 [0122.819] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0122.819] lstrcmpiW (lpString1=".DLL", lpString2=".waifu") returned -1 [0122.819] lstrlenW (lpString="MOFL.DLL") returned 8 [0122.819] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\mofl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x234 [0122.822] GetFileSizeEx (in: hFile=0x234, lpFileSize=0x292f944 | out: lpFileSize=0x292f944*=364928) returned 1 [0122.822] CloseHandle (hObject=0x234) returned 1 [0122.822] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\mofl.dll")) returned 0x20 [0122.822] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\mofl.dll.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0122.822] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\mofl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x234 [0122.822] SetFilePointerEx (in: hFile=0x234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x292f8f0 | out: lpNewFilePointer=0x0) returned 1 [0122.822] SetFilePointerEx (in: hFile=0x234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x292f8f0 | out: lpNewFilePointer=0x0) returned 1 [0122.822] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\mofl.dll.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0122.823] GetLastError () returned 0x0 [0122.823] ReadFile (in: hFile=0x234, lpBuffer=0x3be0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x292f8fc, lpOverlapped=0x0 | out: lpBuffer=0x3be0020*, lpNumberOfBytesRead=0x292f8fc*=0x59180, lpOverlapped=0x0) returned 1 [0122.832] WriteFile (in: hFile=0x20c, lpBuffer=0x3be0020*, nNumberOfBytesToWrite=0x59190, lpNumberOfBytesWritten=0x292f6c4, lpOverlapped=0x0 | out: lpBuffer=0x3be0020*, lpNumberOfBytesWritten=0x292f6c4*=0x59190, lpOverlapped=0x0) returned 1 [0122.835] ReadFile (in: hFile=0x234, lpBuffer=0x3be0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x292f8fc, lpOverlapped=0x0 | out: lpBuffer=0x3be0020*, lpNumberOfBytesRead=0x292f8fc*=0x0, lpOverlapped=0x0) returned 1 [0122.835] WriteFile (in: hFile=0x20c, lpBuffer=0x3be0020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x292f6c4, lpOverlapped=0x0 | out: lpBuffer=0x3be0020*, lpNumberOfBytesWritten=0x292f6c4*=0xe4, lpOverlapped=0x0) returned 1 [0122.836] SetEndOfFile (hFile=0x20c) returned 1 [0122.836] CloseHandle (hObject=0x20c) returned 1 [0122.836] SetFilePointerEx (in: hFile=0x234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x292f8f0 | out: lpNewFilePointer=0x0) returned 1 [0122.836] SetEndOfFile (hFile=0x234) returned 1 [0122.837] CloseHandle (hObject=0x234) returned 1 [0122.837] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0122.837] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\mofl.dll")) returned 1 [0122.837] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL") returned 65 [0122.837] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL") returned 65 [0122.837] lstrlenW (lpString=".doc") returned 4 [0122.837] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0122.837] lstrlenW (lpString=".docx") returned 5 [0122.837] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0122.837] lstrlenW (lpString=".pdf") returned 4 [0122.838] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0122.838] lstrlenW (lpString=".xls") returned 4 [0122.838] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0122.838] lstrlenW (lpString=".xlsx") returned 5 [0122.838] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0122.838] lstrlenW (lpString=".ppt") returned 4 [0122.838] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0122.838] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL") returned 65 [0122.838] lstrlenW (lpString=".zip") returned 4 [0122.838] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0122.838] lstrlenW (lpString=".rar") returned 4 [0122.838] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0122.838] lstrlenW (lpString=".bz2") returned 4 [0122.838] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0122.838] lstrlenW (lpString=".7z") returned 3 [0122.838] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0122.838] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL") returned 65 [0122.838] lstrlenW (lpString=".dbf") returned 4 [0122.838] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0122.838] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL") returned 65 [0122.838] lstrlenW (lpString=".1cd") returned 4 [0122.838] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0122.838] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL") returned 65 [0122.838] lstrlenW (lpString=".jpg") returned 4 [0122.838] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0122.838] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL") returned 65 [0122.838] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL") returned 65 [0122.838] lstrlenW (lpString=".doc") returned 4 [0122.838] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0122.838] lstrlenW (lpString=".docx") returned 5 [0122.838] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0122.838] lstrlenW (lpString=".pdf") returned 4 [0122.838] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0122.838] lstrlenW (lpString=".xls") returned 4 [0122.838] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0122.838] lstrlenW (lpString=".xlsx") returned 5 [0122.838] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0122.838] lstrlenW (lpString=".ppt") returned 4 [0122.838] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0122.838] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL") returned 65 [0122.838] lstrlenW (lpString=".zip") returned 4 [0122.838] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0122.838] lstrlenW (lpString=".rar") returned 4 [0122.838] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0122.838] lstrlenW (lpString=".bz2") returned 4 [0122.838] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0122.838] lstrlenW (lpString=".7z") returned 3 [0122.838] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0122.838] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL") returned 65 [0122.838] lstrlenW (lpString=".dbf") returned 4 [0122.839] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0122.839] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL") returned 65 [0122.839] lstrlenW (lpString=".1cd") returned 4 [0122.839] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0122.839] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MOFL.DLL") returned 65 [0122.839] lstrlenW (lpString=".jpg") returned 4 [0122.839] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0122.839] lstrcmpiW (lpString1=".TLB", lpString2=".waifu") returned -1 [0122.839] lstrlenW (lpString="MSTAG.TLB") returned 9 [0122.839] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\mstag.tlb"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x234 [0122.905] GetFileSizeEx (in: hFile=0x234, lpFileSize=0x292f944 | out: lpFileSize=0x292f944*=13684) returned 1 [0122.905] CloseHandle (hObject=0x234) returned 1 [0122.905] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\mstag.tlb")) returned 0x20 [0122.905] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\mstag.tlb.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0122.905] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\mstag.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x234 [0122.905] SetFilePointerEx (in: hFile=0x234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x292f8f0 | out: lpNewFilePointer=0x0) returned 1 [0122.906] SetFilePointerEx (in: hFile=0x234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x292f8f0 | out: lpNewFilePointer=0x0) returned 1 [0122.906] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\mstag.tlb.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0122.941] GetLastError () returned 0x0 [0122.941] ReadFile (in: hFile=0x234, lpBuffer=0x3be0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x292f8fc, lpOverlapped=0x0 | out: lpBuffer=0x3be0020*, lpNumberOfBytesRead=0x292f8fc*=0x3574, lpOverlapped=0x0) returned 1 [0123.011] WriteFile (in: hFile=0x16c, lpBuffer=0x3be0020*, nNumberOfBytesToWrite=0x3580, lpNumberOfBytesWritten=0x292f6c4, lpOverlapped=0x0 | out: lpBuffer=0x3be0020*, lpNumberOfBytesWritten=0x292f6c4*=0x3580, lpOverlapped=0x0) returned 1 [0123.012] ReadFile (in: hFile=0x234, lpBuffer=0x3be0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x292f8fc, lpOverlapped=0x0 | out: lpBuffer=0x3be0020*, lpNumberOfBytesRead=0x292f8fc*=0x0, lpOverlapped=0x0) returned 1 [0123.012] WriteFile (in: hFile=0x16c, lpBuffer=0x3be0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x292f6c4, lpOverlapped=0x0 | out: lpBuffer=0x3be0020*, lpNumberOfBytesWritten=0x292f6c4*=0xe6, lpOverlapped=0x0) returned 1 [0123.012] SetEndOfFile (hFile=0x16c) returned 1 [0123.012] CloseHandle (hObject=0x16c) returned 1 [0123.012] SetFilePointerEx (in: hFile=0x234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x292f8f0 | out: lpNewFilePointer=0x0) returned 1 [0123.012] SetEndOfFile (hFile=0x234) returned 1 [0123.013] CloseHandle (hObject=0x234) returned 1 [0123.013] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0123.013] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\mstag.tlb")) returned 1 [0123.013] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB") returned 66 [0123.013] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB") returned 66 [0123.013] lstrlenW (lpString=".doc") returned 4 [0123.013] lstrcmpiW (lpString1=".doc", lpString2=".TLB") returned -1 [0123.013] lstrlenW (lpString=".docx") returned 5 [0123.013] lstrcmpiW (lpString1=".docx", lpString2="G.TLB") returned -1 [0123.013] lstrlenW (lpString=".pdf") returned 4 [0123.013] lstrcmpiW (lpString1=".pdf", lpString2=".TLB") returned -1 [0123.013] lstrlenW (lpString=".xls") returned 4 [0123.013] lstrcmpiW (lpString1=".xls", lpString2=".TLB") returned 1 [0123.013] lstrlenW (lpString=".xlsx") returned 5 [0123.013] lstrcmpiW (lpString1=".xlsx", lpString2="G.TLB") returned -1 [0123.013] lstrlenW (lpString=".ppt") returned 4 [0123.013] lstrcmpiW (lpString1=".ppt", lpString2=".TLB") returned -1 [0123.013] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB") returned 66 [0123.013] lstrlenW (lpString=".zip") returned 4 [0123.013] lstrcmpiW (lpString1=".zip", lpString2=".TLB") returned 1 [0123.013] lstrlenW (lpString=".rar") returned 4 [0123.013] lstrcmpiW (lpString1=".rar", lpString2=".TLB") returned -1 [0123.013] lstrlenW (lpString=".bz2") returned 4 [0123.013] lstrcmpiW (lpString1=".bz2", lpString2=".TLB") returned -1 [0123.014] lstrlenW (lpString=".7z") returned 3 [0123.014] lstrcmpiW (lpString1=".7z", lpString2="TLB") returned -1 [0123.014] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB") returned 66 [0123.014] lstrlenW (lpString=".dbf") returned 4 [0123.014] lstrcmpiW (lpString1=".dbf", lpString2=".TLB") returned -1 [0123.014] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB") returned 66 [0123.014] lstrlenW (lpString=".1cd") returned 4 [0123.014] lstrcmpiW (lpString1=".1cd", lpString2=".TLB") returned -1 [0123.014] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB") returned 66 [0123.014] lstrlenW (lpString=".jpg") returned 4 [0123.014] lstrcmpiW (lpString1=".jpg", lpString2=".TLB") returned -1 [0123.014] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB") returned 66 [0123.014] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB") returned 66 [0123.014] lstrlenW (lpString=".doc") returned 4 [0123.014] lstrcmpiW (lpString1=".doc", lpString2=".TLB") returned -1 [0123.014] lstrlenW (lpString=".docx") returned 5 [0123.014] lstrcmpiW (lpString1=".docx", lpString2="G.TLB") returned -1 [0123.014] lstrlenW (lpString=".pdf") returned 4 [0123.014] lstrcmpiW (lpString1=".pdf", lpString2=".TLB") returned -1 [0123.014] lstrlenW (lpString=".xls") returned 4 [0123.014] lstrcmpiW (lpString1=".xls", lpString2=".TLB") returned 1 [0123.014] lstrlenW (lpString=".xlsx") returned 5 [0123.014] lstrcmpiW (lpString1=".xlsx", lpString2="G.TLB") returned -1 [0123.014] lstrlenW (lpString=".ppt") returned 4 [0123.014] lstrcmpiW (lpString1=".ppt", lpString2=".TLB") returned -1 [0123.014] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB") returned 66 [0123.014] lstrlenW (lpString=".zip") returned 4 [0123.014] lstrcmpiW (lpString1=".zip", lpString2=".TLB") returned 1 [0123.014] lstrlenW (lpString=".rar") returned 4 [0123.014] lstrcmpiW (lpString1=".rar", lpString2=".TLB") returned -1 [0123.014] lstrlenW (lpString=".bz2") returned 4 [0123.014] lstrcmpiW (lpString1=".bz2", lpString2=".TLB") returned -1 [0123.014] lstrlenW (lpString=".7z") returned 3 [0123.014] lstrcmpiW (lpString1=".7z", lpString2="TLB") returned -1 [0123.014] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB") returned 66 [0123.014] lstrlenW (lpString=".dbf") returned 4 [0123.014] lstrcmpiW (lpString1=".dbf", lpString2=".TLB") returned -1 [0123.014] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB") returned 66 [0123.014] lstrlenW (lpString=".1cd") returned 4 [0123.014] lstrcmpiW (lpString1=".1cd", lpString2=".TLB") returned -1 [0123.014] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB") returned 66 [0123.014] lstrlenW (lpString=".jpg") returned 4 [0123.014] lstrcmpiW (lpString1=".jpg", lpString2=".TLB") returned -1 [0123.014] lstrcmpiW (lpString1=".CNV", lpString2=".waifu") returned -1 [0123.014] lstrlenW (lpString="WPFT532.CNV") returned 11 [0123.014] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT532.CNV" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wpft532.cnv"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0123.019] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x292f944 | out: lpFileSize=0x292f944*=196976) returned 1 [0123.019] CloseHandle (hObject=0x1b0) returned 1 [0123.019] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT532.CNV" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wpft532.cnv")) returned 0x20 [0123.019] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT532.CNV.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wpft532.cnv.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0123.020] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT532.CNV" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wpft532.cnv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0123.020] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x292f8f0 | out: lpNewFilePointer=0x0) returned 1 [0123.020] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x292f8f0 | out: lpNewFilePointer=0x0) returned 1 [0123.020] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT532.CNV.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wpft532.cnv.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x240 [0123.020] GetLastError () returned 0x0 [0123.020] ReadFile (in: hFile=0x1b0, lpBuffer=0x3be0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x292f8fc, lpOverlapped=0x0 | out: lpBuffer=0x3be0020*, lpNumberOfBytesRead=0x292f8fc*=0x30170, lpOverlapped=0x0) returned 1 [0123.053] WriteFile (in: hFile=0x240, lpBuffer=0x3be0020*, nNumberOfBytesToWrite=0x30180, lpNumberOfBytesWritten=0x292f6c4, lpOverlapped=0x0 | out: lpBuffer=0x3be0020*, lpNumberOfBytesWritten=0x292f6c4*=0x30180, lpOverlapped=0x0) returned 1 [0123.055] ReadFile (in: hFile=0x1b0, lpBuffer=0x3be0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x292f8fc, lpOverlapped=0x0 | out: lpBuffer=0x3be0020*, lpNumberOfBytesRead=0x292f8fc*=0x0, lpOverlapped=0x0) returned 1 [0123.055] WriteFile (in: hFile=0x240, lpBuffer=0x3be0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x292f6c4, lpOverlapped=0x0 | out: lpBuffer=0x3be0020*, lpNumberOfBytesWritten=0x292f6c4*=0xea, lpOverlapped=0x0) returned 1 [0123.055] SetEndOfFile (hFile=0x240) returned 1 [0123.055] CloseHandle (hObject=0x240) returned 1 [0123.055] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x292f8f0 | out: lpNewFilePointer=0x0) returned 1 [0123.055] SetEndOfFile (hFile=0x1b0) returned 1 [0123.056] CloseHandle (hObject=0x1b0) returned 1 [0123.056] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT532.CNV.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0123.057] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT532.CNV" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wpft532.cnv")) returned 1 [0123.057] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT532.CNV") returned 67 [0123.057] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT532.CNV") returned 67 [0123.057] lstrlenW (lpString=".doc") returned 4 [0123.057] lstrcmpiW (lpString1=".doc", lpString2=".CNV") returned 1 [0123.057] lstrlenW (lpString=".docx") returned 5 [0123.057] lstrcmpiW (lpString1=".docx", lpString2="2.CNV") returned -1 [0123.057] lstrlenW (lpString=".pdf") returned 4 [0123.057] lstrcmpiW (lpString1=".pdf", lpString2=".CNV") returned 1 [0123.057] lstrlenW (lpString=".xls") returned 4 [0123.057] lstrcmpiW (lpString1=".xls", lpString2=".CNV") returned 1 [0123.057] lstrlenW (lpString=".xlsx") returned 5 [0123.057] lstrcmpiW (lpString1=".xlsx", lpString2="2.CNV") returned -1 [0123.057] lstrlenW (lpString=".ppt") returned 4 [0123.057] lstrcmpiW (lpString1=".ppt", lpString2=".CNV") returned 1 [0123.057] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT532.CNV") returned 67 [0123.057] lstrlenW (lpString=".zip") returned 4 [0123.057] lstrcmpiW (lpString1=".zip", lpString2=".CNV") returned 1 [0123.057] lstrlenW (lpString=".rar") returned 4 [0123.057] lstrcmpiW (lpString1=".rar", lpString2=".CNV") returned 1 [0123.057] lstrlenW (lpString=".bz2") returned 4 [0123.057] lstrcmpiW (lpString1=".bz2", lpString2=".CNV") returned -1 [0123.057] lstrlenW (lpString=".7z") returned 3 [0123.057] lstrcmpiW (lpString1=".7z", lpString2="CNV") returned -1 [0123.057] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT532.CNV") returned 67 [0123.057] lstrlenW (lpString=".dbf") returned 4 [0123.057] lstrcmpiW (lpString1=".dbf", lpString2=".CNV") returned 1 [0123.057] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT532.CNV") returned 67 [0123.057] lstrlenW (lpString=".1cd") returned 4 [0123.057] lstrcmpiW (lpString1=".1cd", lpString2=".CNV") returned -1 [0123.057] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT532.CNV") returned 67 [0123.057] lstrlenW (lpString=".jpg") returned 4 [0123.057] lstrcmpiW (lpString1=".jpg", lpString2=".CNV") returned 1 [0123.057] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT532.CNV") returned 67 [0123.057] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT532.CNV") returned 67 [0123.057] lstrlenW (lpString=".doc") returned 4 [0123.057] lstrcmpiW (lpString1=".doc", lpString2=".CNV") returned 1 [0123.057] lstrlenW (lpString=".docx") returned 5 [0123.057] lstrcmpiW (lpString1=".docx", lpString2="2.CNV") returned -1 [0123.057] lstrlenW (lpString=".pdf") returned 4 [0123.058] lstrcmpiW (lpString1=".pdf", lpString2=".CNV") returned 1 [0123.058] lstrlenW (lpString=".xls") returned 4 [0123.058] lstrcmpiW (lpString1=".xls", lpString2=".CNV") returned 1 [0123.058] lstrlenW (lpString=".xlsx") returned 5 [0123.058] lstrcmpiW (lpString1=".xlsx", lpString2="2.CNV") returned -1 [0123.058] lstrlenW (lpString=".ppt") returned 4 [0123.058] lstrcmpiW (lpString1=".ppt", lpString2=".CNV") returned 1 [0123.058] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT532.CNV") returned 67 [0123.058] lstrlenW (lpString=".zip") returned 4 [0123.058] lstrcmpiW (lpString1=".zip", lpString2=".CNV") returned 1 [0123.058] lstrlenW (lpString=".rar") returned 4 [0123.058] lstrcmpiW (lpString1=".rar", lpString2=".CNV") returned 1 [0123.058] lstrlenW (lpString=".bz2") returned 4 [0123.058] lstrcmpiW (lpString1=".bz2", lpString2=".CNV") returned -1 [0123.058] lstrlenW (lpString=".7z") returned 3 [0123.058] lstrcmpiW (lpString1=".7z", lpString2="CNV") returned -1 [0123.058] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT532.CNV") returned 67 [0123.058] lstrlenW (lpString=".dbf") returned 4 [0123.058] lstrcmpiW (lpString1=".dbf", lpString2=".CNV") returned 1 [0123.058] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT532.CNV") returned 67 [0123.058] lstrlenW (lpString=".1cd") returned 4 [0123.058] lstrcmpiW (lpString1=".1cd", lpString2=".CNV") returned -1 [0123.058] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT532.CNV") returned 67 [0123.058] lstrlenW (lpString=".jpg") returned 4 [0123.058] lstrcmpiW (lpString1=".jpg", lpString2=".CNV") returned 1 [0123.058] lstrcmpiW (lpString1=".ELM", lpString2=".waifu") returned -1 [0123.058] lstrlenW (lpString="AFTRNOON.ELM") returned 12 [0123.058] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\aftrnoon.elm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0123.059] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x292f944 | out: lpFileSize=0x292f944*=58766) returned 1 [0123.059] CloseHandle (hObject=0x1b0) returned 1 [0123.059] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\aftrnoon.elm")) returned 0x20 [0123.059] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.ELM.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\aftrnoon.elm.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0123.059] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\aftrnoon.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0123.059] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x292f8f0 | out: lpNewFilePointer=0x0) returned 1 [0123.059] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x292f8f0 | out: lpNewFilePointer=0x0) returned 1 [0123.060] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.ELM.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\aftrnoon.elm.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x240 [0123.060] GetLastError () returned 0x0 [0123.060] ReadFile (in: hFile=0x1b0, lpBuffer=0x3be0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x292f8fc, lpOverlapped=0x0 | out: lpBuffer=0x3be0020*, lpNumberOfBytesRead=0x292f8fc*=0xe58e, lpOverlapped=0x0) returned 1 [0123.183] WriteFile (in: hFile=0x240, lpBuffer=0x3be0020*, nNumberOfBytesToWrite=0xe590, lpNumberOfBytesWritten=0x292f6c4, lpOverlapped=0x0 | out: lpBuffer=0x3be0020*, lpNumberOfBytesWritten=0x292f6c4*=0xe590, lpOverlapped=0x0) returned 1 [0123.183] ReadFile (in: hFile=0x1b0, lpBuffer=0x3be0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x292f8fc, lpOverlapped=0x0 | out: lpBuffer=0x3be0020*, lpNumberOfBytesRead=0x292f8fc*=0x0, lpOverlapped=0x0) returned 1 [0123.183] WriteFile (in: hFile=0x240, lpBuffer=0x3be0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x292f6c4, lpOverlapped=0x0 | out: lpBuffer=0x3be0020*, lpNumberOfBytesWritten=0x292f6c4*=0xec, lpOverlapped=0x0) returned 1 [0123.184] SetEndOfFile (hFile=0x240) returned 1 [0123.184] CloseHandle (hObject=0x240) returned 1 [0123.184] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x292f8f0 | out: lpNewFilePointer=0x0) returned 1 [0123.184] SetEndOfFile (hFile=0x1b0) returned 1 [0123.184] CloseHandle (hObject=0x1b0) returned 1 [0123.184] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.ELM.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0123.184] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\aftrnoon.elm")) returned 1 [0123.185] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.ELM") returned 77 [0123.185] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.ELM") returned 77 [0123.185] lstrlenW (lpString=".doc") returned 4 [0123.185] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1 [0123.185] lstrlenW (lpString=".docx") returned 5 [0123.185] lstrcmpiW (lpString1=".docx", lpString2="N.ELM") returned -1 [0123.185] lstrlenW (lpString=".pdf") returned 4 [0123.185] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1 [0123.185] lstrlenW (lpString=".xls") returned 4 [0123.185] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1 [0123.185] lstrlenW (lpString=".xlsx") returned 5 [0123.185] lstrcmpiW (lpString1=".xlsx", lpString2="N.ELM") returned -1 [0123.185] lstrlenW (lpString=".ppt") returned 4 [0123.185] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1 [0123.185] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.ELM") returned 77 [0123.185] lstrlenW (lpString=".zip") returned 4 [0123.185] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1 [0123.185] lstrlenW (lpString=".rar") returned 4 [0123.185] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1 [0123.185] lstrlenW (lpString=".bz2") returned 4 [0123.185] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1 [0123.185] lstrlenW (lpString=".7z") returned 3 [0123.185] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1 [0123.185] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.ELM") returned 77 [0123.185] lstrlenW (lpString=".dbf") returned 4 [0123.185] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1 [0123.185] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.ELM") returned 77 [0123.185] lstrlenW (lpString=".1cd") returned 4 [0123.185] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1 [0123.185] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.ELM") returned 77 [0123.185] lstrlenW (lpString=".jpg") returned 4 [0123.185] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1 [0123.185] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.ELM") returned 77 [0123.185] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.ELM") returned 77 [0123.185] lstrlenW (lpString=".doc") returned 4 [0123.185] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1 [0123.185] lstrlenW (lpString=".docx") returned 5 [0123.185] lstrcmpiW (lpString1=".docx", lpString2="N.ELM") returned -1 [0123.185] lstrlenW (lpString=".pdf") returned 4 [0123.185] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1 [0123.185] lstrlenW (lpString=".xls") returned 4 [0123.186] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1 [0123.186] lstrlenW (lpString=".xlsx") returned 5 [0123.186] lstrcmpiW (lpString1=".xlsx", lpString2="N.ELM") returned -1 [0123.186] lstrlenW (lpString=".ppt") returned 4 [0123.186] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1 [0123.186] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.ELM") returned 77 [0123.186] lstrlenW (lpString=".zip") returned 4 [0123.186] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1 [0123.186] lstrlenW (lpString=".rar") returned 4 [0123.186] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1 [0123.186] lstrlenW (lpString=".bz2") returned 4 [0123.186] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1 [0123.186] lstrlenW (lpString=".7z") returned 3 [0123.186] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1 [0123.186] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.ELM") returned 77 [0123.186] lstrlenW (lpString=".dbf") returned 4 [0123.186] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1 [0123.186] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.ELM") returned 77 [0123.186] lstrlenW (lpString=".1cd") returned 4 [0123.186] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1 [0123.186] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.ELM") returned 77 [0123.186] lstrlenW (lpString=".jpg") returned 4 [0123.186] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1 [0123.186] lstrcmpiW (lpString1=".INF", lpString2=".waifu") returned -1 [0123.186] lstrlenW (lpString="BLENDS.INF") returned 10 [0123.186] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\blends.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0123.187] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x292f944 | out: lpFileSize=0x292f944*=534) returned 1 [0123.187] CloseHandle (hObject=0x1b0) returned 1 [0123.187] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\blends.inf")) returned 0x20 [0123.187] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\blends.inf.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0123.187] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\blends.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0123.187] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x292f8f0 | out: lpNewFilePointer=0x0) returned 1 [0123.187] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x292f8f0 | out: lpNewFilePointer=0x0) returned 1 [0123.187] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\blends.inf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x240 [0123.187] GetLastError () returned 0x0 [0123.187] ReadFile (in: hFile=0x1b0, lpBuffer=0x3be0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x292f8fc, lpOverlapped=0x0 | out: lpBuffer=0x3be0020*, lpNumberOfBytesRead=0x292f8fc*=0x216, lpOverlapped=0x0) returned 1 [0123.188] WriteFile (in: hFile=0x240, lpBuffer=0x3be0020*, nNumberOfBytesToWrite=0x220, lpNumberOfBytesWritten=0x292f6c4, lpOverlapped=0x0 | out: lpBuffer=0x3be0020*, lpNumberOfBytesWritten=0x292f6c4*=0x220, lpOverlapped=0x0) returned 1 [0123.189] ReadFile (in: hFile=0x1b0, lpBuffer=0x3be0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x292f8fc, lpOverlapped=0x0 | out: lpBuffer=0x3be0020*, lpNumberOfBytesRead=0x292f8fc*=0x0, lpOverlapped=0x0) returned 1 [0123.189] WriteFile (in: hFile=0x240, lpBuffer=0x3be0020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x292f6c4, lpOverlapped=0x0 | out: lpBuffer=0x3be0020*, lpNumberOfBytesWritten=0x292f6c4*=0xe8, lpOverlapped=0x0) returned 1 [0123.189] SetEndOfFile (hFile=0x240) returned 1 [0123.189] CloseHandle (hObject=0x240) returned 1 [0123.189] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x292f8f0 | out: lpNewFilePointer=0x0) returned 1 [0123.189] SetEndOfFile (hFile=0x1b0) returned 1 [0123.189] CloseHandle (hObject=0x1b0) returned 1 [0123.189] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0123.190] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\blends.inf")) returned 1 [0123.190] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF") returned 73 [0123.190] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF") returned 73 [0123.190] lstrlenW (lpString=".doc") returned 4 [0123.190] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1 [0123.190] lstrlenW (lpString=".docx") returned 5 [0123.190] lstrcmpiW (lpString1=".docx", lpString2="S.INF") returned -1 [0123.190] lstrlenW (lpString=".pdf") returned 4 [0123.190] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1 [0123.190] lstrlenW (lpString=".xls") returned 4 [0123.190] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1 [0123.190] lstrlenW (lpString=".xlsx") returned 5 [0123.190] lstrcmpiW (lpString1=".xlsx", lpString2="S.INF") returned -1 [0123.190] lstrlenW (lpString=".ppt") returned 4 [0123.190] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1 [0123.190] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF") returned 73 [0123.190] lstrlenW (lpString=".zip") returned 4 [0123.190] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1 [0123.190] lstrlenW (lpString=".rar") returned 4 [0123.190] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1 [0123.190] lstrlenW (lpString=".bz2") returned 4 [0123.190] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1 [0123.190] lstrlenW (lpString=".7z") returned 3 [0123.190] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1 [0123.190] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF") returned 73 [0123.190] lstrlenW (lpString=".dbf") returned 4 [0123.190] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1 [0123.190] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF") returned 73 [0123.190] lstrlenW (lpString=".1cd") returned 4 [0123.190] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1 [0123.191] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF") returned 73 [0123.191] lstrlenW (lpString=".jpg") returned 4 [0123.191] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1 [0123.191] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF") returned 73 [0123.191] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF") returned 73 [0123.191] lstrlenW (lpString=".doc") returned 4 [0123.191] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1 [0123.191] lstrlenW (lpString=".docx") returned 5 [0123.191] lstrcmpiW (lpString1=".docx", lpString2="S.INF") returned -1 [0123.191] lstrlenW (lpString=".pdf") returned 4 [0123.191] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1 [0123.191] lstrlenW (lpString=".xls") returned 4 [0123.191] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1 [0123.191] lstrlenW (lpString=".xlsx") returned 5 [0123.192] lstrcmpiW (lpString1=".xlsx", lpString2="S.INF") returned -1 [0123.192] lstrlenW (lpString=".ppt") returned 4 [0123.192] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1 [0123.192] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF") returned 73 [0123.192] lstrlenW (lpString=".zip") returned 4 [0123.192] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1 [0123.192] lstrlenW (lpString=".rar") returned 4 [0123.192] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1 [0123.192] lstrlenW (lpString=".bz2") returned 4 [0123.192] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1 [0123.192] lstrlenW (lpString=".7z") returned 3 [0123.192] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1 [0123.192] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF") returned 73 [0123.192] lstrlenW (lpString=".dbf") returned 4 [0123.192] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1 [0123.192] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF") returned 73 [0123.192] lstrlenW (lpString=".1cd") returned 4 [0123.192] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1 [0123.192] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF") returned 73 [0123.192] lstrlenW (lpString=".jpg") returned 4 [0123.192] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1 [0123.192] lstrcmpiW (lpString1=".ELM", lpString2=".waifu") returned -1 [0123.192] lstrlenW (lpString="BLUECALM.ELM") returned 12 [0123.192] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\bluecalm.elm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0123.192] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x292f944 | out: lpFileSize=0x292f944*=49850) returned 1 [0123.193] CloseHandle (hObject=0x1b0) returned 1 [0123.193] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\bluecalm.elm")) returned 0x20 [0123.193] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\bluecalm.elm.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0123.193] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\bluecalm.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0123.193] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x292f8f0 | out: lpNewFilePointer=0x0) returned 1 [0123.193] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x292f8f0 | out: lpNewFilePointer=0x0) returned 1 [0123.193] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\bluecalm.elm.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x240 [0123.193] GetLastError () returned 0x0 [0123.193] ReadFile (in: hFile=0x1b0, lpBuffer=0x3be0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x292f8fc, lpOverlapped=0x0 | out: lpBuffer=0x3be0020*, lpNumberOfBytesRead=0x292f8fc*=0xc2ba, lpOverlapped=0x0) returned 1 [0123.229] WriteFile (in: hFile=0x240, lpBuffer=0x3be0020*, nNumberOfBytesToWrite=0xc2c0, lpNumberOfBytesWritten=0x292f6c4, lpOverlapped=0x0 | out: lpBuffer=0x3be0020*, lpNumberOfBytesWritten=0x292f6c4*=0xc2c0, lpOverlapped=0x0) returned 1 [0123.230] ReadFile (in: hFile=0x1b0, lpBuffer=0x3be0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x292f8fc, lpOverlapped=0x0 | out: lpBuffer=0x3be0020*, lpNumberOfBytesRead=0x292f8fc*=0x0, lpOverlapped=0x0) returned 1 [0123.230] WriteFile (in: hFile=0x240, lpBuffer=0x3be0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x292f6c4, lpOverlapped=0x0 | out: lpBuffer=0x3be0020*, lpNumberOfBytesWritten=0x292f6c4*=0xec, lpOverlapped=0x0) returned 1 [0123.230] SetEndOfFile (hFile=0x240) returned 1 [0123.230] CloseHandle (hObject=0x240) returned 1 [0123.230] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x292f8f0 | out: lpNewFilePointer=0x0) returned 1 [0123.230] SetEndOfFile (hFile=0x1b0) returned 1 [0123.231] CloseHandle (hObject=0x1b0) returned 1 [0123.231] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0123.232] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\bluecalm.elm")) returned 1 [0123.232] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM") returned 77 [0123.232] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM") returned 77 [0123.232] lstrlenW (lpString=".doc") returned 4 [0123.232] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1 [0123.232] lstrlenW (lpString=".docx") returned 5 [0123.232] lstrcmpiW (lpString1=".docx", lpString2="M.ELM") returned -1 [0123.232] lstrlenW (lpString=".pdf") returned 4 [0123.232] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1 [0123.232] lstrlenW (lpString=".xls") returned 4 [0123.232] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1 [0123.232] lstrlenW (lpString=".xlsx") returned 5 [0123.232] lstrcmpiW (lpString1=".xlsx", lpString2="M.ELM") returned -1 [0123.232] lstrlenW (lpString=".ppt") returned 4 [0123.232] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1 [0123.232] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM") returned 77 [0123.232] lstrlenW (lpString=".zip") returned 4 [0123.232] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1 [0123.232] lstrlenW (lpString=".rar") returned 4 [0123.232] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1 [0123.232] lstrlenW (lpString=".bz2") returned 4 [0123.232] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1 [0123.232] lstrlenW (lpString=".7z") returned 3 [0123.232] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1 [0123.232] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM") returned 77 [0123.232] lstrlenW (lpString=".dbf") returned 4 [0123.232] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1 [0123.232] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM") returned 77 [0123.232] lstrlenW (lpString=".1cd") returned 4 [0123.232] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1 [0123.232] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM") returned 77 [0123.232] lstrlenW (lpString=".jpg") returned 4 [0123.232] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1 [0123.232] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM") returned 77 [0123.232] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM") returned 77 [0123.232] lstrlenW (lpString=".doc") returned 4 [0123.232] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1 [0123.232] lstrlenW (lpString=".docx") returned 5 [0123.232] lstrcmpiW (lpString1=".docx", lpString2="M.ELM") returned -1 [0123.233] lstrlenW (lpString=".pdf") returned 4 [0123.233] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1 [0123.233] lstrlenW (lpString=".xls") returned 4 [0123.233] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1 [0123.233] lstrlenW (lpString=".xlsx") returned 5 [0123.233] lstrcmpiW (lpString1=".xlsx", lpString2="M.ELM") returned -1 [0123.233] lstrlenW (lpString=".ppt") returned 4 [0123.233] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1 [0123.233] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM") returned 77 [0123.233] lstrlenW (lpString=".zip") returned 4 [0123.233] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1 [0123.233] lstrlenW (lpString=".rar") returned 4 [0123.233] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1 [0123.233] lstrlenW (lpString=".bz2") returned 4 [0123.233] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1 [0123.233] lstrlenW (lpString=".7z") returned 3 [0123.233] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1 [0123.233] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM") returned 77 [0123.233] lstrlenW (lpString=".dbf") returned 4 [0123.233] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1 [0123.233] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM") returned 77 [0123.233] lstrlenW (lpString=".1cd") returned 4 [0123.233] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1 [0123.233] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM") returned 77 [0123.233] lstrlenW (lpString=".jpg") returned 4 [0123.233] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1 [0123.233] lstrcmpiW (lpString1=".ELM", lpString2=".waifu") returned -1 [0123.233] lstrlenW (lpString="BOLDSTRI.ELM") returned 12 [0123.233] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\boldstri.elm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0123.234] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x292f944 | out: lpFileSize=0x292f944*=60154) returned 1 [0123.234] CloseHandle (hObject=0x1b0) returned 1 [0123.234] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\boldstri.elm")) returned 0x20 [0123.234] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\boldstri.elm.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0123.235] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\boldstri.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0123.235] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x292f8f0 | out: lpNewFilePointer=0x0) returned 1 [0123.235] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x292f8f0 | out: lpNewFilePointer=0x0) returned 1 [0123.235] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\boldstri.elm.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0123.236] GetLastError () returned 0x0 [0123.236] ReadFile (in: hFile=0x1b0, lpBuffer=0x3be0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x292f8fc, lpOverlapped=0x0 | out: lpBuffer=0x3be0020*, lpNumberOfBytesRead=0x292f8fc*=0xeafa, lpOverlapped=0x0) returned 1 [0123.681] WriteFile (in: hFile=0x20c, lpBuffer=0x3be0020*, nNumberOfBytesToWrite=0xeb00, lpNumberOfBytesWritten=0x292f6c4, lpOverlapped=0x0 | out: lpBuffer=0x3be0020*, lpNumberOfBytesWritten=0x292f6c4*=0xeb00, lpOverlapped=0x0) returned 1 [0124.143] ReadFile (in: hFile=0x1b0, lpBuffer=0x3be0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x292f8fc, lpOverlapped=0x0 | out: lpBuffer=0x3be0020*, lpNumberOfBytesRead=0x292f8fc*=0x0, lpOverlapped=0x0) returned 1 [0124.143] WriteFile (in: hFile=0x20c, lpBuffer=0x3be0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x292f6c4, lpOverlapped=0x0 | out: lpBuffer=0x3be0020*, lpNumberOfBytesWritten=0x292f6c4*=0xec, lpOverlapped=0x0) returned 1 [0124.143] SetEndOfFile (hFile=0x20c) returned 1 [0124.144] CloseHandle (hObject=0x20c) returned 1 [0124.144] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x292f8f0 | out: lpNewFilePointer=0x0) returned 1 [0124.144] SetEndOfFile (hFile=0x1b0) returned 1 [0124.144] CloseHandle (hObject=0x1b0) returned 1 [0124.144] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0124.144] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\boldstri.elm")) returned 1 [0124.145] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM") returned 77 [0124.145] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM") returned 77 [0124.145] lstrlenW (lpString=".doc") returned 4 [0124.145] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1 [0124.145] lstrlenW (lpString=".docx") returned 5 [0124.145] lstrcmpiW (lpString1=".docx", lpString2="I.ELM") returned -1 [0124.145] lstrlenW (lpString=".pdf") returned 4 [0124.145] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1 [0124.145] lstrlenW (lpString=".xls") returned 4 [0124.145] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1 [0124.145] lstrlenW (lpString=".xlsx") returned 5 [0124.145] lstrcmpiW (lpString1=".xlsx", lpString2="I.ELM") returned -1 [0124.145] lstrlenW (lpString=".ppt") returned 4 [0124.145] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1 [0124.145] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM") returned 77 [0124.145] lstrlenW (lpString=".zip") returned 4 [0124.145] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1 [0124.145] lstrlenW (lpString=".rar") returned 4 [0124.145] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1 [0124.145] lstrlenW (lpString=".bz2") returned 4 [0124.145] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1 [0124.145] lstrlenW (lpString=".7z") returned 3 [0124.145] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1 [0124.145] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM") returned 77 [0124.145] lstrlenW (lpString=".dbf") returned 4 [0124.145] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1 [0124.145] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM") returned 77 [0124.145] lstrlenW (lpString=".1cd") returned 4 [0124.145] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1 [0124.145] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM") returned 77 [0124.145] lstrlenW (lpString=".jpg") returned 4 [0124.145] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1 [0124.145] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM") returned 77 [0124.145] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM") returned 77 [0124.145] lstrlenW (lpString=".doc") returned 4 [0124.145] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1 [0124.145] lstrlenW (lpString=".docx") returned 5 [0124.145] lstrcmpiW (lpString1=".docx", lpString2="I.ELM") returned -1 [0124.145] lstrlenW (lpString=".pdf") returned 4 [0124.145] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1 [0124.145] lstrlenW (lpString=".xls") returned 4 [0124.145] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1 [0124.145] lstrlenW (lpString=".xlsx") returned 5 [0124.145] lstrcmpiW (lpString1=".xlsx", lpString2="I.ELM") returned -1 [0124.145] lstrlenW (lpString=".ppt") returned 4 [0124.145] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1 [0124.145] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM") returned 77 [0124.145] lstrlenW (lpString=".zip") returned 4 [0124.145] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1 [0124.145] lstrlenW (lpString=".rar") returned 4 [0124.146] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1 [0124.146] lstrlenW (lpString=".bz2") returned 4 [0124.146] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1 [0124.146] lstrlenW (lpString=".7z") returned 3 [0124.146] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1 [0124.146] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM") returned 77 [0124.146] lstrlenW (lpString=".dbf") returned 4 [0124.146] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1 [0124.146] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM") returned 77 [0124.146] lstrlenW (lpString=".1cd") returned 4 [0124.146] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1 [0124.146] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM") returned 77 [0124.146] lstrlenW (lpString=".jpg") returned 4 [0124.146] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1 [0124.146] lstrcmpiW (lpString1=".INF", lpString2=".waifu") returned -1 [0124.146] lstrlenW (lpString="CONCRETE.INF") returned 12 [0124.146] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\concrete.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x23c [0124.243] GetFileSizeEx (in: hFile=0x23c, lpFileSize=0x292f944 | out: lpFileSize=0x292f944*=480) returned 1 [0124.243] CloseHandle (hObject=0x23c) returned 1 [0124.243] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\concrete.inf")) returned 0x20 [0124.243] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\concrete.inf.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0124.243] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\concrete.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x23c [0124.243] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x292f8f0 | out: lpNewFilePointer=0x0) returned 1 [0124.243] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x292f8f0 | out: lpNewFilePointer=0x0) returned 1 [0124.243] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\concrete.inf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0124.244] GetLastError () returned 0x0 [0124.244] ReadFile (in: hFile=0x23c, lpBuffer=0x3be0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x292f8fc, lpOverlapped=0x0 | out: lpBuffer=0x3be0020*, lpNumberOfBytesRead=0x292f8fc*=0x1e0, lpOverlapped=0x0) returned 1 [0124.244] WriteFile (in: hFile=0x180, lpBuffer=0x3be0020*, nNumberOfBytesToWrite=0x1f0, lpNumberOfBytesWritten=0x292f6c4, lpOverlapped=0x0 | out: lpBuffer=0x3be0020*, lpNumberOfBytesWritten=0x292f6c4*=0x1f0, lpOverlapped=0x0) returned 1 [0124.245] ReadFile (in: hFile=0x23c, lpBuffer=0x3be0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x292f8fc, lpOverlapped=0x0 | out: lpBuffer=0x3be0020*, lpNumberOfBytesRead=0x292f8fc*=0x0, lpOverlapped=0x0) returned 1 [0124.245] WriteFile (in: hFile=0x180, lpBuffer=0x3be0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x292f6c4, lpOverlapped=0x0 | out: lpBuffer=0x3be0020*, lpNumberOfBytesWritten=0x292f6c4*=0xec, lpOverlapped=0x0) returned 1 [0124.245] SetEndOfFile (hFile=0x180) returned 1 [0124.245] CloseHandle (hObject=0x180) returned 1 [0124.245] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x292f8f0 | out: lpNewFilePointer=0x0) returned 1 [0124.245] SetEndOfFile (hFile=0x23c) returned 1 [0124.246] CloseHandle (hObject=0x23c) returned 1 [0124.246] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0124.246] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\concrete.inf")) returned 1 [0124.246] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF") returned 77 [0124.246] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF") returned 77 [0124.246] lstrlenW (lpString=".doc") returned 4 [0124.246] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1 [0124.246] lstrlenW (lpString=".docx") returned 5 [0124.246] lstrcmpiW (lpString1=".docx", lpString2="E.INF") returned -1 [0124.246] lstrlenW (lpString=".pdf") returned 4 [0124.246] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1 [0124.246] lstrlenW (lpString=".xls") returned 4 [0124.246] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1 [0124.246] lstrlenW (lpString=".xlsx") returned 5 [0124.246] lstrcmpiW (lpString1=".xlsx", lpString2="E.INF") returned -1 [0124.246] lstrlenW (lpString=".ppt") returned 4 [0124.246] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1 [0124.246] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF") returned 77 [0124.246] lstrlenW (lpString=".zip") returned 4 [0124.246] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1 [0124.246] lstrlenW (lpString=".rar") returned 4 [0124.246] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1 [0124.246] lstrlenW (lpString=".bz2") returned 4 [0124.246] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1 [0124.246] lstrlenW (lpString=".7z") returned 3 [0124.246] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1 [0124.246] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF") returned 77 [0124.246] lstrlenW (lpString=".dbf") returned 4 [0124.246] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1 [0124.246] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF") returned 77 [0124.246] lstrlenW (lpString=".1cd") returned 4 [0124.246] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1 [0124.246] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF") returned 77 [0124.247] lstrlenW (lpString=".jpg") returned 4 [0124.247] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1 [0124.247] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF") returned 77 [0124.247] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF") returned 77 [0124.247] lstrlenW (lpString=".doc") returned 4 [0124.247] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1 [0124.247] lstrlenW (lpString=".docx") returned 5 [0124.247] lstrcmpiW (lpString1=".docx", lpString2="E.INF") returned -1 [0124.247] lstrlenW (lpString=".pdf") returned 4 [0124.247] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1 [0124.247] lstrlenW (lpString=".xls") returned 4 [0124.247] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1 [0124.247] lstrlenW (lpString=".xlsx") returned 5 [0124.247] lstrcmpiW (lpString1=".xlsx", lpString2="E.INF") returned -1 [0124.247] lstrlenW (lpString=".ppt") returned 4 [0124.247] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1 [0124.247] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF") returned 77 [0124.247] lstrlenW (lpString=".zip") returned 4 [0124.247] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1 [0124.247] lstrlenW (lpString=".rar") returned 4 [0124.247] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1 [0124.247] lstrlenW (lpString=".bz2") returned 4 [0124.247] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1 [0124.247] lstrlenW (lpString=".7z") returned 3 [0124.247] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1 [0124.247] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF") returned 77 [0124.247] lstrlenW (lpString=".dbf") returned 4 [0124.247] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1 [0124.247] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF") returned 77 [0124.247] lstrlenW (lpString=".1cd") returned 4 [0124.247] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1 [0124.247] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF") returned 77 [0124.247] lstrlenW (lpString=".jpg") returned 4 [0124.247] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1 [0124.247] lstrcmpiW (lpString1=".ELM", lpString2=".waifu") returned -1 [0124.247] lstrlenW (lpString="ECLIPSE.ELM") returned 11 [0124.247] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\eclipse.elm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x23c [0124.248] GetFileSizeEx (in: hFile=0x23c, lpFileSize=0x292f944 | out: lpFileSize=0x292f944*=118577) returned 1 [0124.248] CloseHandle (hObject=0x23c) returned 1 [0124.248] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\eclipse.elm")) returned 0x20 [0124.248] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\eclipse.elm.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0124.248] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\eclipse.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x23c [0124.248] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x292f8f0 | out: lpNewFilePointer=0x0) returned 1 [0124.248] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x292f8f0 | out: lpNewFilePointer=0x0) returned 1 [0124.248] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\eclipse.elm.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0124.249] GetLastError () returned 0x0 [0124.249] ReadFile (in: hFile=0x23c, lpBuffer=0x3be0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x292f8fc, lpOverlapped=0x0 | out: lpBuffer=0x3be0020*, lpNumberOfBytesRead=0x292f8fc*=0x1cf31, lpOverlapped=0x0) returned 1 [0124.317] WriteFile (in: hFile=0x180, lpBuffer=0x3be0020*, nNumberOfBytesToWrite=0x1cf40, lpNumberOfBytesWritten=0x292f6c4, lpOverlapped=0x0 | out: lpBuffer=0x3be0020*, lpNumberOfBytesWritten=0x292f6c4*=0x1cf40, lpOverlapped=0x0) returned 1 [0124.318] ReadFile (in: hFile=0x23c, lpBuffer=0x3be0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x292f8fc, lpOverlapped=0x0 | out: lpBuffer=0x3be0020*, lpNumberOfBytesRead=0x292f8fc*=0x0, lpOverlapped=0x0) returned 1 [0124.318] WriteFile (in: hFile=0x180, lpBuffer=0x3be0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x292f6c4, lpOverlapped=0x0 | out: lpBuffer=0x3be0020*, lpNumberOfBytesWritten=0x292f6c4*=0xea, lpOverlapped=0x0) returned 1 [0124.319] SetEndOfFile (hFile=0x180) returned 1 [0124.319] CloseHandle (hObject=0x180) returned 1 [0124.319] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x292f8f0 | out: lpNewFilePointer=0x0) returned 1 [0124.319] SetEndOfFile (hFile=0x23c) returned 1 [0124.320] CloseHandle (hObject=0x23c) returned 1 [0124.320] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0124.320] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\eclipse.elm")) returned 1 [0124.321] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM") returned 75 [0124.321] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM") returned 75 [0124.321] lstrlenW (lpString=".doc") returned 4 [0124.321] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1 [0124.321] lstrlenW (lpString=".docx") returned 5 [0124.321] lstrcmpiW (lpString1=".docx", lpString2="E.ELM") returned -1 [0124.321] lstrlenW (lpString=".pdf") returned 4 [0124.321] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1 [0124.321] lstrlenW (lpString=".xls") returned 4 [0124.321] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1 [0124.321] lstrlenW (lpString=".xlsx") returned 5 [0124.321] lstrcmpiW (lpString1=".xlsx", lpString2="E.ELM") returned -1 [0124.321] lstrlenW (lpString=".ppt") returned 4 [0124.321] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1 [0124.321] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM") returned 75 [0124.321] lstrlenW (lpString=".zip") returned 4 [0124.322] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1 [0124.322] lstrlenW (lpString=".rar") returned 4 [0124.322] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1 [0124.322] lstrlenW (lpString=".bz2") returned 4 [0124.322] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1 [0124.322] lstrlenW (lpString=".7z") returned 3 [0124.322] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1 [0124.322] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM") returned 75 [0124.322] lstrlenW (lpString=".dbf") returned 4 [0124.322] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1 [0124.322] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM") returned 75 [0124.322] lstrlenW (lpString=".1cd") returned 4 [0124.322] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1 [0124.322] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM") returned 75 [0124.322] lstrlenW (lpString=".jpg") returned 4 [0124.322] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1 [0124.322] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM") returned 75 [0124.322] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM") returned 75 [0124.322] lstrlenW (lpString=".doc") returned 4 [0124.322] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1 [0124.322] lstrlenW (lpString=".docx") returned 5 [0124.322] lstrcmpiW (lpString1=".docx", lpString2="E.ELM") returned -1 [0124.322] lstrlenW (lpString=".pdf") returned 4 [0124.322] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1 [0124.322] lstrlenW (lpString=".xls") returned 4 [0124.322] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1 [0124.322] lstrlenW (lpString=".xlsx") returned 5 [0124.322] lstrcmpiW (lpString1=".xlsx", lpString2="E.ELM") returned -1 [0124.322] lstrlenW (lpString=".ppt") returned 4 [0124.322] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1 [0124.322] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM") returned 75 [0124.322] lstrlenW (lpString=".zip") returned 4 [0124.322] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1 [0124.322] lstrlenW (lpString=".rar") returned 4 [0124.322] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1 [0124.322] lstrlenW (lpString=".bz2") returned 4 [0124.322] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1 [0124.322] lstrlenW (lpString=".7z") returned 3 [0124.322] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1 [0124.322] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM") returned 75 [0124.322] lstrlenW (lpString=".dbf") returned 4 [0124.322] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1 [0124.322] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM") returned 75 [0124.322] lstrlenW (lpString=".1cd") returned 4 [0124.322] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1 [0124.322] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM") returned 75 [0124.322] lstrlenW (lpString=".jpg") returned 4 [0124.322] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1 [0124.323] lstrcmpiW (lpString1=".INF", lpString2=".waifu") returned -1 [0124.323] lstrlenW (lpString="EVRGREEN.INF") returned 12 [0124.323] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\evrgreen.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x23c [0124.323] GetFileSizeEx (in: hFile=0x23c, lpFileSize=0x292f944 | out: lpFileSize=0x292f944*=547) returned 1 [0124.323] CloseHandle (hObject=0x23c) returned 1 [0124.323] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\evrgreen.inf")) returned 0x20 [0124.324] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\evrgreen.inf.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0124.324] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\evrgreen.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x23c [0124.324] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x292f8f0 | out: lpNewFilePointer=0x0) returned 1 [0124.324] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x292f8f0 | out: lpNewFilePointer=0x0) returned 1 [0124.324] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\evrgreen.inf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0124.324] GetLastError () returned 0x0 [0124.324] ReadFile (in: hFile=0x23c, lpBuffer=0x3be0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x292f8fc, lpOverlapped=0x0 | out: lpBuffer=0x3be0020*, lpNumberOfBytesRead=0x292f8fc*=0x223, lpOverlapped=0x0) returned 1 [0124.325] WriteFile (in: hFile=0x180, lpBuffer=0x3be0020*, nNumberOfBytesToWrite=0x230, lpNumberOfBytesWritten=0x292f6c4, lpOverlapped=0x0 | out: lpBuffer=0x3be0020*, lpNumberOfBytesWritten=0x292f6c4*=0x230, lpOverlapped=0x0) returned 1 [0124.325] ReadFile (in: hFile=0x23c, lpBuffer=0x3be0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x292f8fc, lpOverlapped=0x0 | out: lpBuffer=0x3be0020*, lpNumberOfBytesRead=0x292f8fc*=0x0, lpOverlapped=0x0) returned 1 [0124.325] WriteFile (in: hFile=0x180, lpBuffer=0x3be0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x292f6c4, lpOverlapped=0x0 | out: lpBuffer=0x3be0020*, lpNumberOfBytesWritten=0x292f6c4*=0xec, lpOverlapped=0x0) returned 1 [0124.325] SetEndOfFile (hFile=0x180) returned 1 [0124.326] CloseHandle (hObject=0x180) returned 1 [0124.326] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x292f8f0 | out: lpNewFilePointer=0x0) returned 1 [0124.326] SetEndOfFile (hFile=0x23c) returned 1 [0124.326] CloseHandle (hObject=0x23c) returned 1 [0124.326] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0124.326] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\evrgreen.inf")) returned 1 [0124.326] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF") returned 77 [0124.326] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF") returned 77 [0124.326] lstrlenW (lpString=".doc") returned 4 [0124.327] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1 [0124.327] lstrlenW (lpString=".docx") returned 5 [0124.327] lstrcmpiW (lpString1=".docx", lpString2="N.INF") returned -1 [0124.327] lstrlenW (lpString=".pdf") returned 4 [0124.327] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1 [0124.327] lstrlenW (lpString=".xls") returned 4 [0124.327] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1 [0124.327] lstrlenW (lpString=".xlsx") returned 5 [0124.327] lstrcmpiW (lpString1=".xlsx", lpString2="N.INF") returned -1 [0124.327] lstrlenW (lpString=".ppt") returned 4 [0124.327] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1 [0124.327] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF") returned 77 [0124.327] lstrlenW (lpString=".zip") returned 4 [0124.327] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1 [0124.327] lstrlenW (lpString=".rar") returned 4 [0124.327] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1 [0124.327] lstrlenW (lpString=".bz2") returned 4 [0124.327] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1 [0124.327] lstrlenW (lpString=".7z") returned 3 [0124.327] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1 [0124.327] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF") returned 77 [0124.327] lstrlenW (lpString=".dbf") returned 4 [0124.327] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1 [0124.327] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF") returned 77 [0124.327] lstrlenW (lpString=".1cd") returned 4 [0124.327] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1 [0124.327] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF") returned 77 [0124.327] lstrlenW (lpString=".jpg") returned 4 [0124.327] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1 [0124.327] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF") returned 77 [0124.327] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF") returned 77 [0124.327] lstrlenW (lpString=".doc") returned 4 [0124.327] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1 [0124.327] lstrlenW (lpString=".docx") returned 5 [0124.327] lstrcmpiW (lpString1=".docx", lpString2="N.INF") returned -1 [0124.327] lstrlenW (lpString=".pdf") returned 4 [0124.327] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1 [0124.327] lstrlenW (lpString=".xls") returned 4 [0124.327] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1 [0124.327] lstrlenW (lpString=".xlsx") returned 5 [0124.327] lstrcmpiW (lpString1=".xlsx", lpString2="N.INF") returned -1 [0124.327] lstrlenW (lpString=".ppt") returned 4 [0124.327] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1 [0124.327] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF") returned 77 [0124.327] lstrlenW (lpString=".zip") returned 4 [0124.327] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1 [0124.327] lstrlenW (lpString=".rar") returned 4 [0124.327] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1 [0124.327] lstrlenW (lpString=".bz2") returned 4 [0124.327] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1 [0124.327] lstrlenW (lpString=".7z") returned 3 [0124.327] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1 [0124.328] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF") returned 77 [0124.328] lstrlenW (lpString=".dbf") returned 4 [0124.328] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1 [0124.328] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF") returned 77 [0124.328] lstrlenW (lpString=".1cd") returned 4 [0124.328] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1 [0124.328] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF") returned 77 [0124.328] lstrlenW (lpString=".jpg") returned 4 [0124.328] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1 [0124.328] lstrcmpiW (lpString1=".ELM", lpString2=".waifu") returned -1 [0124.328] lstrlenW (lpString="EXPEDITN.ELM") returned 12 [0124.328] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\expeditn.elm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x25c [0124.339] GetFileSizeEx (in: hFile=0x25c, lpFileSize=0x292f944 | out: lpFileSize=0x292f944*=103737) returned 1 [0124.339] CloseHandle (hObject=0x25c) returned 1 [0124.339] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\expeditn.elm")) returned 0x20 [0124.339] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\expeditn.elm.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0124.339] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\expeditn.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x25c [0124.339] SetFilePointerEx (in: hFile=0x25c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x292f8f0 | out: lpNewFilePointer=0x0) returned 1 [0124.339] SetFilePointerEx (in: hFile=0x25c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x292f8f0 | out: lpNewFilePointer=0x0) returned 1 [0124.340] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\expeditn.elm.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x23c [0124.340] GetLastError () returned 0x0 [0124.340] ReadFile (in: hFile=0x25c, lpBuffer=0x3be0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x292f8fc, lpOverlapped=0x0 | out: lpBuffer=0x3be0020*, lpNumberOfBytesRead=0x292f8fc*=0x19539, lpOverlapped=0x0) returned 1 [0124.379] WriteFile (in: hFile=0x23c, lpBuffer=0x3be0020*, nNumberOfBytesToWrite=0x19540, lpNumberOfBytesWritten=0x292f6c4, lpOverlapped=0x0 | out: lpBuffer=0x3be0020*, lpNumberOfBytesWritten=0x292f6c4*=0x19540, lpOverlapped=0x0) returned 1 [0124.380] ReadFile (in: hFile=0x25c, lpBuffer=0x3be0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x292f8fc, lpOverlapped=0x0 | out: lpBuffer=0x3be0020*, lpNumberOfBytesRead=0x292f8fc*=0x0, lpOverlapped=0x0) returned 1 [0124.381] WriteFile (in: hFile=0x23c, lpBuffer=0x3be0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x292f6c4, lpOverlapped=0x0 | out: lpBuffer=0x3be0020*, lpNumberOfBytesWritten=0x292f6c4*=0xec, lpOverlapped=0x0) returned 1 [0124.381] SetEndOfFile (hFile=0x23c) returned 1 [0124.381] CloseHandle (hObject=0x23c) returned 1 [0124.381] SetFilePointerEx (in: hFile=0x25c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x292f8f0 | out: lpNewFilePointer=0x0) returned 1 [0124.381] SetEndOfFile (hFile=0x25c) returned 1 [0124.382] CloseHandle (hObject=0x25c) returned 1 [0124.382] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0124.382] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\expeditn.elm")) returned 1 [0124.382] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM") returned 77 [0124.382] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM") returned 77 [0124.382] lstrlenW (lpString=".doc") returned 4 [0124.382] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1 [0124.382] lstrlenW (lpString=".docx") returned 5 [0124.382] lstrcmpiW (lpString1=".docx", lpString2="N.ELM") returned -1 [0124.382] lstrlenW (lpString=".pdf") returned 4 [0124.382] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1 [0124.382] lstrlenW (lpString=".xls") returned 4 [0124.383] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1 [0124.383] lstrlenW (lpString=".xlsx") returned 5 [0124.383] lstrcmpiW (lpString1=".xlsx", lpString2="N.ELM") returned -1 [0124.383] lstrlenW (lpString=".ppt") returned 4 [0124.383] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1 [0124.383] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM") returned 77 [0124.383] lstrlenW (lpString=".zip") returned 4 [0124.383] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1 [0124.383] lstrlenW (lpString=".rar") returned 4 [0124.383] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1 [0124.383] lstrlenW (lpString=".bz2") returned 4 [0124.383] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1 [0124.383] lstrlenW (lpString=".7z") returned 3 [0124.383] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1 [0124.383] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM") returned 77 [0124.383] lstrlenW (lpString=".dbf") returned 4 [0124.383] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1 [0124.383] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM") returned 77 [0124.383] lstrlenW (lpString=".1cd") returned 4 [0124.383] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1 [0124.383] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM") returned 77 [0124.383] lstrlenW (lpString=".jpg") returned 4 [0124.383] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1 [0124.383] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM") returned 77 [0124.383] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM") returned 77 [0124.383] lstrlenW (lpString=".doc") returned 4 [0124.383] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1 [0124.383] lstrlenW (lpString=".docx") returned 5 [0124.383] lstrcmpiW (lpString1=".docx", lpString2="N.ELM") returned -1 [0124.383] lstrlenW (lpString=".pdf") returned 4 [0124.383] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1 [0124.383] lstrlenW (lpString=".xls") returned 4 [0124.383] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1 [0124.383] lstrlenW (lpString=".xlsx") returned 5 [0124.383] lstrcmpiW (lpString1=".xlsx", lpString2="N.ELM") returned -1 [0124.383] lstrlenW (lpString=".ppt") returned 4 [0124.383] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1 [0124.383] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM") returned 77 [0124.384] lstrlenW (lpString=".zip") returned 4 [0124.384] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1 [0124.384] lstrlenW (lpString=".rar") returned 4 [0124.384] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1 [0124.384] lstrlenW (lpString=".bz2") returned 4 [0124.384] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1 [0124.384] lstrlenW (lpString=".7z") returned 3 [0124.384] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1 [0124.384] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM") returned 77 [0124.384] lstrlenW (lpString=".dbf") returned 4 [0124.384] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1 [0124.384] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM") returned 77 [0124.384] lstrlenW (lpString=".1cd") returned 4 [0124.384] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1 [0124.384] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM") returned 77 [0124.384] lstrlenW (lpString=".jpg") returned 4 [0124.384] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1 [0124.384] lstrcmpiW (lpString1=".INF", lpString2=".waifu") returned -1 [0124.384] lstrlenW (lpString="ICE.INF") returned 7 [0124.384] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\ice.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x25c [0124.385] GetFileSizeEx (in: hFile=0x25c, lpFileSize=0x292f944 | out: lpFileSize=0x292f944*=429) returned 1 [0124.385] CloseHandle (hObject=0x25c) returned 1 [0124.385] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\ice.inf")) returned 0x20 [0124.385] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\ice.inf.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0124.385] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\ice.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x25c [0124.385] SetFilePointerEx (in: hFile=0x25c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x292f8f0 | out: lpNewFilePointer=0x0) returned 1 [0124.385] SetFilePointerEx (in: hFile=0x25c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x292f8f0 | out: lpNewFilePointer=0x0) returned 1 [0124.385] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\ice.inf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x23c [0124.386] GetLastError () returned 0x0 [0124.386] ReadFile (in: hFile=0x25c, lpBuffer=0x3be0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x292f8fc, lpOverlapped=0x0 | out: lpBuffer=0x3be0020*, lpNumberOfBytesRead=0x292f8fc*=0x1ad, lpOverlapped=0x0) returned 1 [0124.386] WriteFile (in: hFile=0x23c, lpBuffer=0x3be0020*, nNumberOfBytesToWrite=0x1b0, lpNumberOfBytesWritten=0x292f6c4, lpOverlapped=0x0 | out: lpBuffer=0x3be0020*, lpNumberOfBytesWritten=0x292f6c4*=0x1b0, lpOverlapped=0x0) returned 1 [0124.387] ReadFile (in: hFile=0x25c, lpBuffer=0x3be0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x292f8fc, lpOverlapped=0x0 | out: lpBuffer=0x3be0020*, lpNumberOfBytesRead=0x292f8fc*=0x0, lpOverlapped=0x0) returned 1 [0124.387] WriteFile (in: hFile=0x23c, lpBuffer=0x3be0020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x292f6c4, lpOverlapped=0x0 | out: lpBuffer=0x3be0020*, lpNumberOfBytesWritten=0x292f6c4*=0xe2, lpOverlapped=0x0) returned 1 [0124.387] SetEndOfFile (hFile=0x23c) returned 1 [0124.387] CloseHandle (hObject=0x23c) returned 1 [0124.387] SetFilePointerEx (in: hFile=0x25c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x292f8f0 | out: lpNewFilePointer=0x0) returned 1 [0124.387] SetEndOfFile (hFile=0x25c) returned 1 [0124.388] CloseHandle (hObject=0x25c) returned 1 [0124.388] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0124.388] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\ice.inf")) returned 1 [0124.388] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF") returned 67 [0124.388] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF") returned 67 [0124.388] lstrlenW (lpString=".doc") returned 4 [0124.388] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1 [0124.388] lstrlenW (lpString=".docx") returned 5 [0124.388] lstrcmpiW (lpString1=".docx", lpString2="E.INF") returned -1 [0124.388] lstrlenW (lpString=".pdf") returned 4 [0124.388] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1 [0124.388] lstrlenW (lpString=".xls") returned 4 [0124.388] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1 [0124.388] lstrlenW (lpString=".xlsx") returned 5 [0124.388] lstrcmpiW (lpString1=".xlsx", lpString2="E.INF") returned -1 [0124.388] lstrlenW (lpString=".ppt") returned 4 [0124.388] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1 [0124.388] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF") returned 67 [0124.388] lstrlenW (lpString=".zip") returned 4 [0124.388] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1 [0124.388] lstrlenW (lpString=".rar") returned 4 [0124.388] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1 [0124.388] lstrlenW (lpString=".bz2") returned 4 [0124.388] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1 [0124.388] lstrlenW (lpString=".7z") returned 3 [0124.389] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1 [0124.389] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF") returned 67 [0124.389] lstrlenW (lpString=".dbf") returned 4 [0124.389] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1 [0124.389] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF") returned 67 [0124.389] lstrlenW (lpString=".1cd") returned 4 [0124.389] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1 [0124.389] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF") returned 67 [0124.389] lstrlenW (lpString=".jpg") returned 4 [0124.389] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1 [0124.389] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF") returned 67 [0124.389] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF") returned 67 [0124.389] lstrlenW (lpString=".doc") returned 4 [0124.389] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1 [0124.389] lstrlenW (lpString=".docx") returned 5 [0124.389] lstrcmpiW (lpString1=".docx", lpString2="E.INF") returned -1 [0124.389] lstrlenW (lpString=".pdf") returned 4 [0124.389] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1 [0124.389] lstrlenW (lpString=".xls") returned 4 [0124.389] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1 [0124.389] lstrlenW (lpString=".xlsx") returned 5 [0124.389] lstrcmpiW (lpString1=".xlsx", lpString2="E.INF") returned -1 [0124.389] lstrlenW (lpString=".ppt") returned 4 [0124.389] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1 [0124.389] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF") returned 67 [0124.389] lstrlenW (lpString=".zip") returned 4 [0124.389] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1 [0124.389] lstrlenW (lpString=".rar") returned 4 [0124.389] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1 [0124.389] lstrlenW (lpString=".bz2") returned 4 [0124.389] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1 [0124.389] lstrlenW (lpString=".7z") returned 3 [0124.389] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1 [0124.389] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF") returned 67 [0124.389] lstrlenW (lpString=".dbf") returned 4 [0124.389] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1 [0124.389] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF") returned 67 [0124.389] lstrlenW (lpString=".1cd") returned 4 [0124.389] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1 [0124.389] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF") returned 67 [0124.389] lstrlenW (lpString=".jpg") returned 4 [0124.389] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1 [0124.391] SetFilePointerEx (in: hFile=0x25c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x292f8f0 | out: lpNewFilePointer=0x0) returned 1 [0124.391] SetFilePointerEx (in: hFile=0x25c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x292f8f0 | out: lpNewFilePointer=0x0) returned 1 [0124.391] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\indust.elm.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x23c [0124.391] GetLastError () returned 0x0 [0124.391] ReadFile (in: hFile=0x25c, lpBuffer=0x3be0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x292f8fc, lpOverlapped=0x0 | out: lpBuffer=0x3be0020*, lpNumberOfBytesRead=0x292f8fc*=0x184e9, lpOverlapped=0x0) returned 1 [0124.408] WriteFile (in: hFile=0x23c, lpBuffer=0x3be0020*, nNumberOfBytesToWrite=0x184f0, lpNumberOfBytesWritten=0x292f6c4, lpOverlapped=0x0 | out: lpBuffer=0x3be0020*, lpNumberOfBytesWritten=0x292f6c4*=0x184f0, lpOverlapped=0x0) returned 1 [0124.409] ReadFile (in: hFile=0x25c, lpBuffer=0x3be0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x292f8fc, lpOverlapped=0x0 | out: lpBuffer=0x3be0020*, lpNumberOfBytesRead=0x292f8fc*=0x0, lpOverlapped=0x0) returned 1 [0124.409] WriteFile (in: hFile=0x23c, lpBuffer=0x3be0020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x292f6c4, lpOverlapped=0x0 | out: lpBuffer=0x3be0020*, lpNumberOfBytesWritten=0x292f6c4*=0xe8, lpOverlapped=0x0) returned 1 [0124.409] SetEndOfFile (hFile=0x23c) returned 1 [0124.409] CloseHandle (hObject=0x23c) returned 1 [0124.409] SetFilePointerEx (in: hFile=0x25c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x292f8f0 | out: lpNewFilePointer=0x0) returned 1 [0124.409] SetEndOfFile (hFile=0x25c) returned 1 [0124.410] CloseHandle (hObject=0x25c) returned 1 [0124.410] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0124.410] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\indust.elm")) returned 1 [0124.410] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM") returned 73 [0124.410] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM") returned 73 [0124.410] lstrlenW (lpString=".doc") returned 4 [0124.411] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1 [0124.411] lstrlenW (lpString=".docx") returned 5 [0124.411] lstrcmpiW (lpString1=".docx", lpString2="T.ELM") returned -1 [0124.411] lstrlenW (lpString=".pdf") returned 4 [0124.411] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1 [0124.411] lstrlenW (lpString=".xls") returned 4 [0124.411] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1 [0124.411] lstrlenW (lpString=".xlsx") returned 5 [0124.411] lstrcmpiW (lpString1=".xlsx", lpString2="T.ELM") returned -1 [0124.411] lstrlenW (lpString=".ppt") returned 4 [0124.411] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1 [0124.411] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM") returned 73 [0124.411] lstrlenW (lpString=".zip") returned 4 [0124.411] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1 [0124.411] lstrlenW (lpString=".rar") returned 4 [0124.411] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1 [0124.411] lstrlenW (lpString=".bz2") returned 4 [0124.411] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1 [0124.411] lstrlenW (lpString=".7z") returned 3 [0124.411] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1 [0124.411] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM") returned 73 [0124.411] lstrlenW (lpString=".dbf") returned 4 [0124.411] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1 [0124.411] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM") returned 73 [0124.411] lstrlenW (lpString=".1cd") returned 4 [0124.411] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1 [0124.411] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM") returned 73 [0124.411] lstrlenW (lpString=".jpg") returned 4 [0124.411] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1 [0124.442] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x292f8f0 | out: lpNewFilePointer=0x0) returned 1 [0124.442] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x292f8f0 | out: lpNewFilePointer=0x0) returned 1 [0124.442] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\journal.elm.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0124.443] GetLastError () returned 0x0 [0124.443] ReadFile (in: hFile=0x220, lpBuffer=0x3be0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x292f8fc, lpOverlapped=0x0 | out: lpBuffer=0x3be0020*, lpNumberOfBytesRead=0x292f8fc*=0xba32, lpOverlapped=0x0) returned 1 [0124.500] WriteFile (in: hFile=0x21c, lpBuffer=0x3be0020*, nNumberOfBytesToWrite=0xba40, lpNumberOfBytesWritten=0x292f6c4, lpOverlapped=0x0 | out: lpBuffer=0x3be0020*, lpNumberOfBytesWritten=0x292f6c4*=0xba40, lpOverlapped=0x0) returned 1 [0124.555] ReadFile (in: hFile=0x220, lpBuffer=0x3be0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x292f8fc, lpOverlapped=0x0 | out: lpBuffer=0x3be0020*, lpNumberOfBytesRead=0x292f8fc*=0x0, lpOverlapped=0x0) returned 1 [0124.555] WriteFile (in: hFile=0x21c, lpBuffer=0x3be0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x292f6c4, lpOverlapped=0x0 | out: lpBuffer=0x3be0020*, lpNumberOfBytesWritten=0x292f6c4*=0xea, lpOverlapped=0x0) returned 1 [0124.555] SetEndOfFile (hFile=0x21c) returned 1 [0124.555] CloseHandle (hObject=0x21c) returned 1 [0124.555] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x292f8f0 | out: lpNewFilePointer=0x0) returned 1 [0124.555] SetEndOfFile (hFile=0x220) returned 1 [0124.556] CloseHandle (hObject=0x220) returned 1 [0124.556] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0124.556] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\journal.elm")) returned 1 [0124.556] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM") returned 75 [0124.556] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM") returned 75 [0124.556] lstrlenW (lpString=".doc") returned 4 [0124.556] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1 [0124.556] lstrlenW (lpString=".docx") returned 5 [0124.556] lstrcmpiW (lpString1=".docx", lpString2="L.ELM") returned -1 [0124.556] lstrlenW (lpString=".pdf") returned 4 [0124.556] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1 [0124.557] lstrlenW (lpString=".xls") returned 4 [0124.557] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1 [0124.557] lstrlenW (lpString=".xlsx") returned 5 [0124.557] lstrcmpiW (lpString1=".xlsx", lpString2="L.ELM") returned -1 [0124.557] lstrlenW (lpString=".ppt") returned 4 [0124.557] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1 [0124.557] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM") returned 75 [0124.557] lstrlenW (lpString=".zip") returned 4 [0124.557] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1 [0124.557] lstrlenW (lpString=".rar") returned 4 [0124.557] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1 [0124.557] lstrlenW (lpString=".bz2") returned 4 [0124.557] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1 [0124.557] lstrlenW (lpString=".7z") returned 3 [0124.557] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1 [0124.557] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM") returned 75 [0124.557] lstrlenW (lpString=".dbf") returned 4 [0124.557] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1 [0124.557] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM") returned 75 [0124.557] lstrlenW (lpString=".1cd") returned 4 [0124.557] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1 [0124.557] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM") returned 75 [0124.557] lstrlenW (lpString=".jpg") returned 4 [0124.557] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1 [0124.559] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x292f8f0 | out: lpNewFilePointer=0x0) returned 1 [0124.559] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x292f8f0 | out: lpNewFilePointer=0x0) returned 1 [0124.559] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.ELM.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\radial.elm.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0124.560] GetLastError () returned 0x0 [0124.560] ReadFile (in: hFile=0x220, lpBuffer=0x3be0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x292f8fc, lpOverlapped=0x0 | out: lpBuffer=0x3be0020*, lpNumberOfBytesRead=0x292f8fc*=0xb75e, lpOverlapped=0x0) returned 1 [0124.642] WriteFile (in: hFile=0x21c, lpBuffer=0x3be0020*, nNumberOfBytesToWrite=0xb760, lpNumberOfBytesWritten=0x292f6c4, lpOverlapped=0x0 | out: lpBuffer=0x3be0020*, lpNumberOfBytesWritten=0x292f6c4*=0xb760, lpOverlapped=0x0) returned 1 [0124.642] ReadFile (in: hFile=0x220, lpBuffer=0x3be0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x292f8fc, lpOverlapped=0x0 | out: lpBuffer=0x3be0020*, lpNumberOfBytesRead=0x292f8fc*=0x0, lpOverlapped=0x0) returned 1 [0124.642] WriteFile (in: hFile=0x21c, lpBuffer=0x3be0020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x292f6c4, lpOverlapped=0x0 | out: lpBuffer=0x3be0020*, lpNumberOfBytesWritten=0x292f6c4*=0xe8, lpOverlapped=0x0) returned 1 [0124.642] SetEndOfFile (hFile=0x21c) returned 1 [0124.643] CloseHandle (hObject=0x21c) returned 1 [0124.643] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x292f8f0 | out: lpNewFilePointer=0x0) returned 1 [0124.643] SetEndOfFile (hFile=0x220) returned 1 [0124.643] CloseHandle (hObject=0x220) returned 1 [0124.643] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.ELM.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0124.643] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\radial.elm")) returned 1 [0124.644] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.ELM") returned 73 [0124.644] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.ELM") returned 73 [0124.644] lstrlenW (lpString=".doc") returned 4 [0124.644] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1 [0124.644] lstrlenW (lpString=".docx") returned 5 [0124.644] lstrcmpiW (lpString1=".docx", lpString2="L.ELM") returned -1 [0124.644] lstrlenW (lpString=".pdf") returned 4 [0124.644] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1 [0124.644] lstrlenW (lpString=".xls") returned 4 [0124.644] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1 [0124.644] lstrlenW (lpString=".xlsx") returned 5 [0124.644] lstrcmpiW (lpString1=".xlsx", lpString2="L.ELM") returned -1 [0124.644] lstrlenW (lpString=".ppt") returned 4 [0124.644] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1 [0124.644] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.ELM") returned 73 [0124.644] lstrlenW (lpString=".zip") returned 4 [0124.644] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1 [0124.644] lstrlenW (lpString=".rar") returned 4 [0124.644] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1 [0124.644] lstrlenW (lpString=".bz2") returned 4 [0124.644] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1 [0124.644] lstrlenW (lpString=".7z") returned 3 [0124.644] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1 [0124.644] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.ELM") returned 73 [0124.644] lstrlenW (lpString=".dbf") returned 4 [0124.644] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1 [0124.644] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.ELM") returned 73 [0124.644] lstrlenW (lpString=".1cd") returned 4 [0124.644] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1 [0124.644] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.ELM") returned 73 [0124.644] lstrlenW (lpString=".jpg") returned 4 [0124.644] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1 [0124.927] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x292f8f0 | out: lpNewFilePointer=0x0) returned 1 [0124.927] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x292f8f0 | out: lpNewFilePointer=0x0) returned 1 [0124.927] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\rmnsque.inf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0124.928] GetLastError () returned 0x0 [0124.928] ReadFile (in: hFile=0x16c, lpBuffer=0x3be0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x292f8fc, lpOverlapped=0x0 | out: lpBuffer=0x3be0020*, lpNumberOfBytesRead=0x292f8fc*=0x265, lpOverlapped=0x0) returned 1 [0124.928] WriteFile (in: hFile=0x220, lpBuffer=0x3be0020*, nNumberOfBytesToWrite=0x270, lpNumberOfBytesWritten=0x292f6c4, lpOverlapped=0x0 | out: lpBuffer=0x3be0020*, lpNumberOfBytesWritten=0x292f6c4*=0x270, lpOverlapped=0x0) returned 1 [0124.929] ReadFile (in: hFile=0x16c, lpBuffer=0x3be0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x292f8fc, lpOverlapped=0x0 | out: lpBuffer=0x3be0020*, lpNumberOfBytesRead=0x292f8fc*=0x0, lpOverlapped=0x0) returned 1 [0124.929] WriteFile (in: hFile=0x220, lpBuffer=0x3be0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x292f6c4, lpOverlapped=0x0 | out: lpBuffer=0x3be0020*, lpNumberOfBytesWritten=0x292f6c4*=0xea, lpOverlapped=0x0) returned 1 [0124.929] SetEndOfFile (hFile=0x220) returned 1 [0124.929] CloseHandle (hObject=0x220) returned 1 [0124.929] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x292f8f0 | out: lpNewFilePointer=0x0) returned 1 [0124.929] SetEndOfFile (hFile=0x16c) returned 1 [0124.930] CloseHandle (hObject=0x16c) returned 1 [0124.930] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0124.930] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\rmnsque.inf")) returned 1 [0124.930] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF") returned 75 [0124.930] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF") returned 75 [0124.930] lstrlenW (lpString=".doc") returned 4 [0124.930] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1 [0124.930] lstrlenW (lpString=".docx") returned 5 [0124.930] lstrcmpiW (lpString1=".docx", lpString2="E.INF") returned -1 [0124.930] lstrlenW (lpString=".pdf") returned 4 [0124.930] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1 [0124.930] lstrlenW (lpString=".xls") returned 4 [0124.931] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1 [0124.931] lstrlenW (lpString=".xlsx") returned 5 [0124.931] lstrcmpiW (lpString1=".xlsx", lpString2="E.INF") returned -1 [0124.931] lstrlenW (lpString=".ppt") returned 4 [0124.931] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1 [0124.931] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF") returned 75 [0124.931] lstrlenW (lpString=".zip") returned 4 [0124.931] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1 [0124.931] lstrlenW (lpString=".rar") returned 4 [0124.931] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1 [0124.931] lstrlenW (lpString=".bz2") returned 4 [0124.931] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1 [0124.931] lstrlenW (lpString=".7z") returned 3 [0124.931] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1 [0124.931] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF") returned 75 [0124.931] lstrlenW (lpString=".dbf") returned 4 [0124.931] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1 [0124.931] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF") returned 75 [0124.931] lstrlenW (lpString=".1cd") returned 4 [0124.931] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1 [0124.931] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF") returned 75 [0124.931] lstrlenW (lpString=".jpg") returned 4 [0124.931] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1 [0125.339] GetFileSizeEx (in: hFile=0x23c, lpFileSize=0x292f944 | out: lpFileSize=0x292f944*=466) returned 1 [0125.340] CloseHandle (hObject=0x23c) returned 1 [0125.340] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\spring.inf")) returned 0x20 [0125.340] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.INF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\spring.inf.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0125.340] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\spring.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x23c [0125.340] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x292f8f0 | out: lpNewFilePointer=0x0) returned 1 [0125.340] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x292f8f0 | out: lpNewFilePointer=0x0) returned 1 [0125.340] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.INF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\spring.inf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x224 [0125.341] GetLastError () returned 0x0 [0125.341] ReadFile (in: hFile=0x23c, lpBuffer=0x3be0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x292f8fc, lpOverlapped=0x0 | out: lpBuffer=0x3be0020*, lpNumberOfBytesRead=0x292f8fc*=0x1d2, lpOverlapped=0x0) returned 1 [0125.342] WriteFile (in: hFile=0x224, lpBuffer=0x3be0020*, nNumberOfBytesToWrite=0x1e0, lpNumberOfBytesWritten=0x292f6c4, lpOverlapped=0x0 | out: lpBuffer=0x3be0020*, lpNumberOfBytesWritten=0x292f6c4*=0x1e0, lpOverlapped=0x0) returned 1 [0125.343] ReadFile (in: hFile=0x23c, lpBuffer=0x3be0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x292f8fc, lpOverlapped=0x0 | out: lpBuffer=0x3be0020*, lpNumberOfBytesRead=0x292f8fc*=0x0, lpOverlapped=0x0) returned 1 [0125.343] WriteFile (in: hFile=0x224, lpBuffer=0x3be0020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x292f6c4, lpOverlapped=0x0 | out: lpBuffer=0x3be0020*, lpNumberOfBytesWritten=0x292f6c4*=0xe8, lpOverlapped=0x0) returned 1 [0125.343] SetEndOfFile (hFile=0x224) returned 1 [0125.343] CloseHandle (hObject=0x224) returned 1 [0125.343] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x292f8f0 | out: lpNewFilePointer=0x0) returned 1 [0125.343] SetEndOfFile (hFile=0x23c) returned 1 [0125.344] CloseHandle (hObject=0x23c) returned 1 [0125.344] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.INF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0125.344] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\spring.inf")) returned 1 [0125.345] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.INF") returned 73 [0125.345] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.INF") returned 73 [0125.345] lstrlenW (lpString=".doc") returned 4 [0125.345] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1 [0125.345] lstrlenW (lpString=".docx") returned 5 [0125.345] lstrcmpiW (lpString1=".docx", lpString2="G.INF") returned -1 [0125.345] lstrlenW (lpString=".pdf") returned 4 [0125.345] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1 [0125.345] lstrlenW (lpString=".xls") returned 4 [0125.345] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1 [0125.345] lstrlenW (lpString=".xlsx") returned 5 [0125.345] lstrcmpiW (lpString1=".xlsx", lpString2="G.INF") returned -1 [0125.345] lstrlenW (lpString=".ppt") returned 4 [0125.345] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1 [0125.345] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.INF") returned 73 [0125.345] lstrlenW (lpString=".zip") returned 4 [0125.345] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1 [0125.345] lstrlenW (lpString=".rar") returned 4 [0125.345] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1 [0125.345] lstrlenW (lpString=".bz2") returned 4 [0125.345] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1 [0125.345] lstrlenW (lpString=".7z") returned 3 [0125.345] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1 [0125.345] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.INF") returned 73 [0125.345] lstrlenW (lpString=".dbf") returned 4 [0125.346] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1 [0125.346] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.INF") returned 73 [0125.346] lstrlenW (lpString=".1cd") returned 4 [0125.346] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1 [0125.346] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.INF") returned 73 [0125.346] lstrlenW (lpString=".jpg") returned 4 [0125.346] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1 [0125.371] SetFilePointerEx (in: hFile=0x24c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x292f8f0 | out: lpNewFilePointer=0x0) returned 1 [0125.371] SetFilePointerEx (in: hFile=0x24c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x292f8f0 | out: lpNewFilePointer=0x0) returned 1 [0125.371] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\strtedge.inf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x23c [0125.371] GetLastError () returned 0x0 [0125.372] ReadFile (in: hFile=0x24c, lpBuffer=0x3be0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x292f8fc, lpOverlapped=0x0 | out: lpBuffer=0x3be0020*, lpNumberOfBytesRead=0x292f8fc*=0x271, lpOverlapped=0x0) returned 1 [0125.372] WriteFile (in: hFile=0x23c, lpBuffer=0x3be0020*, nNumberOfBytesToWrite=0x280, lpNumberOfBytesWritten=0x292f6c4, lpOverlapped=0x0 | out: lpBuffer=0x3be0020*, lpNumberOfBytesWritten=0x292f6c4*=0x280, lpOverlapped=0x0) returned 1 [0125.373] ReadFile (in: hFile=0x24c, lpBuffer=0x3be0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x292f8fc, lpOverlapped=0x0 | out: lpBuffer=0x3be0020*, lpNumberOfBytesRead=0x292f8fc*=0x0, lpOverlapped=0x0) returned 1 [0125.373] WriteFile (in: hFile=0x23c, lpBuffer=0x3be0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x292f6c4, lpOverlapped=0x0 | out: lpBuffer=0x3be0020*, lpNumberOfBytesWritten=0x292f6c4*=0xec, lpOverlapped=0x0) returned 1 [0125.373] SetEndOfFile (hFile=0x23c) returned 1 [0125.373] CloseHandle (hObject=0x23c) returned 1 [0125.373] SetFilePointerEx (in: hFile=0x24c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x292f8f0 | out: lpNewFilePointer=0x0) returned 1 [0125.373] SetEndOfFile (hFile=0x24c) returned 1 [0125.373] CloseHandle (hObject=0x24c) returned 1 [0125.374] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0125.374] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\strtedge.inf")) returned 1 [0125.374] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF") returned 77 [0125.374] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF") returned 77 [0125.374] lstrlenW (lpString=".doc") returned 4 [0125.374] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1 [0125.374] lstrlenW (lpString=".docx") returned 5 [0125.374] lstrcmpiW (lpString1=".docx", lpString2="E.INF") returned -1 [0125.374] lstrlenW (lpString=".pdf") returned 4 [0125.374] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1 [0125.374] lstrlenW (lpString=".xls") returned 4 [0125.374] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1 [0125.374] lstrlenW (lpString=".xlsx") returned 5 [0125.374] lstrcmpiW (lpString1=".xlsx", lpString2="E.INF") returned -1 [0125.374] lstrlenW (lpString=".ppt") returned 4 [0125.374] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1 [0125.374] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF") returned 77 [0125.374] lstrlenW (lpString=".zip") returned 4 [0125.374] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1 [0125.374] lstrlenW (lpString=".rar") returned 4 [0125.374] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1 [0125.374] lstrlenW (lpString=".bz2") returned 4 [0125.374] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1 [0125.374] lstrlenW (lpString=".7z") returned 3 [0125.374] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1 [0125.374] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF") returned 77 [0125.375] lstrlenW (lpString=".dbf") returned 4 [0125.375] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1 [0125.375] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF") returned 77 [0125.375] lstrlenW (lpString=".1cd") returned 4 [0125.375] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1 [0125.375] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF") returned 77 [0125.375] lstrlenW (lpString=".jpg") returned 4 [0125.375] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1 [0125.381] SetFilePointerEx (in: hFile=0x24c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x292f8f0 | out: lpNewFilePointer=0x0) returned 1 [0125.381] SetFilePointerEx (in: hFile=0x24c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x292f8f0 | out: lpNewFilePointer=0x0) returned 1 [0125.381] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.ELM.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\sumipntg.elm.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x23c [0125.381] GetLastError () returned 0x0 [0125.381] ReadFile (in: hFile=0x24c, lpBuffer=0x3be0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x292f8fc, lpOverlapped=0x0 | out: lpBuffer=0x3be0020*, lpNumberOfBytesRead=0x292f8fc*=0x19e14, lpOverlapped=0x0) returned 1 [0125.414] WriteFile (in: hFile=0x23c, lpBuffer=0x3be0020*, nNumberOfBytesToWrite=0x19e20, lpNumberOfBytesWritten=0x292f6c4, lpOverlapped=0x0 | out: lpBuffer=0x3be0020*, lpNumberOfBytesWritten=0x292f6c4*=0x19e20, lpOverlapped=0x0) returned 1 [0125.415] ReadFile (in: hFile=0x24c, lpBuffer=0x3be0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x292f8fc, lpOverlapped=0x0 | out: lpBuffer=0x3be0020*, lpNumberOfBytesRead=0x292f8fc*=0x0, lpOverlapped=0x0) returned 1 [0125.415] WriteFile (in: hFile=0x23c, lpBuffer=0x3be0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x292f6c4, lpOverlapped=0x0 | out: lpBuffer=0x3be0020*, lpNumberOfBytesWritten=0x292f6c4*=0xec, lpOverlapped=0x0) returned 1 [0125.415] SetEndOfFile (hFile=0x23c) returned 1 [0125.415] CloseHandle (hObject=0x23c) returned 1 [0125.415] SetFilePointerEx (in: hFile=0x24c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x292f8f0 | out: lpNewFilePointer=0x0) returned 1 [0125.415] SetEndOfFile (hFile=0x24c) returned 1 [0125.416] CloseHandle (hObject=0x24c) returned 1 [0125.416] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.ELM.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0125.416] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\sumipntg.elm")) returned 1 [0125.416] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.ELM") returned 77 [0125.416] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.ELM") returned 77 [0125.416] lstrlenW (lpString=".doc") returned 4 [0125.416] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1 [0125.416] lstrlenW (lpString=".docx") returned 5 [0125.417] lstrcmpiW (lpString1=".docx", lpString2="G.ELM") returned -1 [0125.417] lstrlenW (lpString=".pdf") returned 4 [0125.417] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1 [0125.417] lstrlenW (lpString=".xls") returned 4 [0125.417] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1 [0125.417] lstrlenW (lpString=".xlsx") returned 5 [0125.417] lstrcmpiW (lpString1=".xlsx", lpString2="G.ELM") returned -1 [0125.417] lstrlenW (lpString=".ppt") returned 4 [0125.417] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1 [0125.417] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.ELM") returned 77 [0125.417] lstrlenW (lpString=".zip") returned 4 [0125.417] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1 [0125.417] lstrlenW (lpString=".rar") returned 4 [0125.417] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1 [0125.417] lstrlenW (lpString=".bz2") returned 4 [0125.417] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1 [0125.417] lstrlenW (lpString=".7z") returned 3 [0125.417] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1 [0125.417] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.ELM") returned 77 [0125.417] lstrlenW (lpString=".dbf") returned 4 [0125.417] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1 [0125.417] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.ELM") returned 77 [0125.417] lstrlenW (lpString=".1cd") returned 4 [0125.417] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1 [0125.417] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.ELM") returned 77 [0125.417] lstrlenW (lpString=".jpg") returned 4 [0125.417] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1 [0125.418] SetFilePointerEx (in: hFile=0x24c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x292f8f0 | out: lpNewFilePointer=0x0) returned 1 [0125.418] SetFilePointerEx (in: hFile=0x24c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x292f8f0 | out: lpNewFilePointer=0x0) returned 1 [0125.418] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\watermar.elm.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x23c [0125.418] GetLastError () returned 0x0 [0125.418] ReadFile (in: hFile=0x24c, lpBuffer=0x3be0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x292f8fc, lpOverlapped=0x0 | out: lpBuffer=0x3be0020*, lpNumberOfBytesRead=0x292f8fc*=0xbfc6, lpOverlapped=0x0) returned 1 [0125.975] WriteFile (in: hFile=0x23c, lpBuffer=0x3be0020*, nNumberOfBytesToWrite=0xbfd0, lpNumberOfBytesWritten=0x292f6c4, lpOverlapped=0x0 | out: lpBuffer=0x3be0020*, lpNumberOfBytesWritten=0x292f6c4*=0xbfd0, lpOverlapped=0x0) returned 1 [0125.977] ReadFile (in: hFile=0x24c, lpBuffer=0x3be0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x292f8fc, lpOverlapped=0x0 | out: lpBuffer=0x3be0020*, lpNumberOfBytesRead=0x292f8fc*=0x0, lpOverlapped=0x0) returned 1 [0125.978] WriteFile (in: hFile=0x23c, lpBuffer=0x3be0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x292f6c4, lpOverlapped=0x0 | out: lpBuffer=0x3be0020*, lpNumberOfBytesWritten=0x292f6c4*=0xec, lpOverlapped=0x0) returned 1 [0125.978] SetEndOfFile (hFile=0x23c) returned 1 [0125.978] CloseHandle (hObject=0x23c) returned 1 [0125.978] SetFilePointerEx (in: hFile=0x24c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x292f8f0 | out: lpNewFilePointer=0x0) returned 1 [0125.978] SetEndOfFile (hFile=0x24c) returned 1 [0125.979] CloseHandle (hObject=0x24c) returned 1 [0125.979] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0125.979] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\watermar.elm")) returned 1 [0125.980] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM") returned 77 [0125.980] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM") returned 77 [0125.980] lstrlenW (lpString=".doc") returned 4 [0125.980] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1 [0125.980] lstrlenW (lpString=".docx") returned 5 [0125.980] lstrcmpiW (lpString1=".docx", lpString2="R.ELM") returned -1 [0125.984] lstrlenW (lpString=".pdf") returned 4 [0125.984] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1 [0125.984] lstrlenW (lpString=".xls") returned 4 [0125.984] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1 [0125.984] lstrlenW (lpString=".xlsx") returned 5 [0125.984] lstrcmpiW (lpString1=".xlsx", lpString2="R.ELM") returned -1 [0125.984] lstrlenW (lpString=".ppt") returned 4 [0125.984] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1 [0125.984] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM") returned 77 [0125.984] lstrlenW (lpString=".zip") returned 4 [0125.984] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1 [0125.984] lstrlenW (lpString=".rar") returned 4 [0125.984] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1 [0125.984] lstrlenW (lpString=".bz2") returned 4 [0125.984] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1 [0125.984] lstrlenW (lpString=".7z") returned 3 [0125.984] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1 [0125.984] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM") returned 77 [0125.984] lstrlenW (lpString=".dbf") returned 4 [0125.984] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1 [0125.984] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM") returned 77 [0125.984] lstrlenW (lpString=".1cd") returned 4 [0125.984] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1 [0125.984] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM") returned 77 [0125.984] lstrlenW (lpString=".jpg") returned 4 [0125.985] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1 [0125.985] SetFilePointerEx (in: hFile=0x24c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x292f8f0 | out: lpNewFilePointer=0x0) returned 1 [0125.985] SetFilePointerEx (in: hFile=0x24c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x292f8f0 | out: lpNewFilePointer=0x0) returned 1 [0125.985] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\MSB1FRAR.ITS.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\frar\\msb1frar.its.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x23c [0125.986] GetLastError () returned 0x0 [0125.986] ReadFile (in: hFile=0x24c, lpBuffer=0x3be0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x292f8fc, lpOverlapped=0x0 | out: lpBuffer=0x3be0020*, lpNumberOfBytesRead=0x292f8fc*=0xffff0, lpOverlapped=0x0) returned 1 [0126.168] WriteFile (in: hFile=0x23c, lpBuffer=0x3be0020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x292f6c4, lpOverlapped=0x0 | out: lpBuffer=0x3be0020*, lpNumberOfBytesWritten=0x292f6c4*=0xffff0, lpOverlapped=0x0) returned 1 [0126.191] ReadFile (in: hFile=0x24c, lpBuffer=0x3be0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x292f8fc, lpOverlapped=0x0 | out: lpBuffer=0x3be0020*, lpNumberOfBytesRead=0x292f8fc*=0x66bbe, lpOverlapped=0x0) returned 1 [0126.343] WriteFile (in: hFile=0x23c, lpBuffer=0x3be0020*, nNumberOfBytesToWrite=0x66bc0, lpNumberOfBytesWritten=0x292f6c4, lpOverlapped=0x0 | out: lpBuffer=0x3be0020*, lpNumberOfBytesWritten=0x292f6c4*=0x66bc0, lpOverlapped=0x0) returned 1 [0126.364] ReadFile (in: hFile=0x24c, lpBuffer=0x3be0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x292f8fc, lpOverlapped=0x0 | out: lpBuffer=0x3be0020*, lpNumberOfBytesRead=0x292f8fc*=0x0, lpOverlapped=0x0) returned 1 [0126.364] WriteFile (in: hFile=0x23c, lpBuffer=0x3be0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x292f6c4, lpOverlapped=0x0 | out: lpBuffer=0x3be0020*, lpNumberOfBytesWritten=0x292f6c4*=0xec, lpOverlapped=0x0) returned 1 [0126.364] SetEndOfFile (hFile=0x23c) returned 1 [0126.364] CloseHandle (hObject=0x23c) returned 1 [0126.364] SetFilePointerEx (in: hFile=0x24c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x292f8f0 | out: lpNewFilePointer=0x0) returned 1 [0126.364] SetEndOfFile (hFile=0x24c) returned 1 [0126.366] CloseHandle (hObject=0x24c) returned 1 [0126.366] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\MSB1FRAR.ITS.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0126.366] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\MSB1FRAR.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\frar\\msb1frar.its")) returned 1 [0126.367] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\MSB1FRAR.ITS") returned 73 [0126.367] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\MSB1FRAR.ITS") returned 73 [0126.367] lstrlenW (lpString=".doc") returned 4 [0126.367] lstrcmpiW (lpString1=".doc", lpString2=".ITS") returned -1 [0126.367] lstrlenW (lpString=".docx") returned 5 [0126.367] lstrcmpiW (lpString1=".docx", lpString2="R.ITS") returned -1 [0126.367] lstrlenW (lpString=".pdf") returned 4 [0126.367] lstrcmpiW (lpString1=".pdf", lpString2=".ITS") returned 1 [0126.367] lstrlenW (lpString=".xls") returned 4 [0126.367] lstrcmpiW (lpString1=".xls", lpString2=".ITS") returned 1 [0126.367] lstrlenW (lpString=".xlsx") returned 5 [0126.367] lstrcmpiW (lpString1=".xlsx", lpString2="R.ITS") returned -1 [0126.367] lstrlenW (lpString=".ppt") returned 4 [0126.367] lstrcmpiW (lpString1=".ppt", lpString2=".ITS") returned 1 [0126.367] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\MSB1FRAR.ITS") returned 73 [0126.367] lstrlenW (lpString=".zip") returned 4 [0126.367] lstrcmpiW (lpString1=".zip", lpString2=".ITS") returned 1 [0126.367] lstrlenW (lpString=".rar") returned 4 [0126.367] lstrcmpiW (lpString1=".rar", lpString2=".ITS") returned 1 [0126.368] lstrlenW (lpString=".bz2") returned 4 [0126.368] lstrcmpiW (lpString1=".bz2", lpString2=".ITS") returned -1 [0126.368] lstrlenW (lpString=".7z") returned 3 [0126.368] lstrcmpiW (lpString1=".7z", lpString2="ITS") returned -1 [0126.368] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\MSB1FRAR.ITS") returned 73 [0126.368] lstrlenW (lpString=".dbf") returned 4 [0126.368] lstrcmpiW (lpString1=".dbf", lpString2=".ITS") returned -1 [0126.368] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\MSB1FRAR.ITS") returned 73 [0126.368] lstrlenW (lpString=".1cd") returned 4 [0126.368] lstrcmpiW (lpString1=".1cd", lpString2=".ITS") returned -1 [0126.368] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\MSB1FRAR.ITS") returned 73 [0126.368] lstrlenW (lpString=".jpg") returned 4 [0126.368] lstrcmpiW (lpString1=".jpg", lpString2=".ITS") returned 1 [0126.368] SetFilePointerEx (in: hFile=0x24c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x292f8f0 | out: lpNewFilePointer=0x0) returned 1 [0126.368] SetFilePointerEx (in: hFile=0x24c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x292f8f0 | out: lpNewFilePointer=0x0) returned 1 [0126.368] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CACH.LEX.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1cach.lex.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x23c [0126.369] GetLastError () returned 0x0 [0126.369] ReadFile (in: hFile=0x24c, lpBuffer=0x3be0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x292f8fc, lpOverlapped=0x0 | out: lpBuffer=0x3be0020*, lpNumberOfBytesRead=0x292f8fc*=0x600, lpOverlapped=0x0) returned 1 [0126.386] WriteFile (in: hFile=0x23c, lpBuffer=0x3be0020*, nNumberOfBytesToWrite=0x610, lpNumberOfBytesWritten=0x292f6c4, lpOverlapped=0x0 | out: lpBuffer=0x3be0020*, lpNumberOfBytesWritten=0x292f6c4*=0x610, lpOverlapped=0x0) returned 1 [0126.387] ReadFile (in: hFile=0x24c, lpBuffer=0x3be0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x292f8fc, lpOverlapped=0x0 | out: lpBuffer=0x3be0020*, lpNumberOfBytesRead=0x292f8fc*=0x0, lpOverlapped=0x0) returned 1 [0126.387] WriteFile (in: hFile=0x23c, lpBuffer=0x3be0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x292f6c4, lpOverlapped=0x0 | out: lpBuffer=0x3be0020*, lpNumberOfBytesWritten=0x292f6c4*=0xec, lpOverlapped=0x0) returned 1 [0126.387] SetEndOfFile (hFile=0x23c) returned 1 [0126.387] CloseHandle (hObject=0x23c) returned 1 [0126.387] SetFilePointerEx (in: hFile=0x24c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x292f8f0 | out: lpNewFilePointer=0x0) returned 1 [0126.387] SetEndOfFile (hFile=0x24c) returned 1 [0126.388] CloseHandle (hObject=0x24c) returned 1 [0126.388] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CACH.LEX.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0126.388] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CACH.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1cach.lex")) returned 1 [0126.388] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CACH.LEX") returned 68 [0126.388] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CACH.LEX") returned 68 [0126.388] lstrlenW (lpString=".doc") returned 4 [0126.388] lstrcmpiW (lpString1=".doc", lpString2=".LEX") returned -1 [0126.388] lstrlenW (lpString=".docx") returned 5 [0126.388] lstrcmpiW (lpString1=".docx", lpString2="H.LEX") returned -1 [0126.388] lstrlenW (lpString=".pdf") returned 4 [0126.388] lstrcmpiW (lpString1=".pdf", lpString2=".LEX") returned 1 [0126.388] lstrlenW (lpString=".xls") returned 4 [0126.388] lstrcmpiW (lpString1=".xls", lpString2=".LEX") returned 1 [0126.389] lstrlenW (lpString=".xlsx") returned 5 [0126.389] lstrcmpiW (lpString1=".xlsx", lpString2="H.LEX") returned -1 [0126.389] lstrlenW (lpString=".ppt") returned 4 [0126.389] lstrcmpiW (lpString1=".ppt", lpString2=".LEX") returned 1 [0126.389] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CACH.LEX") returned 68 [0126.389] lstrlenW (lpString=".zip") returned 4 [0126.389] lstrcmpiW (lpString1=".zip", lpString2=".LEX") returned 1 [0126.389] lstrlenW (lpString=".rar") returned 4 [0126.389] lstrcmpiW (lpString1=".rar", lpString2=".LEX") returned 1 [0126.389] lstrlenW (lpString=".bz2") returned 4 [0126.389] lstrcmpiW (lpString1=".bz2", lpString2=".LEX") returned -1 [0126.389] lstrlenW (lpString=".7z") returned 3 [0126.389] lstrcmpiW (lpString1=".7z", lpString2="LEX") returned -1 [0126.389] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CACH.LEX") returned 68 [0126.389] lstrlenW (lpString=".dbf") returned 4 [0126.389] lstrcmpiW (lpString1=".dbf", lpString2=".LEX") returned -1 [0126.389] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CACH.LEX") returned 68 [0126.389] lstrlenW (lpString=".1cd") returned 4 [0126.389] lstrcmpiW (lpString1=".1cd", lpString2=".LEX") returned -1 [0126.389] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CACH.LEX") returned 68 [0126.389] lstrlenW (lpString=".jpg") returned 4 [0126.389] lstrcmpiW (lpString1=".jpg", lpString2=".LEX") returned -1 [0126.582] SetFilePointerEx (in: hFile=0x234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x292f8f0 | out: lpNewFilePointer=0x0) returned 1 [0126.583] SetFilePointerEx (in: hFile=0x234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x292f8f0 | out: lpNewFilePointer=0x0) returned 1 [0126.585] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CORE.DLL.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1core.dll.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0126.588] GetLastError () returned 0x0 [0126.588] ReadFile (hFile=0x234, lpBuffer=0x3be0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x292f8fc, lpOverlapped=0x0) Thread: id = 28 os_tid = 0xba0 [0102.637] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x757c0000 [0102.637] GetProcAddress (hModule=0x757c0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x757ed650 [0102.637] Wow64DisableWow64FsRedirection (in: OldValue=0x326f908 | out: OldValue=0x326f908*=0x0) returned 1 [0102.637] lstrlenW (lpString="kernel32.dll") returned 12 [0102.637] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0102.637] Sleep (dwMilliseconds=0x64) [0102.839] lstrcmpiW (lpString1=".LOG", lpString2=".waifu") returned -1 [0102.839] lstrlenW (lpString="BCD.LOG") returned 7 [0102.839] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG" (normalized: "c:\\boot\\bcd.log"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0102.839] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0102.839] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0102.839] lstrlenW (lpString=".doc") returned 4 [0102.839] lstrcmpiW (lpString1=".doc", lpString2=".LOG") returned -1 [0102.839] lstrlenW (lpString=".docx") returned 5 [0102.839] lstrcmpiW (lpString1=".docx", lpString2="D.LOG") returned -1 [0102.839] lstrlenW (lpString=".pdf") returned 4 [0102.839] lstrcmpiW (lpString1=".pdf", lpString2=".LOG") returned 1 [0102.839] lstrlenW (lpString=".xls") returned 4 [0102.839] lstrcmpiW (lpString1=".xls", lpString2=".LOG") returned 1 [0102.839] lstrlenW (lpString=".xlsx") returned 5 [0102.839] lstrcmpiW (lpString1=".xlsx", lpString2="D.LOG") returned -1 [0102.839] lstrlenW (lpString=".ppt") returned 4 [0102.839] lstrcmpiW (lpString1=".ppt", lpString2=".LOG") returned 1 [0102.839] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0102.839] lstrlenW (lpString=".zip") returned 4 [0102.839] lstrcmpiW (lpString1=".zip", lpString2=".LOG") returned 1 [0102.839] lstrlenW (lpString=".rar") returned 4 [0102.839] lstrcmpiW (lpString1=".rar", lpString2=".LOG") returned 1 [0102.839] lstrlenW (lpString=".bz2") returned 4 [0102.839] lstrcmpiW (lpString1=".bz2", lpString2=".LOG") returned -1 [0102.839] lstrlenW (lpString=".7z") returned 3 [0102.839] lstrcmpiW (lpString1=".7z", lpString2="LOG") returned -1 [0102.839] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0102.839] lstrlenW (lpString=".dbf") returned 4 [0102.839] lstrcmpiW (lpString1=".dbf", lpString2=".LOG") returned -1 [0102.839] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0102.839] lstrlenW (lpString=".1cd") returned 4 [0102.839] lstrcmpiW (lpString1=".1cd", lpString2=".LOG") returned -1 [0102.839] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0102.839] lstrlenW (lpString=".jpg") returned 4 [0102.839] lstrcmpiW (lpString1=".jpg", lpString2=".LOG") returned -1 [0102.841] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0102.841] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0102.841] lstrlenW (lpString=".doc") returned 4 [0102.841] lstrcmpiW (lpString1=".doc", lpString2=".LOG") returned -1 [0102.841] lstrlenW (lpString=".docx") returned 5 [0102.842] lstrcmpiW (lpString1=".docx", lpString2="D.LOG") returned -1 [0102.842] lstrlenW (lpString=".pdf") returned 4 [0102.842] lstrcmpiW (lpString1=".pdf", lpString2=".LOG") returned 1 [0102.842] lstrlenW (lpString=".xls") returned 4 [0102.842] lstrcmpiW (lpString1=".xls", lpString2=".LOG") returned 1 [0102.842] lstrlenW (lpString=".xlsx") returned 5 [0102.842] lstrcmpiW (lpString1=".xlsx", lpString2="D.LOG") returned -1 [0102.842] lstrlenW (lpString=".ppt") returned 4 [0102.842] lstrcmpiW (lpString1=".ppt", lpString2=".LOG") returned 1 [0102.842] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0102.842] lstrlenW (lpString=".zip") returned 4 [0102.842] lstrcmpiW (lpString1=".zip", lpString2=".LOG") returned 1 [0102.842] lstrlenW (lpString=".rar") returned 4 [0102.842] lstrcmpiW (lpString1=".rar", lpString2=".LOG") returned 1 [0102.842] lstrlenW (lpString=".bz2") returned 4 [0102.842] lstrcmpiW (lpString1=".bz2", lpString2=".LOG") returned -1 [0102.842] lstrlenW (lpString=".7z") returned 3 [0102.842] lstrcmpiW (lpString1=".7z", lpString2="LOG") returned -1 [0102.842] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0102.842] lstrlenW (lpString=".dbf") returned 4 [0102.842] lstrcmpiW (lpString1=".dbf", lpString2=".LOG") returned -1 [0102.842] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0102.842] lstrlenW (lpString=".1cd") returned 4 [0102.842] lstrcmpiW (lpString1=".1cd", lpString2=".LOG") returned -1 [0102.842] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0102.842] lstrlenW (lpString=".jpg") returned 4 [0102.842] lstrcmpiW (lpString1=".jpg", lpString2=".LOG") returned -1 [0102.842] lstrcmpiW (lpString1=".DAT", lpString2=".waifu") returned -1 [0102.842] lstrlenW (lpString="BOOTSTAT.DAT") returned 12 [0102.842] CreateFileW (lpFileName="C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0102.842] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x326f8cc | out: lpFileSize=0x326f8cc*=65536) returned 1 [0102.842] CloseHandle (hObject=0x18c) returned 1 [0102.842] GetFileAttributesW (lpFileName="C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat")) returned 0x26 [0102.842] GetFileAttributesW (lpFileName="C:\\Boot\\BOOTSTAT.DAT.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\boot\\bootstat.dat.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0102.843] CreateFileW (lpFileName="C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0102.843] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0102.843] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0102.843] CreateFileW (lpFileName="C:\\Boot\\BOOTSTAT.DAT.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\boot\\bootstat.dat.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0102.843] GetLastError () returned 0x0 [0102.843] ReadFile (in: hFile=0x18c, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0x10000, lpOverlapped=0x0) returned 1 [0102.848] WriteFile (in: hFile=0x190, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0x10010, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0x10010, lpOverlapped=0x0) returned 1 [0102.849] ReadFile (in: hFile=0x18c, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0x0, lpOverlapped=0x0) returned 1 [0102.849] WriteFile (in: hFile=0x190, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0xec, lpOverlapped=0x0) returned 1 [0102.849] SetEndOfFile (hFile=0x190) returned 1 [0102.849] CloseHandle (hObject=0x190) returned 1 [0102.850] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0102.850] SetEndOfFile (hFile=0x18c) returned 1 [0102.851] CloseHandle (hObject=0x18c) returned 1 [0102.851] SetFileAttributesW (lpFileName="C:\\Boot\\BOOTSTAT.DAT.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x26) returned 1 [0102.851] DeleteFileW (lpFileName="C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat")) returned 1 [0102.851] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0102.851] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0102.851] lstrlenW (lpString=".doc") returned 4 [0102.851] lstrcmpiW (lpString1=".doc", lpString2=".DAT") returned 1 [0102.851] lstrlenW (lpString=".docx") returned 5 [0102.851] lstrcmpiW (lpString1=".docx", lpString2="T.DAT") returned -1 [0102.851] lstrlenW (lpString=".pdf") returned 4 [0102.851] lstrcmpiW (lpString1=".pdf", lpString2=".DAT") returned 1 [0102.851] lstrlenW (lpString=".xls") returned 4 [0102.851] lstrcmpiW (lpString1=".xls", lpString2=".DAT") returned 1 [0102.851] lstrlenW (lpString=".xlsx") returned 5 [0102.851] lstrcmpiW (lpString1=".xlsx", lpString2="T.DAT") returned -1 [0102.851] lstrlenW (lpString=".ppt") returned 4 [0102.851] lstrcmpiW (lpString1=".ppt", lpString2=".DAT") returned 1 [0102.851] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0102.851] lstrlenW (lpString=".zip") returned 4 [0102.851] lstrcmpiW (lpString1=".zip", lpString2=".DAT") returned 1 [0102.851] lstrlenW (lpString=".rar") returned 4 [0102.851] lstrcmpiW (lpString1=".rar", lpString2=".DAT") returned 1 [0102.851] lstrlenW (lpString=".bz2") returned 4 [0102.851] lstrcmpiW (lpString1=".bz2", lpString2=".DAT") returned -1 [0102.851] lstrlenW (lpString=".7z") returned 3 [0102.851] lstrcmpiW (lpString1=".7z", lpString2="DAT") returned -1 [0102.851] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0102.851] lstrlenW (lpString=".dbf") returned 4 [0102.851] lstrcmpiW (lpString1=".dbf", lpString2=".DAT") returned 1 [0102.852] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0102.852] lstrlenW (lpString=".1cd") returned 4 [0102.852] lstrcmpiW (lpString1=".1cd", lpString2=".DAT") returned -1 [0102.852] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0102.852] lstrlenW (lpString=".jpg") returned 4 [0102.852] lstrcmpiW (lpString1=".jpg", lpString2=".DAT") returned 1 [0102.852] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0102.852] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0102.852] lstrlenW (lpString=".doc") returned 4 [0102.852] lstrcmpiW (lpString1=".doc", lpString2=".DAT") returned 1 [0102.852] lstrlenW (lpString=".docx") returned 5 [0102.852] lstrcmpiW (lpString1=".docx", lpString2="T.DAT") returned -1 [0102.852] lstrlenW (lpString=".pdf") returned 4 [0102.852] lstrcmpiW (lpString1=".pdf", lpString2=".DAT") returned 1 [0102.852] lstrlenW (lpString=".xls") returned 4 [0102.852] lstrcmpiW (lpString1=".xls", lpString2=".DAT") returned 1 [0102.852] lstrlenW (lpString=".xlsx") returned 5 [0102.852] lstrcmpiW (lpString1=".xlsx", lpString2="T.DAT") returned -1 [0102.852] lstrlenW (lpString=".ppt") returned 4 [0102.852] lstrcmpiW (lpString1=".ppt", lpString2=".DAT") returned 1 [0102.852] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0102.852] lstrlenW (lpString=".zip") returned 4 [0102.852] lstrcmpiW (lpString1=".zip", lpString2=".DAT") returned 1 [0102.852] lstrlenW (lpString=".rar") returned 4 [0102.852] lstrcmpiW (lpString1=".rar", lpString2=".DAT") returned 1 [0102.852] lstrlenW (lpString=".bz2") returned 4 [0102.852] lstrcmpiW (lpString1=".bz2", lpString2=".DAT") returned -1 [0102.852] lstrlenW (lpString=".7z") returned 3 [0102.852] lstrcmpiW (lpString1=".7z", lpString2="DAT") returned -1 [0102.852] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0102.852] lstrlenW (lpString=".dbf") returned 4 [0102.852] lstrcmpiW (lpString1=".dbf", lpString2=".DAT") returned 1 [0102.852] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0102.852] lstrlenW (lpString=".1cd") returned 4 [0102.852] lstrcmpiW (lpString1=".1cd", lpString2=".DAT") returned -1 [0102.852] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0102.852] lstrlenW (lpString=".jpg") returned 4 [0102.852] lstrcmpiW (lpString1=".jpg", lpString2=".DAT") returned 1 [0102.852] lstrcmpiW (lpString1=".BAK", lpString2=".waifu") returned -1 [0102.852] lstrlenW (lpString="BOOTSECT.BAK") returned 12 [0102.852] CreateFileW (lpFileName="C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0102.853] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x326f8cc | out: lpFileSize=0x326f8cc*=8192) returned 1 [0102.853] CloseHandle (hObject=0x18c) returned 1 [0102.853] GetFileAttributesW (lpFileName="C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak")) returned 0x27 [0102.853] GetFileAttributesW (lpFileName="C:\\BOOTSECT.BAK.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\bootsect.bak.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0102.853] SetFileAttributesW (lpFileName="C:\\BOOTSECT.BAK", dwFileAttributes=0x26) returned 1 [0102.853] CreateFileW (lpFileName="C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0102.853] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0102.853] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0102.854] CreateFileW (lpFileName="C:\\BOOTSECT.BAK.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\bootsect.bak.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0102.855] GetLastError () returned 0x0 [0102.855] ReadFile (in: hFile=0x18c, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0x2000, lpOverlapped=0x0) returned 1 [0102.855] WriteFile (in: hFile=0x190, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0x2010, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0x2010, lpOverlapped=0x0) returned 1 [0102.856] ReadFile (in: hFile=0x18c, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0x0, lpOverlapped=0x0) returned 1 [0102.856] WriteFile (in: hFile=0x190, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0xec, lpOverlapped=0x0) returned 1 [0102.856] SetEndOfFile (hFile=0x190) returned 1 [0102.856] CloseHandle (hObject=0x190) returned 1 [0102.857] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0102.857] SetEndOfFile (hFile=0x18c) returned 1 [0102.858] CloseHandle (hObject=0x18c) returned 1 [0102.858] SetFileAttributesW (lpFileName="C:\\BOOTSECT.BAK.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x27) returned 1 [0102.858] DeleteFileW (lpFileName="C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak")) returned 1 [0102.858] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0102.858] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0102.858] lstrlenW (lpString=".doc") returned 4 [0102.858] lstrcmpiW (lpString1=".doc", lpString2=".BAK") returned 1 [0102.858] lstrlenW (lpString=".docx") returned 5 [0102.858] lstrcmpiW (lpString1=".docx", lpString2="T.BAK") returned -1 [0102.858] lstrlenW (lpString=".pdf") returned 4 [0102.858] lstrcmpiW (lpString1=".pdf", lpString2=".BAK") returned 1 [0102.858] lstrlenW (lpString=".xls") returned 4 [0102.858] lstrcmpiW (lpString1=".xls", lpString2=".BAK") returned 1 [0102.858] lstrlenW (lpString=".xlsx") returned 5 [0102.858] lstrcmpiW (lpString1=".xlsx", lpString2="T.BAK") returned -1 [0102.858] lstrlenW (lpString=".ppt") returned 4 [0102.858] lstrcmpiW (lpString1=".ppt", lpString2=".BAK") returned 1 [0102.858] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0102.858] lstrlenW (lpString=".zip") returned 4 [0102.858] lstrcmpiW (lpString1=".zip", lpString2=".BAK") returned 1 [0102.858] lstrlenW (lpString=".rar") returned 4 [0102.858] lstrcmpiW (lpString1=".rar", lpString2=".BAK") returned 1 [0102.858] lstrlenW (lpString=".bz2") returned 4 [0102.858] lstrcmpiW (lpString1=".bz2", lpString2=".BAK") returned 1 [0102.858] lstrlenW (lpString=".7z") returned 3 [0102.858] lstrcmpiW (lpString1=".7z", lpString2="BAK") returned -1 [0102.858] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0102.858] lstrlenW (lpString=".dbf") returned 4 [0102.858] lstrcmpiW (lpString1=".dbf", lpString2=".BAK") returned 1 [0102.859] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0102.859] lstrlenW (lpString=".1cd") returned 4 [0102.859] lstrcmpiW (lpString1=".1cd", lpString2=".BAK") returned -1 [0102.859] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0102.859] lstrlenW (lpString=".jpg") returned 4 [0102.859] lstrcmpiW (lpString1=".jpg", lpString2=".BAK") returned 1 [0102.859] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0102.859] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0102.859] lstrlenW (lpString=".doc") returned 4 [0102.859] lstrcmpiW (lpString1=".doc", lpString2=".BAK") returned 1 [0102.859] lstrlenW (lpString=".docx") returned 5 [0102.859] lstrcmpiW (lpString1=".docx", lpString2="T.BAK") returned -1 [0102.859] lstrlenW (lpString=".pdf") returned 4 [0102.859] lstrcmpiW (lpString1=".pdf", lpString2=".BAK") returned 1 [0102.859] lstrlenW (lpString=".xls") returned 4 [0102.859] lstrcmpiW (lpString1=".xls", lpString2=".BAK") returned 1 [0102.859] lstrlenW (lpString=".xlsx") returned 5 [0102.859] lstrcmpiW (lpString1=".xlsx", lpString2="T.BAK") returned -1 [0102.859] lstrlenW (lpString=".ppt") returned 4 [0102.859] lstrcmpiW (lpString1=".ppt", lpString2=".BAK") returned 1 [0102.859] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0102.859] lstrlenW (lpString=".zip") returned 4 [0102.859] lstrcmpiW (lpString1=".zip", lpString2=".BAK") returned 1 [0102.859] lstrlenW (lpString=".rar") returned 4 [0102.859] lstrcmpiW (lpString1=".rar", lpString2=".BAK") returned 1 [0102.859] lstrlenW (lpString=".bz2") returned 4 [0102.859] lstrcmpiW (lpString1=".bz2", lpString2=".BAK") returned 1 [0102.859] lstrlenW (lpString=".7z") returned 3 [0102.859] lstrcmpiW (lpString1=".7z", lpString2="BAK") returned -1 [0102.859] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0102.859] lstrlenW (lpString=".dbf") returned 4 [0102.859] lstrcmpiW (lpString1=".dbf", lpString2=".BAK") returned 1 [0102.859] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0102.859] lstrlenW (lpString=".1cd") returned 4 [0102.859] lstrcmpiW (lpString1=".1cd", lpString2=".BAK") returned -1 [0102.859] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0102.859] lstrlenW (lpString=".jpg") returned 4 [0102.859] lstrcmpiW (lpString1=".jpg", lpString2=".BAK") returned 1 [0102.859] lstrcmpiW (lpString1=".xml", lpString2=".waifu") returned 1 [0102.859] lstrlenW (lpString="ExcelMUI.xml") returned 12 [0102.859] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0102.860] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x326f8cc | out: lpFileSize=0x326f8cc*=1565) returned 1 [0102.860] CloseHandle (hObject=0x18c) returned 1 [0102.861] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml")) returned 0x2020 [0102.861] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0102.861] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0102.861] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0102.861] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0102.861] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0102.862] GetLastError () returned 0x0 [0102.862] ReadFile (in: hFile=0x18c, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0x61d, lpOverlapped=0x0) returned 1 [0102.863] WriteFile (in: hFile=0x190, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0x620, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0x620, lpOverlapped=0x0) returned 1 [0102.863] ReadFile (in: hFile=0x18c, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0x0, lpOverlapped=0x0) returned 1 [0102.863] WriteFile (in: hFile=0x190, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0xec, lpOverlapped=0x0) returned 1 [0102.863] SetEndOfFile (hFile=0x190) returned 1 [0102.863] CloseHandle (hObject=0x190) returned 1 [0102.864] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0102.864] SetEndOfFile (hFile=0x18c) returned 1 [0102.865] CloseHandle (hObject=0x18c) returned 1 [0102.865] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x2020) returned 1 [0102.865] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml")) returned 1 [0102.865] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0102.865] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0102.865] lstrlenW (lpString=".doc") returned 4 [0102.865] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0102.865] lstrlenW (lpString=".docx") returned 5 [0102.865] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0102.865] lstrlenW (lpString=".pdf") returned 4 [0102.865] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0102.865] lstrlenW (lpString=".xls") returned 4 [0102.865] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0102.865] lstrlenW (lpString=".xlsx") returned 5 [0102.865] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0102.865] lstrlenW (lpString=".ppt") returned 4 [0102.865] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0102.865] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0102.865] lstrlenW (lpString=".zip") returned 4 [0102.865] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0102.865] lstrlenW (lpString=".rar") returned 4 [0102.865] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0102.866] lstrlenW (lpString=".bz2") returned 4 [0102.866] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0102.866] lstrlenW (lpString=".7z") returned 3 [0102.866] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0102.866] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0102.866] lstrlenW (lpString=".dbf") returned 4 [0102.866] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0102.866] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0102.866] lstrlenW (lpString=".1cd") returned 4 [0102.866] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0102.866] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0102.866] lstrlenW (lpString=".jpg") returned 4 [0102.866] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0102.866] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0102.866] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0102.866] lstrlenW (lpString=".doc") returned 4 [0102.866] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0102.866] lstrlenW (lpString=".docx") returned 5 [0102.866] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0102.866] lstrlenW (lpString=".pdf") returned 4 [0102.866] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0102.866] lstrlenW (lpString=".xls") returned 4 [0102.866] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0102.866] lstrlenW (lpString=".xlsx") returned 5 [0102.866] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0102.866] lstrlenW (lpString=".ppt") returned 4 [0102.866] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0102.866] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0102.866] lstrlenW (lpString=".zip") returned 4 [0102.866] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0102.866] lstrlenW (lpString=".rar") returned 4 [0102.866] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0102.866] lstrlenW (lpString=".bz2") returned 4 [0102.866] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0102.866] lstrlenW (lpString=".7z") returned 3 [0102.866] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0102.866] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0102.866] lstrlenW (lpString=".dbf") returned 4 [0102.866] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0102.866] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0102.866] lstrlenW (lpString=".1cd") returned 4 [0102.866] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0102.866] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0102.866] lstrlenW (lpString=".jpg") returned 4 [0102.866] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0102.866] lstrcmpiW (lpString1=".xml", lpString2=".waifu") returned 1 [0102.867] lstrlenW (lpString="Setup.xml") returned 9 [0102.867] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0102.867] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x326f8cc | out: lpFileSize=0x326f8cc*=2296) returned 1 [0102.867] CloseHandle (hObject=0x18c) returned 1 [0102.867] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0102.867] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0102.867] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0102.867] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0102.867] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0102.867] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0102.867] GetLastError () returned 0x0 [0102.867] ReadFile (in: hFile=0x18c, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0x8f8, lpOverlapped=0x0) returned 1 [0102.868] WriteFile (in: hFile=0x190, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0x900, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0x900, lpOverlapped=0x0) returned 1 [0102.868] ReadFile (in: hFile=0x18c, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0x0, lpOverlapped=0x0) returned 1 [0102.868] WriteFile (in: hFile=0x190, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0xe6, lpOverlapped=0x0) returned 1 [0102.868] SetEndOfFile (hFile=0x190) returned 1 [0102.868] CloseHandle (hObject=0x190) returned 1 [0102.869] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0102.869] SetEndOfFile (hFile=0x18c) returned 1 [0102.869] CloseHandle (hObject=0x18c) returned 1 [0102.869] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x2020) returned 1 [0102.870] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0102.870] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0102.870] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0102.870] lstrlenW (lpString=".doc") returned 4 [0102.870] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0102.870] lstrlenW (lpString=".docx") returned 5 [0102.870] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0102.870] lstrlenW (lpString=".pdf") returned 4 [0102.870] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0102.870] lstrlenW (lpString=".xls") returned 4 [0102.870] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0102.870] lstrlenW (lpString=".xlsx") returned 5 [0102.870] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0102.870] lstrlenW (lpString=".ppt") returned 4 [0102.870] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0102.870] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0102.870] lstrlenW (lpString=".zip") returned 4 [0102.870] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0102.870] lstrlenW (lpString=".rar") returned 4 [0102.870] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0102.870] lstrlenW (lpString=".bz2") returned 4 [0102.870] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0102.870] lstrlenW (lpString=".7z") returned 3 [0102.870] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0102.870] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0102.870] lstrlenW (lpString=".dbf") returned 4 [0102.870] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0102.870] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0102.870] lstrlenW (lpString=".1cd") returned 4 [0102.870] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0102.870] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0102.870] lstrlenW (lpString=".jpg") returned 4 [0102.870] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0102.870] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0102.870] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0102.870] lstrlenW (lpString=".doc") returned 4 [0102.870] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0102.870] lstrlenW (lpString=".docx") returned 5 [0102.871] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0102.871] lstrlenW (lpString=".pdf") returned 4 [0102.871] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0102.871] lstrlenW (lpString=".xls") returned 4 [0102.871] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0102.871] lstrlenW (lpString=".xlsx") returned 5 [0102.871] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0102.871] lstrlenW (lpString=".ppt") returned 4 [0102.871] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0102.871] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0102.871] lstrlenW (lpString=".zip") returned 4 [0102.871] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0102.871] lstrlenW (lpString=".rar") returned 4 [0102.871] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0102.871] lstrlenW (lpString=".bz2") returned 4 [0102.871] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0102.871] lstrlenW (lpString=".7z") returned 3 [0102.871] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0102.871] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0102.871] lstrlenW (lpString=".dbf") returned 4 [0102.871] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0102.871] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0102.871] lstrlenW (lpString=".1cd") returned 4 [0102.871] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0102.871] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0102.871] lstrlenW (lpString=".jpg") returned 4 [0102.871] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0102.871] lstrcmpiW (lpString1=".xml", lpString2=".waifu") returned 1 [0102.871] lstrlenW (lpString="PowerPointMUI.xml") returned 17 [0102.871] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0102.872] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x326f8cc | out: lpFileSize=0x326f8cc*=1450) returned 1 [0102.872] CloseHandle (hObject=0x18c) returned 1 [0102.872] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml")) returned 0x2020 [0102.872] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0102.872] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0102.872] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0102.872] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0102.872] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0102.872] GetLastError () returned 0x0 [0102.872] ReadFile (in: hFile=0x18c, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0x5aa, lpOverlapped=0x0) returned 1 [0102.873] WriteFile (in: hFile=0x190, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0x5b0, lpOverlapped=0x0) returned 1 [0102.874] ReadFile (in: hFile=0x18c, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0x0, lpOverlapped=0x0) returned 1 [0102.874] WriteFile (in: hFile=0x190, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0xf6, lpOverlapped=0x0) returned 1 [0102.874] SetEndOfFile (hFile=0x190) returned 1 [0102.874] CloseHandle (hObject=0x190) returned 1 [0102.874] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0102.874] SetEndOfFile (hFile=0x18c) returned 1 [0102.875] CloseHandle (hObject=0x18c) returned 1 [0102.875] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x2020) returned 1 [0102.875] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml")) returned 1 [0102.875] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0102.875] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0102.876] lstrlenW (lpString=".doc") returned 4 [0102.876] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0102.876] lstrlenW (lpString=".docx") returned 5 [0102.876] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0102.876] lstrlenW (lpString=".pdf") returned 4 [0102.876] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0102.876] lstrlenW (lpString=".xls") returned 4 [0102.876] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0102.876] lstrlenW (lpString=".xlsx") returned 5 [0102.876] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0102.876] lstrlenW (lpString=".ppt") returned 4 [0102.876] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0102.876] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0102.876] lstrlenW (lpString=".zip") returned 4 [0102.876] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0102.876] lstrlenW (lpString=".rar") returned 4 [0102.876] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0102.876] lstrlenW (lpString=".bz2") returned 4 [0102.876] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0102.876] lstrlenW (lpString=".7z") returned 3 [0102.876] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0102.876] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0102.876] lstrlenW (lpString=".dbf") returned 4 [0102.876] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0102.876] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0102.876] lstrlenW (lpString=".1cd") returned 4 [0102.876] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0102.876] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0102.876] lstrlenW (lpString=".jpg") returned 4 [0102.876] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0102.876] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0102.876] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0102.876] lstrlenW (lpString=".doc") returned 4 [0102.876] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0102.876] lstrlenW (lpString=".docx") returned 5 [0102.876] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0102.876] lstrlenW (lpString=".pdf") returned 4 [0102.876] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0102.876] lstrlenW (lpString=".xls") returned 4 [0102.876] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0102.876] lstrlenW (lpString=".xlsx") returned 5 [0102.876] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0102.876] lstrlenW (lpString=".ppt") returned 4 [0102.876] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0102.876] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0102.876] lstrlenW (lpString=".zip") returned 4 [0102.876] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0102.876] lstrlenW (lpString=".rar") returned 4 [0102.876] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0102.876] lstrlenW (lpString=".bz2") returned 4 [0102.877] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0102.877] lstrlenW (lpString=".7z") returned 3 [0102.877] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0102.877] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0102.877] lstrlenW (lpString=".dbf") returned 4 [0102.877] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0102.877] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0102.877] lstrlenW (lpString=".1cd") returned 4 [0102.877] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0102.877] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0102.877] lstrlenW (lpString=".jpg") returned 4 [0102.877] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0102.877] lstrcmpiW (lpString1=".xml", lpString2=".waifu") returned 1 [0102.877] lstrlenW (lpString="Setup.xml") returned 9 [0102.877] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0102.877] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x326f8cc | out: lpFileSize=0x326f8cc*=1886) returned 1 [0102.877] CloseHandle (hObject=0x18c) returned 1 [0102.877] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0102.877] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0102.877] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0102.877] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0102.877] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0102.877] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0102.878] GetLastError () returned 0x0 [0102.878] ReadFile (in: hFile=0x18c, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0x75e, lpOverlapped=0x0) returned 1 [0102.967] WriteFile (in: hFile=0x190, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0x760, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0x760, lpOverlapped=0x0) returned 1 [0102.968] ReadFile (in: hFile=0x18c, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0x0, lpOverlapped=0x0) returned 1 [0102.968] WriteFile (in: hFile=0x190, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0xe6, lpOverlapped=0x0) returned 1 [0102.968] SetEndOfFile (hFile=0x190) returned 1 [0102.968] CloseHandle (hObject=0x190) returned 1 [0102.968] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0102.968] SetEndOfFile (hFile=0x18c) returned 1 [0102.970] CloseHandle (hObject=0x18c) returned 1 [0102.970] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x2020) returned 1 [0102.970] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0102.972] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0102.972] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0102.972] lstrlenW (lpString=".doc") returned 4 [0102.972] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0102.972] lstrlenW (lpString=".docx") returned 5 [0102.972] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0102.972] lstrlenW (lpString=".pdf") returned 4 [0102.972] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0102.972] lstrlenW (lpString=".xls") returned 4 [0102.972] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0102.972] lstrlenW (lpString=".xlsx") returned 5 [0102.972] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0102.972] lstrlenW (lpString=".ppt") returned 4 [0102.972] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0102.972] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0102.972] lstrlenW (lpString=".zip") returned 4 [0102.972] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0102.972] lstrlenW (lpString=".rar") returned 4 [0102.972] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0102.972] lstrlenW (lpString=".bz2") returned 4 [0102.972] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0102.972] lstrlenW (lpString=".7z") returned 3 [0102.972] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0102.972] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0102.972] lstrlenW (lpString=".dbf") returned 4 [0102.973] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0102.973] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0102.973] lstrlenW (lpString=".1cd") returned 4 [0102.973] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0102.973] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0102.973] lstrlenW (lpString=".jpg") returned 4 [0102.973] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0102.973] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0102.973] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0102.973] lstrlenW (lpString=".doc") returned 4 [0102.973] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0102.973] lstrlenW (lpString=".docx") returned 5 [0102.973] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0102.973] lstrlenW (lpString=".pdf") returned 4 [0102.973] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0102.973] lstrlenW (lpString=".xls") returned 4 [0102.973] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0102.973] lstrlenW (lpString=".xlsx") returned 5 [0102.973] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0102.973] lstrlenW (lpString=".ppt") returned 4 [0102.973] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0102.973] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0102.973] lstrlenW (lpString=".zip") returned 4 [0102.973] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0102.973] lstrlenW (lpString=".rar") returned 4 [0102.973] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0102.973] lstrlenW (lpString=".bz2") returned 4 [0102.973] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0102.973] lstrlenW (lpString=".7z") returned 3 [0102.973] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0102.973] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0102.973] lstrlenW (lpString=".dbf") returned 4 [0102.973] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0102.973] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0102.973] lstrlenW (lpString=".1cd") returned 4 [0102.973] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0102.973] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0102.973] lstrlenW (lpString=".jpg") returned 4 [0102.973] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0102.973] lstrcmpiW (lpString1=".xml", lpString2=".waifu") returned 1 [0102.973] lstrlenW (lpString="Proof.xml") returned 9 [0102.973] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0103.258] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x326f8cc | out: lpFileSize=0x326f8cc*=1457) returned 1 [0103.258] CloseHandle (hObject=0x180) returned 1 [0103.258] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml")) returned 0x2020 [0103.259] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0103.259] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0103.259] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0103.259] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0103.259] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0103.259] GetLastError () returned 0x0 [0103.259] ReadFile (in: hFile=0x180, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0x5b1, lpOverlapped=0x0) returned 1 [0103.306] WriteFile (in: hFile=0x16c, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0x5c0, lpOverlapped=0x0) returned 1 [0103.307] ReadFile (in: hFile=0x180, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0x0, lpOverlapped=0x0) returned 1 [0103.307] WriteFile (in: hFile=0x16c, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0xe6, lpOverlapped=0x0) returned 1 [0103.307] SetEndOfFile (hFile=0x16c) returned 1 [0103.307] CloseHandle (hObject=0x16c) returned 1 [0103.308] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0103.308] SetEndOfFile (hFile=0x180) returned 1 [0103.400] CloseHandle (hObject=0x180) returned 1 [0103.400] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x2020) returned 1 [0103.400] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml")) returned 1 [0103.400] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0103.400] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0103.400] lstrlenW (lpString=".doc") returned 4 [0103.400] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0103.400] lstrlenW (lpString=".docx") returned 5 [0103.400] lstrcmpiW (lpString1=".docx", lpString2="f.xml") returned -1 [0103.400] lstrlenW (lpString=".pdf") returned 4 [0103.400] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0103.400] lstrlenW (lpString=".xls") returned 4 [0103.400] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0103.400] lstrlenW (lpString=".xlsx") returned 5 [0103.400] lstrcmpiW (lpString1=".xlsx", lpString2="f.xml") returned -1 [0103.400] lstrlenW (lpString=".ppt") returned 4 [0103.400] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0103.400] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0103.400] lstrlenW (lpString=".zip") returned 4 [0103.400] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0103.400] lstrlenW (lpString=".rar") returned 4 [0103.400] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0103.400] lstrlenW (lpString=".bz2") returned 4 [0103.400] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0103.400] lstrlenW (lpString=".7z") returned 3 [0103.400] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0103.400] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0103.400] lstrlenW (lpString=".dbf") returned 4 [0103.400] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0103.401] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0103.401] lstrlenW (lpString=".1cd") returned 4 [0103.401] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0103.401] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0103.401] lstrlenW (lpString=".jpg") returned 4 [0103.401] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0103.401] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0103.401] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0103.401] lstrlenW (lpString=".doc") returned 4 [0103.401] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0103.401] lstrlenW (lpString=".docx") returned 5 [0103.401] lstrcmpiW (lpString1=".docx", lpString2="f.xml") returned -1 [0103.401] lstrlenW (lpString=".pdf") returned 4 [0103.401] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0103.401] lstrlenW (lpString=".xls") returned 4 [0103.401] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0103.401] lstrlenW (lpString=".xlsx") returned 5 [0103.401] lstrcmpiW (lpString1=".xlsx", lpString2="f.xml") returned -1 [0103.401] lstrlenW (lpString=".ppt") returned 4 [0103.401] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0103.401] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0103.401] lstrlenW (lpString=".zip") returned 4 [0103.401] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0103.401] lstrlenW (lpString=".rar") returned 4 [0103.401] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0103.401] lstrlenW (lpString=".bz2") returned 4 [0103.401] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0103.401] lstrlenW (lpString=".7z") returned 3 [0103.401] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0103.401] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0103.401] lstrlenW (lpString=".dbf") returned 4 [0103.401] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0103.401] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0103.401] lstrlenW (lpString=".1cd") returned 4 [0103.401] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0103.401] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0103.401] lstrlenW (lpString=".jpg") returned 4 [0103.401] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0103.401] lstrcmpiW (lpString1=".xml", lpString2=".waifu") returned 1 [0103.401] lstrlenW (lpString="GrooveMUI.xml") returned 13 [0103.401] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0103.431] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x326f8cc | out: lpFileSize=0x326f8cc*=913) returned 1 [0103.431] CloseHandle (hObject=0x180) returned 1 [0103.431] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml")) returned 0x2020 [0103.432] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0103.433] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0103.433] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0103.433] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0103.433] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0103.433] GetLastError () returned 0x0 [0103.433] ReadFile (in: hFile=0x180, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0x391, lpOverlapped=0x0) returned 1 [0103.463] WriteFile (in: hFile=0x17c, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0x3a0, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0x3a0, lpOverlapped=0x0) returned 1 [0103.463] ReadFile (in: hFile=0x180, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0x0, lpOverlapped=0x0) returned 1 [0103.463] WriteFile (in: hFile=0x17c, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0xee, lpOverlapped=0x0) returned 1 [0103.463] SetEndOfFile (hFile=0x17c) returned 1 [0103.463] CloseHandle (hObject=0x17c) returned 1 [0103.464] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0103.464] SetEndOfFile (hFile=0x180) returned 1 [0103.464] CloseHandle (hObject=0x180) returned 1 [0103.464] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x2020) returned 1 [0103.465] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml")) returned 1 [0103.465] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0103.465] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0103.465] lstrlenW (lpString=".doc") returned 4 [0103.465] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0103.465] lstrlenW (lpString=".docx") returned 5 [0103.465] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0103.465] lstrlenW (lpString=".pdf") returned 4 [0103.465] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0103.465] lstrlenW (lpString=".xls") returned 4 [0103.465] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0103.465] lstrlenW (lpString=".xlsx") returned 5 [0103.465] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0103.465] lstrlenW (lpString=".ppt") returned 4 [0103.465] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0103.465] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0103.465] lstrlenW (lpString=".zip") returned 4 [0103.465] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0103.465] lstrlenW (lpString=".rar") returned 4 [0103.465] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0103.465] lstrlenW (lpString=".bz2") returned 4 [0103.465] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0103.465] lstrlenW (lpString=".7z") returned 3 [0103.465] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0103.465] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0103.465] lstrlenW (lpString=".dbf") returned 4 [0103.465] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0103.465] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0103.465] lstrlenW (lpString=".1cd") returned 4 [0103.465] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0103.465] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0103.465] lstrlenW (lpString=".jpg") returned 4 [0103.465] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0103.465] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0103.466] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0103.466] lstrlenW (lpString=".doc") returned 4 [0103.466] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0103.466] lstrlenW (lpString=".docx") returned 5 [0103.466] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0103.466] lstrlenW (lpString=".pdf") returned 4 [0103.466] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0103.466] lstrlenW (lpString=".xls") returned 4 [0103.466] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0103.466] lstrlenW (lpString=".xlsx") returned 5 [0103.466] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0103.466] lstrlenW (lpString=".ppt") returned 4 [0103.466] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0103.466] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0103.466] lstrlenW (lpString=".zip") returned 4 [0103.466] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0103.466] lstrlenW (lpString=".rar") returned 4 [0103.466] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0103.466] lstrlenW (lpString=".bz2") returned 4 [0103.466] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0103.466] lstrlenW (lpString=".7z") returned 3 [0103.466] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0103.466] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0103.466] lstrlenW (lpString=".dbf") returned 4 [0103.466] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0103.466] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0103.466] lstrlenW (lpString=".1cd") returned 4 [0103.466] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0103.466] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0103.466] lstrlenW (lpString=".jpg") returned 4 [0103.466] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0103.466] lstrcmpiW (lpString1=".xml", lpString2=".waifu") returned 1 [0103.466] lstrlenW (lpString="OfficeMUI.xml") returned 13 [0103.466] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0103.466] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x326f8cc | out: lpFileSize=0x326f8cc*=5557) returned 1 [0103.466] CloseHandle (hObject=0x180) returned 1 [0103.466] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml")) returned 0x2020 [0103.467] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0103.467] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0103.467] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0103.467] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0103.467] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0103.468] GetLastError () returned 0x0 [0103.468] ReadFile (in: hFile=0x180, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0x15b5, lpOverlapped=0x0) returned 1 [0103.469] WriteFile (in: hFile=0x17c, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0x15c0, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0x15c0, lpOverlapped=0x0) returned 1 [0103.469] ReadFile (in: hFile=0x180, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0x0, lpOverlapped=0x0) returned 1 [0103.469] WriteFile (in: hFile=0x17c, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0xee, lpOverlapped=0x0) returned 1 [0103.469] SetEndOfFile (hFile=0x17c) returned 1 [0103.469] CloseHandle (hObject=0x17c) returned 1 [0103.470] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0103.470] SetEndOfFile (hFile=0x180) returned 1 [0103.470] CloseHandle (hObject=0x180) returned 1 [0103.471] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x2020) returned 1 [0103.471] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml")) returned 1 [0103.471] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0103.471] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0103.471] lstrlenW (lpString=".doc") returned 4 [0103.471] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0103.471] lstrlenW (lpString=".docx") returned 5 [0103.471] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0103.471] lstrlenW (lpString=".pdf") returned 4 [0103.471] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0103.471] lstrlenW (lpString=".xls") returned 4 [0103.471] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0103.471] lstrlenW (lpString=".xlsx") returned 5 [0103.471] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0103.471] lstrlenW (lpString=".ppt") returned 4 [0103.471] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0103.471] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0103.471] lstrlenW (lpString=".zip") returned 4 [0103.471] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0103.471] lstrlenW (lpString=".rar") returned 4 [0103.471] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0103.471] lstrlenW (lpString=".bz2") returned 4 [0103.471] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0103.471] lstrlenW (lpString=".7z") returned 3 [0103.471] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0103.471] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0103.471] lstrlenW (lpString=".dbf") returned 4 [0103.471] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0103.471] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0103.471] lstrlenW (lpString=".1cd") returned 4 [0103.471] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0103.471] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0103.471] lstrlenW (lpString=".jpg") returned 4 [0103.472] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0103.472] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0103.472] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0103.472] lstrlenW (lpString=".doc") returned 4 [0103.472] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0103.472] lstrlenW (lpString=".docx") returned 5 [0103.472] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0103.472] lstrlenW (lpString=".pdf") returned 4 [0103.472] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0103.472] lstrlenW (lpString=".xls") returned 4 [0103.472] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0103.472] lstrlenW (lpString=".xlsx") returned 5 [0103.472] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0103.472] lstrlenW (lpString=".ppt") returned 4 [0103.472] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0103.472] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0103.472] lstrlenW (lpString=".zip") returned 4 [0103.472] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0103.472] lstrlenW (lpString=".rar") returned 4 [0103.472] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0103.472] lstrlenW (lpString=".bz2") returned 4 [0103.472] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0103.472] lstrlenW (lpString=".7z") returned 3 [0103.472] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0103.472] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0103.472] lstrlenW (lpString=".dbf") returned 4 [0103.472] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0103.472] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0103.472] lstrlenW (lpString=".1cd") returned 4 [0103.472] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0103.472] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0103.472] lstrlenW (lpString=".jpg") returned 4 [0103.472] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0103.472] lstrcmpiW (lpString1=".xml", lpString2=".waifu") returned 1 [0103.472] lstrlenW (lpString="OfficeMUISet.xml") returned 16 [0103.472] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0103.472] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x326f8cc | out: lpFileSize=0x326f8cc*=819) returned 1 [0103.473] CloseHandle (hObject=0x180) returned 1 [0103.473] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml")) returned 0x2020 [0103.473] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0103.473] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0103.473] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0103.473] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0103.473] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0103.474] GetLastError () returned 0x0 [0103.474] ReadFile (in: hFile=0x180, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0x333, lpOverlapped=0x0) returned 1 [0103.475] WriteFile (in: hFile=0x17c, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0x340, lpOverlapped=0x0) returned 1 [0103.475] ReadFile (in: hFile=0x180, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0x0, lpOverlapped=0x0) returned 1 [0103.475] WriteFile (in: hFile=0x17c, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0xf4, lpOverlapped=0x0) returned 1 [0103.475] SetEndOfFile (hFile=0x17c) returned 1 [0103.475] CloseHandle (hObject=0x17c) returned 1 [0103.476] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0103.476] SetEndOfFile (hFile=0x180) returned 1 [0103.476] CloseHandle (hObject=0x180) returned 1 [0103.476] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x2020) returned 1 [0103.477] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml")) returned 1 [0103.477] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0103.477] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0103.477] lstrlenW (lpString=".doc") returned 4 [0103.477] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0103.477] lstrlenW (lpString=".docx") returned 5 [0103.477] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0103.477] lstrlenW (lpString=".pdf") returned 4 [0103.477] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0103.477] lstrlenW (lpString=".xls") returned 4 [0103.477] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0103.477] lstrlenW (lpString=".xlsx") returned 5 [0103.477] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0103.477] lstrlenW (lpString=".ppt") returned 4 [0103.477] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0103.477] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0103.477] lstrlenW (lpString=".zip") returned 4 [0103.477] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0103.477] lstrlenW (lpString=".rar") returned 4 [0103.477] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0103.477] lstrlenW (lpString=".bz2") returned 4 [0103.477] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0103.477] lstrlenW (lpString=".7z") returned 3 [0103.477] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0103.477] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0103.477] lstrlenW (lpString=".dbf") returned 4 [0103.477] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0103.477] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0103.477] lstrlenW (lpString=".1cd") returned 4 [0103.477] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0103.477] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0103.477] lstrlenW (lpString=".jpg") returned 4 [0103.477] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0103.477] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0103.477] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0103.478] lstrlenW (lpString=".doc") returned 4 [0103.478] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0103.478] lstrlenW (lpString=".docx") returned 5 [0103.478] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0103.478] lstrlenW (lpString=".pdf") returned 4 [0103.478] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0103.478] lstrlenW (lpString=".xls") returned 4 [0103.478] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0103.478] lstrlenW (lpString=".xlsx") returned 5 [0103.478] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0103.478] lstrlenW (lpString=".ppt") returned 4 [0103.478] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0103.478] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0103.478] lstrlenW (lpString=".zip") returned 4 [0103.478] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0103.478] lstrlenW (lpString=".rar") returned 4 [0103.478] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0103.478] lstrlenW (lpString=".bz2") returned 4 [0103.478] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0103.478] lstrlenW (lpString=".7z") returned 3 [0103.478] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0103.478] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0103.478] lstrlenW (lpString=".dbf") returned 4 [0103.478] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0103.478] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0103.478] lstrlenW (lpString=".1cd") returned 4 [0103.478] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0103.478] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0103.478] lstrlenW (lpString=".jpg") returned 4 [0103.478] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0103.478] lstrcmpiW (lpString1=".chm", lpString2=".waifu") returned -1 [0103.478] lstrlenW (lpString="pss10r.chm") returned 10 [0103.478] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\pss10r.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0103.479] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x326f8cc | out: lpFileSize=0x326f8cc*=27195) returned 1 [0103.479] CloseHandle (hObject=0x180) returned 1 [0103.479] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\pss10r.chm")) returned 0x2020 [0103.479] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\pss10r.chm.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0103.479] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\pss10r.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0103.479] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0103.479] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0103.479] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\pss10r.chm.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0103.479] GetLastError () returned 0x0 [0103.479] ReadFile (in: hFile=0x180, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0x6a3b, lpOverlapped=0x0) returned 1 [0103.481] WriteFile (in: hFile=0x17c, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0x6a40, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0x6a40, lpOverlapped=0x0) returned 1 [0103.481] ReadFile (in: hFile=0x180, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0x0, lpOverlapped=0x0) returned 1 [0103.481] WriteFile (in: hFile=0x17c, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0xe8, lpOverlapped=0x0) returned 1 [0103.481] SetEndOfFile (hFile=0x17c) returned 1 [0103.482] CloseHandle (hObject=0x17c) returned 1 [0103.482] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0103.482] SetEndOfFile (hFile=0x180) returned 1 [0103.483] CloseHandle (hObject=0x180) returned 1 [0103.483] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x2020) returned 1 [0103.483] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\pss10r.chm")) returned 1 [0103.483] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0103.483] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0103.483] lstrlenW (lpString=".doc") returned 4 [0103.483] lstrcmpiW (lpString1=".doc", lpString2=".chm") returned 1 [0103.483] lstrlenW (lpString=".docx") returned 5 [0103.483] lstrcmpiW (lpString1=".docx", lpString2="r.chm") returned -1 [0103.483] lstrlenW (lpString=".pdf") returned 4 [0103.483] lstrcmpiW (lpString1=".pdf", lpString2=".chm") returned 1 [0103.483] lstrlenW (lpString=".xls") returned 4 [0103.483] lstrcmpiW (lpString1=".xls", lpString2=".chm") returned 1 [0103.483] lstrlenW (lpString=".xlsx") returned 5 [0103.483] lstrcmpiW (lpString1=".xlsx", lpString2="r.chm") returned -1 [0103.483] lstrlenW (lpString=".ppt") returned 4 [0103.483] lstrcmpiW (lpString1=".ppt", lpString2=".chm") returned 1 [0103.484] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0103.484] lstrlenW (lpString=".zip") returned 4 [0103.484] lstrcmpiW (lpString1=".zip", lpString2=".chm") returned 1 [0103.484] lstrlenW (lpString=".rar") returned 4 [0103.484] lstrcmpiW (lpString1=".rar", lpString2=".chm") returned 1 [0103.484] lstrlenW (lpString=".bz2") returned 4 [0103.484] lstrcmpiW (lpString1=".bz2", lpString2=".chm") returned -1 [0103.484] lstrlenW (lpString=".7z") returned 3 [0103.484] lstrcmpiW (lpString1=".7z", lpString2="chm") returned -1 [0103.484] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0103.484] lstrlenW (lpString=".dbf") returned 4 [0103.484] lstrcmpiW (lpString1=".dbf", lpString2=".chm") returned 1 [0103.484] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0103.484] lstrlenW (lpString=".1cd") returned 4 [0103.484] lstrcmpiW (lpString1=".1cd", lpString2=".chm") returned -1 [0103.484] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0103.484] lstrlenW (lpString=".jpg") returned 4 [0103.484] lstrcmpiW (lpString1=".jpg", lpString2=".chm") returned 1 [0103.484] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0103.484] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0103.484] lstrlenW (lpString=".doc") returned 4 [0103.484] lstrcmpiW (lpString1=".doc", lpString2=".chm") returned 1 [0103.484] lstrlenW (lpString=".docx") returned 5 [0103.484] lstrcmpiW (lpString1=".docx", lpString2="r.chm") returned -1 [0103.484] lstrlenW (lpString=".pdf") returned 4 [0103.484] lstrcmpiW (lpString1=".pdf", lpString2=".chm") returned 1 [0103.484] lstrlenW (lpString=".xls") returned 4 [0103.484] lstrcmpiW (lpString1=".xls", lpString2=".chm") returned 1 [0103.484] lstrlenW (lpString=".xlsx") returned 5 [0103.484] lstrcmpiW (lpString1=".xlsx", lpString2="r.chm") returned -1 [0103.484] lstrlenW (lpString=".ppt") returned 4 [0103.484] lstrcmpiW (lpString1=".ppt", lpString2=".chm") returned 1 [0103.484] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0103.484] lstrlenW (lpString=".zip") returned 4 [0103.484] lstrcmpiW (lpString1=".zip", lpString2=".chm") returned 1 [0103.484] lstrlenW (lpString=".rar") returned 4 [0103.484] lstrcmpiW (lpString1=".rar", lpString2=".chm") returned 1 [0103.484] lstrlenW (lpString=".bz2") returned 4 [0103.484] lstrcmpiW (lpString1=".bz2", lpString2=".chm") returned -1 [0103.484] lstrlenW (lpString=".7z") returned 3 [0103.484] lstrcmpiW (lpString1=".7z", lpString2="chm") returned -1 [0103.484] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0103.484] lstrlenW (lpString=".dbf") returned 4 [0103.484] lstrcmpiW (lpString1=".dbf", lpString2=".chm") returned 1 [0103.484] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0103.484] lstrlenW (lpString=".1cd") returned 4 [0103.484] lstrcmpiW (lpString1=".1cd", lpString2=".chm") returned -1 [0103.484] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0103.484] lstrlenW (lpString=".jpg") returned 4 [0103.484] lstrcmpiW (lpString1=".jpg", lpString2=".chm") returned 1 [0103.485] lstrcmpiW (lpString1=".chm", lpString2=".waifu") returned -1 [0103.485] lstrlenW (lpString="setup.chm") returned 9 [0103.485] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0103.485] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x326f8cc | out: lpFileSize=0x326f8cc*=67190) returned 1 [0103.485] CloseHandle (hObject=0x180) returned 1 [0103.485] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.chm")) returned 0x2020 [0103.485] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.chm.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0103.485] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0103.486] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0103.486] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0103.486] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.chm.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0103.486] GetLastError () returned 0x0 [0103.486] ReadFile (in: hFile=0x180, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0x10676, lpOverlapped=0x0) returned 1 [0103.855] WriteFile (in: hFile=0x17c, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0x10680, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0x10680, lpOverlapped=0x0) returned 1 [0103.857] ReadFile (in: hFile=0x180, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0x0, lpOverlapped=0x0) returned 1 [0103.857] WriteFile (in: hFile=0x17c, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0xe6, lpOverlapped=0x0) returned 1 [0103.857] SetEndOfFile (hFile=0x17c) returned 1 [0103.857] CloseHandle (hObject=0x17c) returned 1 [0103.858] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0103.858] SetEndOfFile (hFile=0x180) returned 1 [0103.858] CloseHandle (hObject=0x180) returned 1 [0103.859] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x2020) returned 1 [0103.859] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.chm")) returned 1 [0103.859] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0103.859] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0103.859] lstrlenW (lpString=".doc") returned 4 [0103.859] lstrcmpiW (lpString1=".doc", lpString2=".chm") returned 1 [0103.859] lstrlenW (lpString=".docx") returned 5 [0103.859] lstrcmpiW (lpString1=".docx", lpString2="p.chm") returned -1 [0103.859] lstrlenW (lpString=".pdf") returned 4 [0103.859] lstrcmpiW (lpString1=".pdf", lpString2=".chm") returned 1 [0103.859] lstrlenW (lpString=".xls") returned 4 [0103.859] lstrcmpiW (lpString1=".xls", lpString2=".chm") returned 1 [0103.859] lstrlenW (lpString=".xlsx") returned 5 [0103.859] lstrcmpiW (lpString1=".xlsx", lpString2="p.chm") returned -1 [0103.859] lstrlenW (lpString=".ppt") returned 4 [0103.859] lstrcmpiW (lpString1=".ppt", lpString2=".chm") returned 1 [0103.859] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0103.859] lstrlenW (lpString=".zip") returned 4 [0103.859] lstrcmpiW (lpString1=".zip", lpString2=".chm") returned 1 [0103.859] lstrlenW (lpString=".rar") returned 4 [0103.859] lstrcmpiW (lpString1=".rar", lpString2=".chm") returned 1 [0103.859] lstrlenW (lpString=".bz2") returned 4 [0103.859] lstrcmpiW (lpString1=".bz2", lpString2=".chm") returned -1 [0103.859] lstrlenW (lpString=".7z") returned 3 [0103.859] lstrcmpiW (lpString1=".7z", lpString2="chm") returned -1 [0103.859] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0103.859] lstrlenW (lpString=".dbf") returned 4 [0103.859] lstrcmpiW (lpString1=".dbf", lpString2=".chm") returned 1 [0103.860] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0103.860] lstrlenW (lpString=".1cd") returned 4 [0103.860] lstrcmpiW (lpString1=".1cd", lpString2=".chm") returned -1 [0103.860] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0103.860] lstrlenW (lpString=".jpg") returned 4 [0103.860] lstrcmpiW (lpString1=".jpg", lpString2=".chm") returned 1 [0103.860] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0103.860] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0103.860] lstrlenW (lpString=".doc") returned 4 [0103.860] lstrcmpiW (lpString1=".doc", lpString2=".chm") returned 1 [0103.860] lstrlenW (lpString=".docx") returned 5 [0103.860] lstrcmpiW (lpString1=".docx", lpString2="p.chm") returned -1 [0103.860] lstrlenW (lpString=".pdf") returned 4 [0103.860] lstrcmpiW (lpString1=".pdf", lpString2=".chm") returned 1 [0103.860] lstrlenW (lpString=".xls") returned 4 [0103.860] lstrcmpiW (lpString1=".xls", lpString2=".chm") returned 1 [0103.860] lstrlenW (lpString=".xlsx") returned 5 [0103.860] lstrcmpiW (lpString1=".xlsx", lpString2="p.chm") returned -1 [0103.860] lstrlenW (lpString=".ppt") returned 4 [0103.860] lstrcmpiW (lpString1=".ppt", lpString2=".chm") returned 1 [0103.860] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0103.860] lstrlenW (lpString=".zip") returned 4 [0103.860] lstrcmpiW (lpString1=".zip", lpString2=".chm") returned 1 [0103.860] lstrlenW (lpString=".rar") returned 4 [0103.860] lstrcmpiW (lpString1=".rar", lpString2=".chm") returned 1 [0103.860] lstrlenW (lpString=".bz2") returned 4 [0103.860] lstrcmpiW (lpString1=".bz2", lpString2=".chm") returned -1 [0103.860] lstrlenW (lpString=".7z") returned 3 [0103.860] lstrcmpiW (lpString1=".7z", lpString2="chm") returned -1 [0103.860] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0103.860] lstrlenW (lpString=".dbf") returned 4 [0103.860] lstrcmpiW (lpString1=".dbf", lpString2=".chm") returned 1 [0103.860] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0103.860] lstrlenW (lpString=".1cd") returned 4 [0103.860] lstrcmpiW (lpString1=".1cd", lpString2=".chm") returned -1 [0103.860] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0103.860] lstrlenW (lpString=".jpg") returned 4 [0103.860] lstrcmpiW (lpString1=".jpg", lpString2=".chm") returned 1 [0103.860] lstrcmpiW (lpString1=".xml", lpString2=".waifu") returned 1 [0103.860] lstrlenW (lpString="AccessMUISet.xml") returned 16 [0103.860] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0103.861] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x326f8cc | out: lpFileSize=0x326f8cc*=819) returned 1 [0103.861] CloseHandle (hObject=0x180) returned 1 [0103.861] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml")) returned 0x2020 [0103.861] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0103.861] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0103.861] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0103.861] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0103.861] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0103.861] GetLastError () returned 0x0 [0103.861] ReadFile (in: hFile=0x180, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0x333, lpOverlapped=0x0) returned 1 [0103.862] WriteFile (in: hFile=0x17c, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0x340, lpOverlapped=0x0) returned 1 [0103.863] ReadFile (in: hFile=0x180, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0x0, lpOverlapped=0x0) returned 1 [0103.863] WriteFile (in: hFile=0x17c, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0xf4, lpOverlapped=0x0) returned 1 [0103.863] SetEndOfFile (hFile=0x17c) returned 1 [0103.863] CloseHandle (hObject=0x17c) returned 1 [0103.863] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0103.863] SetEndOfFile (hFile=0x180) returned 1 [0103.864] CloseHandle (hObject=0x180) returned 1 [0103.864] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x2020) returned 1 [0103.864] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml")) returned 1 [0103.864] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0103.864] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0103.865] lstrlenW (lpString=".doc") returned 4 [0103.865] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0103.865] lstrlenW (lpString=".docx") returned 5 [0103.865] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0103.865] lstrlenW (lpString=".pdf") returned 4 [0103.865] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0103.865] lstrlenW (lpString=".xls") returned 4 [0103.865] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0103.865] lstrlenW (lpString=".xlsx") returned 5 [0103.865] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0103.865] lstrlenW (lpString=".ppt") returned 4 [0103.865] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0103.865] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0103.865] lstrlenW (lpString=".zip") returned 4 [0103.865] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0103.865] lstrlenW (lpString=".rar") returned 4 [0103.865] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0103.865] lstrlenW (lpString=".bz2") returned 4 [0103.865] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0103.865] lstrlenW (lpString=".7z") returned 3 [0103.865] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0103.865] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0103.865] lstrlenW (lpString=".dbf") returned 4 [0103.865] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0103.865] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0103.865] lstrlenW (lpString=".1cd") returned 4 [0103.865] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0103.865] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0103.865] lstrlenW (lpString=".jpg") returned 4 [0103.865] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0103.865] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0103.865] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0103.865] lstrlenW (lpString=".doc") returned 4 [0103.865] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0103.865] lstrlenW (lpString=".docx") returned 5 [0103.865] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0103.865] lstrlenW (lpString=".pdf") returned 4 [0103.865] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0103.865] lstrlenW (lpString=".xls") returned 4 [0103.865] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0103.865] lstrlenW (lpString=".xlsx") returned 5 [0103.865] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0103.865] lstrlenW (lpString=".ppt") returned 4 [0103.865] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0103.865] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0103.865] lstrlenW (lpString=".zip") returned 4 [0103.865] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0103.865] lstrlenW (lpString=".rar") returned 4 [0103.865] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0103.865] lstrlenW (lpString=".bz2") returned 4 [0103.865] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0103.866] lstrlenW (lpString=".7z") returned 3 [0103.866] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0103.866] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0103.866] lstrlenW (lpString=".dbf") returned 4 [0103.866] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0103.866] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0103.866] lstrlenW (lpString=".1cd") returned 4 [0103.866] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0103.866] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0103.866] lstrlenW (lpString=".jpg") returned 4 [0103.866] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0103.866] lstrcmpiW (lpString1=".xml", lpString2=".waifu") returned 1 [0103.866] lstrlenW (lpString="Setup.xml") returned 9 [0103.866] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0103.866] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x326f8cc | out: lpFileSize=0x326f8cc*=2624) returned 1 [0103.866] CloseHandle (hObject=0x180) returned 1 [0103.866] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0103.866] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0103.866] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0103.866] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0103.866] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0103.866] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0103.867] GetLastError () returned 0x0 [0103.867] ReadFile (in: hFile=0x180, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0xa40, lpOverlapped=0x0) returned 1 [0103.868] WriteFile (in: hFile=0x17c, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xa50, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0xa50, lpOverlapped=0x0) returned 1 [0103.868] ReadFile (in: hFile=0x180, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0x0, lpOverlapped=0x0) returned 1 [0103.868] WriteFile (in: hFile=0x17c, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0xe6, lpOverlapped=0x0) returned 1 [0103.869] SetEndOfFile (hFile=0x17c) returned 1 [0103.869] CloseHandle (hObject=0x17c) returned 1 [0103.869] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0103.869] SetEndOfFile (hFile=0x180) returned 1 [0103.870] CloseHandle (hObject=0x180) returned 1 [0103.870] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x2020) returned 1 [0103.870] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0103.870] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0103.870] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0103.870] lstrlenW (lpString=".doc") returned 4 [0103.870] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0103.870] lstrlenW (lpString=".docx") returned 5 [0103.870] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0103.870] lstrlenW (lpString=".pdf") returned 4 [0103.870] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0103.870] lstrlenW (lpString=".xls") returned 4 [0103.870] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0103.870] lstrlenW (lpString=".xlsx") returned 5 [0103.870] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0103.870] lstrlenW (lpString=".ppt") returned 4 [0103.870] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0103.870] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0103.870] lstrlenW (lpString=".zip") returned 4 [0103.870] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0103.870] lstrlenW (lpString=".rar") returned 4 [0103.870] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0103.871] lstrlenW (lpString=".bz2") returned 4 [0103.871] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0103.871] lstrlenW (lpString=".7z") returned 3 [0103.871] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0103.871] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0103.871] lstrlenW (lpString=".dbf") returned 4 [0103.871] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0103.871] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0103.871] lstrlenW (lpString=".1cd") returned 4 [0103.871] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0103.871] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0103.871] lstrlenW (lpString=".jpg") returned 4 [0103.871] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0103.871] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0103.871] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0103.871] lstrlenW (lpString=".doc") returned 4 [0103.871] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0103.871] lstrlenW (lpString=".docx") returned 5 [0103.871] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0103.871] lstrlenW (lpString=".pdf") returned 4 [0103.871] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0103.871] lstrlenW (lpString=".xls") returned 4 [0103.871] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0103.871] lstrlenW (lpString=".xlsx") returned 5 [0103.871] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0103.871] lstrlenW (lpString=".ppt") returned 4 [0103.871] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0103.871] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0103.871] lstrlenW (lpString=".zip") returned 4 [0103.871] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0103.871] lstrlenW (lpString=".rar") returned 4 [0103.871] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0103.871] lstrlenW (lpString=".bz2") returned 4 [0103.871] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0103.871] lstrlenW (lpString=".7z") returned 3 [0103.871] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0103.871] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0103.871] lstrlenW (lpString=".dbf") returned 4 [0103.871] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0103.871] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0103.871] lstrlenW (lpString=".1cd") returned 4 [0103.871] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0103.871] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0103.871] lstrlenW (lpString=".jpg") returned 4 [0103.871] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0103.871] lstrcmpiW (lpString1=".xml", lpString2=".waifu") returned 1 [0103.871] lstrlenW (lpString="Office32WW.xml") returned 14 [0103.871] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0103.872] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x326f8cc | out: lpFileSize=0x326f8cc*=4274) returned 1 [0103.873] CloseHandle (hObject=0x180) returned 1 [0103.873] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml")) returned 0x2020 [0103.873] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0103.873] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0103.873] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0103.873] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0103.873] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0103.873] GetLastError () returned 0x0 [0103.873] ReadFile (in: hFile=0x180, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0x10b2, lpOverlapped=0x0) returned 1 [0103.874] WriteFile (in: hFile=0x17c, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0x10c0, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0x10c0, lpOverlapped=0x0) returned 1 [0103.875] ReadFile (in: hFile=0x180, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0x0, lpOverlapped=0x0) returned 1 [0103.875] WriteFile (in: hFile=0x17c, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0xf0, lpOverlapped=0x0) returned 1 [0103.875] SetEndOfFile (hFile=0x17c) returned 1 [0103.875] CloseHandle (hObject=0x17c) returned 1 [0103.875] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0103.876] SetEndOfFile (hFile=0x180) returned 1 [0103.876] CloseHandle (hObject=0x180) returned 1 [0103.876] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x2020) returned 1 [0103.876] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml")) returned 1 [0103.876] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0103.876] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0103.876] lstrlenW (lpString=".doc") returned 4 [0103.877] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0103.877] lstrlenW (lpString=".docx") returned 5 [0103.877] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0103.877] lstrlenW (lpString=".pdf") returned 4 [0103.877] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0103.877] lstrlenW (lpString=".xls") returned 4 [0103.877] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0103.877] lstrlenW (lpString=".xlsx") returned 5 [0103.877] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0103.877] lstrlenW (lpString=".ppt") returned 4 [0103.877] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0103.877] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0103.877] lstrlenW (lpString=".zip") returned 4 [0103.877] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0103.877] lstrlenW (lpString=".rar") returned 4 [0103.877] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0103.877] lstrlenW (lpString=".bz2") returned 4 [0103.877] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0103.877] lstrlenW (lpString=".7z") returned 3 [0103.877] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0103.877] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0103.877] lstrlenW (lpString=".dbf") returned 4 [0103.877] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0103.877] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0103.877] lstrlenW (lpString=".1cd") returned 4 [0103.877] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0103.877] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0103.877] lstrlenW (lpString=".jpg") returned 4 [0103.877] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0103.877] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0103.877] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0103.877] lstrlenW (lpString=".doc") returned 4 [0103.877] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0103.877] lstrlenW (lpString=".docx") returned 5 [0103.877] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0103.877] lstrlenW (lpString=".pdf") returned 4 [0103.877] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0103.877] lstrlenW (lpString=".xls") returned 4 [0103.877] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0103.877] lstrlenW (lpString=".xlsx") returned 5 [0103.877] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0103.877] lstrlenW (lpString=".ppt") returned 4 [0103.877] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0103.877] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0103.877] lstrlenW (lpString=".zip") returned 4 [0103.877] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0103.877] lstrlenW (lpString=".rar") returned 4 [0103.877] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0103.877] lstrlenW (lpString=".bz2") returned 4 [0103.877] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0103.877] lstrlenW (lpString=".7z") returned 3 [0103.877] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0103.877] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0103.878] lstrlenW (lpString=".dbf") returned 4 [0103.878] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0103.878] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0103.878] lstrlenW (lpString=".1cd") returned 4 [0103.878] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0103.878] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0103.878] lstrlenW (lpString=".jpg") returned 4 [0103.878] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0103.878] lstrcmpiW (lpString1=".xml", lpString2=".waifu") returned 1 [0103.878] lstrlenW (lpString="ProPlusrWW.xml") returned 14 [0103.878] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0103.878] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x326f8cc | out: lpFileSize=0x326f8cc*=16852) returned 1 [0103.878] CloseHandle (hObject=0x180) returned 1 [0103.878] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml")) returned 0x2020 [0103.878] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0103.879] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0103.879] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0103.879] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0103.879] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0103.879] GetLastError () returned 0x0 [0103.879] ReadFile (in: hFile=0x180, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0x41d4, lpOverlapped=0x0) returned 1 [0103.880] WriteFile (in: hFile=0x17c, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0x41e0, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0x41e0, lpOverlapped=0x0) returned 1 [0103.881] ReadFile (in: hFile=0x180, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0x0, lpOverlapped=0x0) returned 1 [0103.881] WriteFile (in: hFile=0x17c, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0xf0, lpOverlapped=0x0) returned 1 [0103.881] SetEndOfFile (hFile=0x17c) returned 1 [0103.881] CloseHandle (hObject=0x17c) returned 1 [0103.882] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0103.882] SetEndOfFile (hFile=0x180) returned 1 [0103.882] CloseHandle (hObject=0x180) returned 1 [0103.882] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x2020) returned 1 [0103.882] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml")) returned 1 [0103.883] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0103.883] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0103.883] lstrlenW (lpString=".doc") returned 4 [0103.883] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0103.883] lstrlenW (lpString=".docx") returned 5 [0103.883] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0103.883] lstrlenW (lpString=".pdf") returned 4 [0103.883] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0103.883] lstrlenW (lpString=".xls") returned 4 [0103.883] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0103.883] lstrlenW (lpString=".xlsx") returned 5 [0103.883] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0103.883] lstrlenW (lpString=".ppt") returned 4 [0103.883] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0103.883] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0103.883] lstrlenW (lpString=".zip") returned 4 [0103.883] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0103.883] lstrlenW (lpString=".rar") returned 4 [0103.883] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0103.883] lstrlenW (lpString=".bz2") returned 4 [0103.883] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0103.883] lstrlenW (lpString=".7z") returned 3 [0103.883] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0103.883] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0103.883] lstrlenW (lpString=".dbf") returned 4 [0103.883] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0103.883] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0103.883] lstrlenW (lpString=".1cd") returned 4 [0103.883] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0103.883] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0103.883] lstrlenW (lpString=".jpg") returned 4 [0103.883] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0103.883] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0103.883] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0103.883] lstrlenW (lpString=".doc") returned 4 [0103.883] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0103.883] lstrlenW (lpString=".docx") returned 5 [0103.883] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0103.883] lstrlenW (lpString=".pdf") returned 4 [0103.883] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0103.883] lstrlenW (lpString=".xls") returned 4 [0103.883] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0103.883] lstrlenW (lpString=".xlsx") returned 5 [0103.883] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0103.884] lstrlenW (lpString=".ppt") returned 4 [0103.884] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0103.884] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0103.884] lstrlenW (lpString=".zip") returned 4 [0103.884] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0103.884] lstrlenW (lpString=".rar") returned 4 [0103.884] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0103.884] lstrlenW (lpString=".bz2") returned 4 [0103.884] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0103.884] lstrlenW (lpString=".7z") returned 3 [0103.884] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0103.884] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0103.884] lstrlenW (lpString=".dbf") returned 4 [0103.884] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0103.884] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0103.884] lstrlenW (lpString=".1cd") returned 4 [0103.884] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0103.884] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0103.884] lstrlenW (lpString=".jpg") returned 4 [0103.884] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0103.884] lstrcmpiW (lpString1=".xml", lpString2=".waifu") returned 1 [0103.884] lstrlenW (lpString="Setup.xml") returned 9 [0103.884] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0103.885] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x326f8cc | out: lpFileSize=0x326f8cc*=31094) returned 1 [0103.885] CloseHandle (hObject=0x180) returned 1 [0103.885] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0103.885] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0103.885] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0103.885] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0103.885] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0103.885] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0103.885] GetLastError () returned 0x0 [0103.885] ReadFile (in: hFile=0x180, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0x7976, lpOverlapped=0x0) returned 1 [0103.886] WriteFile (in: hFile=0x17c, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0x7980, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0x7980, lpOverlapped=0x0) returned 1 [0103.887] ReadFile (in: hFile=0x180, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0x0, lpOverlapped=0x0) returned 1 [0103.887] WriteFile (in: hFile=0x17c, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0xe6, lpOverlapped=0x0) returned 1 [0103.887] SetEndOfFile (hFile=0x17c) returned 1 [0103.887] CloseHandle (hObject=0x17c) returned 1 [0103.888] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0103.888] SetEndOfFile (hFile=0x180) returned 1 [0104.294] CloseHandle (hObject=0x180) returned 1 [0104.295] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x2020) returned 1 [0104.295] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0104.295] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0104.295] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0104.295] lstrlenW (lpString=".doc") returned 4 [0104.295] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0104.295] lstrlenW (lpString=".docx") returned 5 [0104.295] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0104.295] lstrlenW (lpString=".pdf") returned 4 [0104.295] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0104.295] lstrlenW (lpString=".xls") returned 4 [0104.295] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0104.295] lstrlenW (lpString=".xlsx") returned 5 [0104.295] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0104.295] lstrlenW (lpString=".ppt") returned 4 [0104.295] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0104.295] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0104.295] lstrlenW (lpString=".zip") returned 4 [0104.295] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0104.295] lstrlenW (lpString=".rar") returned 4 [0104.295] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0104.295] lstrlenW (lpString=".bz2") returned 4 [0104.295] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0104.295] lstrlenW (lpString=".7z") returned 3 [0104.295] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0104.295] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0104.295] lstrlenW (lpString=".dbf") returned 4 [0104.295] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0104.295] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0104.295] lstrlenW (lpString=".1cd") returned 4 [0104.295] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0104.296] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0104.296] lstrlenW (lpString=".jpg") returned 4 [0104.296] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0104.296] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0104.296] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0104.296] lstrlenW (lpString=".doc") returned 4 [0104.296] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0104.296] lstrlenW (lpString=".docx") returned 5 [0104.296] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0104.296] lstrlenW (lpString=".pdf") returned 4 [0104.296] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0104.296] lstrlenW (lpString=".xls") returned 4 [0104.296] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0104.296] lstrlenW (lpString=".xlsx") returned 5 [0104.296] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0104.296] lstrlenW (lpString=".ppt") returned 4 [0104.296] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0104.296] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0104.296] lstrlenW (lpString=".zip") returned 4 [0104.296] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0104.296] lstrlenW (lpString=".rar") returned 4 [0104.296] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0104.296] lstrlenW (lpString=".bz2") returned 4 [0104.296] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0104.296] lstrlenW (lpString=".7z") returned 3 [0104.296] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0104.296] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0104.296] lstrlenW (lpString=".dbf") returned 4 [0104.296] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0104.296] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0104.296] lstrlenW (lpString=".1cd") returned 4 [0104.296] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0104.296] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0104.296] lstrlenW (lpString=".jpg") returned 4 [0104.296] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0104.296] lstrcmpiW (lpString1=".xml", lpString2=".waifu") returned 1 [0104.296] lstrlenW (lpString="Office32WW.xml") returned 14 [0104.296] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0104.299] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x326f8cc | out: lpFileSize=0x326f8cc*=4274) returned 1 [0104.299] CloseHandle (hObject=0x180) returned 1 [0104.299] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml")) returned 0x2020 [0104.299] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0104.299] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0104.299] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0104.299] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0104.299] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0104.299] GetLastError () returned 0x0 [0104.299] ReadFile (in: hFile=0x180, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0x10b2, lpOverlapped=0x0) returned 1 [0104.432] WriteFile (in: hFile=0x194, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0x10c0, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0x10c0, lpOverlapped=0x0) returned 1 [0104.432] ReadFile (in: hFile=0x180, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0x0, lpOverlapped=0x0) returned 1 [0104.433] WriteFile (in: hFile=0x194, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0xf0, lpOverlapped=0x0) returned 1 [0104.433] SetEndOfFile (hFile=0x194) returned 1 [0104.433] CloseHandle (hObject=0x194) returned 1 [0104.433] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0104.433] SetEndOfFile (hFile=0x180) returned 1 [0104.434] CloseHandle (hObject=0x180) returned 1 [0104.434] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x2020) returned 1 [0104.434] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml")) returned 1 [0104.434] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0104.434] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0104.434] lstrlenW (lpString=".doc") returned 4 [0104.434] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0104.434] lstrlenW (lpString=".docx") returned 5 [0104.434] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0104.434] lstrlenW (lpString=".pdf") returned 4 [0104.434] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0104.434] lstrlenW (lpString=".xls") returned 4 [0104.434] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0104.434] lstrlenW (lpString=".xlsx") returned 5 [0104.434] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0104.434] lstrlenW (lpString=".ppt") returned 4 [0104.434] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0104.434] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0104.434] lstrlenW (lpString=".zip") returned 4 [0104.435] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0104.435] lstrlenW (lpString=".rar") returned 4 [0104.435] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0104.435] lstrlenW (lpString=".bz2") returned 4 [0104.435] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0104.435] lstrlenW (lpString=".7z") returned 3 [0104.435] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0104.435] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0104.435] lstrlenW (lpString=".dbf") returned 4 [0104.435] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0104.435] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0104.435] lstrlenW (lpString=".1cd") returned 4 [0104.435] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0104.435] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0104.435] lstrlenW (lpString=".jpg") returned 4 [0104.435] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0104.435] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0104.435] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0104.435] lstrlenW (lpString=".doc") returned 4 [0104.435] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0104.435] lstrlenW (lpString=".docx") returned 5 [0104.435] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0104.435] lstrlenW (lpString=".pdf") returned 4 [0104.435] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0104.435] lstrlenW (lpString=".xls") returned 4 [0104.435] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0104.435] lstrlenW (lpString=".xlsx") returned 5 [0104.435] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0104.435] lstrlenW (lpString=".ppt") returned 4 [0104.435] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0104.435] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0104.435] lstrlenW (lpString=".zip") returned 4 [0104.435] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0104.435] lstrlenW (lpString=".rar") returned 4 [0104.435] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0104.435] lstrlenW (lpString=".bz2") returned 4 [0104.435] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0104.435] lstrlenW (lpString=".7z") returned 3 [0104.435] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0104.435] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0104.435] lstrlenW (lpString=".dbf") returned 4 [0104.435] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0104.435] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0104.435] lstrlenW (lpString=".1cd") returned 4 [0104.435] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0104.435] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0104.435] lstrlenW (lpString=".jpg") returned 4 [0104.435] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0104.435] lstrcmpiW (lpString1=".xml", lpString2=".waifu") returned 1 [0104.436] lstrlenW (lpString="Setup.xml") returned 9 [0104.436] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0104.436] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x326f8cc | out: lpFileSize=0x326f8cc*=20577) returned 1 [0104.436] CloseHandle (hObject=0x180) returned 1 [0104.436] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0104.436] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0104.436] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0104.436] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0104.436] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0104.436] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0104.436] GetLastError () returned 0x0 [0104.436] ReadFile (in: hFile=0x180, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0x5061, lpOverlapped=0x0) returned 1 [0104.440] WriteFile (in: hFile=0x194, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0x5070, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0x5070, lpOverlapped=0x0) returned 1 [0104.441] ReadFile (in: hFile=0x180, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0x0, lpOverlapped=0x0) returned 1 [0104.441] WriteFile (in: hFile=0x194, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0xe6, lpOverlapped=0x0) returned 1 [0104.441] SetEndOfFile (hFile=0x194) returned 1 [0104.441] CloseHandle (hObject=0x194) returned 1 [0104.442] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0104.442] SetEndOfFile (hFile=0x180) returned 1 [0104.442] CloseHandle (hObject=0x180) returned 1 [0104.442] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x2020) returned 1 [0104.443] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0104.443] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0104.443] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0104.443] lstrlenW (lpString=".doc") returned 4 [0104.443] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0104.443] lstrlenW (lpString=".docx") returned 5 [0104.443] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0104.443] lstrlenW (lpString=".pdf") returned 4 [0104.443] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0104.443] lstrlenW (lpString=".xls") returned 4 [0104.443] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0104.443] lstrlenW (lpString=".xlsx") returned 5 [0104.443] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0104.443] lstrlenW (lpString=".ppt") returned 4 [0104.443] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0104.443] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0104.443] lstrlenW (lpString=".zip") returned 4 [0104.443] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0104.443] lstrlenW (lpString=".rar") returned 4 [0104.443] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0104.443] lstrlenW (lpString=".bz2") returned 4 [0104.443] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0104.443] lstrlenW (lpString=".7z") returned 3 [0104.443] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0104.443] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0104.443] lstrlenW (lpString=".dbf") returned 4 [0104.443] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0104.443] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0104.443] lstrlenW (lpString=".1cd") returned 4 [0104.443] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0104.443] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0104.443] lstrlenW (lpString=".jpg") returned 4 [0104.443] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0104.443] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0104.443] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0104.443] lstrlenW (lpString=".doc") returned 4 [0104.443] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0104.443] lstrlenW (lpString=".docx") returned 5 [0104.443] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0104.443] lstrlenW (lpString=".pdf") returned 4 [0104.443] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0104.443] lstrlenW (lpString=".xls") returned 4 [0104.443] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0104.443] lstrlenW (lpString=".xlsx") returned 5 [0104.443] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0104.444] lstrlenW (lpString=".ppt") returned 4 [0104.444] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0104.444] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0104.444] lstrlenW (lpString=".zip") returned 4 [0104.444] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0104.444] lstrlenW (lpString=".rar") returned 4 [0104.444] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0104.444] lstrlenW (lpString=".bz2") returned 4 [0104.444] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0104.444] lstrlenW (lpString=".7z") returned 3 [0104.444] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0104.444] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0104.444] lstrlenW (lpString=".dbf") returned 4 [0104.444] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0104.444] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0104.444] lstrlenW (lpString=".1cd") returned 4 [0104.444] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0104.444] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0104.444] lstrlenW (lpString=".jpg") returned 4 [0104.444] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0104.444] lstrcmpiW (lpString1=".xml", lpString2=".waifu") returned 1 [0104.444] lstrlenW (lpString="VisiorWW.xml") returned 12 [0104.444] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0104.447] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x326f8cc | out: lpFileSize=0x326f8cc*=8723) returned 1 [0104.447] CloseHandle (hObject=0x180) returned 1 [0104.447] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml")) returned 0x2020 [0104.447] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0104.447] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0104.447] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0104.447] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0104.447] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0104.447] GetLastError () returned 0x0 [0104.447] ReadFile (in: hFile=0x180, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0x2213, lpOverlapped=0x0) returned 1 [0104.450] WriteFile (in: hFile=0x194, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0x2220, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0x2220, lpOverlapped=0x0) returned 1 [0104.451] ReadFile (in: hFile=0x180, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0x0, lpOverlapped=0x0) returned 1 [0104.451] WriteFile (in: hFile=0x194, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0xec, lpOverlapped=0x0) returned 1 [0104.451] SetEndOfFile (hFile=0x194) returned 1 [0104.451] CloseHandle (hObject=0x194) returned 1 [0104.451] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0104.451] SetEndOfFile (hFile=0x180) returned 1 [0104.452] CloseHandle (hObject=0x180) returned 1 [0104.452] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x2020) returned 1 [0104.452] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml")) returned 1 [0104.452] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0104.452] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0104.452] lstrlenW (lpString=".doc") returned 4 [0104.452] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0104.452] lstrlenW (lpString=".docx") returned 5 [0104.452] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0104.452] lstrlenW (lpString=".pdf") returned 4 [0104.452] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0104.452] lstrlenW (lpString=".xls") returned 4 [0104.452] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0104.452] lstrlenW (lpString=".xlsx") returned 5 [0104.453] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0104.453] lstrlenW (lpString=".ppt") returned 4 [0104.453] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0104.453] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0104.453] lstrlenW (lpString=".zip") returned 4 [0104.453] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0104.453] lstrlenW (lpString=".rar") returned 4 [0104.453] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0104.453] lstrlenW (lpString=".bz2") returned 4 [0104.453] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0104.453] lstrlenW (lpString=".7z") returned 3 [0104.453] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0104.453] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0104.453] lstrlenW (lpString=".dbf") returned 4 [0104.453] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0104.453] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0104.453] lstrlenW (lpString=".1cd") returned 4 [0104.453] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0104.453] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0104.453] lstrlenW (lpString=".jpg") returned 4 [0104.453] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0104.453] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0104.453] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0104.453] lstrlenW (lpString=".doc") returned 4 [0104.453] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0104.453] lstrlenW (lpString=".docx") returned 5 [0104.453] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0104.453] lstrlenW (lpString=".pdf") returned 4 [0104.453] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0104.453] lstrlenW (lpString=".xls") returned 4 [0104.453] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0104.453] lstrlenW (lpString=".xlsx") returned 5 [0104.453] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0104.453] lstrlenW (lpString=".ppt") returned 4 [0104.453] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0104.453] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0104.453] lstrlenW (lpString=".zip") returned 4 [0104.453] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0104.453] lstrlenW (lpString=".rar") returned 4 [0104.453] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0104.453] lstrlenW (lpString=".bz2") returned 4 [0104.453] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0104.453] lstrlenW (lpString=".7z") returned 3 [0104.453] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0104.453] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0104.453] lstrlenW (lpString=".dbf") returned 4 [0104.453] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0104.453] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0104.453] lstrlenW (lpString=".1cd") returned 4 [0104.453] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0104.453] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0104.454] lstrlenW (lpString=".jpg") returned 4 [0104.454] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0104.454] lstrcmpiW (lpString1=".EPS", lpString2=".waifu") returned -1 [0104.454] lstrlenW (lpString="MS.EPS") returned 6 [0104.454] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.eps"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0104.455] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x326f8cc | out: lpFileSize=0x326f8cc*=15067) returned 1 [0104.455] CloseHandle (hObject=0x180) returned 1 [0104.455] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.eps")) returned 0x20 [0104.456] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.eps.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0104.456] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.eps"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0104.456] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0104.456] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0104.456] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.eps.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0104.456] GetLastError () returned 0x0 [0104.456] ReadFile (in: hFile=0x180, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0x3adb, lpOverlapped=0x0) returned 1 [0104.458] WriteFile (in: hFile=0x194, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0x3ae0, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0x3ae0, lpOverlapped=0x0) returned 1 [0104.458] ReadFile (in: hFile=0x180, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0x0, lpOverlapped=0x0) returned 1 [0104.458] WriteFile (in: hFile=0x194, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0xe0, lpOverlapped=0x0) returned 1 [0104.458] SetEndOfFile (hFile=0x194) returned 1 [0104.459] CloseHandle (hObject=0x194) returned 1 [0104.459] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0104.459] SetEndOfFile (hFile=0x180) returned 1 [0104.459] CloseHandle (hObject=0x180) returned 1 [0104.459] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0104.460] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.eps")) returned 1 [0104.460] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0104.460] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0104.460] lstrlenW (lpString=".doc") returned 4 [0104.460] lstrcmpiW (lpString1=".doc", lpString2=".EPS") returned -1 [0104.460] lstrlenW (lpString=".docx") returned 5 [0104.460] lstrcmpiW (lpString1=".docx", lpString2="S.EPS") returned -1 [0104.460] lstrlenW (lpString=".pdf") returned 4 [0104.460] lstrcmpiW (lpString1=".pdf", lpString2=".EPS") returned 1 [0104.460] lstrlenW (lpString=".xls") returned 4 [0104.460] lstrcmpiW (lpString1=".xls", lpString2=".EPS") returned 1 [0104.460] lstrlenW (lpString=".xlsx") returned 5 [0104.460] lstrcmpiW (lpString1=".xlsx", lpString2="S.EPS") returned -1 [0104.460] lstrlenW (lpString=".ppt") returned 4 [0104.460] lstrcmpiW (lpString1=".ppt", lpString2=".EPS") returned 1 [0104.460] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0104.460] lstrlenW (lpString=".zip") returned 4 [0104.460] lstrcmpiW (lpString1=".zip", lpString2=".EPS") returned 1 [0104.460] lstrlenW (lpString=".rar") returned 4 [0104.460] lstrcmpiW (lpString1=".rar", lpString2=".EPS") returned 1 [0104.460] lstrlenW (lpString=".bz2") returned 4 [0104.460] lstrcmpiW (lpString1=".bz2", lpString2=".EPS") returned -1 [0104.460] lstrlenW (lpString=".7z") returned 3 [0104.460] lstrcmpiW (lpString1=".7z", lpString2="EPS") returned -1 [0104.460] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0104.460] lstrlenW (lpString=".dbf") returned 4 [0104.460] lstrcmpiW (lpString1=".dbf", lpString2=".EPS") returned -1 [0104.460] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0104.460] lstrlenW (lpString=".1cd") returned 4 [0104.460] lstrcmpiW (lpString1=".1cd", lpString2=".EPS") returned -1 [0104.460] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0104.460] lstrlenW (lpString=".jpg") returned 4 [0104.460] lstrcmpiW (lpString1=".jpg", lpString2=".EPS") returned 1 [0104.461] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0104.461] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0104.461] lstrlenW (lpString=".doc") returned 4 [0104.461] lstrcmpiW (lpString1=".doc", lpString2=".EPS") returned -1 [0104.461] lstrlenW (lpString=".docx") returned 5 [0104.461] lstrcmpiW (lpString1=".docx", lpString2="S.EPS") returned -1 [0104.461] lstrlenW (lpString=".pdf") returned 4 [0104.461] lstrcmpiW (lpString1=".pdf", lpString2=".EPS") returned 1 [0104.461] lstrlenW (lpString=".xls") returned 4 [0104.461] lstrcmpiW (lpString1=".xls", lpString2=".EPS") returned 1 [0104.461] lstrlenW (lpString=".xlsx") returned 5 [0104.461] lstrcmpiW (lpString1=".xlsx", lpString2="S.EPS") returned -1 [0104.461] lstrlenW (lpString=".ppt") returned 4 [0104.461] lstrcmpiW (lpString1=".ppt", lpString2=".EPS") returned 1 [0104.461] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0104.461] lstrlenW (lpString=".zip") returned 4 [0104.461] lstrcmpiW (lpString1=".zip", lpString2=".EPS") returned 1 [0104.461] lstrlenW (lpString=".rar") returned 4 [0104.461] lstrcmpiW (lpString1=".rar", lpString2=".EPS") returned 1 [0104.461] lstrlenW (lpString=".bz2") returned 4 [0104.461] lstrcmpiW (lpString1=".bz2", lpString2=".EPS") returned -1 [0104.461] lstrlenW (lpString=".7z") returned 3 [0104.461] lstrcmpiW (lpString1=".7z", lpString2="EPS") returned -1 [0104.461] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0104.461] lstrlenW (lpString=".dbf") returned 4 [0104.461] lstrcmpiW (lpString1=".dbf", lpString2=".EPS") returned -1 [0104.461] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0104.461] lstrlenW (lpString=".1cd") returned 4 [0104.461] lstrcmpiW (lpString1=".1cd", lpString2=".EPS") returned -1 [0104.461] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0104.461] lstrlenW (lpString=".jpg") returned 4 [0104.461] lstrcmpiW (lpString1=".jpg", lpString2=".EPS") returned 1 [0104.461] lstrcmpiW (lpString1=".GIF", lpString2=".waifu") returned -1 [0104.461] lstrlenW (lpString="MS.GIF") returned 6 [0104.461] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0104.461] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x326f8cc | out: lpFileSize=0x326f8cc*=1069) returned 1 [0104.461] CloseHandle (hObject=0x180) returned 1 [0104.462] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.gif")) returned 0x20 [0104.462] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.gif.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0104.462] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0104.462] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0104.462] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0104.462] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.gif.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0104.462] GetLastError () returned 0x0 [0104.462] ReadFile (in: hFile=0x180, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0x42d, lpOverlapped=0x0) returned 1 [0104.463] WriteFile (in: hFile=0x194, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0x430, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0x430, lpOverlapped=0x0) returned 1 [0104.464] ReadFile (in: hFile=0x180, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0x0, lpOverlapped=0x0) returned 1 [0104.464] WriteFile (in: hFile=0x194, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0xe0, lpOverlapped=0x0) returned 1 [0104.464] SetEndOfFile (hFile=0x194) returned 1 [0104.464] CloseHandle (hObject=0x194) returned 1 [0104.464] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0104.464] SetEndOfFile (hFile=0x180) returned 1 [0104.466] CloseHandle (hObject=0x180) returned 1 [0104.466] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0104.467] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.gif")) returned 1 [0104.467] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0104.467] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0104.467] lstrlenW (lpString=".doc") returned 4 [0104.467] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0104.467] lstrlenW (lpString=".docx") returned 5 [0104.467] lstrcmpiW (lpString1=".docx", lpString2="S.GIF") returned -1 [0104.467] lstrlenW (lpString=".pdf") returned 4 [0104.467] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0104.467] lstrlenW (lpString=".xls") returned 4 [0104.467] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0104.467] lstrlenW (lpString=".xlsx") returned 5 [0104.467] lstrcmpiW (lpString1=".xlsx", lpString2="S.GIF") returned -1 [0104.467] lstrlenW (lpString=".ppt") returned 4 [0104.467] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0104.467] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0104.467] lstrlenW (lpString=".zip") returned 4 [0104.467] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0104.467] lstrlenW (lpString=".rar") returned 4 [0104.467] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0104.467] lstrlenW (lpString=".bz2") returned 4 [0104.467] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0104.467] lstrlenW (lpString=".7z") returned 3 [0104.467] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0104.467] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0104.467] lstrlenW (lpString=".dbf") returned 4 [0104.467] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0104.467] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0104.467] lstrlenW (lpString=".1cd") returned 4 [0104.467] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0104.467] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0104.467] lstrlenW (lpString=".jpg") returned 4 [0104.467] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0104.467] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0104.467] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0104.467] lstrlenW (lpString=".doc") returned 4 [0104.467] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0104.468] lstrlenW (lpString=".docx") returned 5 [0104.468] lstrcmpiW (lpString1=".docx", lpString2="S.GIF") returned -1 [0104.468] lstrlenW (lpString=".pdf") returned 4 [0104.468] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0104.468] lstrlenW (lpString=".xls") returned 4 [0104.468] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0104.468] lstrlenW (lpString=".xlsx") returned 5 [0104.468] lstrcmpiW (lpString1=".xlsx", lpString2="S.GIF") returned -1 [0104.468] lstrlenW (lpString=".ppt") returned 4 [0104.468] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0104.468] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0104.468] lstrlenW (lpString=".zip") returned 4 [0104.468] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0104.468] lstrlenW (lpString=".rar") returned 4 [0104.468] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0104.468] lstrlenW (lpString=".bz2") returned 4 [0104.468] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0104.468] lstrlenW (lpString=".7z") returned 3 [0104.468] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0104.468] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0104.468] lstrlenW (lpString=".dbf") returned 4 [0104.468] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0104.468] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0104.468] lstrlenW (lpString=".1cd") returned 4 [0104.468] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0104.468] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0104.468] lstrlenW (lpString=".jpg") returned 4 [0104.468] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0104.468] lstrcmpiW (lpString1=".JPG", lpString2=".waifu") returned -1 [0104.468] lstrlenW (lpString="MS.JPG") returned 6 [0104.468] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0104.470] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x326f8cc | out: lpFileSize=0x326f8cc*=1061) returned 1 [0104.470] CloseHandle (hObject=0x180) returned 1 [0104.470] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg")) returned 0x20 [0104.470] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0104.470] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0104.470] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0104.470] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0104.470] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0104.471] GetLastError () returned 0x0 [0104.471] ReadFile (in: hFile=0x180, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0x425, lpOverlapped=0x0) returned 1 [0104.669] WriteFile (in: hFile=0x194, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0x430, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0x430, lpOverlapped=0x0) returned 1 [0104.669] ReadFile (in: hFile=0x180, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0x0, lpOverlapped=0x0) returned 1 [0104.669] WriteFile (in: hFile=0x194, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0xe0, lpOverlapped=0x0) returned 1 [0104.669] SetEndOfFile (hFile=0x194) returned 1 [0104.669] CloseHandle (hObject=0x194) returned 1 [0104.670] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0104.670] SetEndOfFile (hFile=0x180) returned 1 [0104.670] CloseHandle (hObject=0x180) returned 1 [0104.671] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0104.671] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg")) returned 1 [0104.671] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0104.671] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0104.671] lstrlenW (lpString=".doc") returned 4 [0104.671] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0104.671] lstrlenW (lpString=".docx") returned 5 [0104.671] lstrcmpiW (lpString1=".docx", lpString2="S.JPG") returned -1 [0104.671] lstrlenW (lpString=".pdf") returned 4 [0104.671] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0104.671] lstrlenW (lpString=".xls") returned 4 [0104.671] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0104.671] lstrlenW (lpString=".xlsx") returned 5 [0104.671] lstrcmpiW (lpString1=".xlsx", lpString2="S.JPG") returned -1 [0104.671] lstrlenW (lpString=".ppt") returned 4 [0104.671] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0104.671] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0104.671] lstrlenW (lpString=".zip") returned 4 [0104.671] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0104.671] lstrlenW (lpString=".rar") returned 4 [0104.671] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0104.671] lstrlenW (lpString=".bz2") returned 4 [0104.671] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0104.671] lstrlenW (lpString=".7z") returned 3 [0104.671] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0104.671] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0104.671] lstrlenW (lpString=".dbf") returned 4 [0104.671] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0104.671] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0104.671] lstrlenW (lpString=".1cd") returned 4 [0104.671] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0104.672] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0104.672] lstrlenW (lpString=".jpg") returned 4 [0104.672] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0104.672] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0104.672] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0104.672] lstrlenW (lpString=".doc") returned 4 [0104.672] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0104.672] lstrlenW (lpString=".docx") returned 5 [0104.672] lstrcmpiW (lpString1=".docx", lpString2="S.JPG") returned -1 [0104.672] lstrlenW (lpString=".pdf") returned 4 [0104.672] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0104.672] lstrlenW (lpString=".xls") returned 4 [0104.672] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0104.672] lstrlenW (lpString=".xlsx") returned 5 [0104.672] lstrcmpiW (lpString1=".xlsx", lpString2="S.JPG") returned -1 [0104.672] lstrlenW (lpString=".ppt") returned 4 [0104.672] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0104.672] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0104.672] lstrlenW (lpString=".zip") returned 4 [0104.672] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0104.672] lstrlenW (lpString=".rar") returned 4 [0104.672] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0104.672] lstrlenW (lpString=".bz2") returned 4 [0104.672] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0104.672] lstrlenW (lpString=".7z") returned 3 [0104.672] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0104.672] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0104.672] lstrlenW (lpString=".dbf") returned 4 [0104.672] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0104.672] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0104.672] lstrlenW (lpString=".1cd") returned 4 [0104.672] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0104.672] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0104.672] lstrlenW (lpString=".jpg") returned 4 [0104.672] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0104.672] lstrcmpiW (lpString1=".xml", lpString2=".waifu") returned 1 [0104.672] lstrlenW (lpString="ipsdeu.xml") returned 10 [0104.672] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdeu.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdeu.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0104.855] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x326f8cc | out: lpFileSize=0x326f8cc*=2616) returned 1 [0104.855] CloseHandle (hObject=0x194) returned 1 [0104.855] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdeu.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdeu.xml")) returned 0x20 [0104.855] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdeu.xml.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdeu.xml.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0104.855] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdeu.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdeu.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0104.856] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdeu.xml") returned 61 [0104.856] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdeu.xml") returned 61 [0104.856] lstrlenW (lpString=".doc") returned 4 [0104.856] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0104.856] lstrlenW (lpString=".docx") returned 5 [0104.856] lstrcmpiW (lpString1=".docx", lpString2="u.xml") returned -1 [0104.856] lstrlenW (lpString=".pdf") returned 4 [0104.856] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0104.856] lstrlenW (lpString=".xls") returned 4 [0104.856] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0104.856] lstrlenW (lpString=".xlsx") returned 5 [0104.856] lstrcmpiW (lpString1=".xlsx", lpString2="u.xml") returned -1 [0104.856] lstrlenW (lpString=".ppt") returned 4 [0104.856] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0104.856] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdeu.xml") returned 61 [0104.856] lstrlenW (lpString=".zip") returned 4 [0104.856] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0104.856] lstrlenW (lpString=".rar") returned 4 [0104.856] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0104.856] lstrlenW (lpString=".bz2") returned 4 [0104.856] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0104.856] lstrlenW (lpString=".7z") returned 3 [0104.856] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0104.856] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdeu.xml") returned 61 [0104.856] lstrlenW (lpString=".dbf") returned 4 [0104.856] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0104.856] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdeu.xml") returned 61 [0104.856] lstrlenW (lpString=".1cd") returned 4 [0104.856] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0104.856] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdeu.xml") returned 61 [0104.856] lstrlenW (lpString=".jpg") returned 4 [0104.856] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0104.856] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdeu.xml") returned 61 [0104.856] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdeu.xml") returned 61 [0104.856] lstrlenW (lpString=".doc") returned 4 [0104.856] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0104.856] lstrlenW (lpString=".docx") returned 5 [0104.856] lstrcmpiW (lpString1=".docx", lpString2="u.xml") returned -1 [0104.856] lstrlenW (lpString=".pdf") returned 4 [0104.856] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0104.856] lstrlenW (lpString=".xls") returned 4 [0104.856] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0104.856] lstrlenW (lpString=".xlsx") returned 5 [0104.856] lstrcmpiW (lpString1=".xlsx", lpString2="u.xml") returned -1 [0104.856] lstrlenW (lpString=".ppt") returned 4 [0104.856] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0104.856] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdeu.xml") returned 61 [0104.856] lstrlenW (lpString=".zip") returned 4 [0104.856] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0104.856] lstrlenW (lpString=".rar") returned 4 [0104.857] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0104.857] lstrlenW (lpString=".bz2") returned 4 [0104.857] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0104.857] lstrlenW (lpString=".7z") returned 3 [0104.857] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0104.857] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdeu.xml") returned 61 [0104.857] lstrlenW (lpString=".dbf") returned 4 [0104.857] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0104.857] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdeu.xml") returned 61 [0104.857] lstrlenW (lpString=".1cd") returned 4 [0104.857] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0104.857] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdeu.xml") returned 61 [0104.857] lstrlenW (lpString=".jpg") returned 4 [0104.857] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0104.857] lstrcmpiW (lpString1=".xml", lpString2=".waifu") returned 1 [0104.857] lstrlenW (lpString="ipsesp.xml") returned 10 [0104.857] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsesp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsesp.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0104.857] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x326f8cc | out: lpFileSize=0x326f8cc*=3024) returned 1 [0104.857] CloseHandle (hObject=0x194) returned 1 [0104.857] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsesp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsesp.xml")) returned 0x20 [0104.857] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsesp.xml.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsesp.xml.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0104.857] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsesp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsesp.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0104.857] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsesp.xml") returned 61 [0104.857] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsesp.xml") returned 61 [0104.857] lstrlenW (lpString=".doc") returned 4 [0104.857] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0104.858] lstrlenW (lpString=".docx") returned 5 [0104.858] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0104.858] lstrlenW (lpString=".pdf") returned 4 [0104.858] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0104.858] lstrlenW (lpString=".xls") returned 4 [0104.858] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0104.858] lstrlenW (lpString=".xlsx") returned 5 [0104.858] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0104.858] lstrlenW (lpString=".ppt") returned 4 [0104.858] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0104.858] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsesp.xml") returned 61 [0104.858] lstrlenW (lpString=".zip") returned 4 [0104.858] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0104.858] lstrlenW (lpString=".rar") returned 4 [0104.858] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0104.858] lstrlenW (lpString=".bz2") returned 4 [0104.858] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0104.858] lstrlenW (lpString=".7z") returned 3 [0104.858] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0104.858] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsesp.xml") returned 61 [0104.858] lstrlenW (lpString=".dbf") returned 4 [0104.858] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0104.858] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsesp.xml") returned 61 [0104.858] lstrlenW (lpString=".1cd") returned 4 [0104.858] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0104.858] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsesp.xml") returned 61 [0104.858] lstrlenW (lpString=".jpg") returned 4 [0104.858] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0104.858] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsesp.xml") returned 61 [0104.858] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsesp.xml") returned 61 [0104.858] lstrlenW (lpString=".doc") returned 4 [0104.858] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0104.858] lstrlenW (lpString=".docx") returned 5 [0104.858] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0104.858] lstrlenW (lpString=".pdf") returned 4 [0104.858] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0104.858] lstrlenW (lpString=".xls") returned 4 [0104.858] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0104.858] lstrlenW (lpString=".xlsx") returned 5 [0104.858] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0104.858] lstrlenW (lpString=".ppt") returned 4 [0104.858] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0104.858] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsesp.xml") returned 61 [0104.858] lstrlenW (lpString=".zip") returned 4 [0104.858] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0104.858] lstrlenW (lpString=".rar") returned 4 [0104.858] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0104.858] lstrlenW (lpString=".bz2") returned 4 [0104.858] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0104.858] lstrlenW (lpString=".7z") returned 3 [0104.858] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0104.859] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsesp.xml") returned 61 [0104.859] lstrlenW (lpString=".dbf") returned 4 [0104.859] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0104.859] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsesp.xml") returned 61 [0104.859] lstrlenW (lpString=".1cd") returned 4 [0104.859] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0104.859] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsesp.xml") returned 61 [0104.859] lstrlenW (lpString=".jpg") returned 4 [0104.859] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0104.859] lstrcmpiW (lpString1=".xml", lpString2=".waifu") returned 1 [0104.859] lstrlenW (lpString="ipsfin.xml") returned 10 [0104.859] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfin.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfin.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0104.859] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x326f8cc | out: lpFileSize=0x326f8cc*=2658) returned 1 [0104.859] CloseHandle (hObject=0x194) returned 1 [0104.859] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfin.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfin.xml")) returned 0x20 [0104.859] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfin.xml.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfin.xml.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0104.859] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfin.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfin.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0104.859] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfin.xml") returned 61 [0104.859] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfin.xml") returned 61 [0104.859] lstrlenW (lpString=".doc") returned 4 [0104.859] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0104.859] lstrlenW (lpString=".docx") returned 5 [0104.859] lstrcmpiW (lpString1=".docx", lpString2="n.xml") returned -1 [0104.859] lstrlenW (lpString=".pdf") returned 4 [0104.859] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0104.859] lstrlenW (lpString=".xls") returned 4 [0104.859] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0104.859] lstrlenW (lpString=".xlsx") returned 5 [0104.860] lstrcmpiW (lpString1=".xlsx", lpString2="n.xml") returned -1 [0104.860] lstrlenW (lpString=".ppt") returned 4 [0104.860] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0104.860] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfin.xml") returned 61 [0104.860] lstrlenW (lpString=".zip") returned 4 [0104.860] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0104.860] lstrlenW (lpString=".rar") returned 4 [0104.860] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0104.860] lstrlenW (lpString=".bz2") returned 4 [0104.860] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0104.860] lstrlenW (lpString=".7z") returned 3 [0104.860] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0104.860] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfin.xml") returned 61 [0104.860] lstrlenW (lpString=".dbf") returned 4 [0104.860] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0104.860] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfin.xml") returned 61 [0104.860] lstrlenW (lpString=".1cd") returned 4 [0104.860] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0104.860] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfin.xml") returned 61 [0104.860] lstrlenW (lpString=".jpg") returned 4 [0104.860] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0104.860] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfin.xml") returned 61 [0104.860] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfin.xml") returned 61 [0104.860] lstrlenW (lpString=".doc") returned 4 [0104.860] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0104.860] lstrlenW (lpString=".docx") returned 5 [0104.860] lstrcmpiW (lpString1=".docx", lpString2="n.xml") returned -1 [0104.860] lstrlenW (lpString=".pdf") returned 4 [0104.860] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0104.860] lstrlenW (lpString=".xls") returned 4 [0104.860] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0104.860] lstrlenW (lpString=".xlsx") returned 5 [0104.860] lstrcmpiW (lpString1=".xlsx", lpString2="n.xml") returned -1 [0104.860] lstrlenW (lpString=".ppt") returned 4 [0104.860] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0104.860] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfin.xml") returned 61 [0104.860] lstrlenW (lpString=".zip") returned 4 [0104.860] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0104.860] lstrlenW (lpString=".rar") returned 4 [0104.860] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0104.860] lstrlenW (lpString=".bz2") returned 4 [0104.860] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0104.860] lstrlenW (lpString=".7z") returned 3 [0104.860] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0104.860] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfin.xml") returned 61 [0104.860] lstrlenW (lpString=".dbf") returned 4 [0104.860] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0104.860] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfin.xml") returned 61 [0104.860] lstrlenW (lpString=".1cd") returned 4 [0104.860] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0104.861] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfin.xml") returned 61 [0104.861] lstrlenW (lpString=".jpg") returned 4 [0104.861] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0104.861] lstrcmpiW (lpString1=".xml", lpString2=".waifu") returned 1 [0104.861] lstrlenW (lpString="ipsfra.xml") returned 10 [0104.861] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfra.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfra.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0104.861] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x326f8cc | out: lpFileSize=0x326f8cc*=2628) returned 1 [0104.861] CloseHandle (hObject=0x194) returned 1 [0104.861] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfra.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfra.xml")) returned 0x20 [0104.861] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfra.xml.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfra.xml.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0104.862] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfra.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfra.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0104.862] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfra.xml") returned 61 [0104.862] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfra.xml") returned 61 [0104.862] lstrlenW (lpString=".doc") returned 4 [0104.862] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0104.862] lstrlenW (lpString=".docx") returned 5 [0104.862] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0104.862] lstrlenW (lpString=".pdf") returned 4 [0104.862] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0104.862] lstrlenW (lpString=".xls") returned 4 [0104.862] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0104.862] lstrlenW (lpString=".xlsx") returned 5 [0104.862] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0104.862] lstrlenW (lpString=".ppt") returned 4 [0104.862] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0104.862] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfra.xml") returned 61 [0104.862] lstrlenW (lpString=".zip") returned 4 [0104.862] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0104.862] lstrlenW (lpString=".rar") returned 4 [0104.862] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0104.862] lstrlenW (lpString=".bz2") returned 4 [0104.862] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0104.862] lstrlenW (lpString=".7z") returned 3 [0104.862] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0104.862] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfra.xml") returned 61 [0104.862] lstrlenW (lpString=".dbf") returned 4 [0104.862] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0104.862] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfra.xml") returned 61 [0104.862] lstrlenW (lpString=".1cd") returned 4 [0104.862] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0104.862] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfra.xml") returned 61 [0104.862] lstrlenW (lpString=".jpg") returned 4 [0104.862] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0104.862] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfra.xml") returned 61 [0104.862] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfra.xml") returned 61 [0104.862] lstrlenW (lpString=".doc") returned 4 [0104.862] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0104.862] lstrlenW (lpString=".docx") returned 5 [0104.862] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0104.862] lstrlenW (lpString=".pdf") returned 4 [0104.862] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0104.862] lstrlenW (lpString=".xls") returned 4 [0104.862] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0104.862] lstrlenW (lpString=".xlsx") returned 5 [0104.862] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0104.862] lstrlenW (lpString=".ppt") returned 4 [0104.862] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0104.862] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfra.xml") returned 61 [0104.863] lstrlenW (lpString=".zip") returned 4 [0104.863] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0104.863] lstrlenW (lpString=".rar") returned 4 [0104.863] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0104.863] lstrlenW (lpString=".bz2") returned 4 [0104.863] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0104.863] lstrlenW (lpString=".7z") returned 3 [0104.863] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0104.863] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfra.xml") returned 61 [0104.863] lstrlenW (lpString=".dbf") returned 4 [0104.863] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0104.863] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfra.xml") returned 61 [0104.863] lstrlenW (lpString=".1cd") returned 4 [0104.863] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0104.863] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfra.xml") returned 61 [0104.863] lstrlenW (lpString=".jpg") returned 4 [0104.863] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0104.863] lstrcmpiW (lpString1=".xml", lpString2=".waifu") returned 1 [0104.863] lstrlenW (lpString="ipshrv.xml") returned 10 [0104.863] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshrv.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0104.863] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x326f8cc | out: lpFileSize=0x326f8cc*=2652) returned 1 [0104.863] CloseHandle (hObject=0x194) returned 1 [0104.863] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshrv.xml")) returned 0x20 [0104.863] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshrv.xml.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0104.863] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshrv.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0104.863] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml") returned 61 [0104.863] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml") returned 61 [0104.863] lstrlenW (lpString=".doc") returned 4 [0104.864] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0104.864] lstrlenW (lpString=".docx") returned 5 [0104.864] lstrcmpiW (lpString1=".docx", lpString2="v.xml") returned -1 [0104.864] lstrlenW (lpString=".pdf") returned 4 [0104.864] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0104.864] lstrlenW (lpString=".xls") returned 4 [0104.864] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0104.864] lstrlenW (lpString=".xlsx") returned 5 [0104.864] lstrcmpiW (lpString1=".xlsx", lpString2="v.xml") returned -1 [0104.864] lstrlenW (lpString=".ppt") returned 4 [0104.864] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0104.864] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml") returned 61 [0104.864] lstrlenW (lpString=".zip") returned 4 [0104.864] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0104.864] lstrlenW (lpString=".rar") returned 4 [0104.864] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0104.864] lstrlenW (lpString=".bz2") returned 4 [0104.864] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0104.864] lstrlenW (lpString=".7z") returned 3 [0104.864] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0104.864] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml") returned 61 [0104.864] lstrlenW (lpString=".dbf") returned 4 [0104.864] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0104.864] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml") returned 61 [0104.864] lstrlenW (lpString=".1cd") returned 4 [0104.864] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0104.864] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml") returned 61 [0104.864] lstrlenW (lpString=".jpg") returned 4 [0104.864] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0104.864] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml") returned 61 [0104.864] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml") returned 61 [0104.864] lstrlenW (lpString=".doc") returned 4 [0104.864] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0104.864] lstrlenW (lpString=".docx") returned 5 [0104.864] lstrcmpiW (lpString1=".docx", lpString2="v.xml") returned -1 [0104.864] lstrlenW (lpString=".pdf") returned 4 [0104.864] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0104.864] lstrlenW (lpString=".xls") returned 4 [0104.864] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0104.864] lstrlenW (lpString=".xlsx") returned 5 [0104.864] lstrcmpiW (lpString1=".xlsx", lpString2="v.xml") returned -1 [0104.864] lstrlenW (lpString=".ppt") returned 4 [0104.864] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0104.864] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml") returned 61 [0104.864] lstrlenW (lpString=".zip") returned 4 [0104.864] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0104.864] lstrlenW (lpString=".rar") returned 4 [0104.864] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0104.864] lstrlenW (lpString=".bz2") returned 4 [0104.864] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0104.865] lstrlenW (lpString=".7z") returned 3 [0104.865] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0104.865] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml") returned 61 [0104.865] lstrlenW (lpString=".dbf") returned 4 [0104.865] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0104.865] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml") returned 61 [0104.865] lstrlenW (lpString=".1cd") returned 4 [0104.865] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0104.865] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml") returned 61 [0104.865] lstrlenW (lpString=".jpg") returned 4 [0104.865] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0104.865] lstrcmpiW (lpString1=".xml", lpString2=".waifu") returned 1 [0104.865] lstrlenW (lpString="ipsita.xml") returned 10 [0104.865] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsita.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0104.865] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x326f8cc | out: lpFileSize=0x326f8cc*=2526) returned 1 [0104.865] CloseHandle (hObject=0x194) returned 1 [0104.865] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsita.xml")) returned 0x20 [0104.865] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsita.xml.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0104.865] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsita.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0104.865] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml") returned 61 [0104.865] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml") returned 61 [0104.865] lstrlenW (lpString=".doc") returned 4 [0104.865] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0104.865] lstrlenW (lpString=".docx") returned 5 [0104.865] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0104.865] lstrlenW (lpString=".pdf") returned 4 [0104.865] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0104.865] lstrlenW (lpString=".xls") returned 4 [0104.865] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0104.866] lstrlenW (lpString=".xlsx") returned 5 [0104.866] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0104.866] lstrlenW (lpString=".ppt") returned 4 [0104.866] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0104.866] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml") returned 61 [0104.866] lstrlenW (lpString=".zip") returned 4 [0104.866] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0104.866] lstrlenW (lpString=".rar") returned 4 [0104.866] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0104.866] lstrlenW (lpString=".bz2") returned 4 [0104.866] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0104.866] lstrlenW (lpString=".7z") returned 3 [0104.866] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0104.866] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml") returned 61 [0104.866] lstrlenW (lpString=".dbf") returned 4 [0104.866] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0104.870] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\ado210.chm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\ado210.chm.id-9c354b42.[darknes@420blaze.it].waifu")) returned 1 [0104.871] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\ado210.chm.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0104.871] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f61c | out: lpNewFilePointer=0x0) returned 1 [0104.871] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f5dc | out: lpNewFilePointer=0x0) returned 1 [0104.871] ReadFile (in: hFile=0x194, lpBuffer=0x3cf0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x326f5e8, lpOverlapped=0x0 | out: lpBuffer=0x3cf0058*, lpNumberOfBytesRead=0x326f5e8*=0x40000, lpOverlapped=0x0) returned 1 [0104.874] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x88bff, lpNewFilePointer=0x0, dwMoveMethod=0x326f5dc | out: lpNewFilePointer=0x0) returned 1 [0104.874] ReadFile (in: hFile=0x194, lpBuffer=0x3d30058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x326f5e8, lpOverlapped=0x0 | out: lpBuffer=0x3d30058*, lpNumberOfBytesRead=0x326f5e8*=0x40000, lpOverlapped=0x0) returned 1 [0104.877] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x326f61c | out: lpNewFilePointer=0xffffffff) returned 1 [0104.877] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x15a3ff, lpNewFilePointer=0x0, dwMoveMethod=0x326f5dc | out: lpNewFilePointer=0x0) returned 1 [0104.877] ReadFile (in: hFile=0x194, lpBuffer=0x3d70058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x326f5e8, lpOverlapped=0x0 | out: lpBuffer=0x3d70058*, lpNumberOfBytesRead=0x326f5e8*=0x40000, lpOverlapped=0x0) returned 1 [0104.892] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0104.892] WriteFile (in: hFile=0x194, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xc0100, lpNumberOfBytesWritten=0x326f660, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f660*=0xc0100, lpOverlapped=0x0) returned 1 [0105.092] SetEndOfFile (hFile=0x194) returned 1 [0105.092] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f62c | out: lpNewFilePointer=0x0) returned 1 [0105.092] WriteFile (in: hFile=0x194, lpBuffer=0x45250c0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x326f638, lpOverlapped=0x0 | out: lpBuffer=0x45250c0*, lpNumberOfBytesWritten=0x326f638*=0x40000, lpOverlapped=0x0) returned 1 [0105.093] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x88bff, lpNewFilePointer=0x0, dwMoveMethod=0x326f62c | out: lpNewFilePointer=0x0) returned 1 [0105.093] WriteFile (in: hFile=0x194, lpBuffer=0x45250c0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x326f638, lpOverlapped=0x0 | out: lpBuffer=0x45250c0*, lpNumberOfBytesWritten=0x326f638*=0x40000, lpOverlapped=0x0) returned 1 [0105.094] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x15a3ff, lpNewFilePointer=0x0, dwMoveMethod=0x326f62c | out: lpNewFilePointer=0x0) returned 1 [0105.094] WriteFile (in: hFile=0x194, lpBuffer=0x45250c0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x326f638, lpOverlapped=0x0 | out: lpBuffer=0x45250c0*, lpNumberOfBytesWritten=0x326f638*=0x40000, lpOverlapped=0x0) returned 1 [0105.095] CloseHandle (hObject=0x194) returned 1 [0105.120] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0105.121] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71 [0105.121] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71 [0105.121] lstrlenW (lpString=".doc") returned 4 [0105.121] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0105.121] lstrlenW (lpString=".docx") returned 5 [0105.121] lstrcmpiW (lpString1=".docx", lpString2="0.CHM") returned -1 [0105.121] lstrlenW (lpString=".pdf") returned 4 [0105.121] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0105.121] lstrlenW (lpString=".xls") returned 4 [0105.121] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0105.121] lstrlenW (lpString=".xlsx") returned 5 [0105.121] lstrcmpiW (lpString1=".xlsx", lpString2="0.CHM") returned -1 [0105.121] lstrlenW (lpString=".ppt") returned 4 [0105.121] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0105.121] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71 [0105.121] lstrlenW (lpString=".zip") returned 4 [0105.121] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0105.121] lstrlenW (lpString=".rar") returned 4 [0105.121] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0105.121] lstrlenW (lpString=".bz2") returned 4 [0105.121] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0105.121] lstrlenW (lpString=".7z") returned 3 [0105.121] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0105.121] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71 [0105.121] lstrlenW (lpString=".dbf") returned 4 [0105.121] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0105.121] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71 [0105.121] lstrlenW (lpString=".1cd") returned 4 [0105.121] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0105.121] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71 [0105.121] lstrlenW (lpString=".jpg") returned 4 [0105.121] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0105.121] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71 [0105.121] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71 [0105.121] lstrlenW (lpString=".doc") returned 4 [0105.121] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0105.121] lstrlenW (lpString=".docx") returned 5 [0105.121] lstrcmpiW (lpString1=".docx", lpString2="0.CHM") returned -1 [0105.121] lstrlenW (lpString=".pdf") returned 4 [0105.121] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0105.121] lstrlenW (lpString=".xls") returned 4 [0105.121] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0105.121] lstrlenW (lpString=".xlsx") returned 5 [0105.121] lstrcmpiW (lpString1=".xlsx", lpString2="0.CHM") returned -1 [0105.121] lstrlenW (lpString=".ppt") returned 4 [0105.121] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0105.121] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71 [0105.121] lstrlenW (lpString=".zip") returned 4 [0105.121] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0105.121] lstrlenW (lpString=".rar") returned 4 [0105.121] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0105.122] lstrlenW (lpString=".bz2") returned 4 [0105.122] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0105.122] lstrlenW (lpString=".7z") returned 3 [0105.122] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0105.122] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71 [0105.122] lstrlenW (lpString=".dbf") returned 4 [0105.122] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0105.122] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71 [0105.122] lstrlenW (lpString=".1cd") returned 4 [0105.122] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0105.122] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71 [0105.122] lstrlenW (lpString=".jpg") returned 4 [0105.122] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0105.122] lstrcmpiW (lpString1=".XML", lpString2=".waifu") returned 1 [0105.122] lstrlenW (lpString="SETUP.XML") returned 9 [0105.122] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0106.098] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x326f8cc | out: lpFileSize=0x326f8cc*=2624) returned 1 [0106.116] CloseHandle (hObject=0x18c) returned 1 [0106.116] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\setup.xml")) returned 0x20 [0106.122] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\setup.xml.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0106.122] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0106.122] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0106.122] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0106.122] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\setup.xml.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0106.123] GetLastError () returned 0x0 [0106.123] ReadFile (in: hFile=0x1ac, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0xa40, lpOverlapped=0x0) returned 1 [0106.126] WriteFile (in: hFile=0x18c, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xa50, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0xa50, lpOverlapped=0x0) returned 1 [0106.126] ReadFile (in: hFile=0x1ac, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0x0, lpOverlapped=0x0) returned 1 [0106.126] WriteFile (in: hFile=0x18c, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0xe6, lpOverlapped=0x0) returned 1 [0106.126] SetEndOfFile (hFile=0x18c) returned 1 [0106.126] CloseHandle (hObject=0x18c) returned 1 [0106.127] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0106.127] SetEndOfFile (hFile=0x1ac) returned 1 [0106.128] CloseHandle (hObject=0x1ac) returned 1 [0106.128] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0106.128] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\setup.xml")) returned 1 [0106.128] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102 [0106.128] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102 [0106.128] lstrlenW (lpString=".doc") returned 4 [0106.128] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0106.128] lstrlenW (lpString=".docx") returned 5 [0106.128] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0106.128] lstrlenW (lpString=".pdf") returned 4 [0106.128] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0106.128] lstrlenW (lpString=".xls") returned 4 [0106.128] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0106.128] lstrlenW (lpString=".xlsx") returned 5 [0106.128] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0106.128] lstrlenW (lpString=".ppt") returned 4 [0106.128] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0106.128] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102 [0106.128] lstrlenW (lpString=".zip") returned 4 [0106.128] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0106.128] lstrlenW (lpString=".rar") returned 4 [0106.128] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0106.128] lstrlenW (lpString=".bz2") returned 4 [0106.128] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0106.128] lstrlenW (lpString=".7z") returned 3 [0106.128] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0106.128] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102 [0106.128] lstrlenW (lpString=".dbf") returned 4 [0106.128] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0106.128] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102 [0106.129] lstrlenW (lpString=".1cd") returned 4 [0106.129] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0106.129] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102 [0106.129] lstrlenW (lpString=".jpg") returned 4 [0106.129] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0106.129] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102 [0106.129] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102 [0106.129] lstrlenW (lpString=".doc") returned 4 [0106.129] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0106.129] lstrlenW (lpString=".docx") returned 5 [0106.129] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0106.129] lstrlenW (lpString=".pdf") returned 4 [0106.129] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0106.129] lstrlenW (lpString=".xls") returned 4 [0106.129] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0106.129] lstrlenW (lpString=".xlsx") returned 5 [0106.129] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0106.129] lstrlenW (lpString=".ppt") returned 4 [0106.129] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0106.129] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102 [0106.129] lstrlenW (lpString=".zip") returned 4 [0106.129] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0106.129] lstrlenW (lpString=".rar") returned 4 [0106.129] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0106.129] lstrlenW (lpString=".bz2") returned 4 [0106.129] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0106.129] lstrlenW (lpString=".7z") returned 3 [0106.129] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0106.129] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102 [0106.129] lstrlenW (lpString=".dbf") returned 4 [0106.129] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0106.129] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102 [0106.129] lstrlenW (lpString=".1cd") returned 4 [0106.129] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0106.129] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102 [0106.129] lstrlenW (lpString=".jpg") returned 4 [0106.129] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0106.129] lstrcmpiW (lpString1=".XML", lpString2=".waifu") returned 1 [0106.129] lstrlenW (lpString="OutlookMUI.XML") returned 14 [0106.129] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\outlookmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0106.130] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x326f8cc | out: lpFileSize=0x326f8cc*=3186) returned 1 [0106.130] CloseHandle (hObject=0x1ac) returned 1 [0106.130] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\outlookmui.xml")) returned 0x20 [0106.130] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\outlookmui.xml.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0106.130] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\outlookmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0106.130] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0106.130] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0106.130] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\outlookmui.xml.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0106.131] GetLastError () returned 0x0 [0106.131] ReadFile (in: hFile=0x1ac, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0xc72, lpOverlapped=0x0) returned 1 [0106.132] WriteFile (in: hFile=0x18c, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xc80, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0xc80, lpOverlapped=0x0) returned 1 [0106.133] ReadFile (in: hFile=0x1ac, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0x0, lpOverlapped=0x0) returned 1 [0106.133] WriteFile (in: hFile=0x18c, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0xf0, lpOverlapped=0x0) returned 1 [0106.133] SetEndOfFile (hFile=0x18c) returned 1 [0106.133] CloseHandle (hObject=0x18c) returned 1 [0106.133] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0106.133] SetEndOfFile (hFile=0x1ac) returned 1 [0106.134] CloseHandle (hObject=0x1ac) returned 1 [0106.134] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0106.134] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\outlookmui.xml")) returned 1 [0106.134] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0106.134] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0106.134] lstrlenW (lpString=".doc") returned 4 [0106.134] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0106.135] lstrlenW (lpString=".docx") returned 5 [0106.135] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0106.135] lstrlenW (lpString=".pdf") returned 4 [0106.135] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0106.135] lstrlenW (lpString=".xls") returned 4 [0106.135] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0106.135] lstrlenW (lpString=".xlsx") returned 5 [0106.135] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0106.135] lstrlenW (lpString=".ppt") returned 4 [0106.135] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0106.135] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0106.135] lstrlenW (lpString=".zip") returned 4 [0106.135] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0106.135] lstrlenW (lpString=".rar") returned 4 [0106.135] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0106.135] lstrlenW (lpString=".bz2") returned 4 [0106.135] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0106.135] lstrlenW (lpString=".7z") returned 3 [0106.135] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0106.135] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0106.135] lstrlenW (lpString=".dbf") returned 4 [0106.135] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0106.135] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0106.135] lstrlenW (lpString=".1cd") returned 4 [0106.135] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0106.135] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0106.135] lstrlenW (lpString=".jpg") returned 4 [0106.135] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0106.135] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0106.135] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0106.135] lstrlenW (lpString=".doc") returned 4 [0106.135] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0106.135] lstrlenW (lpString=".docx") returned 5 [0106.135] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0106.135] lstrlenW (lpString=".pdf") returned 4 [0106.135] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0106.135] lstrlenW (lpString=".xls") returned 4 [0106.135] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0106.135] lstrlenW (lpString=".xlsx") returned 5 [0106.135] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0106.135] lstrlenW (lpString=".ppt") returned 4 [0106.135] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0106.135] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0106.135] lstrlenW (lpString=".zip") returned 4 [0106.135] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0106.135] lstrlenW (lpString=".rar") returned 4 [0106.135] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0106.136] lstrlenW (lpString=".bz2") returned 4 [0106.136] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0106.136] lstrlenW (lpString=".7z") returned 3 [0106.136] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0106.136] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0106.136] lstrlenW (lpString=".dbf") returned 4 [0106.136] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0106.136] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0106.136] lstrlenW (lpString=".1cd") returned 4 [0106.136] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0106.136] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0106.136] lstrlenW (lpString=".jpg") returned 4 [0106.136] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0106.136] lstrcmpiW (lpString1=".XML", lpString2=".waifu") returned 1 [0106.136] lstrlenW (lpString="SETUP.XML") returned 9 [0106.136] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0106.137] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x326f8cc | out: lpFileSize=0x326f8cc*=4207) returned 1 [0106.137] CloseHandle (hObject=0x18c) returned 1 [0106.137] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\setup.xml")) returned 0x20 [0106.137] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\setup.xml.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0106.138] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0106.138] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0106.138] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0106.138] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\setup.xml.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0106.138] GetLastError () returned 0x0 [0106.138] ReadFile (in: hFile=0x18c, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0x106f, lpOverlapped=0x0) returned 1 [0106.141] WriteFile (in: hFile=0x1c0, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0x1070, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0x1070, lpOverlapped=0x0) returned 1 [0106.141] ReadFile (in: hFile=0x18c, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0x0, lpOverlapped=0x0) returned 1 [0106.141] WriteFile (in: hFile=0x1c0, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0xe6, lpOverlapped=0x0) returned 1 [0106.141] SetEndOfFile (hFile=0x1c0) returned 1 [0106.141] CloseHandle (hObject=0x1c0) returned 1 [0106.142] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0106.142] SetEndOfFile (hFile=0x18c) returned 1 [0106.143] CloseHandle (hObject=0x18c) returned 1 [0106.143] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0106.143] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\setup.xml")) returned 1 [0106.143] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0106.143] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0106.143] lstrlenW (lpString=".doc") returned 4 [0106.143] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0106.143] lstrlenW (lpString=".docx") returned 5 [0106.143] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0106.143] lstrlenW (lpString=".pdf") returned 4 [0106.143] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0106.143] lstrlenW (lpString=".xls") returned 4 [0106.143] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0106.143] lstrlenW (lpString=".xlsx") returned 5 [0106.143] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0106.143] lstrlenW (lpString=".ppt") returned 4 [0106.143] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0106.143] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0106.143] lstrlenW (lpString=".zip") returned 4 [0106.143] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0106.143] lstrlenW (lpString=".rar") returned 4 [0106.143] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0106.143] lstrlenW (lpString=".bz2") returned 4 [0106.143] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0106.144] lstrlenW (lpString=".7z") returned 3 [0106.144] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0106.144] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0106.144] lstrlenW (lpString=".dbf") returned 4 [0106.144] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0106.144] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0106.144] lstrlenW (lpString=".1cd") returned 4 [0106.144] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0106.144] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0106.144] lstrlenW (lpString=".jpg") returned 4 [0106.144] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0106.144] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0106.144] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0106.144] lstrlenW (lpString=".doc") returned 4 [0106.144] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0106.144] lstrlenW (lpString=".docx") returned 5 [0106.144] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0106.144] lstrlenW (lpString=".pdf") returned 4 [0106.144] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0106.144] lstrlenW (lpString=".xls") returned 4 [0106.144] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0106.144] lstrlenW (lpString=".xlsx") returned 5 [0106.144] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0106.144] lstrlenW (lpString=".ppt") returned 4 [0106.144] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0106.144] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0106.144] lstrlenW (lpString=".zip") returned 4 [0106.144] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0106.144] lstrlenW (lpString=".rar") returned 4 [0106.144] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0106.144] lstrlenW (lpString=".bz2") returned 4 [0106.144] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0106.144] lstrlenW (lpString=".7z") returned 3 [0106.144] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0106.144] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0106.144] lstrlenW (lpString=".dbf") returned 4 [0106.144] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0106.144] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0106.144] lstrlenW (lpString=".1cd") returned 4 [0106.144] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0106.144] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0106.144] lstrlenW (lpString=".jpg") returned 4 [0106.144] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0106.144] lstrcmpiW (lpString1=".XML", lpString2=".waifu") returned 1 [0106.145] lstrlenW (lpString="PowerPointMUI.XML") returned 17 [0106.145] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\powerpointmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0106.145] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x326f8cc | out: lpFileSize=0x326f8cc*=1450) returned 1 [0106.145] CloseHandle (hObject=0x18c) returned 1 [0106.145] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\powerpointmui.xml")) returned 0x20 [0106.145] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\powerpointmui.xml.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0106.145] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\powerpointmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0106.145] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0106.145] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0106.145] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\powerpointmui.xml.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0106.149] GetLastError () returned 0x0 [0106.149] ReadFile (in: hFile=0x18c, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0x5aa, lpOverlapped=0x0) returned 1 [0106.192] WriteFile (in: hFile=0x1c0, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0x5b0, lpOverlapped=0x0) returned 1 [0106.193] ReadFile (in: hFile=0x18c, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0x0, lpOverlapped=0x0) returned 1 [0106.193] WriteFile (in: hFile=0x1c0, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0xf6, lpOverlapped=0x0) returned 1 [0106.193] SetEndOfFile (hFile=0x1c0) returned 1 [0106.193] CloseHandle (hObject=0x1c0) returned 1 [0106.194] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0106.194] SetEndOfFile (hFile=0x18c) returned 1 [0106.194] CloseHandle (hObject=0x18c) returned 1 [0106.194] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0106.194] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\powerpointmui.xml")) returned 1 [0106.195] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0106.195] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0106.195] lstrlenW (lpString=".doc") returned 4 [0106.195] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0106.195] lstrlenW (lpString=".docx") returned 5 [0106.195] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0106.195] lstrlenW (lpString=".pdf") returned 4 [0106.195] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0106.195] lstrlenW (lpString=".xls") returned 4 [0106.195] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0106.195] lstrlenW (lpString=".xlsx") returned 5 [0106.195] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0106.195] lstrlenW (lpString=".ppt") returned 4 [0106.195] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0106.195] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0106.195] lstrlenW (lpString=".zip") returned 4 [0106.195] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0106.195] lstrlenW (lpString=".rar") returned 4 [0106.195] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0106.195] lstrlenW (lpString=".bz2") returned 4 [0106.195] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0106.195] lstrlenW (lpString=".7z") returned 3 [0106.195] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0106.195] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0106.195] lstrlenW (lpString=".dbf") returned 4 [0106.195] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0106.195] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0106.195] lstrlenW (lpString=".1cd") returned 4 [0106.195] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0106.195] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0106.195] lstrlenW (lpString=".jpg") returned 4 [0106.195] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0106.195] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0106.195] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0106.195] lstrlenW (lpString=".doc") returned 4 [0106.195] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0106.195] lstrlenW (lpString=".docx") returned 5 [0106.195] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0106.195] lstrlenW (lpString=".pdf") returned 4 [0106.195] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0106.195] lstrlenW (lpString=".xls") returned 4 [0106.195] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0106.195] lstrlenW (lpString=".xlsx") returned 5 [0106.195] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0106.195] lstrlenW (lpString=".ppt") returned 4 [0106.195] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0106.196] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0106.196] lstrlenW (lpString=".zip") returned 4 [0106.196] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0106.196] lstrlenW (lpString=".rar") returned 4 [0106.196] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0106.196] lstrlenW (lpString=".bz2") returned 4 [0106.196] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0106.196] lstrlenW (lpString=".7z") returned 3 [0106.196] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0106.196] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0106.196] lstrlenW (lpString=".dbf") returned 4 [0106.196] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0106.196] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0106.196] lstrlenW (lpString=".1cd") returned 4 [0106.196] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0106.196] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0106.196] lstrlenW (lpString=".jpg") returned 4 [0106.196] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0106.196] lstrcmpiW (lpString1=".XML", lpString2=".waifu") returned 1 [0106.196] lstrlenW (lpString="SETUP.XML") returned 9 [0106.196] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0106.197] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x326f8cc | out: lpFileSize=0x326f8cc*=1886) returned 1 [0106.197] CloseHandle (hObject=0x18c) returned 1 [0106.197] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\setup.xml")) returned 0x20 [0106.197] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\setup.xml.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0106.197] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0106.197] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0106.197] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0106.197] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\setup.xml.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0106.197] GetLastError () returned 0x0 [0106.197] ReadFile (in: hFile=0x18c, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0x75e, lpOverlapped=0x0) returned 1 [0106.198] WriteFile (in: hFile=0x1c0, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0x760, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0x760, lpOverlapped=0x0) returned 1 [0106.199] ReadFile (in: hFile=0x18c, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0x0, lpOverlapped=0x0) returned 1 [0106.199] WriteFile (in: hFile=0x1c0, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0xe6, lpOverlapped=0x0) returned 1 [0106.199] SetEndOfFile (hFile=0x1c0) returned 1 [0106.199] CloseHandle (hObject=0x1c0) returned 1 [0106.199] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0106.199] SetEndOfFile (hFile=0x18c) returned 1 [0106.200] CloseHandle (hObject=0x18c) returned 1 [0106.200] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0106.200] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\setup.xml")) returned 1 [0106.200] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0106.200] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0106.200] lstrlenW (lpString=".doc") returned 4 [0106.200] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0106.200] lstrlenW (lpString=".docx") returned 5 [0106.200] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0106.200] lstrlenW (lpString=".pdf") returned 4 [0106.200] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0106.200] lstrlenW (lpString=".xls") returned 4 [0106.200] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0106.200] lstrlenW (lpString=".xlsx") returned 5 [0106.201] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0106.201] lstrlenW (lpString=".ppt") returned 4 [0106.201] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0106.201] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0106.201] lstrlenW (lpString=".zip") returned 4 [0106.201] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0106.201] lstrlenW (lpString=".rar") returned 4 [0106.201] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0106.201] lstrlenW (lpString=".bz2") returned 4 [0106.201] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0106.201] lstrlenW (lpString=".7z") returned 3 [0106.201] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0106.201] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0106.201] lstrlenW (lpString=".dbf") returned 4 [0106.201] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0106.201] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0106.201] lstrlenW (lpString=".1cd") returned 4 [0106.201] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0106.201] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0106.201] lstrlenW (lpString=".jpg") returned 4 [0106.201] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0106.201] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0106.201] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0106.201] lstrlenW (lpString=".doc") returned 4 [0106.201] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0106.201] lstrlenW (lpString=".docx") returned 5 [0106.201] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0106.201] lstrlenW (lpString=".pdf") returned 4 [0106.201] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0106.201] lstrlenW (lpString=".xls") returned 4 [0106.201] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0106.201] lstrlenW (lpString=".xlsx") returned 5 [0106.201] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0106.201] lstrlenW (lpString=".ppt") returned 4 [0106.201] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0106.201] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0106.201] lstrlenW (lpString=".zip") returned 4 [0106.201] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0106.201] lstrlenW (lpString=".rar") returned 4 [0106.201] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0106.201] lstrlenW (lpString=".bz2") returned 4 [0106.201] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0106.201] lstrlenW (lpString=".7z") returned 3 [0106.201] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0106.201] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0106.201] lstrlenW (lpString=".dbf") returned 4 [0106.201] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0106.201] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0106.201] lstrlenW (lpString=".1cd") returned 4 [0106.201] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0106.202] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0106.202] lstrlenW (lpString=".jpg") returned 4 [0106.202] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0106.202] lstrcmpiW (lpString1=".XML", lpString2=".waifu") returned 1 [0106.202] lstrlenW (lpString="PrjProrWW.XML") returned 13 [0106.202] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\prjprorww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0106.202] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x326f8cc | out: lpFileSize=0x326f8cc*=6421) returned 1 [0106.202] CloseHandle (hObject=0x18c) returned 1 [0106.202] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\prjprorww.xml")) returned 0x20 [0106.202] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\prjprorww.xml.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0106.203] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\prjprorww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0106.203] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0106.203] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0106.203] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\prjprorww.xml.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0106.203] GetLastError () returned 0x0 [0106.203] ReadFile (in: hFile=0x18c, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0x1915, lpOverlapped=0x0) returned 1 [0106.492] WriteFile (in: hFile=0x1c0, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0x1920, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0x1920, lpOverlapped=0x0) returned 1 [0106.493] ReadFile (in: hFile=0x18c, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0x0, lpOverlapped=0x0) returned 1 [0106.493] WriteFile (in: hFile=0x1c0, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0xee, lpOverlapped=0x0) returned 1 [0106.493] SetEndOfFile (hFile=0x1c0) returned 1 [0106.493] CloseHandle (hObject=0x1c0) returned 1 [0106.494] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0106.494] SetEndOfFile (hFile=0x18c) returned 1 [0106.494] CloseHandle (hObject=0x18c) returned 1 [0106.494] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0106.494] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\prjprorww.xml")) returned 1 [0106.494] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101 [0106.494] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101 [0106.494] lstrlenW (lpString=".doc") returned 4 [0106.494] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0106.494] lstrlenW (lpString=".docx") returned 5 [0106.494] lstrcmpiW (lpString1=".docx", lpString2="W.XML") returned -1 [0106.494] lstrlenW (lpString=".pdf") returned 4 [0106.494] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0106.494] lstrlenW (lpString=".xls") returned 4 [0106.494] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0106.495] lstrlenW (lpString=".xlsx") returned 5 [0106.495] lstrcmpiW (lpString1=".xlsx", lpString2="W.XML") returned -1 [0106.495] lstrlenW (lpString=".ppt") returned 4 [0106.495] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0106.495] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101 [0106.495] lstrlenW (lpString=".zip") returned 4 [0106.495] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0106.495] lstrlenW (lpString=".rar") returned 4 [0106.495] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0106.495] lstrlenW (lpString=".bz2") returned 4 [0106.495] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0106.495] lstrlenW (lpString=".7z") returned 3 [0106.495] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0106.495] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101 [0106.495] lstrlenW (lpString=".dbf") returned 4 [0106.495] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0106.495] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101 [0106.495] lstrlenW (lpString=".1cd") returned 4 [0106.495] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0106.495] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101 [0106.495] lstrlenW (lpString=".jpg") returned 4 [0106.495] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0106.495] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101 [0106.495] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101 [0106.495] lstrlenW (lpString=".doc") returned 4 [0106.495] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0106.495] lstrlenW (lpString=".docx") returned 5 [0106.495] lstrcmpiW (lpString1=".docx", lpString2="W.XML") returned -1 [0106.495] lstrlenW (lpString=".pdf") returned 4 [0106.495] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0106.495] lstrlenW (lpString=".xls") returned 4 [0106.495] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0106.495] lstrlenW (lpString=".xlsx") returned 5 [0106.495] lstrcmpiW (lpString1=".xlsx", lpString2="W.XML") returned -1 [0106.495] lstrlenW (lpString=".ppt") returned 4 [0106.495] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0106.495] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101 [0106.495] lstrlenW (lpString=".zip") returned 4 [0106.495] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0106.495] lstrlenW (lpString=".rar") returned 4 [0106.495] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0106.495] lstrlenW (lpString=".bz2") returned 4 [0106.495] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0106.495] lstrlenW (lpString=".7z") returned 3 [0106.495] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0106.495] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101 [0106.495] lstrlenW (lpString=".dbf") returned 4 [0106.495] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0106.495] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101 [0106.495] lstrlenW (lpString=".1cd") returned 4 [0106.495] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0106.495] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101 [0106.496] lstrlenW (lpString=".jpg") returned 4 [0106.496] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0106.496] lstrcmpiW (lpString1=".XML", lpString2=".waifu") returned 1 [0106.496] lstrlenW (lpString="SETUP.XML") returned 9 [0106.496] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0106.496] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x326f8cc | out: lpFileSize=0x326f8cc*=16683) returned 1 [0106.496] CloseHandle (hObject=0x194) returned 1 [0106.496] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\setup.xml")) returned 0x20 [0106.497] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\setup.xml.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0106.497] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0106.497] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0106.497] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0106.497] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\setup.xml.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0106.498] GetLastError () returned 0x0 [0106.498] ReadFile (in: hFile=0x194, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0x412b, lpOverlapped=0x0) returned 1 [0106.499] WriteFile (in: hFile=0x1c0, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0x4130, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0x4130, lpOverlapped=0x0) returned 1 [0106.499] ReadFile (in: hFile=0x194, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0x0, lpOverlapped=0x0) returned 1 [0106.500] WriteFile (in: hFile=0x1c0, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0xe6, lpOverlapped=0x0) returned 1 [0106.500] SetEndOfFile (hFile=0x1c0) returned 1 [0106.500] CloseHandle (hObject=0x1c0) returned 1 [0106.500] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0106.500] SetEndOfFile (hFile=0x194) returned 1 [0106.501] CloseHandle (hObject=0x194) returned 1 [0106.501] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0106.501] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\setup.xml")) returned 1 [0106.501] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0106.501] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0106.501] lstrlenW (lpString=".doc") returned 4 [0106.501] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0106.501] lstrlenW (lpString=".docx") returned 5 [0106.501] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0106.501] lstrlenW (lpString=".pdf") returned 4 [0106.501] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0106.501] lstrlenW (lpString=".xls") returned 4 [0106.501] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0106.502] lstrlenW (lpString=".xlsx") returned 5 [0106.502] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0106.502] lstrlenW (lpString=".ppt") returned 4 [0106.502] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0106.502] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0106.502] lstrlenW (lpString=".zip") returned 4 [0106.502] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0106.502] lstrlenW (lpString=".rar") returned 4 [0106.502] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0106.502] lstrlenW (lpString=".bz2") returned 4 [0106.502] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0106.502] lstrlenW (lpString=".7z") returned 3 [0106.502] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0106.502] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0106.502] lstrlenW (lpString=".dbf") returned 4 [0106.502] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0106.502] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0106.502] lstrlenW (lpString=".1cd") returned 4 [0106.502] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0106.502] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0106.502] lstrlenW (lpString=".jpg") returned 4 [0106.502] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0106.502] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0106.502] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0106.502] lstrlenW (lpString=".doc") returned 4 [0106.502] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0106.502] lstrlenW (lpString=".docx") returned 5 [0106.502] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0106.502] lstrlenW (lpString=".pdf") returned 4 [0106.502] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0106.502] lstrlenW (lpString=".xls") returned 4 [0106.502] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0106.502] lstrlenW (lpString=".xlsx") returned 5 [0106.502] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0106.502] lstrlenW (lpString=".ppt") returned 4 [0106.502] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0106.502] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0106.502] lstrlenW (lpString=".zip") returned 4 [0106.502] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0106.502] lstrlenW (lpString=".rar") returned 4 [0106.502] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0106.502] lstrlenW (lpString=".bz2") returned 4 [0106.502] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0106.502] lstrlenW (lpString=".7z") returned 3 [0106.502] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0106.502] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0106.502] lstrlenW (lpString=".dbf") returned 4 [0106.502] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0106.502] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0106.502] lstrlenW (lpString=".1cd") returned 4 [0106.502] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0106.502] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0106.503] lstrlenW (lpString=".jpg") returned 4 [0106.503] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0106.503] lstrcmpiW (lpString1=".XML", lpString2=".waifu") returned 1 [0106.503] lstrlenW (lpString="ProjectMUI.XML") returned 14 [0106.503] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\projectmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0106.503] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x326f8cc | out: lpFileSize=0x326f8cc*=1452) returned 1 [0106.503] CloseHandle (hObject=0x194) returned 1 [0106.503] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\projectmui.xml")) returned 0x20 [0106.503] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\projectmui.xml.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0106.503] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\projectmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0106.503] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0106.503] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0106.503] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\projectmui.xml.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0106.504] GetLastError () returned 0x0 [0106.504] ReadFile (in: hFile=0x194, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0x5ac, lpOverlapped=0x0) returned 1 [0106.505] WriteFile (in: hFile=0x1c0, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0x5b0, lpOverlapped=0x0) returned 1 [0106.506] ReadFile (in: hFile=0x194, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0x0, lpOverlapped=0x0) returned 1 [0106.506] WriteFile (in: hFile=0x1c0, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0xf0, lpOverlapped=0x0) returned 1 [0106.506] SetEndOfFile (hFile=0x1c0) returned 1 [0106.506] CloseHandle (hObject=0x1c0) returned 1 [0106.507] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0106.507] SetEndOfFile (hFile=0x194) returned 1 [0106.507] CloseHandle (hObject=0x194) returned 1 [0106.508] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0106.508] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\projectmui.xml")) returned 1 [0106.508] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108 [0106.508] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108 [0106.508] lstrlenW (lpString=".doc") returned 4 [0106.508] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0106.508] lstrlenW (lpString=".docx") returned 5 [0106.508] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0106.508] lstrlenW (lpString=".pdf") returned 4 [0106.508] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0106.508] lstrlenW (lpString=".xls") returned 4 [0106.508] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0106.508] lstrlenW (lpString=".xlsx") returned 5 [0106.508] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0106.508] lstrlenW (lpString=".ppt") returned 4 [0106.508] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0106.508] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108 [0106.508] lstrlenW (lpString=".zip") returned 4 [0106.508] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0106.508] lstrlenW (lpString=".rar") returned 4 [0106.508] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0106.508] lstrlenW (lpString=".bz2") returned 4 [0106.508] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0106.508] lstrlenW (lpString=".7z") returned 3 [0106.508] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0106.508] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108 [0106.508] lstrlenW (lpString=".dbf") returned 4 [0106.508] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0106.508] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108 [0106.508] lstrlenW (lpString=".1cd") returned 4 [0106.508] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0106.508] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108 [0106.508] lstrlenW (lpString=".jpg") returned 4 [0106.508] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0106.509] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108 [0106.509] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108 [0106.509] lstrlenW (lpString=".doc") returned 4 [0106.509] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0106.509] lstrlenW (lpString=".docx") returned 5 [0106.509] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0106.509] lstrlenW (lpString=".pdf") returned 4 [0106.509] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0106.509] lstrlenW (lpString=".xls") returned 4 [0106.509] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0106.509] lstrlenW (lpString=".xlsx") returned 5 [0106.509] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0106.509] lstrlenW (lpString=".ppt") returned 4 [0106.509] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0106.509] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108 [0106.509] lstrlenW (lpString=".zip") returned 4 [0106.509] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0106.509] lstrlenW (lpString=".rar") returned 4 [0106.509] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0106.509] lstrlenW (lpString=".bz2") returned 4 [0106.509] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0106.509] lstrlenW (lpString=".7z") returned 3 [0106.509] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0106.509] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108 [0106.509] lstrlenW (lpString=".dbf") returned 4 [0106.509] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0106.509] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108 [0106.509] lstrlenW (lpString=".1cd") returned 4 [0106.509] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0106.509] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108 [0106.509] lstrlenW (lpString=".jpg") returned 4 [0106.509] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0106.509] lstrcmpiW (lpString1=".XML", lpString2=".waifu") returned 1 [0106.509] lstrlenW (lpString="SETUP.XML") returned 9 [0106.509] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0106.510] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x326f8cc | out: lpFileSize=0x326f8cc*=1872) returned 1 [0106.510] CloseHandle (hObject=0x194) returned 1 [0106.510] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\setup.xml")) returned 0x20 [0106.510] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\setup.xml.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0106.510] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0106.510] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0106.510] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0106.510] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\setup.xml.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0106.510] GetLastError () returned 0x0 [0106.511] ReadFile (in: hFile=0x194, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0x750, lpOverlapped=0x0) returned 1 [0106.511] WriteFile (in: hFile=0x1c0, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0x760, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0x760, lpOverlapped=0x0) returned 1 [0106.512] ReadFile (in: hFile=0x194, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0x0, lpOverlapped=0x0) returned 1 [0106.512] WriteFile (in: hFile=0x1c0, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0xe6, lpOverlapped=0x0) returned 1 [0106.512] SetEndOfFile (hFile=0x1c0) returned 1 [0106.512] CloseHandle (hObject=0x1c0) returned 1 [0106.513] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0106.513] SetEndOfFile (hFile=0x194) returned 1 [0106.513] CloseHandle (hObject=0x194) returned 1 [0106.513] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0106.513] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\setup.xml")) returned 1 [0106.514] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103 [0106.514] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103 [0106.514] lstrlenW (lpString=".doc") returned 4 [0106.514] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0106.514] lstrlenW (lpString=".docx") returned 5 [0106.514] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0106.514] lstrlenW (lpString=".pdf") returned 4 [0106.514] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0106.514] lstrlenW (lpString=".xls") returned 4 [0106.514] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0106.514] lstrlenW (lpString=".xlsx") returned 5 [0106.514] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0106.514] lstrlenW (lpString=".ppt") returned 4 [0106.514] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0106.514] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103 [0106.514] lstrlenW (lpString=".zip") returned 4 [0106.514] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0106.514] lstrlenW (lpString=".rar") returned 4 [0106.514] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0106.514] lstrlenW (lpString=".bz2") returned 4 [0106.514] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0106.514] lstrlenW (lpString=".7z") returned 3 [0106.514] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0106.514] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103 [0106.514] lstrlenW (lpString=".dbf") returned 4 [0106.514] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0106.514] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103 [0106.514] lstrlenW (lpString=".1cd") returned 4 [0106.514] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0106.514] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103 [0106.514] lstrlenW (lpString=".jpg") returned 4 [0106.514] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0106.514] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103 [0106.514] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103 [0106.514] lstrlenW (lpString=".doc") returned 4 [0106.514] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0106.514] lstrlenW (lpString=".docx") returned 5 [0106.514] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0106.514] lstrlenW (lpString=".pdf") returned 4 [0106.514] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0106.514] lstrlenW (lpString=".xls") returned 4 [0106.514] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0106.514] lstrlenW (lpString=".xlsx") returned 5 [0106.514] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0106.514] lstrlenW (lpString=".ppt") returned 4 [0106.514] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0106.514] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103 [0106.514] lstrlenW (lpString=".zip") returned 4 [0106.514] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0106.515] lstrlenW (lpString=".rar") returned 4 [0106.515] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0106.515] lstrlenW (lpString=".bz2") returned 4 [0106.515] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0106.515] lstrlenW (lpString=".7z") returned 3 [0106.515] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0106.515] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103 [0106.515] lstrlenW (lpString=".dbf") returned 4 [0106.515] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0106.515] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103 [0106.515] lstrlenW (lpString=".1cd") returned 4 [0106.515] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0106.515] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103 [0106.515] lstrlenW (lpString=".jpg") returned 4 [0106.515] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0106.515] lstrcmpiW (lpString1=".XML", lpString2=".waifu") returned 1 [0106.515] lstrlenW (lpString="Proof.XML") returned 9 [0106.515] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.en\\proof.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0106.515] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x326f8cc | out: lpFileSize=0x326f8cc*=1347) returned 1 [0106.515] CloseHandle (hObject=0x194) returned 1 [0106.515] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.en\\proof.xml")) returned 0x20 [0106.515] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.en\\proof.xml.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0106.515] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.en\\proof.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0106.515] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0106.515] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0106.516] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.en\\proof.xml.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0106.516] GetLastError () returned 0x0 [0106.516] ReadFile (in: hFile=0x194, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0x543, lpOverlapped=0x0) returned 1 [0106.517] WriteFile (in: hFile=0x1c0, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0x550, lpOverlapped=0x0) returned 1 [0106.517] ReadFile (in: hFile=0x194, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0x0, lpOverlapped=0x0) returned 1 [0106.517] WriteFile (in: hFile=0x1c0, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0xe6, lpOverlapped=0x0) returned 1 [0106.517] SetEndOfFile (hFile=0x1c0) returned 1 [0106.517] CloseHandle (hObject=0x1c0) returned 1 [0106.518] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0106.518] SetEndOfFile (hFile=0x194) returned 1 [0106.518] CloseHandle (hObject=0x194) returned 1 [0106.519] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0106.519] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.en\\proof.xml")) returned 1 [0106.519] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98 [0106.519] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98 [0106.519] lstrlenW (lpString=".doc") returned 4 [0106.519] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0106.519] lstrlenW (lpString=".docx") returned 5 [0106.519] lstrcmpiW (lpString1=".docx", lpString2="f.XML") returned -1 [0106.519] lstrlenW (lpString=".pdf") returned 4 [0106.519] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0106.519] lstrlenW (lpString=".xls") returned 4 [0106.519] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0106.519] lstrlenW (lpString=".xlsx") returned 5 [0106.519] lstrcmpiW (lpString1=".xlsx", lpString2="f.XML") returned -1 [0106.519] lstrlenW (lpString=".ppt") returned 4 [0106.519] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0106.519] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98 [0106.519] lstrlenW (lpString=".zip") returned 4 [0106.519] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0106.519] lstrlenW (lpString=".rar") returned 4 [0106.519] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0106.519] lstrlenW (lpString=".bz2") returned 4 [0106.519] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0106.519] lstrlenW (lpString=".7z") returned 3 [0106.519] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0106.519] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98 [0106.519] lstrlenW (lpString=".dbf") returned 4 [0106.519] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0106.519] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98 [0106.520] lstrlenW (lpString=".1cd") returned 4 [0106.520] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0106.520] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98 [0106.520] lstrlenW (lpString=".jpg") returned 4 [0106.520] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0106.520] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98 [0106.520] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98 [0106.520] lstrlenW (lpString=".doc") returned 4 [0106.520] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0106.520] lstrlenW (lpString=".docx") returned 5 [0106.520] lstrcmpiW (lpString1=".docx", lpString2="f.XML") returned -1 [0106.520] lstrlenW (lpString=".pdf") returned 4 [0106.520] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0106.520] lstrlenW (lpString=".xls") returned 4 [0106.520] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0106.520] lstrlenW (lpString=".xlsx") returned 5 [0106.520] lstrcmpiW (lpString1=".xlsx", lpString2="f.XML") returned -1 [0106.520] lstrlenW (lpString=".ppt") returned 4 [0106.520] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0106.520] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98 [0106.520] lstrlenW (lpString=".zip") returned 4 [0106.520] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0106.520] lstrlenW (lpString=".rar") returned 4 [0106.520] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0106.520] lstrlenW (lpString=".bz2") returned 4 [0106.520] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0106.520] lstrlenW (lpString=".7z") returned 3 [0106.520] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0106.520] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98 [0106.520] lstrlenW (lpString=".dbf") returned 4 [0106.520] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0106.520] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98 [0106.520] lstrlenW (lpString=".1cd") returned 4 [0106.520] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0106.520] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98 [0106.520] lstrlenW (lpString=".jpg") returned 4 [0106.520] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0106.520] lstrcmpiW (lpString1=".XML", lpString2=".waifu") returned 1 [0106.520] lstrlenW (lpString="Proof.XML") returned 9 [0106.520] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.es\\proof.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0106.521] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x326f8cc | out: lpFileSize=0x326f8cc*=1457) returned 1 [0106.521] CloseHandle (hObject=0x194) returned 1 [0106.521] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.es\\proof.xml")) returned 0x20 [0106.521] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.es\\proof.xml.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0106.521] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.es\\proof.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0106.521] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0106.521] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0106.521] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.es\\proof.xml.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0106.522] GetLastError () returned 0x0 [0106.522] ReadFile (in: hFile=0x194, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0x5b1, lpOverlapped=0x0) returned 1 [0106.522] WriteFile (in: hFile=0x1c0, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0x5c0, lpOverlapped=0x0) returned 1 [0106.523] ReadFile (in: hFile=0x194, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0x0, lpOverlapped=0x0) returned 1 [0106.523] WriteFile (in: hFile=0x1c0, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0xe6, lpOverlapped=0x0) returned 1 [0106.523] SetEndOfFile (hFile=0x1c0) returned 1 [0106.523] CloseHandle (hObject=0x1c0) returned 1 [0106.524] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0106.524] SetEndOfFile (hFile=0x194) returned 1 [0106.524] CloseHandle (hObject=0x194) returned 1 [0106.524] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0106.524] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.es\\proof.xml")) returned 1 [0106.525] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98 [0106.525] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98 [0106.525] lstrlenW (lpString=".doc") returned 4 [0106.525] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0106.525] lstrlenW (lpString=".docx") returned 5 [0106.525] lstrcmpiW (lpString1=".docx", lpString2="f.XML") returned -1 [0106.525] lstrlenW (lpString=".pdf") returned 4 [0106.525] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0106.525] lstrlenW (lpString=".xls") returned 4 [0106.525] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0106.525] lstrlenW (lpString=".xlsx") returned 5 [0106.525] lstrcmpiW (lpString1=".xlsx", lpString2="f.XML") returned -1 [0106.525] lstrlenW (lpString=".ppt") returned 4 [0106.525] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0106.525] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98 [0106.525] lstrlenW (lpString=".zip") returned 4 [0106.525] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0106.525] lstrlenW (lpString=".rar") returned 4 [0106.525] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0106.525] lstrlenW (lpString=".bz2") returned 4 [0106.525] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0106.525] lstrlenW (lpString=".7z") returned 3 [0106.525] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0106.525] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98 [0106.525] lstrlenW (lpString=".dbf") returned 4 [0106.525] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0106.525] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98 [0106.525] lstrlenW (lpString=".1cd") returned 4 [0106.525] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0106.525] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98 [0106.525] lstrlenW (lpString=".jpg") returned 4 [0106.525] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0106.525] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98 [0106.525] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98 [0106.525] lstrlenW (lpString=".doc") returned 4 [0106.525] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0106.525] lstrlenW (lpString=".docx") returned 5 [0106.525] lstrcmpiW (lpString1=".docx", lpString2="f.XML") returned -1 [0106.525] lstrlenW (lpString=".pdf") returned 4 [0106.526] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0106.526] lstrlenW (lpString=".xls") returned 4 [0106.526] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0106.526] lstrlenW (lpString=".xlsx") returned 5 [0106.526] lstrcmpiW (lpString1=".xlsx", lpString2="f.XML") returned -1 [0106.526] lstrlenW (lpString=".ppt") returned 4 [0106.526] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0106.526] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98 [0106.526] lstrlenW (lpString=".zip") returned 4 [0106.526] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0106.526] lstrlenW (lpString=".rar") returned 4 [0106.526] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0106.526] lstrlenW (lpString=".bz2") returned 4 [0106.526] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0106.526] lstrlenW (lpString=".7z") returned 3 [0106.526] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0106.526] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98 [0106.526] lstrlenW (lpString=".dbf") returned 4 [0106.526] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0106.526] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98 [0106.526] lstrlenW (lpString=".1cd") returned 4 [0106.526] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0106.526] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98 [0106.526] lstrlenW (lpString=".jpg") returned 4 [0106.526] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0106.526] lstrcmpiW (lpString1=".XML", lpString2=".waifu") returned 1 [0106.526] lstrlenW (lpString="Proof.XML") returned 9 [0106.526] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.fr\\proof.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0106.526] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x326f8cc | out: lpFileSize=0x326f8cc*=1458) returned 1 [0106.526] CloseHandle (hObject=0x194) returned 1 [0106.526] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.fr\\proof.xml")) returned 0x20 [0106.527] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.fr\\proof.xml.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0106.527] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.fr\\proof.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0106.527] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0106.527] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0106.527] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.fr\\proof.xml.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0106.527] GetLastError () returned 0x0 [0106.527] ReadFile (in: hFile=0x194, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0x5b2, lpOverlapped=0x0) returned 1 [0106.633] WriteFile (in: hFile=0x1c0, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0x5c0, lpOverlapped=0x0) returned 1 [0106.635] ReadFile (in: hFile=0x194, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0x0, lpOverlapped=0x0) returned 1 [0106.635] WriteFile (in: hFile=0x1c0, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0xe6, lpOverlapped=0x0) returned 1 [0106.635] SetEndOfFile (hFile=0x1c0) returned 1 [0106.635] CloseHandle (hObject=0x1c0) returned 1 [0106.635] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0106.635] SetEndOfFile (hFile=0x194) returned 1 [0106.754] CloseHandle (hObject=0x194) returned 1 [0106.754] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0107.671] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.fr\\proof.xml")) returned 1 [0107.671] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98 [0107.671] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98 [0107.671] lstrlenW (lpString=".doc") returned 4 [0107.671] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0107.671] lstrlenW (lpString=".docx") returned 5 [0107.671] lstrcmpiW (lpString1=".docx", lpString2="f.XML") returned -1 [0107.671] lstrlenW (lpString=".pdf") returned 4 [0107.671] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0107.671] lstrlenW (lpString=".xls") returned 4 [0107.671] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0107.671] lstrlenW (lpString=".xlsx") returned 5 [0107.671] lstrcmpiW (lpString1=".xlsx", lpString2="f.XML") returned -1 [0107.671] lstrlenW (lpString=".ppt") returned 4 [0107.671] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0107.671] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98 [0107.671] lstrlenW (lpString=".zip") returned 4 [0107.671] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0107.671] lstrlenW (lpString=".rar") returned 4 [0107.671] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0107.671] lstrlenW (lpString=".bz2") returned 4 [0107.671] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0107.671] lstrlenW (lpString=".7z") returned 3 [0107.671] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0107.671] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98 [0107.671] lstrlenW (lpString=".dbf") returned 4 [0107.671] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0107.671] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98 [0107.671] lstrlenW (lpString=".1cd") returned 4 [0107.671] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0107.671] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98 [0107.671] lstrlenW (lpString=".jpg") returned 4 [0107.671] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0107.671] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98 [0107.671] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98 [0107.671] lstrlenW (lpString=".doc") returned 4 [0107.672] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0107.672] lstrlenW (lpString=".docx") returned 5 [0107.672] lstrcmpiW (lpString1=".docx", lpString2="f.XML") returned -1 [0107.672] lstrlenW (lpString=".pdf") returned 4 [0107.672] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0107.672] lstrlenW (lpString=".xls") returned 4 [0107.672] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0107.672] lstrlenW (lpString=".xlsx") returned 5 [0107.672] lstrcmpiW (lpString1=".xlsx", lpString2="f.XML") returned -1 [0107.672] lstrlenW (lpString=".ppt") returned 4 [0107.672] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0107.672] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98 [0107.672] lstrlenW (lpString=".zip") returned 4 [0107.672] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0107.672] lstrlenW (lpString=".rar") returned 4 [0107.672] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0107.672] lstrlenW (lpString=".bz2") returned 4 [0107.672] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0107.672] lstrlenW (lpString=".7z") returned 3 [0107.672] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0107.672] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98 [0107.672] lstrlenW (lpString=".dbf") returned 4 [0107.672] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0107.672] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98 [0107.672] lstrlenW (lpString=".1cd") returned 4 [0107.672] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0107.672] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98 [0107.672] lstrlenW (lpString=".jpg") returned 4 [0107.672] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0107.672] lstrcmpiW (lpString1=".XML", lpString2=".waifu") returned 1 [0107.672] lstrlenW (lpString="SETUP.XML") returned 9 [0107.672] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0107.758] GetFileSizeEx (in: hFile=0x1cc, lpFileSize=0x326f8cc | out: lpFileSize=0x326f8cc*=6241) returned 1 [0107.758] CloseHandle (hObject=0x1cc) returned 1 [0107.758] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\setup.xml")) returned 0x20 [0107.758] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\setup.xml.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0107.758] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1cc [0107.758] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0107.758] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0107.758] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\setup.xml.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0107.758] GetLastError () returned 0x0 [0107.758] ReadFile (in: hFile=0x1cc, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0x1861, lpOverlapped=0x0) returned 1 [0107.802] WriteFile (in: hFile=0x1d0, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0x1870, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0x1870, lpOverlapped=0x0) returned 1 [0107.803] ReadFile (in: hFile=0x1cc, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0x0, lpOverlapped=0x0) returned 1 [0107.803] WriteFile (in: hFile=0x1d0, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0xe6, lpOverlapped=0x0) returned 1 [0107.803] SetEndOfFile (hFile=0x1d0) returned 1 [0107.803] CloseHandle (hObject=0x1d0) returned 1 [0107.803] SetFilePointerEx (in: hFile=0x1cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0107.804] SetEndOfFile (hFile=0x1cc) returned 1 [0107.804] CloseHandle (hObject=0x1cc) returned 1 [0107.804] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0107.804] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\setup.xml")) returned 1 [0107.804] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101 [0107.804] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101 [0107.804] lstrlenW (lpString=".doc") returned 4 [0107.805] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0107.805] lstrlenW (lpString=".docx") returned 5 [0107.805] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0107.805] lstrlenW (lpString=".pdf") returned 4 [0107.805] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0107.805] lstrlenW (lpString=".xls") returned 4 [0107.805] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0107.805] lstrlenW (lpString=".xlsx") returned 5 [0107.805] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0107.805] lstrlenW (lpString=".ppt") returned 4 [0107.805] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0107.805] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101 [0107.805] lstrlenW (lpString=".zip") returned 4 [0107.805] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0107.805] lstrlenW (lpString=".rar") returned 4 [0107.805] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0107.805] lstrlenW (lpString=".bz2") returned 4 [0107.805] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0107.805] lstrlenW (lpString=".7z") returned 3 [0107.805] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0107.805] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101 [0107.805] lstrlenW (lpString=".dbf") returned 4 [0107.805] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0107.805] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101 [0107.805] lstrlenW (lpString=".1cd") returned 4 [0107.805] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0107.805] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101 [0107.805] lstrlenW (lpString=".jpg") returned 4 [0107.805] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0107.805] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101 [0107.805] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101 [0107.805] lstrlenW (lpString=".doc") returned 4 [0107.805] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0107.805] lstrlenW (lpString=".docx") returned 5 [0107.805] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0107.805] lstrlenW (lpString=".pdf") returned 4 [0107.805] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0107.805] lstrlenW (lpString=".xls") returned 4 [0107.805] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0107.805] lstrlenW (lpString=".xlsx") returned 5 [0107.805] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0107.805] lstrlenW (lpString=".ppt") returned 4 [0107.805] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0107.805] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101 [0107.805] lstrlenW (lpString=".zip") returned 4 [0107.805] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0107.805] lstrlenW (lpString=".rar") returned 4 [0107.805] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0107.805] lstrlenW (lpString=".bz2") returned 4 [0107.805] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0107.805] lstrlenW (lpString=".7z") returned 3 [0107.805] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0107.806] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101 [0107.806] lstrlenW (lpString=".dbf") returned 4 [0107.806] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0107.806] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101 [0107.806] lstrlenW (lpString=".1cd") returned 4 [0107.806] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0107.806] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101 [0107.806] lstrlenW (lpString=".jpg") returned 4 [0107.806] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0107.806] lstrcmpiW (lpString1=".XML", lpString2=".waifu") returned 1 [0107.806] lstrlenW (lpString="VisioMUI.XML") returned 12 [0107.806] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\visiomui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0107.877] GetFileSizeEx (in: hFile=0x1bc, lpFileSize=0x326f8cc | out: lpFileSize=0x326f8cc*=9503) returned 1 [0107.877] CloseHandle (hObject=0x1bc) returned 1 [0107.877] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\visiomui.xml")) returned 0x20 [0107.877] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\visiomui.xml.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0107.877] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\visiomui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0107.877] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0107.877] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0107.877] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\visiomui.xml.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0107.888] GetLastError () returned 0x0 [0107.888] ReadFile (in: hFile=0x1bc, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0x251f, lpOverlapped=0x0) returned 1 [0107.890] WriteFile (in: hFile=0x1dc, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0x2520, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0x2520, lpOverlapped=0x0) returned 1 [0107.891] ReadFile (in: hFile=0x1bc, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0x0, lpOverlapped=0x0) returned 1 [0107.891] WriteFile (in: hFile=0x1dc, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0xec, lpOverlapped=0x0) returned 1 [0107.891] SetEndOfFile (hFile=0x1dc) returned 1 [0107.891] CloseHandle (hObject=0x1dc) returned 1 [0107.892] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0107.892] SetEndOfFile (hFile=0x1bc) returned 1 [0107.893] CloseHandle (hObject=0x1bc) returned 1 [0107.893] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0107.893] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\visiomui.xml")) returned 1 [0107.893] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0107.893] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0107.893] lstrlenW (lpString=".doc") returned 4 [0107.893] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0107.893] lstrlenW (lpString=".docx") returned 5 [0107.893] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0107.893] lstrlenW (lpString=".pdf") returned 4 [0107.893] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0107.893] lstrlenW (lpString=".xls") returned 4 [0107.893] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0107.893] lstrlenW (lpString=".xlsx") returned 5 [0107.893] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0107.893] lstrlenW (lpString=".ppt") returned 4 [0107.893] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0107.893] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0107.893] lstrlenW (lpString=".zip") returned 4 [0107.893] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0107.894] lstrlenW (lpString=".rar") returned 4 [0107.894] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0107.894] lstrlenW (lpString=".bz2") returned 4 [0107.894] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0107.894] lstrlenW (lpString=".7z") returned 3 [0107.894] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0107.894] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0107.894] lstrlenW (lpString=".dbf") returned 4 [0107.894] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0107.894] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0107.894] lstrlenW (lpString=".1cd") returned 4 [0107.894] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0107.894] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0107.894] lstrlenW (lpString=".jpg") returned 4 [0107.894] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0107.894] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0107.894] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0107.894] lstrlenW (lpString=".doc") returned 4 [0107.894] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0107.894] lstrlenW (lpString=".docx") returned 5 [0107.894] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0107.894] lstrlenW (lpString=".pdf") returned 4 [0107.894] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0107.894] lstrlenW (lpString=".xls") returned 4 [0107.894] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0107.894] lstrlenW (lpString=".xlsx") returned 5 [0107.894] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0107.894] lstrlenW (lpString=".ppt") returned 4 [0107.894] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0107.894] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0107.894] lstrlenW (lpString=".zip") returned 4 [0107.894] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0107.894] lstrlenW (lpString=".rar") returned 4 [0107.894] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0107.894] lstrlenW (lpString=".bz2") returned 4 [0107.894] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0107.894] lstrlenW (lpString=".7z") returned 3 [0107.894] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0107.894] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0107.894] lstrlenW (lpString=".dbf") returned 4 [0107.894] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0107.894] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0107.894] lstrlenW (lpString=".1cd") returned 4 [0107.894] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0107.894] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0107.894] lstrlenW (lpString=".jpg") returned 4 [0107.894] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0107.894] lstrcmpiW (lpString1=".XML", lpString2=".waifu") returned 1 [0107.895] lstrlenW (lpString="VisiorWW.XML") returned 12 [0107.895] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\visiorww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0107.895] GetFileSizeEx (in: hFile=0x1bc, lpFileSize=0x326f8cc | out: lpFileSize=0x326f8cc*=8723) returned 1 [0107.895] CloseHandle (hObject=0x1bc) returned 1 [0107.895] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\visiorww.xml")) returned 0x20 [0107.895] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\visiorww.xml.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0107.895] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\visiorww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0107.895] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0107.895] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0107.895] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\visiorww.xml.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0107.898] GetLastError () returned 0x0 [0107.898] ReadFile (in: hFile=0x1bc, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0x2213, lpOverlapped=0x0) returned 1 [0107.899] WriteFile (in: hFile=0x1dc, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0x2220, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0x2220, lpOverlapped=0x0) returned 1 [0107.903] ReadFile (in: hFile=0x1bc, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0x0, lpOverlapped=0x0) returned 1 [0107.903] WriteFile (in: hFile=0x1dc, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0xec, lpOverlapped=0x0) returned 1 [0107.903] SetEndOfFile (hFile=0x1dc) returned 1 [0107.903] CloseHandle (hObject=0x1dc) returned 1 [0107.903] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0107.903] SetEndOfFile (hFile=0x1bc) returned 1 [0107.904] CloseHandle (hObject=0x1bc) returned 1 [0107.904] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0107.904] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\visiorww.xml")) returned 1 [0107.904] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0107.904] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0107.904] lstrlenW (lpString=".doc") returned 4 [0107.904] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0107.904] lstrlenW (lpString=".docx") returned 5 [0107.904] lstrcmpiW (lpString1=".docx", lpString2="W.XML") returned -1 [0107.904] lstrlenW (lpString=".pdf") returned 4 [0107.904] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0107.904] lstrlenW (lpString=".xls") returned 4 [0107.904] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0107.905] lstrlenW (lpString=".xlsx") returned 5 [0107.905] lstrcmpiW (lpString1=".xlsx", lpString2="W.XML") returned -1 [0107.905] lstrlenW (lpString=".ppt") returned 4 [0107.905] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0107.905] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0107.905] lstrlenW (lpString=".zip") returned 4 [0107.905] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0107.905] lstrlenW (lpString=".rar") returned 4 [0107.905] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0107.905] lstrlenW (lpString=".bz2") returned 4 [0107.905] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0107.905] lstrlenW (lpString=".7z") returned 3 [0107.905] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0107.905] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0107.905] lstrlenW (lpString=".dbf") returned 4 [0107.905] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0107.905] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0107.905] lstrlenW (lpString=".1cd") returned 4 [0107.905] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0107.905] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0107.905] lstrlenW (lpString=".jpg") returned 4 [0107.905] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0107.905] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0107.905] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0107.905] lstrlenW (lpString=".doc") returned 4 [0107.905] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0107.905] lstrlenW (lpString=".docx") returned 5 [0107.905] lstrcmpiW (lpString1=".docx", lpString2="W.XML") returned -1 [0107.905] lstrlenW (lpString=".pdf") returned 4 [0107.905] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0107.905] lstrlenW (lpString=".xls") returned 4 [0107.905] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0107.905] lstrlenW (lpString=".xlsx") returned 5 [0107.905] lstrcmpiW (lpString1=".xlsx", lpString2="W.XML") returned -1 [0107.905] lstrlenW (lpString=".ppt") returned 4 [0107.905] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0107.905] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0107.905] lstrlenW (lpString=".zip") returned 4 [0107.905] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0107.905] lstrlenW (lpString=".rar") returned 4 [0107.905] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0107.905] lstrlenW (lpString=".bz2") returned 4 [0107.905] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0107.905] lstrlenW (lpString=".7z") returned 3 [0107.905] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0107.905] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0107.905] lstrlenW (lpString=".dbf") returned 4 [0107.905] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0107.905] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0107.905] lstrlenW (lpString=".1cd") returned 4 [0107.905] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0107.905] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0107.905] lstrlenW (lpString=".jpg") returned 4 [0107.906] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0107.906] lstrcmpiW (lpString1=".XML", lpString2=".waifu") returned 1 [0107.906] lstrlenW (lpString="SETUP.XML") returned 9 [0107.906] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0107.907] GetFileSizeEx (in: hFile=0x1bc, lpFileSize=0x326f8cc | out: lpFileSize=0x326f8cc*=2424) returned 1 [0107.907] CloseHandle (hObject=0x1bc) returned 1 [0107.907] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\setup.xml")) returned 0x20 [0107.907] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\setup.xml.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0107.907] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0107.907] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0107.908] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0107.908] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\setup.xml.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0107.908] GetLastError () returned 0x0 [0107.908] ReadFile (in: hFile=0x1bc, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0x978, lpOverlapped=0x0) returned 1 [0107.940] WriteFile (in: hFile=0x1dc, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0x980, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0x980, lpOverlapped=0x0) returned 1 [0107.942] ReadFile (in: hFile=0x1bc, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0x0, lpOverlapped=0x0) returned 1 [0107.942] WriteFile (in: hFile=0x1dc, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0xe6, lpOverlapped=0x0) returned 1 [0107.942] SetEndOfFile (hFile=0x1dc) returned 1 [0107.942] CloseHandle (hObject=0x1dc) returned 1 [0107.943] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0107.943] SetEndOfFile (hFile=0x1bc) returned 1 [0107.943] CloseHandle (hObject=0x1bc) returned 1 [0107.943] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0107.944] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\setup.xml")) returned 1 [0107.944] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100 [0107.944] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100 [0107.944] lstrlenW (lpString=".doc") returned 4 [0107.944] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0107.944] lstrlenW (lpString=".docx") returned 5 [0107.944] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0107.944] lstrlenW (lpString=".pdf") returned 4 [0107.944] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0107.944] lstrlenW (lpString=".xls") returned 4 [0107.944] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0107.944] lstrlenW (lpString=".xlsx") returned 5 [0107.944] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0107.944] lstrlenW (lpString=".ppt") returned 4 [0107.944] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0107.944] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100 [0107.944] lstrlenW (lpString=".zip") returned 4 [0107.944] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0107.944] lstrlenW (lpString=".rar") returned 4 [0107.944] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0107.944] lstrlenW (lpString=".bz2") returned 4 [0107.944] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0107.944] lstrlenW (lpString=".7z") returned 3 [0107.944] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0107.944] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100 [0107.944] lstrlenW (lpString=".dbf") returned 4 [0107.944] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0107.944] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100 [0107.944] lstrlenW (lpString=".1cd") returned 4 [0107.944] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0107.944] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100 [0107.944] lstrlenW (lpString=".jpg") returned 4 [0107.944] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0107.945] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100 [0107.945] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100 [0107.945] lstrlenW (lpString=".doc") returned 4 [0107.945] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0107.945] lstrlenW (lpString=".docx") returned 5 [0107.945] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0107.945] lstrlenW (lpString=".pdf") returned 4 [0107.945] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0107.945] lstrlenW (lpString=".xls") returned 4 [0107.945] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0107.945] lstrlenW (lpString=".xlsx") returned 5 [0107.945] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0107.945] lstrlenW (lpString=".ppt") returned 4 [0107.945] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0107.945] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100 [0107.945] lstrlenW (lpString=".zip") returned 4 [0107.945] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0107.945] lstrlenW (lpString=".rar") returned 4 [0107.945] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0107.945] lstrlenW (lpString=".bz2") returned 4 [0107.945] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0107.945] lstrlenW (lpString=".7z") returned 3 [0107.945] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0107.945] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100 [0107.945] lstrlenW (lpString=".dbf") returned 4 [0107.945] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0107.945] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100 [0107.945] lstrlenW (lpString=".1cd") returned 4 [0107.945] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0107.945] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100 [0107.945] lstrlenW (lpString=".jpg") returned 4 [0107.945] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0107.945] lstrcmpiW (lpString1=".XML", lpString2=".waifu") returned 1 [0107.945] lstrlenW (lpString="WordMUI.XML") returned 11 [0107.945] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\wordmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0107.946] GetFileSizeEx (in: hFile=0x1bc, lpFileSize=0x326f8cc | out: lpFileSize=0x326f8cc*=1800) returned 1 [0107.946] CloseHandle (hObject=0x1bc) returned 1 [0107.946] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\wordmui.xml")) returned 0x20 [0107.946] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\wordmui.xml.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0107.946] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\wordmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0107.946] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0107.946] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0107.946] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\wordmui.xml.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0108.283] GetLastError () returned 0x0 [0108.283] ReadFile (in: hFile=0x1bc, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0x708, lpOverlapped=0x0) returned 1 [0108.457] WriteFile (in: hFile=0x1d0, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0x710, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0x710, lpOverlapped=0x0) returned 1 [0108.458] ReadFile (in: hFile=0x1bc, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0x0, lpOverlapped=0x0) returned 1 [0108.458] WriteFile (in: hFile=0x1d0, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0xea, lpOverlapped=0x0) returned 1 [0108.458] SetEndOfFile (hFile=0x1d0) returned 1 [0108.458] CloseHandle (hObject=0x1d0) returned 1 [0108.458] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0108.458] SetEndOfFile (hFile=0x1bc) returned 1 [0110.324] CloseHandle (hObject=0x1bc) returned 1 [0110.324] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0110.324] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\wordmui.xml")) returned 1 [0110.325] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102 [0110.325] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102 [0110.325] lstrlenW (lpString=".doc") returned 4 [0110.325] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0110.325] lstrlenW (lpString=".docx") returned 5 [0110.325] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0110.325] lstrlenW (lpString=".pdf") returned 4 [0110.325] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0110.325] lstrlenW (lpString=".xls") returned 4 [0110.325] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0110.325] lstrlenW (lpString=".xlsx") returned 5 [0110.325] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0110.325] lstrlenW (lpString=".ppt") returned 4 [0110.325] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0110.325] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102 [0110.325] lstrlenW (lpString=".zip") returned 4 [0110.325] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0110.325] lstrlenW (lpString=".rar") returned 4 [0110.325] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0110.325] lstrlenW (lpString=".bz2") returned 4 [0110.325] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0110.325] lstrlenW (lpString=".7z") returned 3 [0110.325] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0110.325] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102 [0110.325] lstrlenW (lpString=".dbf") returned 4 [0110.325] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0110.325] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102 [0110.325] lstrlenW (lpString=".1cd") returned 4 [0110.325] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0110.325] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102 [0110.325] lstrlenW (lpString=".jpg") returned 4 [0110.325] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0110.325] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102 [0110.325] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102 [0110.325] lstrlenW (lpString=".doc") returned 4 [0110.325] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0110.325] lstrlenW (lpString=".docx") returned 5 [0110.325] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0110.325] lstrlenW (lpString=".pdf") returned 4 [0110.325] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0110.325] lstrlenW (lpString=".xls") returned 4 [0110.326] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0110.326] lstrlenW (lpString=".xlsx") returned 5 [0110.326] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0110.326] lstrlenW (lpString=".ppt") returned 4 [0110.326] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0110.326] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102 [0110.326] lstrlenW (lpString=".zip") returned 4 [0110.326] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0110.326] lstrlenW (lpString=".rar") returned 4 [0110.326] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0110.326] lstrlenW (lpString=".bz2") returned 4 [0110.326] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0110.326] lstrlenW (lpString=".7z") returned 3 [0110.326] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0110.326] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102 [0110.326] lstrlenW (lpString=".dbf") returned 4 [0110.326] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0110.326] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102 [0110.326] lstrlenW (lpString=".1cd") returned 4 [0110.326] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0110.326] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102 [0110.326] lstrlenW (lpString=".jpg") returned 4 [0110.326] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0110.326] lstrcmpiW (lpString1=".jpg", lpString2=".waifu") returned -1 [0110.326] lstrlenW (lpString="Blue_Gradient.jpg") returned 17 [0110.326] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\blue_gradient.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0111.302] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x326f8cc | out: lpFileSize=0x326f8cc*=2575) returned 1 [0111.302] CloseHandle (hObject=0x1b0) returned 1 [0111.303] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\blue_gradient.jpg")) returned 0x20 [0111.303] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\blue_gradient.jpg.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0111.303] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\blue_gradient.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0111.303] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0111.303] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0111.303] lstrlenW (lpString=".doc") returned 4 [0111.303] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0111.303] lstrlenW (lpString=".docx") returned 5 [0111.303] lstrcmpiW (lpString1=".docx", lpString2="t.jpg") returned -1 [0111.303] lstrlenW (lpString=".pdf") returned 4 [0111.303] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0111.303] lstrlenW (lpString=".xls") returned 4 [0111.303] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0111.303] lstrlenW (lpString=".xlsx") returned 5 [0111.303] lstrcmpiW (lpString1=".xlsx", lpString2="t.jpg") returned -1 [0111.303] lstrlenW (lpString=".ppt") returned 4 [0111.303] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0111.303] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0111.303] lstrlenW (lpString=".zip") returned 4 [0111.303] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0111.303] lstrlenW (lpString=".rar") returned 4 [0111.303] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0111.303] lstrlenW (lpString=".bz2") returned 4 [0111.303] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0111.303] lstrlenW (lpString=".7z") returned 3 [0111.303] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0111.303] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0111.303] lstrlenW (lpString=".dbf") returned 4 [0111.303] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0111.303] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0111.303] lstrlenW (lpString=".1cd") returned 4 [0111.303] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0111.303] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0111.303] lstrlenW (lpString=".jpg") returned 4 [0111.303] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0111.303] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0111.303] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0111.304] lstrlenW (lpString=".doc") returned 4 [0111.304] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0111.304] lstrlenW (lpString=".docx") returned 5 [0111.304] lstrcmpiW (lpString1=".docx", lpString2="t.jpg") returned -1 [0111.304] lstrlenW (lpString=".pdf") returned 4 [0111.304] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0111.304] lstrlenW (lpString=".xls") returned 4 [0111.304] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0111.304] lstrlenW (lpString=".xlsx") returned 5 [0111.304] lstrcmpiW (lpString1=".xlsx", lpString2="t.jpg") returned -1 [0111.304] lstrlenW (lpString=".ppt") returned 4 [0111.304] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0111.304] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0111.304] lstrlenW (lpString=".zip") returned 4 [0111.304] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0111.304] lstrlenW (lpString=".rar") returned 4 [0111.304] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0111.304] lstrlenW (lpString=".bz2") returned 4 [0111.304] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0111.304] lstrlenW (lpString=".7z") returned 3 [0111.304] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0111.304] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0111.304] lstrlenW (lpString=".dbf") returned 4 [0111.304] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0111.304] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0111.304] lstrlenW (lpString=".1cd") returned 4 [0111.304] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0111.304] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0111.304] lstrlenW (lpString=".jpg") returned 4 [0111.304] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0111.304] lstrcmpiW (lpString1=".PNG", lpString2=".waifu") returned -1 [0111.304] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0111.304] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0111.827] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x326f8cc | out: lpFileSize=0x326f8cc*=19780) returned 1 [0111.827] CloseHandle (hObject=0x1f4) returned 1 [0111.827] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\thmbnail.png")) returned 0x20 [0111.827] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\thmbnail.png.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0111.827] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0111.827] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0111.828] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0111.828] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\thmbnail.png.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0111.828] GetLastError () returned 0x0 [0111.828] ReadFile (in: hFile=0x1f4, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0x4d44, lpOverlapped=0x0) returned 1 [0111.830] WriteFile (in: hFile=0x1f8, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0x4d50, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0x4d50, lpOverlapped=0x0) returned 1 [0112.057] ReadFile (in: hFile=0x1f4, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0x0, lpOverlapped=0x0) returned 1 [0112.057] WriteFile (in: hFile=0x1f8, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0xec, lpOverlapped=0x0) returned 1 [0112.057] SetEndOfFile (hFile=0x1f8) returned 1 [0112.057] CloseHandle (hObject=0x1f8) returned 1 [0112.057] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0112.057] SetEndOfFile (hFile=0x1f4) returned 1 [0112.058] CloseHandle (hObject=0x1f4) returned 1 [0112.058] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0112.058] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\thmbnail.png")) returned 1 [0112.058] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75 [0112.058] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75 [0112.058] lstrlenW (lpString=".doc") returned 4 [0112.058] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0112.058] lstrlenW (lpString=".docx") returned 5 [0112.058] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0112.059] lstrlenW (lpString=".pdf") returned 4 [0112.059] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0112.059] lstrlenW (lpString=".xls") returned 4 [0112.059] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0112.059] lstrlenW (lpString=".xlsx") returned 5 [0112.059] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0112.059] lstrlenW (lpString=".ppt") returned 4 [0112.059] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0112.059] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75 [0112.059] lstrlenW (lpString=".zip") returned 4 [0112.059] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0112.059] lstrlenW (lpString=".rar") returned 4 [0112.059] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0112.059] lstrlenW (lpString=".bz2") returned 4 [0112.059] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0112.059] lstrlenW (lpString=".7z") returned 3 [0112.059] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0112.059] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75 [0112.059] lstrlenW (lpString=".dbf") returned 4 [0112.059] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0112.059] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75 [0112.059] lstrlenW (lpString=".1cd") returned 4 [0112.059] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0112.059] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75 [0112.059] lstrlenW (lpString=".jpg") returned 4 [0112.059] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0112.059] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75 [0112.059] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75 [0112.059] lstrlenW (lpString=".doc") returned 4 [0112.059] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0112.059] lstrlenW (lpString=".docx") returned 5 [0112.059] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0112.059] lstrlenW (lpString=".pdf") returned 4 [0112.059] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0112.059] lstrlenW (lpString=".xls") returned 4 [0112.059] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0112.059] lstrlenW (lpString=".xlsx") returned 5 [0112.059] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0112.059] lstrlenW (lpString=".ppt") returned 4 [0112.059] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0112.059] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75 [0112.059] lstrlenW (lpString=".zip") returned 4 [0112.059] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0112.059] lstrlenW (lpString=".rar") returned 4 [0112.059] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0112.059] lstrlenW (lpString=".bz2") returned 4 [0112.059] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0112.059] lstrlenW (lpString=".7z") returned 3 [0112.059] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0112.059] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75 [0112.059] lstrlenW (lpString=".dbf") returned 4 [0112.060] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0112.060] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75 [0112.060] lstrlenW (lpString=".1cd") returned 4 [0112.060] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0112.060] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75 [0112.060] lstrlenW (lpString=".jpg") returned 4 [0112.060] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0112.060] lstrcmpiW (lpString1=".PNG", lpString2=".waifu") returned -1 [0112.060] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0112.060] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0112.315] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x326f8cc | out: lpFileSize=0x326f8cc*=20371) returned 1 [0112.315] CloseHandle (hObject=0x1fc) returned 1 [0112.315] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\thmbnail.png")) returned 0x20 [0112.315] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\thmbnail.png.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0112.315] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0112.315] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0112.315] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0112.315] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\thmbnail.png.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0112.315] GetLastError () returned 0x0 [0112.315] ReadFile (in: hFile=0x1fc, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0x4f93, lpOverlapped=0x0) returned 1 [0112.446] WriteFile (in: hFile=0x180, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0x4fa0, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0x4fa0, lpOverlapped=0x0) returned 1 [0112.447] ReadFile (in: hFile=0x1fc, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0x0, lpOverlapped=0x0) returned 1 [0112.447] WriteFile (in: hFile=0x180, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0xec, lpOverlapped=0x0) returned 1 [0112.447] SetEndOfFile (hFile=0x180) returned 1 [0112.447] CloseHandle (hObject=0x180) returned 1 [0112.447] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0112.447] SetEndOfFile (hFile=0x1fc) returned 1 [0112.448] CloseHandle (hObject=0x1fc) returned 1 [0112.448] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0112.449] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\thmbnail.png")) returned 1 [0112.449] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76 [0112.449] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76 [0112.449] lstrlenW (lpString=".doc") returned 4 [0112.449] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0112.449] lstrlenW (lpString=".docx") returned 5 [0112.449] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0112.449] lstrlenW (lpString=".pdf") returned 4 [0112.449] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0112.449] lstrlenW (lpString=".xls") returned 4 [0112.449] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0112.449] lstrlenW (lpString=".xlsx") returned 5 [0112.449] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0112.449] lstrlenW (lpString=".ppt") returned 4 [0112.449] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0112.449] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76 [0112.449] lstrlenW (lpString=".zip") returned 4 [0112.449] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0112.449] lstrlenW (lpString=".rar") returned 4 [0112.449] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0112.449] lstrlenW (lpString=".bz2") returned 4 [0112.449] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0112.449] lstrlenW (lpString=".7z") returned 3 [0112.449] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0112.449] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76 [0112.449] lstrlenW (lpString=".dbf") returned 4 [0112.449] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0112.449] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76 [0112.449] lstrlenW (lpString=".1cd") returned 4 [0112.449] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0112.449] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76 [0112.449] lstrlenW (lpString=".jpg") returned 4 [0112.449] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0112.449] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76 [0112.449] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76 [0112.449] lstrlenW (lpString=".doc") returned 4 [0112.449] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0112.449] lstrlenW (lpString=".docx") returned 5 [0112.450] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0112.450] lstrlenW (lpString=".pdf") returned 4 [0112.450] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0112.450] lstrlenW (lpString=".xls") returned 4 [0112.450] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0112.450] lstrlenW (lpString=".xlsx") returned 5 [0112.450] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0112.450] lstrlenW (lpString=".ppt") returned 4 [0112.450] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0112.450] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76 [0112.450] lstrlenW (lpString=".zip") returned 4 [0112.450] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0112.450] lstrlenW (lpString=".rar") returned 4 [0112.450] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0112.450] lstrlenW (lpString=".bz2") returned 4 [0112.450] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0112.450] lstrlenW (lpString=".7z") returned 3 [0112.450] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0112.450] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76 [0112.450] lstrlenW (lpString=".dbf") returned 4 [0112.450] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0112.450] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76 [0112.450] lstrlenW (lpString=".1cd") returned 4 [0112.450] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0112.450] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76 [0112.450] lstrlenW (lpString=".jpg") returned 4 [0112.450] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0112.450] lstrcmpiW (lpString1=".PNG", lpString2=".waifu") returned -1 [0112.450] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0112.450] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0112.714] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x326f8cc | out: lpFileSize=0x326f8cc*=28595) returned 1 [0112.714] CloseHandle (hObject=0x1f4) returned 1 [0112.714] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\thmbnail.png")) returned 0x20 [0112.714] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\thmbnail.png.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0112.714] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0112.714] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0112.714] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0112.714] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\thmbnail.png.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0112.715] GetLastError () returned 0x0 [0112.715] ReadFile (in: hFile=0x1f4, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0x6fb3, lpOverlapped=0x0) returned 1 [0112.910] WriteFile (in: hFile=0x1f8, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0x6fc0, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0x6fc0, lpOverlapped=0x0) returned 1 [0112.911] ReadFile (in: hFile=0x1f4, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0x0, lpOverlapped=0x0) returned 1 [0112.911] WriteFile (in: hFile=0x1f8, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0xec, lpOverlapped=0x0) returned 1 [0112.912] SetEndOfFile (hFile=0x1f8) returned 1 [0112.912] CloseHandle (hObject=0x1f8) returned 1 [0112.912] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0112.912] SetEndOfFile (hFile=0x1f4) returned 1 [0112.912] CloseHandle (hObject=0x1f4) returned 1 [0112.912] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0112.913] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\thmbnail.png")) returned 1 [0112.913] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG") returned 77 [0112.913] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG") returned 77 [0112.913] lstrlenW (lpString=".doc") returned 4 [0112.913] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0112.913] lstrlenW (lpString=".docx") returned 5 [0112.913] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0112.913] lstrlenW (lpString=".pdf") returned 4 [0112.913] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0112.913] lstrlenW (lpString=".xls") returned 4 [0112.913] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0112.913] lstrlenW (lpString=".xlsx") returned 5 [0112.913] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0112.913] lstrlenW (lpString=".ppt") returned 4 [0112.913] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0112.913] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG") returned 77 [0112.913] lstrlenW (lpString=".zip") returned 4 [0112.913] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0112.913] lstrlenW (lpString=".rar") returned 4 [0112.913] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0112.913] lstrlenW (lpString=".bz2") returned 4 [0112.913] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0112.913] lstrlenW (lpString=".7z") returned 3 [0112.913] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0112.913] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG") returned 77 [0112.913] lstrlenW (lpString=".dbf") returned 4 [0112.913] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0112.913] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG") returned 77 [0112.913] lstrlenW (lpString=".1cd") returned 4 [0112.913] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0112.913] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG") returned 77 [0112.913] lstrlenW (lpString=".jpg") returned 4 [0112.913] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0112.914] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG") returned 77 [0112.914] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG") returned 77 [0112.914] lstrlenW (lpString=".doc") returned 4 [0112.914] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0112.914] lstrlenW (lpString=".docx") returned 5 [0112.914] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0112.914] lstrlenW (lpString=".pdf") returned 4 [0112.914] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0112.914] lstrlenW (lpString=".xls") returned 4 [0112.914] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0112.914] lstrlenW (lpString=".xlsx") returned 5 [0112.914] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0112.914] lstrlenW (lpString=".ppt") returned 4 [0112.914] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0112.914] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG") returned 77 [0112.914] lstrlenW (lpString=".zip") returned 4 [0112.914] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0112.914] lstrlenW (lpString=".rar") returned 4 [0112.914] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0112.914] lstrlenW (lpString=".bz2") returned 4 [0112.914] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0112.914] lstrlenW (lpString=".7z") returned 3 [0112.914] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0112.914] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG") returned 77 [0112.914] lstrlenW (lpString=".dbf") returned 4 [0112.914] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0112.914] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG") returned 77 [0112.914] lstrlenW (lpString=".1cd") returned 4 [0112.914] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0112.914] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG") returned 77 [0112.914] lstrlenW (lpString=".jpg") returned 4 [0112.914] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0112.914] lstrcmpiW (lpString1=".GIF", lpString2=".waifu") returned -1 [0112.914] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0112.915] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0112.915] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x326f8cc | out: lpFileSize=0x326f8cc*=1453) returned 1 [0112.915] CloseHandle (hObject=0x1f4) returned 1 [0112.915] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\preview.gif")) returned 0x20 [0112.915] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\preview.gif.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0112.915] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0112.915] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0112.915] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0112.915] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\preview.gif.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0113.116] GetLastError () returned 0x0 [0113.116] ReadFile (in: hFile=0x1f4, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0x5ad, lpOverlapped=0x0) returned 1 [0113.175] WriteFile (in: hFile=0x200, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0x5b0, lpOverlapped=0x0) returned 1 [0113.176] ReadFile (in: hFile=0x1f4, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0x0, lpOverlapped=0x0) returned 1 [0113.176] WriteFile (in: hFile=0x200, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0xea, lpOverlapped=0x0) returned 1 [0113.176] SetEndOfFile (hFile=0x200) returned 1 [0113.176] CloseHandle (hObject=0x200) returned 1 [0113.176] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0113.176] SetEndOfFile (hFile=0x1f4) returned 1 [0113.177] CloseHandle (hObject=0x1f4) returned 1 [0113.178] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0113.178] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\preview.gif")) returned 1 [0113.178] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF") returned 72 [0113.178] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF") returned 72 [0113.178] lstrlenW (lpString=".doc") returned 4 [0113.178] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0113.178] lstrlenW (lpString=".docx") returned 5 [0113.178] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0113.178] lstrlenW (lpString=".pdf") returned 4 [0113.178] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0113.178] lstrlenW (lpString=".xls") returned 4 [0113.178] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0113.178] lstrlenW (lpString=".xlsx") returned 5 [0113.178] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0113.178] lstrlenW (lpString=".ppt") returned 4 [0113.178] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0113.178] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF") returned 72 [0113.178] lstrlenW (lpString=".zip") returned 4 [0113.178] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0113.178] lstrlenW (lpString=".rar") returned 4 [0113.178] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0113.178] lstrlenW (lpString=".bz2") returned 4 [0113.178] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0113.178] lstrlenW (lpString=".7z") returned 3 [0113.178] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0113.178] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF") returned 72 [0113.178] lstrlenW (lpString=".dbf") returned 4 [0113.178] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0113.178] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF") returned 72 [0113.178] lstrlenW (lpString=".1cd") returned 4 [0113.178] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0113.178] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF") returned 72 [0113.178] lstrlenW (lpString=".jpg") returned 4 [0113.178] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0113.179] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF") returned 72 [0113.179] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF") returned 72 [0113.179] lstrlenW (lpString=".doc") returned 4 [0113.179] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0113.179] lstrlenW (lpString=".docx") returned 5 [0113.179] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0113.179] lstrlenW (lpString=".pdf") returned 4 [0113.179] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0113.179] lstrlenW (lpString=".xls") returned 4 [0113.179] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0113.179] lstrlenW (lpString=".xlsx") returned 5 [0113.179] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0113.179] lstrlenW (lpString=".ppt") returned 4 [0113.179] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0113.179] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF") returned 72 [0113.179] lstrlenW (lpString=".zip") returned 4 [0113.179] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0113.179] lstrlenW (lpString=".rar") returned 4 [0113.179] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0113.179] lstrlenW (lpString=".bz2") returned 4 [0113.179] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0113.179] lstrlenW (lpString=".7z") returned 3 [0113.179] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0113.179] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF") returned 72 [0113.179] lstrlenW (lpString=".dbf") returned 4 [0113.179] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0113.179] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF") returned 72 [0113.179] lstrlenW (lpString=".1cd") returned 4 [0113.179] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0113.179] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF") returned 72 [0113.179] lstrlenW (lpString=".jpg") returned 4 [0113.179] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0113.180] lstrcmpiW (lpString1=".GIF", lpString2=".waifu") returned -1 [0113.180] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0113.180] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0113.180] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x326f8cc | out: lpFileSize=0x326f8cc*=5120) returned 1 [0113.180] CloseHandle (hObject=0x200) returned 1 [0113.180] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\preview.gif")) returned 0x20 [0113.180] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\preview.gif.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0113.180] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0113.180] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0113.180] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0113.180] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\preview.gif.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0113.895] GetLastError () returned 0x0 [0113.895] ReadFile (in: hFile=0x200, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0x1400, lpOverlapped=0x0) returned 1 [0113.922] WriteFile (in: hFile=0x1d8, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0x1410, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0x1410, lpOverlapped=0x0) returned 1 [0113.923] ReadFile (in: hFile=0x200, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0x0, lpOverlapped=0x0) returned 1 [0113.923] WriteFile (in: hFile=0x1d8, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0xea, lpOverlapped=0x0) returned 1 [0113.923] SetEndOfFile (hFile=0x1d8) returned 1 [0113.923] CloseHandle (hObject=0x1d8) returned 1 [0113.923] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0113.923] SetEndOfFile (hFile=0x200) returned 1 [0113.924] CloseHandle (hObject=0x200) returned 1 [0113.924] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0113.924] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\preview.gif")) returned 1 [0113.924] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned 76 [0113.924] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned 76 [0113.924] lstrlenW (lpString=".doc") returned 4 [0113.924] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0113.924] lstrlenW (lpString=".docx") returned 5 [0113.924] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0113.924] lstrlenW (lpString=".pdf") returned 4 [0113.924] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0113.924] lstrlenW (lpString=".xls") returned 4 [0113.924] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0113.924] lstrlenW (lpString=".xlsx") returned 5 [0113.924] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0113.924] lstrlenW (lpString=".ppt") returned 4 [0113.924] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0113.925] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned 76 [0113.925] lstrlenW (lpString=".zip") returned 4 [0113.925] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0113.925] lstrlenW (lpString=".rar") returned 4 [0113.925] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0113.925] lstrlenW (lpString=".bz2") returned 4 [0113.925] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0113.925] lstrlenW (lpString=".7z") returned 3 [0113.925] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0113.925] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned 76 [0113.925] lstrlenW (lpString=".dbf") returned 4 [0113.925] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0113.925] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned 76 [0113.925] lstrlenW (lpString=".1cd") returned 4 [0113.925] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0113.925] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned 76 [0113.925] lstrlenW (lpString=".jpg") returned 4 [0113.925] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0113.925] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned 76 [0113.925] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned 76 [0113.925] lstrlenW (lpString=".doc") returned 4 [0113.925] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0113.925] lstrlenW (lpString=".docx") returned 5 [0113.925] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0113.925] lstrlenW (lpString=".pdf") returned 4 [0113.925] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0113.925] lstrlenW (lpString=".xls") returned 4 [0113.925] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0113.925] lstrlenW (lpString=".xlsx") returned 5 [0113.925] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0113.925] lstrlenW (lpString=".ppt") returned 4 [0113.925] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0113.925] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned 76 [0113.925] lstrlenW (lpString=".zip") returned 4 [0113.925] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0113.925] lstrlenW (lpString=".rar") returned 4 [0113.925] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0113.925] lstrlenW (lpString=".bz2") returned 4 [0113.925] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0113.925] lstrlenW (lpString=".7z") returned 3 [0113.925] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0113.925] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned 76 [0113.925] lstrlenW (lpString=".dbf") returned 4 [0113.925] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0113.925] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned 76 [0113.925] lstrlenW (lpString=".1cd") returned 4 [0113.925] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0113.925] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned 76 [0113.925] lstrlenW (lpString=".jpg") returned 4 [0113.926] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0113.926] lstrcmpiW (lpString1=".PNG", lpString2=".waifu") returned -1 [0113.926] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0113.926] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0114.325] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x326f8cc | out: lpFileSize=0x326f8cc*=48115) returned 1 [0114.325] CloseHandle (hObject=0x1f0) returned 1 [0114.325] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\thmbnail.png")) returned 0x20 [0114.325] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\thmbnail.png.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0114.325] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0114.325] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0114.325] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0114.326] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\thmbnail.png.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0114.326] GetLastError () returned 0x0 [0114.326] ReadFile (in: hFile=0x1f0, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0xbbf3, lpOverlapped=0x0) returned 1 [0114.329] WriteFile (in: hFile=0x180, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xbc00, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0xbc00, lpOverlapped=0x0) returned 1 [0114.329] ReadFile (in: hFile=0x1f0, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0x0, lpOverlapped=0x0) returned 1 [0114.329] WriteFile (in: hFile=0x180, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0xec, lpOverlapped=0x0) returned 1 [0114.330] SetEndOfFile (hFile=0x180) returned 1 [0114.330] CloseHandle (hObject=0x180) returned 1 [0114.330] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0114.330] SetEndOfFile (hFile=0x1f0) returned 1 [0114.330] CloseHandle (hObject=0x1f0) returned 1 [0114.330] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0114.331] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\thmbnail.png")) returned 1 [0114.331] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74 [0114.331] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74 [0114.331] lstrlenW (lpString=".doc") returned 4 [0114.331] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0114.331] lstrlenW (lpString=".docx") returned 5 [0114.331] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0114.331] lstrlenW (lpString=".pdf") returned 4 [0114.331] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0114.331] lstrlenW (lpString=".xls") returned 4 [0114.331] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0114.331] lstrlenW (lpString=".xlsx") returned 5 [0114.331] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0114.331] lstrlenW (lpString=".ppt") returned 4 [0114.331] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0114.331] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74 [0114.331] lstrlenW (lpString=".zip") returned 4 [0114.331] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0114.331] lstrlenW (lpString=".rar") returned 4 [0114.331] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0114.331] lstrlenW (lpString=".bz2") returned 4 [0114.331] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0114.331] lstrlenW (lpString=".7z") returned 3 [0114.331] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0114.331] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74 [0114.331] lstrlenW (lpString=".dbf") returned 4 [0114.331] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0114.331] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74 [0114.331] lstrlenW (lpString=".1cd") returned 4 [0114.331] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0114.331] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74 [0114.331] lstrlenW (lpString=".jpg") returned 4 [0114.331] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0114.331] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74 [0114.331] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74 [0114.331] lstrlenW (lpString=".doc") returned 4 [0114.331] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0114.332] lstrlenW (lpString=".docx") returned 5 [0114.332] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0114.332] lstrlenW (lpString=".pdf") returned 4 [0114.332] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0114.332] lstrlenW (lpString=".xls") returned 4 [0114.332] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0114.332] lstrlenW (lpString=".xlsx") returned 5 [0114.332] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0114.332] lstrlenW (lpString=".ppt") returned 4 [0114.332] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0114.332] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74 [0114.332] lstrlenW (lpString=".zip") returned 4 [0114.332] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0114.332] lstrlenW (lpString=".rar") returned 4 [0114.332] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0114.332] lstrlenW (lpString=".bz2") returned 4 [0114.332] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0114.332] lstrlenW (lpString=".7z") returned 3 [0114.332] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0114.332] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74 [0114.332] lstrlenW (lpString=".dbf") returned 4 [0114.332] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0114.332] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74 [0114.332] lstrlenW (lpString=".1cd") returned 4 [0114.332] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0114.332] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74 [0114.332] lstrlenW (lpString=".jpg") returned 4 [0114.332] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0114.332] lstrcmpiW (lpString1=".PNG", lpString2=".waifu") returned -1 [0114.332] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0114.332] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0114.349] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x326f8cc | out: lpFileSize=0x326f8cc*=37440) returned 1 [0114.349] CloseHandle (hObject=0x1ec) returned 1 [0114.349] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\thmbnail.png")) returned 0x20 [0114.350] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\thmbnail.png.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0114.350] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0114.350] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0114.350] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0114.350] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\thmbnail.png.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0114.350] GetLastError () returned 0x0 [0114.350] ReadFile (in: hFile=0x1ec, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0x9240, lpOverlapped=0x0) returned 1 [0114.352] WriteFile (in: hFile=0x1f8, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0x9250, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0x9250, lpOverlapped=0x0) returned 1 [0114.353] ReadFile (in: hFile=0x1ec, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0x0, lpOverlapped=0x0) returned 1 [0114.353] WriteFile (in: hFile=0x1f8, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0xec, lpOverlapped=0x0) returned 1 [0114.353] SetEndOfFile (hFile=0x1f8) returned 1 [0114.353] CloseHandle (hObject=0x1f8) returned 1 [0114.353] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0114.353] SetEndOfFile (hFile=0x1ec) returned 1 [0114.353] CloseHandle (hObject=0x1ec) returned 1 [0114.354] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0114.354] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\thmbnail.png")) returned 1 [0114.354] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76 [0114.354] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76 [0114.354] lstrlenW (lpString=".doc") returned 4 [0114.354] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0114.354] lstrlenW (lpString=".docx") returned 5 [0114.354] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0114.354] lstrlenW (lpString=".pdf") returned 4 [0114.354] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0114.354] lstrlenW (lpString=".xls") returned 4 [0114.354] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0114.354] lstrlenW (lpString=".xlsx") returned 5 [0114.354] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0114.354] lstrlenW (lpString=".ppt") returned 4 [0114.354] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0114.354] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76 [0114.354] lstrlenW (lpString=".zip") returned 4 [0114.354] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0114.354] lstrlenW (lpString=".rar") returned 4 [0114.354] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0114.354] lstrlenW (lpString=".bz2") returned 4 [0114.354] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0114.354] lstrlenW (lpString=".7z") returned 3 [0114.354] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0114.354] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76 [0114.354] lstrlenW (lpString=".dbf") returned 4 [0114.354] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0114.354] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76 [0114.354] lstrlenW (lpString=".1cd") returned 4 [0114.354] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0114.354] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76 [0114.354] lstrlenW (lpString=".jpg") returned 4 [0114.354] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0114.355] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76 [0114.355] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76 [0114.355] lstrlenW (lpString=".doc") returned 4 [0114.355] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0114.355] lstrlenW (lpString=".docx") returned 5 [0114.355] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0114.355] lstrlenW (lpString=".pdf") returned 4 [0114.355] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0114.355] lstrlenW (lpString=".xls") returned 4 [0114.355] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0114.355] lstrlenW (lpString=".xlsx") returned 5 [0114.355] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0114.355] lstrlenW (lpString=".ppt") returned 4 [0114.355] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0114.355] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76 [0114.355] lstrlenW (lpString=".zip") returned 4 [0114.355] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0114.355] lstrlenW (lpString=".rar") returned 4 [0114.355] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0114.355] lstrlenW (lpString=".bz2") returned 4 [0114.355] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0114.355] lstrlenW (lpString=".7z") returned 3 [0114.355] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0114.355] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76 [0114.355] lstrlenW (lpString=".dbf") returned 4 [0114.355] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0114.355] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76 [0114.355] lstrlenW (lpString=".1cd") returned 4 [0114.355] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0114.355] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76 [0114.355] lstrlenW (lpString=".jpg") returned 4 [0114.355] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0114.355] lstrcmpiW (lpString1=".GIF", lpString2=".waifu") returned -1 [0114.355] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0114.355] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0114.356] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x326f8cc | out: lpFileSize=0x326f8cc*=1593) returned 1 [0114.356] CloseHandle (hObject=0x1ec) returned 1 [0114.356] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\preview.gif")) returned 0x20 [0114.356] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\preview.gif.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0114.356] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0114.356] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0114.356] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0114.356] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\preview.gif.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0114.359] GetLastError () returned 0x0 [0114.359] ReadFile (in: hFile=0x1ec, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0x639, lpOverlapped=0x0) returned 1 [0114.360] WriteFile (in: hFile=0x1f8, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0x640, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0x640, lpOverlapped=0x0) returned 1 [0114.361] ReadFile (in: hFile=0x1ec, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0x0, lpOverlapped=0x0) returned 1 [0114.361] WriteFile (in: hFile=0x1f8, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0xea, lpOverlapped=0x0) returned 1 [0114.361] SetEndOfFile (hFile=0x1f8) returned 1 [0114.361] CloseHandle (hObject=0x1f8) returned 1 [0114.361] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0114.361] SetEndOfFile (hFile=0x1ec) returned 1 [0114.362] CloseHandle (hObject=0x1ec) returned 1 [0114.362] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0114.362] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\preview.gif")) returned 1 [0114.362] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73 [0114.362] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73 [0114.362] lstrlenW (lpString=".doc") returned 4 [0114.362] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0114.362] lstrlenW (lpString=".docx") returned 5 [0114.362] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0114.363] lstrlenW (lpString=".pdf") returned 4 [0114.363] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0114.363] lstrlenW (lpString=".xls") returned 4 [0114.363] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0114.363] lstrlenW (lpString=".xlsx") returned 5 [0114.363] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0114.363] lstrlenW (lpString=".ppt") returned 4 [0114.363] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0114.363] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73 [0114.363] lstrlenW (lpString=".zip") returned 4 [0114.363] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0114.363] lstrlenW (lpString=".rar") returned 4 [0114.363] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0114.363] lstrlenW (lpString=".bz2") returned 4 [0114.363] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0114.363] lstrlenW (lpString=".7z") returned 3 [0114.363] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0114.363] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73 [0114.363] lstrlenW (lpString=".dbf") returned 4 [0114.363] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0114.363] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73 [0114.363] lstrlenW (lpString=".1cd") returned 4 [0114.363] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0114.363] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73 [0114.363] lstrlenW (lpString=".jpg") returned 4 [0114.363] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0114.363] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73 [0114.363] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73 [0114.363] lstrlenW (lpString=".doc") returned 4 [0114.363] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0114.363] lstrlenW (lpString=".docx") returned 5 [0114.363] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0114.363] lstrlenW (lpString=".pdf") returned 4 [0114.363] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0114.363] lstrlenW (lpString=".xls") returned 4 [0114.363] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0114.363] lstrlenW (lpString=".xlsx") returned 5 [0114.363] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0114.363] lstrlenW (lpString=".ppt") returned 4 [0114.363] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0114.363] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73 [0114.363] lstrlenW (lpString=".zip") returned 4 [0114.363] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0114.363] lstrlenW (lpString=".rar") returned 4 [0114.363] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0114.363] lstrlenW (lpString=".bz2") returned 4 [0114.363] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0114.363] lstrlenW (lpString=".7z") returned 3 [0114.363] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0114.363] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73 [0114.363] lstrlenW (lpString=".dbf") returned 4 [0114.364] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0114.364] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73 [0114.364] lstrlenW (lpString=".1cd") returned 4 [0114.364] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0114.364] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73 [0114.364] lstrlenW (lpString=".jpg") returned 4 [0114.364] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0114.364] lstrcmpiW (lpString1=".PNG", lpString2=".waifu") returned -1 [0114.364] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0114.364] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0114.365] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x326f8cc | out: lpFileSize=0x326f8cc*=21745) returned 1 [0114.365] CloseHandle (hObject=0x1ec) returned 1 [0114.365] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\thmbnail.png")) returned 0x20 [0114.365] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\thmbnail.png.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0114.365] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0114.365] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0114.365] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0114.365] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\thmbnail.png.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0114.365] GetLastError () returned 0x0 [0114.365] ReadFile (in: hFile=0x1ec, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0x54f1, lpOverlapped=0x0) returned 1 [0114.367] WriteFile (in: hFile=0x1f8, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0x5500, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0x5500, lpOverlapped=0x0) returned 1 [0114.367] ReadFile (in: hFile=0x1ec, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0x0, lpOverlapped=0x0) returned 1 [0114.367] WriteFile (in: hFile=0x1f8, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0xec, lpOverlapped=0x0) returned 1 [0114.368] SetEndOfFile (hFile=0x1f8) returned 1 [0114.368] CloseHandle (hObject=0x1f8) returned 1 [0114.368] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0114.368] SetEndOfFile (hFile=0x1ec) returned 1 [0114.368] CloseHandle (hObject=0x1ec) returned 1 [0114.368] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0114.369] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\thmbnail.png")) returned 1 [0114.369] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74 [0114.369] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74 [0114.369] lstrlenW (lpString=".doc") returned 4 [0114.369] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0114.369] lstrlenW (lpString=".docx") returned 5 [0114.369] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0114.369] lstrlenW (lpString=".pdf") returned 4 [0114.369] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0114.369] lstrlenW (lpString=".xls") returned 4 [0114.369] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0114.369] lstrlenW (lpString=".xlsx") returned 5 [0114.369] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0114.369] lstrlenW (lpString=".ppt") returned 4 [0114.369] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0114.369] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74 [0114.369] lstrlenW (lpString=".zip") returned 4 [0114.369] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0114.369] lstrlenW (lpString=".rar") returned 4 [0114.369] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0114.369] lstrlenW (lpString=".bz2") returned 4 [0114.369] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0114.369] lstrlenW (lpString=".7z") returned 3 [0114.369] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0114.369] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74 [0114.369] lstrlenW (lpString=".dbf") returned 4 [0114.369] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0114.369] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74 [0114.369] lstrlenW (lpString=".1cd") returned 4 [0114.369] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0114.369] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74 [0114.369] lstrlenW (lpString=".jpg") returned 4 [0114.369] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0114.369] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74 [0114.369] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74 [0114.369] lstrlenW (lpString=".doc") returned 4 [0114.369] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0114.370] lstrlenW (lpString=".docx") returned 5 [0114.370] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0114.370] lstrlenW (lpString=".pdf") returned 4 [0114.370] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0114.370] lstrlenW (lpString=".xls") returned 4 [0114.370] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0114.370] lstrlenW (lpString=".xlsx") returned 5 [0114.370] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0114.370] lstrlenW (lpString=".ppt") returned 4 [0114.370] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0114.370] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74 [0114.370] lstrlenW (lpString=".zip") returned 4 [0114.370] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0114.370] lstrlenW (lpString=".rar") returned 4 [0114.370] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0114.370] lstrlenW (lpString=".bz2") returned 4 [0114.370] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0114.370] lstrlenW (lpString=".7z") returned 3 [0114.370] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0114.370] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74 [0114.370] lstrlenW (lpString=".dbf") returned 4 [0114.370] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0114.370] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74 [0114.370] lstrlenW (lpString=".1cd") returned 4 [0114.370] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0114.370] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74 [0114.370] lstrlenW (lpString=".jpg") returned 4 [0114.370] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0114.370] lstrcmpiW (lpString1=".GIF", lpString2=".waifu") returned -1 [0114.370] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0114.370] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0114.370] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x326f8cc | out: lpFileSize=0x326f8cc*=1339) returned 1 [0114.371] CloseHandle (hObject=0x1ec) returned 1 [0114.371] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\preview.gif")) returned 0x20 [0114.371] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\preview.gif.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0114.371] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0114.371] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0114.371] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0114.371] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\preview.gif.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0114.372] GetLastError () returned 0x0 [0114.372] ReadFile (in: hFile=0x1ec, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0x53b, lpOverlapped=0x0) returned 1 [0114.373] WriteFile (in: hFile=0x1f8, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0x540, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0x540, lpOverlapped=0x0) returned 1 [0114.374] ReadFile (in: hFile=0x1ec, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0x0, lpOverlapped=0x0) returned 1 [0114.374] WriteFile (in: hFile=0x1f8, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0xea, lpOverlapped=0x0) returned 1 [0114.374] SetEndOfFile (hFile=0x1f8) returned 1 [0114.374] CloseHandle (hObject=0x1f8) returned 1 [0114.374] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0114.374] SetEndOfFile (hFile=0x1ec) returned 1 [0114.375] CloseHandle (hObject=0x1ec) returned 1 [0114.375] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0114.375] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\preview.gif")) returned 1 [0114.375] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75 [0114.375] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75 [0114.375] lstrlenW (lpString=".doc") returned 4 [0114.375] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0114.375] lstrlenW (lpString=".docx") returned 5 [0114.375] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0114.375] lstrlenW (lpString=".pdf") returned 4 [0114.375] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0114.375] lstrlenW (lpString=".xls") returned 4 [0114.375] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0114.375] lstrlenW (lpString=".xlsx") returned 5 [0114.375] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0114.376] lstrlenW (lpString=".ppt") returned 4 [0114.376] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0114.376] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75 [0114.376] lstrlenW (lpString=".zip") returned 4 [0114.376] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0114.376] lstrlenW (lpString=".rar") returned 4 [0114.376] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0114.376] lstrlenW (lpString=".bz2") returned 4 [0114.376] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0114.376] lstrlenW (lpString=".7z") returned 3 [0114.376] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0114.376] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75 [0114.376] lstrlenW (lpString=".dbf") returned 4 [0114.376] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0114.376] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75 [0114.376] lstrlenW (lpString=".1cd") returned 4 [0114.376] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0114.376] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75 [0114.376] lstrlenW (lpString=".jpg") returned 4 [0114.376] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0114.376] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75 [0114.376] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75 [0114.376] lstrlenW (lpString=".doc") returned 4 [0114.376] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0114.376] lstrlenW (lpString=".docx") returned 5 [0114.376] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0114.376] lstrlenW (lpString=".pdf") returned 4 [0114.376] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0114.376] lstrlenW (lpString=".xls") returned 4 [0114.376] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0114.376] lstrlenW (lpString=".xlsx") returned 5 [0114.376] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0114.376] lstrlenW (lpString=".ppt") returned 4 [0114.376] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0114.376] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75 [0114.376] lstrlenW (lpString=".zip") returned 4 [0114.376] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0114.376] lstrlenW (lpString=".rar") returned 4 [0114.376] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0114.376] lstrlenW (lpString=".bz2") returned 4 [0114.376] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0114.376] lstrlenW (lpString=".7z") returned 3 [0114.376] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0114.376] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75 [0114.376] lstrlenW (lpString=".dbf") returned 4 [0114.376] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0114.376] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75 [0114.376] lstrlenW (lpString=".1cd") returned 4 [0114.376] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0114.377] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75 [0114.377] lstrlenW (lpString=".jpg") returned 4 [0114.377] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0114.377] lstrcmpiW (lpString1=".PNG", lpString2=".waifu") returned -1 [0114.377] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0114.377] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0114.377] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x326f8cc | out: lpFileSize=0x326f8cc*=16738) returned 1 [0114.377] CloseHandle (hObject=0x1ec) returned 1 [0114.377] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\thmbnail.png")) returned 0x20 [0114.377] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\thmbnail.png.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0114.377] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0114.377] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0114.377] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0114.377] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\thmbnail.png.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0114.378] GetLastError () returned 0x0 [0114.378] ReadFile (in: hFile=0x1ec, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0x4162, lpOverlapped=0x0) returned 1 [0114.439] WriteFile (in: hFile=0x1f8, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0x4170, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0x4170, lpOverlapped=0x0) returned 1 [0114.440] ReadFile (in: hFile=0x1ec, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0x0, lpOverlapped=0x0) returned 1 [0114.440] WriteFile (in: hFile=0x1f8, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0xec, lpOverlapped=0x0) returned 1 [0114.440] SetEndOfFile (hFile=0x1f8) returned 1 [0114.440] CloseHandle (hObject=0x1f8) returned 1 [0114.440] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0114.440] SetEndOfFile (hFile=0x1ec) returned 1 [0114.441] CloseHandle (hObject=0x1ec) returned 1 [0114.441] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0114.441] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\thmbnail.png")) returned 1 [0114.441] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 76 [0114.441] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 76 [0114.441] lstrlenW (lpString=".doc") returned 4 [0114.441] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0114.441] lstrlenW (lpString=".docx") returned 5 [0114.441] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0114.442] lstrlenW (lpString=".pdf") returned 4 [0114.442] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0114.442] lstrlenW (lpString=".xls") returned 4 [0114.442] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0114.442] lstrlenW (lpString=".xlsx") returned 5 [0114.442] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0114.442] lstrlenW (lpString=".ppt") returned 4 [0114.442] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0114.442] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 76 [0114.442] lstrlenW (lpString=".zip") returned 4 [0114.442] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0114.442] lstrlenW (lpString=".rar") returned 4 [0114.442] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0114.442] lstrlenW (lpString=".bz2") returned 4 [0114.442] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0114.442] lstrlenW (lpString=".7z") returned 3 [0114.442] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0114.442] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 76 [0114.442] lstrlenW (lpString=".dbf") returned 4 [0114.442] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0114.442] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 76 [0114.442] lstrlenW (lpString=".1cd") returned 4 [0114.442] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0114.442] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 76 [0114.442] lstrlenW (lpString=".jpg") returned 4 [0114.442] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0114.442] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 76 [0114.442] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 76 [0114.442] lstrlenW (lpString=".doc") returned 4 [0114.442] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0114.442] lstrlenW (lpString=".docx") returned 5 [0114.442] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0114.442] lstrlenW (lpString=".pdf") returned 4 [0114.443] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0114.443] lstrlenW (lpString=".xls") returned 4 [0114.443] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0114.443] lstrlenW (lpString=".xlsx") returned 5 [0114.443] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0114.443] lstrlenW (lpString=".ppt") returned 4 [0114.443] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0114.443] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 76 [0114.443] lstrlenW (lpString=".zip") returned 4 [0114.443] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0114.443] lstrlenW (lpString=".rar") returned 4 [0114.443] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0114.443] lstrlenW (lpString=".bz2") returned 4 [0114.443] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0114.443] lstrlenW (lpString=".7z") returned 3 [0114.443] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0114.443] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 76 [0114.443] lstrlenW (lpString=".dbf") returned 4 [0114.443] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0114.443] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 76 [0114.443] lstrlenW (lpString=".1cd") returned 4 [0114.443] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0114.443] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 76 [0114.443] lstrlenW (lpString=".jpg") returned 4 [0114.443] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0114.443] lstrcmpiW (lpString1=".PNG", lpString2=".waifu") returned -1 [0114.443] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0114.443] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0114.611] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x326f8cc | out: lpFileSize=0x326f8cc*=19563) returned 1 [0114.611] CloseHandle (hObject=0x1f8) returned 1 [0114.611] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\thmbnail.png")) returned 0x20 [0114.611] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\thmbnail.png.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0114.611] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0114.611] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0114.612] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0114.612] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\thmbnail.png.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0114.612] GetLastError () returned 0x0 [0114.612] ReadFile (in: hFile=0x1f8, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0x4c6b, lpOverlapped=0x0) returned 1 [0114.614] WriteFile (in: hFile=0x1d8, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0x4c70, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0x4c70, lpOverlapped=0x0) returned 1 [0114.615] ReadFile (in: hFile=0x1f8, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0x0, lpOverlapped=0x0) returned 1 [0114.615] WriteFile (in: hFile=0x1d8, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0xec, lpOverlapped=0x0) returned 1 [0114.615] SetEndOfFile (hFile=0x1d8) returned 1 [0114.615] CloseHandle (hObject=0x1d8) returned 1 [0114.615] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0114.615] SetEndOfFile (hFile=0x1f8) returned 1 [0114.616] CloseHandle (hObject=0x1f8) returned 1 [0114.616] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0114.616] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\thmbnail.png")) returned 1 [0114.617] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG") returned 75 [0114.617] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG") returned 75 [0114.617] lstrlenW (lpString=".doc") returned 4 [0114.617] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0114.617] lstrlenW (lpString=".docx") returned 5 [0114.617] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0114.617] lstrlenW (lpString=".pdf") returned 4 [0114.617] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0114.617] lstrlenW (lpString=".xls") returned 4 [0114.617] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0114.617] lstrlenW (lpString=".xlsx") returned 5 [0114.617] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0114.617] lstrlenW (lpString=".ppt") returned 4 [0114.617] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0114.617] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG") returned 75 [0114.617] lstrlenW (lpString=".zip") returned 4 [0114.617] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0114.617] lstrlenW (lpString=".rar") returned 4 [0114.617] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0114.617] lstrlenW (lpString=".bz2") returned 4 [0114.617] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0114.617] lstrlenW (lpString=".7z") returned 3 [0114.617] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0114.617] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG") returned 75 [0114.617] lstrlenW (lpString=".dbf") returned 4 [0114.617] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0114.617] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG") returned 75 [0114.617] lstrlenW (lpString=".1cd") returned 4 [0114.617] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0114.617] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG") returned 75 [0114.617] lstrlenW (lpString=".jpg") returned 4 [0114.617] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0114.617] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG") returned 75 [0114.617] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG") returned 75 [0114.618] lstrlenW (lpString=".doc") returned 4 [0114.618] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0114.618] lstrlenW (lpString=".docx") returned 5 [0114.618] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0114.618] lstrlenW (lpString=".pdf") returned 4 [0114.618] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0114.618] lstrlenW (lpString=".xls") returned 4 [0114.618] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0114.618] lstrlenW (lpString=".xlsx") returned 5 [0114.618] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0114.618] lstrlenW (lpString=".ppt") returned 4 [0114.618] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0114.618] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG") returned 75 [0114.618] lstrlenW (lpString=".zip") returned 4 [0114.618] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0114.618] lstrlenW (lpString=".rar") returned 4 [0114.618] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0114.618] lstrlenW (lpString=".bz2") returned 4 [0114.618] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0114.618] lstrlenW (lpString=".7z") returned 3 [0114.618] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0114.618] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG") returned 75 [0114.618] lstrlenW (lpString=".dbf") returned 4 [0114.618] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0114.618] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG") returned 75 [0114.618] lstrlenW (lpString=".1cd") returned 4 [0114.618] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0114.618] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG") returned 75 [0114.618] lstrlenW (lpString=".jpg") returned 4 [0114.618] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0114.618] lstrcmpiW (lpString1=".GIF", lpString2=".waifu") returned -1 [0114.618] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0114.619] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0114.620] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x326f8cc | out: lpFileSize=0x326f8cc*=1009) returned 1 [0114.620] CloseHandle (hObject=0x1f8) returned 1 [0114.620] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\preview.gif")) returned 0x20 [0114.621] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\preview.gif.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0114.621] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0114.621] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0114.621] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0114.621] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\preview.gif.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0114.622] GetLastError () returned 0x0 [0114.623] ReadFile (in: hFile=0x1f8, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0x3f1, lpOverlapped=0x0) returned 1 [0114.624] WriteFile (in: hFile=0x1d8, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0x400, lpOverlapped=0x0) returned 1 [0114.625] ReadFile (in: hFile=0x1f8, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0x0, lpOverlapped=0x0) returned 1 [0114.625] WriteFile (in: hFile=0x1d8, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0xea, lpOverlapped=0x0) returned 1 [0114.625] SetEndOfFile (hFile=0x1d8) returned 1 [0114.626] CloseHandle (hObject=0x1d8) returned 1 [0114.626] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0114.626] SetEndOfFile (hFile=0x1f8) returned 1 [0114.627] CloseHandle (hObject=0x1f8) returned 1 [0114.627] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0114.627] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\preview.gif")) returned 1 [0114.627] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF") returned 73 [0114.627] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF") returned 73 [0114.627] lstrlenW (lpString=".doc") returned 4 [0114.627] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0114.628] lstrlenW (lpString=".docx") returned 5 [0114.628] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0114.628] lstrlenW (lpString=".pdf") returned 4 [0114.628] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0114.628] lstrlenW (lpString=".xls") returned 4 [0114.628] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0114.628] lstrlenW (lpString=".xlsx") returned 5 [0114.628] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0114.628] lstrlenW (lpString=".ppt") returned 4 [0114.628] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0114.628] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF") returned 73 [0114.628] lstrlenW (lpString=".zip") returned 4 [0114.628] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0114.628] lstrlenW (lpString=".rar") returned 4 [0114.628] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0114.628] lstrlenW (lpString=".bz2") returned 4 [0114.628] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0114.628] lstrlenW (lpString=".7z") returned 3 [0114.628] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0114.628] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF") returned 73 [0114.628] lstrlenW (lpString=".dbf") returned 4 [0114.628] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0114.628] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF") returned 73 [0114.628] lstrlenW (lpString=".1cd") returned 4 [0114.628] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0114.628] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF") returned 73 [0114.628] lstrlenW (lpString=".jpg") returned 4 [0114.628] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0114.628] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF") returned 73 [0114.629] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF") returned 73 [0114.629] lstrlenW (lpString=".doc") returned 4 [0114.629] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0114.629] lstrlenW (lpString=".docx") returned 5 [0114.629] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0114.629] lstrlenW (lpString=".pdf") returned 4 [0114.629] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0114.629] lstrlenW (lpString=".xls") returned 4 [0114.629] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0114.629] lstrlenW (lpString=".xlsx") returned 5 [0114.629] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0114.629] lstrlenW (lpString=".ppt") returned 4 [0114.629] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0114.629] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF") returned 73 [0114.629] lstrlenW (lpString=".zip") returned 4 [0114.629] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0114.629] lstrlenW (lpString=".rar") returned 4 [0114.629] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0114.629] lstrlenW (lpString=".bz2") returned 4 [0114.629] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0114.629] lstrlenW (lpString=".7z") returned 3 [0114.629] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0114.629] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF") returned 73 [0114.629] lstrlenW (lpString=".dbf") returned 4 [0114.629] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0114.629] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF") returned 73 [0114.629] lstrlenW (lpString=".1cd") returned 4 [0114.629] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0114.629] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF") returned 73 [0114.629] lstrlenW (lpString=".jpg") returned 4 [0114.629] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0114.629] lstrcmpiW (lpString1=".PNG", lpString2=".waifu") returned -1 [0114.630] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0114.630] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0114.630] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x326f8cc | out: lpFileSize=0x326f8cc*=27177) returned 1 [0114.630] CloseHandle (hObject=0x1f8) returned 1 [0114.630] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\thmbnail.png")) returned 0x20 [0114.630] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\thmbnail.png.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0114.630] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0114.630] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0114.630] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0114.631] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\thmbnail.png.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0114.631] GetLastError () returned 0x0 [0114.631] ReadFile (in: hFile=0x1f8, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0x6a29, lpOverlapped=0x0) returned 1 [0114.633] WriteFile (in: hFile=0x1d8, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0x6a30, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0x6a30, lpOverlapped=0x0) returned 1 [0114.634] ReadFile (in: hFile=0x1f8, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0x0, lpOverlapped=0x0) returned 1 [0114.634] WriteFile (in: hFile=0x1d8, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0xec, lpOverlapped=0x0) returned 1 [0114.634] SetEndOfFile (hFile=0x1d8) returned 1 [0114.634] CloseHandle (hObject=0x1d8) returned 1 [0114.635] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0114.635] SetEndOfFile (hFile=0x1f8) returned 1 [0114.635] CloseHandle (hObject=0x1f8) returned 1 [0114.636] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0114.636] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\thmbnail.png")) returned 1 [0114.636] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG") returned 74 [0114.636] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG") returned 74 [0114.636] lstrlenW (lpString=".doc") returned 4 [0114.636] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0114.636] lstrlenW (lpString=".docx") returned 5 [0114.636] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0114.636] lstrlenW (lpString=".pdf") returned 4 [0114.637] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0114.637] lstrlenW (lpString=".xls") returned 4 [0114.637] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0114.637] lstrlenW (lpString=".xlsx") returned 5 [0114.637] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0114.637] lstrlenW (lpString=".ppt") returned 4 [0114.637] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0114.637] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG") returned 74 [0114.637] lstrlenW (lpString=".zip") returned 4 [0114.637] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0114.637] lstrlenW (lpString=".rar") returned 4 [0114.637] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0114.637] lstrlenW (lpString=".bz2") returned 4 [0114.637] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0114.637] lstrlenW (lpString=".7z") returned 3 [0114.637] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0114.637] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG") returned 74 [0114.637] lstrlenW (lpString=".dbf") returned 4 [0114.637] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0114.637] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG") returned 74 [0114.637] lstrlenW (lpString=".1cd") returned 4 [0114.637] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0114.637] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG") returned 74 [0114.637] lstrlenW (lpString=".jpg") returned 4 [0114.637] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0114.637] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG") returned 74 [0114.637] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG") returned 74 [0114.637] lstrlenW (lpString=".doc") returned 4 [0114.637] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0114.637] lstrlenW (lpString=".docx") returned 5 [0114.637] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0114.637] lstrlenW (lpString=".pdf") returned 4 [0114.637] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0114.637] lstrlenW (lpString=".xls") returned 4 [0114.637] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0114.637] lstrlenW (lpString=".xlsx") returned 5 [0114.637] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0114.638] lstrlenW (lpString=".ppt") returned 4 [0114.638] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0114.638] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG") returned 74 [0114.638] lstrlenW (lpString=".zip") returned 4 [0114.638] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0114.638] lstrlenW (lpString=".rar") returned 4 [0114.638] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0114.638] lstrlenW (lpString=".bz2") returned 4 [0114.638] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0114.638] lstrlenW (lpString=".7z") returned 3 [0114.638] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0114.638] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG") returned 74 [0114.638] lstrlenW (lpString=".dbf") returned 4 [0114.638] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0114.638] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG") returned 74 [0114.638] lstrlenW (lpString=".1cd") returned 4 [0114.638] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0114.638] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG") returned 74 [0114.638] lstrlenW (lpString=".jpg") returned 4 [0114.638] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0114.639] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0114.639] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0114.639] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\preview.gif.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0115.161] GetLastError () returned 0x0 [0115.161] ReadFile (in: hFile=0x1f8, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0x8a1, lpOverlapped=0x0) returned 1 [0115.162] WriteFile (in: hFile=0x20c, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0x8b0, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0x8b0, lpOverlapped=0x0) returned 1 [0115.163] ReadFile (in: hFile=0x1f8, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0x0, lpOverlapped=0x0) returned 1 [0115.163] WriteFile (in: hFile=0x20c, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0xea, lpOverlapped=0x0) returned 1 [0115.163] SetEndOfFile (hFile=0x20c) returned 1 [0115.163] CloseHandle (hObject=0x20c) returned 1 [0115.163] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0115.163] SetEndOfFile (hFile=0x1f8) returned 1 [0115.164] CloseHandle (hObject=0x1f8) returned 1 [0115.164] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0115.164] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\preview.gif")) returned 1 [0115.164] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF") returned 74 [0115.164] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF") returned 74 [0115.164] lstrlenW (lpString=".doc") returned 4 [0115.165] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0115.165] lstrlenW (lpString=".docx") returned 5 [0115.165] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0115.165] lstrlenW (lpString=".pdf") returned 4 [0115.165] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0115.165] lstrlenW (lpString=".xls") returned 4 [0115.165] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0115.165] lstrlenW (lpString=".xlsx") returned 5 [0115.165] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0115.165] lstrlenW (lpString=".ppt") returned 4 [0115.165] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0115.165] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF") returned 74 [0115.165] lstrlenW (lpString=".zip") returned 4 [0115.165] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0115.165] lstrlenW (lpString=".rar") returned 4 [0115.165] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0115.165] lstrlenW (lpString=".bz2") returned 4 [0115.165] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0115.165] lstrlenW (lpString=".7z") returned 3 [0115.165] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0115.165] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF") returned 74 [0115.165] lstrlenW (lpString=".dbf") returned 4 [0115.165] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0115.165] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF") returned 74 [0115.165] lstrlenW (lpString=".1cd") returned 4 [0115.165] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0115.165] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF") returned 74 [0115.165] lstrlenW (lpString=".jpg") returned 4 [0115.165] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0115.165] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0115.165] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0115.165] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\preview.gif.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0115.167] GetLastError () returned 0x0 [0115.167] ReadFile (in: hFile=0x1f8, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0x137f, lpOverlapped=0x0) returned 1 [0115.168] WriteFile (in: hFile=0x20c, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0x1380, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0x1380, lpOverlapped=0x0) returned 1 [0115.168] ReadFile (in: hFile=0x1f8, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0x0, lpOverlapped=0x0) returned 1 [0115.168] WriteFile (in: hFile=0x20c, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0xea, lpOverlapped=0x0) returned 1 [0115.168] SetEndOfFile (hFile=0x20c) returned 1 [0115.169] CloseHandle (hObject=0x20c) returned 1 [0115.169] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0115.169] SetEndOfFile (hFile=0x1f8) returned 1 [0115.169] CloseHandle (hObject=0x1f8) returned 1 [0115.169] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0115.170] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\preview.gif")) returned 1 [0115.170] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF") returned 76 [0115.170] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF") returned 76 [0115.170] lstrlenW (lpString=".doc") returned 4 [0115.170] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0115.170] lstrlenW (lpString=".docx") returned 5 [0115.170] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0115.170] lstrlenW (lpString=".pdf") returned 4 [0115.170] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0115.170] lstrlenW (lpString=".xls") returned 4 [0115.170] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0115.170] lstrlenW (lpString=".xlsx") returned 5 [0115.170] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0115.170] lstrlenW (lpString=".ppt") returned 4 [0115.170] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0115.170] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF") returned 76 [0115.170] lstrlenW (lpString=".zip") returned 4 [0115.170] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0115.170] lstrlenW (lpString=".rar") returned 4 [0115.170] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0115.170] lstrlenW (lpString=".bz2") returned 4 [0115.170] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0115.170] lstrlenW (lpString=".7z") returned 3 [0115.170] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0115.170] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF") returned 76 [0115.170] lstrlenW (lpString=".dbf") returned 4 [0115.170] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0115.170] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF") returned 76 [0115.170] lstrlenW (lpString=".1cd") returned 4 [0115.170] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0115.170] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF") returned 76 [0115.170] lstrlenW (lpString=".jpg") returned 4 [0115.171] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0115.171] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x326f8cc | out: lpFileSize=0x326f8cc*=44302) returned 1 [0115.171] CloseHandle (hObject=0x1f8) returned 1 [0115.171] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\thmbnail.png")) returned 0x20 [0115.171] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\thmbnail.png.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0115.171] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0115.171] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0115.171] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0115.171] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\thmbnail.png.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0115.172] GetLastError () returned 0x0 [0115.172] ReadFile (in: hFile=0x1f8, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0xad0e, lpOverlapped=0x0) returned 1 [0115.173] WriteFile (in: hFile=0x20c, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xad10, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0xad10, lpOverlapped=0x0) returned 1 [0115.174] ReadFile (in: hFile=0x1f8, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0x0, lpOverlapped=0x0) returned 1 [0115.174] WriteFile (in: hFile=0x20c, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0xec, lpOverlapped=0x0) returned 1 [0115.174] SetEndOfFile (hFile=0x20c) returned 1 [0115.174] CloseHandle (hObject=0x20c) returned 1 [0115.174] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0115.174] SetEndOfFile (hFile=0x1f8) returned 1 [0115.175] CloseHandle (hObject=0x1f8) returned 1 [0115.175] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0115.175] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\thmbnail.png")) returned 1 [0115.175] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG") returned 77 [0115.175] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG") returned 77 [0115.175] lstrlenW (lpString=".doc") returned 4 [0115.175] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0115.175] lstrlenW (lpString=".docx") returned 5 [0115.175] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0115.175] lstrlenW (lpString=".pdf") returned 4 [0115.175] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0115.175] lstrlenW (lpString=".xls") returned 4 [0115.175] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0115.175] lstrlenW (lpString=".xlsx") returned 5 [0115.175] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0115.175] lstrlenW (lpString=".ppt") returned 4 [0115.175] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0115.176] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG") returned 77 [0115.176] lstrlenW (lpString=".zip") returned 4 [0115.176] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0115.176] lstrlenW (lpString=".rar") returned 4 [0115.176] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0115.176] lstrlenW (lpString=".bz2") returned 4 [0115.176] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0115.176] lstrlenW (lpString=".7z") returned 3 [0115.176] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0115.176] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG") returned 77 [0115.176] lstrlenW (lpString=".dbf") returned 4 [0115.176] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0115.176] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG") returned 77 [0115.176] lstrlenW (lpString=".1cd") returned 4 [0115.176] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0115.176] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG") returned 77 [0115.176] lstrlenW (lpString=".jpg") returned 4 [0115.176] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0115.176] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0115.176] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0115.176] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\preview.gif.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0115.414] GetLastError () returned 0x0 [0115.414] ReadFile (in: hFile=0x1f8, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0xa6c, lpOverlapped=0x0) returned 1 [0115.415] WriteFile (in: hFile=0x1f0, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xa70, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0xa70, lpOverlapped=0x0) returned 1 [0115.416] ReadFile (in: hFile=0x1f8, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0x0, lpOverlapped=0x0) returned 1 [0115.416] WriteFile (in: hFile=0x1f0, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0xea, lpOverlapped=0x0) returned 1 [0115.416] SetEndOfFile (hFile=0x1f0) returned 1 [0115.416] CloseHandle (hObject=0x1f0) returned 1 [0115.416] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0115.416] SetEndOfFile (hFile=0x1f8) returned 1 [0115.417] CloseHandle (hObject=0x1f8) returned 1 [0115.417] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0115.417] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\preview.gif")) returned 1 [0115.417] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF") returned 73 [0115.418] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF") returned 73 [0115.418] lstrlenW (lpString=".doc") returned 4 [0115.418] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0115.418] lstrlenW (lpString=".docx") returned 5 [0115.418] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0115.418] lstrlenW (lpString=".pdf") returned 4 [0115.418] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0115.418] lstrlenW (lpString=".xls") returned 4 [0115.418] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0115.418] lstrlenW (lpString=".xlsx") returned 5 [0115.418] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0115.418] lstrlenW (lpString=".ppt") returned 4 [0115.418] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0115.418] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF") returned 73 [0115.418] lstrlenW (lpString=".zip") returned 4 [0115.418] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0115.418] lstrlenW (lpString=".rar") returned 4 [0115.418] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0115.418] lstrlenW (lpString=".bz2") returned 4 [0115.418] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0115.418] lstrlenW (lpString=".7z") returned 3 [0115.418] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0115.418] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF") returned 73 [0115.418] lstrlenW (lpString=".dbf") returned 4 [0115.418] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0115.418] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF") returned 73 [0115.418] lstrlenW (lpString=".1cd") returned 4 [0115.418] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0115.418] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF") returned 73 [0115.418] lstrlenW (lpString=".jpg") returned 4 [0115.418] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0116.494] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmainbackground.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground.wmv.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmainbackground.wmv.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0 [0116.494] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground.wmv") returned 75 [0116.494] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground.wmv") returned 75 [0116.494] lstrlenW (lpString=".doc") returned 4 [0116.494] lstrcmpiW (lpString1=".doc", lpString2=".wmv") returned -1 [0116.494] lstrlenW (lpString=".docx") returned 5 [0116.494] lstrcmpiW (lpString1=".docx", lpString2="d.wmv") returned -1 [0116.495] lstrlenW (lpString=".pdf") returned 4 [0116.495] lstrcmpiW (lpString1=".pdf", lpString2=".wmv") returned -1 [0116.495] lstrlenW (lpString=".xls") returned 4 [0116.495] lstrcmpiW (lpString1=".xls", lpString2=".wmv") returned 1 [0116.495] lstrlenW (lpString=".xlsx") returned 5 [0116.495] lstrcmpiW (lpString1=".xlsx", lpString2="d.wmv") returned -1 [0116.495] lstrlenW (lpString=".ppt") returned 4 [0116.495] lstrcmpiW (lpString1=".ppt", lpString2=".wmv") returned -1 [0116.495] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground.wmv") returned 75 [0116.495] lstrlenW (lpString=".zip") returned 4 [0116.495] lstrcmpiW (lpString1=".zip", lpString2=".wmv") returned 1 [0116.495] lstrlenW (lpString=".rar") returned 4 [0116.495] lstrcmpiW (lpString1=".rar", lpString2=".wmv") returned -1 [0116.495] lstrlenW (lpString=".bz2") returned 4 [0116.495] lstrcmpiW (lpString1=".bz2", lpString2=".wmv") returned -1 [0116.495] lstrlenW (lpString=".7z") returned 3 [0116.495] lstrcmpiW (lpString1=".7z", lpString2="wmv") returned -1 [0116.495] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground.wmv") returned 75 [0116.495] lstrlenW (lpString=".dbf") returned 4 [0116.495] lstrcmpiW (lpString1=".dbf", lpString2=".wmv") returned -1 [0116.495] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground.wmv") returned 75 [0116.495] lstrlenW (lpString=".1cd") returned 4 [0116.495] lstrcmpiW (lpString1=".1cd", lpString2=".wmv") returned -1 [0116.495] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground.wmv") returned 75 [0116.495] lstrlenW (lpString=".jpg") returned 4 [0116.495] lstrcmpiW (lpString1=".jpg", lpString2=".wmv") returned -1 [0116.495] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmainbackground_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground_PAL.wmv.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmainbackground_pal.wmv.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0 [0116.495] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground_PAL.wmv") returned 79 [0116.495] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground_PAL.wmv") returned 79 [0116.495] lstrlenW (lpString=".doc") returned 4 [0116.495] lstrcmpiW (lpString1=".doc", lpString2=".wmv") returned -1 [0116.495] lstrlenW (lpString=".docx") returned 5 [0116.495] lstrcmpiW (lpString1=".docx", lpString2="L.wmv") returned -1 [0116.495] lstrlenW (lpString=".pdf") returned 4 [0116.495] lstrcmpiW (lpString1=".pdf", lpString2=".wmv") returned -1 [0116.495] lstrlenW (lpString=".xls") returned 4 [0116.495] lstrcmpiW (lpString1=".xls", lpString2=".wmv") returned 1 [0116.496] lstrlenW (lpString=".xlsx") returned 5 [0116.496] lstrcmpiW (lpString1=".xlsx", lpString2="L.wmv") returned -1 [0116.496] lstrlenW (lpString=".ppt") returned 4 [0116.496] lstrcmpiW (lpString1=".ppt", lpString2=".wmv") returned -1 [0116.496] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground_PAL.wmv") returned 79 [0116.496] lstrlenW (lpString=".zip") returned 4 [0116.496] lstrcmpiW (lpString1=".zip", lpString2=".wmv") returned 1 [0116.496] lstrlenW (lpString=".rar") returned 4 [0116.496] lstrcmpiW (lpString1=".rar", lpString2=".wmv") returned -1 [0116.496] lstrlenW (lpString=".bz2") returned 4 [0116.496] lstrcmpiW (lpString1=".bz2", lpString2=".wmv") returned -1 [0116.496] lstrlenW (lpString=".7z") returned 3 [0116.496] lstrcmpiW (lpString1=".7z", lpString2="wmv") returned -1 [0116.496] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground_PAL.wmv") returned 79 [0116.496] lstrlenW (lpString=".dbf") returned 4 [0116.496] lstrcmpiW (lpString1=".dbf", lpString2=".wmv") returned -1 [0116.496] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground_PAL.wmv") returned 79 [0116.496] lstrlenW (lpString=".1cd") returned 4 [0116.496] lstrcmpiW (lpString1=".1cd", lpString2=".wmv") returned -1 [0116.496] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground_PAL.wmv") returned 79 [0116.496] lstrlenW (lpString=".jpg") returned 4 [0116.496] lstrcmpiW (lpString1=".jpg", lpString2=".wmv") returned -1 [0116.496] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintonotesbackground.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground.wmv.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintonotesbackground.wmv.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0 [0116.496] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground.wmv") returned 82 [0116.496] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground.wmv") returned 82 [0116.496] lstrlenW (lpString=".doc") returned 4 [0116.496] lstrcmpiW (lpString1=".doc", lpString2=".wmv") returned -1 [0116.496] lstrlenW (lpString=".docx") returned 5 [0116.496] lstrcmpiW (lpString1=".docx", lpString2="d.wmv") returned -1 [0116.496] lstrlenW (lpString=".pdf") returned 4 [0116.496] lstrcmpiW (lpString1=".pdf", lpString2=".wmv") returned -1 [0116.496] lstrlenW (lpString=".xls") returned 4 [0116.496] lstrcmpiW (lpString1=".xls", lpString2=".wmv") returned 1 [0116.496] lstrlenW (lpString=".xlsx") returned 5 [0116.496] lstrcmpiW (lpString1=".xlsx", lpString2="d.wmv") returned -1 [0116.496] lstrlenW (lpString=".ppt") returned 4 [0116.496] lstrcmpiW (lpString1=".ppt", lpString2=".wmv") returned -1 [0116.497] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground.wmv") returned 82 [0116.497] lstrlenW (lpString=".zip") returned 4 [0116.497] lstrcmpiW (lpString1=".zip", lpString2=".wmv") returned 1 [0116.497] lstrlenW (lpString=".rar") returned 4 [0116.497] lstrcmpiW (lpString1=".rar", lpString2=".wmv") returned -1 [0116.497] lstrlenW (lpString=".bz2") returned 4 [0116.497] lstrcmpiW (lpString1=".bz2", lpString2=".wmv") returned -1 [0116.497] lstrlenW (lpString=".7z") returned 3 [0116.497] lstrcmpiW (lpString1=".7z", lpString2="wmv") returned -1 [0116.497] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground.wmv") returned 82 [0116.497] lstrlenW (lpString=".dbf") returned 4 [0116.497] lstrcmpiW (lpString1=".dbf", lpString2=".wmv") returned -1 [0116.497] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground.wmv") returned 82 [0116.497] lstrlenW (lpString=".1cd") returned 4 [0116.497] lstrcmpiW (lpString1=".1cd", lpString2=".wmv") returned -1 [0116.497] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground.wmv") returned 82 [0116.497] lstrlenW (lpString=".jpg") returned 4 [0116.497] lstrcmpiW (lpString1=".jpg", lpString2=".wmv") returned -1 [0116.497] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintonotesbackground_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground_PAL.wmv.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintonotesbackground_pal.wmv.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0 [0116.498] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground_PAL.wmv") returned 86 [0116.498] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground_PAL.wmv") returned 86 [0116.498] lstrlenW (lpString=".doc") returned 4 [0116.498] lstrcmpiW (lpString1=".doc", lpString2=".wmv") returned -1 [0116.498] lstrlenW (lpString=".docx") returned 5 [0116.498] lstrcmpiW (lpString1=".docx", lpString2="L.wmv") returned -1 [0116.498] lstrlenW (lpString=".pdf") returned 4 [0116.498] lstrcmpiW (lpString1=".pdf", lpString2=".wmv") returned -1 [0116.498] lstrlenW (lpString=".xls") returned 4 [0116.498] lstrcmpiW (lpString1=".xls", lpString2=".wmv") returned 1 [0116.498] lstrlenW (lpString=".xlsx") returned 5 [0116.498] lstrcmpiW (lpString1=".xlsx", lpString2="L.wmv") returned -1 [0116.498] lstrlenW (lpString=".ppt") returned 4 [0116.498] lstrcmpiW (lpString1=".ppt", lpString2=".wmv") returned -1 [0116.498] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground_PAL.wmv") returned 86 [0116.498] lstrlenW (lpString=".zip") returned 4 [0116.498] lstrcmpiW (lpString1=".zip", lpString2=".wmv") returned 1 [0116.498] lstrlenW (lpString=".rar") returned 4 [0116.498] lstrcmpiW (lpString1=".rar", lpString2=".wmv") returned -1 [0116.498] lstrlenW (lpString=".bz2") returned 4 [0116.498] lstrcmpiW (lpString1=".bz2", lpString2=".wmv") returned -1 [0116.498] lstrlenW (lpString=".7z") returned 3 [0116.498] lstrcmpiW (lpString1=".7z", lpString2="wmv") returned -1 [0116.498] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground_PAL.wmv") returned 86 [0116.498] lstrlenW (lpString=".dbf") returned 4 [0116.498] lstrcmpiW (lpString1=".dbf", lpString2=".wmv") returned -1 [0116.498] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground_PAL.wmv") returned 86 [0116.498] lstrlenW (lpString=".1cd") returned 4 [0116.498] lstrcmpiW (lpString1=".1cd", lpString2=".wmv") returned -1 [0116.498] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground_PAL.wmv") returned 86 [0116.498] lstrlenW (lpString=".jpg") returned 4 [0116.498] lstrcmpiW (lpString1=".jpg", lpString2=".wmv") returned -1 [0116.500] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintoscenesbackground.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground.wmv.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintoscenesbackground.wmv.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0 [0116.500] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground.wmv") returned 83 [0116.500] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground.wmv") returned 83 [0116.500] lstrlenW (lpString=".doc") returned 4 [0116.500] lstrcmpiW (lpString1=".doc", lpString2=".wmv") returned -1 [0116.500] lstrlenW (lpString=".docx") returned 5 [0116.500] lstrcmpiW (lpString1=".docx", lpString2="d.wmv") returned -1 [0116.500] lstrlenW (lpString=".pdf") returned 4 [0116.500] lstrcmpiW (lpString1=".pdf", lpString2=".wmv") returned -1 [0116.500] lstrlenW (lpString=".xls") returned 4 [0116.500] lstrcmpiW (lpString1=".xls", lpString2=".wmv") returned 1 [0116.500] lstrlenW (lpString=".xlsx") returned 5 [0116.500] lstrcmpiW (lpString1=".xlsx", lpString2="d.wmv") returned -1 [0116.500] lstrlenW (lpString=".ppt") returned 4 [0116.500] lstrcmpiW (lpString1=".ppt", lpString2=".wmv") returned -1 [0116.500] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground.wmv") returned 83 [0116.500] lstrlenW (lpString=".zip") returned 4 [0116.500] lstrcmpiW (lpString1=".zip", lpString2=".wmv") returned 1 [0116.500] lstrlenW (lpString=".rar") returned 4 [0116.500] lstrcmpiW (lpString1=".rar", lpString2=".wmv") returned -1 [0116.500] lstrlenW (lpString=".bz2") returned 4 [0116.500] lstrcmpiW (lpString1=".bz2", lpString2=".wmv") returned -1 [0116.500] lstrlenW (lpString=".7z") returned 3 [0116.500] lstrcmpiW (lpString1=".7z", lpString2="wmv") returned -1 [0116.501] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground.wmv") returned 83 [0116.501] lstrlenW (lpString=".dbf") returned 4 [0116.501] lstrcmpiW (lpString1=".dbf", lpString2=".wmv") returned -1 [0116.501] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground.wmv") returned 83 [0116.501] lstrlenW (lpString=".1cd") returned 4 [0116.501] lstrcmpiW (lpString1=".1cd", lpString2=".wmv") returned -1 [0116.501] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground.wmv") returned 83 [0116.501] lstrlenW (lpString=".jpg") returned 4 [0116.501] lstrcmpiW (lpString1=".jpg", lpString2=".wmv") returned -1 [0116.501] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintoscenesbackground_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground_PAL.wmv.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintoscenesbackground_pal.wmv.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0 [0116.501] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground_PAL.wmv") returned 87 [0116.501] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground_PAL.wmv") returned 87 [0116.501] lstrlenW (lpString=".doc") returned 4 [0116.501] lstrcmpiW (lpString1=".doc", lpString2=".wmv") returned -1 [0116.501] lstrlenW (lpString=".docx") returned 5 [0116.501] lstrcmpiW (lpString1=".docx", lpString2="L.wmv") returned -1 [0116.501] lstrlenW (lpString=".pdf") returned 4 [0116.501] lstrcmpiW (lpString1=".pdf", lpString2=".wmv") returned -1 [0116.501] lstrlenW (lpString=".xls") returned 4 [0116.501] lstrcmpiW (lpString1=".xls", lpString2=".wmv") returned 1 [0116.501] lstrlenW (lpString=".xlsx") returned 5 [0116.501] lstrcmpiW (lpString1=".xlsx", lpString2="L.wmv") returned -1 [0116.501] lstrlenW (lpString=".ppt") returned 4 [0116.501] lstrcmpiW (lpString1=".ppt", lpString2=".wmv") returned -1 [0116.501] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground_PAL.wmv") returned 87 [0116.501] lstrlenW (lpString=".zip") returned 4 [0116.501] lstrcmpiW (lpString1=".zip", lpString2=".wmv") returned 1 [0116.501] lstrlenW (lpString=".rar") returned 4 [0116.501] lstrcmpiW (lpString1=".rar", lpString2=".wmv") returned -1 [0116.501] lstrlenW (lpString=".bz2") returned 4 [0116.501] lstrcmpiW (lpString1=".bz2", lpString2=".wmv") returned -1 [0116.501] lstrlenW (lpString=".7z") returned 3 [0116.501] lstrcmpiW (lpString1=".7z", lpString2="wmv") returned -1 [0116.501] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground_PAL.wmv") returned 87 [0116.501] lstrlenW (lpString=".dbf") returned 4 [0116.501] lstrcmpiW (lpString1=".dbf", lpString2=".wmv") returned -1 [0116.502] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground_PAL.wmv") returned 87 [0116.502] lstrlenW (lpString=".1cd") returned 4 [0116.502] lstrcmpiW (lpString1=".1cd", lpString2=".wmv") returned -1 [0116.502] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground_PAL.wmv") returned 87 [0116.502] lstrlenW (lpString=".jpg") returned 4 [0116.502] lstrcmpiW (lpString1=".jpg", lpString2=".wmv") returned -1 [0116.502] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsnotesbackground.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground.wmv.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsnotesbackground.wmv.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0 [0116.502] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground.wmv") returned 76 [0116.502] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground.wmv") returned 76 [0116.502] lstrlenW (lpString=".doc") returned 4 [0116.502] lstrcmpiW (lpString1=".doc", lpString2=".wmv") returned -1 [0116.502] lstrlenW (lpString=".docx") returned 5 [0116.502] lstrcmpiW (lpString1=".docx", lpString2="d.wmv") returned -1 [0116.502] lstrlenW (lpString=".pdf") returned 4 [0116.502] lstrcmpiW (lpString1=".pdf", lpString2=".wmv") returned -1 [0116.502] lstrlenW (lpString=".xls") returned 4 [0116.502] lstrcmpiW (lpString1=".xls", lpString2=".wmv") returned 1 [0116.502] lstrlenW (lpString=".xlsx") returned 5 [0116.502] lstrcmpiW (lpString1=".xlsx", lpString2="d.wmv") returned -1 [0116.502] lstrlenW (lpString=".ppt") returned 4 [0116.502] lstrcmpiW (lpString1=".ppt", lpString2=".wmv") returned -1 [0116.502] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground.wmv") returned 76 [0116.502] lstrlenW (lpString=".zip") returned 4 [0116.502] lstrcmpiW (lpString1=".zip", lpString2=".wmv") returned 1 [0116.502] lstrlenW (lpString=".rar") returned 4 [0116.502] lstrcmpiW (lpString1=".rar", lpString2=".wmv") returned -1 [0116.502] lstrlenW (lpString=".bz2") returned 4 [0116.502] lstrcmpiW (lpString1=".bz2", lpString2=".wmv") returned -1 [0116.502] lstrlenW (lpString=".7z") returned 3 [0116.502] lstrcmpiW (lpString1=".7z", lpString2="wmv") returned -1 [0116.502] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground.wmv") returned 76 [0116.502] lstrlenW (lpString=".dbf") returned 4 [0116.502] lstrcmpiW (lpString1=".dbf", lpString2=".wmv") returned -1 [0116.502] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground.wmv") returned 76 [0116.502] lstrlenW (lpString=".1cd") returned 4 [0116.502] lstrcmpiW (lpString1=".1cd", lpString2=".wmv") returned -1 [0116.502] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground.wmv") returned 76 [0116.503] lstrlenW (lpString=".jpg") returned 4 [0116.503] lstrcmpiW (lpString1=".jpg", lpString2=".wmv") returned -1 [0116.503] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsnotesbackground_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground_PAL.wmv.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsnotesbackground_pal.wmv.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0 [0116.503] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground_PAL.wmv") returned 80 [0116.503] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground_PAL.wmv") returned 80 [0116.503] lstrlenW (lpString=".doc") returned 4 [0116.503] lstrcmpiW (lpString1=".doc", lpString2=".wmv") returned -1 [0116.503] lstrlenW (lpString=".docx") returned 5 [0116.503] lstrcmpiW (lpString1=".docx", lpString2="L.wmv") returned -1 [0116.504] lstrlenW (lpString=".pdf") returned 4 [0116.504] lstrcmpiW (lpString1=".pdf", lpString2=".wmv") returned -1 [0116.504] lstrlenW (lpString=".xls") returned 4 [0116.504] lstrcmpiW (lpString1=".xls", lpString2=".wmv") returned 1 [0116.504] lstrlenW (lpString=".xlsx") returned 5 [0116.504] lstrcmpiW (lpString1=".xlsx", lpString2="L.wmv") returned -1 [0116.504] lstrlenW (lpString=".ppt") returned 4 [0116.504] lstrcmpiW (lpString1=".ppt", lpString2=".wmv") returned -1 [0116.504] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground_PAL.wmv") returned 80 [0116.504] lstrlenW (lpString=".zip") returned 4 [0116.504] lstrcmpiW (lpString1=".zip", lpString2=".wmv") returned 1 [0116.504] lstrlenW (lpString=".rar") returned 4 [0116.504] lstrcmpiW (lpString1=".rar", lpString2=".wmv") returned -1 [0116.504] lstrlenW (lpString=".bz2") returned 4 [0116.504] lstrcmpiW (lpString1=".bz2", lpString2=".wmv") returned -1 [0116.504] lstrlenW (lpString=".7z") returned 3 [0116.504] lstrcmpiW (lpString1=".7z", lpString2="wmv") returned -1 [0116.504] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground_PAL.wmv") returned 80 [0116.504] lstrlenW (lpString=".dbf") returned 4 [0116.504] lstrcmpiW (lpString1=".dbf", lpString2=".wmv") returned -1 [0116.504] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground_PAL.wmv") returned 80 [0116.504] lstrlenW (lpString=".1cd") returned 4 [0116.504] lstrcmpiW (lpString1=".1cd", lpString2=".wmv") returned -1 [0116.504] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground_PAL.wmv") returned 80 [0116.504] lstrlenW (lpString=".jpg") returned 4 [0116.504] lstrcmpiW (lpString1=".jpg", lpString2=".wmv") returned -1 [0116.504] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsscenesbackground.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground.wmv.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsscenesbackground.wmv.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0 [0116.504] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground.wmv") returned 77 [0116.504] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground.wmv") returned 77 [0116.504] lstrlenW (lpString=".doc") returned 4 [0116.504] lstrcmpiW (lpString1=".doc", lpString2=".wmv") returned -1 [0116.504] lstrlenW (lpString=".docx") returned 5 [0116.504] lstrcmpiW (lpString1=".docx", lpString2="d.wmv") returned -1 [0116.504] lstrlenW (lpString=".pdf") returned 4 [0116.504] lstrcmpiW (lpString1=".pdf", lpString2=".wmv") returned -1 [0116.504] lstrlenW (lpString=".xls") returned 4 [0116.505] lstrcmpiW (lpString1=".xls", lpString2=".wmv") returned 1 [0116.505] lstrlenW (lpString=".xlsx") returned 5 [0116.505] lstrcmpiW (lpString1=".xlsx", lpString2="d.wmv") returned -1 [0116.505] lstrlenW (lpString=".ppt") returned 4 [0116.505] lstrcmpiW (lpString1=".ppt", lpString2=".wmv") returned -1 [0116.505] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground.wmv") returned 77 [0116.505] lstrlenW (lpString=".zip") returned 4 [0116.505] lstrcmpiW (lpString1=".zip", lpString2=".wmv") returned 1 [0116.505] lstrlenW (lpString=".rar") returned 4 [0116.505] lstrcmpiW (lpString1=".rar", lpString2=".wmv") returned -1 [0116.505] lstrlenW (lpString=".bz2") returned 4 [0116.505] lstrcmpiW (lpString1=".bz2", lpString2=".wmv") returned -1 [0116.505] lstrlenW (lpString=".7z") returned 3 [0116.505] lstrcmpiW (lpString1=".7z", lpString2="wmv") returned -1 [0116.505] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground.wmv") returned 77 [0116.505] lstrlenW (lpString=".dbf") returned 4 [0116.505] lstrcmpiW (lpString1=".dbf", lpString2=".wmv") returned -1 [0116.505] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground.wmv") returned 77 [0116.505] lstrlenW (lpString=".1cd") returned 4 [0116.505] lstrcmpiW (lpString1=".1cd", lpString2=".wmv") returned -1 [0116.505] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground.wmv") returned 77 [0116.505] lstrlenW (lpString=".jpg") returned 4 [0116.505] lstrcmpiW (lpString1=".jpg", lpString2=".wmv") returned -1 [0116.505] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsscenesbackground_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground_PAL.wmv.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsscenesbackground_pal.wmv.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0 [0116.505] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground_PAL.wmv") returned 81 [0116.505] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground_PAL.wmv") returned 81 [0116.505] lstrlenW (lpString=".doc") returned 4 [0116.505] lstrcmpiW (lpString1=".doc", lpString2=".wmv") returned -1 [0116.505] lstrlenW (lpString=".docx") returned 5 [0116.505] lstrcmpiW (lpString1=".docx", lpString2="L.wmv") returned -1 [0116.505] lstrlenW (lpString=".pdf") returned 4 [0116.505] lstrcmpiW (lpString1=".pdf", lpString2=".wmv") returned -1 [0116.505] lstrlenW (lpString=".xls") returned 4 [0116.505] lstrcmpiW (lpString1=".xls", lpString2=".wmv") returned 1 [0116.505] lstrlenW (lpString=".xlsx") returned 5 [0116.505] lstrcmpiW (lpString1=".xlsx", lpString2="L.wmv") returned -1 [0116.505] lstrlenW (lpString=".ppt") returned 4 [0116.506] lstrcmpiW (lpString1=".ppt", lpString2=".wmv") returned -1 [0116.506] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground_PAL.wmv") returned 81 [0116.506] lstrlenW (lpString=".zip") returned 4 [0116.506] lstrcmpiW (lpString1=".zip", lpString2=".wmv") returned 1 [0116.506] lstrlenW (lpString=".rar") returned 4 [0116.506] lstrcmpiW (lpString1=".rar", lpString2=".wmv") returned -1 [0116.506] lstrlenW (lpString=".bz2") returned 4 [0116.506] lstrcmpiW (lpString1=".bz2", lpString2=".wmv") returned -1 [0116.506] lstrlenW (lpString=".7z") returned 3 [0116.506] lstrcmpiW (lpString1=".7z", lpString2="wmv") returned -1 [0116.506] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground_PAL.wmv") returned 81 [0116.506] lstrlenW (lpString=".dbf") returned 4 [0116.506] lstrcmpiW (lpString1=".dbf", lpString2=".wmv") returned -1 [0116.506] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground_PAL.wmv") returned 81 [0116.506] lstrlenW (lpString=".1cd") returned 4 [0116.506] lstrcmpiW (lpString1=".1cd", lpString2=".wmv") returned -1 [0116.506] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground_PAL.wmv") returned 81 [0116.506] lstrlenW (lpString=".jpg") returned 4 [0116.506] lstrcmpiW (lpString1=".jpg", lpString2=".wmv") returned -1 [0116.820] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0116.820] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0116.820] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\msjet.xsl.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0116.820] GetLastError () returned 0x0 [0116.820] ReadFile (in: hFile=0x1d8, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0x712e, lpOverlapped=0x0) returned 1 [0116.835] WriteFile (in: hFile=0x1fc, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0x7130, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0x7130, lpOverlapped=0x0) returned 1 [0116.835] ReadFile (in: hFile=0x1d8, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0x0, lpOverlapped=0x0) returned 1 [0116.835] WriteFile (in: hFile=0x1fc, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0xe6, lpOverlapped=0x0) returned 1 [0116.836] SetEndOfFile (hFile=0x1fc) returned 1 [0116.836] CloseHandle (hObject=0x1fc) returned 1 [0116.836] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0116.836] SetEndOfFile (hFile=0x1d8) returned 1 [0116.837] CloseHandle (hObject=0x1d8) returned 1 [0116.837] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0116.837] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\msjet.xsl")) returned 1 [0116.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl") returned 77 [0116.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl") returned 77 [0116.838] lstrlenW (lpString=".doc") returned 4 [0116.838] lstrcmpiW (lpString1=".doc", lpString2=".xsl") returned -1 [0116.838] lstrlenW (lpString=".docx") returned 5 [0116.838] lstrcmpiW (lpString1=".docx", lpString2="t.xsl") returned -1 [0116.838] lstrlenW (lpString=".pdf") returned 4 [0116.838] lstrcmpiW (lpString1=".pdf", lpString2=".xsl") returned -1 [0116.838] lstrlenW (lpString=".xls") returned 4 [0116.838] lstrcmpiW (lpString1=".xls", lpString2=".xsl") returned -1 [0116.838] lstrlenW (lpString=".xlsx") returned 5 [0116.838] lstrcmpiW (lpString1=".xlsx", lpString2="t.xsl") returned -1 [0116.838] lstrlenW (lpString=".ppt") returned 4 [0116.838] lstrcmpiW (lpString1=".ppt", lpString2=".xsl") returned -1 [0116.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl") returned 77 [0116.838] lstrlenW (lpString=".zip") returned 4 [0116.838] lstrcmpiW (lpString1=".zip", lpString2=".xsl") returned 1 [0116.838] lstrlenW (lpString=".rar") returned 4 [0116.838] lstrcmpiW (lpString1=".rar", lpString2=".xsl") returned -1 [0116.838] lstrlenW (lpString=".bz2") returned 4 [0116.838] lstrcmpiW (lpString1=".bz2", lpString2=".xsl") returned -1 [0116.838] lstrlenW (lpString=".7z") returned 3 [0116.838] lstrcmpiW (lpString1=".7z", lpString2="xsl") returned -1 [0116.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl") returned 77 [0116.838] lstrlenW (lpString=".dbf") returned 4 [0116.838] lstrcmpiW (lpString1=".dbf", lpString2=".xsl") returned -1 [0116.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl") returned 77 [0116.838] lstrlenW (lpString=".1cd") returned 4 [0116.838] lstrcmpiW (lpString1=".1cd", lpString2=".xsl") returned -1 [0116.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl") returned 77 [0116.838] lstrlenW (lpString=".jpg") returned 4 [0116.838] lstrcmpiW (lpString1=".jpg", lpString2=".xsl") returned -1 [0117.521] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x326f8cc | out: lpFileSize=0x326f8cc*=32146) returned 1 [0117.521] CloseHandle (hObject=0x19c) returned 1 [0117.521] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql70.xsl")) returned 0x20 [0117.521] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql70.xsl.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0117.521] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql70.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0117.521] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0117.521] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0117.521] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql70.xsl.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0117.521] GetLastError () returned 0x0 [0117.521] ReadFile (in: hFile=0x19c, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0x7d92, lpOverlapped=0x0) returned 1 [0117.564] WriteFile (in: hFile=0x1b0, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0x7da0, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0x7da0, lpOverlapped=0x0) returned 1 [0117.566] ReadFile (in: hFile=0x19c, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0x0, lpOverlapped=0x0) returned 1 [0117.566] WriteFile (in: hFile=0x1b0, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0xe6, lpOverlapped=0x0) returned 1 [0117.566] SetEndOfFile (hFile=0x1b0) returned 1 [0117.566] CloseHandle (hObject=0x1b0) returned 1 [0117.566] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0117.566] SetEndOfFile (hFile=0x19c) returned 1 [0117.567] CloseHandle (hObject=0x19c) returned 1 [0117.567] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0117.568] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql70.xsl")) returned 1 [0117.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl") returned 77 [0117.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl") returned 77 [0117.568] lstrlenW (lpString=".doc") returned 4 [0117.568] lstrcmpiW (lpString1=".doc", lpString2=".xsl") returned -1 [0117.568] lstrlenW (lpString=".docx") returned 5 [0117.568] lstrcmpiW (lpString1=".docx", lpString2="0.xsl") returned -1 [0117.568] lstrlenW (lpString=".pdf") returned 4 [0117.568] lstrcmpiW (lpString1=".pdf", lpString2=".xsl") returned -1 [0117.568] lstrlenW (lpString=".xls") returned 4 [0117.568] lstrcmpiW (lpString1=".xls", lpString2=".xsl") returned -1 [0117.568] lstrlenW (lpString=".xlsx") returned 5 [0117.568] lstrcmpiW (lpString1=".xlsx", lpString2="0.xsl") returned -1 [0117.568] lstrlenW (lpString=".ppt") returned 4 [0117.568] lstrcmpiW (lpString1=".ppt", lpString2=".xsl") returned -1 [0117.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl") returned 77 [0117.568] lstrlenW (lpString=".zip") returned 4 [0117.568] lstrcmpiW (lpString1=".zip", lpString2=".xsl") returned 1 [0117.568] lstrlenW (lpString=".rar") returned 4 [0117.568] lstrcmpiW (lpString1=".rar", lpString2=".xsl") returned -1 [0117.568] lstrlenW (lpString=".bz2") returned 4 [0117.569] lstrcmpiW (lpString1=".bz2", lpString2=".xsl") returned -1 [0117.569] lstrlenW (lpString=".7z") returned 3 [0117.569] lstrcmpiW (lpString1=".7z", lpString2="xsl") returned -1 [0117.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl") returned 77 [0117.569] lstrlenW (lpString=".dbf") returned 4 [0117.569] lstrcmpiW (lpString1=".dbf", lpString2=".xsl") returned -1 [0117.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl") returned 77 [0117.569] lstrlenW (lpString=".1cd") returned 4 [0117.569] lstrcmpiW (lpString1=".1cd", lpString2=".xsl") returned -1 [0117.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl") returned 77 [0117.569] lstrlenW (lpString=".jpg") returned 4 [0117.569] lstrcmpiW (lpString1=".jpg", lpString2=".xsl") returned -1 [0117.605] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0117.605] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0117.606] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00004_.gif.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0117.606] GetLastError () returned 0x0 [0117.606] ReadFile (in: hFile=0x1e4, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0x2340, lpOverlapped=0x0) returned 1 [0117.618] WriteFile (in: hFile=0x1fc, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0x2350, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0x2350, lpOverlapped=0x0) returned 1 [0117.619] ReadFile (in: hFile=0x1e4, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0x0, lpOverlapped=0x0) returned 1 [0117.619] WriteFile (in: hFile=0x1fc, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0xec, lpOverlapped=0x0) returned 1 [0117.619] SetEndOfFile (hFile=0x1fc) returned 1 [0117.619] CloseHandle (hObject=0x1fc) returned 1 [0117.620] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0117.620] SetEndOfFile (hFile=0x1e4) returned 1 [0117.621] CloseHandle (hObject=0x1e4) returned 1 [0117.621] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0117.621] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00004_.gif")) returned 1 [0117.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 63 [0117.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 63 [0117.621] lstrlenW (lpString=".doc") returned 4 [0117.621] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0117.621] lstrlenW (lpString=".docx") returned 5 [0117.621] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0117.621] lstrlenW (lpString=".pdf") returned 4 [0117.621] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0117.621] lstrlenW (lpString=".xls") returned 4 [0117.621] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0117.621] lstrlenW (lpString=".xlsx") returned 5 [0117.621] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0117.621] lstrlenW (lpString=".ppt") returned 4 [0117.622] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0117.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 63 [0117.622] lstrlenW (lpString=".zip") returned 4 [0117.622] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0117.622] lstrlenW (lpString=".rar") returned 4 [0117.622] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0117.622] lstrlenW (lpString=".bz2") returned 4 [0117.622] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0117.622] lstrlenW (lpString=".7z") returned 3 [0117.622] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0117.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 63 [0117.622] lstrlenW (lpString=".dbf") returned 4 [0117.622] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0117.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 63 [0117.622] lstrlenW (lpString=".1cd") returned 4 [0117.622] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0117.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 63 [0117.622] lstrlenW (lpString=".jpg") returned 4 [0117.622] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0117.623] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x326f8cc | out: lpFileSize=0x326f8cc*=3251) returned 1 [0117.623] CloseHandle (hObject=0x1e4) returned 1 [0117.623] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00038_.gif")) returned 0x20 [0117.623] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00038_.gif.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0117.623] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00038_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0117.623] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0117.623] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0117.623] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00038_.gif.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0117.624] GetLastError () returned 0x0 [0117.624] ReadFile (in: hFile=0x1e4, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0xcb3, lpOverlapped=0x0) returned 1 [0117.688] WriteFile (in: hFile=0x1fc, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xcc0, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0xcc0, lpOverlapped=0x0) returned 1 [0117.688] ReadFile (in: hFile=0x1e4, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0x0, lpOverlapped=0x0) returned 1 [0117.688] WriteFile (in: hFile=0x1fc, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0xec, lpOverlapped=0x0) returned 1 [0117.688] SetEndOfFile (hFile=0x1fc) returned 1 [0117.688] CloseHandle (hObject=0x1fc) returned 1 [0117.689] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0117.689] SetEndOfFile (hFile=0x1e4) returned 1 [0117.689] CloseHandle (hObject=0x1e4) returned 1 [0117.690] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0117.690] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00038_.gif")) returned 1 [0117.690] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 63 [0117.690] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 63 [0117.690] lstrlenW (lpString=".doc") returned 4 [0117.690] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0117.690] lstrlenW (lpString=".docx") returned 5 [0117.690] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0117.690] lstrlenW (lpString=".pdf") returned 4 [0117.690] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0117.690] lstrlenW (lpString=".xls") returned 4 [0117.690] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0117.690] lstrlenW (lpString=".xlsx") returned 5 [0117.690] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0117.690] lstrlenW (lpString=".ppt") returned 4 [0117.690] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0117.690] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 63 [0117.690] lstrlenW (lpString=".zip") returned 4 [0117.690] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0117.690] lstrlenW (lpString=".rar") returned 4 [0117.690] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0117.690] lstrlenW (lpString=".bz2") returned 4 [0117.690] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0117.690] lstrlenW (lpString=".7z") returned 3 [0117.690] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0117.690] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 63 [0117.690] lstrlenW (lpString=".dbf") returned 4 [0117.690] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0117.690] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 63 [0117.690] lstrlenW (lpString=".1cd") returned 4 [0117.690] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0117.690] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 63 [0117.690] lstrlenW (lpString=".jpg") returned 4 [0117.690] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0117.691] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x326f8cc | out: lpFileSize=0x326f8cc*=3140) returned 1 [0117.691] CloseHandle (hObject=0x1e4) returned 1 [0117.691] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00126_.gif")) returned 0x20 [0117.691] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00126_.gif.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0117.691] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00126_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0117.691] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0117.691] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0117.691] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00126_.gif.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0117.691] GetLastError () returned 0x0 [0117.691] ReadFile (in: hFile=0x1e4, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0xc44, lpOverlapped=0x0) returned 1 [0117.706] WriteFile (in: hFile=0x1fc, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xc50, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0xc50, lpOverlapped=0x0) returned 1 [0117.706] ReadFile (in: hFile=0x1e4, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0x0, lpOverlapped=0x0) returned 1 [0117.706] WriteFile (in: hFile=0x1fc, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0xec, lpOverlapped=0x0) returned 1 [0117.706] SetEndOfFile (hFile=0x1fc) returned 1 [0117.707] CloseHandle (hObject=0x1fc) returned 1 [0117.707] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0117.707] SetEndOfFile (hFile=0x1e4) returned 1 [0117.707] CloseHandle (hObject=0x1e4) returned 1 [0117.707] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0117.708] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00126_.gif")) returned 1 [0117.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 63 [0117.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 63 [0117.708] lstrlenW (lpString=".doc") returned 4 [0117.708] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0117.708] lstrlenW (lpString=".docx") returned 5 [0117.708] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0117.708] lstrlenW (lpString=".pdf") returned 4 [0117.708] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0117.708] lstrlenW (lpString=".xls") returned 4 [0117.708] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0117.708] lstrlenW (lpString=".xlsx") returned 5 [0117.708] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0117.708] lstrlenW (lpString=".ppt") returned 4 [0117.708] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0117.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 63 [0117.708] lstrlenW (lpString=".zip") returned 4 [0117.708] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0117.708] lstrlenW (lpString=".rar") returned 4 [0117.708] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0117.708] lstrlenW (lpString=".bz2") returned 4 [0117.708] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0117.708] lstrlenW (lpString=".7z") returned 3 [0117.708] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0117.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 63 [0117.708] lstrlenW (lpString=".dbf") returned 4 [0117.708] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0117.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 63 [0117.708] lstrlenW (lpString=".1cd") returned 4 [0117.708] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0117.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 63 [0117.708] lstrlenW (lpString=".jpg") returned 4 [0117.708] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0117.709] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x326f8cc | out: lpFileSize=0x326f8cc*=5253) returned 1 [0117.709] CloseHandle (hObject=0x1e4) returned 1 [0117.709] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00130_.gif")) returned 0x20 [0117.709] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00130_.gif.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0117.709] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00130_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0117.709] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0117.709] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0117.709] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00130_.gif.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0117.709] GetLastError () returned 0x0 [0117.709] ReadFile (in: hFile=0x1e4, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0x1485, lpOverlapped=0x0) returned 1 [0117.722] WriteFile (in: hFile=0x1fc, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0x1490, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0x1490, lpOverlapped=0x0) returned 1 [0117.723] ReadFile (in: hFile=0x1e4, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0x0, lpOverlapped=0x0) returned 1 [0117.723] WriteFile (in: hFile=0x1fc, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0xec, lpOverlapped=0x0) returned 1 [0117.723] SetEndOfFile (hFile=0x1fc) returned 1 [0117.723] CloseHandle (hObject=0x1fc) returned 1 [0117.723] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0117.723] SetEndOfFile (hFile=0x1e4) returned 1 [0117.724] CloseHandle (hObject=0x1e4) returned 1 [0117.724] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0117.724] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00130_.gif")) returned 1 [0117.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 63 [0117.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 63 [0117.724] lstrlenW (lpString=".doc") returned 4 [0117.724] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0117.724] lstrlenW (lpString=".docx") returned 5 [0117.724] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0117.724] lstrlenW (lpString=".pdf") returned 4 [0117.724] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0117.724] lstrlenW (lpString=".xls") returned 4 [0117.724] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0117.724] lstrlenW (lpString=".xlsx") returned 5 [0117.724] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0117.724] lstrlenW (lpString=".ppt") returned 4 [0117.724] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0117.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 63 [0117.724] lstrlenW (lpString=".zip") returned 4 [0117.724] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0117.724] lstrlenW (lpString=".rar") returned 4 [0117.724] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0117.724] lstrlenW (lpString=".bz2") returned 4 [0117.724] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0117.724] lstrlenW (lpString=".7z") returned 3 [0117.724] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0117.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 63 [0117.724] lstrlenW (lpString=".dbf") returned 4 [0117.724] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0117.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 63 [0117.725] lstrlenW (lpString=".1cd") returned 4 [0117.725] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0117.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 63 [0117.725] lstrlenW (lpString=".jpg") returned 4 [0117.725] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0117.727] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x326f8cc | out: lpFileSize=0x326f8cc*=10607) returned 1 [0117.727] CloseHandle (hObject=0x1e4) returned 1 [0117.727] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00139_.gif")) returned 0x20 [0117.727] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00139_.gif.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0117.727] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00139_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0117.727] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0117.727] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0117.727] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00139_.gif.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0117.728] GetLastError () returned 0x0 [0117.728] ReadFile (in: hFile=0x1e4, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0x296f, lpOverlapped=0x0) returned 1 [0117.742] WriteFile (in: hFile=0x1fc, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0x2970, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0x2970, lpOverlapped=0x0) returned 1 [0117.743] ReadFile (in: hFile=0x1e4, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0x0, lpOverlapped=0x0) returned 1 [0117.743] WriteFile (in: hFile=0x1fc, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0xec, lpOverlapped=0x0) returned 1 [0117.743] SetEndOfFile (hFile=0x1fc) returned 1 [0117.743] CloseHandle (hObject=0x1fc) returned 1 [0117.743] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0117.743] SetEndOfFile (hFile=0x1e4) returned 1 [0117.744] CloseHandle (hObject=0x1e4) returned 1 [0117.744] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0117.744] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00139_.gif")) returned 1 [0117.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 63 [0117.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 63 [0117.744] lstrlenW (lpString=".doc") returned 4 [0117.744] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0117.744] lstrlenW (lpString=".docx") returned 5 [0117.744] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0117.744] lstrlenW (lpString=".pdf") returned 4 [0117.744] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0117.744] lstrlenW (lpString=".xls") returned 4 [0117.744] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0117.744] lstrlenW (lpString=".xlsx") returned 5 [0117.744] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0117.745] lstrlenW (lpString=".ppt") returned 4 [0117.745] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0117.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 63 [0117.745] lstrlenW (lpString=".zip") returned 4 [0117.745] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0117.745] lstrlenW (lpString=".rar") returned 4 [0117.745] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0117.745] lstrlenW (lpString=".bz2") returned 4 [0117.745] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0117.745] lstrlenW (lpString=".7z") returned 3 [0117.745] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0117.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 63 [0117.745] lstrlenW (lpString=".dbf") returned 4 [0117.745] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0117.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 63 [0117.745] lstrlenW (lpString=".1cd") returned 4 [0117.745] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0117.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 63 [0117.745] lstrlenW (lpString=".jpg") returned 4 [0117.745] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0117.745] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x326f8cc | out: lpFileSize=0x326f8cc*=5315) returned 1 [0117.745] CloseHandle (hObject=0x1e4) returned 1 [0117.745] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00154_.gif")) returned 0x20 [0117.745] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00154_.gif.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0117.745] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00154_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0117.746] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0117.746] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0117.746] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00154_.gif.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0117.746] GetLastError () returned 0x0 [0117.746] ReadFile (in: hFile=0x1e4, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0x14c3, lpOverlapped=0x0) returned 1 [0117.759] WriteFile (in: hFile=0x1fc, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0x14d0, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0x14d0, lpOverlapped=0x0) returned 1 [0117.760] ReadFile (in: hFile=0x1e4, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0x0, lpOverlapped=0x0) returned 1 [0117.760] WriteFile (in: hFile=0x1fc, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0xec, lpOverlapped=0x0) returned 1 [0117.760] SetEndOfFile (hFile=0x1fc) returned 1 [0117.760] CloseHandle (hObject=0x1fc) returned 1 [0117.760] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0117.760] SetEndOfFile (hFile=0x1e4) returned 1 [0117.768] CloseHandle (hObject=0x1e4) returned 1 [0117.768] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0117.768] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00154_.gif")) returned 1 [0117.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 63 [0117.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 63 [0117.768] lstrlenW (lpString=".doc") returned 4 [0117.768] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0117.768] lstrlenW (lpString=".docx") returned 5 [0117.768] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0117.768] lstrlenW (lpString=".pdf") returned 4 [0117.768] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0117.768] lstrlenW (lpString=".xls") returned 4 [0117.768] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0117.768] lstrlenW (lpString=".xlsx") returned 5 [0117.768] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0117.768] lstrlenW (lpString=".ppt") returned 4 [0117.768] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0117.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 63 [0117.768] lstrlenW (lpString=".zip") returned 4 [0117.768] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0117.768] lstrlenW (lpString=".rar") returned 4 [0117.768] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0117.768] lstrlenW (lpString=".bz2") returned 4 [0117.768] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0117.768] lstrlenW (lpString=".7z") returned 3 [0117.768] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0117.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 63 [0117.768] lstrlenW (lpString=".dbf") returned 4 [0117.769] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0117.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 63 [0117.769] lstrlenW (lpString=".1cd") returned 4 [0117.769] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0117.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 63 [0117.769] lstrlenW (lpString=".jpg") returned 4 [0117.769] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0117.769] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x326f8cc | out: lpFileSize=0x326f8cc*=7583) returned 1 [0117.769] CloseHandle (hObject=0x1e4) returned 1 [0117.769] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00161_.gif")) returned 0x20 [0117.769] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00161_.gif.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0117.769] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00161_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0117.769] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0117.769] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0117.769] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00161_.gif.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0117.770] GetLastError () returned 0x0 [0117.770] ReadFile (in: hFile=0x1e4, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0x1d9f, lpOverlapped=0x0) returned 1 [0117.795] WriteFile (in: hFile=0x1fc, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0x1da0, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0x1da0, lpOverlapped=0x0) returned 1 [0117.795] ReadFile (in: hFile=0x1e4, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0x0, lpOverlapped=0x0) returned 1 [0117.795] WriteFile (in: hFile=0x1fc, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0xec, lpOverlapped=0x0) returned 1 [0117.796] SetEndOfFile (hFile=0x1fc) returned 1 [0117.796] CloseHandle (hObject=0x1fc) returned 1 [0117.796] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0117.796] SetEndOfFile (hFile=0x1e4) returned 1 [0117.802] CloseHandle (hObject=0x1e4) returned 1 [0117.802] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0117.802] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00161_.gif")) returned 1 [0117.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 63 [0117.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 63 [0117.802] lstrlenW (lpString=".doc") returned 4 [0117.802] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0117.802] lstrlenW (lpString=".docx") returned 5 [0117.802] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0117.802] lstrlenW (lpString=".pdf") returned 4 [0117.803] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0117.803] lstrlenW (lpString=".xls") returned 4 [0117.803] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0117.803] lstrlenW (lpString=".xlsx") returned 5 [0117.803] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0117.803] lstrlenW (lpString=".ppt") returned 4 [0117.803] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0117.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 63 [0117.803] lstrlenW (lpString=".zip") returned 4 [0117.803] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0117.803] lstrlenW (lpString=".rar") returned 4 [0117.803] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0117.803] lstrlenW (lpString=".bz2") returned 4 [0117.803] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0117.803] lstrlenW (lpString=".7z") returned 3 [0117.803] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0117.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 63 [0117.803] lstrlenW (lpString=".dbf") returned 4 [0117.803] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0117.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 63 [0117.803] lstrlenW (lpString=".1cd") returned 4 [0117.803] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0117.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 63 [0117.803] lstrlenW (lpString=".jpg") returned 4 [0117.803] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0117.803] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x326f8cc | out: lpFileSize=0x326f8cc*=4894) returned 1 [0117.803] CloseHandle (hObject=0x1e4) returned 1 [0117.803] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00167_.gif")) returned 0x20 [0117.804] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00167_.gif.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0117.804] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00167_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0117.804] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0117.804] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0117.804] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00167_.gif.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0117.804] GetLastError () returned 0x0 [0117.804] ReadFile (in: hFile=0x1e4, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0x131e, lpOverlapped=0x0) returned 1 [0117.827] WriteFile (in: hFile=0x1fc, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0x1320, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0x1320, lpOverlapped=0x0) returned 1 [0117.828] ReadFile (in: hFile=0x1e4, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0x0, lpOverlapped=0x0) returned 1 [0117.828] WriteFile (in: hFile=0x1fc, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0xec, lpOverlapped=0x0) returned 1 [0117.828] SetEndOfFile (hFile=0x1fc) returned 1 [0117.828] CloseHandle (hObject=0x1fc) returned 1 [0117.828] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0117.828] SetEndOfFile (hFile=0x1e4) returned 1 [0117.829] CloseHandle (hObject=0x1e4) returned 1 [0117.829] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0117.829] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00167_.gif")) returned 1 [0117.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 63 [0117.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 63 [0117.829] lstrlenW (lpString=".doc") returned 4 [0117.829] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0117.829] lstrlenW (lpString=".docx") returned 5 [0117.829] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0117.829] lstrlenW (lpString=".pdf") returned 4 [0117.829] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0117.829] lstrlenW (lpString=".xls") returned 4 [0117.829] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0117.829] lstrlenW (lpString=".xlsx") returned 5 [0117.829] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0117.829] lstrlenW (lpString=".ppt") returned 4 [0117.829] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0117.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 63 [0117.829] lstrlenW (lpString=".zip") returned 4 [0117.829] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0117.829] lstrlenW (lpString=".rar") returned 4 [0117.829] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0117.830] lstrlenW (lpString=".bz2") returned 4 [0117.830] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0117.830] lstrlenW (lpString=".7z") returned 3 [0117.830] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0117.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 63 [0117.830] lstrlenW (lpString=".dbf") returned 4 [0117.830] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0117.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 63 [0117.830] lstrlenW (lpString=".1cd") returned 4 [0117.830] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0117.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 63 [0117.830] lstrlenW (lpString=".jpg") returned 4 [0117.830] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0117.830] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x326f8cc | out: lpFileSize=0x326f8cc*=5016) returned 1 [0117.830] CloseHandle (hObject=0x1e4) returned 1 [0117.830] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00171_.gif")) returned 0x20 [0117.830] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00171_.gif.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0117.830] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00171_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0117.830] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0117.830] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0117.831] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00171_.gif.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0117.831] GetLastError () returned 0x0 [0117.831] ReadFile (in: hFile=0x1e4, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0x1398, lpOverlapped=0x0) returned 1 [0117.924] WriteFile (in: hFile=0x1fc, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0x13a0, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0x13a0, lpOverlapped=0x0) returned 1 [0117.925] ReadFile (in: hFile=0x1e4, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0x0, lpOverlapped=0x0) returned 1 [0117.925] WriteFile (in: hFile=0x1fc, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0xec, lpOverlapped=0x0) returned 1 [0117.925] SetEndOfFile (hFile=0x1fc) returned 1 [0117.925] CloseHandle (hObject=0x1fc) returned 1 [0117.925] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0117.925] SetEndOfFile (hFile=0x1e4) returned 1 [0117.926] CloseHandle (hObject=0x1e4) returned 1 [0117.926] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0117.927] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00171_.gif")) returned 1 [0117.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 63 [0117.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 63 [0117.954] lstrlenW (lpString=".doc") returned 4 [0117.954] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0117.954] lstrlenW (lpString=".docx") returned 5 [0117.955] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0117.955] lstrlenW (lpString=".pdf") returned 4 [0117.955] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0117.955] lstrlenW (lpString=".xls") returned 4 [0117.955] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0117.955] lstrlenW (lpString=".xlsx") returned 5 [0117.955] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0117.955] lstrlenW (lpString=".ppt") returned 4 [0117.955] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0117.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 63 [0117.955] lstrlenW (lpString=".zip") returned 4 [0117.955] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0117.955] lstrlenW (lpString=".rar") returned 4 [0117.955] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0117.955] lstrlenW (lpString=".bz2") returned 4 [0117.955] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0117.955] lstrlenW (lpString=".7z") returned 3 [0117.955] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0117.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 63 [0117.955] lstrlenW (lpString=".dbf") returned 4 [0117.955] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0117.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 63 [0117.955] lstrlenW (lpString=".1cd") returned 4 [0117.955] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0117.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 63 [0117.955] lstrlenW (lpString=".jpg") returned 4 [0117.955] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0117.962] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0117.962] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0117.962] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00932_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0117.962] GetLastError () returned 0x0 [0117.962] ReadFile (in: hFile=0x164, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0x385c, lpOverlapped=0x0) returned 1 [0118.163] WriteFile (in: hFile=0x1f0, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0x3860, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0x3860, lpOverlapped=0x0) returned 1 [0118.164] ReadFile (in: hFile=0x164, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0x0, lpOverlapped=0x0) returned 1 [0118.164] WriteFile (in: hFile=0x1f0, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0xec, lpOverlapped=0x0) returned 1 [0118.164] SetEndOfFile (hFile=0x1f0) returned 1 [0118.164] CloseHandle (hObject=0x1f0) returned 1 [0118.164] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0118.164] SetEndOfFile (hFile=0x164) returned 1 [0118.165] CloseHandle (hObject=0x164) returned 1 [0118.165] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0118.166] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00932_.wmf")) returned 1 [0118.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 63 [0118.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 63 [0118.166] lstrlenW (lpString=".doc") returned 4 [0118.166] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0118.166] lstrlenW (lpString=".docx") returned 5 [0118.166] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0118.166] lstrlenW (lpString=".pdf") returned 4 [0118.166] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0118.166] lstrlenW (lpString=".xls") returned 4 [0118.166] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0118.166] lstrlenW (lpString=".xlsx") returned 5 [0118.166] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0118.166] lstrlenW (lpString=".ppt") returned 4 [0118.166] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0118.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 63 [0118.166] lstrlenW (lpString=".zip") returned 4 [0118.166] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0118.166] lstrlenW (lpString=".rar") returned 4 [0118.166] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0118.166] lstrlenW (lpString=".bz2") returned 4 [0118.166] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0118.166] lstrlenW (lpString=".7z") returned 3 [0118.166] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0118.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 63 [0118.166] lstrlenW (lpString=".dbf") returned 4 [0118.166] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0118.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 63 [0118.166] lstrlenW (lpString=".1cd") returned 4 [0118.166] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0118.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 63 [0118.166] lstrlenW (lpString=".jpg") returned 4 [0118.166] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0118.167] GetFileSizeEx (in: hFile=0x164, lpFileSize=0x326f8cc | out: lpFileSize=0x326f8cc*=1832) returned 1 [0118.167] CloseHandle (hObject=0x164) returned 1 [0118.167] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01084_.wmf")) returned 0x20 [0118.167] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01084_.wmf.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0118.167] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01084_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0118.167] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0118.167] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0118.167] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01084_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0118.167] GetLastError () returned 0x0 [0118.167] ReadFile (in: hFile=0x164, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0x728, lpOverlapped=0x0) returned 1 [0118.380] WriteFile (in: hFile=0x1f0, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0x730, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0x730, lpOverlapped=0x0) returned 1 [0118.885] ReadFile (in: hFile=0x164, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0x0, lpOverlapped=0x0) returned 1 [0118.886] WriteFile (in: hFile=0x1f0, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0xec, lpOverlapped=0x0) returned 1 [0118.886] SetEndOfFile (hFile=0x1f0) returned 1 [0118.886] CloseHandle (hObject=0x1f0) returned 1 [0118.886] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0118.886] SetEndOfFile (hFile=0x164) returned 1 [0118.886] CloseHandle (hObject=0x164) returned 1 [0118.886] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0118.887] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01084_.wmf")) returned 1 [0118.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 63 [0118.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 63 [0118.995] lstrlenW (lpString=".doc") returned 4 [0118.995] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0118.995] lstrlenW (lpString=".docx") returned 5 [0118.995] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0118.995] lstrlenW (lpString=".pdf") returned 4 [0118.995] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0118.995] lstrlenW (lpString=".xls") returned 4 [0118.995] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0118.995] lstrlenW (lpString=".xlsx") returned 5 [0118.995] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0118.995] lstrlenW (lpString=".ppt") returned 4 [0118.995] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0118.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 63 [0118.995] lstrlenW (lpString=".zip") returned 4 [0118.995] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0118.995] lstrlenW (lpString=".rar") returned 4 [0118.995] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0118.995] lstrlenW (lpString=".bz2") returned 4 [0118.995] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0118.995] lstrlenW (lpString=".7z") returned 3 [0118.995] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0118.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 63 [0118.995] lstrlenW (lpString=".dbf") returned 4 [0118.995] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0118.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 63 [0118.995] lstrlenW (lpString=".1cd") returned 4 [0118.995] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0118.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 63 [0118.995] lstrlenW (lpString=".jpg") returned 4 [0118.995] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0118.995] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0118.996] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0118.996] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01251_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0118.996] GetLastError () returned 0x0 [0118.996] ReadFile (in: hFile=0x1e4, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0xac4, lpOverlapped=0x0) returned 1 [0119.034] WriteFile (in: hFile=0x1fc, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xad0, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0xad0, lpOverlapped=0x0) returned 1 [0119.035] ReadFile (in: hFile=0x1e4, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0x0, lpOverlapped=0x0) returned 1 [0119.035] WriteFile (in: hFile=0x1fc, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0xec, lpOverlapped=0x0) returned 1 [0119.035] SetEndOfFile (hFile=0x1fc) returned 1 [0119.035] CloseHandle (hObject=0x1fc) returned 1 [0119.035] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0119.035] SetEndOfFile (hFile=0x1e4) returned 1 [0119.036] CloseHandle (hObject=0x1e4) returned 1 [0119.036] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0119.037] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01251_.wmf")) returned 1 [0119.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 63 [0119.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 63 [0119.037] lstrlenW (lpString=".doc") returned 4 [0119.037] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0119.037] lstrlenW (lpString=".docx") returned 5 [0119.037] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0119.037] lstrlenW (lpString=".pdf") returned 4 [0119.037] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0119.037] lstrlenW (lpString=".xls") returned 4 [0119.037] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0119.037] lstrlenW (lpString=".xlsx") returned 5 [0119.037] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0119.037] lstrlenW (lpString=".ppt") returned 4 [0119.037] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0119.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 63 [0119.037] lstrlenW (lpString=".zip") returned 4 [0119.037] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0119.037] lstrlenW (lpString=".rar") returned 4 [0119.037] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0119.037] lstrlenW (lpString=".bz2") returned 4 [0119.037] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0119.037] lstrlenW (lpString=".7z") returned 3 [0119.038] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0119.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 63 [0119.038] lstrlenW (lpString=".dbf") returned 4 [0119.038] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0119.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 63 [0119.038] lstrlenW (lpString=".1cd") returned 4 [0119.038] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0119.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 63 [0119.038] lstrlenW (lpString=".jpg") returned 4 [0119.038] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0119.048] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0119.048] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0119.048] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02724_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0119.048] GetLastError () returned 0x0 [0119.048] ReadFile (in: hFile=0x1fc, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0x83c, lpOverlapped=0x0) returned 1 [0119.076] WriteFile (in: hFile=0x1f0, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0x840, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0x840, lpOverlapped=0x0) returned 1 [0119.078] ReadFile (in: hFile=0x1fc, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0x0, lpOverlapped=0x0) returned 1 [0119.078] WriteFile (in: hFile=0x1f0, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0xec, lpOverlapped=0x0) returned 1 [0119.078] SetEndOfFile (hFile=0x1f0) returned 1 [0119.078] CloseHandle (hObject=0x1f0) returned 1 [0119.078] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0119.079] SetEndOfFile (hFile=0x1fc) returned 1 [0119.079] CloseHandle (hObject=0x1fc) returned 1 [0119.079] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0119.079] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02724_.wmf")) returned 1 [0119.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 63 [0119.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 63 [0119.080] lstrlenW (lpString=".doc") returned 4 [0119.080] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0119.080] lstrlenW (lpString=".docx") returned 5 [0119.080] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0119.080] lstrlenW (lpString=".pdf") returned 4 [0119.080] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0119.080] lstrlenW (lpString=".xls") returned 4 [0119.080] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0119.080] lstrlenW (lpString=".xlsx") returned 5 [0119.080] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0119.080] lstrlenW (lpString=".ppt") returned 4 [0119.080] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0119.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 63 [0119.080] lstrlenW (lpString=".zip") returned 4 [0119.080] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0119.080] lstrlenW (lpString=".rar") returned 4 [0119.080] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0119.080] lstrlenW (lpString=".bz2") returned 4 [0119.080] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0119.080] lstrlenW (lpString=".7z") returned 3 [0119.080] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0119.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 63 [0119.080] lstrlenW (lpString=".dbf") returned 4 [0119.080] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0119.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 63 [0119.080] lstrlenW (lpString=".1cd") returned 4 [0119.080] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0119.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 63 [0119.080] lstrlenW (lpString=".jpg") returned 4 [0119.080] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0119.081] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x326f8cc | out: lpFileSize=0x326f8cc*=6060) returned 1 [0119.081] CloseHandle (hObject=0x1fc) returned 1 [0119.086] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04117_.wmf")) returned 0x20 [0119.086] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04117_.wmf.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0119.086] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04117_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0119.086] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0119.086] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0119.086] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04117_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0119.087] GetLastError () returned 0x0 [0119.087] ReadFile (in: hFile=0x1fc, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0x17ac, lpOverlapped=0x0) returned 1 [0119.150] WriteFile (in: hFile=0x1f0, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0x17b0, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0x17b0, lpOverlapped=0x0) returned 1 [0119.151] ReadFile (in: hFile=0x1fc, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0x0, lpOverlapped=0x0) returned 1 [0119.151] WriteFile (in: hFile=0x1f0, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0xec, lpOverlapped=0x0) returned 1 [0119.151] SetEndOfFile (hFile=0x1f0) returned 1 [0119.156] CloseHandle (hObject=0x1f0) returned 1 [0119.156] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0119.156] SetEndOfFile (hFile=0x1fc) returned 1 [0119.157] CloseHandle (hObject=0x1fc) returned 1 [0119.157] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0119.157] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04117_.wmf")) returned 1 [0119.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 63 [0119.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 63 [0119.157] lstrlenW (lpString=".doc") returned 4 [0119.157] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0119.157] lstrlenW (lpString=".docx") returned 5 [0119.157] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0119.157] lstrlenW (lpString=".pdf") returned 4 [0119.157] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0119.157] lstrlenW (lpString=".xls") returned 4 [0119.157] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0119.157] lstrlenW (lpString=".xlsx") returned 5 [0119.158] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0119.158] lstrlenW (lpString=".ppt") returned 4 [0119.158] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0119.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 63 [0119.158] lstrlenW (lpString=".zip") returned 4 [0119.158] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0119.158] lstrlenW (lpString=".rar") returned 4 [0119.158] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0119.158] lstrlenW (lpString=".bz2") returned 4 [0119.158] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0119.158] lstrlenW (lpString=".7z") returned 3 [0119.158] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0119.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 63 [0119.158] lstrlenW (lpString=".dbf") returned 4 [0119.158] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0119.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 63 [0119.158] lstrlenW (lpString=".1cd") returned 4 [0119.158] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0119.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 63 [0119.158] lstrlenW (lpString=".jpg") returned 4 [0119.158] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0119.158] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x326f8cc | out: lpFileSize=0x326f8cc*=4612) returned 1 [0119.158] CloseHandle (hObject=0x1fc) returned 1 [0119.158] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04195_.wmf")) returned 0x20 [0119.158] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04195_.wmf.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0119.158] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04195_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0119.159] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0119.159] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0119.159] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04195_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0119.159] GetLastError () returned 0x0 [0119.159] ReadFile (in: hFile=0x1fc, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0x1204, lpOverlapped=0x0) returned 1 [0119.233] WriteFile (in: hFile=0x1f0, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0x1210, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0x1210, lpOverlapped=0x0) returned 1 [0119.234] ReadFile (in: hFile=0x1fc, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0x0, lpOverlapped=0x0) returned 1 [0119.234] WriteFile (in: hFile=0x1f0, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0xec, lpOverlapped=0x0) returned 1 [0119.234] SetEndOfFile (hFile=0x1f0) returned 1 [0119.234] CloseHandle (hObject=0x1f0) returned 1 [0119.234] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0119.234] SetEndOfFile (hFile=0x1fc) returned 1 [0119.235] CloseHandle (hObject=0x1fc) returned 1 [0119.235] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0119.235] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04195_.wmf")) returned 1 [0119.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 63 [0119.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 63 [0119.235] lstrlenW (lpString=".doc") returned 4 [0119.235] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0119.235] lstrlenW (lpString=".docx") returned 5 [0119.235] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0119.235] lstrlenW (lpString=".pdf") returned 4 [0119.235] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0119.235] lstrlenW (lpString=".xls") returned 4 [0119.235] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0119.235] lstrlenW (lpString=".xlsx") returned 5 [0119.235] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0119.235] lstrlenW (lpString=".ppt") returned 4 [0119.235] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0119.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 63 [0119.235] lstrlenW (lpString=".zip") returned 4 [0119.235] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0119.235] lstrlenW (lpString=".rar") returned 4 [0119.236] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0119.236] lstrlenW (lpString=".bz2") returned 4 [0119.236] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0119.236] lstrlenW (lpString=".7z") returned 3 [0119.236] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0119.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 63 [0119.236] lstrlenW (lpString=".dbf") returned 4 [0119.236] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0119.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 63 [0119.236] lstrlenW (lpString=".1cd") returned 4 [0119.236] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0119.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 63 [0119.236] lstrlenW (lpString=".jpg") returned 4 [0119.236] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0119.237] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x326f8cc | out: lpFileSize=0x326f8cc*=7668) returned 1 [0119.237] CloseHandle (hObject=0x1fc) returned 1 [0119.237] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04206_.wmf")) returned 0x20 [0119.237] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04206_.wmf.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0119.237] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04206_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0119.237] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0119.238] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0119.238] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04206_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0119.238] GetLastError () returned 0x0 [0119.238] ReadFile (in: hFile=0x1fc, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0x1df4, lpOverlapped=0x0) returned 1 [0119.340] WriteFile (in: hFile=0x1f0, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0x1e00, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0x1e00, lpOverlapped=0x0) returned 1 [0119.341] ReadFile (in: hFile=0x1fc, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0x0, lpOverlapped=0x0) returned 1 [0119.341] WriteFile (in: hFile=0x1f0, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0xec, lpOverlapped=0x0) returned 1 [0119.341] SetEndOfFile (hFile=0x1f0) returned 1 [0119.467] CloseHandle (hObject=0x1f0) returned 1 [0119.470] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0119.470] SetEndOfFile (hFile=0x1fc) returned 1 [0119.471] CloseHandle (hObject=0x1fc) returned 1 [0119.471] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0119.471] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04206_.wmf")) returned 1 [0119.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 63 [0119.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 63 [0119.471] lstrlenW (lpString=".doc") returned 4 [0119.471] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0119.471] lstrlenW (lpString=".docx") returned 5 [0119.471] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0119.471] lstrlenW (lpString=".pdf") returned 4 [0119.471] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0119.471] lstrlenW (lpString=".xls") returned 4 [0119.471] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0119.471] lstrlenW (lpString=".xlsx") returned 5 [0119.502] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0119.502] lstrlenW (lpString=".ppt") returned 4 [0119.502] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0119.502] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 63 [0119.502] lstrlenW (lpString=".zip") returned 4 [0119.502] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0119.502] lstrlenW (lpString=".rar") returned 4 [0119.502] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0119.502] lstrlenW (lpString=".bz2") returned 4 [0119.502] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0119.502] lstrlenW (lpString=".7z") returned 3 [0119.502] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0119.502] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 63 [0119.502] lstrlenW (lpString=".dbf") returned 4 [0119.502] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0119.502] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 63 [0119.502] lstrlenW (lpString=".1cd") returned 4 [0119.502] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0119.502] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 63 [0119.502] lstrlenW (lpString=".jpg") returned 4 [0119.502] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0119.502] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0119.503] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0119.503] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04269_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0119.503] GetLastError () returned 0x0 [0119.503] ReadFile (in: hFile=0x170, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0x7e0, lpOverlapped=0x0) returned 1 [0119.508] WriteFile (in: hFile=0x1f0, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0x7f0, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0x7f0, lpOverlapped=0x0) returned 1 [0119.509] ReadFile (in: hFile=0x170, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0x0, lpOverlapped=0x0) returned 1 [0119.509] WriteFile (in: hFile=0x1f0, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0xec, lpOverlapped=0x0) returned 1 [0119.510] SetEndOfFile (hFile=0x1f0) returned 1 [0119.510] CloseHandle (hObject=0x1f0) returned 1 [0119.510] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0119.510] SetEndOfFile (hFile=0x170) returned 1 [0119.510] CloseHandle (hObject=0x170) returned 1 [0119.510] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0119.511] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04269_.wmf")) returned 1 [0119.513] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 63 [0119.513] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 63 [0119.513] lstrlenW (lpString=".doc") returned 4 [0119.513] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0119.513] lstrlenW (lpString=".docx") returned 5 [0119.513] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0119.513] lstrlenW (lpString=".pdf") returned 4 [0119.513] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0119.513] lstrlenW (lpString=".xls") returned 4 [0119.513] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0119.513] lstrlenW (lpString=".xlsx") returned 5 [0119.513] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0119.513] lstrlenW (lpString=".ppt") returned 4 [0119.513] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0119.513] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 63 [0119.513] lstrlenW (lpString=".zip") returned 4 [0119.513] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0119.513] lstrlenW (lpString=".rar") returned 4 [0119.513] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0119.513] lstrlenW (lpString=".bz2") returned 4 [0119.513] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0119.513] lstrlenW (lpString=".7z") returned 3 [0119.513] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0119.514] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 63 [0119.514] lstrlenW (lpString=".dbf") returned 4 [0119.514] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0119.514] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 63 [0119.514] lstrlenW (lpString=".1cd") returned 4 [0119.514] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0119.514] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 63 [0119.514] lstrlenW (lpString=".jpg") returned 4 [0119.514] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0119.518] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0119.518] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0119.518] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04332_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0119.519] GetLastError () returned 0x0 [0119.519] ReadFile (in: hFile=0x19c, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0x10c8, lpOverlapped=0x0) returned 1 [0119.616] WriteFile (in: hFile=0x1f4, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0x10d0, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0x10d0, lpOverlapped=0x0) returned 1 [0119.617] ReadFile (in: hFile=0x19c, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0x0, lpOverlapped=0x0) returned 1 [0119.617] WriteFile (in: hFile=0x1f4, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0xec, lpOverlapped=0x0) returned 1 [0119.617] SetEndOfFile (hFile=0x1f4) returned 1 [0119.617] CloseHandle (hObject=0x1f4) returned 1 [0119.617] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0119.617] SetEndOfFile (hFile=0x19c) returned 1 [0119.618] CloseHandle (hObject=0x19c) returned 1 [0119.618] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0119.618] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04332_.wmf")) returned 1 [0119.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 63 [0119.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 63 [0119.646] lstrlenW (lpString=".doc") returned 4 [0119.646] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0119.646] lstrlenW (lpString=".docx") returned 5 [0119.647] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0119.647] lstrlenW (lpString=".pdf") returned 4 [0119.647] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0119.647] lstrlenW (lpString=".xls") returned 4 [0119.647] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0119.647] lstrlenW (lpString=".xlsx") returned 5 [0119.647] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0119.647] lstrlenW (lpString=".ppt") returned 4 [0119.647] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0119.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 63 [0119.647] lstrlenW (lpString=".zip") returned 4 [0119.647] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0119.647] lstrlenW (lpString=".rar") returned 4 [0119.647] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0119.647] lstrlenW (lpString=".bz2") returned 4 [0119.647] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0119.647] lstrlenW (lpString=".7z") returned 3 [0119.647] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0119.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 63 [0119.647] lstrlenW (lpString=".dbf") returned 4 [0119.647] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0119.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 63 [0119.647] lstrlenW (lpString=".1cd") returned 4 [0119.647] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0119.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 63 [0119.647] lstrlenW (lpString=".jpg") returned 4 [0119.647] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0119.686] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0119.687] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0119.687] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00141_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x224 [0119.687] GetLastError () returned 0x0 [0119.687] ReadFile (in: hFile=0x220, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0x6906, lpOverlapped=0x0) returned 1 [0119.707] WriteFile (in: hFile=0x224, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0x6910, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0x6910, lpOverlapped=0x0) returned 1 [0119.708] ReadFile (in: hFile=0x220, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0x0, lpOverlapped=0x0) returned 1 [0119.708] WriteFile (in: hFile=0x224, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0xec, lpOverlapped=0x0) returned 1 [0119.708] SetEndOfFile (hFile=0x224) returned 1 [0119.708] CloseHandle (hObject=0x224) returned 1 [0119.708] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0119.708] SetEndOfFile (hFile=0x220) returned 1 [0119.709] CloseHandle (hObject=0x220) returned 1 [0119.709] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0119.709] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00141_.wmf")) returned 1 [0119.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 63 [0119.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 63 [0119.718] lstrlenW (lpString=".doc") returned 4 [0119.718] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0119.718] lstrlenW (lpString=".docx") returned 5 [0119.718] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0119.718] lstrlenW (lpString=".pdf") returned 4 [0119.719] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0119.719] lstrlenW (lpString=".xls") returned 4 [0119.719] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0119.719] lstrlenW (lpString=".xlsx") returned 5 [0119.719] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0119.719] lstrlenW (lpString=".ppt") returned 4 [0119.719] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0119.719] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 63 [0119.719] lstrlenW (lpString=".zip") returned 4 [0119.719] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0119.719] lstrlenW (lpString=".rar") returned 4 [0119.719] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0119.719] lstrlenW (lpString=".bz2") returned 4 [0119.719] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0119.719] lstrlenW (lpString=".7z") returned 3 [0119.719] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0119.719] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 63 [0119.719] lstrlenW (lpString=".dbf") returned 4 [0119.719] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0119.719] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 63 [0119.719] lstrlenW (lpString=".1cd") returned 4 [0119.719] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0119.719] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 63 [0119.719] lstrlenW (lpString=".jpg") returned 4 [0119.719] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0119.719] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0119.719] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0119.719] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd05119_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x224 [0119.720] GetLastError () returned 0x0 [0119.720] ReadFile (in: hFile=0x220, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0x4354, lpOverlapped=0x0) returned 1 [0119.733] WriteFile (in: hFile=0x224, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0x4360, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0x4360, lpOverlapped=0x0) returned 1 [0119.734] ReadFile (in: hFile=0x220, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0x0, lpOverlapped=0x0) returned 1 [0119.734] WriteFile (in: hFile=0x224, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0xec, lpOverlapped=0x0) returned 1 [0119.734] SetEndOfFile (hFile=0x224) returned 1 [0119.734] CloseHandle (hObject=0x224) returned 1 [0119.734] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0119.734] SetEndOfFile (hFile=0x220) returned 1 [0119.734] CloseHandle (hObject=0x220) returned 1 [0119.735] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0119.735] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd05119_.wmf")) returned 1 [0119.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 63 [0119.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 63 [0119.735] lstrlenW (lpString=".doc") returned 4 [0119.735] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0119.735] lstrlenW (lpString=".docx") returned 5 [0119.735] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0119.735] lstrlenW (lpString=".pdf") returned 4 [0119.735] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0119.735] lstrlenW (lpString=".xls") returned 4 [0119.735] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0119.735] lstrlenW (lpString=".xlsx") returned 5 [0119.735] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0119.736] lstrlenW (lpString=".ppt") returned 4 [0119.736] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0119.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 63 [0119.736] lstrlenW (lpString=".zip") returned 4 [0119.736] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0119.736] lstrlenW (lpString=".rar") returned 4 [0119.736] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0119.736] lstrlenW (lpString=".bz2") returned 4 [0119.736] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0119.736] lstrlenW (lpString=".7z") returned 3 [0119.736] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0119.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 63 [0119.736] lstrlenW (lpString=".dbf") returned 4 [0119.736] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0119.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 63 [0119.736] lstrlenW (lpString=".1cd") returned 4 [0119.736] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0119.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 63 [0119.736] lstrlenW (lpString=".jpg") returned 4 [0119.736] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0119.736] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x326f8cc | out: lpFileSize=0x326f8cc*=16112) returned 1 [0119.736] CloseHandle (hObject=0x220) returned 1 [0119.736] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06102_.wmf")) returned 0x20 [0119.736] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06102_.wmf.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0119.736] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06102_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0119.736] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0119.737] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0119.737] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06102_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x224 [0119.737] GetLastError () returned 0x0 [0119.737] ReadFile (in: hFile=0x220, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0x3ef0, lpOverlapped=0x0) returned 1 [0119.784] WriteFile (in: hFile=0x224, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0x3f00, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0x3f00, lpOverlapped=0x0) returned 1 [0119.784] ReadFile (in: hFile=0x220, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0x0, lpOverlapped=0x0) returned 1 [0119.785] WriteFile (in: hFile=0x224, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0xec, lpOverlapped=0x0) returned 1 [0119.785] SetEndOfFile (hFile=0x224) returned 1 [0119.785] CloseHandle (hObject=0x224) returned 1 [0119.785] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0119.785] SetEndOfFile (hFile=0x220) returned 1 [0119.785] CloseHandle (hObject=0x220) returned 1 [0119.785] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0119.786] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06102_.wmf")) returned 1 [0119.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 63 [0119.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 63 [0119.786] lstrlenW (lpString=".doc") returned 4 [0119.786] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0119.786] lstrlenW (lpString=".docx") returned 5 [0119.786] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0119.786] lstrlenW (lpString=".pdf") returned 4 [0119.786] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0119.786] lstrlenW (lpString=".xls") returned 4 [0119.786] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0119.786] lstrlenW (lpString=".xlsx") returned 5 [0119.786] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0119.786] lstrlenW (lpString=".ppt") returned 4 [0119.786] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0119.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 63 [0119.786] lstrlenW (lpString=".zip") returned 4 [0119.786] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0119.786] lstrlenW (lpString=".rar") returned 4 [0119.786] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0119.786] lstrlenW (lpString=".bz2") returned 4 [0119.786] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0119.786] lstrlenW (lpString=".7z") returned 3 [0119.786] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0119.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 63 [0119.786] lstrlenW (lpString=".dbf") returned 4 [0119.786] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0119.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 63 [0119.786] lstrlenW (lpString=".1cd") returned 4 [0119.786] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0119.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 63 [0119.786] lstrlenW (lpString=".jpg") returned 4 [0119.786] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0119.787] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x326f8cc | out: lpFileSize=0x326f8cc*=26748) returned 1 [0119.787] CloseHandle (hObject=0x220) returned 1 [0119.787] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07761_.wmf")) returned 0x20 [0119.787] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07761_.wmf.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0119.787] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07761_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0119.787] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0119.787] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0119.787] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07761_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x224 [0119.788] GetLastError () returned 0x0 [0119.788] ReadFile (in: hFile=0x220, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0x687c, lpOverlapped=0x0) returned 1 [0119.799] WriteFile (in: hFile=0x224, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0x6880, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0x6880, lpOverlapped=0x0) returned 1 [0119.800] ReadFile (in: hFile=0x220, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0x0, lpOverlapped=0x0) returned 1 [0119.800] WriteFile (in: hFile=0x224, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0xec, lpOverlapped=0x0) returned 1 [0119.800] SetEndOfFile (hFile=0x224) returned 1 [0119.800] CloseHandle (hObject=0x224) returned 1 [0119.800] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0119.800] SetEndOfFile (hFile=0x220) returned 1 [0119.800] CloseHandle (hObject=0x220) returned 1 [0119.801] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0119.801] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07761_.wmf")) returned 1 [0119.801] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 63 [0119.801] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 63 [0119.801] lstrlenW (lpString=".doc") returned 4 [0119.801] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0119.801] lstrlenW (lpString=".docx") returned 5 [0119.801] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0119.801] lstrlenW (lpString=".pdf") returned 4 [0119.801] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0119.801] lstrlenW (lpString=".xls") returned 4 [0119.801] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0119.801] lstrlenW (lpString=".xlsx") returned 5 [0119.801] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0119.801] lstrlenW (lpString=".ppt") returned 4 [0119.801] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0119.801] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 63 [0119.801] lstrlenW (lpString=".zip") returned 4 [0119.801] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0119.801] lstrlenW (lpString=".rar") returned 4 [0119.801] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0119.801] lstrlenW (lpString=".bz2") returned 4 [0119.801] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0119.801] lstrlenW (lpString=".7z") returned 3 [0119.801] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0119.801] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 63 [0119.801] lstrlenW (lpString=".dbf") returned 4 [0119.801] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0119.801] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 63 [0119.801] lstrlenW (lpString=".1cd") returned 4 [0119.801] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0119.801] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 63 [0119.801] lstrlenW (lpString=".jpg") returned 4 [0119.801] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0119.802] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x326f8cc | out: lpFileSize=0x326f8cc*=4924) returned 1 [0119.802] CloseHandle (hObject=0x220) returned 1 [0119.802] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07804_.wmf")) returned 0x20 [0119.802] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07804_.wmf.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0119.802] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07804_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0119.803] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0119.803] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0119.803] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07804_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x224 [0119.803] GetLastError () returned 0x0 [0119.803] ReadFile (in: hFile=0x220, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0x133c, lpOverlapped=0x0) returned 1 [0119.923] WriteFile (in: hFile=0x224, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0x1340, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0x1340, lpOverlapped=0x0) returned 1 [0119.923] ReadFile (in: hFile=0x220, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0x0, lpOverlapped=0x0) returned 1 [0119.923] WriteFile (in: hFile=0x224, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0xec, lpOverlapped=0x0) returned 1 [0119.923] SetEndOfFile (hFile=0x224) returned 1 [0119.924] CloseHandle (hObject=0x224) returned 1 [0119.924] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0119.924] SetEndOfFile (hFile=0x220) returned 1 [0119.924] CloseHandle (hObject=0x220) returned 1 [0119.924] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0119.924] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07804_.wmf")) returned 1 [0120.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 63 [0120.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 63 [0120.078] lstrlenW (lpString=".doc") returned 4 [0120.078] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0120.078] lstrlenW (lpString=".docx") returned 5 [0120.078] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0120.078] lstrlenW (lpString=".pdf") returned 4 [0120.078] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0120.078] lstrlenW (lpString=".xls") returned 4 [0120.078] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0120.078] lstrlenW (lpString=".xlsx") returned 5 [0120.078] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0120.078] lstrlenW (lpString=".ppt") returned 4 [0120.078] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0120.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 63 [0120.078] lstrlenW (lpString=".zip") returned 4 [0120.078] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0120.078] lstrlenW (lpString=".rar") returned 4 [0120.078] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0120.078] lstrlenW (lpString=".bz2") returned 4 [0120.078] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0120.078] lstrlenW (lpString=".7z") returned 3 [0120.078] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0120.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 63 [0120.078] lstrlenW (lpString=".dbf") returned 4 [0120.078] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0120.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 63 [0120.078] lstrlenW (lpString=".1cd") returned 4 [0120.078] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0120.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 63 [0120.078] lstrlenW (lpString=".jpg") returned 4 [0120.078] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0120.159] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x326f8cc | out: lpFileSize=0x326f8cc*=14486) returned 1 [0120.159] CloseHandle (hObject=0x19c) returned 1 [0120.160] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19986_.wmf")) returned 0x20 [0120.160] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19986_.wmf.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0120.160] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19986_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0120.160] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0120.160] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0120.160] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19986_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0120.161] GetLastError () returned 0x0 [0120.161] ReadFile (in: hFile=0x19c, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0x3896, lpOverlapped=0x0) returned 1 [0120.254] WriteFile (in: hFile=0x218, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0x38a0, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0x38a0, lpOverlapped=0x0) returned 1 [0120.258] ReadFile (in: hFile=0x19c, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0x0, lpOverlapped=0x0) returned 1 [0120.258] WriteFile (in: hFile=0x218, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0xec, lpOverlapped=0x0) returned 1 [0120.258] SetEndOfFile (hFile=0x218) returned 1 [0120.430] CloseHandle (hObject=0x218) returned 1 [0120.431] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0120.431] SetEndOfFile (hFile=0x19c) returned 1 [0120.431] CloseHandle (hObject=0x19c) returned 1 [0120.431] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0120.431] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19986_.wmf")) returned 1 [0120.445] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 63 [0120.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 63 [0120.446] lstrlenW (lpString=".doc") returned 4 [0120.446] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0120.446] lstrlenW (lpString=".docx") returned 5 [0120.446] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0120.446] lstrlenW (lpString=".pdf") returned 4 [0120.446] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0120.446] lstrlenW (lpString=".xls") returned 4 [0120.446] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0120.446] lstrlenW (lpString=".xlsx") returned 5 [0120.446] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0120.446] lstrlenW (lpString=".ppt") returned 4 [0120.446] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0120.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 63 [0120.446] lstrlenW (lpString=".zip") returned 4 [0120.446] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0120.446] lstrlenW (lpString=".rar") returned 4 [0120.446] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0120.446] lstrlenW (lpString=".bz2") returned 4 [0120.446] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0120.446] lstrlenW (lpString=".7z") returned 3 [0120.446] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0120.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 63 [0120.446] lstrlenW (lpString=".dbf") returned 4 [0120.446] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0120.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 63 [0120.446] lstrlenW (lpString=".1cd") returned 4 [0120.446] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0120.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 63 [0120.446] lstrlenW (lpString=".jpg") returned 4 [0120.446] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0120.466] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0120.466] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0120.466] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00098_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0120.466] GetLastError () returned 0x0 [0120.466] ReadFile (in: hFile=0x218, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0x3f4, lpOverlapped=0x0) returned 1 [0120.467] WriteFile (in: hFile=0x16c, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0x400, lpOverlapped=0x0) returned 1 [0120.468] ReadFile (in: hFile=0x218, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0x0, lpOverlapped=0x0) returned 1 [0120.468] WriteFile (in: hFile=0x16c, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0xec, lpOverlapped=0x0) returned 1 [0120.468] SetEndOfFile (hFile=0x16c) returned 1 [0120.468] CloseHandle (hObject=0x16c) returned 1 [0120.468] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0120.468] SetEndOfFile (hFile=0x218) returned 1 [0120.469] CloseHandle (hObject=0x218) returned 1 [0120.469] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0120.469] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00098_.wmf")) returned 1 [0120.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 63 [0120.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 63 [0120.470] lstrlenW (lpString=".doc") returned 4 [0120.470] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0120.470] lstrlenW (lpString=".docx") returned 5 [0120.470] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0120.470] lstrlenW (lpString=".pdf") returned 4 [0120.470] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0120.470] lstrlenW (lpString=".xls") returned 4 [0120.470] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0120.470] lstrlenW (lpString=".xlsx") returned 5 [0120.470] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0120.470] lstrlenW (lpString=".ppt") returned 4 [0120.470] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0120.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 63 [0120.470] lstrlenW (lpString=".zip") returned 4 [0120.470] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0120.470] lstrlenW (lpString=".rar") returned 4 [0120.470] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0120.470] lstrlenW (lpString=".bz2") returned 4 [0120.470] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0120.470] lstrlenW (lpString=".7z") returned 3 [0120.470] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0120.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 63 [0120.470] lstrlenW (lpString=".dbf") returned 4 [0120.470] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0120.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 63 [0120.470] lstrlenW (lpString=".1cd") returned 4 [0120.470] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0120.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 63 [0120.470] lstrlenW (lpString=".jpg") returned 4 [0120.470] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0120.472] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x326f8cc | out: lpFileSize=0x326f8cc*=880) returned 1 [0120.472] CloseHandle (hObject=0x218) returned 1 [0120.472] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00105_.wmf")) returned 0x20 [0120.472] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00105_.wmf.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0120.472] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00105_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0120.472] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0120.472] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0120.472] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00105_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0120.473] GetLastError () returned 0x0 [0120.473] ReadFile (in: hFile=0x218, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0x370, lpOverlapped=0x0) returned 1 [0120.568] WriteFile (in: hFile=0x16c, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0x380, lpOverlapped=0x0) returned 1 [0120.569] ReadFile (in: hFile=0x218, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0x0, lpOverlapped=0x0) returned 1 [0120.569] WriteFile (in: hFile=0x16c, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0xec, lpOverlapped=0x0) returned 1 [0120.569] SetEndOfFile (hFile=0x16c) returned 1 [0120.569] CloseHandle (hObject=0x16c) returned 1 [0120.569] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0120.569] SetEndOfFile (hFile=0x218) returned 1 [0120.570] CloseHandle (hObject=0x218) returned 1 [0120.570] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0120.570] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00105_.wmf")) returned 1 [0120.570] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 63 [0120.570] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 63 [0120.570] lstrlenW (lpString=".doc") returned 4 [0120.570] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0120.570] lstrlenW (lpString=".docx") returned 5 [0120.570] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0120.570] lstrlenW (lpString=".pdf") returned 4 [0120.570] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0120.570] lstrlenW (lpString=".xls") returned 4 [0120.570] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0120.570] lstrlenW (lpString=".xlsx") returned 5 [0120.570] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0120.570] lstrlenW (lpString=".ppt") returned 4 [0120.570] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0120.570] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 63 [0120.570] lstrlenW (lpString=".zip") returned 4 [0120.570] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0120.570] lstrlenW (lpString=".rar") returned 4 [0120.570] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0120.570] lstrlenW (lpString=".bz2") returned 4 [0120.571] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0120.571] lstrlenW (lpString=".7z") returned 3 [0120.571] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0120.571] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 63 [0120.571] lstrlenW (lpString=".dbf") returned 4 [0120.571] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0120.571] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 63 [0120.571] lstrlenW (lpString=".1cd") returned 4 [0120.571] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0120.571] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 63 [0120.571] lstrlenW (lpString=".jpg") returned 4 [0120.571] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0120.588] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x326f8cc | out: lpFileSize=0x326f8cc*=1516) returned 1 [0120.588] CloseHandle (hObject=0x1fc) returned 1 [0120.588] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00152_.wmf")) returned 0x20 [0120.588] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00152_.wmf.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0120.588] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00152_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0120.588] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0120.588] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0120.588] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00152_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0120.588] GetLastError () returned 0x0 [0120.588] ReadFile (in: hFile=0x1fc, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0x5ec, lpOverlapped=0x0) returned 1 [0120.682] WriteFile (in: hFile=0x218, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0x5f0, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0x5f0, lpOverlapped=0x0) returned 1 [0120.683] ReadFile (in: hFile=0x1fc, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0x0, lpOverlapped=0x0) returned 1 [0120.683] WriteFile (in: hFile=0x218, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0xec, lpOverlapped=0x0) returned 1 [0120.683] SetEndOfFile (hFile=0x218) returned 1 [0120.683] CloseHandle (hObject=0x218) returned 1 [0120.683] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0120.683] SetEndOfFile (hFile=0x1fc) returned 1 [0120.684] CloseHandle (hObject=0x1fc) returned 1 [0120.684] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0120.684] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00152_.wmf")) returned 1 [0120.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 63 [0120.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 63 [0120.684] lstrlenW (lpString=".doc") returned 4 [0120.684] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0120.684] lstrlenW (lpString=".docx") returned 5 [0120.684] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0120.684] lstrlenW (lpString=".pdf") returned 4 [0120.684] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0120.684] lstrlenW (lpString=".xls") returned 4 [0120.684] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0120.685] lstrlenW (lpString=".xlsx") returned 5 [0120.685] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0120.685] lstrlenW (lpString=".ppt") returned 4 [0120.685] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0120.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 63 [0120.685] lstrlenW (lpString=".zip") returned 4 [0120.685] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0120.685] lstrlenW (lpString=".rar") returned 4 [0120.685] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0120.685] lstrlenW (lpString=".bz2") returned 4 [0120.685] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0120.685] lstrlenW (lpString=".7z") returned 3 [0120.685] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0120.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 63 [0120.685] lstrlenW (lpString=".dbf") returned 4 [0120.685] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0120.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 63 [0120.685] lstrlenW (lpString=".1cd") returned 4 [0120.685] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0120.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 63 [0120.685] lstrlenW (lpString=".jpg") returned 4 [0120.685] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0120.694] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0120.694] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0120.694] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00270_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0120.695] GetLastError () returned 0x0 [0120.695] ReadFile (in: hFile=0x1f8, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0xbc8, lpOverlapped=0x0) returned 1 [0120.706] WriteFile (in: hFile=0x1f4, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xbd0, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0xbd0, lpOverlapped=0x0) returned 1 [0120.706] ReadFile (in: hFile=0x1f8, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0x0, lpOverlapped=0x0) returned 1 [0120.706] WriteFile (in: hFile=0x1f4, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0xec, lpOverlapped=0x0) returned 1 [0120.706] SetEndOfFile (hFile=0x1f4) returned 1 [0120.707] CloseHandle (hObject=0x1f4) returned 1 [0120.707] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0120.707] SetEndOfFile (hFile=0x1f8) returned 1 [0120.707] CloseHandle (hObject=0x1f8) returned 1 [0120.707] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0120.707] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00270_.wmf")) returned 1 [0120.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 63 [0120.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 63 [0120.708] lstrlenW (lpString=".doc") returned 4 [0120.708] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0120.708] lstrlenW (lpString=".docx") returned 5 [0120.708] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0120.708] lstrlenW (lpString=".pdf") returned 4 [0120.708] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0120.708] lstrlenW (lpString=".xls") returned 4 [0120.708] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0120.708] lstrlenW (lpString=".xlsx") returned 5 [0120.708] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0120.708] lstrlenW (lpString=".ppt") returned 4 [0120.708] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0120.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 63 [0120.708] lstrlenW (lpString=".zip") returned 4 [0120.708] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0120.708] lstrlenW (lpString=".rar") returned 4 [0120.708] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0120.708] lstrlenW (lpString=".bz2") returned 4 [0120.708] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0120.708] lstrlenW (lpString=".7z") returned 3 [0120.708] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0120.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 63 [0120.708] lstrlenW (lpString=".dbf") returned 4 [0120.708] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0120.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 63 [0120.708] lstrlenW (lpString=".1cd") returned 4 [0120.708] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0120.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 63 [0120.708] lstrlenW (lpString=".jpg") returned 4 [0120.708] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0120.709] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x326f8cc | out: lpFileSize=0x326f8cc*=13102) returned 1 [0120.709] CloseHandle (hObject=0x1f8) returned 1 [0120.709] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00390_.wmf")) returned 0x20 [0120.709] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00390_.wmf.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0120.709] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00390_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0120.709] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0120.709] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0120.709] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00390_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0120.710] GetLastError () returned 0x0 [0120.710] ReadFile (in: hFile=0x1f8, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0x332e, lpOverlapped=0x0) returned 1 [0120.737] WriteFile (in: hFile=0x1f4, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0x3330, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0x3330, lpOverlapped=0x0) returned 1 [0120.737] ReadFile (in: hFile=0x1f8, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0x0, lpOverlapped=0x0) returned 1 [0120.737] WriteFile (in: hFile=0x1f4, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0xec, lpOverlapped=0x0) returned 1 [0120.737] SetEndOfFile (hFile=0x1f4) returned 1 [0120.737] CloseHandle (hObject=0x1f4) returned 1 [0120.738] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0120.738] SetEndOfFile (hFile=0x1f8) returned 1 [0120.738] CloseHandle (hObject=0x1f8) returned 1 [0120.738] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0120.739] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00390_.wmf")) returned 1 [0120.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 63 [0120.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 63 [0120.739] lstrlenW (lpString=".doc") returned 4 [0120.739] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0120.739] lstrlenW (lpString=".docx") returned 5 [0120.739] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0120.739] lstrlenW (lpString=".pdf") returned 4 [0120.739] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0120.739] lstrlenW (lpString=".xls") returned 4 [0120.739] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0120.739] lstrlenW (lpString=".xlsx") returned 5 [0120.739] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0120.739] lstrlenW (lpString=".ppt") returned 4 [0120.739] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0120.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 63 [0120.739] lstrlenW (lpString=".zip") returned 4 [0120.739] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0120.739] lstrlenW (lpString=".rar") returned 4 [0120.739] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0120.739] lstrlenW (lpString=".bz2") returned 4 [0120.739] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0120.739] lstrlenW (lpString=".7z") returned 3 [0120.739] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0120.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 63 [0120.739] lstrlenW (lpString=".dbf") returned 4 [0120.739] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0120.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 63 [0120.739] lstrlenW (lpString=".1cd") returned 4 [0120.739] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0120.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 63 [0120.739] lstrlenW (lpString=".jpg") returned 4 [0120.739] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0120.740] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x326f8cc | out: lpFileSize=0x326f8cc*=9590) returned 1 [0120.740] CloseHandle (hObject=0x1f8) returned 1 [0120.740] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00525_.wmf")) returned 0x20 [0120.740] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00525_.wmf.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0120.740] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00525_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0120.740] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0120.740] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0120.740] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00525_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0120.740] GetLastError () returned 0x0 [0120.740] ReadFile (in: hFile=0x1f8, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0x2576, lpOverlapped=0x0) returned 1 [0120.750] WriteFile (in: hFile=0x1f4, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0x2580, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0x2580, lpOverlapped=0x0) returned 1 [0120.751] ReadFile (in: hFile=0x1f8, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0x0, lpOverlapped=0x0) returned 1 [0120.751] WriteFile (in: hFile=0x1f4, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0xec, lpOverlapped=0x0) returned 1 [0120.751] SetEndOfFile (hFile=0x1f4) returned 1 [0120.751] CloseHandle (hObject=0x1f4) returned 1 [0120.751] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0120.751] SetEndOfFile (hFile=0x1f8) returned 1 [0120.756] CloseHandle (hObject=0x1f8) returned 1 [0120.756] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0120.757] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00525_.wmf")) returned 1 [0120.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 63 [0120.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 63 [0120.757] lstrlenW (lpString=".doc") returned 4 [0120.757] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0120.757] lstrlenW (lpString=".docx") returned 5 [0120.757] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0120.757] lstrlenW (lpString=".pdf") returned 4 [0120.757] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0120.757] lstrlenW (lpString=".xls") returned 4 [0120.757] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0120.757] lstrlenW (lpString=".xlsx") returned 5 [0120.757] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0120.757] lstrlenW (lpString=".ppt") returned 4 [0120.757] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0120.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 63 [0120.757] lstrlenW (lpString=".zip") returned 4 [0120.757] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0120.757] lstrlenW (lpString=".rar") returned 4 [0120.757] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0120.757] lstrlenW (lpString=".bz2") returned 4 [0120.757] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0120.757] lstrlenW (lpString=".7z") returned 3 [0120.757] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0120.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 63 [0120.757] lstrlenW (lpString=".dbf") returned 4 [0120.757] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0120.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 63 [0120.757] lstrlenW (lpString=".1cd") returned 4 [0120.757] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0120.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 63 [0120.758] lstrlenW (lpString=".jpg") returned 4 [0120.758] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0120.758] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x326f8cc | out: lpFileSize=0x326f8cc*=6256) returned 1 [0120.758] CloseHandle (hObject=0x1f8) returned 1 [0120.758] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00923_.wmf")) returned 0x20 [0120.758] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00923_.wmf.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0120.758] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00923_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0120.758] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0120.758] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0120.758] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00923_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0120.758] GetLastError () returned 0x0 [0120.758] ReadFile (in: hFile=0x1f8, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0x1870, lpOverlapped=0x0) returned 1 [0120.804] WriteFile (in: hFile=0x1f4, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0x1880, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0x1880, lpOverlapped=0x0) returned 1 [0120.805] ReadFile (in: hFile=0x1f8, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0x0, lpOverlapped=0x0) returned 1 [0120.805] WriteFile (in: hFile=0x1f4, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0xec, lpOverlapped=0x0) returned 1 [0120.805] SetEndOfFile (hFile=0x1f4) returned 1 [0120.805] CloseHandle (hObject=0x1f4) returned 1 [0120.805] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0120.805] SetEndOfFile (hFile=0x1f8) returned 1 [0120.806] CloseHandle (hObject=0x1f8) returned 1 [0120.806] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0120.806] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00923_.wmf")) returned 1 [0120.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 63 [0120.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 63 [0120.806] lstrlenW (lpString=".doc") returned 4 [0120.806] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0120.806] lstrlenW (lpString=".docx") returned 5 [0120.806] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0120.806] lstrlenW (lpString=".pdf") returned 4 [0120.806] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0120.806] lstrlenW (lpString=".xls") returned 4 [0120.806] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0120.806] lstrlenW (lpString=".xlsx") returned 5 [0120.806] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0120.806] lstrlenW (lpString=".ppt") returned 4 [0120.806] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0120.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 63 [0120.806] lstrlenW (lpString=".zip") returned 4 [0120.806] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0120.806] lstrlenW (lpString=".rar") returned 4 [0120.806] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0120.806] lstrlenW (lpString=".bz2") returned 4 [0120.806] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0120.807] lstrlenW (lpString=".7z") returned 3 [0120.807] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0120.807] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 63 [0120.807] lstrlenW (lpString=".dbf") returned 4 [0120.807] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0120.807] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 63 [0120.807] lstrlenW (lpString=".1cd") returned 4 [0120.807] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0120.807] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 63 [0120.807] lstrlenW (lpString=".jpg") returned 4 [0120.807] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0120.811] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x326f8cc | out: lpFileSize=0x326f8cc*=29004) returned 1 [0120.811] CloseHandle (hObject=0x1f8) returned 1 [0120.811] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boatinst.wmf")) returned 0x20 [0120.811] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boatinst.wmf.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0120.811] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boatinst.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0120.812] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0120.812] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0120.812] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boatinst.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0120.812] GetLastError () returned 0x0 [0120.812] ReadFile (in: hFile=0x1f8, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0x714c, lpOverlapped=0x0) returned 1 [0120.868] WriteFile (in: hFile=0x1f4, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0x7150, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0x7150, lpOverlapped=0x0) returned 1 [0120.870] ReadFile (in: hFile=0x1f8, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0x0, lpOverlapped=0x0) returned 1 [0120.870] WriteFile (in: hFile=0x1f4, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0xec, lpOverlapped=0x0) returned 1 [0120.870] SetEndOfFile (hFile=0x1f4) returned 1 [0120.870] CloseHandle (hObject=0x1f4) returned 1 [0120.871] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0120.871] SetEndOfFile (hFile=0x1f8) returned 1 [0120.871] CloseHandle (hObject=0x1f8) returned 1 [0120.871] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0120.872] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boatinst.wmf")) returned 1 [0120.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 63 [0120.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 63 [0120.872] lstrlenW (lpString=".doc") returned 4 [0120.872] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0120.872] lstrlenW (lpString=".docx") returned 5 [0120.872] lstrcmpiW (lpString1=".docx", lpString2="T.WMF") returned -1 [0120.872] lstrlenW (lpString=".pdf") returned 4 [0120.872] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0120.872] lstrlenW (lpString=".xls") returned 4 [0120.872] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0120.872] lstrlenW (lpString=".xlsx") returned 5 [0120.872] lstrcmpiW (lpString1=".xlsx", lpString2="T.WMF") returned -1 [0120.872] lstrlenW (lpString=".ppt") returned 4 [0120.872] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0120.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 63 [0120.872] lstrlenW (lpString=".zip") returned 4 [0120.872] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0120.872] lstrlenW (lpString=".rar") returned 4 [0120.872] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0120.872] lstrlenW (lpString=".bz2") returned 4 [0120.872] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0120.872] lstrlenW (lpString=".7z") returned 3 [0120.872] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0120.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 63 [0120.872] lstrlenW (lpString=".dbf") returned 4 [0120.872] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0120.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 63 [0120.872] lstrlenW (lpString=".1cd") returned 4 [0120.872] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0120.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 63 [0120.872] lstrlenW (lpString=".jpg") returned 4 [0120.873] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0120.873] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x326f8cc | out: lpFileSize=0x326f8cc*=2166) returned 1 [0120.873] CloseHandle (hObject=0x1f8) returned 1 [0120.873] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00136_.wmf")) returned 0x20 [0120.873] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00136_.wmf.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0120.873] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00136_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0120.873] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0120.873] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0120.873] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00136_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0120.874] GetLastError () returned 0x0 [0120.874] ReadFile (in: hFile=0x1f8, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0x876, lpOverlapped=0x0) returned 1 [0120.886] WriteFile (in: hFile=0x1f4, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0x880, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0x880, lpOverlapped=0x0) returned 1 [0120.892] ReadFile (in: hFile=0x1f8, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0x0, lpOverlapped=0x0) returned 1 [0120.892] WriteFile (in: hFile=0x1f4, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0xec, lpOverlapped=0x0) returned 1 [0120.892] SetEndOfFile (hFile=0x1f4) returned 1 [0120.892] CloseHandle (hObject=0x1f4) returned 1 [0120.892] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0120.892] SetEndOfFile (hFile=0x1f8) returned 1 [0120.892] CloseHandle (hObject=0x1f8) returned 1 [0120.893] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0120.893] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00136_.wmf")) returned 1 [0120.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 63 [0120.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 63 [0120.893] lstrlenW (lpString=".doc") returned 4 [0120.893] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0120.893] lstrlenW (lpString=".docx") returned 5 [0120.893] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0120.893] lstrlenW (lpString=".pdf") returned 4 [0120.893] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0120.893] lstrlenW (lpString=".xls") returned 4 [0120.893] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0120.893] lstrlenW (lpString=".xlsx") returned 5 [0120.893] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0120.893] lstrlenW (lpString=".ppt") returned 4 [0120.893] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0120.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 63 [0120.893] lstrlenW (lpString=".zip") returned 4 [0120.893] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0120.893] lstrlenW (lpString=".rar") returned 4 [0120.893] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0120.893] lstrlenW (lpString=".bz2") returned 4 [0120.893] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0120.893] lstrlenW (lpString=".7z") returned 3 [0120.893] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0120.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 63 [0120.893] lstrlenW (lpString=".dbf") returned 4 [0120.893] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0120.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 63 [0120.893] lstrlenW (lpString=".1cd") returned 4 [0120.894] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0120.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 63 [0120.894] lstrlenW (lpString=".jpg") returned 4 [0120.894] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0120.898] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0120.898] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0120.898] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00186_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0120.900] GetLastError () returned 0x0 [0120.900] ReadFile (in: hFile=0x1f8, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0x31f4, lpOverlapped=0x0) returned 1 [0120.956] WriteFile (in: hFile=0x1f4, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0x3200, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0x3200, lpOverlapped=0x0) returned 1 [0120.957] ReadFile (in: hFile=0x1f8, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0x0, lpOverlapped=0x0) returned 1 [0120.957] WriteFile (in: hFile=0x1f4, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0xec, lpOverlapped=0x0) returned 1 [0120.957] SetEndOfFile (hFile=0x1f4) returned 1 [0120.957] CloseHandle (hObject=0x1f4) returned 1 [0120.957] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0120.957] SetEndOfFile (hFile=0x1f8) returned 1 [0120.958] CloseHandle (hObject=0x1f8) returned 1 [0120.958] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0120.958] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00186_.wmf")) returned 1 [0120.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 63 [0120.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 63 [0120.958] lstrlenW (lpString=".doc") returned 4 [0120.958] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0120.958] lstrlenW (lpString=".docx") returned 5 [0120.958] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0120.958] lstrlenW (lpString=".pdf") returned 4 [0120.958] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0120.958] lstrlenW (lpString=".xls") returned 4 [0120.958] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0120.958] lstrlenW (lpString=".xlsx") returned 5 [0120.958] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0120.958] lstrlenW (lpString=".ppt") returned 4 [0120.958] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0120.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 63 [0120.958] lstrlenW (lpString=".zip") returned 4 [0120.958] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0120.958] lstrlenW (lpString=".rar") returned 4 [0120.958] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0120.958] lstrlenW (lpString=".bz2") returned 4 [0120.958] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0120.958] lstrlenW (lpString=".7z") returned 3 [0120.958] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0120.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 63 [0120.959] lstrlenW (lpString=".dbf") returned 4 [0120.959] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0120.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 63 [0120.959] lstrlenW (lpString=".1cd") returned 4 [0120.959] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0120.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 63 [0120.959] lstrlenW (lpString=".jpg") returned 4 [0120.959] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0120.959] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x326f8cc | out: lpFileSize=0x326f8cc*=2488) returned 1 [0120.959] CloseHandle (hObject=0x1f8) returned 1 [0120.959] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00442_.wmf")) returned 0x20 [0120.959] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00442_.wmf.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0120.959] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00442_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0120.959] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0120.959] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0120.959] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00442_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0120.960] GetLastError () returned 0x0 [0120.960] ReadFile (in: hFile=0x1f8, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0x9b8, lpOverlapped=0x0) returned 1 [0121.052] WriteFile (in: hFile=0x1f4, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0x9c0, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0x9c0, lpOverlapped=0x0) returned 1 [0121.053] ReadFile (in: hFile=0x1f8, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0x0, lpOverlapped=0x0) returned 1 [0121.053] WriteFile (in: hFile=0x1f4, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0xec, lpOverlapped=0x0) returned 1 [0121.053] SetEndOfFile (hFile=0x1f4) returned 1 [0121.053] CloseHandle (hObject=0x1f4) returned 1 [0121.053] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0121.053] SetEndOfFile (hFile=0x1f8) returned 1 [0121.054] CloseHandle (hObject=0x1f8) returned 1 [0121.054] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0121.054] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00442_.wmf")) returned 1 [0121.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 63 [0121.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 63 [0121.054] lstrlenW (lpString=".doc") returned 4 [0121.054] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0121.054] lstrlenW (lpString=".docx") returned 5 [0121.054] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0121.054] lstrlenW (lpString=".pdf") returned 4 [0121.054] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0121.054] lstrlenW (lpString=".xls") returned 4 [0121.054] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0121.054] lstrlenW (lpString=".xlsx") returned 5 [0121.054] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0121.054] lstrlenW (lpString=".ppt") returned 4 [0121.054] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0121.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 63 [0121.054] lstrlenW (lpString=".zip") returned 4 [0121.054] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0121.054] lstrlenW (lpString=".rar") returned 4 [0121.054] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0121.054] lstrlenW (lpString=".bz2") returned 4 [0121.054] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0121.054] lstrlenW (lpString=".7z") returned 3 [0121.054] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0121.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 63 [0121.055] lstrlenW (lpString=".dbf") returned 4 [0121.055] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0121.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 63 [0121.055] lstrlenW (lpString=".1cd") returned 4 [0121.055] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0121.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 63 [0121.055] lstrlenW (lpString=".jpg") returned 4 [0121.055] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0121.055] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x326f8cc | out: lpFileSize=0x326f8cc*=14996) returned 1 [0121.055] CloseHandle (hObject=0x1f8) returned 1 [0121.055] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01635_.wmf")) returned 0x20 [0121.055] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01635_.wmf.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0121.055] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01635_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0121.055] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0121.055] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0121.055] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01635_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0121.055] GetLastError () returned 0x0 [0121.056] ReadFile (in: hFile=0x1f8, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0x3a94, lpOverlapped=0x0) returned 1 [0121.148] WriteFile (in: hFile=0x1f4, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0x3aa0, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0x3aa0, lpOverlapped=0x0) returned 1 [0121.157] ReadFile (in: hFile=0x1f8, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0x0, lpOverlapped=0x0) returned 1 [0121.157] WriteFile (in: hFile=0x1f4, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0xec, lpOverlapped=0x0) returned 1 [0121.157] SetEndOfFile (hFile=0x1f4) returned 1 [0121.157] CloseHandle (hObject=0x1f4) returned 1 [0121.157] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0121.157] SetEndOfFile (hFile=0x1f8) returned 1 [0121.158] CloseHandle (hObject=0x1f8) returned 1 [0121.158] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0121.158] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01635_.wmf")) returned 1 [0121.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 63 [0121.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 63 [0121.158] lstrlenW (lpString=".doc") returned 4 [0121.158] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0121.158] lstrlenW (lpString=".docx") returned 5 [0121.158] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0121.158] lstrlenW (lpString=".pdf") returned 4 [0121.158] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0121.158] lstrlenW (lpString=".xls") returned 4 [0121.158] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0121.158] lstrlenW (lpString=".xlsx") returned 5 [0121.159] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0121.159] lstrlenW (lpString=".ppt") returned 4 [0121.159] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0121.159] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 63 [0121.159] lstrlenW (lpString=".zip") returned 4 [0121.159] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0121.159] lstrlenW (lpString=".rar") returned 4 [0121.159] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0121.159] lstrlenW (lpString=".bz2") returned 4 [0121.159] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0121.159] lstrlenW (lpString=".7z") returned 3 [0121.159] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0121.159] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 63 [0121.159] lstrlenW (lpString=".dbf") returned 4 [0121.159] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0121.159] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 63 [0121.159] lstrlenW (lpString=".1cd") returned 4 [0121.159] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0121.159] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 63 [0121.159] lstrlenW (lpString=".jpg") returned 4 [0121.159] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0121.159] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x326f8cc | out: lpFileSize=0x326f8cc*=4236) returned 1 [0121.159] CloseHandle (hObject=0x1f8) returned 1 [0121.159] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01639_.wmf")) returned 0x20 [0121.159] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01639_.wmf.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0121.159] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01639_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0121.160] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0121.160] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0121.160] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01639_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0121.160] GetLastError () returned 0x0 [0121.160] ReadFile (in: hFile=0x1f8, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0x108c, lpOverlapped=0x0) returned 1 [0121.174] WriteFile (in: hFile=0x1f4, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0x1090, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0x1090, lpOverlapped=0x0) returned 1 [0121.174] ReadFile (in: hFile=0x1f8, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0x0, lpOverlapped=0x0) returned 1 [0121.175] WriteFile (in: hFile=0x1f4, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0xec, lpOverlapped=0x0) returned 1 [0121.175] SetEndOfFile (hFile=0x1f4) returned 1 [0121.250] CloseHandle (hObject=0x1f4) returned 1 [0121.252] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0121.252] SetEndOfFile (hFile=0x1f8) returned 1 [0121.253] CloseHandle (hObject=0x1f8) returned 1 [0121.253] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0121.253] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01639_.wmf")) returned 1 [0121.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 63 [0121.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 63 [0121.253] lstrlenW (lpString=".doc") returned 4 [0121.253] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0121.253] lstrlenW (lpString=".docx") returned 5 [0121.253] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0121.253] lstrlenW (lpString=".pdf") returned 4 [0121.253] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0121.253] lstrlenW (lpString=".xls") returned 4 [0121.253] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0121.253] lstrlenW (lpString=".xlsx") returned 5 [0121.253] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0121.253] lstrlenW (lpString=".ppt") returned 4 [0121.254] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0121.254] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 63 [0121.254] lstrlenW (lpString=".zip") returned 4 [0121.254] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0121.254] lstrlenW (lpString=".rar") returned 4 [0121.254] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0121.254] lstrlenW (lpString=".bz2") returned 4 [0121.254] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0121.254] lstrlenW (lpString=".7z") returned 3 [0121.254] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0121.254] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 63 [0121.254] lstrlenW (lpString=".dbf") returned 4 [0121.254] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0121.254] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 63 [0121.254] lstrlenW (lpString=".1cd") returned 4 [0121.254] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0121.254] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 63 [0121.254] lstrlenW (lpString=".jpg") returned 4 [0121.254] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0121.257] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x326f8cc | out: lpFileSize=0x326f8cc*=2262) returned 1 [0121.257] CloseHandle (hObject=0x1f8) returned 1 [0121.257] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\classic2.wmf")) returned 0x20 [0121.257] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\classic2.wmf.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0121.257] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\classic2.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0121.257] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0121.257] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0121.257] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\classic2.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0121.258] GetLastError () returned 0x0 [0121.258] ReadFile (in: hFile=0x1f8, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0x8d6, lpOverlapped=0x0) returned 1 [0121.304] WriteFile (in: hFile=0x170, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0x8e0, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0x8e0, lpOverlapped=0x0) returned 1 [0121.305] ReadFile (in: hFile=0x1f8, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0x0, lpOverlapped=0x0) returned 1 [0121.305] WriteFile (in: hFile=0x170, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0xec, lpOverlapped=0x0) returned 1 [0121.305] SetEndOfFile (hFile=0x170) returned 1 [0121.305] CloseHandle (hObject=0x170) returned 1 [0121.305] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0121.305] SetEndOfFile (hFile=0x1f8) returned 1 [0121.305] CloseHandle (hObject=0x1f8) returned 1 [0121.305] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0121.306] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\classic2.wmf")) returned 1 [0121.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 63 [0121.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 63 [0121.306] lstrlenW (lpString=".doc") returned 4 [0121.306] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0121.306] lstrlenW (lpString=".docx") returned 5 [0121.306] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0121.306] lstrlenW (lpString=".pdf") returned 4 [0121.306] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0121.306] lstrlenW (lpString=".xls") returned 4 [0121.306] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0121.306] lstrlenW (lpString=".xlsx") returned 5 [0121.306] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0121.306] lstrlenW (lpString=".ppt") returned 4 [0121.306] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0121.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 63 [0121.306] lstrlenW (lpString=".zip") returned 4 [0121.306] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0121.306] lstrlenW (lpString=".rar") returned 4 [0121.306] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0121.306] lstrlenW (lpString=".bz2") returned 4 [0121.306] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0121.306] lstrlenW (lpString=".7z") returned 3 [0121.306] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0121.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 63 [0121.306] lstrlenW (lpString=".dbf") returned 4 [0121.306] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0121.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 63 [0121.306] lstrlenW (lpString=".1cd") returned 4 [0121.306] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0121.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 63 [0121.306] lstrlenW (lpString=".jpg") returned 4 [0121.306] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0121.307] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x326f8cc | out: lpFileSize=0x326f8cc*=2966) returned 1 [0121.307] CloseHandle (hObject=0x1f8) returned 1 [0121.307] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cup.wmf")) returned 0x20 [0121.307] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cup.wmf.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0121.307] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cup.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0121.308] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0121.308] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0121.308] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cup.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0121.308] GetLastError () returned 0x0 [0121.308] ReadFile (in: hFile=0x1f8, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0xb96, lpOverlapped=0x0) returned 1 [0121.359] WriteFile (in: hFile=0x170, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xba0, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0xba0, lpOverlapped=0x0) returned 1 [0121.359] ReadFile (in: hFile=0x1f8, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0x0, lpOverlapped=0x0) returned 1 [0121.360] WriteFile (in: hFile=0x170, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0xe2, lpOverlapped=0x0) returned 1 [0121.360] SetEndOfFile (hFile=0x170) returned 1 [0121.360] CloseHandle (hObject=0x170) returned 1 [0121.360] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0121.360] SetEndOfFile (hFile=0x1f8) returned 1 [0121.362] CloseHandle (hObject=0x1f8) returned 1 [0121.362] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0121.362] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cup.wmf")) returned 1 [0121.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF") returned 58 [0121.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF") returned 58 [0121.363] lstrlenW (lpString=".doc") returned 4 [0121.363] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0121.363] lstrlenW (lpString=".docx") returned 5 [0121.363] lstrcmpiW (lpString1=".docx", lpString2="P.WMF") returned -1 [0121.363] lstrlenW (lpString=".pdf") returned 4 [0121.363] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0121.363] lstrlenW (lpString=".xls") returned 4 [0121.363] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0121.363] lstrlenW (lpString=".xlsx") returned 5 [0121.363] lstrcmpiW (lpString1=".xlsx", lpString2="P.WMF") returned -1 [0121.363] lstrlenW (lpString=".ppt") returned 4 [0121.363] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0121.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF") returned 58 [0121.363] lstrlenW (lpString=".zip") returned 4 [0121.363] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0121.363] lstrlenW (lpString=".rar") returned 4 [0121.363] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0121.363] lstrlenW (lpString=".bz2") returned 4 [0121.363] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0121.363] lstrlenW (lpString=".7z") returned 3 [0121.363] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0121.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF") returned 58 [0121.363] lstrlenW (lpString=".dbf") returned 4 [0121.363] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0121.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF") returned 58 [0121.363] lstrlenW (lpString=".1cd") returned 4 [0121.363] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0121.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF") returned 58 [0121.363] lstrlenW (lpString=".jpg") returned 4 [0121.363] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0121.417] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0121.417] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0121.417] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00117_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0121.423] GetLastError () returned 0x0 [0121.423] ReadFile (in: hFile=0x1e4, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0x7992, lpOverlapped=0x0) returned 1 [0121.511] WriteFile (in: hFile=0x220, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0x79a0, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0x79a0, lpOverlapped=0x0) returned 1 [0121.512] ReadFile (in: hFile=0x1e4, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0x0, lpOverlapped=0x0) returned 1 [0121.512] WriteFile (in: hFile=0x220, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0xec, lpOverlapped=0x0) returned 1 [0121.512] SetEndOfFile (hFile=0x220) returned 1 [0121.512] CloseHandle (hObject=0x220) returned 1 [0121.513] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0121.513] SetEndOfFile (hFile=0x1e4) returned 1 [0121.513] CloseHandle (hObject=0x1e4) returned 1 [0121.513] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0121.513] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00117_.wmf")) returned 1 [0121.514] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 63 [0121.514] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 63 [0121.514] lstrlenW (lpString=".doc") returned 4 [0121.514] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0121.514] lstrlenW (lpString=".docx") returned 5 [0121.514] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0121.514] lstrlenW (lpString=".pdf") returned 4 [0121.514] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0121.514] lstrlenW (lpString=".xls") returned 4 [0121.514] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0121.514] lstrlenW (lpString=".xlsx") returned 5 [0121.514] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0121.514] lstrlenW (lpString=".ppt") returned 4 [0121.514] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0121.514] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 63 [0121.514] lstrlenW (lpString=".zip") returned 4 [0121.514] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0121.514] lstrlenW (lpString=".rar") returned 4 [0121.514] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0121.514] lstrlenW (lpString=".bz2") returned 4 [0121.514] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0121.514] lstrlenW (lpString=".7z") returned 3 [0121.514] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0121.514] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 63 [0121.514] lstrlenW (lpString=".dbf") returned 4 [0121.514] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0121.514] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 63 [0121.514] lstrlenW (lpString=".1cd") returned 4 [0121.514] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0121.514] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 63 [0121.514] lstrlenW (lpString=".jpg") returned 4 [0121.514] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0121.515] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x326f8cc | out: lpFileSize=0x326f8cc*=42908) returned 1 [0121.515] CloseHandle (hObject=0x1e4) returned 1 [0121.515] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00414_.wmf")) returned 0x20 [0121.515] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00414_.wmf.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0121.515] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00414_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0121.515] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0121.515] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0121.515] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00414_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0121.515] GetLastError () returned 0x0 [0121.515] ReadFile (in: hFile=0x1e4, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0xa79c, lpOverlapped=0x0) returned 1 [0121.537] WriteFile (in: hFile=0x220, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xa7a0, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0xa7a0, lpOverlapped=0x0) returned 1 [0121.538] ReadFile (in: hFile=0x1e4, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0x0, lpOverlapped=0x0) returned 1 [0121.538] WriteFile (in: hFile=0x220, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0xec, lpOverlapped=0x0) returned 1 [0121.538] SetEndOfFile (hFile=0x220) returned 1 [0121.541] CloseHandle (hObject=0x220) returned 1 [0121.541] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0121.541] SetEndOfFile (hFile=0x1e4) returned 1 [0121.543] CloseHandle (hObject=0x1e4) returned 1 [0121.543] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0121.543] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00414_.wmf")) returned 1 [0121.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF") returned 63 [0121.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF") returned 63 [0121.543] lstrlenW (lpString=".doc") returned 4 [0121.543] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0121.543] lstrlenW (lpString=".docx") returned 5 [0121.543] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0121.543] lstrlenW (lpString=".pdf") returned 4 [0121.543] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0121.543] lstrlenW (lpString=".xls") returned 4 [0121.543] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0121.543] lstrlenW (lpString=".xlsx") returned 5 [0121.543] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0121.543] lstrlenW (lpString=".ppt") returned 4 [0121.543] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0121.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF") returned 63 [0121.543] lstrlenW (lpString=".zip") returned 4 [0121.543] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0121.543] lstrlenW (lpString=".rar") returned 4 [0121.543] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0121.543] lstrlenW (lpString=".bz2") returned 4 [0121.543] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0121.543] lstrlenW (lpString=".7z") returned 3 [0121.543] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0121.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF") returned 63 [0121.543] lstrlenW (lpString=".dbf") returned 4 [0121.543] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0121.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF") returned 63 [0121.543] lstrlenW (lpString=".1cd") returned 4 [0121.543] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0121.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF") returned 63 [0121.543] lstrlenW (lpString=".jpg") returned 4 [0121.544] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0121.544] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x326f8cc | out: lpFileSize=0x326f8cc*=9992) returned 1 [0121.544] CloseHandle (hObject=0x1e4) returned 1 [0121.544] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00449_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00449_.wmf")) returned 0x20 [0121.544] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00449_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00449_.wmf.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0121.544] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00449_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00449_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0121.544] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0121.544] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0121.544] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00449_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00449_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0121.545] GetLastError () returned 0x0 [0121.545] ReadFile (in: hFile=0x1e4, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0x2708, lpOverlapped=0x0) returned 1 [0121.631] WriteFile (in: hFile=0x220, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0x2710, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0x2710, lpOverlapped=0x0) returned 1 [0121.632] ReadFile (in: hFile=0x1e4, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0x0, lpOverlapped=0x0) returned 1 [0121.632] WriteFile (in: hFile=0x220, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0xec, lpOverlapped=0x0) returned 1 [0121.632] SetEndOfFile (hFile=0x220) returned 1 [0121.632] CloseHandle (hObject=0x220) returned 1 [0121.632] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0121.633] SetEndOfFile (hFile=0x1e4) returned 1 [0121.633] CloseHandle (hObject=0x1e4) returned 1 [0121.633] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00449_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0121.633] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00449_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00449_.wmf")) returned 1 [0121.672] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00449_.WMF") returned 63 [0121.672] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00449_.WMF") returned 63 [0121.672] lstrlenW (lpString=".doc") returned 4 [0121.672] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0121.672] lstrlenW (lpString=".docx") returned 5 [0121.672] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0121.672] lstrlenW (lpString=".pdf") returned 4 [0121.672] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0121.672] lstrlenW (lpString=".xls") returned 4 [0121.672] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0121.672] lstrlenW (lpString=".xlsx") returned 5 [0121.672] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0121.673] lstrlenW (lpString=".ppt") returned 4 [0121.673] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0121.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00449_.WMF") returned 63 [0121.673] lstrlenW (lpString=".zip") returned 4 [0121.673] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0121.673] lstrlenW (lpString=".rar") returned 4 [0121.673] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0121.673] lstrlenW (lpString=".bz2") returned 4 [0121.673] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0121.673] lstrlenW (lpString=".7z") returned 3 [0121.673] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0121.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00449_.WMF") returned 63 [0121.673] lstrlenW (lpString=".dbf") returned 4 [0121.673] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0121.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00449_.WMF") returned 63 [0121.673] lstrlenW (lpString=".1cd") returned 4 [0121.673] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0121.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00449_.WMF") returned 63 [0121.673] lstrlenW (lpString=".jpg") returned 4 [0121.673] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0121.673] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0121.673] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0121.673] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01145_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01145_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0121.673] GetLastError () returned 0x0 [0121.673] ReadFile (in: hFile=0x220, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0xadc, lpOverlapped=0x0) returned 1 [0121.696] WriteFile (in: hFile=0x164, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xae0, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0xae0, lpOverlapped=0x0) returned 1 [0121.697] ReadFile (in: hFile=0x220, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0x0, lpOverlapped=0x0) returned 1 [0121.697] WriteFile (in: hFile=0x164, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0xec, lpOverlapped=0x0) returned 1 [0121.697] SetEndOfFile (hFile=0x164) returned 1 [0121.697] CloseHandle (hObject=0x164) returned 1 [0121.697] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0121.697] SetEndOfFile (hFile=0x220) returned 1 [0121.697] CloseHandle (hObject=0x220) returned 1 [0121.697] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01145_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0121.698] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01145_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01145_.wmf")) returned 1 [0121.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 63 [0121.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 63 [0121.698] lstrlenW (lpString=".doc") returned 4 [0121.698] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0121.698] lstrlenW (lpString=".docx") returned 5 [0121.698] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0121.698] lstrlenW (lpString=".pdf") returned 4 [0121.698] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0121.698] lstrlenW (lpString=".xls") returned 4 [0121.698] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0121.698] lstrlenW (lpString=".xlsx") returned 5 [0121.698] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0121.698] lstrlenW (lpString=".ppt") returned 4 [0121.698] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0121.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 63 [0121.698] lstrlenW (lpString=".zip") returned 4 [0121.698] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0121.698] lstrlenW (lpString=".rar") returned 4 [0121.698] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0121.698] lstrlenW (lpString=".bz2") returned 4 [0121.698] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0121.698] lstrlenW (lpString=".7z") returned 3 [0121.698] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0121.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 63 [0121.698] lstrlenW (lpString=".dbf") returned 4 [0121.698] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0121.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 63 [0121.698] lstrlenW (lpString=".1cd") returned 4 [0121.699] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0121.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 63 [0121.699] lstrlenW (lpString=".jpg") returned 4 [0121.699] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0121.699] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0121.699] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0121.699] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01151_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01151_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0121.699] GetLastError () returned 0x0 [0121.699] ReadFile (in: hFile=0x220, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0xb90, lpOverlapped=0x0) returned 1 [0121.721] WriteFile (in: hFile=0x164, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xba0, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0xba0, lpOverlapped=0x0) returned 1 [0121.721] ReadFile (in: hFile=0x220, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0x0, lpOverlapped=0x0) returned 1 [0121.721] WriteFile (in: hFile=0x164, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0xec, lpOverlapped=0x0) returned 1 [0121.721] SetEndOfFile (hFile=0x164) returned 1 [0121.721] CloseHandle (hObject=0x164) returned 1 [0121.721] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0121.721] SetEndOfFile (hFile=0x220) returned 1 [0121.722] CloseHandle (hObject=0x220) returned 1 [0121.722] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01151_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0121.722] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01151_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01151_.wmf")) returned 1 [0121.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01151_.WMF") returned 63 [0121.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01151_.WMF") returned 63 [0121.723] lstrlenW (lpString=".doc") returned 4 [0121.723] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0121.723] lstrlenW (lpString=".docx") returned 5 [0121.723] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0121.723] lstrlenW (lpString=".pdf") returned 4 [0121.723] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0121.723] lstrlenW (lpString=".xls") returned 4 [0121.723] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0121.723] lstrlenW (lpString=".xlsx") returned 5 [0121.723] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0121.723] lstrlenW (lpString=".ppt") returned 4 [0121.723] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0121.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01151_.WMF") returned 63 [0121.723] lstrlenW (lpString=".zip") returned 4 [0121.723] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0121.723] lstrlenW (lpString=".rar") returned 4 [0121.723] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0121.723] lstrlenW (lpString=".bz2") returned 4 [0121.723] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0121.723] lstrlenW (lpString=".7z") returned 3 [0121.723] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0121.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01151_.WMF") returned 63 [0121.723] lstrlenW (lpString=".dbf") returned 4 [0121.723] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0121.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01151_.WMF") returned 63 [0121.723] lstrlenW (lpString=".1cd") returned 4 [0121.723] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0121.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01151_.WMF") returned 63 [0121.723] lstrlenW (lpString=".jpg") returned 4 [0121.723] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0121.723] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x326f8cc | out: lpFileSize=0x326f8cc*=2228) returned 1 [0121.723] CloseHandle (hObject=0x220) returned 1 [0121.723] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01160_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01160_.wmf")) returned 0x20 [0121.723] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01160_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01160_.wmf.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0121.723] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01160_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01160_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0121.724] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0121.724] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0121.724] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01160_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01160_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0121.724] GetLastError () returned 0x0 [0121.724] ReadFile (in: hFile=0x220, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0x8b4, lpOverlapped=0x0) returned 1 [0121.737] WriteFile (in: hFile=0x164, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0x8c0, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0x8c0, lpOverlapped=0x0) returned 1 [0121.737] ReadFile (in: hFile=0x220, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0x0, lpOverlapped=0x0) returned 1 [0121.737] WriteFile (in: hFile=0x164, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0xec, lpOverlapped=0x0) returned 1 [0121.737] SetEndOfFile (hFile=0x164) returned 1 [0121.737] CloseHandle (hObject=0x164) returned 1 [0121.737] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0121.738] SetEndOfFile (hFile=0x220) returned 1 [0121.738] CloseHandle (hObject=0x220) returned 1 [0121.738] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01160_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0121.738] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01160_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01160_.wmf")) returned 1 [0121.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 63 [0121.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 63 [0121.738] lstrlenW (lpString=".doc") returned 4 [0121.738] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0121.738] lstrlenW (lpString=".docx") returned 5 [0121.738] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0121.738] lstrlenW (lpString=".pdf") returned 4 [0121.738] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0121.738] lstrlenW (lpString=".xls") returned 4 [0121.738] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0121.738] lstrlenW (lpString=".xlsx") returned 5 [0121.739] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0121.739] lstrlenW (lpString=".ppt") returned 4 [0121.739] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0121.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 63 [0121.739] lstrlenW (lpString=".zip") returned 4 [0121.739] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0121.739] lstrlenW (lpString=".rar") returned 4 [0121.739] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0121.739] lstrlenW (lpString=".bz2") returned 4 [0121.739] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0121.739] lstrlenW (lpString=".7z") returned 3 [0121.739] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0121.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 63 [0121.739] lstrlenW (lpString=".dbf") returned 4 [0121.739] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0121.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 63 [0121.739] lstrlenW (lpString=".1cd") returned 4 [0121.739] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0121.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 63 [0121.739] lstrlenW (lpString=".jpg") returned 4 [0121.739] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0121.739] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0121.739] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0121.740] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01166_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01166_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0121.740] GetLastError () returned 0x0 [0121.740] ReadFile (in: hFile=0x220, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0x820, lpOverlapped=0x0) returned 1 [0121.748] WriteFile (in: hFile=0x164, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0x830, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0x830, lpOverlapped=0x0) returned 1 [0121.749] ReadFile (in: hFile=0x220, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0x0, lpOverlapped=0x0) returned 1 [0121.749] WriteFile (in: hFile=0x164, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0xec, lpOverlapped=0x0) returned 1 [0121.749] SetEndOfFile (hFile=0x164) returned 1 [0121.749] CloseHandle (hObject=0x164) returned 1 [0121.749] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0121.749] SetEndOfFile (hFile=0x220) returned 1 [0121.750] CloseHandle (hObject=0x220) returned 1 [0121.750] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01166_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0121.750] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01166_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01166_.wmf")) returned 1 [0121.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 63 [0121.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 63 [0121.750] lstrlenW (lpString=".doc") returned 4 [0121.750] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0121.750] lstrlenW (lpString=".docx") returned 5 [0121.750] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0121.750] lstrlenW (lpString=".pdf") returned 4 [0121.750] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0121.750] lstrlenW (lpString=".xls") returned 4 [0121.750] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0121.750] lstrlenW (lpString=".xlsx") returned 5 [0121.750] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0121.750] lstrlenW (lpString=".ppt") returned 4 [0121.750] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0121.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 63 [0121.750] lstrlenW (lpString=".zip") returned 4 [0121.750] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0121.750] lstrlenW (lpString=".rar") returned 4 [0121.750] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0121.750] lstrlenW (lpString=".bz2") returned 4 [0121.750] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0121.750] lstrlenW (lpString=".7z") returned 3 [0121.750] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0121.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 63 [0121.750] lstrlenW (lpString=".dbf") returned 4 [0121.750] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0121.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 63 [0121.750] lstrlenW (lpString=".1cd") returned 4 [0121.750] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0121.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 63 [0121.750] lstrlenW (lpString=".jpg") returned 4 [0121.750] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0121.755] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0121.755] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0121.755] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01167_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0121.755] GetLastError () returned 0x0 [0121.755] ReadFile (in: hFile=0x220, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0x820, lpOverlapped=0x0) returned 1 [0121.765] WriteFile (in: hFile=0x164, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0x830, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0x830, lpOverlapped=0x0) returned 1 [0121.765] ReadFile (in: hFile=0x220, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0x0, lpOverlapped=0x0) returned 1 [0121.765] WriteFile (in: hFile=0x164, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0xec, lpOverlapped=0x0) returned 1 [0121.765] SetEndOfFile (hFile=0x164) returned 1 [0121.766] CloseHandle (hObject=0x164) returned 1 [0121.766] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0121.766] SetEndOfFile (hFile=0x220) returned 1 [0121.766] CloseHandle (hObject=0x220) returned 1 [0121.766] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0121.766] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01167_.wmf")) returned 1 [0121.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 63 [0121.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 63 [0121.767] lstrlenW (lpString=".doc") returned 4 [0121.767] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0121.767] lstrlenW (lpString=".docx") returned 5 [0121.767] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0121.767] lstrlenW (lpString=".pdf") returned 4 [0121.767] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0121.767] lstrlenW (lpString=".xls") returned 4 [0121.767] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0121.767] lstrlenW (lpString=".xlsx") returned 5 [0121.767] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0121.767] lstrlenW (lpString=".ppt") returned 4 [0121.767] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0121.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 63 [0121.767] lstrlenW (lpString=".zip") returned 4 [0121.767] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0121.767] lstrlenW (lpString=".rar") returned 4 [0121.767] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0121.767] lstrlenW (lpString=".bz2") returned 4 [0121.767] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0121.770] lstrlenW (lpString=".7z") returned 3 [0121.770] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0121.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 63 [0121.770] lstrlenW (lpString=".dbf") returned 4 [0121.770] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0121.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 63 [0121.770] lstrlenW (lpString=".1cd") returned 4 [0121.770] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0121.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 63 [0121.770] lstrlenW (lpString=".jpg") returned 4 [0121.770] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0121.968] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0121.969] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0121.969] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01170_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0121.969] GetLastError () returned 0x0 [0121.969] ReadFile (in: hFile=0x218, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0x964, lpOverlapped=0x0) returned 1 [0122.024] WriteFile (in: hFile=0x1c0, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0x970, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0x970, lpOverlapped=0x0) returned 1 [0122.025] ReadFile (in: hFile=0x218, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0x0, lpOverlapped=0x0) returned 1 [0122.025] WriteFile (in: hFile=0x1c0, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0xec, lpOverlapped=0x0) returned 1 [0122.025] SetEndOfFile (hFile=0x1c0) returned 1 [0122.025] CloseHandle (hObject=0x1c0) returned 1 [0122.025] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0122.025] SetEndOfFile (hFile=0x218) returned 1 [0122.026] CloseHandle (hObject=0x218) returned 1 [0122.026] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0122.026] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01170_.wmf")) returned 1 [0122.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 63 [0122.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 63 [0122.027] lstrlenW (lpString=".doc") returned 4 [0122.027] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0122.027] lstrlenW (lpString=".docx") returned 5 [0122.027] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0122.027] lstrlenW (lpString=".pdf") returned 4 [0122.027] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0122.027] lstrlenW (lpString=".xls") returned 4 [0122.027] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0122.027] lstrlenW (lpString=".xlsx") returned 5 [0122.027] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0122.027] lstrlenW (lpString=".ppt") returned 4 [0122.027] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0122.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 63 [0122.027] lstrlenW (lpString=".zip") returned 4 [0122.027] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0122.027] lstrlenW (lpString=".rar") returned 4 [0122.027] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0122.027] lstrlenW (lpString=".bz2") returned 4 [0122.027] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0122.027] lstrlenW (lpString=".7z") returned 3 [0122.027] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0122.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 63 [0122.027] lstrlenW (lpString=".dbf") returned 4 [0122.027] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0122.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 63 [0122.027] lstrlenW (lpString=".1cd") returned 4 [0122.027] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0122.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 63 [0122.027] lstrlenW (lpString=".jpg") returned 4 [0122.027] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0122.033] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0122.033] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0122.033] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01181_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01181_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0122.034] GetLastError () returned 0x0 [0122.034] ReadFile (in: hFile=0x218, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0x5a8, lpOverlapped=0x0) returned 1 [0122.035] WriteFile (in: hFile=0x1c0, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0x5b0, lpOverlapped=0x0) returned 1 [0122.036] ReadFile (in: hFile=0x218, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0x0, lpOverlapped=0x0) returned 1 [0122.036] WriteFile (in: hFile=0x1c0, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0xec, lpOverlapped=0x0) returned 1 [0122.036] SetEndOfFile (hFile=0x1c0) returned 1 [0122.036] CloseHandle (hObject=0x1c0) returned 1 [0122.036] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0122.036] SetEndOfFile (hFile=0x218) returned 1 [0122.037] CloseHandle (hObject=0x218) returned 1 [0122.037] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01181_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0122.037] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01181_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01181_.wmf")) returned 1 [0122.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 63 [0122.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 63 [0122.037] lstrlenW (lpString=".doc") returned 4 [0122.037] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0122.037] lstrlenW (lpString=".docx") returned 5 [0122.040] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0122.040] lstrlenW (lpString=".pdf") returned 4 [0122.041] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0122.041] lstrlenW (lpString=".xls") returned 4 [0122.041] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0122.041] lstrlenW (lpString=".xlsx") returned 5 [0122.041] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0122.041] lstrlenW (lpString=".ppt") returned 4 [0122.041] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0122.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 63 [0122.041] lstrlenW (lpString=".zip") returned 4 [0122.041] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0122.041] lstrlenW (lpString=".rar") returned 4 [0122.041] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0122.041] lstrlenW (lpString=".bz2") returned 4 [0122.041] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0122.041] lstrlenW (lpString=".7z") returned 3 [0122.041] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0122.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 63 [0122.041] lstrlenW (lpString=".dbf") returned 4 [0122.041] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0122.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 63 [0122.041] lstrlenW (lpString=".1cd") returned 4 [0122.041] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0122.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 63 [0122.041] lstrlenW (lpString=".jpg") returned 4 [0122.041] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0122.041] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0122.042] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0122.042] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01183_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01183_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0122.042] GetLastError () returned 0x0 [0122.042] ReadFile (in: hFile=0x218, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0x8f8, lpOverlapped=0x0) returned 1 [0122.193] WriteFile (in: hFile=0x1c0, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0x900, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0x900, lpOverlapped=0x0) returned 1 [0122.204] ReadFile (in: hFile=0x218, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0x0, lpOverlapped=0x0) returned 1 [0122.204] WriteFile (in: hFile=0x1c0, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0xec, lpOverlapped=0x0) returned 1 [0122.205] SetEndOfFile (hFile=0x1c0) returned 1 [0122.205] CloseHandle (hObject=0x1c0) returned 1 [0122.205] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0122.205] SetEndOfFile (hFile=0x218) returned 1 [0122.205] CloseHandle (hObject=0x218) returned 1 [0122.205] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01183_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0122.206] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01183_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01183_.wmf")) returned 1 [0122.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 63 [0122.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 63 [0122.250] lstrlenW (lpString=".doc") returned 4 [0122.250] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0122.250] lstrlenW (lpString=".docx") returned 5 [0122.250] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0122.250] lstrlenW (lpString=".pdf") returned 4 [0122.250] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0122.250] lstrlenW (lpString=".xls") returned 4 [0122.250] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0122.251] lstrlenW (lpString=".xlsx") returned 5 [0122.251] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0122.251] lstrlenW (lpString=".ppt") returned 4 [0122.251] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0122.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 63 [0122.251] lstrlenW (lpString=".zip") returned 4 [0122.251] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0122.251] lstrlenW (lpString=".rar") returned 4 [0122.251] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0122.251] lstrlenW (lpString=".bz2") returned 4 [0122.251] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0122.251] lstrlenW (lpString=".7z") returned 3 [0122.251] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0122.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 63 [0122.251] lstrlenW (lpString=".dbf") returned 4 [0122.251] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0122.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 63 [0122.251] lstrlenW (lpString=".1cd") returned 4 [0122.251] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0122.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 63 [0122.251] lstrlenW (lpString=".jpg") returned 4 [0122.251] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0122.259] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0122.259] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0122.259] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01434_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01434_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0122.260] GetLastError () returned 0x0 [0122.260] ReadFile (in: hFile=0x21c, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0x384, lpOverlapped=0x0) returned 1 [0122.268] WriteFile (in: hFile=0x1ec, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0x390, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0x390, lpOverlapped=0x0) returned 1 [0122.268] ReadFile (in: hFile=0x21c, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0x0, lpOverlapped=0x0) returned 1 [0122.268] WriteFile (in: hFile=0x1ec, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0xec, lpOverlapped=0x0) returned 1 [0122.269] SetEndOfFile (hFile=0x1ec) returned 1 [0122.269] CloseHandle (hObject=0x1ec) returned 1 [0122.269] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0122.269] SetEndOfFile (hFile=0x21c) returned 1 [0122.269] CloseHandle (hObject=0x21c) returned 1 [0122.269] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01434_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0122.270] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01434_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01434_.wmf")) returned 1 [0122.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 63 [0122.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 63 [0122.270] lstrlenW (lpString=".doc") returned 4 [0122.270] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0122.270] lstrlenW (lpString=".docx") returned 5 [0122.270] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0122.270] lstrlenW (lpString=".pdf") returned 4 [0122.270] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0122.270] lstrlenW (lpString=".xls") returned 4 [0122.270] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0122.270] lstrlenW (lpString=".xlsx") returned 5 [0122.270] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0122.270] lstrlenW (lpString=".ppt") returned 4 [0122.270] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0122.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 63 [0122.270] lstrlenW (lpString=".zip") returned 4 [0122.270] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0122.270] lstrlenW (lpString=".rar") returned 4 [0122.270] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0122.270] lstrlenW (lpString=".bz2") returned 4 [0122.270] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0122.270] lstrlenW (lpString=".7z") returned 3 [0122.270] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0122.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 63 [0122.270] lstrlenW (lpString=".dbf") returned 4 [0122.270] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0122.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 63 [0122.270] lstrlenW (lpString=".1cd") returned 4 [0122.270] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0122.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 63 [0122.270] lstrlenW (lpString=".jpg") returned 4 [0122.270] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0122.271] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0122.271] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0122.271] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01628_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0122.271] GetLastError () returned 0x0 [0122.271] ReadFile (in: hFile=0x21c, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0x4a7c, lpOverlapped=0x0) returned 1 [0122.306] WriteFile (in: hFile=0x1ec, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0x4a80, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0x4a80, lpOverlapped=0x0) returned 1 [0122.307] ReadFile (in: hFile=0x21c, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0x0, lpOverlapped=0x0) returned 1 [0122.307] WriteFile (in: hFile=0x1ec, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0xec, lpOverlapped=0x0) returned 1 [0122.307] SetEndOfFile (hFile=0x1ec) returned 1 [0122.307] CloseHandle (hObject=0x1ec) returned 1 [0122.307] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0122.307] SetEndOfFile (hFile=0x21c) returned 1 [0122.308] CloseHandle (hObject=0x21c) returned 1 [0122.308] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0122.308] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01628_.wmf")) returned 1 [0122.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 63 [0122.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 63 [0122.308] lstrlenW (lpString=".doc") returned 4 [0122.308] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0122.308] lstrlenW (lpString=".docx") returned 5 [0122.308] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0122.308] lstrlenW (lpString=".pdf") returned 4 [0122.308] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0122.308] lstrlenW (lpString=".xls") returned 4 [0122.308] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0122.308] lstrlenW (lpString=".xlsx") returned 5 [0122.308] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0122.308] lstrlenW (lpString=".ppt") returned 4 [0122.308] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0122.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 63 [0122.308] lstrlenW (lpString=".zip") returned 4 [0122.308] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0122.308] lstrlenW (lpString=".rar") returned 4 [0122.308] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0122.308] lstrlenW (lpString=".bz2") returned 4 [0122.309] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0122.309] lstrlenW (lpString=".7z") returned 3 [0122.309] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0122.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 63 [0122.309] lstrlenW (lpString=".dbf") returned 4 [0122.309] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0122.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 63 [0122.309] lstrlenW (lpString=".1cd") returned 4 [0122.309] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0122.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 63 [0122.309] lstrlenW (lpString=".jpg") returned 4 [0122.309] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0122.309] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0122.309] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0122.309] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01630_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0122.310] GetLastError () returned 0x0 [0122.310] ReadFile (in: hFile=0x21c, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0x128, lpOverlapped=0x0) returned 1 [0122.310] WriteFile (in: hFile=0x1ec, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0x130, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0x130, lpOverlapped=0x0) returned 1 [0122.311] ReadFile (in: hFile=0x21c, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0x0, lpOverlapped=0x0) returned 1 [0122.311] WriteFile (in: hFile=0x1ec, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0xec, lpOverlapped=0x0) returned 1 [0122.312] SetEndOfFile (hFile=0x1ec) returned 1 [0122.312] CloseHandle (hObject=0x1ec) returned 1 [0122.312] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0122.312] SetEndOfFile (hFile=0x21c) returned 1 [0122.312] CloseHandle (hObject=0x21c) returned 1 [0122.312] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0122.312] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01630_.wmf")) returned 1 [0122.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 63 [0122.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 63 [0122.313] lstrlenW (lpString=".doc") returned 4 [0122.313] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0122.313] lstrlenW (lpString=".docx") returned 5 [0122.313] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0122.313] lstrlenW (lpString=".pdf") returned 4 [0122.313] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0122.313] lstrlenW (lpString=".xls") returned 4 [0122.313] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0122.313] lstrlenW (lpString=".xlsx") returned 5 [0122.313] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0122.313] lstrlenW (lpString=".ppt") returned 4 [0122.313] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0122.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 63 [0122.313] lstrlenW (lpString=".zip") returned 4 [0122.313] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0122.313] lstrlenW (lpString=".rar") returned 4 [0122.313] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0122.313] lstrlenW (lpString=".bz2") returned 4 [0122.313] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0122.313] lstrlenW (lpString=".7z") returned 3 [0122.313] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0122.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 63 [0122.313] lstrlenW (lpString=".dbf") returned 4 [0122.313] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0122.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 63 [0122.313] lstrlenW (lpString=".1cd") returned 4 [0122.313] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0122.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 63 [0122.313] lstrlenW (lpString=".jpg") returned 4 [0122.313] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0122.314] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0122.314] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0122.314] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01631_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0122.314] GetLastError () returned 0x0 [0122.314] ReadFile (in: hFile=0x21c, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0x228, lpOverlapped=0x0) returned 1 [0122.315] WriteFile (in: hFile=0x1ec, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0x230, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0x230, lpOverlapped=0x0) returned 1 [0122.316] ReadFile (in: hFile=0x21c, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0x0, lpOverlapped=0x0) returned 1 [0122.316] WriteFile (in: hFile=0x1ec, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0xec, lpOverlapped=0x0) returned 1 [0122.316] SetEndOfFile (hFile=0x1ec) returned 1 [0122.316] CloseHandle (hObject=0x1ec) returned 1 [0122.316] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0122.316] SetEndOfFile (hFile=0x21c) returned 1 [0122.316] CloseHandle (hObject=0x21c) returned 1 [0122.317] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0122.317] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01631_.wmf")) returned 1 [0122.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 63 [0122.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 63 [0122.317] lstrlenW (lpString=".doc") returned 4 [0122.317] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0122.317] lstrlenW (lpString=".docx") returned 5 [0122.317] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0122.317] lstrlenW (lpString=".pdf") returned 4 [0122.317] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0122.317] lstrlenW (lpString=".xls") returned 4 [0122.317] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0122.317] lstrlenW (lpString=".xlsx") returned 5 [0122.317] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0122.317] lstrlenW (lpString=".ppt") returned 4 [0122.317] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0122.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 63 [0122.317] lstrlenW (lpString=".zip") returned 4 [0122.317] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0122.317] lstrlenW (lpString=".rar") returned 4 [0122.317] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0122.317] lstrlenW (lpString=".bz2") returned 4 [0122.317] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0122.317] lstrlenW (lpString=".7z") returned 3 [0122.317] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0122.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 63 [0122.317] lstrlenW (lpString=".dbf") returned 4 [0122.317] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0122.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 63 [0122.317] lstrlenW (lpString=".1cd") returned 4 [0122.318] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0122.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 63 [0122.318] lstrlenW (lpString=".jpg") returned 4 [0122.318] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0122.318] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0122.318] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0122.318] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01761_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0122.319] GetLastError () returned 0x0 [0122.319] ReadFile (in: hFile=0x21c, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0x1034, lpOverlapped=0x0) returned 1 [0122.412] WriteFile (in: hFile=0x1ec, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0x1040, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0x1040, lpOverlapped=0x0) returned 1 [0122.413] ReadFile (in: hFile=0x21c, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0x0, lpOverlapped=0x0) returned 1 [0122.413] WriteFile (in: hFile=0x1ec, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0xec, lpOverlapped=0x0) returned 1 [0122.413] SetEndOfFile (hFile=0x1ec) returned 1 [0122.413] CloseHandle (hObject=0x1ec) returned 1 [0122.413] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0122.413] SetEndOfFile (hFile=0x21c) returned 1 [0122.414] CloseHandle (hObject=0x21c) returned 1 [0122.414] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0122.414] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01761_.wmf")) returned 1 [0122.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 63 [0122.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 63 [0122.414] lstrlenW (lpString=".doc") returned 4 [0122.414] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0122.414] lstrlenW (lpString=".docx") returned 5 [0122.415] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0122.415] lstrlenW (lpString=".pdf") returned 4 [0122.415] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0122.415] lstrlenW (lpString=".xls") returned 4 [0122.415] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0122.415] lstrlenW (lpString=".xlsx") returned 5 [0122.415] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0122.415] lstrlenW (lpString=".ppt") returned 4 [0122.415] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0122.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 63 [0122.415] lstrlenW (lpString=".zip") returned 4 [0122.415] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0122.415] lstrlenW (lpString=".rar") returned 4 [0122.415] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0122.415] lstrlenW (lpString=".bz2") returned 4 [0122.415] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0122.415] lstrlenW (lpString=".7z") returned 3 [0122.415] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0122.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 63 [0122.415] lstrlenW (lpString=".dbf") returned 4 [0122.415] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0122.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 63 [0122.415] lstrlenW (lpString=".1cd") returned 4 [0122.415] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0122.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 63 [0122.415] lstrlenW (lpString=".jpg") returned 4 [0122.415] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0122.423] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0122.423] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0122.423] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00172_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0122.424] GetLastError () returned 0x0 [0122.424] ReadFile (in: hFile=0x180, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0xa8c, lpOverlapped=0x0) returned 1 [0122.471] WriteFile (in: hFile=0x21c, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xa90, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0xa90, lpOverlapped=0x0) returned 1 [0122.472] ReadFile (in: hFile=0x180, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0x0, lpOverlapped=0x0) returned 1 [0122.472] WriteFile (in: hFile=0x21c, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0xec, lpOverlapped=0x0) returned 1 [0122.472] SetEndOfFile (hFile=0x21c) returned 1 [0122.472] CloseHandle (hObject=0x21c) returned 1 [0122.472] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0122.472] SetEndOfFile (hFile=0x180) returned 1 [0122.473] CloseHandle (hObject=0x180) returned 1 [0122.473] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0122.473] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00172_.wmf")) returned 1 [0122.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF") returned 63 [0122.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF") returned 63 [0122.473] lstrlenW (lpString=".doc") returned 4 [0122.473] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0122.473] lstrlenW (lpString=".docx") returned 5 [0122.473] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0122.473] lstrlenW (lpString=".pdf") returned 4 [0122.473] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0122.473] lstrlenW (lpString=".xls") returned 4 [0122.473] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0122.473] lstrlenW (lpString=".xlsx") returned 5 [0122.473] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0122.473] lstrlenW (lpString=".ppt") returned 4 [0122.473] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0122.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF") returned 63 [0122.474] lstrlenW (lpString=".zip") returned 4 [0122.474] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0122.474] lstrlenW (lpString=".rar") returned 4 [0122.474] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0122.474] lstrlenW (lpString=".bz2") returned 4 [0122.474] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0122.474] lstrlenW (lpString=".7z") returned 3 [0122.474] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0122.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF") returned 63 [0122.474] lstrlenW (lpString=".dbf") returned 4 [0122.474] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0122.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF") returned 63 [0122.474] lstrlenW (lpString=".1cd") returned 4 [0122.474] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0122.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF") returned 63 [0122.474] lstrlenW (lpString=".jpg") returned 4 [0122.474] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0122.474] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0122.474] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0122.474] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00222_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00222_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0122.475] GetLastError () returned 0x0 [0122.475] ReadFile (in: hFile=0x180, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0x3044, lpOverlapped=0x0) returned 1 [0122.524] WriteFile (in: hFile=0x21c, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0x3050, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0x3050, lpOverlapped=0x0) returned 1 [0122.524] ReadFile (in: hFile=0x180, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0x0, lpOverlapped=0x0) returned 1 [0122.524] WriteFile (in: hFile=0x21c, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0xec, lpOverlapped=0x0) returned 1 [0122.524] SetEndOfFile (hFile=0x21c) returned 1 [0122.525] CloseHandle (hObject=0x21c) returned 1 [0122.525] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0122.525] SetEndOfFile (hFile=0x180) returned 1 [0122.525] CloseHandle (hObject=0x180) returned 1 [0122.525] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00222_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0122.525] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00222_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00222_.wmf")) returned 1 [0122.526] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 63 [0122.526] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 63 [0122.526] lstrlenW (lpString=".doc") returned 4 [0122.526] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0122.526] lstrlenW (lpString=".docx") returned 5 [0122.526] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0122.526] lstrlenW (lpString=".pdf") returned 4 [0122.526] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0122.526] lstrlenW (lpString=".xls") returned 4 [0122.526] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0122.526] lstrlenW (lpString=".xlsx") returned 5 [0122.526] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0122.526] lstrlenW (lpString=".ppt") returned 4 [0122.526] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0122.526] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 63 [0122.526] lstrlenW (lpString=".zip") returned 4 [0122.526] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0122.526] lstrlenW (lpString=".rar") returned 4 [0122.526] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0122.526] lstrlenW (lpString=".bz2") returned 4 [0122.526] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0122.526] lstrlenW (lpString=".7z") returned 3 [0122.526] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0122.526] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 63 [0122.526] lstrlenW (lpString=".dbf") returned 4 [0122.526] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0122.526] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 63 [0122.526] lstrlenW (lpString=".1cd") returned 4 [0122.526] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0122.526] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 63 [0122.526] lstrlenW (lpString=".jpg") returned 4 [0122.526] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0122.527] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0122.527] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0122.527] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00397_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0122.527] GetLastError () returned 0x0 [0122.527] ReadFile (in: hFile=0x180, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0x439c, lpOverlapped=0x0) returned 1 [0122.536] WriteFile (in: hFile=0x21c, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0x43a0, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0x43a0, lpOverlapped=0x0) returned 1 [0122.536] ReadFile (in: hFile=0x180, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0x0, lpOverlapped=0x0) returned 1 [0122.536] WriteFile (in: hFile=0x21c, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0xec, lpOverlapped=0x0) returned 1 [0122.536] SetEndOfFile (hFile=0x21c) returned 1 [0122.536] CloseHandle (hObject=0x21c) returned 1 [0122.537] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0122.537] SetEndOfFile (hFile=0x180) returned 1 [0122.537] CloseHandle (hObject=0x180) returned 1 [0122.537] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0122.537] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00397_.wmf")) returned 1 [0122.539] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 63 [0122.540] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 63 [0122.540] lstrlenW (lpString=".doc") returned 4 [0122.540] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0122.540] lstrlenW (lpString=".docx") returned 5 [0122.540] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0122.540] lstrlenW (lpString=".pdf") returned 4 [0122.540] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0122.540] lstrlenW (lpString=".xls") returned 4 [0122.540] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0122.540] lstrlenW (lpString=".xlsx") returned 5 [0122.540] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0122.540] lstrlenW (lpString=".ppt") returned 4 [0122.540] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0122.540] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 63 [0122.540] lstrlenW (lpString=".zip") returned 4 [0122.540] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0122.540] lstrlenW (lpString=".rar") returned 4 [0122.540] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0122.540] lstrlenW (lpString=".bz2") returned 4 [0122.540] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0122.540] lstrlenW (lpString=".7z") returned 3 [0122.540] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0122.540] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 63 [0122.540] lstrlenW (lpString=".dbf") returned 4 [0122.540] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0122.540] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 63 [0122.540] lstrlenW (lpString=".1cd") returned 4 [0122.540] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0122.540] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 63 [0122.540] lstrlenW (lpString=".jpg") returned 4 [0122.540] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0122.541] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0122.541] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0122.541] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00074_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00074_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0122.541] GetLastError () returned 0x0 [0122.541] ReadFile (in: hFile=0x1f0, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0x45ba, lpOverlapped=0x0) returned 1 [0122.567] WriteFile (in: hFile=0x180, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0x45c0, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0x45c0, lpOverlapped=0x0) returned 1 [0122.568] ReadFile (in: hFile=0x1f0, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0x0, lpOverlapped=0x0) returned 1 [0122.568] WriteFile (in: hFile=0x180, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0xec, lpOverlapped=0x0) returned 1 [0122.568] SetEndOfFile (hFile=0x180) returned 1 [0122.568] CloseHandle (hObject=0x180) returned 1 [0122.568] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0122.568] SetEndOfFile (hFile=0x1f0) returned 1 [0122.568] CloseHandle (hObject=0x1f0) returned 1 [0122.568] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00074_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0122.569] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00074_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00074_.wmf")) returned 1 [0122.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 63 [0122.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 63 [0122.569] lstrlenW (lpString=".doc") returned 4 [0122.569] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0122.569] lstrlenW (lpString=".docx") returned 5 [0122.569] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0122.569] lstrlenW (lpString=".pdf") returned 4 [0122.569] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0122.569] lstrlenW (lpString=".xls") returned 4 [0122.569] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0122.569] lstrlenW (lpString=".xlsx") returned 5 [0122.569] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0122.569] lstrlenW (lpString=".ppt") returned 4 [0122.569] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0122.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 63 [0122.569] lstrlenW (lpString=".zip") returned 4 [0122.569] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0122.569] lstrlenW (lpString=".rar") returned 4 [0122.569] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0122.569] lstrlenW (lpString=".bz2") returned 4 [0122.569] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0122.569] lstrlenW (lpString=".7z") returned 3 [0122.569] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0122.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 63 [0122.569] lstrlenW (lpString=".dbf") returned 4 [0122.569] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0122.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 63 [0122.569] lstrlenW (lpString=".1cd") returned 4 [0122.569] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0122.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 63 [0122.569] lstrlenW (lpString=".jpg") returned 4 [0122.569] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0122.570] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0122.570] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0122.570] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00077_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00077_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0122.571] GetLastError () returned 0x0 [0122.571] ReadFile (in: hFile=0x1f0, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0x7620, lpOverlapped=0x0) returned 1 [0122.638] WriteFile (in: hFile=0x180, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0x7630, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0x7630, lpOverlapped=0x0) returned 1 [0122.639] ReadFile (in: hFile=0x1f0, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0x0, lpOverlapped=0x0) returned 1 [0122.639] WriteFile (in: hFile=0x180, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0xec, lpOverlapped=0x0) returned 1 [0122.639] SetEndOfFile (hFile=0x180) returned 1 [0122.639] CloseHandle (hObject=0x180) returned 1 [0122.639] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0122.639] SetEndOfFile (hFile=0x1f0) returned 1 [0122.640] CloseHandle (hObject=0x1f0) returned 1 [0122.640] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00077_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0122.640] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00077_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00077_.wmf")) returned 1 [0122.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 63 [0122.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 63 [0122.640] lstrlenW (lpString=".doc") returned 4 [0122.640] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0122.640] lstrlenW (lpString=".docx") returned 5 [0122.640] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0122.640] lstrlenW (lpString=".pdf") returned 4 [0122.640] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0122.640] lstrlenW (lpString=".xls") returned 4 [0122.640] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0122.640] lstrlenW (lpString=".xlsx") returned 5 [0122.640] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0122.640] lstrlenW (lpString=".ppt") returned 4 [0122.640] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0122.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 63 [0122.640] lstrlenW (lpString=".zip") returned 4 [0122.640] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0122.641] lstrlenW (lpString=".rar") returned 4 [0122.641] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0122.641] lstrlenW (lpString=".bz2") returned 4 [0122.641] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0122.641] lstrlenW (lpString=".7z") returned 3 [0122.641] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0122.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 63 [0122.641] lstrlenW (lpString=".dbf") returned 4 [0122.641] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0122.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 63 [0122.641] lstrlenW (lpString=".1cd") returned 4 [0122.641] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0122.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 63 [0122.641] lstrlenW (lpString=".jpg") returned 4 [0122.641] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0122.641] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0122.641] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0122.641] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00096_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0122.642] GetLastError () returned 0x0 [0122.642] ReadFile (in: hFile=0x1f0, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0x920e, lpOverlapped=0x0) returned 1 [0122.652] WriteFile (in: hFile=0x180, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0x9210, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0x9210, lpOverlapped=0x0) returned 1 [0122.653] ReadFile (in: hFile=0x1f0, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0x0, lpOverlapped=0x0) returned 1 [0122.653] WriteFile (in: hFile=0x180, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0xec, lpOverlapped=0x0) returned 1 [0122.653] SetEndOfFile (hFile=0x180) returned 1 [0122.653] CloseHandle (hObject=0x180) returned 1 [0122.653] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0122.653] SetEndOfFile (hFile=0x1f0) returned 1 [0122.654] CloseHandle (hObject=0x1f0) returned 1 [0122.654] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0122.654] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00096_.wmf")) returned 1 [0122.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 63 [0122.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 63 [0122.654] lstrlenW (lpString=".doc") returned 4 [0122.655] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0122.655] lstrlenW (lpString=".docx") returned 5 [0122.655] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0122.655] lstrlenW (lpString=".pdf") returned 4 [0122.655] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0122.655] lstrlenW (lpString=".xls") returned 4 [0122.655] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0122.655] lstrlenW (lpString=".xlsx") returned 5 [0122.655] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0122.655] lstrlenW (lpString=".ppt") returned 4 [0122.655] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0122.655] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 63 [0122.655] lstrlenW (lpString=".zip") returned 4 [0122.655] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0122.655] lstrlenW (lpString=".rar") returned 4 [0122.655] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0122.655] lstrlenW (lpString=".bz2") returned 4 [0122.655] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0122.655] lstrlenW (lpString=".7z") returned 3 [0122.655] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0122.655] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 63 [0122.655] lstrlenW (lpString=".dbf") returned 4 [0122.655] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0122.655] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 63 [0122.655] lstrlenW (lpString=".1cd") returned 4 [0122.655] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0122.655] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 63 [0122.655] lstrlenW (lpString=".jpg") returned 4 [0122.655] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0122.655] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0122.655] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0122.655] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00306_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0122.656] GetLastError () returned 0x0 [0122.656] ReadFile (in: hFile=0x1f0, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0xb6de, lpOverlapped=0x0) returned 1 [0122.698] WriteFile (in: hFile=0x180, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xb6e0, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0xb6e0, lpOverlapped=0x0) returned 1 [0122.699] ReadFile (in: hFile=0x1f0, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0x0, lpOverlapped=0x0) returned 1 [0122.699] WriteFile (in: hFile=0x180, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0xec, lpOverlapped=0x0) returned 1 [0122.699] SetEndOfFile (hFile=0x180) returned 1 [0122.699] CloseHandle (hObject=0x180) returned 1 [0122.699] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0122.699] SetEndOfFile (hFile=0x1f0) returned 1 [0122.699] CloseHandle (hObject=0x1f0) returned 1 [0122.700] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0122.700] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00306_.wmf")) returned 1 [0122.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 63 [0122.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 63 [0122.700] lstrlenW (lpString=".doc") returned 4 [0122.700] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0122.700] lstrlenW (lpString=".docx") returned 5 [0122.700] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0122.700] lstrlenW (lpString=".pdf") returned 4 [0122.700] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0122.700] lstrlenW (lpString=".xls") returned 4 [0122.700] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0122.700] lstrlenW (lpString=".xlsx") returned 5 [0122.700] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0122.700] lstrlenW (lpString=".ppt") returned 4 [0122.700] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0122.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 63 [0122.700] lstrlenW (lpString=".zip") returned 4 [0122.700] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0122.700] lstrlenW (lpString=".rar") returned 4 [0122.700] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0122.700] lstrlenW (lpString=".bz2") returned 4 [0122.700] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0122.700] lstrlenW (lpString=".7z") returned 3 [0122.700] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0122.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 63 [0122.700] lstrlenW (lpString=".dbf") returned 4 [0122.701] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0122.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 63 [0122.701] lstrlenW (lpString=".1cd") returned 4 [0122.701] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0122.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 63 [0122.701] lstrlenW (lpString=".jpg") returned 4 [0122.701] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0122.702] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0122.702] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0122.702] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00361_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00361_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0122.702] GetLastError () returned 0x0 [0122.702] ReadFile (in: hFile=0x1f0, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0xfea, lpOverlapped=0x0) returned 1 [0122.953] WriteFile (in: hFile=0x180, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xff0, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0xff0, lpOverlapped=0x0) returned 1 [0122.953] ReadFile (in: hFile=0x1f0, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0x0, lpOverlapped=0x0) returned 1 [0122.953] WriteFile (in: hFile=0x180, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0xec, lpOverlapped=0x0) returned 1 [0122.953] SetEndOfFile (hFile=0x180) returned 1 [0122.954] CloseHandle (hObject=0x180) returned 1 [0122.954] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0122.954] SetEndOfFile (hFile=0x1f0) returned 1 [0122.954] CloseHandle (hObject=0x1f0) returned 1 [0122.954] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00361_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0122.954] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00361_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00361_.wmf")) returned 1 [0122.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00361_.WMF") returned 63 [0122.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00361_.WMF") returned 63 [0122.955] lstrlenW (lpString=".doc") returned 4 [0122.955] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0122.955] lstrlenW (lpString=".docx") returned 5 [0122.955] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0122.955] lstrlenW (lpString=".pdf") returned 4 [0122.955] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0122.955] lstrlenW (lpString=".xls") returned 4 [0122.955] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0122.955] lstrlenW (lpString=".xlsx") returned 5 [0122.955] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0122.955] lstrlenW (lpString=".ppt") returned 4 [0122.955] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0122.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00361_.WMF") returned 63 [0122.955] lstrlenW (lpString=".zip") returned 4 [0122.955] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0122.955] lstrlenW (lpString=".rar") returned 4 [0122.955] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0122.955] lstrlenW (lpString=".bz2") returned 4 [0122.955] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0122.955] lstrlenW (lpString=".7z") returned 3 [0122.955] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0122.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00361_.WMF") returned 63 [0122.955] lstrlenW (lpString=".dbf") returned 4 [0122.955] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0122.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00361_.WMF") returned 63 [0122.955] lstrlenW (lpString=".1cd") returned 4 [0122.955] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0122.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00361_.WMF") returned 63 [0122.955] lstrlenW (lpString=".jpg") returned 4 [0122.955] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0122.956] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0122.956] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0122.956] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00564_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00564_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0122.956] GetLastError () returned 0x0 [0122.956] ReadFile (in: hFile=0x1f0, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0x380, lpOverlapped=0x0) returned 1 [0122.985] WriteFile (in: hFile=0x180, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0x390, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0x390, lpOverlapped=0x0) returned 1 [0122.986] ReadFile (in: hFile=0x1f0, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0x0, lpOverlapped=0x0) returned 1 [0122.986] WriteFile (in: hFile=0x180, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0xec, lpOverlapped=0x0) returned 1 [0122.986] SetEndOfFile (hFile=0x180) returned 1 [0122.986] CloseHandle (hObject=0x180) returned 1 [0122.987] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0122.987] SetEndOfFile (hFile=0x1f0) returned 1 [0122.987] CloseHandle (hObject=0x1f0) returned 1 [0122.987] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00564_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0122.987] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00564_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00564_.wmf")) returned 1 [0122.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 63 [0122.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 63 [0122.988] lstrlenW (lpString=".doc") returned 4 [0122.988] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0122.988] lstrlenW (lpString=".docx") returned 5 [0122.988] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0122.988] lstrlenW (lpString=".pdf") returned 4 [0122.988] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0122.988] lstrlenW (lpString=".xls") returned 4 [0122.988] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0122.988] lstrlenW (lpString=".xlsx") returned 5 [0122.988] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0122.988] lstrlenW (lpString=".ppt") returned 4 [0122.988] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0122.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 63 [0122.988] lstrlenW (lpString=".zip") returned 4 [0122.988] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0122.988] lstrlenW (lpString=".rar") returned 4 [0122.988] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0122.988] lstrlenW (lpString=".bz2") returned 4 [0122.988] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0122.988] lstrlenW (lpString=".7z") returned 3 [0122.988] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0122.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 63 [0122.988] lstrlenW (lpString=".dbf") returned 4 [0122.988] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0122.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 63 [0122.988] lstrlenW (lpString=".1cd") returned 4 [0122.988] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0122.989] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 63 [0122.989] lstrlenW (lpString=".jpg") returned 4 [0122.989] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0122.989] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x326f8cc | out: lpFileSize=0x326f8cc*=752) returned 1 [0122.989] CloseHandle (hObject=0x1f0) returned 1 [0122.989] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00586_.wmf")) returned 0x20 [0122.989] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00586_.wmf.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0122.989] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00586_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0122.989] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0122.989] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0122.989] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00586_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0122.990] GetLastError () returned 0x0 [0122.990] ReadFile (in: hFile=0x1f0, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0x2f0, lpOverlapped=0x0) returned 1 [0123.033] WriteFile (in: hFile=0x180, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0x300, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0x300, lpOverlapped=0x0) returned 1 [0123.034] ReadFile (in: hFile=0x1f0, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0x0, lpOverlapped=0x0) returned 1 [0123.034] WriteFile (in: hFile=0x180, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0xec, lpOverlapped=0x0) returned 1 [0123.034] SetEndOfFile (hFile=0x180) returned 1 [0123.034] CloseHandle (hObject=0x180) returned 1 [0123.034] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0123.034] SetEndOfFile (hFile=0x1f0) returned 1 [0123.035] CloseHandle (hObject=0x1f0) returned 1 [0123.035] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0123.035] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00586_.wmf")) returned 1 [0123.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 63 [0123.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 63 [0123.035] lstrlenW (lpString=".doc") returned 4 [0123.035] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0123.035] lstrlenW (lpString=".docx") returned 5 [0123.035] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0123.035] lstrlenW (lpString=".pdf") returned 4 [0123.035] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0123.035] lstrlenW (lpString=".xls") returned 4 [0123.035] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0123.035] lstrlenW (lpString=".xlsx") returned 5 [0123.035] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0123.035] lstrlenW (lpString=".ppt") returned 4 [0123.035] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0123.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 63 [0123.035] lstrlenW (lpString=".zip") returned 4 [0123.035] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0123.035] lstrlenW (lpString=".rar") returned 4 [0123.035] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0123.035] lstrlenW (lpString=".bz2") returned 4 [0123.035] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0123.035] lstrlenW (lpString=".7z") returned 3 [0123.035] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0123.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 63 [0123.035] lstrlenW (lpString=".dbf") returned 4 [0123.035] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0123.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 63 [0123.035] lstrlenW (lpString=".1cd") returned 4 [0123.036] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0123.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 63 [0123.036] lstrlenW (lpString=".jpg") returned 4 [0123.036] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0123.036] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0123.036] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0123.036] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00814_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00814_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0123.036] GetLastError () returned 0x0 [0123.036] ReadFile (in: hFile=0x1f0, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0xa6d0, lpOverlapped=0x0) returned 1 [0123.078] WriteFile (in: hFile=0x180, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xa6e0, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0xa6e0, lpOverlapped=0x0) returned 1 [0123.079] ReadFile (in: hFile=0x1f0, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0x0, lpOverlapped=0x0) returned 1 [0123.079] WriteFile (in: hFile=0x180, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0xec, lpOverlapped=0x0) returned 1 [0123.079] SetEndOfFile (hFile=0x180) returned 1 [0123.079] CloseHandle (hObject=0x180) returned 1 [0123.079] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0123.080] SetEndOfFile (hFile=0x1f0) returned 1 [0123.080] CloseHandle (hObject=0x1f0) returned 1 [0123.080] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00814_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0123.080] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00814_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00814_.wmf")) returned 1 [0123.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 63 [0123.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 63 [0123.081] lstrlenW (lpString=".doc") returned 4 [0123.081] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0123.081] lstrlenW (lpString=".docx") returned 5 [0123.081] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0123.081] lstrlenW (lpString=".pdf") returned 4 [0123.081] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0123.081] lstrlenW (lpString=".xls") returned 4 [0123.081] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0123.081] lstrlenW (lpString=".xlsx") returned 5 [0123.081] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0123.081] lstrlenW (lpString=".ppt") returned 4 [0123.081] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0123.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 63 [0123.081] lstrlenW (lpString=".zip") returned 4 [0123.081] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0123.081] lstrlenW (lpString=".rar") returned 4 [0123.081] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0123.081] lstrlenW (lpString=".bz2") returned 4 [0123.081] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0123.081] lstrlenW (lpString=".7z") returned 3 [0123.081] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0123.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 63 [0123.081] lstrlenW (lpString=".dbf") returned 4 [0123.081] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0123.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 63 [0123.081] lstrlenW (lpString=".1cd") returned 4 [0123.081] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0123.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 63 [0123.081] lstrlenW (lpString=".jpg") returned 4 [0123.081] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0123.082] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0123.082] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0123.082] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01084_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0123.082] GetLastError () returned 0x0 [0123.082] ReadFile (in: hFile=0x1f0, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0x96c, lpOverlapped=0x0) returned 1 [0123.146] WriteFile (in: hFile=0x180, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0x970, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0x970, lpOverlapped=0x0) returned 1 [0123.147] ReadFile (in: hFile=0x1f0, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0x0, lpOverlapped=0x0) returned 1 [0123.147] WriteFile (in: hFile=0x180, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0xec, lpOverlapped=0x0) returned 1 [0123.147] SetEndOfFile (hFile=0x180) returned 1 [0123.147] CloseHandle (hObject=0x180) returned 1 [0123.147] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0123.147] SetEndOfFile (hFile=0x1f0) returned 1 [0123.148] CloseHandle (hObject=0x1f0) returned 1 [0123.148] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0123.148] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01084_.wmf")) returned 1 [0123.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 63 [0123.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 63 [0123.148] lstrlenW (lpString=".doc") returned 4 [0123.148] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0123.148] lstrlenW (lpString=".docx") returned 5 [0123.148] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0123.148] lstrlenW (lpString=".pdf") returned 4 [0123.148] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0123.148] lstrlenW (lpString=".xls") returned 4 [0123.148] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0123.148] lstrlenW (lpString=".xlsx") returned 5 [0123.148] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0123.148] lstrlenW (lpString=".ppt") returned 4 [0123.149] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0123.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 63 [0123.149] lstrlenW (lpString=".zip") returned 4 [0123.149] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0123.149] lstrlenW (lpString=".rar") returned 4 [0123.149] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0123.149] lstrlenW (lpString=".bz2") returned 4 [0123.149] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0123.149] lstrlenW (lpString=".7z") returned 3 [0123.149] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0123.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 63 [0123.149] lstrlenW (lpString=".dbf") returned 4 [0123.149] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0123.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 63 [0123.149] lstrlenW (lpString=".1cd") returned 4 [0123.149] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0123.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 63 [0123.149] lstrlenW (lpString=".jpg") returned 4 [0123.149] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0123.373] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0123.373] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0123.373] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01191_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0123.374] GetLastError () returned 0x0 [0123.374] ReadFile (in: hFile=0x1a0, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0xf7c, lpOverlapped=0x0) returned 1 [0123.572] WriteFile (in: hFile=0x1f0, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xf80, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0xf80, lpOverlapped=0x0) returned 1 [0124.053] ReadFile (in: hFile=0x1a0, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0x0, lpOverlapped=0x0) returned 1 [0124.053] WriteFile (in: hFile=0x1f0, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0xec, lpOverlapped=0x0) returned 1 [0124.054] SetEndOfFile (hFile=0x1f0) returned 1 [0124.054] CloseHandle (hObject=0x1f0) returned 1 [0124.054] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0124.054] SetEndOfFile (hFile=0x1a0) returned 1 [0124.054] CloseHandle (hObject=0x1a0) returned 1 [0124.054] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0124.054] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01191_.wmf")) returned 1 [0124.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 63 [0124.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 63 [0124.055] lstrlenW (lpString=".doc") returned 4 [0124.055] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0124.055] lstrlenW (lpString=".docx") returned 5 [0124.055] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0124.055] lstrlenW (lpString=".pdf") returned 4 [0124.055] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0124.055] lstrlenW (lpString=".xls") returned 4 [0124.055] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0124.055] lstrlenW (lpString=".xlsx") returned 5 [0124.055] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0124.055] lstrlenW (lpString=".ppt") returned 4 [0124.055] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0124.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 63 [0124.055] lstrlenW (lpString=".zip") returned 4 [0124.055] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0124.055] lstrlenW (lpString=".rar") returned 4 [0124.055] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0124.055] lstrlenW (lpString=".bz2") returned 4 [0124.055] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0124.055] lstrlenW (lpString=".7z") returned 3 [0124.055] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0124.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 63 [0124.055] lstrlenW (lpString=".dbf") returned 4 [0124.055] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0124.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 63 [0124.055] lstrlenW (lpString=".1cd") returned 4 [0124.055] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0124.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 63 [0124.055] lstrlenW (lpString=".jpg") returned 4 [0124.055] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0124.355] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0124.355] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0124.355] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00084_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00084_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0124.356] GetLastError () returned 0x0 [0124.356] ReadFile (in: hFile=0x230, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0x9a8, lpOverlapped=0x0) returned 1 [0124.446] WriteFile (in: hFile=0x1b0, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0x9b0, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0x9b0, lpOverlapped=0x0) returned 1 [0124.447] ReadFile (in: hFile=0x230, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0x0, lpOverlapped=0x0) returned 1 [0124.448] WriteFile (in: hFile=0x1b0, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0xec, lpOverlapped=0x0) returned 1 [0124.450] SetEndOfFile (hFile=0x1b0) returned 1 [0124.450] CloseHandle (hObject=0x1b0) returned 1 [0124.450] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0124.450] SetEndOfFile (hFile=0x230) returned 1 [0124.453] CloseHandle (hObject=0x230) returned 1 [0124.453] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00084_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0124.453] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00084_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00084_.wmf")) returned 1 [0124.454] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00084_.WMF") returned 63 [0124.454] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00084_.WMF") returned 63 [0124.454] lstrlenW (lpString=".doc") returned 4 [0124.454] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0124.454] lstrlenW (lpString=".docx") returned 5 [0124.454] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0124.454] lstrlenW (lpString=".pdf") returned 4 [0124.454] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0124.454] lstrlenW (lpString=".xls") returned 4 [0124.454] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0124.482] lstrlenW (lpString=".xlsx") returned 5 [0124.482] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0124.482] lstrlenW (lpString=".ppt") returned 4 [0124.482] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0124.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00084_.WMF") returned 63 [0124.482] lstrlenW (lpString=".zip") returned 4 [0124.482] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0124.482] lstrlenW (lpString=".rar") returned 4 [0124.482] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0124.482] lstrlenW (lpString=".bz2") returned 4 [0124.482] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0124.482] lstrlenW (lpString=".7z") returned 3 [0124.482] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0124.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00084_.WMF") returned 63 [0124.482] lstrlenW (lpString=".dbf") returned 4 [0124.482] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0124.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00084_.WMF") returned 63 [0124.483] lstrlenW (lpString=".1cd") returned 4 [0124.483] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0124.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00084_.WMF") returned 63 [0124.483] lstrlenW (lpString=".jpg") returned 4 [0124.483] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0124.483] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0124.483] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0124.483] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00276_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00276_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0124.498] GetLastError () returned 0x0 [0124.498] ReadFile (in: hFile=0x230, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0xbc8, lpOverlapped=0x0) returned 1 [0124.564] WriteFile (in: hFile=0x1b0, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xbd0, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0xbd0, lpOverlapped=0x0) returned 1 [0124.564] ReadFile (in: hFile=0x230, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0x0, lpOverlapped=0x0) returned 1 [0124.564] WriteFile (in: hFile=0x1b0, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0xec, lpOverlapped=0x0) returned 1 [0124.565] SetEndOfFile (hFile=0x1b0) returned 1 [0124.565] CloseHandle (hObject=0x1b0) returned 1 [0124.565] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0124.565] SetEndOfFile (hFile=0x230) returned 1 [0124.565] CloseHandle (hObject=0x230) returned 1 [0124.565] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00276_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0124.565] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00276_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00276_.wmf")) returned 1 [0124.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 63 [0124.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 63 [0124.634] lstrlenW (lpString=".doc") returned 4 [0124.634] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0124.634] lstrlenW (lpString=".docx") returned 5 [0124.634] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0124.634] lstrlenW (lpString=".pdf") returned 4 [0124.634] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0124.634] lstrlenW (lpString=".xls") returned 4 [0124.634] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0124.634] lstrlenW (lpString=".xlsx") returned 5 [0124.634] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0124.634] lstrlenW (lpString=".ppt") returned 4 [0124.634] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0124.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 63 [0124.634] lstrlenW (lpString=".zip") returned 4 [0124.634] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0124.634] lstrlenW (lpString=".rar") returned 4 [0124.634] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0124.634] lstrlenW (lpString=".bz2") returned 4 [0124.634] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0124.634] lstrlenW (lpString=".7z") returned 3 [0124.634] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0124.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 63 [0124.634] lstrlenW (lpString=".dbf") returned 4 [0124.634] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0124.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 63 [0124.634] lstrlenW (lpString=".1cd") returned 4 [0124.634] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0124.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 63 [0124.634] lstrlenW (lpString=".jpg") returned 4 [0124.634] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0124.635] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0124.635] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0124.635] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00513_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00513_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x244 [0124.635] GetLastError () returned 0x0 [0124.635] ReadFile (in: hFile=0x20c, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0x332, lpOverlapped=0x0) returned 1 [0124.692] WriteFile (in: hFile=0x244, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0x340, lpOverlapped=0x0) returned 1 [0124.692] ReadFile (in: hFile=0x20c, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0x0, lpOverlapped=0x0) returned 1 [0124.692] WriteFile (in: hFile=0x244, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0xec, lpOverlapped=0x0) returned 1 [0124.692] SetEndOfFile (hFile=0x244) returned 1 [0124.692] CloseHandle (hObject=0x244) returned 1 [0124.693] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0124.693] SetEndOfFile (hFile=0x20c) returned 1 [0124.693] CloseHandle (hObject=0x20c) returned 1 [0124.693] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00513_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0124.693] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00513_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00513_.wmf")) returned 1 [0124.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00513_.WMF") returned 63 [0124.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00513_.WMF") returned 63 [0124.694] lstrlenW (lpString=".doc") returned 4 [0124.694] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0124.694] lstrlenW (lpString=".docx") returned 5 [0124.694] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0124.694] lstrlenW (lpString=".pdf") returned 4 [0124.694] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0124.694] lstrlenW (lpString=".xls") returned 4 [0124.694] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0124.694] lstrlenW (lpString=".xlsx") returned 5 [0124.694] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0124.694] lstrlenW (lpString=".ppt") returned 4 [0124.694] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0124.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00513_.WMF") returned 63 [0124.694] lstrlenW (lpString=".zip") returned 4 [0124.695] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0124.695] lstrlenW (lpString=".rar") returned 4 [0124.695] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0124.695] lstrlenW (lpString=".bz2") returned 4 [0124.695] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0124.695] lstrlenW (lpString=".7z") returned 3 [0124.695] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0124.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00513_.WMF") returned 63 [0124.695] lstrlenW (lpString=".dbf") returned 4 [0124.695] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0124.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00513_.WMF") returned 63 [0124.695] lstrlenW (lpString=".1cd") returned 4 [0124.695] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0124.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00513_.WMF") returned 63 [0124.695] lstrlenW (lpString=".jpg") returned 4 [0124.695] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0124.751] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0124.751] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0124.751] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00527_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00527_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0124.751] GetLastError () returned 0x0 [0124.751] ReadFile (in: hFile=0x16c, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0x16a6, lpOverlapped=0x0) returned 1 [0124.808] WriteFile (in: hFile=0x20c, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0x16b0, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0x16b0, lpOverlapped=0x0) returned 1 [0124.808] ReadFile (in: hFile=0x16c, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0x0, lpOverlapped=0x0) returned 1 [0124.808] WriteFile (in: hFile=0x20c, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0xec, lpOverlapped=0x0) returned 1 [0124.809] SetEndOfFile (hFile=0x20c) returned 1 [0124.809] CloseHandle (hObject=0x20c) returned 1 [0124.809] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0124.809] SetEndOfFile (hFile=0x16c) returned 1 [0124.809] CloseHandle (hObject=0x16c) returned 1 [0124.809] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00527_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0124.809] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00527_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00527_.wmf")) returned 1 [0125.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00527_.WMF") returned 63 [0125.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00527_.WMF") returned 63 [0125.162] lstrlenW (lpString=".doc") returned 4 [0125.162] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0125.162] lstrlenW (lpString=".docx") returned 5 [0125.162] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0125.162] lstrlenW (lpString=".pdf") returned 4 [0125.162] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0125.162] lstrlenW (lpString=".xls") returned 4 [0125.162] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0125.162] lstrlenW (lpString=".xlsx") returned 5 [0125.162] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0125.162] lstrlenW (lpString=".ppt") returned 4 [0125.162] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0125.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00527_.WMF") returned 63 [0125.162] lstrlenW (lpString=".zip") returned 4 [0125.162] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0125.162] lstrlenW (lpString=".rar") returned 4 [0125.162] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0125.162] lstrlenW (lpString=".bz2") returned 4 [0125.162] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0125.162] lstrlenW (lpString=".7z") returned 3 [0125.162] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0125.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00527_.WMF") returned 63 [0125.162] lstrlenW (lpString=".dbf") returned 4 [0125.162] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0125.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00527_.WMF") returned 63 [0125.162] lstrlenW (lpString=".1cd") returned 4 [0125.162] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0125.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00527_.WMF") returned 63 [0125.163] lstrlenW (lpString=".jpg") returned 4 [0125.163] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0125.409] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0125.409] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0125.409] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00114_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00114_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0125.409] GetLastError () returned 0x0 [0125.409] ReadFile (in: hFile=0x19c, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0x5664, lpOverlapped=0x0) returned 1 [0125.419] WriteFile (in: hFile=0x254, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0x5670, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0x5670, lpOverlapped=0x0) returned 1 [0125.420] ReadFile (in: hFile=0x19c, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0x0, lpOverlapped=0x0) returned 1 [0125.420] WriteFile (in: hFile=0x254, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0xec, lpOverlapped=0x0) returned 1 [0125.420] SetEndOfFile (hFile=0x254) returned 1 [0125.421] CloseHandle (hObject=0x254) returned 1 [0125.421] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0125.421] SetEndOfFile (hFile=0x19c) returned 1 [0125.422] CloseHandle (hObject=0x19c) returned 1 [0125.422] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00114_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0125.422] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00114_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00114_.wmf")) returned 1 [0125.425] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 63 [0125.425] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 63 [0125.425] lstrlenW (lpString=".doc") returned 4 [0125.425] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0125.425] lstrlenW (lpString=".docx") returned 5 [0125.425] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0125.425] lstrlenW (lpString=".pdf") returned 4 [0125.425] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0125.425] lstrlenW (lpString=".xls") returned 4 [0125.425] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0125.425] lstrlenW (lpString=".xlsx") returned 5 [0125.425] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0125.425] lstrlenW (lpString=".ppt") returned 4 [0125.425] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0125.425] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 63 [0125.425] lstrlenW (lpString=".zip") returned 4 [0125.425] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0125.425] lstrlenW (lpString=".rar") returned 4 [0125.425] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0125.425] lstrlenW (lpString=".bz2") returned 4 [0125.425] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0125.425] lstrlenW (lpString=".7z") returned 3 [0125.425] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0125.425] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 63 [0125.425] lstrlenW (lpString=".dbf") returned 4 [0125.425] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0125.425] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 63 [0125.425] lstrlenW (lpString=".1cd") returned 4 [0125.425] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0125.425] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 63 [0125.425] lstrlenW (lpString=".jpg") returned 4 [0125.425] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0125.426] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0125.426] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0125.426] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00118_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00118_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0125.426] GetLastError () returned 0x0 [0125.426] ReadFile (in: hFile=0x19c, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0x318, lpOverlapped=0x0) returned 1 [0125.495] WriteFile (in: hFile=0x254, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0x320, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0x320, lpOverlapped=0x0) returned 1 [0125.496] ReadFile (in: hFile=0x19c, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0x0, lpOverlapped=0x0) returned 1 [0125.496] WriteFile (in: hFile=0x254, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0xec, lpOverlapped=0x0) returned 1 [0125.496] SetEndOfFile (hFile=0x254) returned 1 [0125.496] CloseHandle (hObject=0x254) returned 1 [0125.496] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0125.496] SetEndOfFile (hFile=0x19c) returned 1 [0125.497] CloseHandle (hObject=0x19c) returned 1 [0125.497] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00118_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0125.497] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00118_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00118_.wmf")) returned 1 [0125.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00118_.WMF") returned 63 [0125.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00118_.WMF") returned 63 [0125.497] lstrlenW (lpString=".doc") returned 4 [0125.497] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0125.498] lstrlenW (lpString=".docx") returned 5 [0125.498] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0125.498] lstrlenW (lpString=".pdf") returned 4 [0125.498] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0125.498] lstrlenW (lpString=".xls") returned 4 [0125.498] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0125.498] lstrlenW (lpString=".xlsx") returned 5 [0125.498] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0125.498] lstrlenW (lpString=".ppt") returned 4 [0125.498] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0125.498] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00118_.WMF") returned 63 [0125.498] lstrlenW (lpString=".zip") returned 4 [0125.498] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0125.498] lstrlenW (lpString=".rar") returned 4 [0125.498] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0125.498] lstrlenW (lpString=".bz2") returned 4 [0125.498] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0125.498] lstrlenW (lpString=".7z") returned 3 [0125.498] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0125.498] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00118_.WMF") returned 63 [0125.498] lstrlenW (lpString=".dbf") returned 4 [0125.498] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0125.498] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00118_.WMF") returned 63 [0125.498] lstrlenW (lpString=".1cd") returned 4 [0125.498] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0125.498] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00118_.WMF") returned 63 [0125.498] lstrlenW (lpString=".jpg") returned 4 [0125.498] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0125.499] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0125.499] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0125.499] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00204_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00204_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x254 [0125.499] GetLastError () returned 0x0 [0125.499] ReadFile (in: hFile=0x19c, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0x738, lpOverlapped=0x0) returned 1 [0125.797] WriteFile (in: hFile=0x254, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0x740, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0x740, lpOverlapped=0x0) returned 1 [0125.798] ReadFile (in: hFile=0x19c, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0x0, lpOverlapped=0x0) returned 1 [0125.798] WriteFile (in: hFile=0x254, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0xec, lpOverlapped=0x0) returned 1 [0125.798] SetEndOfFile (hFile=0x254) returned 1 [0125.798] CloseHandle (hObject=0x254) returned 1 [0125.799] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0125.799] SetEndOfFile (hFile=0x19c) returned 1 [0125.799] CloseHandle (hObject=0x19c) returned 1 [0125.800] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00204_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0125.800] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00204_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00204_.wmf")) returned 1 [0125.800] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00204_.WMF") returned 63 [0125.800] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00204_.WMF") returned 63 [0125.800] lstrlenW (lpString=".doc") returned 4 [0125.800] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0125.800] lstrlenW (lpString=".docx") returned 5 [0125.800] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0125.800] lstrlenW (lpString=".pdf") returned 4 [0125.800] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0125.800] lstrlenW (lpString=".xls") returned 4 [0125.801] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0125.801] lstrlenW (lpString=".xlsx") returned 5 [0125.801] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0125.801] lstrlenW (lpString=".ppt") returned 4 [0125.801] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0125.801] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00204_.WMF") returned 63 [0125.801] lstrlenW (lpString=".zip") returned 4 [0125.801] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0125.801] lstrlenW (lpString=".rar") returned 4 [0125.801] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0125.801] lstrlenW (lpString=".bz2") returned 4 [0125.801] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0125.801] lstrlenW (lpString=".7z") returned 3 [0125.801] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0125.801] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00204_.WMF") returned 63 [0125.801] lstrlenW (lpString=".dbf") returned 4 [0125.801] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0125.801] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00204_.WMF") returned 63 [0125.801] lstrlenW (lpString=".1cd") returned 4 [0125.801] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0125.801] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00204_.WMF") returned 63 [0125.801] lstrlenW (lpString=".jpg") returned 4 [0125.801] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0126.066] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0126.066] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0126.066] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00233_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00233_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0126.067] GetLastError () returned 0x0 [0126.067] ReadFile (in: hFile=0x168, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0x2bb6, lpOverlapped=0x0) returned 1 [0126.073] WriteFile (in: hFile=0x19c, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0x2bc0, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0x2bc0, lpOverlapped=0x0) returned 1 [0126.074] ReadFile (in: hFile=0x168, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0x0, lpOverlapped=0x0) returned 1 [0126.074] WriteFile (in: hFile=0x19c, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0xec, lpOverlapped=0x0) returned 1 [0126.074] SetEndOfFile (hFile=0x19c) returned 1 [0126.074] CloseHandle (hObject=0x19c) returned 1 [0126.074] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0126.074] SetEndOfFile (hFile=0x168) returned 1 [0126.074] CloseHandle (hObject=0x168) returned 1 [0126.074] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00233_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0126.075] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00233_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00233_.wmf")) returned 1 [0126.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00233_.WMF") returned 63 [0126.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00233_.WMF") returned 63 [0126.075] lstrlenW (lpString=".doc") returned 4 [0126.075] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0126.075] lstrlenW (lpString=".docx") returned 5 [0126.075] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0126.075] lstrlenW (lpString=".pdf") returned 4 [0126.075] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0126.075] lstrlenW (lpString=".xls") returned 4 [0126.075] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0126.075] lstrlenW (lpString=".xlsx") returned 5 [0126.075] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0126.075] lstrlenW (lpString=".ppt") returned 4 [0126.075] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0126.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00233_.WMF") returned 63 [0126.075] lstrlenW (lpString=".zip") returned 4 [0126.075] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0126.075] lstrlenW (lpString=".rar") returned 4 [0126.075] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0126.075] lstrlenW (lpString=".bz2") returned 4 [0126.075] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0126.075] lstrlenW (lpString=".7z") returned 3 [0126.075] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0126.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00233_.WMF") returned 63 [0126.075] lstrlenW (lpString=".dbf") returned 4 [0126.075] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0126.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00233_.WMF") returned 63 [0126.075] lstrlenW (lpString=".1cd") returned 4 [0126.075] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0126.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00233_.WMF") returned 63 [0126.075] lstrlenW (lpString=".jpg") returned 4 [0126.075] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0126.076] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0126.076] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0126.076] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00957_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00957_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0126.076] GetLastError () returned 0x0 [0126.076] ReadFile (in: hFile=0x168, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0xb80, lpOverlapped=0x0) returned 1 [0126.151] WriteFile (in: hFile=0x19c, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xb90, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0xb90, lpOverlapped=0x0) returned 1 [0126.152] ReadFile (in: hFile=0x168, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x326f884, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x326f884*=0x0, lpOverlapped=0x0) returned 1 [0126.152] WriteFile (in: hFile=0x19c, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x326f64c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x326f64c*=0xec, lpOverlapped=0x0) returned 1 [0126.152] SetEndOfFile (hFile=0x19c) returned 1 [0126.152] CloseHandle (hObject=0x19c) returned 1 [0126.153] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x326f878 | out: lpNewFilePointer=0x0) returned 1 [0126.153] SetEndOfFile (hFile=0x168) returned 1 [0126.158] CloseHandle (hObject=0x168) returned 1 [0126.158] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00957_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0126.158] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00957_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00957_.wmf")) returned 1 [0126.580] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00957_.WMF") returned 63 [0126.580] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00957_.WMF") returned 63 [0126.580] lstrlenW (lpString=".doc") returned 4 [0126.580] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0126.580] lstrlenW (lpString=".docx") returned 5 [0126.580] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0126.580] lstrlenW (lpString=".pdf") returned 4 [0126.580] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0126.581] lstrlenW (lpString=".xls") returned 4 [0126.581] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0126.581] lstrlenW (lpString=".xlsx") returned 5 [0126.581] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0126.581] lstrlenW (lpString=".ppt") returned 4 [0126.581] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0126.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00957_.WMF") returned 63 [0126.581] lstrlenW (lpString=".zip") returned 4 [0126.581] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0126.581] lstrlenW (lpString=".rar") returned 4 [0126.581] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0126.581] lstrlenW (lpString=".bz2") returned 4 [0126.581] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0126.581] lstrlenW (lpString=".7z") returned 3 [0126.581] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0126.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00957_.WMF") returned 63 [0126.581] lstrlenW (lpString=".dbf") returned 4 [0126.581] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0126.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00957_.WMF") returned 63 [0126.581] lstrlenW (lpString=".1cd") returned 4 [0126.581] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0126.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00957_.WMF") returned 63 [0126.581] lstrlenW (lpString=".jpg") returned 4 [0126.581] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 Thread: id = 29 os_tid = 0xba4 [0102.638] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x757c0000 [0102.638] GetProcAddress (hModule=0x757c0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x757ed650 [0102.638] Wow64DisableWow64FsRedirection (in: OldValue=0x30afb78 | out: OldValue=0x30afb78*=0x0) returned 1 [0102.638] lstrlenW (lpString="kernel32.dll") returned 12 [0102.639] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0102.639] Sleep (dwMilliseconds=0x64) [0102.878] lstrcmpiW (lpString1=".ttf", lpString2=".waifu") returned -1 [0102.878] lstrlenW (lpString="jpn_boot.ttf") returned 12 [0102.878] CreateFileW (lpFileName="C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0103.215] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x30afb3c | out: lpFileSize=0x30afb3c*=1984228) returned 1 [0103.215] CloseHandle (hObject=0x180) returned 1 [0103.216] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf")) returned 0x20 [0103.216] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\jpn_boot.ttf.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0103.216] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\jpn_boot.ttf.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0 [0103.216] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0103.216] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0103.216] lstrlenW (lpString=".doc") returned 4 [0103.216] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0103.216] lstrlenW (lpString=".docx") returned 5 [0103.216] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0103.216] lstrlenW (lpString=".pdf") returned 4 [0103.216] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0103.216] lstrlenW (lpString=".xls") returned 4 [0103.216] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0103.216] lstrlenW (lpString=".xlsx") returned 5 [0103.216] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0103.216] lstrlenW (lpString=".ppt") returned 4 [0103.216] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0103.216] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0103.216] lstrlenW (lpString=".zip") returned 4 [0103.216] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0103.216] lstrlenW (lpString=".rar") returned 4 [0103.216] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0103.216] lstrlenW (lpString=".bz2") returned 4 [0103.216] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0103.216] lstrlenW (lpString=".7z") returned 3 [0103.216] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0103.216] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0103.216] lstrlenW (lpString=".dbf") returned 4 [0103.216] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0103.216] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0103.216] lstrlenW (lpString=".1cd") returned 4 [0103.216] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0103.216] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0103.216] lstrlenW (lpString=".jpg") returned 4 [0103.216] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0103.217] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0103.217] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0103.217] lstrlenW (lpString=".doc") returned 4 [0103.217] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0103.217] lstrlenW (lpString=".docx") returned 5 [0103.217] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0103.217] lstrlenW (lpString=".pdf") returned 4 [0103.217] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0103.217] lstrlenW (lpString=".xls") returned 4 [0103.217] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0103.217] lstrlenW (lpString=".xlsx") returned 5 [0103.217] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0103.217] lstrlenW (lpString=".ppt") returned 4 [0103.217] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0103.217] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0103.217] lstrlenW (lpString=".zip") returned 4 [0103.217] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0103.217] lstrlenW (lpString=".rar") returned 4 [0103.217] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0103.217] lstrlenW (lpString=".bz2") returned 4 [0103.217] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0103.217] lstrlenW (lpString=".7z") returned 3 [0103.217] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0103.217] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0103.217] lstrlenW (lpString=".dbf") returned 4 [0103.217] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0103.217] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0103.217] lstrlenW (lpString=".1cd") returned 4 [0103.217] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0103.217] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0103.217] lstrlenW (lpString=".jpg") returned 4 [0103.217] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0103.217] lstrcmpiW (lpString1=".cab", lpString2=".waifu") returned -1 [0103.217] lstrlenW (lpString="PptLR.cab") returned 9 [0103.217] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\pptlr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0103.357] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x30afb3c | out: lpFileSize=0x30afb3c*=70361744) returned 1 [0103.357] CloseHandle (hObject=0x16c) returned 1 [0103.357] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\pptlr.cab")) returned 0x2020 [0103.357] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\pptlr.cab.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0103.357] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\pptlr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\pptlr.cab.id-9c354b42.[darknes@420blaze.it].waifu")) returned 1 [0103.358] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\pptlr.cab.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0103.358] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30af88c | out: lpNewFilePointer=0x0) returned 1 [0103.358] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30af84c | out: lpNewFilePointer=0x0) returned 1 [0103.358] ReadFile (in: hFile=0x16c, lpBuffer=0x3f00058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x30af858, lpOverlapped=0x0 | out: lpBuffer=0x3f00058*, lpNumberOfBytesRead=0x30af858*=0x40000, lpOverlapped=0x0) returned 1 [0103.365] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x165e0da, lpNewFilePointer=0x0, dwMoveMethod=0x30af84c | out: lpNewFilePointer=0x0) returned 1 [0103.365] ReadFile (in: hFile=0x16c, lpBuffer=0x3f40058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x30af858, lpOverlapped=0x0 | out: lpBuffer=0x3f40058*, lpNumberOfBytesRead=0x30af858*=0x40000, lpOverlapped=0x0) returned 1 [0103.367] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x30af88c | out: lpNewFilePointer=0xffffffff) returned 1 [0103.368] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x42da290, lpNewFilePointer=0x0, dwMoveMethod=0x30af84c | out: lpNewFilePointer=0x0) returned 1 [0103.368] ReadFile (in: hFile=0x16c, lpBuffer=0x3f80058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x30af858, lpOverlapped=0x0 | out: lpBuffer=0x3f80058*, lpNumberOfBytesRead=0x30af858*=0x40000, lpOverlapped=0x0) returned 1 [0103.381] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30afae8 | out: lpNewFilePointer=0x0) returned 1 [0103.381] WriteFile (in: hFile=0x16c, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0xc00fe, lpNumberOfBytesWritten=0x30af8d0, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x30af8d0*=0xc00fe, lpOverlapped=0x0) returned 1 [0103.387] SetEndOfFile (hFile=0x16c) returned 1 [0103.387] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30af89c | out: lpNewFilePointer=0x0) returned 1 [0103.387] WriteFile (in: hFile=0x16c, lpBuffer=0x44d40a0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x30af8a8, lpOverlapped=0x0 | out: lpBuffer=0x44d40a0*, lpNumberOfBytesWritten=0x30af8a8*=0x40000, lpOverlapped=0x0) returned 1 [0103.387] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x165e0da, lpNewFilePointer=0x0, dwMoveMethod=0x30af89c | out: lpNewFilePointer=0x0) returned 1 [0103.387] WriteFile (in: hFile=0x16c, lpBuffer=0x44d40a0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x30af8a8, lpOverlapped=0x0 | out: lpBuffer=0x44d40a0*, lpNumberOfBytesWritten=0x30af8a8*=0x40000, lpOverlapped=0x0) returned 1 [0103.388] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x42da290, lpNewFilePointer=0x0, dwMoveMethod=0x30af89c | out: lpNewFilePointer=0x0) returned 1 [0103.388] WriteFile (in: hFile=0x16c, lpBuffer=0x44d40a0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x30af8a8, lpOverlapped=0x0 | out: lpBuffer=0x44d40a0*, lpNumberOfBytesWritten=0x30af8a8*=0x40000, lpOverlapped=0x0) returned 1 [0103.389] CloseHandle (hObject=0x16c) returned 1 [0104.793] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x2020) returned 1 [0104.793] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0104.793] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0104.793] lstrlenW (lpString=".doc") returned 4 [0104.793] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0104.793] lstrlenW (lpString=".docx") returned 5 [0104.793] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0104.793] lstrlenW (lpString=".pdf") returned 4 [0104.793] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0104.793] lstrlenW (lpString=".xls") returned 4 [0104.793] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0104.793] lstrlenW (lpString=".xlsx") returned 5 [0104.793] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0104.793] lstrlenW (lpString=".ppt") returned 4 [0104.793] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0104.793] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0104.793] lstrlenW (lpString=".zip") returned 4 [0104.794] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0104.794] lstrlenW (lpString=".rar") returned 4 [0104.794] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0104.794] lstrlenW (lpString=".bz2") returned 4 [0104.794] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0104.794] lstrlenW (lpString=".7z") returned 3 [0104.794] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0104.794] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0104.794] lstrlenW (lpString=".dbf") returned 4 [0104.794] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0104.794] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0104.794] lstrlenW (lpString=".1cd") returned 4 [0104.794] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0104.794] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0104.794] lstrlenW (lpString=".jpg") returned 4 [0104.794] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0104.794] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0104.794] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0104.794] lstrlenW (lpString=".doc") returned 4 [0104.794] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0104.794] lstrlenW (lpString=".docx") returned 5 [0104.794] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0104.794] lstrlenW (lpString=".pdf") returned 4 [0104.794] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0104.794] lstrlenW (lpString=".xls") returned 4 [0104.794] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0104.794] lstrlenW (lpString=".xlsx") returned 5 [0104.794] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0104.794] lstrlenW (lpString=".ppt") returned 4 [0104.794] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0104.794] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0104.794] lstrlenW (lpString=".zip") returned 4 [0104.794] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0104.794] lstrlenW (lpString=".rar") returned 4 [0104.794] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0104.794] lstrlenW (lpString=".bz2") returned 4 [0104.794] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0104.794] lstrlenW (lpString=".7z") returned 3 [0104.794] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0104.794] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0104.794] lstrlenW (lpString=".dbf") returned 4 [0104.794] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0104.794] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0104.794] lstrlenW (lpString=".1cd") returned 4 [0104.794] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0104.794] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0104.794] lstrlenW (lpString=".jpg") returned 4 [0104.794] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0104.794] lstrcmpiW (lpString1=".cab", lpString2=".waifu") returned -1 [0104.795] lstrlenW (lpString="WordLR.cab") returned 10 [0104.795] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordlr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0104.795] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x30afb3c | out: lpFileSize=0x30afb3c*=43806141) returned 1 [0104.795] CloseHandle (hObject=0x16c) returned 1 [0104.795] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordlr.cab")) returned 0x2020 [0104.795] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordlr.cab.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0104.795] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordlr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordlr.cab.id-9c354b42.[darknes@420blaze.it].waifu")) returned 1 [0104.795] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordlr.cab.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0104.795] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30af88c | out: lpNewFilePointer=0x0) returned 1 [0104.795] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30af84c | out: lpNewFilePointer=0x0) returned 1 [0104.795] ReadFile (in: hFile=0x16c, lpBuffer=0x3f00058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x30af858, lpOverlapped=0x0 | out: lpBuffer=0x3f00058*, lpNumberOfBytesRead=0x30af858*=0x40000, lpOverlapped=0x0) returned 1 [0104.964] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0xdecf3f, lpNewFilePointer=0x0, dwMoveMethod=0x30af84c | out: lpNewFilePointer=0x0) returned 1 [0104.964] ReadFile (in: hFile=0x16c, lpBuffer=0x3f40058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x30af858, lpOverlapped=0x0 | out: lpBuffer=0x3f40058*, lpNumberOfBytesRead=0x30af858*=0x40000, lpOverlapped=0x0) returned 1 [0105.124] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x30af88c | out: lpNewFilePointer=0xffffffff) returned 1 [0105.124] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x2986dbd, lpNewFilePointer=0x0, dwMoveMethod=0x30af84c | out: lpNewFilePointer=0x0) returned 1 [0105.124] ReadFile (in: hFile=0x16c, lpBuffer=0x3f80058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x30af858, lpOverlapped=0x0 | out: lpBuffer=0x3f80058*, lpNumberOfBytesRead=0x30af858*=0x40000, lpOverlapped=0x0) returned 1 [0105.147] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30afae8 | out: lpNewFilePointer=0x0) returned 1 [0105.147] WriteFile (in: hFile=0x16c, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0xc0100, lpNumberOfBytesWritten=0x30af8d0, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x30af8d0*=0xc0100, lpOverlapped=0x0) returned 1 [0105.153] SetEndOfFile (hFile=0x16c) returned 1 [0105.153] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30af89c | out: lpNewFilePointer=0x0) returned 1 [0105.153] WriteFile (in: hFile=0x16c, lpBuffer=0x45250c0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x30af8a8, lpOverlapped=0x0 | out: lpBuffer=0x45250c0*, lpNumberOfBytesWritten=0x30af8a8*=0x40000, lpOverlapped=0x0) returned 1 [0105.154] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0xdecf3f, lpNewFilePointer=0x0, dwMoveMethod=0x30af89c | out: lpNewFilePointer=0x0) returned 1 [0105.154] WriteFile (in: hFile=0x16c, lpBuffer=0x45250c0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x30af8a8, lpOverlapped=0x0 | out: lpBuffer=0x45250c0*, lpNumberOfBytesWritten=0x30af8a8*=0x40000, lpOverlapped=0x0) returned 1 [0105.155] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x2986dbd, lpNewFilePointer=0x0, dwMoveMethod=0x30af89c | out: lpNewFilePointer=0x0) returned 1 [0105.155] WriteFile (in: hFile=0x16c, lpBuffer=0x45250c0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x30af8a8, lpOverlapped=0x0 | out: lpBuffer=0x45250c0*, lpNumberOfBytesWritten=0x30af8a8*=0x40000, lpOverlapped=0x0) returned 1 [0105.157] CloseHandle (hObject=0x16c) returned 1 [0106.286] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x2020) returned 1 [0106.286] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0106.286] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0106.286] lstrlenW (lpString=".doc") returned 4 [0106.286] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0106.286] lstrlenW (lpString=".docx") returned 5 [0106.286] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0106.286] lstrlenW (lpString=".pdf") returned 4 [0106.286] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0106.286] lstrlenW (lpString=".xls") returned 4 [0106.286] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0106.286] lstrlenW (lpString=".xlsx") returned 5 [0106.286] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0106.286] lstrlenW (lpString=".ppt") returned 4 [0106.286] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0106.286] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0106.286] lstrlenW (lpString=".zip") returned 4 [0106.286] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0106.286] lstrlenW (lpString=".rar") returned 4 [0106.286] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0106.286] lstrlenW (lpString=".bz2") returned 4 [0106.286] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0106.287] lstrlenW (lpString=".7z") returned 3 [0106.287] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0106.287] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0106.287] lstrlenW (lpString=".dbf") returned 4 [0106.287] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0106.287] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0106.287] lstrlenW (lpString=".1cd") returned 4 [0106.287] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0106.287] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0106.287] lstrlenW (lpString=".jpg") returned 4 [0106.287] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0106.287] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0106.287] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0106.287] lstrlenW (lpString=".doc") returned 4 [0106.287] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0106.287] lstrlenW (lpString=".docx") returned 5 [0106.287] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0106.287] lstrlenW (lpString=".pdf") returned 4 [0106.287] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0106.287] lstrlenW (lpString=".xls") returned 4 [0106.287] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0106.287] lstrlenW (lpString=".xlsx") returned 5 [0106.287] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0106.287] lstrlenW (lpString=".ppt") returned 4 [0106.287] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0106.287] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0106.287] lstrlenW (lpString=".zip") returned 4 [0106.287] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0106.287] lstrlenW (lpString=".rar") returned 4 [0106.287] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0106.287] lstrlenW (lpString=".bz2") returned 4 [0106.287] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0106.287] lstrlenW (lpString=".7z") returned 3 [0106.287] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0106.287] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0106.287] lstrlenW (lpString=".dbf") returned 4 [0106.287] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0106.287] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0106.287] lstrlenW (lpString=".1cd") returned 4 [0106.287] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0106.287] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0106.287] lstrlenW (lpString=".jpg") returned 4 [0106.287] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0106.287] lstrcmpiW (lpString1=".msi", lpString2=".waifu") returned -1 [0106.287] lstrlenW (lpString="Proof.msi") returned 9 [0106.287] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0107.660] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x30afb3c | out: lpFileSize=0x30afb3c*=885760) returned 1 [0107.660] CloseHandle (hObject=0x1c0) returned 1 [0107.660] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.msi")) returned 0x2020 [0107.660] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.msi.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0107.660] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0107.660] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30afae8 | out: lpNewFilePointer=0x0) returned 1 [0107.661] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30afae8 | out: lpNewFilePointer=0x0) returned 1 [0107.661] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.msi.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0107.661] GetLastError () returned 0x0 [0107.661] ReadFile (in: hFile=0x1c0, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30afaf4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x30afaf4*=0xd8400, lpOverlapped=0x0) returned 1 [0107.771] WriteFile (in: hFile=0x1a4, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0xd8410, lpNumberOfBytesWritten=0x30af8bc, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x30af8bc*=0xd8410, lpOverlapped=0x0) returned 1 [0107.778] ReadFile (in: hFile=0x1c0, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30afaf4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x30afaf4*=0x0, lpOverlapped=0x0) returned 1 [0107.778] WriteFile (in: hFile=0x1a4, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x30af8bc, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x30af8bc*=0xe6, lpOverlapped=0x0) returned 1 [0107.778] SetEndOfFile (hFile=0x1a4) returned 1 [0107.778] CloseHandle (hObject=0x1a4) returned 1 [0107.784] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30afae8 | out: lpNewFilePointer=0x0) returned 1 [0107.784] SetEndOfFile (hFile=0x1c0) returned 1 [0107.786] CloseHandle (hObject=0x1c0) returned 1 [0107.786] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x2020) returned 1 [0107.786] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.msi")) returned 1 [0107.786] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0107.786] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0107.786] lstrlenW (lpString=".doc") returned 4 [0107.786] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0107.786] lstrlenW (lpString=".docx") returned 5 [0107.786] lstrcmpiW (lpString1=".docx", lpString2="f.msi") returned -1 [0107.786] lstrlenW (lpString=".pdf") returned 4 [0107.786] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0107.786] lstrlenW (lpString=".xls") returned 4 [0107.786] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0107.786] lstrlenW (lpString=".xlsx") returned 5 [0107.786] lstrcmpiW (lpString1=".xlsx", lpString2="f.msi") returned -1 [0107.786] lstrlenW (lpString=".ppt") returned 4 [0107.786] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0107.786] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0107.786] lstrlenW (lpString=".zip") returned 4 [0107.787] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0107.787] lstrlenW (lpString=".rar") returned 4 [0107.787] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0107.787] lstrlenW (lpString=".bz2") returned 4 [0107.787] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0107.787] lstrlenW (lpString=".7z") returned 3 [0107.787] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0107.787] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0107.787] lstrlenW (lpString=".dbf") returned 4 [0107.787] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0107.787] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0107.787] lstrlenW (lpString=".1cd") returned 4 [0107.787] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0107.787] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0107.787] lstrlenW (lpString=".jpg") returned 4 [0107.787] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0107.787] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0107.787] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0107.787] lstrlenW (lpString=".doc") returned 4 [0107.787] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0107.787] lstrlenW (lpString=".docx") returned 5 [0107.787] lstrcmpiW (lpString1=".docx", lpString2="f.msi") returned -1 [0107.787] lstrlenW (lpString=".pdf") returned 4 [0107.787] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0107.787] lstrlenW (lpString=".xls") returned 4 [0107.787] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0107.787] lstrlenW (lpString=".xlsx") returned 5 [0107.787] lstrcmpiW (lpString1=".xlsx", lpString2="f.msi") returned -1 [0107.787] lstrlenW (lpString=".ppt") returned 4 [0107.787] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0107.787] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0107.787] lstrlenW (lpString=".zip") returned 4 [0107.787] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0107.787] lstrlenW (lpString=".rar") returned 4 [0107.787] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0107.787] lstrlenW (lpString=".bz2") returned 4 [0107.787] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0107.787] lstrlenW (lpString=".7z") returned 3 [0107.787] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0107.787] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0107.787] lstrlenW (lpString=".dbf") returned 4 [0107.787] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0107.787] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0107.787] lstrlenW (lpString=".1cd") returned 4 [0107.787] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0107.787] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0107.787] lstrlenW (lpString=".jpg") returned 4 [0107.787] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0107.787] lstrcmpiW (lpString1=".cab", lpString2=".waifu") returned -1 [0107.788] lstrlenW (lpString="OWOW32LR.cab") returned 12 [0107.788] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\owow32lr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0107.788] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x30afb3c | out: lpFileSize=0x30afb3c*=2928955) returned 1 [0107.788] CloseHandle (hObject=0x1c0) returned 1 [0107.788] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\owow32lr.cab")) returned 0x2020 [0107.788] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\owow32lr.cab.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0107.788] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\owow32lr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\owow32lr.cab.id-9c354b42.[darknes@420blaze.it].waifu")) returned 1 [0107.788] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\owow32lr.cab.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0107.788] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30af88c | out: lpNewFilePointer=0x0) returned 1 [0107.789] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30af84c | out: lpNewFilePointer=0x0) returned 1 [0107.789] ReadFile (in: hFile=0x1c0, lpBuffer=0x3f00058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x30af858, lpOverlapped=0x0 | out: lpBuffer=0x3f00058*, lpNumberOfBytesRead=0x30af858*=0x40000, lpOverlapped=0x0) returned 1 [0107.791] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0xee5be, lpNewFilePointer=0x0, dwMoveMethod=0x30af84c | out: lpNewFilePointer=0x0) returned 1 [0107.791] ReadFile (in: hFile=0x1c0, lpBuffer=0x3f40058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x30af858, lpOverlapped=0x0 | out: lpBuffer=0x3f40058*, lpNumberOfBytesRead=0x30af858*=0x40000, lpOverlapped=0x0) returned 1 [0107.810] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x30af88c | out: lpNewFilePointer=0xffffffff) returned 1 [0107.810] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x28b13b, lpNewFilePointer=0x0, dwMoveMethod=0x30af84c | out: lpNewFilePointer=0x0) returned 1 [0107.810] ReadFile (in: hFile=0x1c0, lpBuffer=0x3f80058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x30af858, lpOverlapped=0x0 | out: lpBuffer=0x3f80058*, lpNumberOfBytesRead=0x30af858*=0x40000, lpOverlapped=0x0) returned 1 [0108.136] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30afae8 | out: lpNewFilePointer=0x0) returned 1 [0108.136] WriteFile (in: hFile=0x1c0, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x30af8d0, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x30af8d0*=0xc0104, lpOverlapped=0x0) returned 1 [0108.176] SetEndOfFile (hFile=0x1c0) returned 1 [0108.178] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30af89c | out: lpNewFilePointer=0x0) returned 1 [0108.178] WriteFile (in: hFile=0x1c0, lpBuffer=0x44b2070*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x30af8a8, lpOverlapped=0x0 | out: lpBuffer=0x44b2070*, lpNumberOfBytesWritten=0x30af8a8*=0x40000, lpOverlapped=0x0) returned 1 [0108.179] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0xee5be, lpNewFilePointer=0x0, dwMoveMethod=0x30af89c | out: lpNewFilePointer=0x0) returned 1 [0108.179] WriteFile (in: hFile=0x1c0, lpBuffer=0x44b2070*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x30af8a8, lpOverlapped=0x0 | out: lpBuffer=0x44b2070*, lpNumberOfBytesWritten=0x30af8a8*=0x40000, lpOverlapped=0x0) returned 1 [0108.183] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x28b13b, lpNewFilePointer=0x0, dwMoveMethod=0x30af89c | out: lpNewFilePointer=0x0) returned 1 [0108.183] WriteFile (in: hFile=0x1c0, lpBuffer=0x44b2070*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x30af8a8, lpOverlapped=0x0 | out: lpBuffer=0x44b2070*, lpNumberOfBytesWritten=0x30af8a8*=0x40000, lpOverlapped=0x0) returned 1 [0108.185] CloseHandle (hObject=0x1c0) returned 1 [0110.312] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x2020) returned 1 [0110.313] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0110.313] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0110.313] lstrlenW (lpString=".doc") returned 4 [0110.313] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0110.313] lstrlenW (lpString=".docx") returned 5 [0110.313] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0110.313] lstrlenW (lpString=".pdf") returned 4 [0110.313] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0110.313] lstrlenW (lpString=".xls") returned 4 [0110.313] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0110.313] lstrlenW (lpString=".xlsx") returned 5 [0110.313] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0110.313] lstrlenW (lpString=".ppt") returned 4 [0110.313] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0110.313] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0110.313] lstrlenW (lpString=".zip") returned 4 [0110.313] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0110.313] lstrlenW (lpString=".rar") returned 4 [0110.313] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0110.313] lstrlenW (lpString=".bz2") returned 4 [0110.313] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0110.313] lstrlenW (lpString=".7z") returned 3 [0110.313] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0110.313] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0110.313] lstrlenW (lpString=".dbf") returned 4 [0110.313] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0110.313] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0110.313] lstrlenW (lpString=".1cd") returned 4 [0110.313] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0110.313] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0110.313] lstrlenW (lpString=".jpg") returned 4 [0110.313] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0110.313] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0110.313] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0110.313] lstrlenW (lpString=".doc") returned 4 [0110.313] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0110.313] lstrlenW (lpString=".docx") returned 5 [0110.313] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0110.314] lstrlenW (lpString=".pdf") returned 4 [0110.314] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0110.314] lstrlenW (lpString=".xls") returned 4 [0110.314] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0110.314] lstrlenW (lpString=".xlsx") returned 5 [0110.314] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0110.314] lstrlenW (lpString=".ppt") returned 4 [0110.314] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0110.314] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0110.314] lstrlenW (lpString=".zip") returned 4 [0110.314] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0110.314] lstrlenW (lpString=".rar") returned 4 [0110.314] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0110.314] lstrlenW (lpString=".bz2") returned 4 [0110.314] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0110.314] lstrlenW (lpString=".7z") returned 3 [0110.314] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0110.314] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0110.314] lstrlenW (lpString=".dbf") returned 4 [0110.314] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0110.314] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0110.314] lstrlenW (lpString=".1cd") returned 4 [0110.314] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0110.314] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0110.314] lstrlenW (lpString=".jpg") returned 4 [0110.314] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0110.314] lstrcmpiW (lpString1=".cab", lpString2=".waifu") returned -1 [0110.314] lstrlenW (lpString="VisioLR.cab") returned 11 [0110.314] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiolr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0110.315] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x30afb3c | out: lpFileSize=0x30afb3c*=50823389) returned 1 [0110.315] CloseHandle (hObject=0x1c0) returned 1 [0110.315] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiolr.cab")) returned 0x2020 [0110.315] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiolr.cab.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0110.315] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiolr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiolr.cab.id-9c354b42.[darknes@420blaze.it].waifu")) returned 1 [0110.315] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiolr.cab.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0110.315] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30af88c | out: lpNewFilePointer=0x0) returned 1 [0110.315] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30af84c | out: lpNewFilePointer=0x0) returned 1 [0110.315] ReadFile (in: hFile=0x1c0, lpBuffer=0x3f00058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x30af858, lpOverlapped=0x0 | out: lpBuffer=0x3f00058*, lpNumberOfBytesRead=0x30af858*=0x40000, lpOverlapped=0x0) returned 1 [0110.330] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x1028049, lpNewFilePointer=0x0, dwMoveMethod=0x30af84c | out: lpNewFilePointer=0x0) returned 1 [0110.331] ReadFile (in: hFile=0x1c0, lpBuffer=0x3f40058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x30af858, lpOverlapped=0x0 | out: lpBuffer=0x3f40058*, lpNumberOfBytesRead=0x30af858*=0x40000, lpOverlapped=0x0) returned 1 [0110.352] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x30af88c | out: lpNewFilePointer=0xffffffff) returned 1 [0110.352] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x30380dd, lpNewFilePointer=0x0, dwMoveMethod=0x30af84c | out: lpNewFilePointer=0x0) returned 1 [0110.352] ReadFile (in: hFile=0x1c0, lpBuffer=0x3f80058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x30af858, lpOverlapped=0x0 | out: lpBuffer=0x3f80058*, lpNumberOfBytesRead=0x30af858*=0x40000, lpOverlapped=0x0) returned 1 [0110.738] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30afae8 | out: lpNewFilePointer=0x0) returned 1 [0110.738] WriteFile (in: hFile=0x1c0, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x30af8d0, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x30af8d0*=0xc0102, lpOverlapped=0x0) returned 1 [0110.749] SetEndOfFile (hFile=0x1c0) returned 1 [0110.752] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30af89c | out: lpNewFilePointer=0x0) returned 1 [0110.752] WriteFile (in: hFile=0x1c0, lpBuffer=0x44b2070*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x30af8a8, lpOverlapped=0x0 | out: lpBuffer=0x44b2070*, lpNumberOfBytesWritten=0x30af8a8*=0x40000, lpOverlapped=0x0) returned 1 [0110.753] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x1028049, lpNewFilePointer=0x0, dwMoveMethod=0x30af89c | out: lpNewFilePointer=0x0) returned 1 [0110.753] WriteFile (in: hFile=0x1c0, lpBuffer=0x44b2070*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x30af8a8, lpOverlapped=0x0 | out: lpBuffer=0x44b2070*, lpNumberOfBytesWritten=0x30af8a8*=0x40000, lpOverlapped=0x0) returned 1 [0110.754] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x30380dd, lpNewFilePointer=0x0, dwMoveMethod=0x30af89c | out: lpNewFilePointer=0x0) returned 1 [0110.754] WriteFile (in: hFile=0x1c0, lpBuffer=0x44b2070*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x30af8a8, lpOverlapped=0x0 | out: lpBuffer=0x44b2070*, lpNumberOfBytesWritten=0x30af8a8*=0x40000, lpOverlapped=0x0) returned 1 [0110.756] CloseHandle (hObject=0x1c0) returned 1 [0110.756] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x2020) returned 1 [0110.757] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74 [0110.757] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74 [0110.757] lstrlenW (lpString=".doc") returned 4 [0110.757] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0110.757] lstrlenW (lpString=".docx") returned 5 [0110.757] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0110.757] lstrlenW (lpString=".pdf") returned 4 [0110.757] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0110.757] lstrlenW (lpString=".xls") returned 4 [0110.757] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0110.757] lstrlenW (lpString=".xlsx") returned 5 [0110.757] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0110.757] lstrlenW (lpString=".ppt") returned 4 [0110.757] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0110.757] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74 [0110.757] lstrlenW (lpString=".zip") returned 4 [0110.757] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0110.757] lstrlenW (lpString=".rar") returned 4 [0110.758] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0110.758] lstrlenW (lpString=".bz2") returned 4 [0110.758] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0110.758] lstrlenW (lpString=".7z") returned 3 [0110.758] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0110.758] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74 [0110.758] lstrlenW (lpString=".dbf") returned 4 [0110.758] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0110.758] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74 [0110.758] lstrlenW (lpString=".1cd") returned 4 [0110.758] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0110.758] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74 [0110.758] lstrlenW (lpString=".jpg") returned 4 [0110.758] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0110.758] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74 [0110.758] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74 [0110.758] lstrlenW (lpString=".doc") returned 4 [0110.758] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0110.758] lstrlenW (lpString=".docx") returned 5 [0110.758] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0110.758] lstrlenW (lpString=".pdf") returned 4 [0110.758] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0110.759] lstrlenW (lpString=".xls") returned 4 [0110.759] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0110.759] lstrlenW (lpString=".xlsx") returned 5 [0110.759] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0110.759] lstrlenW (lpString=".ppt") returned 4 [0110.759] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0110.759] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74 [0110.759] lstrlenW (lpString=".zip") returned 4 [0110.759] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0110.759] lstrlenW (lpString=".rar") returned 4 [0110.759] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0110.759] lstrlenW (lpString=".bz2") returned 4 [0110.759] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0110.759] lstrlenW (lpString=".7z") returned 3 [0110.759] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0110.759] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74 [0110.759] lstrlenW (lpString=".dbf") returned 4 [0110.759] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0110.759] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74 [0110.759] lstrlenW (lpString=".1cd") returned 4 [0110.759] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0110.759] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74 [0110.759] lstrlenW (lpString=".jpg") returned 4 [0110.760] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0110.760] lstrcmpiW (lpString1=".cab", lpString2=".waifu") returned -1 [0110.760] lstrlenW (lpString="OnoteLR.cab") returned 11 [0110.760] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onotelr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0110.760] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x30afb3c | out: lpFileSize=0x30afb3c*=17456632) returned 1 [0110.760] CloseHandle (hObject=0x1c0) returned 1 [0110.761] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onotelr.cab")) returned 0x2020 [0110.761] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onotelr.cab.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0110.761] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onotelr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onotelr.cab.id-9c354b42.[darknes@420blaze.it].waifu")) returned 1 [0110.762] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onotelr.cab.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0110.762] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30af88c | out: lpNewFilePointer=0x0) returned 1 [0110.762] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30af84c | out: lpNewFilePointer=0x0) returned 1 [0110.762] ReadFile (in: hFile=0x1c0, lpBuffer=0x3f00058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x30af858, lpOverlapped=0x0 | out: lpBuffer=0x3f00058*, lpNumberOfBytesRead=0x30af858*=0x40000, lpOverlapped=0x0) returned 1 [0111.307] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x58c9fd, lpNewFilePointer=0x0, dwMoveMethod=0x30af84c | out: lpNewFilePointer=0x0) returned 1 [0111.307] ReadFile (in: hFile=0x1c0, lpBuffer=0x3f40058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x30af858, lpOverlapped=0x0 | out: lpBuffer=0x3f40058*, lpNumberOfBytesRead=0x30af858*=0x40000, lpOverlapped=0x0) returned 1 [0111.309] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x30af88c | out: lpNewFilePointer=0xffffffff) returned 1 [0111.309] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x1065df8, lpNewFilePointer=0x0, dwMoveMethod=0x30af84c | out: lpNewFilePointer=0x0) returned 1 [0111.309] ReadFile (in: hFile=0x1c0, lpBuffer=0x3f80058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x30af858, lpOverlapped=0x0 | out: lpBuffer=0x3f80058*, lpNumberOfBytesRead=0x30af858*=0x40000, lpOverlapped=0x0) returned 1 [0111.322] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30afae8 | out: lpNewFilePointer=0x0) returned 1 [0111.322] WriteFile (in: hFile=0x1c0, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x30af8d0, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x30af8d0*=0xc0102, lpOverlapped=0x0) returned 1 [0111.329] SetEndOfFile (hFile=0x1c0) returned 1 [0111.330] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30af89c | out: lpNewFilePointer=0x0) returned 1 [0111.330] WriteFile (in: hFile=0x1c0, lpBuffer=0x44b2070*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x30af8a8, lpOverlapped=0x0 | out: lpBuffer=0x44b2070*, lpNumberOfBytesWritten=0x30af8a8*=0x40000, lpOverlapped=0x0) returned 1 [0111.330] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x58c9fd, lpNewFilePointer=0x0, dwMoveMethod=0x30af89c | out: lpNewFilePointer=0x0) returned 1 [0111.330] WriteFile (in: hFile=0x1c0, lpBuffer=0x44b2070*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x30af8a8, lpOverlapped=0x0 | out: lpBuffer=0x44b2070*, lpNumberOfBytesWritten=0x30af8a8*=0x40000, lpOverlapped=0x0) returned 1 [0111.331] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x1065df8, lpNewFilePointer=0x0, dwMoveMethod=0x30af89c | out: lpNewFilePointer=0x0) returned 1 [0111.331] WriteFile (in: hFile=0x1c0, lpBuffer=0x44b2070*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x30af8a8, lpOverlapped=0x0 | out: lpBuffer=0x44b2070*, lpNumberOfBytesWritten=0x30af8a8*=0x40000, lpOverlapped=0x0) returned 1 [0111.332] CloseHandle (hObject=0x1c0) returned 1 [0111.333] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x2020) returned 1 [0111.333] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74 [0111.333] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74 [0111.333] lstrlenW (lpString=".doc") returned 4 [0111.333] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0111.333] lstrlenW (lpString=".docx") returned 5 [0111.333] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0111.333] lstrlenW (lpString=".pdf") returned 4 [0111.333] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0111.333] lstrlenW (lpString=".xls") returned 4 [0111.333] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0111.333] lstrlenW (lpString=".xlsx") returned 5 [0111.333] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0111.333] lstrlenW (lpString=".ppt") returned 4 [0111.333] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0111.333] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74 [0111.333] lstrlenW (lpString=".zip") returned 4 [0111.333] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0111.333] lstrlenW (lpString=".rar") returned 4 [0111.333] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0111.333] lstrlenW (lpString=".bz2") returned 4 [0111.333] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0111.333] lstrlenW (lpString=".7z") returned 3 [0111.333] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0111.333] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74 [0111.333] lstrlenW (lpString=".dbf") returned 4 [0111.334] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0111.334] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74 [0111.334] lstrlenW (lpString=".1cd") returned 4 [0111.334] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0111.334] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74 [0111.334] lstrlenW (lpString=".jpg") returned 4 [0111.334] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0111.334] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74 [0111.334] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74 [0111.334] lstrlenW (lpString=".doc") returned 4 [0111.334] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0111.334] lstrlenW (lpString=".docx") returned 5 [0111.334] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0111.334] lstrlenW (lpString=".pdf") returned 4 [0111.334] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0111.334] lstrlenW (lpString=".xls") returned 4 [0111.334] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0111.334] lstrlenW (lpString=".xlsx") returned 5 [0111.334] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0111.334] lstrlenW (lpString=".ppt") returned 4 [0111.334] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0111.334] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74 [0111.334] lstrlenW (lpString=".zip") returned 4 [0111.334] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0111.334] lstrlenW (lpString=".rar") returned 4 [0111.334] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0111.334] lstrlenW (lpString=".bz2") returned 4 [0111.334] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0111.334] lstrlenW (lpString=".7z") returned 3 [0111.334] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0111.334] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74 [0111.334] lstrlenW (lpString=".dbf") returned 4 [0111.334] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0111.334] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74 [0111.334] lstrlenW (lpString=".1cd") returned 4 [0111.334] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0111.334] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74 [0111.334] lstrlenW (lpString=".jpg") returned 4 [0111.334] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0111.334] lstrcmpiW (lpString1=".msi", lpString2=".waifu") returned -1 [0111.334] lstrlenW (lpString="GrooveMUI.msi") returned 13 [0111.334] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0111.335] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x30afb3c | out: lpFileSize=0x30afb3c*=2507776) returned 1 [0111.335] CloseHandle (hObject=0x1c0) returned 1 [0111.335] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.msi")) returned 0x2020 [0111.335] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.msi.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0111.335] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.msi.id-9c354b42.[darknes@420blaze.it].waifu")) returned 1 [0111.335] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.msi.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0111.335] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30af88c | out: lpNewFilePointer=0x0) returned 1 [0111.335] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30af84c | out: lpNewFilePointer=0x0) returned 1 [0111.336] ReadFile (in: hFile=0x1c0, lpBuffer=0x3f00058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x30af858, lpOverlapped=0x0 | out: lpBuffer=0x3f00058*, lpNumberOfBytesRead=0x30af858*=0x40000, lpOverlapped=0x0) returned 1 [0111.338] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0xcc155, lpNewFilePointer=0x0, dwMoveMethod=0x30af84c | out: lpNewFilePointer=0x0) returned 1 [0111.338] ReadFile (in: hFile=0x1c0, lpBuffer=0x3f40058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x30af858, lpOverlapped=0x0 | out: lpBuffer=0x3f40058*, lpNumberOfBytesRead=0x30af858*=0x40000, lpOverlapped=0x0) returned 1 [0111.342] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x30af88c | out: lpNewFilePointer=0xffffffff) returned 1 [0111.342] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x224400, lpNewFilePointer=0x0, dwMoveMethod=0x30af84c | out: lpNewFilePointer=0x0) returned 1 [0111.342] ReadFile (in: hFile=0x1c0, lpBuffer=0x3f80058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x30af858, lpOverlapped=0x0 | out: lpBuffer=0x3f80058*, lpNumberOfBytesRead=0x30af858*=0x40000, lpOverlapped=0x0) returned 1 [0111.571] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30afae8 | out: lpNewFilePointer=0x0) returned 1 [0111.571] WriteFile (in: hFile=0x1c0, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0xc0106, lpNumberOfBytesWritten=0x30af8d0, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x30af8d0*=0xc0106, lpOverlapped=0x0) returned 1 [0111.580] SetEndOfFile (hFile=0x1c0) returned 1 [0111.580] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30af89c | out: lpNewFilePointer=0x0) returned 1 [0111.580] WriteFile (in: hFile=0x1c0, lpBuffer=0x45540b8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x30af8a8, lpOverlapped=0x0 | out: lpBuffer=0x45540b8*, lpNumberOfBytesWritten=0x30af8a8*=0x40000, lpOverlapped=0x0) returned 1 [0111.581] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0xcc155, lpNewFilePointer=0x0, dwMoveMethod=0x30af89c | out: lpNewFilePointer=0x0) returned 1 [0111.581] WriteFile (in: hFile=0x1c0, lpBuffer=0x45540b8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x30af8a8, lpOverlapped=0x0 | out: lpBuffer=0x45540b8*, lpNumberOfBytesWritten=0x30af8a8*=0x40000, lpOverlapped=0x0) returned 1 [0111.584] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x224400, lpNewFilePointer=0x0, dwMoveMethod=0x30af89c | out: lpNewFilePointer=0x0) returned 1 [0111.584] WriteFile (in: hFile=0x1c0, lpBuffer=0x45540b8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x30af8a8, lpOverlapped=0x0 | out: lpBuffer=0x45540b8*, lpNumberOfBytesWritten=0x30af8a8*=0x40000, lpOverlapped=0x0) returned 1 [0111.586] CloseHandle (hObject=0x1c0) returned 1 [0111.586] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x2020) returned 1 [0111.586] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76 [0111.586] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76 [0111.586] lstrlenW (lpString=".doc") returned 4 [0111.586] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0111.586] lstrlenW (lpString=".docx") returned 5 [0111.586] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0111.586] lstrlenW (lpString=".pdf") returned 4 [0111.586] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0111.586] lstrlenW (lpString=".xls") returned 4 [0111.586] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0111.586] lstrlenW (lpString=".xlsx") returned 5 [0111.586] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0111.586] lstrlenW (lpString=".ppt") returned 4 [0111.586] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0111.586] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76 [0111.586] lstrlenW (lpString=".zip") returned 4 [0111.586] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0111.586] lstrlenW (lpString=".rar") returned 4 [0111.586] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0111.586] lstrlenW (lpString=".bz2") returned 4 [0111.587] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0111.587] lstrlenW (lpString=".7z") returned 3 [0111.587] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0111.587] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76 [0111.587] lstrlenW (lpString=".dbf") returned 4 [0111.587] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0111.587] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76 [0111.587] lstrlenW (lpString=".1cd") returned 4 [0111.587] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0111.587] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76 [0111.587] lstrlenW (lpString=".jpg") returned 4 [0111.587] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0111.587] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76 [0111.587] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76 [0111.587] lstrlenW (lpString=".doc") returned 4 [0111.587] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0111.587] lstrlenW (lpString=".docx") returned 5 [0111.587] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0111.587] lstrlenW (lpString=".pdf") returned 4 [0111.587] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0111.587] lstrlenW (lpString=".xls") returned 4 [0111.587] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0111.587] lstrlenW (lpString=".xlsx") returned 5 [0111.587] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0111.587] lstrlenW (lpString=".ppt") returned 4 [0111.587] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0111.587] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76 [0111.587] lstrlenW (lpString=".zip") returned 4 [0111.587] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0111.587] lstrlenW (lpString=".rar") returned 4 [0111.587] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0111.587] lstrlenW (lpString=".bz2") returned 4 [0111.587] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0111.587] lstrlenW (lpString=".7z") returned 3 [0111.587] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0111.587] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76 [0111.587] lstrlenW (lpString=".dbf") returned 4 [0111.587] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0111.587] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76 [0111.587] lstrlenW (lpString=".1cd") returned 4 [0111.587] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0111.587] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76 [0111.587] lstrlenW (lpString=".jpg") returned 4 [0111.587] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0111.588] lstrcmpiW (lpString1=".dll", lpString2=".waifu") returned -1 [0111.588] lstrlenW (lpString="msvcr90.dll") returned 11 [0111.588] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\msvcr90.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0111.997] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x30afb3c | out: lpFileSize=0x30afb3c*=655872) returned 1 [0111.997] CloseHandle (hObject=0x194) returned 1 [0111.997] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\msvcr90.dll")) returned 0x2020 [0111.998] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\msvcr90.dll.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0111.998] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\msvcr90.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0111.998] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30afae8 | out: lpNewFilePointer=0x0) returned 1 [0111.998] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30afae8 | out: lpNewFilePointer=0x0) returned 1 [0111.998] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\msvcr90.dll.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0111.998] GetLastError () returned 0x0 [0111.998] ReadFile (in: hFile=0x194, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30afaf4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x30afaf4*=0xa0200, lpOverlapped=0x0) returned 1 [0112.012] WriteFile (in: hFile=0x164, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0xa0210, lpNumberOfBytesWritten=0x30af8bc, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x30af8bc*=0xa0210, lpOverlapped=0x0) returned 1 [0112.017] ReadFile (in: hFile=0x194, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30afaf4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x30afaf4*=0x0, lpOverlapped=0x0) returned 1 [0112.018] WriteFile (in: hFile=0x164, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x30af8bc, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x30af8bc*=0xea, lpOverlapped=0x0) returned 1 [0112.018] SetEndOfFile (hFile=0x164) returned 1 [0112.018] CloseHandle (hObject=0x164) returned 1 [0112.018] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30afae8 | out: lpNewFilePointer=0x0) returned 1 [0112.018] SetEndOfFile (hFile=0x194) returned 1 [0112.020] CloseHandle (hObject=0x194) returned 1 [0112.020] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x2020) returned 1 [0112.020] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\msvcr90.dll")) returned 1 [0112.020] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74 [0112.020] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74 [0112.020] lstrlenW (lpString=".doc") returned 4 [0112.020] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0112.020] lstrlenW (lpString=".docx") returned 5 [0112.020] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0112.020] lstrlenW (lpString=".pdf") returned 4 [0112.020] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0112.020] lstrlenW (lpString=".xls") returned 4 [0112.020] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0112.020] lstrlenW (lpString=".xlsx") returned 5 [0112.020] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0112.020] lstrlenW (lpString=".ppt") returned 4 [0112.020] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0112.021] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74 [0112.021] lstrlenW (lpString=".zip") returned 4 [0112.021] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0112.021] lstrlenW (lpString=".rar") returned 4 [0112.021] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0112.021] lstrlenW (lpString=".bz2") returned 4 [0112.021] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0112.021] lstrlenW (lpString=".7z") returned 3 [0112.021] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0112.021] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74 [0112.021] lstrlenW (lpString=".dbf") returned 4 [0112.021] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0112.021] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74 [0112.021] lstrlenW (lpString=".1cd") returned 4 [0112.021] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0112.021] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74 [0112.021] lstrlenW (lpString=".jpg") returned 4 [0112.021] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0112.021] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74 [0112.021] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74 [0112.021] lstrlenW (lpString=".doc") returned 4 [0112.021] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0112.021] lstrlenW (lpString=".docx") returned 5 [0112.021] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0112.021] lstrlenW (lpString=".pdf") returned 4 [0112.021] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0112.021] lstrlenW (lpString=".xls") returned 4 [0112.021] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0112.021] lstrlenW (lpString=".xlsx") returned 5 [0112.021] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0112.021] lstrlenW (lpString=".ppt") returned 4 [0112.021] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0112.021] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74 [0112.021] lstrlenW (lpString=".zip") returned 4 [0112.021] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0112.021] lstrlenW (lpString=".rar") returned 4 [0112.021] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0112.021] lstrlenW (lpString=".bz2") returned 4 [0112.021] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0112.021] lstrlenW (lpString=".7z") returned 3 [0112.021] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0112.021] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74 [0112.021] lstrlenW (lpString=".dbf") returned 4 [0112.021] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0112.021] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74 [0112.021] lstrlenW (lpString=".1cd") returned 4 [0112.021] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0112.021] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74 [0112.021] lstrlenW (lpString=".jpg") returned 4 [0112.022] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0112.022] lstrcmpiW (lpString1=".cab", lpString2=".waifu") returned -1 [0112.022] lstrlenW (lpString="OfficeLR.cab") returned 12 [0112.022] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officelr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0112.022] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x30afb3c | out: lpFileSize=0x30afb3c*=14127746) returned 1 [0112.022] CloseHandle (hObject=0x194) returned 1 [0112.022] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officelr.cab")) returned 0x2020 [0112.022] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officelr.cab.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0112.022] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officelr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officelr.cab.id-9c354b42.[darknes@420blaze.it].waifu")) returned 1 [0112.023] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officelr.cab.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0112.023] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30af88c | out: lpNewFilePointer=0x0) returned 1 [0112.023] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30af84c | out: lpNewFilePointer=0x0) returned 1 [0112.023] ReadFile (in: hFile=0x194, lpBuffer=0x3f00058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x30af858, lpOverlapped=0x0 | out: lpBuffer=0x3f00058*, lpNumberOfBytesRead=0x30af858*=0x40000, lpOverlapped=0x0) returned 1 [0112.028] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x47db80, lpNewFilePointer=0x0, dwMoveMethod=0x30af84c | out: lpNewFilePointer=0x0) returned 1 [0112.028] ReadFile (in: hFile=0x194, lpBuffer=0x3f40058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x30af858, lpOverlapped=0x0 | out: lpBuffer=0x3f40058*, lpNumberOfBytesRead=0x30af858*=0x40000, lpOverlapped=0x0) returned 1 [0112.030] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x30af88c | out: lpNewFilePointer=0xffffffff) returned 1 [0112.030] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0xd39282, lpNewFilePointer=0x0, dwMoveMethod=0x30af84c | out: lpNewFilePointer=0x0) returned 1 [0112.030] ReadFile (in: hFile=0x194, lpBuffer=0x3f80058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x30af858, lpOverlapped=0x0 | out: lpBuffer=0x3f80058*, lpNumberOfBytesRead=0x30af858*=0x40000, lpOverlapped=0x0) returned 1 [0112.195] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30afae8 | out: lpNewFilePointer=0x0) returned 1 [0112.195] WriteFile (in: hFile=0x194, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x30af8d0, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x30af8d0*=0xc0104, lpOverlapped=0x0) returned 1 [0112.204] SetEndOfFile (hFile=0x194) returned 1 [0112.204] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30af89c | out: lpNewFilePointer=0x0) returned 1 [0112.204] WriteFile (in: hFile=0x194, lpBuffer=0x44b2070*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x30af8a8, lpOverlapped=0x0 | out: lpBuffer=0x44b2070*, lpNumberOfBytesWritten=0x30af8a8*=0x40000, lpOverlapped=0x0) returned 1 [0112.205] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x47db80, lpNewFilePointer=0x0, dwMoveMethod=0x30af89c | out: lpNewFilePointer=0x0) returned 1 [0112.205] WriteFile (in: hFile=0x194, lpBuffer=0x44b2070*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x30af8a8, lpOverlapped=0x0 | out: lpBuffer=0x44b2070*, lpNumberOfBytesWritten=0x30af8a8*=0x40000, lpOverlapped=0x0) returned 1 [0112.205] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0xd39282, lpNewFilePointer=0x0, dwMoveMethod=0x30af89c | out: lpNewFilePointer=0x0) returned 1 [0112.205] WriteFile (in: hFile=0x194, lpBuffer=0x44b2070*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x30af8a8, lpOverlapped=0x0 | out: lpBuffer=0x44b2070*, lpNumberOfBytesWritten=0x30af8a8*=0x40000, lpOverlapped=0x0) returned 1 [0112.207] CloseHandle (hObject=0x194) returned 1 [0112.207] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x2020) returned 1 [0112.207] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75 [0112.207] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75 [0112.207] lstrlenW (lpString=".doc") returned 4 [0112.207] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0112.207] lstrlenW (lpString=".docx") returned 5 [0112.207] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0112.207] lstrlenW (lpString=".pdf") returned 4 [0112.207] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0112.207] lstrlenW (lpString=".xls") returned 4 [0112.207] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0112.207] lstrlenW (lpString=".xlsx") returned 5 [0112.207] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0112.207] lstrlenW (lpString=".ppt") returned 4 [0112.207] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0112.207] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75 [0112.207] lstrlenW (lpString=".zip") returned 4 [0112.207] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0112.208] lstrlenW (lpString=".rar") returned 4 [0112.208] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0112.208] lstrlenW (lpString=".bz2") returned 4 [0112.208] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0112.208] lstrlenW (lpString=".7z") returned 3 [0112.208] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0112.208] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75 [0112.208] lstrlenW (lpString=".dbf") returned 4 [0112.208] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0112.208] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75 [0112.208] lstrlenW (lpString=".1cd") returned 4 [0112.208] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0112.208] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75 [0112.208] lstrlenW (lpString=".jpg") returned 4 [0112.208] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0112.208] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75 [0112.208] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75 [0112.208] lstrlenW (lpString=".doc") returned 4 [0112.208] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0112.208] lstrlenW (lpString=".docx") returned 5 [0112.208] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0112.208] lstrlenW (lpString=".pdf") returned 4 [0112.208] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0112.208] lstrlenW (lpString=".xls") returned 4 [0112.208] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0112.208] lstrlenW (lpString=".xlsx") returned 5 [0112.208] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0112.208] lstrlenW (lpString=".ppt") returned 4 [0112.208] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0112.208] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75 [0112.208] lstrlenW (lpString=".zip") returned 4 [0112.208] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0112.208] lstrlenW (lpString=".rar") returned 4 [0112.208] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0112.208] lstrlenW (lpString=".bz2") returned 4 [0112.208] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0112.208] lstrlenW (lpString=".7z") returned 3 [0112.208] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0112.208] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75 [0112.208] lstrlenW (lpString=".dbf") returned 4 [0112.208] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0112.208] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75 [0112.208] lstrlenW (lpString=".1cd") returned 4 [0112.208] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0112.208] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75 [0112.208] lstrlenW (lpString=".jpg") returned 4 [0112.208] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0112.209] lstrcmpiW (lpString1=".msi", lpString2=".waifu") returned -1 [0112.209] lstrlenW (lpString="AccessMUISet.msi") returned 16 [0112.209] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0112.209] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x30afb3c | out: lpFileSize=0x30afb3c*=868864) returned 1 [0112.209] CloseHandle (hObject=0x194) returned 1 [0112.209] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.msi")) returned 0x2020 [0112.209] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.msi.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0112.209] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0112.209] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30afae8 | out: lpNewFilePointer=0x0) returned 1 [0112.209] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30afae8 | out: lpNewFilePointer=0x0) returned 1 [0112.209] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.msi.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0112.209] GetLastError () returned 0x0 [0112.209] ReadFile (in: hFile=0x194, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30afaf4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x30afaf4*=0xd4200, lpOverlapped=0x0) returned 1 [0112.227] WriteFile (in: hFile=0x1c0, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0xd4210, lpNumberOfBytesWritten=0x30af8bc, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x30af8bc*=0xd4210, lpOverlapped=0x0) returned 1 [0112.405] ReadFile (in: hFile=0x194, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30afaf4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x30afaf4*=0x0, lpOverlapped=0x0) returned 1 [0112.405] WriteFile (in: hFile=0x1c0, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x30af8bc, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x30af8bc*=0xf4, lpOverlapped=0x0) returned 1 [0112.406] SetEndOfFile (hFile=0x1c0) returned 1 [0112.406] CloseHandle (hObject=0x1c0) returned 1 [0112.406] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30afae8 | out: lpNewFilePointer=0x0) returned 1 [0112.406] SetEndOfFile (hFile=0x194) returned 1 [0112.409] CloseHandle (hObject=0x194) returned 1 [0112.409] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x2020) returned 1 [0112.410] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.msi")) returned 1 [0112.410] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79 [0112.410] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79 [0112.410] lstrlenW (lpString=".doc") returned 4 [0112.410] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0112.410] lstrlenW (lpString=".docx") returned 5 [0112.410] lstrcmpiW (lpString1=".docx", lpString2="t.msi") returned -1 [0112.410] lstrlenW (lpString=".pdf") returned 4 [0112.410] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0112.410] lstrlenW (lpString=".xls") returned 4 [0112.410] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0112.410] lstrlenW (lpString=".xlsx") returned 5 [0112.410] lstrcmpiW (lpString1=".xlsx", lpString2="t.msi") returned -1 [0112.410] lstrlenW (lpString=".ppt") returned 4 [0112.410] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0112.410] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79 [0112.410] lstrlenW (lpString=".zip") returned 4 [0112.410] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0112.410] lstrlenW (lpString=".rar") returned 4 [0112.410] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0112.410] lstrlenW (lpString=".bz2") returned 4 [0112.410] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0112.411] lstrlenW (lpString=".7z") returned 3 [0112.411] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0112.411] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79 [0112.411] lstrlenW (lpString=".dbf") returned 4 [0112.411] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0112.411] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79 [0112.411] lstrlenW (lpString=".1cd") returned 4 [0112.411] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0112.411] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79 [0112.411] lstrlenW (lpString=".jpg") returned 4 [0112.411] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0112.411] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79 [0112.411] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79 [0112.411] lstrlenW (lpString=".doc") returned 4 [0112.411] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0112.411] lstrlenW (lpString=".docx") returned 5 [0112.411] lstrcmpiW (lpString1=".docx", lpString2="t.msi") returned -1 [0112.411] lstrlenW (lpString=".pdf") returned 4 [0112.411] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0112.411] lstrlenW (lpString=".xls") returned 4 [0112.411] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0112.411] lstrlenW (lpString=".xlsx") returned 5 [0112.411] lstrcmpiW (lpString1=".xlsx", lpString2="t.msi") returned -1 [0112.411] lstrlenW (lpString=".ppt") returned 4 [0112.411] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0112.411] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79 [0112.411] lstrlenW (lpString=".zip") returned 4 [0112.411] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0112.411] lstrlenW (lpString=".rar") returned 4 [0112.411] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0112.411] lstrlenW (lpString=".bz2") returned 4 [0112.411] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0112.411] lstrlenW (lpString=".7z") returned 3 [0112.411] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0112.411] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79 [0112.411] lstrlenW (lpString=".dbf") returned 4 [0112.412] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0112.412] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79 [0112.412] lstrlenW (lpString=".1cd") returned 4 [0112.412] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0112.412] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79 [0112.412] lstrlenW (lpString=".jpg") returned 4 [0112.412] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0112.412] lstrcmpiW (lpString1=".cab", lpString2=".waifu") returned -1 [0112.412] lstrlenW (lpString="OWOW32WW.cab") returned 12 [0112.412] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\owow32ww.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0112.412] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x30afb3c | out: lpFileSize=0x30afb3c*=36233052) returned 1 [0112.412] CloseHandle (hObject=0x194) returned 1 [0112.412] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\owow32ww.cab")) returned 0x2020 [0112.412] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\owow32ww.cab.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0112.412] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\owow32ww.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\owow32ww.cab.id-9c354b42.[darknes@420blaze.it].waifu")) returned 1 [0112.413] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\owow32ww.cab.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0112.413] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30af88c | out: lpNewFilePointer=0x0) returned 1 [0112.413] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30af84c | out: lpNewFilePointer=0x0) returned 1 [0112.413] ReadFile (in: hFile=0x194, lpBuffer=0x3f00058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x30af858, lpOverlapped=0x0 | out: lpBuffer=0x3f00058*, lpNumberOfBytesRead=0x30af858*=0x40000, lpOverlapped=0x0) returned 1 [0112.452] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0xb84a74, lpNewFilePointer=0x0, dwMoveMethod=0x30af84c | out: lpNewFilePointer=0x0) returned 1 [0112.452] ReadFile (in: hFile=0x194, lpBuffer=0x3f40058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x30af858, lpOverlapped=0x0 | out: lpBuffer=0x3f40058*, lpNumberOfBytesRead=0x30af858*=0x40000, lpOverlapped=0x0) returned 1 [0112.559] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x30af88c | out: lpNewFilePointer=0xffffffff) returned 1 [0112.559] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x224df5c, lpNewFilePointer=0x0, dwMoveMethod=0x30af84c | out: lpNewFilePointer=0x0) returned 1 [0112.559] ReadFile (in: hFile=0x194, lpBuffer=0x3f80058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x30af858, lpOverlapped=0x0 | out: lpBuffer=0x3f80058*, lpNumberOfBytesRead=0x30af858*=0x40000, lpOverlapped=0x0) returned 1 [0112.605] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30afae8 | out: lpNewFilePointer=0x0) returned 1 [0112.605] WriteFile (in: hFile=0x194, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x30af8d0, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x30af8d0*=0xc0104, lpOverlapped=0x0) returned 1 [0112.615] SetEndOfFile (hFile=0x194) returned 1 [0112.615] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30af89c | out: lpNewFilePointer=0x0) returned 1 [0112.615] WriteFile (in: hFile=0x194, lpBuffer=0x45840d0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x30af8a8, lpOverlapped=0x0 | out: lpBuffer=0x45840d0*, lpNumberOfBytesWritten=0x30af8a8*=0x40000, lpOverlapped=0x0) returned 1 [0112.615] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0xb84a74, lpNewFilePointer=0x0, dwMoveMethod=0x30af89c | out: lpNewFilePointer=0x0) returned 1 [0112.615] WriteFile (in: hFile=0x194, lpBuffer=0x45840d0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x30af8a8, lpOverlapped=0x0 | out: lpBuffer=0x45840d0*, lpNumberOfBytesWritten=0x30af8a8*=0x40000, lpOverlapped=0x0) returned 1 [0112.616] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x224df5c, lpNewFilePointer=0x0, dwMoveMethod=0x30af89c | out: lpNewFilePointer=0x0) returned 1 [0112.616] WriteFile (in: hFile=0x194, lpBuffer=0x45840d0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x30af8a8, lpOverlapped=0x0 | out: lpBuffer=0x45840d0*, lpNumberOfBytesWritten=0x30af8a8*=0x40000, lpOverlapped=0x0) returned 1 [0112.617] CloseHandle (hObject=0x194) returned 1 [0112.617] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x2020) returned 1 [0112.618] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0112.618] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0112.618] lstrlenW (lpString=".doc") returned 4 [0112.618] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0112.618] lstrlenW (lpString=".docx") returned 5 [0112.618] lstrcmpiW (lpString1=".docx", lpString2="W.cab") returned -1 [0112.618] lstrlenW (lpString=".pdf") returned 4 [0112.618] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0112.618] lstrlenW (lpString=".xls") returned 4 [0112.618] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0112.618] lstrlenW (lpString=".xlsx") returned 5 [0112.618] lstrcmpiW (lpString1=".xlsx", lpString2="W.cab") returned -1 [0112.618] lstrlenW (lpString=".ppt") returned 4 [0112.618] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0112.618] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0112.618] lstrlenW (lpString=".zip") returned 4 [0112.618] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0112.618] lstrlenW (lpString=".rar") returned 4 [0112.618] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0112.618] lstrlenW (lpString=".bz2") returned 4 [0112.618] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0112.618] lstrlenW (lpString=".7z") returned 3 [0112.618] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0112.618] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0112.618] lstrlenW (lpString=".dbf") returned 4 [0112.618] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0112.618] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0112.618] lstrlenW (lpString=".1cd") returned 4 [0112.618] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0112.618] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0112.618] lstrlenW (lpString=".jpg") returned 4 [0112.618] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0112.618] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0112.618] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0112.618] lstrlenW (lpString=".doc") returned 4 [0112.618] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0112.618] lstrlenW (lpString=".docx") returned 5 [0112.618] lstrcmpiW (lpString1=".docx", lpString2="W.cab") returned -1 [0112.618] lstrlenW (lpString=".pdf") returned 4 [0112.619] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0112.619] lstrlenW (lpString=".xls") returned 4 [0112.619] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0112.619] lstrlenW (lpString=".xlsx") returned 5 [0112.619] lstrcmpiW (lpString1=".xlsx", lpString2="W.cab") returned -1 [0112.619] lstrlenW (lpString=".ppt") returned 4 [0112.619] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0112.619] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0112.619] lstrlenW (lpString=".zip") returned 4 [0112.619] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0112.619] lstrlenW (lpString=".rar") returned 4 [0112.619] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0112.619] lstrlenW (lpString=".bz2") returned 4 [0112.619] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0112.619] lstrlenW (lpString=".7z") returned 3 [0112.619] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0112.619] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0112.619] lstrlenW (lpString=".dbf") returned 4 [0112.619] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0112.619] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0112.619] lstrlenW (lpString=".1cd") returned 4 [0112.619] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0112.619] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0112.619] lstrlenW (lpString=".jpg") returned 4 [0112.619] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0112.715] lstrcmpiW (lpString1=".cab", lpString2=".waifu") returned -1 [0112.715] lstrlenW (lpString="ProPrWW2.cab") returned 12 [0112.715] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww2.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0112.865] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x30afb3c | out: lpFileSize=0x30afb3c*=222948913) returned 1 [0112.865] CloseHandle (hObject=0x1e8) returned 1 [0112.865] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww2.cab")) returned 0x2020 [0112.865] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww2.cab.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0112.865] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww2.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww2.cab.id-9c354b42.[darknes@420blaze.it].waifu")) returned 1 [0112.865] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww2.cab.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0112.866] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30af88c | out: lpNewFilePointer=0x0) returned 1 [0112.866] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30af84c | out: lpNewFilePointer=0x0) returned 1 [0112.866] ReadFile (in: hFile=0x1e8, lpBuffer=0x3f00058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x30af858, lpOverlapped=0x0 | out: lpBuffer=0x3f00058*, lpNumberOfBytesRead=0x30af858*=0x40000, lpOverlapped=0x0) returned 1 [0112.872] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x46dfa10, lpNewFilePointer=0x0, dwMoveMethod=0x30af84c | out: lpNewFilePointer=0x0) returned 1 [0112.872] ReadFile (in: hFile=0x1e8, lpBuffer=0x3f40058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x30af858, lpOverlapped=0x0 | out: lpBuffer=0x3f40058*, lpNumberOfBytesRead=0x30af858*=0x40000, lpOverlapped=0x0) returned 1 [0112.875] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x30af88c | out: lpNewFilePointer=0xffffffff) returned 1 [0112.875] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0xd45ee31, lpNewFilePointer=0x0, dwMoveMethod=0x30af84c | out: lpNewFilePointer=0x0) returned 1 [0112.875] ReadFile (in: hFile=0x1e8, lpBuffer=0x3f80058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x30af858, lpOverlapped=0x0 | out: lpBuffer=0x3f80058*, lpNumberOfBytesRead=0x30af858*=0x40000, lpOverlapped=0x0) returned 1 [0112.891] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30afae8 | out: lpNewFilePointer=0x0) returned 1 [0112.891] WriteFile (in: hFile=0x1e8, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x30af8d0, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x30af8d0*=0xc0104, lpOverlapped=0x0) returned 1 [0113.077] SetEndOfFile (hFile=0x1e8) returned 1 [0113.079] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30af89c | out: lpNewFilePointer=0x0) returned 1 [0113.079] WriteFile (in: hFile=0x1e8, lpBuffer=0x45c40d8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x30af8a8, lpOverlapped=0x0 | out: lpBuffer=0x45c40d8*, lpNumberOfBytesWritten=0x30af8a8*=0x40000, lpOverlapped=0x0) returned 1 [0113.168] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x46dfa10, lpNewFilePointer=0x0, dwMoveMethod=0x30af89c | out: lpNewFilePointer=0x0) returned 1 [0113.168] WriteFile (in: hFile=0x1e8, lpBuffer=0x45c40d8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x30af8a8, lpOverlapped=0x0 | out: lpBuffer=0x45c40d8*, lpNumberOfBytesWritten=0x30af8a8*=0x40000, lpOverlapped=0x0) returned 1 [0113.169] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0xd45ee31, lpNewFilePointer=0x0, dwMoveMethod=0x30af89c | out: lpNewFilePointer=0x0) returned 1 [0113.169] WriteFile (in: hFile=0x1e8, lpBuffer=0x45c40d8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x30af8a8, lpOverlapped=0x0 | out: lpBuffer=0x45c40d8*, lpNumberOfBytesWritten=0x30af8a8*=0x40000, lpOverlapped=0x0) returned 1 [0113.171] CloseHandle (hObject=0x1e8) returned 1 [0113.174] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x2020) returned 1 [0113.187] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75 [0113.187] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75 [0113.188] lstrlenW (lpString=".doc") returned 4 [0113.188] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0113.188] lstrlenW (lpString=".docx") returned 5 [0113.188] lstrcmpiW (lpString1=".docx", lpString2="2.cab") returned -1 [0113.188] lstrlenW (lpString=".pdf") returned 4 [0113.188] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0113.188] lstrlenW (lpString=".xls") returned 4 [0113.188] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0113.188] lstrlenW (lpString=".xlsx") returned 5 [0113.188] lstrcmpiW (lpString1=".xlsx", lpString2="2.cab") returned -1 [0113.188] lstrlenW (lpString=".ppt") returned 4 [0113.188] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0113.188] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75 [0113.188] lstrlenW (lpString=".zip") returned 4 [0113.188] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0113.188] lstrlenW (lpString=".rar") returned 4 [0113.188] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0113.188] lstrlenW (lpString=".bz2") returned 4 [0113.188] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0113.188] lstrlenW (lpString=".7z") returned 3 [0113.188] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0113.188] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75 [0113.188] lstrlenW (lpString=".dbf") returned 4 [0113.188] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0113.188] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75 [0113.188] lstrlenW (lpString=".1cd") returned 4 [0113.188] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0113.188] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75 [0113.188] lstrlenW (lpString=".jpg") returned 4 [0113.188] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0113.188] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75 [0113.188] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75 [0113.188] lstrlenW (lpString=".doc") returned 4 [0113.188] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0113.188] lstrlenW (lpString=".docx") returned 5 [0113.188] lstrcmpiW (lpString1=".docx", lpString2="2.cab") returned -1 [0113.188] lstrlenW (lpString=".pdf") returned 4 [0113.188] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0113.188] lstrlenW (lpString=".xls") returned 4 [0113.188] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0113.188] lstrlenW (lpString=".xlsx") returned 5 [0113.188] lstrcmpiW (lpString1=".xlsx", lpString2="2.cab") returned -1 [0113.188] lstrlenW (lpString=".ppt") returned 4 [0113.188] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0113.188] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75 [0113.188] lstrlenW (lpString=".zip") returned 4 [0113.188] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0113.188] lstrlenW (lpString=".rar") returned 4 [0113.188] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0113.188] lstrlenW (lpString=".bz2") returned 4 [0113.189] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0113.189] lstrlenW (lpString=".7z") returned 3 [0113.189] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0113.189] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75 [0113.189] lstrlenW (lpString=".dbf") returned 4 [0113.189] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0113.189] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75 [0113.189] lstrlenW (lpString=".1cd") returned 4 [0113.189] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0113.189] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75 [0113.189] lstrlenW (lpString=".jpg") returned 4 [0113.189] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0113.189] lstrcmpiW (lpString1=".msi", lpString2=".waifu") returned -1 [0113.189] lstrlenW (lpString="Office32WW.msi") returned 14 [0113.189] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0113.217] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x30afb3c | out: lpFileSize=0x30afb3c*=1992192) returned 1 [0113.217] CloseHandle (hObject=0x194) returned 1 [0113.217] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.msi")) returned 0x2020 [0113.217] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.msi.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0113.217] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.msi.id-9c354b42.[darknes@420blaze.it].waifu")) returned 1 [0113.218] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.msi.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0113.218] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30af88c | out: lpNewFilePointer=0x0) returned 1 [0113.218] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30af84c | out: lpNewFilePointer=0x0) returned 1 [0113.218] ReadFile (in: hFile=0x194, lpBuffer=0x3f00058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x30af858, lpOverlapped=0x0 | out: lpBuffer=0x3f00058*, lpNumberOfBytesRead=0x30af858*=0x40000, lpOverlapped=0x0) returned 1 [0113.775] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0xa2200, lpNewFilePointer=0x0, dwMoveMethod=0x30af84c | out: lpNewFilePointer=0x0) returned 1 [0113.775] ReadFile (in: hFile=0x194, lpBuffer=0x3f40058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x30af858, lpOverlapped=0x0 | out: lpBuffer=0x3f40058*, lpNumberOfBytesRead=0x30af858*=0x40000, lpOverlapped=0x0) returned 1 [0113.778] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x30af88c | out: lpNewFilePointer=0xffffffff) returned 1 [0113.778] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x1a6600, lpNewFilePointer=0x0, dwMoveMethod=0x30af84c | out: lpNewFilePointer=0x0) returned 1 [0113.778] ReadFile (in: hFile=0x194, lpBuffer=0x3f80058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x30af858, lpOverlapped=0x0 | out: lpBuffer=0x3f80058*, lpNumberOfBytesRead=0x30af858*=0x40000, lpOverlapped=0x0) returned 1 [0113.797] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30afae8 | out: lpNewFilePointer=0x0) returned 1 [0113.797] WriteFile (in: hFile=0x194, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0xc0108, lpNumberOfBytesWritten=0x30af8d0, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x30af8d0*=0xc0108, lpOverlapped=0x0) returned 1 [0113.933] SetEndOfFile (hFile=0x194) returned 1 [0113.936] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30af89c | out: lpNewFilePointer=0x0) returned 1 [0113.936] WriteFile (in: hFile=0x194, lpBuffer=0x45840d0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x30af8a8, lpOverlapped=0x0 | out: lpBuffer=0x45840d0*, lpNumberOfBytesWritten=0x30af8a8*=0x40000, lpOverlapped=0x0) returned 1 [0113.937] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0xa2200, lpNewFilePointer=0x0, dwMoveMethod=0x30af89c | out: lpNewFilePointer=0x0) returned 1 [0113.937] WriteFile (in: hFile=0x194, lpBuffer=0x45840d0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x30af8a8, lpOverlapped=0x0 | out: lpBuffer=0x45840d0*, lpNumberOfBytesWritten=0x30af8a8*=0x40000, lpOverlapped=0x0) returned 1 [0113.938] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x1a6600, lpNewFilePointer=0x0, dwMoveMethod=0x30af89c | out: lpNewFilePointer=0x0) returned 1 [0113.938] WriteFile (in: hFile=0x194, lpBuffer=0x45840d0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x30af8a8, lpOverlapped=0x0 | out: lpBuffer=0x45840d0*, lpNumberOfBytesWritten=0x30af8a8*=0x40000, lpOverlapped=0x0) returned 1 [0113.939] CloseHandle (hObject=0x194) returned 1 [0113.940] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x2020) returned 1 [0113.940] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0113.940] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0113.940] lstrlenW (lpString=".doc") returned 4 [0113.940] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0113.940] lstrlenW (lpString=".docx") returned 5 [0113.940] lstrcmpiW (lpString1=".docx", lpString2="W.msi") returned -1 [0113.940] lstrlenW (lpString=".pdf") returned 4 [0113.940] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0113.940] lstrlenW (lpString=".xls") returned 4 [0113.940] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0113.940] lstrlenW (lpString=".xlsx") returned 5 [0113.940] lstrcmpiW (lpString1=".xlsx", lpString2="W.msi") returned -1 [0113.940] lstrlenW (lpString=".ppt") returned 4 [0113.940] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0113.940] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0113.940] lstrlenW (lpString=".zip") returned 4 [0113.940] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0113.940] lstrlenW (lpString=".rar") returned 4 [0113.940] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0113.940] lstrlenW (lpString=".bz2") returned 4 [0113.940] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0113.940] lstrlenW (lpString=".7z") returned 3 [0113.940] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0113.940] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0113.940] lstrlenW (lpString=".dbf") returned 4 [0113.940] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0113.940] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0113.940] lstrlenW (lpString=".1cd") returned 4 [0113.940] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0113.940] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0113.940] lstrlenW (lpString=".jpg") returned 4 [0113.940] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0113.941] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0113.941] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0113.941] lstrlenW (lpString=".doc") returned 4 [0113.941] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0113.941] lstrlenW (lpString=".docx") returned 5 [0113.941] lstrcmpiW (lpString1=".docx", lpString2="W.msi") returned -1 [0113.941] lstrlenW (lpString=".pdf") returned 4 [0113.941] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0113.941] lstrlenW (lpString=".xls") returned 4 [0113.941] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0113.941] lstrlenW (lpString=".xlsx") returned 5 [0113.941] lstrcmpiW (lpString1=".xlsx", lpString2="W.msi") returned -1 [0113.941] lstrlenW (lpString=".ppt") returned 4 [0113.941] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0113.941] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0113.941] lstrlenW (lpString=".zip") returned 4 [0113.941] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0113.941] lstrlenW (lpString=".rar") returned 4 [0113.941] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0113.941] lstrlenW (lpString=".bz2") returned 4 [0113.941] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0113.941] lstrlenW (lpString=".7z") returned 3 [0113.941] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0113.941] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0113.941] lstrlenW (lpString=".dbf") returned 4 [0113.941] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0113.941] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0113.941] lstrlenW (lpString=".1cd") returned 4 [0113.941] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0113.941] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0113.941] lstrlenW (lpString=".jpg") returned 4 [0113.941] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0113.941] lstrcmpiW (lpString1=".dll", lpString2=".waifu") returned -1 [0113.941] lstrlenW (lpString="PidGenX.dll") returned 11 [0113.941] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pidgenx.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0114.009] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x30afb3c | out: lpFileSize=0x30afb3c*=1463568) returned 1 [0114.009] CloseHandle (hObject=0x1f8) returned 1 [0114.009] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pidgenx.dll")) returned 0x2020 [0114.009] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pidgenx.dll.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0114.009] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pidgenx.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0114.009] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30afae8 | out: lpNewFilePointer=0x0) returned 1 [0114.009] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30afae8 | out: lpNewFilePointer=0x0) returned 1 [0114.009] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pidgenx.dll.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0114.009] GetLastError () returned 0x0 [0114.009] ReadFile (in: hFile=0x1f8, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30afaf4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x30afaf4*=0xffff0, lpOverlapped=0x0) returned 1 [0114.028] WriteFile (in: hFile=0x1fc, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x30af8bc, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x30af8bc*=0xffff0, lpOverlapped=0x0) returned 1 [0114.037] ReadFile (in: hFile=0x1f8, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30afaf4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x30afaf4*=0x65520, lpOverlapped=0x0) returned 1 [0114.043] WriteFile (in: hFile=0x1fc, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0x65530, lpNumberOfBytesWritten=0x30af8bc, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x30af8bc*=0x65530, lpOverlapped=0x0) returned 1 [0114.048] ReadFile (in: hFile=0x1f8, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30afaf4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x30afaf4*=0x0, lpOverlapped=0x0) returned 1 [0114.048] WriteFile (in: hFile=0x1fc, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x30af8bc, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x30af8bc*=0xea, lpOverlapped=0x0) returned 1 [0114.049] SetEndOfFile (hFile=0x1fc) returned 1 [0114.049] CloseHandle (hObject=0x1fc) returned 1 [0114.049] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30afae8 | out: lpNewFilePointer=0x0) returned 1 [0114.049] SetEndOfFile (hFile=0x1f8) returned 1 [0114.050] CloseHandle (hObject=0x1f8) returned 1 [0114.050] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x2020) returned 1 [0114.050] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pidgenx.dll")) returned 1 [0114.050] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0114.051] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0114.051] lstrlenW (lpString=".doc") returned 4 [0114.051] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0114.051] lstrlenW (lpString=".docx") returned 5 [0114.051] lstrcmpiW (lpString1=".docx", lpString2="X.dll") returned -1 [0114.051] lstrlenW (lpString=".pdf") returned 4 [0114.051] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0114.051] lstrlenW (lpString=".xls") returned 4 [0114.051] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0114.051] lstrlenW (lpString=".xlsx") returned 5 [0114.051] lstrcmpiW (lpString1=".xlsx", lpString2="X.dll") returned -1 [0114.051] lstrlenW (lpString=".ppt") returned 4 [0114.051] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0114.051] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0114.051] lstrlenW (lpString=".zip") returned 4 [0114.051] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0114.051] lstrlenW (lpString=".rar") returned 4 [0114.051] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0114.051] lstrlenW (lpString=".bz2") returned 4 [0114.051] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0114.051] lstrlenW (lpString=".7z") returned 3 [0114.051] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0114.051] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0114.051] lstrlenW (lpString=".dbf") returned 4 [0114.051] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0114.051] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0114.051] lstrlenW (lpString=".1cd") returned 4 [0114.051] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0114.051] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0114.051] lstrlenW (lpString=".jpg") returned 4 [0114.051] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0114.051] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0114.051] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0114.051] lstrlenW (lpString=".doc") returned 4 [0114.051] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0114.051] lstrlenW (lpString=".docx") returned 5 [0114.051] lstrcmpiW (lpString1=".docx", lpString2="X.dll") returned -1 [0114.051] lstrlenW (lpString=".pdf") returned 4 [0114.051] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0114.051] lstrlenW (lpString=".xls") returned 4 [0114.051] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0114.051] lstrlenW (lpString=".xlsx") returned 5 [0114.051] lstrcmpiW (lpString1=".xlsx", lpString2="X.dll") returned -1 [0114.051] lstrlenW (lpString=".ppt") returned 4 [0114.051] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0114.051] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0114.051] lstrlenW (lpString=".zip") returned 4 [0114.051] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0114.051] lstrlenW (lpString=".rar") returned 4 [0114.051] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0114.052] lstrlenW (lpString=".bz2") returned 4 [0114.052] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0114.052] lstrlenW (lpString=".7z") returned 3 [0114.052] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0114.052] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0114.052] lstrlenW (lpString=".dbf") returned 4 [0114.052] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0114.052] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0114.052] lstrlenW (lpString=".1cd") returned 4 [0114.052] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0114.052] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0114.052] lstrlenW (lpString=".jpg") returned 4 [0114.052] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0114.052] lstrcmpiW (lpString1=".xrm-ms", lpString2=".waifu") returned 1 [0114.052] lstrlenW (lpString="pkeyconfig-office.xrm-ms") returned 24 [0114.052] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0114.053] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x30afb3c | out: lpFileSize=0x30afb3c*=715834) returned 1 [0114.053] CloseHandle (hObject=0x1f8) returned 1 [0114.053] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms")) returned 0x2020 [0114.053] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0114.053] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0114.053] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30afae8 | out: lpNewFilePointer=0x0) returned 1 [0114.053] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30afae8 | out: lpNewFilePointer=0x0) returned 1 [0114.053] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0114.053] GetLastError () returned 0x0 [0114.053] ReadFile (in: hFile=0x1f8, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30afaf4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x30afaf4*=0xaec3a, lpOverlapped=0x0) returned 1 [0114.065] WriteFile (in: hFile=0x1fc, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0xaec40, lpNumberOfBytesWritten=0x30af8bc, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x30af8bc*=0xaec40, lpOverlapped=0x0) returned 1 [0114.103] ReadFile (in: hFile=0x1f8, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30afaf4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x30afaf4*=0x0, lpOverlapped=0x0) returned 1 [0114.103] WriteFile (in: hFile=0x1fc, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x30af8bc, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x30af8bc*=0x104, lpOverlapped=0x0) returned 1 [0114.113] SetEndOfFile (hFile=0x1fc) returned 1 [0114.279] CloseHandle (hObject=0x1fc) returned 1 [0114.279] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30afae8 | out: lpNewFilePointer=0x0) returned 1 [0114.279] SetEndOfFile (hFile=0x1f8) returned 1 [0114.281] CloseHandle (hObject=0x1f8) returned 1 [0114.281] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x2020) returned 1 [0114.281] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms")) returned 1 [0114.282] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0114.282] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0114.282] lstrlenW (lpString=".doc") returned 4 [0114.282] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0114.282] lstrlenW (lpString=".docx") returned 5 [0114.282] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0114.282] lstrlenW (lpString=".pdf") returned 4 [0114.282] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0114.282] lstrlenW (lpString=".xls") returned 4 [0114.282] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0114.282] lstrlenW (lpString=".xlsx") returned 5 [0114.282] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0114.282] lstrlenW (lpString=".ppt") returned 4 [0114.282] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0114.282] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0114.282] lstrlenW (lpString=".zip") returned 4 [0114.282] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0114.282] lstrlenW (lpString=".rar") returned 4 [0114.282] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0114.282] lstrlenW (lpString=".bz2") returned 4 [0114.282] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0114.282] lstrlenW (lpString=".7z") returned 3 [0114.282] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0114.282] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0114.282] lstrlenW (lpString=".dbf") returned 4 [0114.282] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0114.282] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0114.282] lstrlenW (lpString=".1cd") returned 4 [0114.282] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0114.282] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0114.282] lstrlenW (lpString=".jpg") returned 4 [0114.282] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0114.282] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0114.282] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0114.282] lstrlenW (lpString=".doc") returned 4 [0114.282] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0114.282] lstrlenW (lpString=".docx") returned 5 [0114.282] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0114.282] lstrlenW (lpString=".pdf") returned 4 [0114.282] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0114.282] lstrlenW (lpString=".xls") returned 4 [0114.282] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0114.282] lstrlenW (lpString=".xlsx") returned 5 [0114.282] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0114.282] lstrlenW (lpString=".ppt") returned 4 [0114.282] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0114.283] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0114.283] lstrlenW (lpString=".zip") returned 4 [0114.283] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0114.283] lstrlenW (lpString=".rar") returned 4 [0114.283] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0114.283] lstrlenW (lpString=".bz2") returned 4 [0114.283] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0114.283] lstrlenW (lpString=".7z") returned 3 [0114.283] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0114.283] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0114.283] lstrlenW (lpString=".dbf") returned 4 [0114.283] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0114.283] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0114.283] lstrlenW (lpString=".1cd") returned 4 [0114.283] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0114.283] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0114.283] lstrlenW (lpString=".jpg") returned 4 [0114.283] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0114.283] lstrcmpiW (lpString1=".dll", lpString2=".waifu") returned -1 [0114.283] lstrlenW (lpString="osetup.dll") returned 10 [0114.283] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\osetup.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0114.643] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x30afb3c | out: lpFileSize=0x30afb3c*=7378792) returned 1 [0114.643] CloseHandle (hObject=0x180) returned 1 [0114.643] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\osetup.dll")) returned 0x2020 [0114.643] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\osetup.dll.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0114.643] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\osetup.dll"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\osetup.dll.id-9c354b42.[darknes@420blaze.it].waifu")) returned 1 [0114.643] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\osetup.dll.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0114.644] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30af88c | out: lpNewFilePointer=0x0) returned 1 [0114.644] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30af84c | out: lpNewFilePointer=0x0) returned 1 [0114.644] ReadFile (in: hFile=0x180, lpBuffer=0x3f00058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x30af858, lpOverlapped=0x0 | out: lpBuffer=0x3f00058*, lpNumberOfBytesRead=0x30af858*=0x40000, lpOverlapped=0x0) returned 1 [0114.647] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x2587cd, lpNewFilePointer=0x0, dwMoveMethod=0x30af84c | out: lpNewFilePointer=0x0) returned 1 [0114.647] ReadFile (in: hFile=0x180, lpBuffer=0x3f40058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x30af858, lpOverlapped=0x0 | out: lpBuffer=0x3f40058*, lpNumberOfBytesRead=0x30af858*=0x40000, lpOverlapped=0x0) returned 1 [0114.650] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x30af88c | out: lpNewFilePointer=0xffffffff) returned 1 [0114.650] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x6c9768, lpNewFilePointer=0x0, dwMoveMethod=0x30af84c | out: lpNewFilePointer=0x0) returned 1 [0114.650] ReadFile (in: hFile=0x180, lpBuffer=0x3f80058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x30af858, lpOverlapped=0x0 | out: lpBuffer=0x3f80058*, lpNumberOfBytesRead=0x30af858*=0x40000, lpOverlapped=0x0) returned 1 [0114.666] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30afae8 | out: lpNewFilePointer=0x0) returned 1 [0114.666] WriteFile (in: hFile=0x180, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0xc0100, lpNumberOfBytesWritten=0x30af8d0, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x30af8d0*=0xc0100, lpOverlapped=0x0) returned 1 [0114.671] SetEndOfFile (hFile=0x180) returned 1 [0114.671] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30af89c | out: lpNewFilePointer=0x0) returned 1 [0114.671] WriteFile (in: hFile=0x180, lpBuffer=0x44c2078*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x30af8a8, lpOverlapped=0x0 | out: lpBuffer=0x44c2078*, lpNumberOfBytesWritten=0x30af8a8*=0x40000, lpOverlapped=0x0) returned 1 [0114.672] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x2587cd, lpNewFilePointer=0x0, dwMoveMethod=0x30af89c | out: lpNewFilePointer=0x0) returned 1 [0114.672] WriteFile (in: hFile=0x180, lpBuffer=0x44c2078*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x30af8a8, lpOverlapped=0x0 | out: lpBuffer=0x44c2078*, lpNumberOfBytesWritten=0x30af8a8*=0x40000, lpOverlapped=0x0) returned 1 [0114.674] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x6c9768, lpNewFilePointer=0x0, dwMoveMethod=0x30af89c | out: lpNewFilePointer=0x0) returned 1 [0114.674] WriteFile (in: hFile=0x180, lpBuffer=0x44c2078*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x30af8a8, lpOverlapped=0x0 | out: lpBuffer=0x44c2078*, lpNumberOfBytesWritten=0x30af8a8*=0x40000, lpOverlapped=0x0) returned 1 [0114.675] CloseHandle (hObject=0x180) returned 1 [0114.675] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x2020) returned 1 [0114.675] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0114.675] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0114.675] lstrlenW (lpString=".doc") returned 4 [0114.675] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0114.675] lstrlenW (lpString=".docx") returned 5 [0114.675] lstrcmpiW (lpString1=".docx", lpString2="p.dll") returned -1 [0114.675] lstrlenW (lpString=".pdf") returned 4 [0114.675] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0114.675] lstrlenW (lpString=".xls") returned 4 [0114.675] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0114.675] lstrlenW (lpString=".xlsx") returned 5 [0114.675] lstrcmpiW (lpString1=".xlsx", lpString2="p.dll") returned -1 [0114.675] lstrlenW (lpString=".ppt") returned 4 [0114.675] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0114.675] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0114.675] lstrlenW (lpString=".zip") returned 4 [0114.675] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0114.675] lstrlenW (lpString=".rar") returned 4 [0114.675] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0114.675] lstrlenW (lpString=".bz2") returned 4 [0114.676] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0114.676] lstrlenW (lpString=".7z") returned 3 [0114.676] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0114.676] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0114.676] lstrlenW (lpString=".dbf") returned 4 [0114.676] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0114.676] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0114.676] lstrlenW (lpString=".1cd") returned 4 [0114.676] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0114.676] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0114.676] lstrlenW (lpString=".jpg") returned 4 [0114.676] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0114.676] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0114.676] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0114.676] lstrlenW (lpString=".doc") returned 4 [0114.676] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0114.676] lstrlenW (lpString=".docx") returned 5 [0114.676] lstrcmpiW (lpString1=".docx", lpString2="p.dll") returned -1 [0114.676] lstrlenW (lpString=".pdf") returned 4 [0114.676] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0114.676] lstrlenW (lpString=".xls") returned 4 [0114.676] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0114.676] lstrlenW (lpString=".xlsx") returned 5 [0114.676] lstrcmpiW (lpString1=".xlsx", lpString2="p.dll") returned -1 [0114.676] lstrlenW (lpString=".ppt") returned 4 [0114.676] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0114.678] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0114.679] lstrlenW (lpString=".zip") returned 4 [0114.679] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0114.679] lstrlenW (lpString=".rar") returned 4 [0114.679] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0114.679] lstrlenW (lpString=".bz2") returned 4 [0114.679] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0114.679] lstrlenW (lpString=".7z") returned 3 [0114.679] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0114.679] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0114.679] lstrlenW (lpString=".dbf") returned 4 [0114.679] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0114.679] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0114.679] lstrlenW (lpString=".1cd") returned 4 [0114.680] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0114.680] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0114.680] lstrlenW (lpString=".jpg") returned 4 [0114.680] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0114.680] lstrcmpiW (lpString1=".xrm-ms", lpString2=".waifu") returned 1 [0114.680] lstrlenW (lpString="pkeyconfig-office.xrm-ms") returned 24 [0114.680] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0114.680] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x30afb3c | out: lpFileSize=0x30afb3c*=715834) returned 1 [0114.680] CloseHandle (hObject=0x180) returned 1 [0114.680] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms")) returned 0x2020 [0114.680] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0114.680] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0114.680] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30afae8 | out: lpNewFilePointer=0x0) returned 1 [0114.680] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30afae8 | out: lpNewFilePointer=0x0) returned 1 [0114.680] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0114.681] GetLastError () returned 0x0 [0114.681] ReadFile (in: hFile=0x180, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30afaf4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x30afaf4*=0xaec3a, lpOverlapped=0x0) returned 1 [0114.701] WriteFile (in: hFile=0x194, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0xaec40, lpNumberOfBytesWritten=0x30af8bc, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x30af8bc*=0xaec40, lpOverlapped=0x0) returned 1 [0114.706] ReadFile (in: hFile=0x180, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30afaf4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x30afaf4*=0x0, lpOverlapped=0x0) returned 1 [0114.706] WriteFile (in: hFile=0x194, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x30af8bc, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x30af8bc*=0x104, lpOverlapped=0x0) returned 1 [0114.706] SetEndOfFile (hFile=0x194) returned 1 [0114.706] CloseHandle (hObject=0x194) returned 1 [0114.707] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30afae8 | out: lpNewFilePointer=0x0) returned 1 [0114.707] SetEndOfFile (hFile=0x180) returned 1 [0114.708] CloseHandle (hObject=0x180) returned 1 [0114.708] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x2020) returned 1 [0114.709] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms")) returned 1 [0114.709] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0114.709] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0114.709] lstrlenW (lpString=".doc") returned 4 [0114.709] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0114.709] lstrlenW (lpString=".docx") returned 5 [0114.709] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0114.709] lstrlenW (lpString=".pdf") returned 4 [0114.709] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0114.709] lstrlenW (lpString=".xls") returned 4 [0114.709] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0114.709] lstrlenW (lpString=".xlsx") returned 5 [0114.709] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0114.709] lstrlenW (lpString=".ppt") returned 4 [0114.709] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0114.709] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0114.709] lstrlenW (lpString=".zip") returned 4 [0114.709] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0114.709] lstrlenW (lpString=".rar") returned 4 [0114.709] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0114.709] lstrlenW (lpString=".bz2") returned 4 [0114.709] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0114.709] lstrlenW (lpString=".7z") returned 3 [0114.709] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0114.709] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0114.709] lstrlenW (lpString=".dbf") returned 4 [0114.709] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0114.709] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0114.709] lstrlenW (lpString=".1cd") returned 4 [0114.709] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0114.709] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0114.709] lstrlenW (lpString=".jpg") returned 4 [0114.709] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0114.710] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0114.710] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0114.710] lstrlenW (lpString=".doc") returned 4 [0114.710] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0114.710] lstrlenW (lpString=".docx") returned 5 [0114.710] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0114.710] lstrlenW (lpString=".pdf") returned 4 [0114.710] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0114.710] lstrlenW (lpString=".xls") returned 4 [0114.710] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0114.710] lstrlenW (lpString=".xlsx") returned 5 [0114.710] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0114.710] lstrlenW (lpString=".ppt") returned 4 [0114.710] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0114.710] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0114.710] lstrlenW (lpString=".zip") returned 4 [0114.710] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0114.710] lstrlenW (lpString=".rar") returned 4 [0114.710] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0114.710] lstrlenW (lpString=".bz2") returned 4 [0114.710] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0114.710] lstrlenW (lpString=".7z") returned 3 [0114.710] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0114.710] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0114.710] lstrlenW (lpString=".dbf") returned 4 [0114.710] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0114.710] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0114.710] lstrlenW (lpString=".1cd") returned 4 [0114.710] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0114.710] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0114.710] lstrlenW (lpString=".jpg") returned 4 [0114.710] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0114.710] lstrcmpiW (lpString1=".exe", lpString2=".waifu") returned -1 [0114.710] lstrlenW (lpString="setup.exe") returned 9 [0114.710] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0114.711] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x30afb3c | out: lpFileSize=0x30afb3c*=1377656) returned 1 [0114.711] CloseHandle (hObject=0x1d8) returned 1 [0114.713] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.exe")) returned 0x2020 [0114.713] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.exe.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0114.713] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0114.713] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30afae8 | out: lpNewFilePointer=0x0) returned 1 [0114.713] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30afae8 | out: lpNewFilePointer=0x0) returned 1 [0114.713] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.exe.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0114.713] GetLastError () returned 0x0 [0114.713] ReadFile (in: hFile=0x180, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30afaf4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x30afaf4*=0xffff0, lpOverlapped=0x0) returned 1 [0114.732] WriteFile (in: hFile=0x194, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x30af8bc, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x30af8bc*=0xffff0, lpOverlapped=0x0) returned 1 [0114.740] ReadFile (in: hFile=0x180, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30afaf4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x30afaf4*=0x50588, lpOverlapped=0x0) returned 1 [0114.746] WriteFile (in: hFile=0x194, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0x50590, lpNumberOfBytesWritten=0x30af8bc, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x30af8bc*=0x50590, lpOverlapped=0x0) returned 1 [0114.751] ReadFile (in: hFile=0x180, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30afaf4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x30afaf4*=0x0, lpOverlapped=0x0) returned 1 [0114.751] WriteFile (in: hFile=0x194, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x30af8bc, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x30af8bc*=0xe6, lpOverlapped=0x0) returned 1 [0114.751] SetEndOfFile (hFile=0x194) returned 1 [0114.751] CloseHandle (hObject=0x194) returned 1 [0114.751] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30afae8 | out: lpNewFilePointer=0x0) returned 1 [0114.751] SetEndOfFile (hFile=0x180) returned 1 [0114.752] CloseHandle (hObject=0x180) returned 1 [0114.752] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x2020) returned 1 [0114.752] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.exe")) returned 1 [0114.753] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0114.753] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0114.753] lstrlenW (lpString=".doc") returned 4 [0114.753] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0114.753] lstrlenW (lpString=".docx") returned 5 [0114.753] lstrcmpiW (lpString1=".docx", lpString2="p.exe") returned -1 [0114.753] lstrlenW (lpString=".pdf") returned 4 [0114.753] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0114.753] lstrlenW (lpString=".xls") returned 4 [0114.753] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0114.753] lstrlenW (lpString=".xlsx") returned 5 [0114.753] lstrcmpiW (lpString1=".xlsx", lpString2="p.exe") returned -1 [0114.753] lstrlenW (lpString=".ppt") returned 4 [0114.753] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0114.753] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0114.753] lstrlenW (lpString=".zip") returned 4 [0114.753] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0114.753] lstrlenW (lpString=".rar") returned 4 [0114.753] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0114.753] lstrlenW (lpString=".bz2") returned 4 [0114.753] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0114.753] lstrlenW (lpString=".7z") returned 3 [0114.753] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0114.753] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0114.753] lstrlenW (lpString=".dbf") returned 4 [0114.753] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0114.753] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0114.753] lstrlenW (lpString=".1cd") returned 4 [0114.753] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0114.753] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0114.753] lstrlenW (lpString=".jpg") returned 4 [0114.753] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0114.753] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0114.753] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0114.753] lstrlenW (lpString=".doc") returned 4 [0114.753] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0114.753] lstrlenW (lpString=".docx") returned 5 [0114.753] lstrcmpiW (lpString1=".docx", lpString2="p.exe") returned -1 [0114.753] lstrlenW (lpString=".pdf") returned 4 [0114.753] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0114.753] lstrlenW (lpString=".xls") returned 4 [0114.754] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0114.754] lstrlenW (lpString=".xlsx") returned 5 [0114.754] lstrcmpiW (lpString1=".xlsx", lpString2="p.exe") returned -1 [0114.754] lstrlenW (lpString=".ppt") returned 4 [0114.754] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0114.754] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0114.754] lstrlenW (lpString=".zip") returned 4 [0114.754] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0114.754] lstrlenW (lpString=".rar") returned 4 [0114.754] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0114.754] lstrlenW (lpString=".bz2") returned 4 [0114.754] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0114.754] lstrlenW (lpString=".7z") returned 3 [0114.754] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0114.754] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0114.754] lstrlenW (lpString=".dbf") returned 4 [0114.754] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0114.754] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0114.754] lstrlenW (lpString=".1cd") returned 4 [0114.754] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0114.754] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0114.754] lstrlenW (lpString=".jpg") returned 4 [0114.754] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0114.754] lstrcmpiW (lpString1=".cab", lpString2=".waifu") returned -1 [0114.754] lstrlenW (lpString="VisiorWW.cab") returned 12 [0114.754] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0114.754] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x30afb3c | out: lpFileSize=0x30afb3c*=195011319) returned 1 [0114.754] CloseHandle (hObject=0x180) returned 1 [0114.755] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.cab")) returned 0x2020 [0114.755] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.cab.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0114.755] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.cab.id-9c354b42.[darknes@420blaze.it].waifu")) returned 1 [0114.755] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.cab.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0114.755] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30af88c | out: lpNewFilePointer=0x0) returned 1 [0114.755] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30af84c | out: lpNewFilePointer=0x0) returned 1 [0114.755] ReadFile (in: hFile=0x180, lpBuffer=0x3f00058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x30af858, lpOverlapped=0x0 | out: lpBuffer=0x3f00058*, lpNumberOfBytesRead=0x30af858*=0x40000, lpOverlapped=0x0) returned 1 [0114.760] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x3dfe0fd, lpNewFilePointer=0x0, dwMoveMethod=0x30af84c | out: lpNewFilePointer=0x0) returned 1 [0114.760] ReadFile (in: hFile=0x180, lpBuffer=0x3f40058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x30af858, lpOverlapped=0x0 | out: lpBuffer=0x3f40058*, lpNumberOfBytesRead=0x30af858*=0x40000, lpOverlapped=0x0) returned 1 [0114.762] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x30af88c | out: lpNewFilePointer=0xffffffff) returned 1 [0114.762] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xb9ba2f7, lpNewFilePointer=0x0, dwMoveMethod=0x30af84c | out: lpNewFilePointer=0x0) returned 1 [0114.762] ReadFile (in: hFile=0x180, lpBuffer=0x3f80058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x30af858, lpOverlapped=0x0 | out: lpBuffer=0x3f80058*, lpNumberOfBytesRead=0x30af858*=0x40000, lpOverlapped=0x0) returned 1 [0114.783] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30afae8 | out: lpNewFilePointer=0x0) returned 1 [0114.783] WriteFile (in: hFile=0x180, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x30af8d0, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x30af8d0*=0xc0104, lpOverlapped=0x0) returned 1 [0114.802] SetEndOfFile (hFile=0x180) returned 1 [0114.804] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30af89c | out: lpNewFilePointer=0x0) returned 1 [0114.804] WriteFile (in: hFile=0x180, lpBuffer=0x45840d0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x30af8a8, lpOverlapped=0x0 | out: lpBuffer=0x45840d0*, lpNumberOfBytesWritten=0x30af8a8*=0x40000, lpOverlapped=0x0) returned 1 [0114.804] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x3dfe0fd, lpNewFilePointer=0x0, dwMoveMethod=0x30af89c | out: lpNewFilePointer=0x0) returned 1 [0114.805] WriteFile (in: hFile=0x180, lpBuffer=0x45840d0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x30af8a8, lpOverlapped=0x0 | out: lpBuffer=0x45840d0*, lpNumberOfBytesWritten=0x30af8a8*=0x40000, lpOverlapped=0x0) returned 1 [0114.806] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xb9ba2f7, lpNewFilePointer=0x0, dwMoveMethod=0x30af89c | out: lpNewFilePointer=0x0) returned 1 [0114.806] WriteFile (in: hFile=0x180, lpBuffer=0x45840d0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x30af8a8, lpOverlapped=0x0 | out: lpBuffer=0x45840d0*, lpNumberOfBytesWritten=0x30af8a8*=0x40000, lpOverlapped=0x0) returned 1 [0114.807] CloseHandle (hObject=0x180) returned 1 [0114.808] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x2020) returned 1 [0114.808] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab") returned 75 [0114.808] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab") returned 75 [0114.808] lstrlenW (lpString=".doc") returned 4 [0114.808] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0114.808] lstrlenW (lpString=".docx") returned 5 [0114.808] lstrcmpiW (lpString1=".docx", lpString2="W.cab") returned -1 [0114.808] lstrlenW (lpString=".pdf") returned 4 [0114.808] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0114.808] lstrlenW (lpString=".xls") returned 4 [0114.808] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0114.808] lstrlenW (lpString=".xlsx") returned 5 [0114.808] lstrcmpiW (lpString1=".xlsx", lpString2="W.cab") returned -1 [0114.808] lstrlenW (lpString=".ppt") returned 4 [0114.808] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0114.808] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab") returned 75 [0114.808] lstrlenW (lpString=".zip") returned 4 [0114.808] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0114.808] lstrlenW (lpString=".rar") returned 4 [0114.808] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0114.808] lstrlenW (lpString=".bz2") returned 4 [0114.808] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0114.808] lstrlenW (lpString=".7z") returned 3 [0114.808] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0114.808] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab") returned 75 [0114.808] lstrlenW (lpString=".dbf") returned 4 [0114.808] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0114.808] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab") returned 75 [0114.808] lstrlenW (lpString=".1cd") returned 4 [0114.808] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0114.808] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab") returned 75 [0114.808] lstrlenW (lpString=".jpg") returned 4 [0114.808] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0114.808] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab") returned 75 [0114.809] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab") returned 75 [0114.809] lstrlenW (lpString=".doc") returned 4 [0114.809] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0114.809] lstrlenW (lpString=".docx") returned 5 [0114.809] lstrcmpiW (lpString1=".docx", lpString2="W.cab") returned -1 [0114.809] lstrlenW (lpString=".pdf") returned 4 [0114.809] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0114.809] lstrlenW (lpString=".xls") returned 4 [0114.809] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0114.809] lstrlenW (lpString=".xlsx") returned 5 [0114.809] lstrcmpiW (lpString1=".xlsx", lpString2="W.cab") returned -1 [0114.809] lstrlenW (lpString=".ppt") returned 4 [0114.809] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0114.809] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab") returned 75 [0114.809] lstrlenW (lpString=".zip") returned 4 [0114.809] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0114.809] lstrlenW (lpString=".rar") returned 4 [0114.809] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0114.809] lstrlenW (lpString=".bz2") returned 4 [0114.809] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0114.809] lstrlenW (lpString=".7z") returned 3 [0114.809] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0114.809] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab") returned 75 [0114.809] lstrlenW (lpString=".dbf") returned 4 [0114.809] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0114.809] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab") returned 75 [0114.809] lstrlenW (lpString=".1cd") returned 4 [0114.809] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0114.809] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab") returned 75 [0114.809] lstrlenW (lpString=".jpg") returned 4 [0114.809] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0114.809] lstrcmpiW (lpString1=".msi", lpString2=".waifu") returned -1 [0114.809] lstrlenW (lpString="VisiorWW.msi") returned 12 [0114.809] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0114.810] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x30afb3c | out: lpFileSize=0x30afb3c*=12060672) returned 1 [0114.810] CloseHandle (hObject=0x180) returned 1 [0114.810] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.msi")) returned 0x2020 [0114.810] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.msi.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0114.810] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.msi.id-9c354b42.[darknes@420blaze.it].waifu")) returned 1 [0114.810] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.msi.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0114.810] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30af88c | out: lpNewFilePointer=0x0) returned 1 [0114.810] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30af84c | out: lpNewFilePointer=0x0) returned 1 [0114.810] ReadFile (in: hFile=0x180, lpBuffer=0x3f00058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x30af858, lpOverlapped=0x0 | out: lpBuffer=0x3f00058*, lpNumberOfBytesRead=0x30af858*=0x40000, lpOverlapped=0x0) returned 1 [0114.817] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x3d5800, lpNewFilePointer=0x0, dwMoveMethod=0x30af84c | out: lpNewFilePointer=0x0) returned 1 [0114.817] ReadFile (in: hFile=0x180, lpBuffer=0x3f40058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x30af858, lpOverlapped=0x0 | out: lpBuffer=0x3f40058*, lpNumberOfBytesRead=0x30af858*=0x40000, lpOverlapped=0x0) returned 1 [0114.821] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x30af88c | out: lpNewFilePointer=0xffffffff) returned 1 [0114.823] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xb40800, lpNewFilePointer=0x0, dwMoveMethod=0x30af84c | out: lpNewFilePointer=0x0) returned 1 [0114.823] ReadFile (in: hFile=0x180, lpBuffer=0x3f80058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x30af858, lpOverlapped=0x0 | out: lpBuffer=0x3f80058*, lpNumberOfBytesRead=0x30af858*=0x40000, lpOverlapped=0x0) returned 1 [0114.989] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30afae8 | out: lpNewFilePointer=0x0) returned 1 [0114.989] WriteFile (in: hFile=0x180, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x30af8d0, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x30af8d0*=0xc0104, lpOverlapped=0x0) returned 1 [0114.997] SetEndOfFile (hFile=0x180) returned 1 [0114.999] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30af89c | out: lpNewFilePointer=0x0) returned 1 [0114.999] WriteFile (in: hFile=0x180, lpBuffer=0x44c2078*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x30af8a8, lpOverlapped=0x0 | out: lpBuffer=0x44c2078*, lpNumberOfBytesWritten=0x30af8a8*=0x40000, lpOverlapped=0x0) returned 1 [0115.000] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x3d5800, lpNewFilePointer=0x0, dwMoveMethod=0x30af89c | out: lpNewFilePointer=0x0) returned 1 [0115.000] WriteFile (in: hFile=0x180, lpBuffer=0x44c2078*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x30af8a8, lpOverlapped=0x0 | out: lpBuffer=0x44c2078*, lpNumberOfBytesWritten=0x30af8a8*=0x40000, lpOverlapped=0x0) returned 1 [0115.003] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xb40800, lpNewFilePointer=0x0, dwMoveMethod=0x30af89c | out: lpNewFilePointer=0x0) returned 1 [0115.003] WriteFile (in: hFile=0x180, lpBuffer=0x44c2078*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x30af8a8, lpOverlapped=0x0 | out: lpBuffer=0x44c2078*, lpNumberOfBytesWritten=0x30af8a8*=0x40000, lpOverlapped=0x0) returned 1 [0115.004] CloseHandle (hObject=0x180) returned 1 [0115.004] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x2020) returned 1 [0115.004] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi") returned 75 [0115.004] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi") returned 75 [0115.004] lstrlenW (lpString=".doc") returned 4 [0115.004] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0115.005] lstrlenW (lpString=".docx") returned 5 [0115.005] lstrcmpiW (lpString1=".docx", lpString2="W.msi") returned -1 [0115.005] lstrlenW (lpString=".pdf") returned 4 [0115.005] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0115.005] lstrlenW (lpString=".xls") returned 4 [0115.005] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0115.005] lstrlenW (lpString=".xlsx") returned 5 [0115.005] lstrcmpiW (lpString1=".xlsx", lpString2="W.msi") returned -1 [0115.005] lstrlenW (lpString=".ppt") returned 4 [0115.005] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0115.005] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi") returned 75 [0115.005] lstrlenW (lpString=".zip") returned 4 [0115.005] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0115.005] lstrlenW (lpString=".rar") returned 4 [0115.005] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0115.005] lstrlenW (lpString=".bz2") returned 4 [0115.005] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0115.005] lstrlenW (lpString=".7z") returned 3 [0115.005] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0115.005] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi") returned 75 [0115.005] lstrlenW (lpString=".dbf") returned 4 [0115.005] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0115.005] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi") returned 75 [0115.005] lstrlenW (lpString=".1cd") returned 4 [0115.005] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0115.005] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi") returned 75 [0115.005] lstrlenW (lpString=".jpg") returned 4 [0115.005] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0115.005] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi") returned 75 [0115.005] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi") returned 75 [0115.005] lstrlenW (lpString=".doc") returned 4 [0115.005] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0115.005] lstrlenW (lpString=".docx") returned 5 [0115.005] lstrcmpiW (lpString1=".docx", lpString2="W.msi") returned -1 [0115.005] lstrlenW (lpString=".pdf") returned 4 [0115.005] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0115.005] lstrlenW (lpString=".xls") returned 4 [0115.005] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0115.005] lstrlenW (lpString=".xlsx") returned 5 [0115.005] lstrcmpiW (lpString1=".xlsx", lpString2="W.msi") returned -1 [0115.005] lstrlenW (lpString=".ppt") returned 4 [0115.005] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0115.005] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi") returned 75 [0115.005] lstrlenW (lpString=".zip") returned 4 [0115.005] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0115.005] lstrlenW (lpString=".rar") returned 4 [0115.005] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0115.005] lstrlenW (lpString=".bz2") returned 4 [0115.005] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0115.006] lstrlenW (lpString=".7z") returned 3 [0115.006] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0115.006] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi") returned 75 [0115.006] lstrlenW (lpString=".dbf") returned 4 [0115.006] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0115.006] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi") returned 75 [0115.006] lstrlenW (lpString=".1cd") returned 4 [0115.006] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0115.006] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi") returned 75 [0115.006] lstrlenW (lpString=".jpg") returned 4 [0115.006] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0115.006] lstrcmpiW (lpString1=".EXE", lpString2=".waifu") returned -1 [0115.006] lstrlenW (lpString="DW20.EXE") returned 8 [0115.006] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dw20.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0115.547] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x30afb3c | out: lpFileSize=0x30afb3c*=994184) returned 1 [0115.547] CloseHandle (hObject=0x1f8) returned 1 [0115.547] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dw20.exe")) returned 0x20 [0115.547] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dw20.exe.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0115.547] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dw20.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0115.547] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30afae8 | out: lpNewFilePointer=0x0) returned 1 [0115.547] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30afae8 | out: lpNewFilePointer=0x0) returned 1 [0115.547] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dw20.exe.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0115.974] GetLastError () returned 0x0 [0115.974] ReadFile (in: hFile=0x1f8, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30afaf4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x30afaf4*=0xf2b88, lpOverlapped=0x0) returned 1 [0116.012] WriteFile (in: hFile=0x1e4, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0xf2b90, lpNumberOfBytesWritten=0x30af8bc, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x30af8bc*=0xf2b90, lpOverlapped=0x0) returned 1 [0116.145] ReadFile (in: hFile=0x1f8, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30afaf4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x30afaf4*=0x0, lpOverlapped=0x0) returned 1 [0116.145] WriteFile (in: hFile=0x1e4, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x30af8bc, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x30af8bc*=0xe4, lpOverlapped=0x0) returned 1 [0116.145] SetEndOfFile (hFile=0x1e4) returned 1 [0116.146] CloseHandle (hObject=0x1e4) returned 1 [0116.146] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30afae8 | out: lpNewFilePointer=0x0) returned 1 [0116.146] SetEndOfFile (hFile=0x1f8) returned 1 [0116.148] CloseHandle (hObject=0x1f8) returned 1 [0116.148] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0116.148] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dw20.exe")) returned 1 [0116.149] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE") returned 58 [0116.149] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE") returned 58 [0116.149] lstrlenW (lpString=".doc") returned 4 [0116.149] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0116.149] lstrlenW (lpString=".docx") returned 5 [0116.149] lstrcmpiW (lpString1=".docx", lpString2="0.EXE") returned -1 [0116.149] lstrlenW (lpString=".pdf") returned 4 [0116.149] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0116.149] lstrlenW (lpString=".xls") returned 4 [0116.149] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0116.149] lstrlenW (lpString=".xlsx") returned 5 [0116.149] lstrcmpiW (lpString1=".xlsx", lpString2="0.EXE") returned -1 [0116.149] lstrlenW (lpString=".ppt") returned 4 [0116.149] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0116.149] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE") returned 58 [0116.149] lstrlenW (lpString=".zip") returned 4 [0116.149] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0116.149] lstrlenW (lpString=".rar") returned 4 [0116.149] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0116.149] lstrlenW (lpString=".bz2") returned 4 [0116.149] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0116.149] lstrlenW (lpString=".7z") returned 3 [0116.149] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0116.149] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE") returned 58 [0116.149] lstrlenW (lpString=".dbf") returned 4 [0116.149] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0116.149] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE") returned 58 [0116.149] lstrlenW (lpString=".1cd") returned 4 [0116.149] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0116.149] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE") returned 58 [0116.149] lstrlenW (lpString=".jpg") returned 4 [0116.149] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0116.149] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE") returned 58 [0116.149] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE") returned 58 [0116.149] lstrlenW (lpString=".doc") returned 4 [0116.149] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0116.149] lstrlenW (lpString=".docx") returned 5 [0116.149] lstrcmpiW (lpString1=".docx", lpString2="0.EXE") returned -1 [0116.149] lstrlenW (lpString=".pdf") returned 4 [0116.149] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0116.149] lstrlenW (lpString=".xls") returned 4 [0116.149] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0116.149] lstrlenW (lpString=".xlsx") returned 5 [0116.149] lstrcmpiW (lpString1=".xlsx", lpString2="0.EXE") returned -1 [0116.149] lstrlenW (lpString=".ppt") returned 4 [0116.149] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0116.149] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE") returned 58 [0116.149] lstrlenW (lpString=".zip") returned 4 [0116.149] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0116.150] lstrlenW (lpString=".rar") returned 4 [0116.150] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0116.150] lstrlenW (lpString=".bz2") returned 4 [0116.150] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0116.150] lstrlenW (lpString=".7z") returned 3 [0116.150] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0116.150] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE") returned 58 [0116.150] lstrlenW (lpString=".dbf") returned 4 [0116.150] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0116.150] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE") returned 58 [0116.150] lstrlenW (lpString=".1cd") returned 4 [0116.150] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0116.150] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE") returned 58 [0116.150] lstrlenW (lpString=".jpg") returned 4 [0116.150] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0116.150] lstrcmpiW (lpString1=".FLT", lpString2=".waifu") returned -1 [0116.150] lstrlenW (lpString="PNG32.FLT") returned 9 [0116.150] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\png32.flt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0116.241] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x30afb3c | out: lpFileSize=0x30afb3c*=302976) returned 1 [0116.241] CloseHandle (hObject=0x208) returned 1 [0116.241] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\png32.flt")) returned 0x20 [0116.241] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\png32.flt.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0116.241] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\png32.flt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0116.241] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30afae8 | out: lpNewFilePointer=0x0) returned 1 [0116.241] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30afae8 | out: lpNewFilePointer=0x0) returned 1 [0116.241] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\png32.flt.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0116.241] GetLastError () returned 0x0 [0116.241] ReadFile (in: hFile=0x208, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30afaf4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x30afaf4*=0x49f80, lpOverlapped=0x0) returned 1 [0116.264] WriteFile (in: hFile=0x194, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0x49f90, lpNumberOfBytesWritten=0x30af8bc, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x30af8bc*=0x49f90, lpOverlapped=0x0) returned 1 [0116.266] ReadFile (in: hFile=0x208, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30afaf4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x30afaf4*=0x0, lpOverlapped=0x0) returned 1 [0116.266] WriteFile (in: hFile=0x194, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x30af8bc, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x30af8bc*=0xe6, lpOverlapped=0x0) returned 1 [0116.267] SetEndOfFile (hFile=0x194) returned 1 [0116.267] CloseHandle (hObject=0x194) returned 1 [0116.267] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30afae8 | out: lpNewFilePointer=0x0) returned 1 [0116.267] SetEndOfFile (hFile=0x208) returned 1 [0116.268] CloseHandle (hObject=0x208) returned 1 [0116.268] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0116.268] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\png32.flt")) returned 1 [0116.269] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT") returned 64 [0116.269] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT") returned 64 [0116.269] lstrlenW (lpString=".doc") returned 4 [0116.269] lstrcmpiW (lpString1=".doc", lpString2=".FLT") returned -1 [0116.269] lstrlenW (lpString=".docx") returned 5 [0116.269] lstrcmpiW (lpString1=".docx", lpString2="2.FLT") returned -1 [0116.269] lstrlenW (lpString=".pdf") returned 4 [0116.269] lstrcmpiW (lpString1=".pdf", lpString2=".FLT") returned 1 [0116.269] lstrlenW (lpString=".xls") returned 4 [0116.269] lstrcmpiW (lpString1=".xls", lpString2=".FLT") returned 1 [0116.269] lstrlenW (lpString=".xlsx") returned 5 [0116.269] lstrcmpiW (lpString1=".xlsx", lpString2="2.FLT") returned -1 [0116.269] lstrlenW (lpString=".ppt") returned 4 [0116.269] lstrcmpiW (lpString1=".ppt", lpString2=".FLT") returned 1 [0116.269] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT") returned 64 [0116.269] lstrlenW (lpString=".zip") returned 4 [0116.269] lstrcmpiW (lpString1=".zip", lpString2=".FLT") returned 1 [0116.269] lstrlenW (lpString=".rar") returned 4 [0116.269] lstrcmpiW (lpString1=".rar", lpString2=".FLT") returned 1 [0116.269] lstrlenW (lpString=".bz2") returned 4 [0116.269] lstrcmpiW (lpString1=".bz2", lpString2=".FLT") returned -1 [0116.269] lstrlenW (lpString=".7z") returned 3 [0116.269] lstrcmpiW (lpString1=".7z", lpString2="FLT") returned -1 [0116.269] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT") returned 64 [0116.269] lstrlenW (lpString=".dbf") returned 4 [0116.269] lstrcmpiW (lpString1=".dbf", lpString2=".FLT") returned -1 [0116.269] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT") returned 64 [0116.269] lstrlenW (lpString=".1cd") returned 4 [0116.269] lstrcmpiW (lpString1=".1cd", lpString2=".FLT") returned -1 [0116.269] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT") returned 64 [0116.269] lstrlenW (lpString=".jpg") returned 4 [0116.269] lstrcmpiW (lpString1=".jpg", lpString2=".FLT") returned 1 [0116.269] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT") returned 64 [0116.269] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT") returned 64 [0116.269] lstrlenW (lpString=".doc") returned 4 [0116.269] lstrcmpiW (lpString1=".doc", lpString2=".FLT") returned -1 [0116.270] lstrlenW (lpString=".docx") returned 5 [0116.270] lstrcmpiW (lpString1=".docx", lpString2="2.FLT") returned -1 [0116.270] lstrlenW (lpString=".pdf") returned 4 [0116.270] lstrcmpiW (lpString1=".pdf", lpString2=".FLT") returned 1 [0116.270] lstrlenW (lpString=".xls") returned 4 [0116.270] lstrcmpiW (lpString1=".xls", lpString2=".FLT") returned 1 [0116.270] lstrlenW (lpString=".xlsx") returned 5 [0116.270] lstrcmpiW (lpString1=".xlsx", lpString2="2.FLT") returned -1 [0116.270] lstrlenW (lpString=".ppt") returned 4 [0116.270] lstrcmpiW (lpString1=".ppt", lpString2=".FLT") returned 1 [0116.270] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT") returned 64 [0116.270] lstrlenW (lpString=".zip") returned 4 [0116.270] lstrcmpiW (lpString1=".zip", lpString2=".FLT") returned 1 [0116.270] lstrlenW (lpString=".rar") returned 4 [0116.270] lstrcmpiW (lpString1=".rar", lpString2=".FLT") returned 1 [0116.270] lstrlenW (lpString=".bz2") returned 4 [0116.270] lstrcmpiW (lpString1=".bz2", lpString2=".FLT") returned -1 [0116.270] lstrlenW (lpString=".7z") returned 3 [0116.270] lstrcmpiW (lpString1=".7z", lpString2="FLT") returned -1 [0116.270] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT") returned 64 [0116.270] lstrlenW (lpString=".dbf") returned 4 [0116.270] lstrcmpiW (lpString1=".dbf", lpString2=".FLT") returned -1 [0116.270] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT") returned 64 [0116.270] lstrlenW (lpString=".1cd") returned 4 [0116.270] lstrcmpiW (lpString1=".1cd", lpString2=".FLT") returned -1 [0116.270] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT") returned 64 [0116.270] lstrlenW (lpString=".jpg") returned 4 [0116.270] lstrcmpiW (lpString1=".jpg", lpString2=".FLT") returned 1 [0116.270] lstrcmpiW (lpString1=".mui", lpString2=".waifu") returned -1 [0116.270] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0116.270] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ar-sa\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0116.274] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x30afb3c | out: lpFileSize=0x30afb3c*=3584) returned 1 [0116.274] CloseHandle (hObject=0x208) returned 1 [0116.274] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ar-sa\\tipresx.dll.mui")) returned 0x20 [0116.275] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ar-sa\\tipresx.dll.mui.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0116.275] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ar-sa\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0116.275] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0116.275] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0116.275] lstrlenW (lpString=".doc") returned 4 [0116.275] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0116.275] lstrlenW (lpString=".docx") returned 5 [0116.275] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0116.275] lstrlenW (lpString=".pdf") returned 4 [0116.275] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0116.275] lstrlenW (lpString=".xls") returned 4 [0116.275] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0116.275] lstrlenW (lpString=".xlsx") returned 5 [0116.275] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0116.275] lstrlenW (lpString=".ppt") returned 4 [0116.275] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0116.275] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0116.275] lstrlenW (lpString=".zip") returned 4 [0116.275] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0116.275] lstrlenW (lpString=".rar") returned 4 [0116.275] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0116.275] lstrlenW (lpString=".bz2") returned 4 [0116.275] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0116.275] lstrlenW (lpString=".7z") returned 3 [0116.275] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0116.275] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0116.275] lstrlenW (lpString=".dbf") returned 4 [0116.275] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0116.275] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0116.275] lstrlenW (lpString=".1cd") returned 4 [0116.275] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0116.275] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0116.275] lstrlenW (lpString=".jpg") returned 4 [0116.275] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0116.275] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0116.275] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0116.275] lstrlenW (lpString=".doc") returned 4 [0116.275] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0116.275] lstrlenW (lpString=".docx") returned 5 [0116.275] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0116.275] lstrlenW (lpString=".pdf") returned 4 [0116.275] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0116.275] lstrlenW (lpString=".xls") returned 4 [0116.276] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0116.276] lstrlenW (lpString=".xlsx") returned 5 [0116.276] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0116.276] lstrlenW (lpString=".ppt") returned 4 [0116.276] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0116.276] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0116.276] lstrlenW (lpString=".zip") returned 4 [0116.276] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0116.276] lstrlenW (lpString=".rar") returned 4 [0116.276] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0116.276] lstrlenW (lpString=".bz2") returned 4 [0116.276] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0116.276] lstrlenW (lpString=".7z") returned 3 [0116.276] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0116.276] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0116.276] lstrlenW (lpString=".dbf") returned 4 [0116.276] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0116.276] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0116.276] lstrlenW (lpString=".1cd") returned 4 [0116.276] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0116.276] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0116.276] lstrlenW (lpString=".jpg") returned 4 [0116.276] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0116.276] lstrcmpiW (lpString1=".mui", lpString2=".waifu") returned -1 [0116.276] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0116.276] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\bg-bg\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0116.276] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x30afb3c | out: lpFileSize=0x30afb3c*=4096) returned 1 [0116.277] CloseHandle (hObject=0x208) returned 1 [0116.277] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\bg-bg\\tipresx.dll.mui")) returned 0x20 [0116.277] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\bg-bg\\tipresx.dll.mui.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0116.277] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\bg-bg\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0116.277] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0116.277] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0116.277] lstrlenW (lpString=".doc") returned 4 [0116.277] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0116.277] lstrlenW (lpString=".docx") returned 5 [0116.277] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0116.277] lstrlenW (lpString=".pdf") returned 4 [0116.277] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0116.277] lstrlenW (lpString=".xls") returned 4 [0116.277] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0116.277] lstrlenW (lpString=".xlsx") returned 5 [0116.277] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0116.277] lstrlenW (lpString=".ppt") returned 4 [0116.277] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0116.277] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0116.277] lstrlenW (lpString=".zip") returned 4 [0116.277] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0116.277] lstrlenW (lpString=".rar") returned 4 [0116.277] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0116.277] lstrlenW (lpString=".bz2") returned 4 [0116.277] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0116.277] lstrlenW (lpString=".7z") returned 3 [0116.277] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0116.277] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0116.277] lstrlenW (lpString=".dbf") returned 4 [0116.277] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0116.277] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0116.277] lstrlenW (lpString=".1cd") returned 4 [0116.278] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0116.278] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0116.278] lstrlenW (lpString=".jpg") returned 4 [0116.278] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0116.278] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0116.278] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0116.278] lstrlenW (lpString=".doc") returned 4 [0116.278] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0116.278] lstrlenW (lpString=".docx") returned 5 [0116.278] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0116.278] lstrlenW (lpString=".pdf") returned 4 [0116.278] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0116.278] lstrlenW (lpString=".xls") returned 4 [0116.278] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0116.278] lstrlenW (lpString=".xlsx") returned 5 [0116.278] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0116.278] lstrlenW (lpString=".ppt") returned 4 [0116.278] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0116.278] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0116.278] lstrlenW (lpString=".zip") returned 4 [0116.278] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0116.278] lstrlenW (lpString=".rar") returned 4 [0116.278] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0116.278] lstrlenW (lpString=".bz2") returned 4 [0116.278] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0116.278] lstrlenW (lpString=".7z") returned 3 [0116.278] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0116.278] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0116.278] lstrlenW (lpString=".dbf") returned 4 [0116.278] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0116.278] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0116.278] lstrlenW (lpString=".1cd") returned 4 [0116.278] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0116.278] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0116.278] lstrlenW (lpString=".jpg") returned 4 [0116.278] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0116.278] lstrcmpiW (lpString1=".exe", lpString2=".waifu") returned -1 [0116.278] lstrlenW (lpString="ConvertInkStore.exe") returned 19 [0116.278] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\convertinkstore.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0116.279] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x30afb3c | out: lpFileSize=0x30afb3c*=193024) returned 1 [0116.279] CloseHandle (hObject=0x208) returned 1 [0116.279] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\convertinkstore.exe")) returned 0x20 [0116.279] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\convertinkstore.exe.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0116.279] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\convertinkstore.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0116.279] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe") returned 70 [0116.279] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe") returned 70 [0116.279] lstrlenW (lpString=".doc") returned 4 [0116.279] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0116.279] lstrlenW (lpString=".docx") returned 5 [0116.279] lstrcmpiW (lpString1=".docx", lpString2="e.exe") returned -1 [0116.279] lstrlenW (lpString=".pdf") returned 4 [0116.279] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0116.279] lstrlenW (lpString=".xls") returned 4 [0116.279] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0116.279] lstrlenW (lpString=".xlsx") returned 5 [0116.279] lstrcmpiW (lpString1=".xlsx", lpString2="e.exe") returned -1 [0116.279] lstrlenW (lpString=".ppt") returned 4 [0116.279] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0116.279] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe") returned 70 [0116.279] lstrlenW (lpString=".zip") returned 4 [0116.279] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0116.279] lstrlenW (lpString=".rar") returned 4 [0116.279] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0116.279] lstrlenW (lpString=".bz2") returned 4 [0116.279] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0116.279] lstrlenW (lpString=".7z") returned 3 [0116.279] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0116.279] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe") returned 70 [0116.279] lstrlenW (lpString=".dbf") returned 4 [0116.279] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0116.279] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe") returned 70 [0116.279] lstrlenW (lpString=".1cd") returned 4 [0116.280] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0116.280] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe") returned 70 [0116.280] lstrlenW (lpString=".jpg") returned 4 [0116.280] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0116.280] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe") returned 70 [0116.280] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe") returned 70 [0116.280] lstrlenW (lpString=".doc") returned 4 [0116.280] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0116.280] lstrlenW (lpString=".docx") returned 5 [0116.280] lstrcmpiW (lpString1=".docx", lpString2="e.exe") returned -1 [0116.280] lstrlenW (lpString=".pdf") returned 4 [0116.280] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0116.280] lstrlenW (lpString=".xls") returned 4 [0116.280] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0116.280] lstrlenW (lpString=".xlsx") returned 5 [0116.280] lstrcmpiW (lpString1=".xlsx", lpString2="e.exe") returned -1 [0116.280] lstrlenW (lpString=".ppt") returned 4 [0116.280] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0116.280] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe") returned 70 [0116.280] lstrlenW (lpString=".zip") returned 4 [0116.280] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0116.280] lstrlenW (lpString=".rar") returned 4 [0116.280] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0116.280] lstrlenW (lpString=".bz2") returned 4 [0116.280] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0116.280] lstrlenW (lpString=".7z") returned 3 [0116.280] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0116.280] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe") returned 70 [0116.280] lstrlenW (lpString=".dbf") returned 4 [0116.280] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0116.280] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe") returned 70 [0116.280] lstrlenW (lpString=".1cd") returned 4 [0116.280] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0116.280] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe") returned 70 [0116.280] lstrlenW (lpString=".jpg") returned 4 [0116.280] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0116.280] lstrcmpiW (lpString1=".mui", lpString2=".waifu") returned -1 [0116.280] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0116.280] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\cs-cz\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0116.281] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x30afb3c | out: lpFileSize=0x30afb3c*=3584) returned 1 [0116.281] CloseHandle (hObject=0x208) returned 1 [0116.281] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\cs-cz\\tipresx.dll.mui")) returned 0x20 [0116.281] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\cs-cz\\tipresx.dll.mui.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0116.281] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\cs-cz\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0116.281] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0116.281] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0116.281] lstrlenW (lpString=".doc") returned 4 [0116.281] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0116.281] lstrlenW (lpString=".docx") returned 5 [0116.281] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0116.281] lstrlenW (lpString=".pdf") returned 4 [0116.281] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0116.281] lstrlenW (lpString=".xls") returned 4 [0116.281] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0116.281] lstrlenW (lpString=".xlsx") returned 5 [0116.281] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0116.281] lstrlenW (lpString=".ppt") returned 4 [0116.281] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0116.281] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0116.281] lstrlenW (lpString=".zip") returned 4 [0116.281] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0116.281] lstrlenW (lpString=".rar") returned 4 [0116.281] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0116.281] lstrlenW (lpString=".bz2") returned 4 [0116.281] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0116.281] lstrlenW (lpString=".7z") returned 3 [0116.281] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0116.281] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0116.281] lstrlenW (lpString=".dbf") returned 4 [0116.281] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0116.281] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0116.281] lstrlenW (lpString=".1cd") returned 4 [0116.281] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0116.282] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0116.282] lstrlenW (lpString=".jpg") returned 4 [0116.282] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0116.282] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0116.282] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0116.282] lstrlenW (lpString=".doc") returned 4 [0116.282] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0116.282] lstrlenW (lpString=".docx") returned 5 [0116.282] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0116.282] lstrlenW (lpString=".pdf") returned 4 [0116.282] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0116.282] lstrlenW (lpString=".xls") returned 4 [0116.282] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0116.282] lstrlenW (lpString=".xlsx") returned 5 [0116.282] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0116.282] lstrlenW (lpString=".ppt") returned 4 [0116.282] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0116.282] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0116.282] lstrlenW (lpString=".zip") returned 4 [0116.282] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0116.282] lstrlenW (lpString=".rar") returned 4 [0116.282] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0116.282] lstrlenW (lpString=".bz2") returned 4 [0116.282] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0116.282] lstrlenW (lpString=".7z") returned 3 [0116.282] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0116.282] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0116.282] lstrlenW (lpString=".dbf") returned 4 [0116.282] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0116.282] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0116.282] lstrlenW (lpString=".1cd") returned 4 [0116.282] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0116.282] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0116.282] lstrlenW (lpString=".jpg") returned 4 [0116.282] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0116.282] lstrcmpiW (lpString1=".mui", lpString2=".waifu") returned -1 [0116.282] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0116.282] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\da-dk\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0116.283] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x30afb3c | out: lpFileSize=0x30afb3c*=3584) returned 1 [0116.283] CloseHandle (hObject=0x208) returned 1 [0116.283] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\da-dk\\tipresx.dll.mui")) returned 0x20 [0116.283] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\da-dk\\tipresx.dll.mui.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0116.283] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\da-dk\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0116.283] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0116.283] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0116.283] lstrlenW (lpString=".doc") returned 4 [0116.283] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0116.283] lstrlenW (lpString=".docx") returned 5 [0116.283] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0116.283] lstrlenW (lpString=".pdf") returned 4 [0116.283] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0116.283] lstrlenW (lpString=".xls") returned 4 [0116.283] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0116.283] lstrlenW (lpString=".xlsx") returned 5 [0116.283] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0116.283] lstrlenW (lpString=".ppt") returned 4 [0116.283] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0116.283] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0116.283] lstrlenW (lpString=".zip") returned 4 [0116.283] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0116.283] lstrlenW (lpString=".rar") returned 4 [0116.283] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0116.283] lstrlenW (lpString=".bz2") returned 4 [0116.283] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0116.283] lstrlenW (lpString=".7z") returned 3 [0116.283] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0116.283] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0116.283] lstrlenW (lpString=".dbf") returned 4 [0116.283] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0116.283] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0116.283] lstrlenW (lpString=".1cd") returned 4 [0116.284] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0116.284] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0116.284] lstrlenW (lpString=".jpg") returned 4 [0116.284] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0116.284] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0116.284] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0116.284] lstrlenW (lpString=".doc") returned 4 [0116.284] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0116.284] lstrlenW (lpString=".docx") returned 5 [0116.284] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0116.284] lstrlenW (lpString=".pdf") returned 4 [0116.284] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0116.284] lstrlenW (lpString=".xls") returned 4 [0116.284] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0116.284] lstrlenW (lpString=".xlsx") returned 5 [0116.284] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0116.284] lstrlenW (lpString=".ppt") returned 4 [0116.284] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0116.284] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0116.284] lstrlenW (lpString=".zip") returned 4 [0116.284] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0116.284] lstrlenW (lpString=".rar") returned 4 [0116.284] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0116.284] lstrlenW (lpString=".bz2") returned 4 [0116.284] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0116.284] lstrlenW (lpString=".7z") returned 3 [0116.284] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0116.284] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0116.284] lstrlenW (lpString=".dbf") returned 4 [0116.284] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0116.284] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0116.284] lstrlenW (lpString=".1cd") returned 4 [0116.284] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0116.284] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0116.284] lstrlenW (lpString=".jpg") returned 4 [0116.284] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0116.284] lstrcmpiW (lpString1=".mui", lpString2=".waifu") returned -1 [0116.284] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0116.284] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\de-de\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0116.457] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x30afb3c | out: lpFileSize=0x30afb3c*=4096) returned 1 [0116.457] CloseHandle (hObject=0x16c) returned 1 [0116.457] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\de-de\\tipresx.dll.mui")) returned 0x20 [0116.457] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\de-de\\tipresx.dll.mui.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0116.457] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\de-de\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0116.457] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui") returned 72 [0116.457] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui") returned 72 [0116.458] lstrlenW (lpString=".doc") returned 4 [0116.458] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0116.458] lstrlenW (lpString=".docx") returned 5 [0116.458] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0116.458] lstrlenW (lpString=".pdf") returned 4 [0116.458] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0116.458] lstrlenW (lpString=".xls") returned 4 [0116.458] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0116.458] lstrlenW (lpString=".xlsx") returned 5 [0116.458] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0116.458] lstrlenW (lpString=".ppt") returned 4 [0116.458] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0116.458] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui") returned 72 [0116.458] lstrlenW (lpString=".zip") returned 4 [0116.458] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0116.458] lstrlenW (lpString=".rar") returned 4 [0116.458] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0116.458] lstrlenW (lpString=".bz2") returned 4 [0116.458] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0116.458] lstrlenW (lpString=".7z") returned 3 [0116.458] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0116.458] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui") returned 72 [0116.458] lstrlenW (lpString=".dbf") returned 4 [0116.458] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0116.844] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30afae8 | out: lpNewFilePointer=0x0) returned 1 [0116.844] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30afae8 | out: lpNewFilePointer=0x0) returned 1 [0116.844] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\aceodbci.dll.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0116.845] GetLastError () returned 0x0 [0116.845] ReadFile (in: hFile=0x1ec, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30afaf4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x30afaf4*=0xcdb0, lpOverlapped=0x0) returned 1 [0117.348] WriteFile (in: hFile=0x1f8, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0xcdc0, lpNumberOfBytesWritten=0x30af8bc, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x30af8bc*=0xcdc0, lpOverlapped=0x0) returned 1 [0117.352] ReadFile (in: hFile=0x1ec, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30afaf4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x30afaf4*=0x0, lpOverlapped=0x0) returned 1 [0117.352] WriteFile (in: hFile=0x1f8, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x30af8bc, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x30af8bc*=0xec, lpOverlapped=0x0) returned 1 [0117.352] SetEndOfFile (hFile=0x1f8) returned 1 [0117.353] CloseHandle (hObject=0x1f8) returned 1 [0117.353] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30afae8 | out: lpNewFilePointer=0x0) returned 1 [0117.353] SetEndOfFile (hFile=0x1ec) returned 1 [0117.354] CloseHandle (hObject=0x1ec) returned 1 [0117.354] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0117.355] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\aceodbci.dll")) returned 1 [0117.357] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL") returned 73 [0117.357] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL") returned 73 [0117.357] lstrlenW (lpString=".doc") returned 4 [0117.357] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0117.357] lstrlenW (lpString=".docx") returned 5 [0117.357] lstrcmpiW (lpString1=".docx", lpString2="I.DLL") returned -1 [0117.357] lstrlenW (lpString=".pdf") returned 4 [0117.357] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0117.357] lstrlenW (lpString=".xls") returned 4 [0117.357] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0117.358] lstrlenW (lpString=".xlsx") returned 5 [0117.358] lstrcmpiW (lpString1=".xlsx", lpString2="I.DLL") returned -1 [0117.358] lstrlenW (lpString=".ppt") returned 4 [0117.358] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0117.358] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL") returned 73 [0117.358] lstrlenW (lpString=".zip") returned 4 [0117.358] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0117.358] lstrlenW (lpString=".rar") returned 4 [0117.358] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0117.358] lstrlenW (lpString=".bz2") returned 4 [0117.358] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0117.358] lstrlenW (lpString=".7z") returned 3 [0117.358] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0117.358] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL") returned 73 [0117.358] lstrlenW (lpString=".dbf") returned 4 [0117.358] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0117.358] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL") returned 73 [0117.358] lstrlenW (lpString=".1cd") returned 4 [0117.358] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0117.358] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL") returned 73 [0117.358] lstrlenW (lpString=".jpg") returned 4 [0117.358] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0117.358] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL") returned 73 [0117.358] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL") returned 73 [0117.358] lstrlenW (lpString=".doc") returned 4 [0117.358] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0117.358] lstrlenW (lpString=".docx") returned 5 [0117.358] lstrcmpiW (lpString1=".docx", lpString2="I.DLL") returned -1 [0117.358] lstrlenW (lpString=".pdf") returned 4 [0117.359] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0117.359] lstrlenW (lpString=".xls") returned 4 [0117.359] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0117.359] lstrlenW (lpString=".xlsx") returned 5 [0117.359] lstrcmpiW (lpString1=".xlsx", lpString2="I.DLL") returned -1 [0117.359] lstrlenW (lpString=".ppt") returned 4 [0117.359] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0117.359] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL") returned 73 [0117.359] lstrlenW (lpString=".zip") returned 4 [0117.359] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0117.359] lstrlenW (lpString=".rar") returned 4 [0117.359] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0117.359] lstrlenW (lpString=".bz2") returned 4 [0117.359] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0117.359] lstrlenW (lpString=".7z") returned 3 [0117.359] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0117.359] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL") returned 73 [0117.359] lstrlenW (lpString=".dbf") returned 4 [0117.359] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0117.359] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL") returned 73 [0117.359] lstrlenW (lpString=".1cd") returned 4 [0117.359] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0117.359] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL") returned 73 [0117.359] lstrlenW (lpString=".jpg") returned 4 [0117.359] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0117.359] lstrcmpiW (lpString1=".DLL", lpString2=".waifu") returned -1 [0117.360] lstrlenW (lpString="ALRTINTL.DLL") returned 12 [0117.360] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\alrtintl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0117.360] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x30afb3c | out: lpFileSize=0x30afb3c*=154448) returned 1 [0117.360] CloseHandle (hObject=0x1ec) returned 1 [0117.360] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\alrtintl.dll")) returned 0x20 [0117.360] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\alrtintl.dll.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0117.361] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\alrtintl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0117.361] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30afae8 | out: lpNewFilePointer=0x0) returned 1 [0117.361] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30afae8 | out: lpNewFilePointer=0x0) returned 1 [0117.361] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\alrtintl.dll.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0117.361] GetLastError () returned 0x0 [0117.361] ReadFile (in: hFile=0x1ec, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30afaf4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x30afaf4*=0x25b50, lpOverlapped=0x0) returned 1 [0117.406] WriteFile (in: hFile=0x1f8, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0x25b60, lpNumberOfBytesWritten=0x30af8bc, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x30af8bc*=0x25b60, lpOverlapped=0x0) returned 1 [0117.408] ReadFile (in: hFile=0x1ec, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30afaf4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x30afaf4*=0x0, lpOverlapped=0x0) returned 1 [0117.408] WriteFile (in: hFile=0x1f8, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x30af8bc, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x30af8bc*=0xec, lpOverlapped=0x0) returned 1 [0117.413] SetEndOfFile (hFile=0x1f8) returned 1 [0117.413] CloseHandle (hObject=0x1f8) returned 1 [0117.414] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30afae8 | out: lpNewFilePointer=0x0) returned 1 [0117.414] SetEndOfFile (hFile=0x1ec) returned 1 [0117.415] CloseHandle (hObject=0x1ec) returned 1 [0117.415] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0117.415] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\alrtintl.dll")) returned 1 [0117.415] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL") returned 73 [0117.415] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL") returned 73 [0117.415] lstrlenW (lpString=".doc") returned 4 [0117.415] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0117.415] lstrlenW (lpString=".docx") returned 5 [0117.415] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0117.415] lstrlenW (lpString=".pdf") returned 4 [0117.416] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0117.416] lstrlenW (lpString=".xls") returned 4 [0117.416] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0117.416] lstrlenW (lpString=".xlsx") returned 5 [0117.416] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0117.416] lstrlenW (lpString=".ppt") returned 4 [0117.416] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0117.416] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL") returned 73 [0117.416] lstrlenW (lpString=".zip") returned 4 [0117.416] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0117.416] lstrlenW (lpString=".rar") returned 4 [0117.416] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0117.416] lstrlenW (lpString=".bz2") returned 4 [0117.416] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0117.416] lstrlenW (lpString=".7z") returned 3 [0117.416] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0117.416] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL") returned 73 [0117.416] lstrlenW (lpString=".dbf") returned 4 [0117.416] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0117.416] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL") returned 73 [0117.416] lstrlenW (lpString=".1cd") returned 4 [0117.416] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0117.416] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL") returned 73 [0117.416] lstrlenW (lpString=".jpg") returned 4 [0117.416] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0117.416] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL") returned 73 [0117.416] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL") returned 73 [0117.416] lstrlenW (lpString=".doc") returned 4 [0117.416] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0117.416] lstrlenW (lpString=".docx") returned 5 [0117.416] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0117.416] lstrlenW (lpString=".pdf") returned 4 [0117.416] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0117.416] lstrlenW (lpString=".xls") returned 4 [0117.416] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0117.416] lstrlenW (lpString=".xlsx") returned 5 [0117.417] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0117.417] lstrlenW (lpString=".ppt") returned 4 [0117.417] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0117.417] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL") returned 73 [0117.417] lstrlenW (lpString=".zip") returned 4 [0117.417] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0117.417] lstrlenW (lpString=".rar") returned 4 [0117.417] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0117.417] lstrlenW (lpString=".bz2") returned 4 [0117.417] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0117.417] lstrlenW (lpString=".7z") returned 3 [0117.417] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0117.417] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL") returned 73 [0117.417] lstrlenW (lpString=".dbf") returned 4 [0117.417] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0117.417] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL") returned 73 [0117.417] lstrlenW (lpString=".1cd") returned 4 [0117.417] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0117.417] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL") returned 73 [0117.417] lstrlenW (lpString=".jpg") returned 4 [0117.417] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0117.417] lstrcmpiW (lpString1=".IDX_DLL", lpString2=".waifu") returned -1 [0117.417] lstrlenW (lpString="MSOINTL.REST.IDX_DLL") returned 20 [0117.417] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.rest.idx_dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0117.418] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x30afb3c | out: lpFileSize=0x30afb3c*=1388416) returned 1 [0117.418] CloseHandle (hObject=0x1ec) returned 1 [0117.418] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.rest.idx_dll")) returned 0x20 [0117.418] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.rest.idx_dll.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0117.418] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.rest.idx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0117.418] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30afae8 | out: lpNewFilePointer=0x0) returned 1 [0117.418] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30afae8 | out: lpNewFilePointer=0x0) returned 1 [0117.419] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.rest.idx_dll.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0117.419] GetLastError () returned 0x0 [0117.419] ReadFile (in: hFile=0x1ec, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30afaf4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x30afaf4*=0xffff0, lpOverlapped=0x0) returned 1 [0117.492] WriteFile (in: hFile=0x1f8, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x30af8bc, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x30af8bc*=0xffff0, lpOverlapped=0x0) returned 1 [0117.507] ReadFile (in: hFile=0x1ec, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30afaf4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x30afaf4*=0x52f90, lpOverlapped=0x0) returned 1 [0117.512] WriteFile (in: hFile=0x1f8, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0x52fa0, lpNumberOfBytesWritten=0x30af8bc, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x30af8bc*=0x52fa0, lpOverlapped=0x0) returned 1 [0117.516] ReadFile (in: hFile=0x1ec, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30afaf4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x30afaf4*=0x0, lpOverlapped=0x0) returned 1 [0117.516] WriteFile (in: hFile=0x1f8, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x30af8bc, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x30af8bc*=0xfc, lpOverlapped=0x0) returned 1 [0117.517] SetEndOfFile (hFile=0x1f8) returned 1 [0117.517] CloseHandle (hObject=0x1f8) returned 1 [0117.517] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30afae8 | out: lpNewFilePointer=0x0) returned 1 [0117.517] SetEndOfFile (hFile=0x1ec) returned 1 [0117.947] CloseHandle (hObject=0x1ec) returned 1 [0117.947] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0117.948] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.rest.idx_dll")) returned 1 [0117.948] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL") returned 81 [0117.948] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL") returned 81 [0117.948] lstrlenW (lpString=".doc") returned 4 [0117.948] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0117.948] lstrlenW (lpString=".docx") returned 5 [0117.948] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0117.948] lstrlenW (lpString=".pdf") returned 4 [0117.948] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0117.948] lstrlenW (lpString=".xls") returned 4 [0117.948] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0117.948] lstrlenW (lpString=".xlsx") returned 5 [0117.948] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0117.948] lstrlenW (lpString=".ppt") returned 4 [0117.948] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0117.948] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL") returned 81 [0117.948] lstrlenW (lpString=".zip") returned 4 [0117.948] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0117.948] lstrlenW (lpString=".rar") returned 4 [0117.948] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0117.948] lstrlenW (lpString=".bz2") returned 4 [0117.948] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0117.948] lstrlenW (lpString=".7z") returned 3 [0117.948] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0117.948] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL") returned 81 [0117.948] lstrlenW (lpString=".dbf") returned 4 [0117.948] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0117.948] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL") returned 81 [0117.948] lstrlenW (lpString=".1cd") returned 4 [0117.948] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0117.948] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL") returned 81 [0117.948] lstrlenW (lpString=".jpg") returned 4 [0117.948] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0117.949] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL") returned 81 [0117.949] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL") returned 81 [0117.949] lstrlenW (lpString=".doc") returned 4 [0117.949] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0117.949] lstrlenW (lpString=".docx") returned 5 [0117.949] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0117.949] lstrlenW (lpString=".pdf") returned 4 [0117.949] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0117.949] lstrlenW (lpString=".xls") returned 4 [0117.949] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0117.949] lstrlenW (lpString=".xlsx") returned 5 [0117.949] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0117.949] lstrlenW (lpString=".ppt") returned 4 [0117.949] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0117.949] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL") returned 81 [0117.949] lstrlenW (lpString=".zip") returned 4 [0117.949] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0117.949] lstrlenW (lpString=".rar") returned 4 [0117.949] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0117.949] lstrlenW (lpString=".bz2") returned 4 [0117.949] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0117.949] lstrlenW (lpString=".7z") returned 3 [0117.949] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0117.949] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL") returned 81 [0117.949] lstrlenW (lpString=".dbf") returned 4 [0117.949] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0117.949] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL") returned 81 [0117.949] lstrlenW (lpString=".1cd") returned 4 [0117.949] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0117.949] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL") returned 81 [0117.949] lstrlenW (lpString=".jpg") returned 4 [0117.949] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0117.949] lstrcmpiW (lpString1=".DLL", lpString2=".waifu") returned -1 [0117.949] lstrlenW (lpString="ACEDAO.DLL") returned 10 [0117.949] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acedao.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0117.950] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x30afb3c | out: lpFileSize=0x30afb3c*=744888) returned 1 [0117.950] CloseHandle (hObject=0x1ec) returned 1 [0117.950] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acedao.dll")) returned 0x20 [0117.950] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acedao.dll.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0117.950] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acedao.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0117.950] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30afae8 | out: lpNewFilePointer=0x0) returned 1 [0117.950] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30afae8 | out: lpNewFilePointer=0x0) returned 1 [0117.950] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acedao.dll.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0117.950] GetLastError () returned 0x0 [0117.950] ReadFile (in: hFile=0x1ec, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30afaf4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x30afaf4*=0xb5db8, lpOverlapped=0x0) returned 1 [0118.077] WriteFile (in: hFile=0x20c, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0xb5dc0, lpNumberOfBytesWritten=0x30af8bc, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x30af8bc*=0xb5dc0, lpOverlapped=0x0) returned 1 [0118.085] ReadFile (in: hFile=0x1ec, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30afaf4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x30afaf4*=0x0, lpOverlapped=0x0) returned 1 [0118.085] WriteFile (in: hFile=0x20c, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x30af8bc, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x30af8bc*=0xe8, lpOverlapped=0x0) returned 1 [0118.085] SetEndOfFile (hFile=0x20c) returned 1 [0118.085] CloseHandle (hObject=0x20c) returned 1 [0118.085] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30afae8 | out: lpNewFilePointer=0x0) returned 1 [0118.085] SetEndOfFile (hFile=0x1ec) returned 1 [0118.088] CloseHandle (hObject=0x1ec) returned 1 [0118.088] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0118.088] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acedao.dll")) returned 1 [0118.089] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL") returned 66 [0118.089] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL") returned 66 [0118.089] lstrlenW (lpString=".doc") returned 4 [0118.089] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0118.089] lstrlenW (lpString=".docx") returned 5 [0118.089] lstrcmpiW (lpString1=".docx", lpString2="O.DLL") returned -1 [0118.089] lstrlenW (lpString=".pdf") returned 4 [0118.089] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0118.089] lstrlenW (lpString=".xls") returned 4 [0118.089] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0118.089] lstrlenW (lpString=".xlsx") returned 5 [0118.089] lstrcmpiW (lpString1=".xlsx", lpString2="O.DLL") returned -1 [0118.089] lstrlenW (lpString=".ppt") returned 4 [0118.089] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0118.089] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL") returned 66 [0118.089] lstrlenW (lpString=".zip") returned 4 [0118.089] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0118.089] lstrlenW (lpString=".rar") returned 4 [0118.089] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0118.089] lstrlenW (lpString=".bz2") returned 4 [0118.089] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0118.089] lstrlenW (lpString=".7z") returned 3 [0118.089] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0118.089] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL") returned 66 [0118.098] lstrlenW (lpString=".dbf") returned 4 [0118.193] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0118.193] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL") returned 66 [0118.193] lstrlenW (lpString=".1cd") returned 4 [0118.193] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0118.193] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL") returned 66 [0118.193] lstrlenW (lpString=".jpg") returned 4 [0118.193] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0118.193] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL") returned 66 [0118.193] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL") returned 66 [0118.193] lstrlenW (lpString=".doc") returned 4 [0118.193] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0118.193] lstrlenW (lpString=".docx") returned 5 [0118.193] lstrcmpiW (lpString1=".docx", lpString2="O.DLL") returned -1 [0118.193] lstrlenW (lpString=".pdf") returned 4 [0118.193] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0118.193] lstrlenW (lpString=".xls") returned 4 [0118.193] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0118.193] lstrlenW (lpString=".xlsx") returned 5 [0118.193] lstrcmpiW (lpString1=".xlsx", lpString2="O.DLL") returned -1 [0118.193] lstrlenW (lpString=".ppt") returned 4 [0118.193] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0118.193] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL") returned 66 [0118.193] lstrlenW (lpString=".zip") returned 4 [0118.193] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0118.193] lstrlenW (lpString=".rar") returned 4 [0118.193] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0118.193] lstrlenW (lpString=".bz2") returned 4 [0118.193] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0118.193] lstrlenW (lpString=".7z") returned 3 [0118.193] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0118.193] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL") returned 66 [0118.193] lstrlenW (lpString=".dbf") returned 4 [0118.193] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0118.193] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL") returned 66 [0118.193] lstrlenW (lpString=".1cd") returned 4 [0118.193] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0118.193] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL") returned 66 [0118.193] lstrlenW (lpString=".jpg") returned 4 [0118.193] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0118.194] lstrcmpiW (lpString1=".DLL", lpString2=".waifu") returned -1 [0118.194] lstrlenW (lpString="ACEES.DLL") returned 9 [0118.194] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acees.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0118.494] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x30afb3c | out: lpFileSize=0x30afb3c*=1012648) returned 1 [0118.494] CloseHandle (hObject=0x1c0) returned 1 [0118.495] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acees.dll")) returned 0x20 [0118.496] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acees.dll.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0118.496] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acees.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0118.496] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30afae8 | out: lpNewFilePointer=0x0) returned 1 [0118.496] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30afae8 | out: lpNewFilePointer=0x0) returned 1 [0118.496] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acees.dll.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0118.497] GetLastError () returned 0x0 [0118.497] ReadFile (in: hFile=0x1c0, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30afaf4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x30afaf4*=0xf73a8, lpOverlapped=0x0) returned 1 [0118.705] WriteFile (in: hFile=0x1b0, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0xf73b0, lpNumberOfBytesWritten=0x30af8bc, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x30af8bc*=0xf73b0, lpOverlapped=0x0) returned 1 [0118.878] ReadFile (in: hFile=0x1c0, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30afaf4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x30afaf4*=0x0, lpOverlapped=0x0) returned 1 [0118.878] WriteFile (in: hFile=0x1b0, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x30af8bc, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x30af8bc*=0xe6, lpOverlapped=0x0) returned 1 [0118.878] SetEndOfFile (hFile=0x1b0) returned 1 [0118.878] CloseHandle (hObject=0x1b0) returned 1 [0118.878] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30afae8 | out: lpNewFilePointer=0x0) returned 1 [0118.878] SetEndOfFile (hFile=0x1c0) returned 1 [0118.881] CloseHandle (hObject=0x1c0) returned 1 [0118.881] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0118.881] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acees.dll")) returned 1 [0118.881] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL") returned 65 [0118.881] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL") returned 65 [0118.881] lstrlenW (lpString=".doc") returned 4 [0118.881] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0118.881] lstrlenW (lpString=".docx") returned 5 [0118.881] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0118.881] lstrlenW (lpString=".pdf") returned 4 [0118.881] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0118.881] lstrlenW (lpString=".xls") returned 4 [0118.881] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0118.881] lstrlenW (lpString=".xlsx") returned 5 [0118.881] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0118.881] lstrlenW (lpString=".ppt") returned 4 [0118.881] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0118.882] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL") returned 65 [0118.882] lstrlenW (lpString=".zip") returned 4 [0118.882] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0118.882] lstrlenW (lpString=".rar") returned 4 [0118.882] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0118.882] lstrlenW (lpString=".bz2") returned 4 [0118.882] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0118.882] lstrlenW (lpString=".7z") returned 3 [0118.882] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0118.882] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL") returned 65 [0118.882] lstrlenW (lpString=".dbf") returned 4 [0118.882] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0118.882] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL") returned 65 [0118.882] lstrlenW (lpString=".1cd") returned 4 [0118.882] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0118.882] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL") returned 65 [0118.882] lstrlenW (lpString=".jpg") returned 4 [0118.882] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0118.882] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL") returned 65 [0118.882] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL") returned 65 [0118.882] lstrlenW (lpString=".doc") returned 4 [0118.882] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0118.882] lstrlenW (lpString=".docx") returned 5 [0118.882] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0118.882] lstrlenW (lpString=".pdf") returned 4 [0118.882] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0118.882] lstrlenW (lpString=".xls") returned 4 [0118.882] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0118.882] lstrlenW (lpString=".xlsx") returned 5 [0118.882] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0118.882] lstrlenW (lpString=".ppt") returned 4 [0118.882] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0118.882] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL") returned 65 [0118.882] lstrlenW (lpString=".zip") returned 4 [0118.882] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0118.882] lstrlenW (lpString=".rar") returned 4 [0118.882] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0118.882] lstrlenW (lpString=".bz2") returned 4 [0118.882] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0118.882] lstrlenW (lpString=".7z") returned 3 [0118.882] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0118.882] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL") returned 65 [0118.882] lstrlenW (lpString=".dbf") returned 4 [0118.882] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0118.882] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL") returned 65 [0118.882] lstrlenW (lpString=".1cd") returned 4 [0118.882] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0118.882] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL") returned 65 [0118.883] lstrlenW (lpString=".jpg") returned 4 [0118.883] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0118.883] lstrcmpiW (lpString1=".DLL", lpString2=".waifu") returned -1 [0118.883] lstrlenW (lpString="ACEEXCH.DLL") returned 11 [0118.883] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceexch.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0118.883] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x30afb3c | out: lpFileSize=0x30afb3c*=442272) returned 1 [0118.883] CloseHandle (hObject=0x1c0) returned 1 [0118.883] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceexch.dll")) returned 0x20 [0118.883] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceexch.dll.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0118.883] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceexch.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0118.884] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30afae8 | out: lpNewFilePointer=0x0) returned 1 [0118.884] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30afae8 | out: lpNewFilePointer=0x0) returned 1 [0118.884] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceexch.dll.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0118.884] GetLastError () returned 0x0 [0118.884] ReadFile (in: hFile=0x1c0, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30afaf4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x30afaf4*=0x6bfa0, lpOverlapped=0x0) returned 1 [0118.923] WriteFile (in: hFile=0x1b0, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0x6bfb0, lpNumberOfBytesWritten=0x30af8bc, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x30af8bc*=0x6bfb0, lpOverlapped=0x0) returned 1 [0118.927] ReadFile (in: hFile=0x1c0, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30afaf4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x30afaf4*=0x0, lpOverlapped=0x0) returned 1 [0118.927] WriteFile (in: hFile=0x1b0, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x30af8bc, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x30af8bc*=0xea, lpOverlapped=0x0) returned 1 [0118.927] SetEndOfFile (hFile=0x1b0) returned 1 [0118.928] CloseHandle (hObject=0x1b0) returned 1 [0118.928] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30afae8 | out: lpNewFilePointer=0x0) returned 1 [0118.928] SetEndOfFile (hFile=0x1c0) returned 1 [0118.929] CloseHandle (hObject=0x1c0) returned 1 [0118.929] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0118.929] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceexch.dll")) returned 1 [0118.930] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL") returned 67 [0118.930] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL") returned 67 [0118.930] lstrlenW (lpString=".doc") returned 4 [0118.930] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0118.930] lstrlenW (lpString=".docx") returned 5 [0118.930] lstrcmpiW (lpString1=".docx", lpString2="H.DLL") returned -1 [0118.930] lstrlenW (lpString=".pdf") returned 4 [0118.930] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0118.930] lstrlenW (lpString=".xls") returned 4 [0118.930] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0118.930] lstrlenW (lpString=".xlsx") returned 5 [0118.930] lstrcmpiW (lpString1=".xlsx", lpString2="H.DLL") returned -1 [0118.930] lstrlenW (lpString=".ppt") returned 4 [0118.930] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0118.930] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL") returned 67 [0118.930] lstrlenW (lpString=".zip") returned 4 [0118.930] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0118.930] lstrlenW (lpString=".rar") returned 4 [0118.930] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0118.930] lstrlenW (lpString=".bz2") returned 4 [0118.930] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0118.930] lstrlenW (lpString=".7z") returned 3 [0118.930] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0118.930] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL") returned 67 [0118.930] lstrlenW (lpString=".dbf") returned 4 [0118.930] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0118.930] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL") returned 67 [0118.930] lstrlenW (lpString=".1cd") returned 4 [0118.930] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0118.930] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL") returned 67 [0118.930] lstrlenW (lpString=".jpg") returned 4 [0118.930] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0118.930] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL") returned 67 [0118.930] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL") returned 67 [0118.930] lstrlenW (lpString=".doc") returned 4 [0118.930] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0118.930] lstrlenW (lpString=".docx") returned 5 [0118.930] lstrcmpiW (lpString1=".docx", lpString2="H.DLL") returned -1 [0118.930] lstrlenW (lpString=".pdf") returned 4 [0118.930] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0118.930] lstrlenW (lpString=".xls") returned 4 [0118.930] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0118.930] lstrlenW (lpString=".xlsx") returned 5 [0118.930] lstrcmpiW (lpString1=".xlsx", lpString2="H.DLL") returned -1 [0118.930] lstrlenW (lpString=".ppt") returned 4 [0118.930] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0118.930] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL") returned 67 [0118.930] lstrlenW (lpString=".zip") returned 4 [0118.931] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0118.931] lstrlenW (lpString=".rar") returned 4 [0118.931] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0118.931] lstrlenW (lpString=".bz2") returned 4 [0118.931] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0118.931] lstrlenW (lpString=".7z") returned 3 [0118.931] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0118.931] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL") returned 67 [0118.931] lstrlenW (lpString=".dbf") returned 4 [0118.931] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0118.931] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL") returned 67 [0118.931] lstrlenW (lpString=".1cd") returned 4 [0118.931] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0118.931] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL") returned 67 [0118.931] lstrlenW (lpString=".jpg") returned 4 [0118.931] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0118.931] lstrcmpiW (lpString1=".DLL", lpString2=".waifu") returned -1 [0118.931] lstrlenW (lpString="ACEODBC.DLL") returned 11 [0118.931] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodbc.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0118.931] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x30afb3c | out: lpFileSize=0x30afb3c*=342960) returned 1 [0118.932] CloseHandle (hObject=0x1c0) returned 1 [0118.932] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodbc.dll")) returned 0x20 [0118.932] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodbc.dll.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0118.932] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodbc.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0118.932] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30afae8 | out: lpNewFilePointer=0x0) returned 1 [0118.932] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30afae8 | out: lpNewFilePointer=0x0) returned 1 [0118.932] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodbc.dll.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0118.932] GetLastError () returned 0x0 [0118.932] ReadFile (in: hFile=0x1c0, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30afaf4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x30afaf4*=0x53bb0, lpOverlapped=0x0) returned 1 [0119.145] WriteFile (in: hFile=0x1b0, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0x53bc0, lpNumberOfBytesWritten=0x30af8bc, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x30af8bc*=0x53bc0, lpOverlapped=0x0) returned 1 [0119.148] ReadFile (in: hFile=0x1c0, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30afaf4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x30afaf4*=0x0, lpOverlapped=0x0) returned 1 [0119.148] WriteFile (in: hFile=0x1b0, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x30af8bc, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x30af8bc*=0xea, lpOverlapped=0x0) returned 1 [0119.148] SetEndOfFile (hFile=0x1b0) returned 1 [0119.166] CloseHandle (hObject=0x1b0) returned 1 [0119.166] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30afae8 | out: lpNewFilePointer=0x0) returned 1 [0119.166] SetEndOfFile (hFile=0x1c0) returned 1 [0119.168] CloseHandle (hObject=0x1c0) returned 1 [0119.168] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0119.168] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodbc.dll")) returned 1 [0119.207] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL") returned 67 [0119.207] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL") returned 67 [0119.207] lstrlenW (lpString=".doc") returned 4 [0119.207] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0119.207] lstrlenW (lpString=".docx") returned 5 [0119.207] lstrcmpiW (lpString1=".docx", lpString2="C.DLL") returned -1 [0119.207] lstrlenW (lpString=".pdf") returned 4 [0119.207] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0119.207] lstrlenW (lpString=".xls") returned 4 [0119.207] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0119.207] lstrlenW (lpString=".xlsx") returned 5 [0119.207] lstrcmpiW (lpString1=".xlsx", lpString2="C.DLL") returned -1 [0119.207] lstrlenW (lpString=".ppt") returned 4 [0119.207] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0119.207] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL") returned 67 [0119.207] lstrlenW (lpString=".zip") returned 4 [0119.207] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0119.207] lstrlenW (lpString=".rar") returned 4 [0119.207] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0119.207] lstrlenW (lpString=".bz2") returned 4 [0119.207] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0119.207] lstrlenW (lpString=".7z") returned 3 [0119.207] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0119.207] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL") returned 67 [0119.207] lstrlenW (lpString=".dbf") returned 4 [0119.207] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0119.207] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL") returned 67 [0119.207] lstrlenW (lpString=".1cd") returned 4 [0119.207] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0119.207] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL") returned 67 [0119.207] lstrlenW (lpString=".jpg") returned 4 [0119.207] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0119.207] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL") returned 67 [0119.207] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL") returned 67 [0119.207] lstrlenW (lpString=".doc") returned 4 [0119.207] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0119.208] lstrlenW (lpString=".docx") returned 5 [0119.208] lstrcmpiW (lpString1=".docx", lpString2="C.DLL") returned -1 [0119.208] lstrlenW (lpString=".pdf") returned 4 [0119.208] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0119.208] lstrlenW (lpString=".xls") returned 4 [0119.208] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0119.208] lstrlenW (lpString=".xlsx") returned 5 [0119.208] lstrcmpiW (lpString1=".xlsx", lpString2="C.DLL") returned -1 [0119.208] lstrlenW (lpString=".ppt") returned 4 [0119.208] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0119.208] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL") returned 67 [0119.208] lstrlenW (lpString=".zip") returned 4 [0119.208] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0119.208] lstrlenW (lpString=".rar") returned 4 [0119.208] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0119.208] lstrlenW (lpString=".bz2") returned 4 [0119.208] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0119.208] lstrlenW (lpString=".7z") returned 3 [0119.208] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0119.208] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL") returned 67 [0119.208] lstrlenW (lpString=".dbf") returned 4 [0119.208] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0119.208] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL") returned 67 [0119.208] lstrlenW (lpString=".1cd") returned 4 [0119.208] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0119.208] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL") returned 67 [0119.208] lstrlenW (lpString=".jpg") returned 4 [0119.208] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0119.208] lstrcmpiW (lpString1=".DLL", lpString2=".waifu") returned -1 [0119.208] lstrlenW (lpString="ACER3X.DLL") returned 10 [0119.208] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACER3X.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acer3x.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0119.212] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x30afb3c | out: lpFileSize=0x30afb3c*=451480) returned 1 [0119.212] CloseHandle (hObject=0x20c) returned 1 [0119.212] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACER3X.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acer3x.dll")) returned 0x20 [0119.212] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACER3X.DLL.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acer3x.dll.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0119.212] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACER3X.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acer3x.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0119.212] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30afae8 | out: lpNewFilePointer=0x0) returned 1 [0119.212] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30afae8 | out: lpNewFilePointer=0x0) returned 1 [0119.212] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACER3X.DLL.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acer3x.dll.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0119.274] GetLastError () returned 0x0 [0119.274] ReadFile (in: hFile=0x20c, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30afaf4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x30afaf4*=0x6e398, lpOverlapped=0x0) returned 1 [0119.326] WriteFile (in: hFile=0x1f8, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0x6e3a0, lpNumberOfBytesWritten=0x30af8bc, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x30af8bc*=0x6e3a0, lpOverlapped=0x0) returned 1 [0119.330] ReadFile (in: hFile=0x20c, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30afaf4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x30afaf4*=0x0, lpOverlapped=0x0) returned 1 [0119.331] WriteFile (in: hFile=0x1f8, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x30af8bc, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x30af8bc*=0xe8, lpOverlapped=0x0) returned 1 [0119.331] SetEndOfFile (hFile=0x1f8) returned 1 [0119.331] CloseHandle (hObject=0x1f8) returned 1 [0119.331] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30afae8 | out: lpNewFilePointer=0x0) returned 1 [0119.331] SetEndOfFile (hFile=0x20c) returned 1 [0119.333] CloseHandle (hObject=0x20c) returned 1 [0119.333] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACER3X.DLL.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0119.333] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACER3X.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acer3x.dll")) returned 1 [0119.336] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACER3X.DLL") returned 66 [0119.336] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACER3X.DLL") returned 66 [0119.336] lstrlenW (lpString=".doc") returned 4 [0119.336] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0119.336] lstrlenW (lpString=".docx") returned 5 [0119.336] lstrcmpiW (lpString1=".docx", lpString2="X.DLL") returned -1 [0119.336] lstrlenW (lpString=".pdf") returned 4 [0119.336] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0119.336] lstrlenW (lpString=".xls") returned 4 [0119.336] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0119.336] lstrlenW (lpString=".xlsx") returned 5 [0119.336] lstrcmpiW (lpString1=".xlsx", lpString2="X.DLL") returned -1 [0119.336] lstrlenW (lpString=".ppt") returned 4 [0119.336] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0119.336] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACER3X.DLL") returned 66 [0119.336] lstrlenW (lpString=".zip") returned 4 [0119.336] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0119.336] lstrlenW (lpString=".rar") returned 4 [0119.336] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0119.336] lstrlenW (lpString=".bz2") returned 4 [0119.336] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0119.336] lstrlenW (lpString=".7z") returned 3 [0119.336] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0119.336] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACER3X.DLL") returned 66 [0119.336] lstrlenW (lpString=".dbf") returned 4 [0119.336] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0119.336] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACER3X.DLL") returned 66 [0119.336] lstrlenW (lpString=".1cd") returned 4 [0119.336] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0119.336] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACER3X.DLL") returned 66 [0119.336] lstrlenW (lpString=".jpg") returned 4 [0119.336] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0119.336] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACER3X.DLL") returned 66 [0119.336] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACER3X.DLL") returned 66 [0119.336] lstrlenW (lpString=".doc") returned 4 [0119.336] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0119.336] lstrlenW (lpString=".docx") returned 5 [0119.336] lstrcmpiW (lpString1=".docx", lpString2="X.DLL") returned -1 [0119.336] lstrlenW (lpString=".pdf") returned 4 [0119.336] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0119.336] lstrlenW (lpString=".xls") returned 4 [0119.336] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0119.336] lstrlenW (lpString=".xlsx") returned 5 [0119.336] lstrcmpiW (lpString1=".xlsx", lpString2="X.DLL") returned -1 [0119.336] lstrlenW (lpString=".ppt") returned 4 [0119.336] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0119.337] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACER3X.DLL") returned 66 [0119.337] lstrlenW (lpString=".zip") returned 4 [0119.337] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0119.337] lstrlenW (lpString=".rar") returned 4 [0119.337] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0119.337] lstrlenW (lpString=".bz2") returned 4 [0119.337] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0119.337] lstrlenW (lpString=".7z") returned 3 [0119.337] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0119.337] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACER3X.DLL") returned 66 [0119.337] lstrlenW (lpString=".dbf") returned 4 [0119.337] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0119.337] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACER3X.DLL") returned 66 [0119.337] lstrlenW (lpString=".1cd") returned 4 [0119.337] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0119.337] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACER3X.DLL") returned 66 [0119.337] lstrlenW (lpString=".jpg") returned 4 [0119.337] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0119.337] lstrcmpiW (lpString1=".DLL", lpString2=".waifu") returned -1 [0119.337] lstrlenW (lpString="ACETXT.DLL") returned 10 [0119.337] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACETXT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acetxt.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0119.337] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x30afb3c | out: lpFileSize=0x30afb3c*=297360) returned 1 [0119.337] CloseHandle (hObject=0x20c) returned 1 [0119.338] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACETXT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acetxt.dll")) returned 0x20 [0119.338] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACETXT.DLL.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acetxt.dll.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0119.338] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACETXT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acetxt.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0119.338] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30afae8 | out: lpNewFilePointer=0x0) returned 1 [0119.338] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30afae8 | out: lpNewFilePointer=0x0) returned 1 [0119.338] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACETXT.DLL.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acetxt.dll.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0119.339] GetLastError () returned 0x0 [0119.339] ReadFile (in: hFile=0x20c, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30afaf4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x30afaf4*=0x48990, lpOverlapped=0x0) returned 1 [0119.445] WriteFile (in: hFile=0x1f8, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0x489a0, lpNumberOfBytesWritten=0x30af8bc, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x30af8bc*=0x489a0, lpOverlapped=0x0) returned 1 [0119.448] ReadFile (in: hFile=0x20c, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30afaf4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x30afaf4*=0x0, lpOverlapped=0x0) returned 1 [0119.448] WriteFile (in: hFile=0x1f8, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x30af8bc, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x30af8bc*=0xe8, lpOverlapped=0x0) returned 1 [0119.448] SetEndOfFile (hFile=0x1f8) returned 1 [0119.448] CloseHandle (hObject=0x1f8) returned 1 [0119.449] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30afae8 | out: lpNewFilePointer=0x0) returned 1 [0119.449] SetEndOfFile (hFile=0x20c) returned 1 [0119.450] CloseHandle (hObject=0x20c) returned 1 [0119.450] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACETXT.DLL.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0119.450] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACETXT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acetxt.dll")) returned 1 [0119.450] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACETXT.DLL") returned 66 [0119.450] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACETXT.DLL") returned 66 [0119.450] lstrlenW (lpString=".doc") returned 4 [0119.450] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0119.450] lstrlenW (lpString=".docx") returned 5 [0119.450] lstrcmpiW (lpString1=".docx", lpString2="T.DLL") returned -1 [0119.450] lstrlenW (lpString=".pdf") returned 4 [0119.450] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0119.450] lstrlenW (lpString=".xls") returned 4 [0119.450] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0119.450] lstrlenW (lpString=".xlsx") returned 5 [0119.450] lstrcmpiW (lpString1=".xlsx", lpString2="T.DLL") returned -1 [0119.450] lstrlenW (lpString=".ppt") returned 4 [0119.450] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0119.450] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACETXT.DLL") returned 66 [0119.450] lstrlenW (lpString=".zip") returned 4 [0119.450] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0119.450] lstrlenW (lpString=".rar") returned 4 [0119.451] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0119.451] lstrlenW (lpString=".bz2") returned 4 [0119.451] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0119.451] lstrlenW (lpString=".7z") returned 3 [0119.451] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0119.451] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACETXT.DLL") returned 66 [0119.451] lstrlenW (lpString=".dbf") returned 4 [0119.451] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0119.451] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACETXT.DLL") returned 66 [0119.451] lstrlenW (lpString=".1cd") returned 4 [0119.451] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0119.451] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACETXT.DLL") returned 66 [0119.451] lstrlenW (lpString=".jpg") returned 4 [0119.451] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0119.451] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACETXT.DLL") returned 66 [0119.451] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACETXT.DLL") returned 66 [0119.451] lstrlenW (lpString=".doc") returned 4 [0119.451] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0119.451] lstrlenW (lpString=".docx") returned 5 [0119.451] lstrcmpiW (lpString1=".docx", lpString2="T.DLL") returned -1 [0119.451] lstrlenW (lpString=".pdf") returned 4 [0119.451] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0119.451] lstrlenW (lpString=".xls") returned 4 [0119.451] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0119.451] lstrlenW (lpString=".xlsx") returned 5 [0119.451] lstrcmpiW (lpString1=".xlsx", lpString2="T.DLL") returned -1 [0119.451] lstrlenW (lpString=".ppt") returned 4 [0119.451] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0119.451] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACETXT.DLL") returned 66 [0119.451] lstrlenW (lpString=".zip") returned 4 [0119.451] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0119.451] lstrlenW (lpString=".rar") returned 4 [0119.451] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0119.451] lstrlenW (lpString=".bz2") returned 4 [0119.451] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0119.451] lstrlenW (lpString=".7z") returned 3 [0119.451] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0119.451] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACETXT.DLL") returned 66 [0119.451] lstrlenW (lpString=".dbf") returned 4 [0119.451] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0119.451] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACETXT.DLL") returned 66 [0119.451] lstrlenW (lpString=".1cd") returned 4 [0119.451] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0119.451] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACETXT.DLL") returned 66 [0119.451] lstrlenW (lpString=".jpg") returned 4 [0119.451] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0119.452] lstrcmpiW (lpString1=".DLL", lpString2=".waifu") returned -1 [0119.452] lstrlenW (lpString="ATLCONV.DLL") returned 11 [0119.452] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ATLCONV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\atlconv.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0119.453] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x30afb3c | out: lpFileSize=0x30afb3c*=385368) returned 1 [0119.453] CloseHandle (hObject=0x20c) returned 1 [0119.453] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ATLCONV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\atlconv.dll")) returned 0x20 [0119.453] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ATLCONV.DLL.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\atlconv.dll.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0119.453] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ATLCONV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\atlconv.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0119.453] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30afae8 | out: lpNewFilePointer=0x0) returned 1 [0119.453] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30afae8 | out: lpNewFilePointer=0x0) returned 1 [0119.453] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ATLCONV.DLL.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\atlconv.dll.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0119.453] GetLastError () returned 0x0 [0119.453] ReadFile (in: hFile=0x20c, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30afaf4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x30afaf4*=0x5e158, lpOverlapped=0x0) returned 1 [0119.541] WriteFile (in: hFile=0x1f8, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0x5e160, lpNumberOfBytesWritten=0x30af8bc, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x30af8bc*=0x5e160, lpOverlapped=0x0) returned 1 [0119.544] ReadFile (in: hFile=0x20c, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30afaf4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x30afaf4*=0x0, lpOverlapped=0x0) returned 1 [0119.544] WriteFile (in: hFile=0x1f8, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x30af8bc, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x30af8bc*=0xea, lpOverlapped=0x0) returned 1 [0119.544] SetEndOfFile (hFile=0x1f8) returned 1 [0119.544] CloseHandle (hObject=0x1f8) returned 1 [0119.544] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30afae8 | out: lpNewFilePointer=0x0) returned 1 [0119.544] SetEndOfFile (hFile=0x20c) returned 1 [0119.547] CloseHandle (hObject=0x20c) returned 1 [0119.547] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ATLCONV.DLL.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0119.548] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ATLCONV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\atlconv.dll")) returned 1 [0119.548] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ATLCONV.DLL") returned 67 [0119.548] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ATLCONV.DLL") returned 67 [0119.548] lstrlenW (lpString=".doc") returned 4 [0119.548] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0119.548] lstrlenW (lpString=".docx") returned 5 [0119.548] lstrcmpiW (lpString1=".docx", lpString2="V.DLL") returned -1 [0119.548] lstrlenW (lpString=".pdf") returned 4 [0119.548] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0119.548] lstrlenW (lpString=".xls") returned 4 [0119.548] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0119.548] lstrlenW (lpString=".xlsx") returned 5 [0119.548] lstrcmpiW (lpString1=".xlsx", lpString2="V.DLL") returned -1 [0119.548] lstrlenW (lpString=".ppt") returned 4 [0119.549] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0119.549] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ATLCONV.DLL") returned 67 [0119.549] lstrlenW (lpString=".zip") returned 4 [0119.549] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0119.549] lstrlenW (lpString=".rar") returned 4 [0119.549] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0119.549] lstrlenW (lpString=".bz2") returned 4 [0119.549] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0119.549] lstrlenW (lpString=".7z") returned 3 [0119.549] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0119.549] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ATLCONV.DLL") returned 67 [0119.549] lstrlenW (lpString=".dbf") returned 4 [0119.549] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0119.549] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ATLCONV.DLL") returned 67 [0119.549] lstrlenW (lpString=".1cd") returned 4 [0119.549] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0119.549] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ATLCONV.DLL") returned 67 [0119.549] lstrlenW (lpString=".jpg") returned 4 [0119.549] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0119.549] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ATLCONV.DLL") returned 67 [0119.549] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ATLCONV.DLL") returned 67 [0119.549] lstrlenW (lpString=".doc") returned 4 [0119.549] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0119.549] lstrlenW (lpString=".docx") returned 5 [0119.549] lstrcmpiW (lpString1=".docx", lpString2="V.DLL") returned -1 [0119.549] lstrlenW (lpString=".pdf") returned 4 [0119.549] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0119.549] lstrlenW (lpString=".xls") returned 4 [0119.549] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0119.549] lstrlenW (lpString=".xlsx") returned 5 [0119.549] lstrcmpiW (lpString1=".xlsx", lpString2="V.DLL") returned -1 [0119.549] lstrlenW (lpString=".ppt") returned 4 [0119.549] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0119.549] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ATLCONV.DLL") returned 67 [0119.549] lstrlenW (lpString=".zip") returned 4 [0119.549] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0119.549] lstrlenW (lpString=".rar") returned 4 [0119.549] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0119.549] lstrlenW (lpString=".bz2") returned 4 [0119.549] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0119.549] lstrlenW (lpString=".7z") returned 3 [0119.549] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0119.549] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ATLCONV.DLL") returned 67 [0119.549] lstrlenW (lpString=".dbf") returned 4 [0119.549] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0119.549] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ATLCONV.DLL") returned 67 [0119.549] lstrlenW (lpString=".1cd") returned 4 [0119.549] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0119.549] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ATLCONV.DLL") returned 67 [0119.549] lstrlenW (lpString=".jpg") returned 4 [0119.550] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0119.550] lstrcmpiW (lpString1=".ODF", lpString2=".waifu") returned -1 [0119.550] lstrlenW (lpString="OFFICE.ODF") returned 10 [0119.550] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\cultures\\office.odf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0119.550] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x30afb3c | out: lpFileSize=0x30afb3c*=4297568) returned 1 [0119.550] CloseHandle (hObject=0x20c) returned 1 [0119.550] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\cultures\\office.odf")) returned 0x20 [0119.550] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\cultures\\office.odf.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0119.550] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\cultures\\office.odf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\cultures\\office.odf.id-9c354b42.[darknes@420blaze.it].waifu")) returned 1 [0119.551] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\cultures\\office.odf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0119.552] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0119.552] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\cultures\\office.odf.id-9c354b42.[darknes@420blaze.it].waifu"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\cultures\\office.odf")) returned 1 [0119.552] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF") returned 75 [0119.552] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF") returned 75 [0119.552] lstrlenW (lpString=".doc") returned 4 [0119.552] lstrcmpiW (lpString1=".doc", lpString2=".ODF") returned -1 [0119.552] lstrlenW (lpString=".docx") returned 5 [0119.552] lstrcmpiW (lpString1=".docx", lpString2="E.ODF") returned -1 [0119.552] lstrlenW (lpString=".pdf") returned 4 [0119.552] lstrcmpiW (lpString1=".pdf", lpString2=".ODF") returned 1 [0119.552] lstrlenW (lpString=".xls") returned 4 [0119.552] lstrcmpiW (lpString1=".xls", lpString2=".ODF") returned 1 [0119.552] lstrlenW (lpString=".xlsx") returned 5 [0119.552] lstrcmpiW (lpString1=".xlsx", lpString2="E.ODF") returned -1 [0119.552] lstrlenW (lpString=".ppt") returned 4 [0119.553] lstrcmpiW (lpString1=".ppt", lpString2=".ODF") returned 1 [0119.553] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF") returned 75 [0119.553] lstrlenW (lpString=".zip") returned 4 [0119.553] lstrcmpiW (lpString1=".zip", lpString2=".ODF") returned 1 [0119.553] lstrlenW (lpString=".rar") returned 4 [0119.553] lstrcmpiW (lpString1=".rar", lpString2=".ODF") returned 1 [0119.553] lstrlenW (lpString=".bz2") returned 4 [0119.553] lstrcmpiW (lpString1=".bz2", lpString2=".ODF") returned -1 [0119.553] lstrlenW (lpString=".7z") returned 3 [0119.553] lstrcmpiW (lpString1=".7z", lpString2="ODF") returned -1 [0119.553] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF") returned 75 [0119.553] lstrlenW (lpString=".dbf") returned 4 [0119.553] lstrcmpiW (lpString1=".dbf", lpString2=".ODF") returned -1 [0119.553] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF") returned 75 [0119.553] lstrlenW (lpString=".1cd") returned 4 [0119.553] lstrcmpiW (lpString1=".1cd", lpString2=".ODF") returned -1 [0119.553] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF") returned 75 [0119.553] lstrlenW (lpString=".jpg") returned 4 [0119.553] lstrcmpiW (lpString1=".jpg", lpString2=".ODF") returned -1 [0119.553] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF") returned 75 [0119.553] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF") returned 75 [0119.553] lstrlenW (lpString=".doc") returned 4 [0119.553] lstrcmpiW (lpString1=".doc", lpString2=".ODF") returned -1 [0119.553] lstrlenW (lpString=".docx") returned 5 [0119.553] lstrcmpiW (lpString1=".docx", lpString2="E.ODF") returned -1 [0119.553] lstrlenW (lpString=".pdf") returned 4 [0119.553] lstrcmpiW (lpString1=".pdf", lpString2=".ODF") returned 1 [0119.553] lstrlenW (lpString=".xls") returned 4 [0119.553] lstrcmpiW (lpString1=".xls", lpString2=".ODF") returned 1 [0119.553] lstrlenW (lpString=".xlsx") returned 5 [0119.553] lstrcmpiW (lpString1=".xlsx", lpString2="E.ODF") returned -1 [0119.553] lstrlenW (lpString=".ppt") returned 4 [0119.553] lstrcmpiW (lpString1=".ppt", lpString2=".ODF") returned 1 [0119.553] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF") returned 75 [0119.553] lstrlenW (lpString=".zip") returned 4 [0119.553] lstrcmpiW (lpString1=".zip", lpString2=".ODF") returned 1 [0119.554] lstrlenW (lpString=".rar") returned 4 [0119.554] lstrcmpiW (lpString1=".rar", lpString2=".ODF") returned 1 [0119.554] lstrlenW (lpString=".bz2") returned 4 [0119.554] lstrcmpiW (lpString1=".bz2", lpString2=".ODF") returned -1 [0119.554] lstrlenW (lpString=".7z") returned 3 [0119.554] lstrcmpiW (lpString1=".7z", lpString2="ODF") returned -1 [0119.554] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF") returned 75 [0119.554] lstrlenW (lpString=".dbf") returned 4 [0119.554] lstrcmpiW (lpString1=".dbf", lpString2=".ODF") returned -1 [0119.554] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF") returned 75 [0119.554] lstrlenW (lpString=".1cd") returned 4 [0119.554] lstrcmpiW (lpString1=".1cd", lpString2=".ODF") returned -1 [0119.554] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF") returned 75 [0119.554] lstrlenW (lpString=".jpg") returned 4 [0119.554] lstrcmpiW (lpString1=".jpg", lpString2=".ODF") returned -1 [0119.554] lstrcmpiW (lpString1=".DLL", lpString2=".waifu") returned -1 [0119.554] lstrlenW (lpString="EXPSRV.DLL") returned 10 [0119.554] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXPSRV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\expsrv.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0119.554] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x30afb3c | out: lpFileSize=0x30afb3c*=518984) returned 1 [0119.554] CloseHandle (hObject=0x20c) returned 1 [0119.554] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXPSRV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\expsrv.dll")) returned 0x20 [0119.555] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXPSRV.DLL.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\expsrv.dll.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0119.555] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXPSRV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\expsrv.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0119.555] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30afae8 | out: lpNewFilePointer=0x0) returned 1 [0119.555] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30afae8 | out: lpNewFilePointer=0x0) returned 1 [0119.555] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXPSRV.DLL.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\expsrv.dll.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0119.555] GetLastError () returned 0x0 [0119.555] ReadFile (in: hFile=0x20c, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30afaf4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x30afaf4*=0x7eb48, lpOverlapped=0x0) returned 1 [0119.833] WriteFile (in: hFile=0x1f8, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0x7eb50, lpNumberOfBytesWritten=0x30af8bc, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x30af8bc*=0x7eb50, lpOverlapped=0x0) returned 1 [0119.837] ReadFile (in: hFile=0x20c, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30afaf4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x30afaf4*=0x0, lpOverlapped=0x0) returned 1 [0119.837] WriteFile (in: hFile=0x1f8, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x30af8bc, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x30af8bc*=0xe8, lpOverlapped=0x0) returned 1 [0119.837] SetEndOfFile (hFile=0x1f8) returned 1 [0119.837] CloseHandle (hObject=0x1f8) returned 1 [0119.838] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30afae8 | out: lpNewFilePointer=0x0) returned 1 [0119.838] SetEndOfFile (hFile=0x20c) returned 1 [0119.839] CloseHandle (hObject=0x20c) returned 1 [0119.839] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXPSRV.DLL.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0119.839] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXPSRV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\expsrv.dll")) returned 1 [0119.839] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXPSRV.DLL") returned 66 [0119.839] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXPSRV.DLL") returned 66 [0119.839] lstrlenW (lpString=".doc") returned 4 [0119.839] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0119.840] lstrlenW (lpString=".docx") returned 5 [0119.840] lstrcmpiW (lpString1=".docx", lpString2="V.DLL") returned -1 [0119.840] lstrlenW (lpString=".pdf") returned 4 [0119.840] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0119.840] lstrlenW (lpString=".xls") returned 4 [0119.840] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0119.840] lstrlenW (lpString=".xlsx") returned 5 [0119.840] lstrcmpiW (lpString1=".xlsx", lpString2="V.DLL") returned -1 [0119.840] lstrlenW (lpString=".ppt") returned 4 [0119.840] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0119.840] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXPSRV.DLL") returned 66 [0119.840] lstrlenW (lpString=".zip") returned 4 [0119.840] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0119.840] lstrlenW (lpString=".rar") returned 4 [0119.840] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0119.840] lstrlenW (lpString=".bz2") returned 4 [0119.840] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0119.840] lstrlenW (lpString=".7z") returned 3 [0119.840] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0119.840] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXPSRV.DLL") returned 66 [0119.840] lstrlenW (lpString=".dbf") returned 4 [0119.840] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0119.840] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXPSRV.DLL") returned 66 [0119.840] lstrlenW (lpString=".1cd") returned 4 [0119.840] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0119.840] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXPSRV.DLL") returned 66 [0119.840] lstrlenW (lpString=".jpg") returned 4 [0119.840] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0119.840] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXPSRV.DLL") returned 66 [0119.840] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXPSRV.DLL") returned 66 [0119.840] lstrlenW (lpString=".doc") returned 4 [0119.840] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0119.840] lstrlenW (lpString=".docx") returned 5 [0119.840] lstrcmpiW (lpString1=".docx", lpString2="V.DLL") returned -1 [0119.840] lstrlenW (lpString=".pdf") returned 4 [0119.840] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0119.840] lstrlenW (lpString=".xls") returned 4 [0119.840] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0119.840] lstrlenW (lpString=".xlsx") returned 5 [0119.840] lstrcmpiW (lpString1=".xlsx", lpString2="V.DLL") returned -1 [0119.840] lstrlenW (lpString=".ppt") returned 4 [0119.840] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0119.840] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXPSRV.DLL") returned 66 [0119.840] lstrlenW (lpString=".zip") returned 4 [0119.840] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0119.840] lstrlenW (lpString=".rar") returned 4 [0119.840] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0119.840] lstrlenW (lpString=".bz2") returned 4 [0119.840] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0119.840] lstrlenW (lpString=".7z") returned 3 [0119.840] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0119.841] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXPSRV.DLL") returned 66 [0119.841] lstrlenW (lpString=".dbf") returned 4 [0119.841] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0119.841] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXPSRV.DLL") returned 66 [0119.841] lstrlenW (lpString=".1cd") returned 4 [0119.841] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0119.841] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXPSRV.DLL") returned 66 [0119.841] lstrlenW (lpString=".jpg") returned 4 [0119.841] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0119.841] lstrcmpiW (lpString1=".DLL", lpString2=".waifu") returned -1 [0119.841] lstrlenW (lpString="MSO.DLL") returned 7 [0119.841] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\mso.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0119.843] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x30afb3c | out: lpFileSize=0x30afb3c*=25417600) returned 1 [0119.843] CloseHandle (hObject=0x20c) returned 1 [0119.843] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\mso.dll")) returned 0x20 [0119.843] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\mso.dll.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0119.844] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\mso.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\mso.dll.id-9c354b42.[darknes@420blaze.it].waifu")) returned 1 [0119.844] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\mso.dll.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0119.844] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30af88c | out: lpNewFilePointer=0x0) returned 1 [0119.844] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30af84c | out: lpNewFilePointer=0x0) returned 1 [0119.844] ReadFile (in: hFile=0x20c, lpBuffer=0x3f00058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x30af858, lpOverlapped=0x0 | out: lpBuffer=0x3f00058*, lpNumberOfBytesRead=0x30af858*=0x40000, lpOverlapped=0x0) returned 1 [0119.863] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x8147d5, lpNewFilePointer=0x0, dwMoveMethod=0x30af84c | out: lpNewFilePointer=0x0) returned 1 [0119.863] ReadFile (in: hFile=0x20c, lpBuffer=0x3f40058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x30af858, lpOverlapped=0x0 | out: lpBuffer=0x3f40058*, lpNumberOfBytesRead=0x30af858*=0x40000, lpOverlapped=0x0) returned 1 [0119.910] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x30af88c | out: lpNewFilePointer=0xffffffff) returned 1 [0119.910] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x17fd780, lpNewFilePointer=0x0, dwMoveMethod=0x30af84c | out: lpNewFilePointer=0x0) returned 1 [0119.910] ReadFile (in: hFile=0x20c, lpBuffer=0x3f80058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x30af858, lpOverlapped=0x0 | out: lpBuffer=0x3f80058*, lpNumberOfBytesRead=0x30af858*=0x40000, lpOverlapped=0x0) returned 1 [0119.970] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30afae8 | out: lpNewFilePointer=0x0) returned 1 [0119.970] WriteFile (in: hFile=0x20c, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0xc00fa, lpNumberOfBytesWritten=0x30af8d0, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x30af8d0*=0xc00fa, lpOverlapped=0x0) returned 1 [0119.978] SetEndOfFile (hFile=0x20c) returned 1 [0119.978] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30af89c | out: lpNewFilePointer=0x0) returned 1 [0119.978] WriteFile (in: hFile=0x20c, lpBuffer=0x44c2078*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x30af8a8, lpOverlapped=0x0 | out: lpBuffer=0x44c2078*, lpNumberOfBytesWritten=0x30af8a8*=0x40000, lpOverlapped=0x0) returned 1 [0119.979] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x8147d5, lpNewFilePointer=0x0, dwMoveMethod=0x30af89c | out: lpNewFilePointer=0x0) returned 1 [0119.979] WriteFile (in: hFile=0x20c, lpBuffer=0x44c2078*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x30af8a8, lpOverlapped=0x0 | out: lpBuffer=0x44c2078*, lpNumberOfBytesWritten=0x30af8a8*=0x40000, lpOverlapped=0x0) returned 1 [0119.980] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x17fd780, lpNewFilePointer=0x0, dwMoveMethod=0x30af89c | out: lpNewFilePointer=0x0) returned 1 [0119.980] WriteFile (in: hFile=0x20c, lpBuffer=0x44c2078*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x30af8a8, lpOverlapped=0x0 | out: lpBuffer=0x44c2078*, lpNumberOfBytesWritten=0x30af8a8*=0x40000, lpOverlapped=0x0) returned 1 [0119.981] CloseHandle (hObject=0x20c) returned 1 [0119.982] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0119.982] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL") returned 63 [0119.982] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL") returned 63 [0119.982] lstrlenW (lpString=".doc") returned 4 [0119.982] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0119.982] lstrlenW (lpString=".docx") returned 5 [0119.982] lstrcmpiW (lpString1=".docx", lpString2="O.DLL") returned -1 [0119.982] lstrlenW (lpString=".pdf") returned 4 [0119.982] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0119.982] lstrlenW (lpString=".xls") returned 4 [0119.982] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0119.982] lstrlenW (lpString=".xlsx") returned 5 [0119.982] lstrcmpiW (lpString1=".xlsx", lpString2="O.DLL") returned -1 [0119.982] lstrlenW (lpString=".ppt") returned 4 [0119.982] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0119.982] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL") returned 63 [0119.982] lstrlenW (lpString=".zip") returned 4 [0119.982] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0119.983] lstrlenW (lpString=".rar") returned 4 [0119.983] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0119.983] lstrlenW (lpString=".bz2") returned 4 [0119.983] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0119.983] lstrlenW (lpString=".7z") returned 3 [0119.983] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0119.983] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL") returned 63 [0119.983] lstrlenW (lpString=".dbf") returned 4 [0119.983] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0119.983] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL") returned 63 [0119.983] lstrlenW (lpString=".1cd") returned 4 [0119.983] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0119.983] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL") returned 63 [0119.983] lstrlenW (lpString=".jpg") returned 4 [0119.983] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0119.983] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL") returned 63 [0119.983] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL") returned 63 [0119.983] lstrlenW (lpString=".doc") returned 4 [0119.983] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0119.983] lstrlenW (lpString=".docx") returned 5 [0119.983] lstrcmpiW (lpString1=".docx", lpString2="O.DLL") returned -1 [0119.983] lstrlenW (lpString=".pdf") returned 4 [0119.983] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0119.983] lstrlenW (lpString=".xls") returned 4 [0119.983] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0119.983] lstrlenW (lpString=".xlsx") returned 5 [0119.989] lstrcmpiW (lpString1=".xlsx", lpString2="O.DLL") returned -1 [0119.989] lstrlenW (lpString=".ppt") returned 4 [0119.989] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0119.990] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL") returned 63 [0119.990] lstrlenW (lpString=".zip") returned 4 [0119.990] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0119.990] lstrlenW (lpString=".rar") returned 4 [0119.990] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0119.990] lstrlenW (lpString=".bz2") returned 4 [0119.990] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0119.990] lstrlenW (lpString=".7z") returned 3 [0119.990] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0119.990] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL") returned 63 [0119.990] lstrlenW (lpString=".dbf") returned 4 [0119.990] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0119.990] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL") returned 63 [0119.990] lstrlenW (lpString=".1cd") returned 4 [0119.990] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0119.990] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL") returned 63 [0119.990] lstrlenW (lpString=".jpg") returned 4 [0119.990] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0119.990] lstrcmpiW (lpString1=".DLL", lpString2=".waifu") returned -1 [0119.990] lstrlenW (lpString="MSORES.DLL") returned 10 [0119.990] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSORES.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msores.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0119.991] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x30afb3c | out: lpFileSize=0x30afb3c*=72521600) returned 1 [0119.991] CloseHandle (hObject=0x20c) returned 1 [0119.991] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSORES.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msores.dll")) returned 0x20 [0119.991] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSORES.DLL.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msores.dll.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0119.991] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSORES.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msores.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSORES.DLL.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msores.dll.id-9c354b42.[darknes@420blaze.it].waifu")) returned 1 [0119.992] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSORES.DLL.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msores.dll.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0119.992] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30af88c | out: lpNewFilePointer=0x0) returned 1 [0119.992] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30af84c | out: lpNewFilePointer=0x0) returned 1 [0119.992] ReadFile (in: hFile=0x20c, lpBuffer=0x3f00058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x30af858, lpOverlapped=0x0 | out: lpBuffer=0x3f00058*, lpNumberOfBytesRead=0x30af858*=0x40000, lpOverlapped=0x0) returned 1 [0120.006] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x170dd2a, lpNewFilePointer=0x0, dwMoveMethod=0x30af84c | out: lpNewFilePointer=0x0) returned 1 [0120.006] ReadFile (in: hFile=0x20c, lpBuffer=0x3f40058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x30af858, lpOverlapped=0x0 | out: lpBuffer=0x3f40058*, lpNumberOfBytesRead=0x30af858*=0x40000, lpOverlapped=0x0) returned 1 [0120.027] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x30af88c | out: lpNewFilePointer=0xffffffff) returned 1 [0120.027] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x44e9780, lpNewFilePointer=0x0, dwMoveMethod=0x30af84c | out: lpNewFilePointer=0x0) returned 1 [0120.027] ReadFile (in: hFile=0x20c, lpBuffer=0x3f80058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x30af858, lpOverlapped=0x0 | out: lpBuffer=0x3f80058*, lpNumberOfBytesRead=0x30af858*=0x40000, lpOverlapped=0x0) returned 1 [0120.049] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30afae8 | out: lpNewFilePointer=0x0) returned 1 [0120.049] WriteFile (in: hFile=0x20c, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0xc0100, lpNumberOfBytesWritten=0x30af8d0, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x30af8d0*=0xc0100, lpOverlapped=0x0) returned 1 [0120.055] SetEndOfFile (hFile=0x20c) returned 1 [0120.055] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30af89c | out: lpNewFilePointer=0x0) returned 1 [0120.055] WriteFile (in: hFile=0x20c, lpBuffer=0x44c2078*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x30af8a8, lpOverlapped=0x0 | out: lpBuffer=0x44c2078*, lpNumberOfBytesWritten=0x30af8a8*=0x40000, lpOverlapped=0x0) returned 1 [0120.056] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x170dd2a, lpNewFilePointer=0x0, dwMoveMethod=0x30af89c | out: lpNewFilePointer=0x0) returned 1 [0120.056] WriteFile (in: hFile=0x20c, lpBuffer=0x44c2078*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x30af8a8, lpOverlapped=0x0 | out: lpBuffer=0x44c2078*, lpNumberOfBytesWritten=0x30af8a8*=0x40000, lpOverlapped=0x0) returned 1 [0120.056] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x44e9780, lpNewFilePointer=0x0, dwMoveMethod=0x30af89c | out: lpNewFilePointer=0x0) returned 1 [0120.056] WriteFile (in: hFile=0x20c, lpBuffer=0x44c2078*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x30af8a8, lpOverlapped=0x0 | out: lpBuffer=0x44c2078*, lpNumberOfBytesWritten=0x30af8a8*=0x40000, lpOverlapped=0x0) returned 1 [0120.058] CloseHandle (hObject=0x20c) returned 1 [0120.061] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSORES.DLL.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0120.061] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSORES.DLL") returned 66 [0120.061] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSORES.DLL") returned 66 [0120.061] lstrlenW (lpString=".doc") returned 4 [0120.061] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0120.061] lstrlenW (lpString=".docx") returned 5 [0120.061] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0120.061] lstrlenW (lpString=".pdf") returned 4 [0120.061] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0120.061] lstrlenW (lpString=".xls") returned 4 [0120.061] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0120.061] lstrlenW (lpString=".xlsx") returned 5 [0120.061] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0120.061] lstrlenW (lpString=".ppt") returned 4 [0120.061] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0120.061] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSORES.DLL") returned 66 [0120.061] lstrlenW (lpString=".zip") returned 4 [0120.061] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0120.061] lstrlenW (lpString=".rar") returned 4 [0120.061] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0120.061] lstrlenW (lpString=".bz2") returned 4 [0120.061] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0120.061] lstrlenW (lpString=".7z") returned 3 [0120.061] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0120.061] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSORES.DLL") returned 66 [0120.061] lstrlenW (lpString=".dbf") returned 4 [0120.061] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0120.061] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSORES.DLL") returned 66 [0120.061] lstrlenW (lpString=".1cd") returned 4 [0120.061] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0120.061] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSORES.DLL") returned 66 [0120.061] lstrlenW (lpString=".jpg") returned 4 [0120.061] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0120.062] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSORES.DLL") returned 66 [0120.062] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSORES.DLL") returned 66 [0120.062] lstrlenW (lpString=".doc") returned 4 [0120.062] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0120.062] lstrlenW (lpString=".docx") returned 5 [0120.062] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0120.062] lstrlenW (lpString=".pdf") returned 4 [0120.062] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0120.062] lstrlenW (lpString=".xls") returned 4 [0120.062] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0120.062] lstrlenW (lpString=".xlsx") returned 5 [0120.062] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0120.062] lstrlenW (lpString=".ppt") returned 4 [0120.062] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0120.062] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSORES.DLL") returned 66 [0120.062] lstrlenW (lpString=".zip") returned 4 [0120.062] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0120.062] lstrlenW (lpString=".rar") returned 4 [0120.062] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0120.062] lstrlenW (lpString=".bz2") returned 4 [0120.062] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0120.062] lstrlenW (lpString=".7z") returned 3 [0120.062] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0120.062] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSORES.DLL") returned 66 [0120.062] lstrlenW (lpString=".dbf") returned 4 [0120.062] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0120.062] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSORES.DLL") returned 66 [0120.062] lstrlenW (lpString=".1cd") returned 4 [0120.062] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0120.062] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSORES.DLL") returned 66 [0120.062] lstrlenW (lpString=".jpg") returned 4 [0120.062] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0120.062] lstrcmpiW (lpString1=".dll", lpString2=".waifu") returned -1 [0120.062] lstrlenW (lpString="msoshext.dll") returned 12 [0120.062] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\msoshext.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoshext.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0120.063] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x30afb3c | out: lpFileSize=0x30afb3c*=1269648) returned 1 [0120.063] CloseHandle (hObject=0x20c) returned 1 [0120.063] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\msoshext.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoshext.dll")) returned 0x20 [0120.063] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\msoshext.dll.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoshext.dll.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0120.063] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\msoshext.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoshext.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0120.063] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30afae8 | out: lpNewFilePointer=0x0) returned 1 [0120.063] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30afae8 | out: lpNewFilePointer=0x0) returned 1 [0120.063] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\msoshext.dll.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoshext.dll.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0120.064] GetLastError () returned 0x0 [0120.064] ReadFile (in: hFile=0x20c, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30afaf4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x30afaf4*=0xffff0, lpOverlapped=0x0) returned 1 [0120.203] WriteFile (in: hFile=0x180, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x30af8bc, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x30af8bc*=0xffff0, lpOverlapped=0x0) returned 1 [0120.214] ReadFile (in: hFile=0x20c, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30afaf4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x30afaf4*=0x35fa0, lpOverlapped=0x0) returned 1 [0120.265] WriteFile (in: hFile=0x180, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0x35fb0, lpNumberOfBytesWritten=0x30af8bc, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x30af8bc*=0x35fb0, lpOverlapped=0x0) returned 1 [0120.268] ReadFile (in: hFile=0x20c, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30afaf4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x30afaf4*=0x0, lpOverlapped=0x0) returned 1 [0120.268] WriteFile (in: hFile=0x180, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x30af8bc, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x30af8bc*=0xec, lpOverlapped=0x0) returned 1 [0120.269] SetEndOfFile (hFile=0x180) returned 1 [0120.269] CloseHandle (hObject=0x180) returned 1 [0120.269] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30afae8 | out: lpNewFilePointer=0x0) returned 1 [0120.269] SetEndOfFile (hFile=0x20c) returned 1 [0120.270] CloseHandle (hObject=0x20c) returned 1 [0120.270] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\msoshext.dll.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0120.270] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\msoshext.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoshext.dll")) returned 1 [0120.270] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\msoshext.dll") returned 68 [0120.270] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\msoshext.dll") returned 68 [0120.270] lstrlenW (lpString=".doc") returned 4 [0120.270] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0120.271] lstrlenW (lpString=".docx") returned 5 [0120.271] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0120.271] lstrlenW (lpString=".pdf") returned 4 [0120.271] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0120.271] lstrlenW (lpString=".xls") returned 4 [0120.271] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0120.271] lstrlenW (lpString=".xlsx") returned 5 [0120.271] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0120.271] lstrlenW (lpString=".ppt") returned 4 [0120.271] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0120.271] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\msoshext.dll") returned 68 [0120.271] lstrlenW (lpString=".zip") returned 4 [0120.271] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0120.271] lstrlenW (lpString=".rar") returned 4 [0120.271] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0120.271] lstrlenW (lpString=".bz2") returned 4 [0120.271] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0120.271] lstrlenW (lpString=".7z") returned 3 [0120.271] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0120.271] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\msoshext.dll") returned 68 [0120.271] lstrlenW (lpString=".dbf") returned 4 [0120.271] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0120.271] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\msoshext.dll") returned 68 [0120.271] lstrlenW (lpString=".1cd") returned 4 [0120.271] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0120.271] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\msoshext.dll") returned 68 [0120.271] lstrlenW (lpString=".jpg") returned 4 [0120.271] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0120.271] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\msoshext.dll") returned 68 [0120.271] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\msoshext.dll") returned 68 [0120.271] lstrlenW (lpString=".doc") returned 4 [0120.271] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0120.271] lstrlenW (lpString=".docx") returned 5 [0120.271] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0120.271] lstrlenW (lpString=".pdf") returned 4 [0120.271] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0120.271] lstrlenW (lpString=".xls") returned 4 [0120.271] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0120.271] lstrlenW (lpString=".xlsx") returned 5 [0120.271] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0120.271] lstrlenW (lpString=".ppt") returned 4 [0120.271] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0120.271] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\msoshext.dll") returned 68 [0120.271] lstrlenW (lpString=".zip") returned 4 [0120.271] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0120.271] lstrlenW (lpString=".rar") returned 4 [0120.271] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0120.272] lstrlenW (lpString=".bz2") returned 4 [0120.272] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0120.272] lstrlenW (lpString=".7z") returned 3 [0120.272] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0120.272] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\msoshext.dll") returned 68 [0120.272] lstrlenW (lpString=".dbf") returned 4 [0120.272] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0120.272] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\msoshext.dll") returned 68 [0120.272] lstrlenW (lpString=".1cd") returned 4 [0120.272] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0120.272] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\msoshext.dll") returned 68 [0120.272] lstrlenW (lpString=".jpg") returned 4 [0120.272] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0120.272] lstrcmpiW (lpString1=".DLL", lpString2=".waifu") returned -1 [0120.272] lstrlenW (lpString="MSOXMLMF.DLL") returned 12 [0120.272] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLMF.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoxmlmf.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0120.272] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x30afb3c | out: lpFileSize=0x30afb3c*=56192) returned 1 [0120.272] CloseHandle (hObject=0x20c) returned 1 [0120.272] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLMF.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoxmlmf.dll")) returned 0x20 [0120.272] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLMF.DLL.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoxmlmf.dll.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0120.272] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLMF.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoxmlmf.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0120.273] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLMF.DLL") returned 68 [0120.273] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLMF.DLL") returned 68 [0120.273] lstrlenW (lpString=".doc") returned 4 [0120.273] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0120.273] lstrlenW (lpString=".docx") returned 5 [0120.273] lstrcmpiW (lpString1=".docx", lpString2="F.DLL") returned -1 [0120.273] lstrlenW (lpString=".pdf") returned 4 [0120.273] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0120.273] lstrlenW (lpString=".xls") returned 4 [0120.273] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0120.273] lstrlenW (lpString=".xlsx") returned 5 [0120.273] lstrcmpiW (lpString1=".xlsx", lpString2="F.DLL") returned -1 [0120.273] lstrlenW (lpString=".ppt") returned 4 [0120.273] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0120.273] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLMF.DLL") returned 68 [0120.273] lstrlenW (lpString=".zip") returned 4 [0120.273] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0120.273] lstrlenW (lpString=".rar") returned 4 [0120.273] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0120.273] lstrlenW (lpString=".bz2") returned 4 [0120.273] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0120.273] lstrlenW (lpString=".7z") returned 3 [0120.273] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0120.273] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLMF.DLL") returned 68 [0120.273] lstrlenW (lpString=".dbf") returned 4 [0120.273] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0120.273] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLMF.DLL") returned 68 [0120.273] lstrlenW (lpString=".1cd") returned 4 [0120.273] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0120.273] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLMF.DLL") returned 68 [0120.273] lstrlenW (lpString=".jpg") returned 4 [0120.273] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0120.273] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLMF.DLL") returned 68 [0120.273] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLMF.DLL") returned 68 [0120.273] lstrlenW (lpString=".doc") returned 4 [0120.273] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0120.273] lstrlenW (lpString=".docx") returned 5 [0120.273] lstrcmpiW (lpString1=".docx", lpString2="F.DLL") returned -1 [0120.273] lstrlenW (lpString=".pdf") returned 4 [0120.274] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0120.274] lstrlenW (lpString=".xls") returned 4 [0120.274] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0120.274] lstrlenW (lpString=".xlsx") returned 5 [0120.274] lstrcmpiW (lpString1=".xlsx", lpString2="F.DLL") returned -1 [0120.274] lstrlenW (lpString=".ppt") returned 4 [0120.274] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0120.274] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLMF.DLL") returned 68 [0120.274] lstrlenW (lpString=".zip") returned 4 [0120.274] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0120.274] lstrlenW (lpString=".rar") returned 4 [0120.274] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0120.274] lstrlenW (lpString=".bz2") returned 4 [0120.274] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0120.274] lstrlenW (lpString=".7z") returned 3 [0120.274] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0120.274] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLMF.DLL") returned 68 [0120.274] lstrlenW (lpString=".dbf") returned 4 [0120.274] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0120.274] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLMF.DLL") returned 68 [0120.274] lstrlenW (lpString=".1cd") returned 4 [0120.274] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0120.274] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLMF.DLL") returned 68 [0120.274] lstrlenW (lpString=".jpg") returned 4 [0120.274] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0120.274] lstrcmpiW (lpString1=".DLL", lpString2=".waifu") returned -1 [0120.274] lstrlenW (lpString="MSPTLS.DLL") returned 10 [0120.274] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSPTLS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msptls.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0120.275] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x30afb3c | out: lpFileSize=0x30afb3c*=1198464) returned 1 [0120.275] CloseHandle (hObject=0x20c) returned 1 [0120.275] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSPTLS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msptls.dll")) returned 0x20 [0120.275] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSPTLS.DLL.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msptls.dll.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0120.276] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSPTLS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msptls.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0120.276] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30afae8 | out: lpNewFilePointer=0x0) returned 1 [0120.276] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30afae8 | out: lpNewFilePointer=0x0) returned 1 [0120.276] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSPTLS.DLL.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msptls.dll.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0120.276] GetLastError () returned 0x0 [0120.276] ReadFile (in: hFile=0x20c, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30afaf4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x30afaf4*=0xffff0, lpOverlapped=0x0) returned 1 [0120.310] WriteFile (in: hFile=0x180, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x30af8bc, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x30af8bc*=0xffff0, lpOverlapped=0x0) returned 1 [0120.319] ReadFile (in: hFile=0x20c, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30afaf4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x30afaf4*=0x24990, lpOverlapped=0x0) returned 1 [0120.459] WriteFile (in: hFile=0x180, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0x249a0, lpNumberOfBytesWritten=0x30af8bc, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x30af8bc*=0x249a0, lpOverlapped=0x0) returned 1 [0120.463] ReadFile (in: hFile=0x20c, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30afaf4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x30afaf4*=0x0, lpOverlapped=0x0) returned 1 [0120.463] WriteFile (in: hFile=0x180, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x30af8bc, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x30af8bc*=0xe8, lpOverlapped=0x0) returned 1 [0120.463] SetEndOfFile (hFile=0x180) returned 1 [0120.488] CloseHandle (hObject=0x180) returned 1 [0120.488] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30afae8 | out: lpNewFilePointer=0x0) returned 1 [0120.488] SetEndOfFile (hFile=0x20c) returned 1 [0120.489] CloseHandle (hObject=0x20c) returned 1 [0120.490] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSPTLS.DLL.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0120.490] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSPTLS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msptls.dll")) returned 1 [0120.490] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSPTLS.DLL") returned 66 [0120.490] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSPTLS.DLL") returned 66 [0120.490] lstrlenW (lpString=".doc") returned 4 [0120.490] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0120.491] lstrlenW (lpString=".docx") returned 5 [0120.491] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0120.491] lstrlenW (lpString=".pdf") returned 4 [0120.491] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0120.491] lstrlenW (lpString=".xls") returned 4 [0120.491] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0120.491] lstrlenW (lpString=".xlsx") returned 5 [0120.491] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0120.491] lstrlenW (lpString=".ppt") returned 4 [0120.491] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0120.491] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSPTLS.DLL") returned 66 [0120.491] lstrlenW (lpString=".zip") returned 4 [0120.491] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0120.491] lstrlenW (lpString=".rar") returned 4 [0120.491] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0120.491] lstrlenW (lpString=".bz2") returned 4 [0120.491] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0120.491] lstrlenW (lpString=".7z") returned 3 [0120.491] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0120.491] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSPTLS.DLL") returned 66 [0120.491] lstrlenW (lpString=".dbf") returned 4 [0120.491] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0120.491] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSPTLS.DLL") returned 66 [0120.491] lstrlenW (lpString=".1cd") returned 4 [0120.491] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0120.491] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSPTLS.DLL") returned 66 [0120.491] lstrlenW (lpString=".jpg") returned 4 [0120.491] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0120.492] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSPTLS.DLL") returned 66 [0120.492] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSPTLS.DLL") returned 66 [0120.492] lstrlenW (lpString=".doc") returned 4 [0120.492] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0120.492] lstrlenW (lpString=".docx") returned 5 [0120.492] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0120.492] lstrlenW (lpString=".pdf") returned 4 [0120.492] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0120.492] lstrlenW (lpString=".xls") returned 4 [0120.492] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0120.492] lstrlenW (lpString=".xlsx") returned 5 [0120.492] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0120.492] lstrlenW (lpString=".ppt") returned 4 [0120.492] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0120.492] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSPTLS.DLL") returned 66 [0120.492] lstrlenW (lpString=".zip") returned 4 [0120.492] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0120.492] lstrlenW (lpString=".rar") returned 4 [0120.492] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0120.492] lstrlenW (lpString=".bz2") returned 4 [0120.492] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0120.492] lstrlenW (lpString=".7z") returned 3 [0120.492] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0120.492] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSPTLS.DLL") returned 66 [0120.492] lstrlenW (lpString=".dbf") returned 4 [0120.492] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0120.492] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSPTLS.DLL") returned 66 [0120.492] lstrlenW (lpString=".1cd") returned 4 [0120.492] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0120.492] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSPTLS.DLL") returned 66 [0120.492] lstrlenW (lpString=".jpg") returned 4 [0120.492] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0120.492] lstrcmpiW (lpString1=".exe", lpString2=".waifu") returned -1 [0120.493] lstrlenW (lpString="ODeploy.exe") returned 11 [0120.493] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\ODeploy.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\odeploy.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0120.496] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x30afb3c | out: lpFileSize=0x30afb3c*=571320) returned 1 [0120.496] CloseHandle (hObject=0x20c) returned 1 [0120.496] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\ODeploy.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\odeploy.exe")) returned 0x20 [0120.496] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\ODeploy.exe.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\odeploy.exe.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0120.497] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\ODeploy.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\odeploy.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0120.497] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30afae8 | out: lpNewFilePointer=0x0) returned 1 [0120.497] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30afae8 | out: lpNewFilePointer=0x0) returned 1 [0120.497] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\ODeploy.exe.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\odeploy.exe.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0120.498] GetLastError () returned 0x0 [0120.498] ReadFile (in: hFile=0x20c, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30afaf4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x30afaf4*=0x8b7b8, lpOverlapped=0x0) returned 1 [0121.006] WriteFile (in: hFile=0x180, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0x8b7c0, lpNumberOfBytesWritten=0x30af8bc, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x30af8bc*=0x8b7c0, lpOverlapped=0x0) returned 1 [0121.010] ReadFile (in: hFile=0x20c, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30afaf4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x30afaf4*=0x0, lpOverlapped=0x0) returned 1 [0121.010] WriteFile (in: hFile=0x180, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x30af8bc, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x30af8bc*=0xea, lpOverlapped=0x0) returned 1 [0121.010] SetEndOfFile (hFile=0x180) returned 1 [0121.011] CloseHandle (hObject=0x180) returned 1 [0121.011] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30afae8 | out: lpNewFilePointer=0x0) returned 1 [0121.011] SetEndOfFile (hFile=0x20c) returned 1 [0121.012] CloseHandle (hObject=0x20c) returned 1 [0121.012] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\ODeploy.exe.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0121.013] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\ODeploy.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\odeploy.exe")) returned 1 [0121.013] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\ODeploy.exe") returned 91 [0121.013] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\ODeploy.exe") returned 91 [0121.013] lstrlenW (lpString=".doc") returned 4 [0121.013] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0121.013] lstrlenW (lpString=".docx") returned 5 [0121.013] lstrcmpiW (lpString1=".docx", lpString2="y.exe") returned -1 [0121.013] lstrlenW (lpString=".pdf") returned 4 [0121.013] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0121.013] lstrlenW (lpString=".xls") returned 4 [0121.013] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0121.013] lstrlenW (lpString=".xlsx") returned 5 [0121.013] lstrcmpiW (lpString1=".xlsx", lpString2="y.exe") returned -1 [0121.013] lstrlenW (lpString=".ppt") returned 4 [0121.013] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0121.013] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\ODeploy.exe") returned 91 [0121.013] lstrlenW (lpString=".zip") returned 4 [0121.013] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0121.013] lstrlenW (lpString=".rar") returned 4 [0121.013] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0121.013] lstrlenW (lpString=".bz2") returned 4 [0121.013] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0121.013] lstrlenW (lpString=".7z") returned 3 [0121.013] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0121.013] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\ODeploy.exe") returned 91 [0121.013] lstrlenW (lpString=".dbf") returned 4 [0121.013] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0121.013] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\ODeploy.exe") returned 91 [0121.013] lstrlenW (lpString=".1cd") returned 4 [0121.013] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0121.013] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\ODeploy.exe") returned 91 [0121.013] lstrlenW (lpString=".jpg") returned 4 [0121.013] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0121.013] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\ODeploy.exe") returned 91 [0121.013] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\ODeploy.exe") returned 91 [0121.013] lstrlenW (lpString=".doc") returned 4 [0121.013] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0121.014] lstrlenW (lpString=".docx") returned 5 [0121.014] lstrcmpiW (lpString1=".docx", lpString2="y.exe") returned -1 [0121.014] lstrlenW (lpString=".pdf") returned 4 [0121.014] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0121.014] lstrlenW (lpString=".xls") returned 4 [0121.014] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0121.014] lstrlenW (lpString=".xlsx") returned 5 [0121.014] lstrcmpiW (lpString1=".xlsx", lpString2="y.exe") returned -1 [0121.014] lstrlenW (lpString=".ppt") returned 4 [0121.014] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0121.014] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\ODeploy.exe") returned 91 [0121.014] lstrlenW (lpString=".zip") returned 4 [0121.014] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0121.014] lstrlenW (lpString=".rar") returned 4 [0121.014] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0121.014] lstrlenW (lpString=".bz2") returned 4 [0121.014] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0121.014] lstrlenW (lpString=".7z") returned 3 [0121.014] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0121.014] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\ODeploy.exe") returned 91 [0121.014] lstrlenW (lpString=".dbf") returned 4 [0121.014] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0121.014] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\ODeploy.exe") returned 91 [0121.014] lstrlenW (lpString=".1cd") returned 4 [0121.014] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0121.014] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\ODeploy.exe") returned 91 [0121.014] lstrlenW (lpString=".jpg") returned 4 [0121.014] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0121.014] lstrcmpiW (lpString1=".DLL", lpString2=".waifu") returned -1 [0121.014] lstrlenW (lpString="OPTINPS.DLL") returned 11 [0121.014] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPTINPS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\optinps.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x224 [0121.022] GetFileSizeEx (in: hFile=0x224, lpFileSize=0x30afb3c | out: lpFileSize=0x30afb3c*=18336) returned 1 [0121.022] CloseHandle (hObject=0x224) returned 1 [0121.022] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPTINPS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\optinps.dll")) returned 0x20 [0121.022] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPTINPS.DLL.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\optinps.dll.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0121.022] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPTINPS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\optinps.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x224 [0121.022] SetFilePointerEx (in: hFile=0x224, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30afae8 | out: lpNewFilePointer=0x0) returned 1 [0121.023] SetFilePointerEx (in: hFile=0x224, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30afae8 | out: lpNewFilePointer=0x0) returned 1 [0121.023] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPTINPS.DLL.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\optinps.dll.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0121.023] GetLastError () returned 0x0 [0121.023] ReadFile (in: hFile=0x224, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30afaf4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x30afaf4*=0x47a0, lpOverlapped=0x0) returned 1 [0121.164] WriteFile (in: hFile=0x19c, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0x47b0, lpNumberOfBytesWritten=0x30af8bc, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x30af8bc*=0x47b0, lpOverlapped=0x0) returned 1 [0121.164] ReadFile (in: hFile=0x224, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30afaf4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x30afaf4*=0x0, lpOverlapped=0x0) returned 1 [0121.164] WriteFile (in: hFile=0x19c, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x30af8bc, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x30af8bc*=0xea, lpOverlapped=0x0) returned 1 [0121.164] SetEndOfFile (hFile=0x19c) returned 1 [0121.164] CloseHandle (hObject=0x19c) returned 1 [0121.165] SetFilePointerEx (in: hFile=0x224, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30afae8 | out: lpNewFilePointer=0x0) returned 1 [0121.165] SetEndOfFile (hFile=0x224) returned 1 [0121.165] CloseHandle (hObject=0x224) returned 1 [0121.165] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPTINPS.DLL.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0121.165] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPTINPS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\optinps.dll")) returned 1 [0121.165] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPTINPS.DLL") returned 67 [0121.165] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPTINPS.DLL") returned 67 [0121.165] lstrlenW (lpString=".doc") returned 4 [0121.165] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0121.165] lstrlenW (lpString=".docx") returned 5 [0121.166] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0121.166] lstrlenW (lpString=".pdf") returned 4 [0121.166] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0121.166] lstrlenW (lpString=".xls") returned 4 [0121.166] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0121.166] lstrlenW (lpString=".xlsx") returned 5 [0121.166] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0121.166] lstrlenW (lpString=".ppt") returned 4 [0121.166] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0121.166] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPTINPS.DLL") returned 67 [0121.166] lstrlenW (lpString=".zip") returned 4 [0121.166] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0121.166] lstrlenW (lpString=".rar") returned 4 [0121.166] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0121.166] lstrlenW (lpString=".bz2") returned 4 [0121.166] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0121.166] lstrlenW (lpString=".7z") returned 3 [0121.166] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0121.166] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPTINPS.DLL") returned 67 [0121.166] lstrlenW (lpString=".dbf") returned 4 [0121.166] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0121.166] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPTINPS.DLL") returned 67 [0121.166] lstrlenW (lpString=".1cd") returned 4 [0121.166] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0121.166] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPTINPS.DLL") returned 67 [0121.166] lstrlenW (lpString=".jpg") returned 4 [0121.166] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0121.166] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPTINPS.DLL") returned 67 [0121.166] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPTINPS.DLL") returned 67 [0121.166] lstrlenW (lpString=".doc") returned 4 [0121.166] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0121.166] lstrlenW (lpString=".docx") returned 5 [0121.166] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0121.166] lstrlenW (lpString=".pdf") returned 4 [0121.166] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0121.166] lstrlenW (lpString=".xls") returned 4 [0121.166] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0121.166] lstrlenW (lpString=".xlsx") returned 5 [0121.166] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0121.166] lstrlenW (lpString=".ppt") returned 4 [0121.166] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0121.166] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPTINPS.DLL") returned 67 [0121.166] lstrlenW (lpString=".zip") returned 4 [0121.166] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0121.166] lstrlenW (lpString=".rar") returned 4 [0121.166] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0121.166] lstrlenW (lpString=".bz2") returned 4 [0121.166] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0121.166] lstrlenW (lpString=".7z") returned 3 [0121.166] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0121.166] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPTINPS.DLL") returned 67 [0121.167] lstrlenW (lpString=".dbf") returned 4 [0121.167] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0121.167] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPTINPS.DLL") returned 67 [0121.167] lstrlenW (lpString=".1cd") returned 4 [0121.167] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0121.167] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPTINPS.DLL") returned 67 [0121.167] lstrlenW (lpString=".jpg") returned 4 [0121.167] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0121.167] lstrcmpiW (lpString1=".DLL", lpString2=".waifu") returned -1 [0121.167] lstrlenW (lpString="PJRESC.DLL") returned 10 [0121.167] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJRESC.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\pjresc.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x224 [0121.167] GetFileSizeEx (in: hFile=0x224, lpFileSize=0x30afb3c | out: lpFileSize=0x30afb3c*=261008) returned 1 [0121.167] CloseHandle (hObject=0x224) returned 1 [0121.167] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJRESC.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\pjresc.dll")) returned 0x20 [0121.167] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJRESC.DLL.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\pjresc.dll.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0121.167] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJRESC.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\pjresc.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x224 [0121.167] SetFilePointerEx (in: hFile=0x224, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30afae8 | out: lpNewFilePointer=0x0) returned 1 [0121.168] SetFilePointerEx (in: hFile=0x224, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30afae8 | out: lpNewFilePointer=0x0) returned 1 [0121.168] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJRESC.DLL.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\pjresc.dll.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0121.168] GetLastError () returned 0x0 [0121.168] ReadFile (in: hFile=0x224, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30afaf4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x30afaf4*=0x3fb90, lpOverlapped=0x0) returned 1 [0121.201] WriteFile (in: hFile=0x19c, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0x3fba0, lpNumberOfBytesWritten=0x30af8bc, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x30af8bc*=0x3fba0, lpOverlapped=0x0) returned 1 [0121.203] ReadFile (in: hFile=0x224, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30afaf4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x30afaf4*=0x0, lpOverlapped=0x0) returned 1 [0121.203] WriteFile (in: hFile=0x19c, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x30af8bc, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x30af8bc*=0xe8, lpOverlapped=0x0) returned 1 [0121.203] SetEndOfFile (hFile=0x19c) returned 1 [0121.467] CloseHandle (hObject=0x19c) returned 1 [0121.468] SetFilePointerEx (in: hFile=0x224, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30afae8 | out: lpNewFilePointer=0x0) returned 1 [0121.468] SetEndOfFile (hFile=0x224) returned 1 [0121.468] CloseHandle (hObject=0x224) returned 1 [0121.468] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJRESC.DLL.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0121.469] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJRESC.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\pjresc.dll")) returned 1 [0121.469] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJRESC.DLL") returned 66 [0121.469] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJRESC.DLL") returned 66 [0121.469] lstrlenW (lpString=".doc") returned 4 [0121.469] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0121.469] lstrlenW (lpString=".docx") returned 5 [0121.469] lstrcmpiW (lpString1=".docx", lpString2="C.DLL") returned -1 [0121.469] lstrlenW (lpString=".pdf") returned 4 [0121.469] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0121.469] lstrlenW (lpString=".xls") returned 4 [0121.469] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0121.469] lstrlenW (lpString=".xlsx") returned 5 [0121.469] lstrcmpiW (lpString1=".xlsx", lpString2="C.DLL") returned -1 [0121.469] lstrlenW (lpString=".ppt") returned 4 [0121.469] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0121.469] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJRESC.DLL") returned 66 [0121.469] lstrlenW (lpString=".zip") returned 4 [0121.469] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0121.469] lstrlenW (lpString=".rar") returned 4 [0121.469] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0121.469] lstrlenW (lpString=".bz2") returned 4 [0121.469] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0121.469] lstrlenW (lpString=".7z") returned 3 [0121.469] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0121.469] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJRESC.DLL") returned 66 [0121.469] lstrlenW (lpString=".dbf") returned 4 [0121.469] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0121.469] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJRESC.DLL") returned 66 [0121.469] lstrlenW (lpString=".1cd") returned 4 [0121.469] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0121.469] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJRESC.DLL") returned 66 [0121.469] lstrlenW (lpString=".jpg") returned 4 [0121.469] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0121.469] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJRESC.DLL") returned 66 [0121.469] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJRESC.DLL") returned 66 [0121.469] lstrlenW (lpString=".doc") returned 4 [0121.469] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0121.469] lstrlenW (lpString=".docx") returned 5 [0121.470] lstrcmpiW (lpString1=".docx", lpString2="C.DLL") returned -1 [0121.470] lstrlenW (lpString=".pdf") returned 4 [0121.470] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0121.470] lstrlenW (lpString=".xls") returned 4 [0121.470] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0121.470] lstrlenW (lpString=".xlsx") returned 5 [0121.470] lstrcmpiW (lpString1=".xlsx", lpString2="C.DLL") returned -1 [0121.470] lstrlenW (lpString=".ppt") returned 4 [0121.470] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0121.470] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJRESC.DLL") returned 66 [0121.470] lstrlenW (lpString=".zip") returned 4 [0121.470] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0121.470] lstrlenW (lpString=".rar") returned 4 [0121.470] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0121.470] lstrlenW (lpString=".bz2") returned 4 [0121.470] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0121.470] lstrlenW (lpString=".7z") returned 3 [0121.470] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0121.470] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJRESC.DLL") returned 66 [0121.470] lstrlenW (lpString=".dbf") returned 4 [0121.470] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0121.470] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJRESC.DLL") returned 66 [0121.470] lstrlenW (lpString=".1cd") returned 4 [0121.470] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0121.470] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJRESC.DLL") returned 66 [0121.470] lstrlenW (lpString=".jpg") returned 4 [0121.470] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0121.470] lstrcmpiW (lpString1=".DLL", lpString2=".waifu") returned -1 [0121.470] lstrlenW (lpString="RICHED20.DLL") returned 12 [0121.470] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\RICHED20.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\riched20.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0121.472] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x30afb3c | out: lpFileSize=0x30afb3c*=1870696) returned 1 [0121.472] CloseHandle (hObject=0x19c) returned 1 [0121.472] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\RICHED20.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\riched20.dll")) returned 0x20 [0121.472] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\RICHED20.DLL.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\riched20.dll.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0121.472] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\RICHED20.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\riched20.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\RICHED20.DLL.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\riched20.dll.id-9c354b42.[darknes@420blaze.it].waifu")) returned 1 [0121.473] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\RICHED20.DLL.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\riched20.dll.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0121.473] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30af88c | out: lpNewFilePointer=0x0) returned 1 [0121.473] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30af84c | out: lpNewFilePointer=0x0) returned 1 [0121.473] ReadFile (in: hFile=0x19c, lpBuffer=0x3f00058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x30af858, lpOverlapped=0x0 | out: lpBuffer=0x3f00058*, lpNumberOfBytesRead=0x30af858*=0x40000, lpOverlapped=0x0) returned 1 [0121.534] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x983cd, lpNewFilePointer=0x0, dwMoveMethod=0x30af84c | out: lpNewFilePointer=0x0) returned 1 [0121.534] ReadFile (in: hFile=0x19c, lpBuffer=0x3f40058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x30af858, lpOverlapped=0x0 | out: lpBuffer=0x3f40058*, lpNumberOfBytesRead=0x30af858*=0x40000, lpOverlapped=0x0) returned 1 [0121.621] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x30af88c | out: lpNewFilePointer=0xffffffff) returned 1 [0121.621] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x188b68, lpNewFilePointer=0x0, dwMoveMethod=0x30af84c | out: lpNewFilePointer=0x0) returned 1 [0121.621] ReadFile (in: hFile=0x19c, lpBuffer=0x3f80058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x30af858, lpOverlapped=0x0 | out: lpBuffer=0x3f80058*, lpNumberOfBytesRead=0x30af858*=0x40000, lpOverlapped=0x0) returned 1 [0121.647] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30afae8 | out: lpNewFilePointer=0x0) returned 1 [0121.647] WriteFile (in: hFile=0x19c, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x30af8d0, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x30af8d0*=0xc0104, lpOverlapped=0x0) returned 1 [0121.657] SetEndOfFile (hFile=0x19c) returned 1 [0121.657] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30af89c | out: lpNewFilePointer=0x0) returned 1 [0121.657] WriteFile (in: hFile=0x19c, lpBuffer=0x44b2070*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x30af8a8, lpOverlapped=0x0 | out: lpBuffer=0x44b2070*, lpNumberOfBytesWritten=0x30af8a8*=0x40000, lpOverlapped=0x0) returned 1 [0121.658] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x983cd, lpNewFilePointer=0x0, dwMoveMethod=0x30af89c | out: lpNewFilePointer=0x0) returned 1 [0121.658] WriteFile (in: hFile=0x19c, lpBuffer=0x44b2070*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x30af8a8, lpOverlapped=0x0 | out: lpBuffer=0x44b2070*, lpNumberOfBytesWritten=0x30af8a8*=0x40000, lpOverlapped=0x0) returned 1 [0121.659] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x188b68, lpNewFilePointer=0x0, dwMoveMethod=0x30af89c | out: lpNewFilePointer=0x0) returned 1 [0121.659] WriteFile (in: hFile=0x19c, lpBuffer=0x44b2070*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x30af8a8, lpOverlapped=0x0 | out: lpBuffer=0x44b2070*, lpNumberOfBytesWritten=0x30af8a8*=0x40000, lpOverlapped=0x0) returned 1 [0121.661] CloseHandle (hObject=0x19c) returned 1 [0121.662] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\RICHED20.DLL.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0121.662] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\RICHED20.DLL") returned 68 [0121.662] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\RICHED20.DLL") returned 68 [0121.662] lstrlenW (lpString=".doc") returned 4 [0121.662] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0121.662] lstrlenW (lpString=".docx") returned 5 [0121.662] lstrcmpiW (lpString1=".docx", lpString2="0.DLL") returned -1 [0121.662] lstrlenW (lpString=".pdf") returned 4 [0121.662] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0121.662] lstrlenW (lpString=".xls") returned 4 [0121.662] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0121.662] lstrlenW (lpString=".xlsx") returned 5 [0121.662] lstrcmpiW (lpString1=".xlsx", lpString2="0.DLL") returned -1 [0121.662] lstrlenW (lpString=".ppt") returned 4 [0121.662] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0121.662] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\RICHED20.DLL") returned 68 [0121.662] lstrlenW (lpString=".zip") returned 4 [0121.662] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0121.662] lstrlenW (lpString=".rar") returned 4 [0121.662] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0121.662] lstrlenW (lpString=".bz2") returned 4 [0121.662] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0121.662] lstrlenW (lpString=".7z") returned 3 [0121.662] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0121.662] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\RICHED20.DLL") returned 68 [0121.662] lstrlenW (lpString=".dbf") returned 4 [0121.662] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0121.662] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\RICHED20.DLL") returned 68 [0121.662] lstrlenW (lpString=".1cd") returned 4 [0121.662] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0121.662] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\RICHED20.DLL") returned 68 [0121.662] lstrlenW (lpString=".jpg") returned 4 [0121.662] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0121.662] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\RICHED20.DLL") returned 68 [0121.662] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\RICHED20.DLL") returned 68 [0121.662] lstrlenW (lpString=".doc") returned 4 [0121.662] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0121.662] lstrlenW (lpString=".docx") returned 5 [0121.662] lstrcmpiW (lpString1=".docx", lpString2="0.DLL") returned -1 [0121.662] lstrlenW (lpString=".pdf") returned 4 [0121.662] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0121.662] lstrlenW (lpString=".xls") returned 4 [0121.662] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0121.662] lstrlenW (lpString=".xlsx") returned 5 [0121.662] lstrcmpiW (lpString1=".xlsx", lpString2="0.DLL") returned -1 [0121.662] lstrlenW (lpString=".ppt") returned 4 [0121.663] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0121.663] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\RICHED20.DLL") returned 68 [0121.663] lstrlenW (lpString=".zip") returned 4 [0121.663] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0121.663] lstrlenW (lpString=".rar") returned 4 [0121.663] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0121.663] lstrlenW (lpString=".bz2") returned 4 [0121.663] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0121.663] lstrlenW (lpString=".7z") returned 3 [0121.663] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0121.663] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\RICHED20.DLL") returned 68 [0121.663] lstrlenW (lpString=".dbf") returned 4 [0121.663] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0121.663] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\RICHED20.DLL") returned 68 [0121.663] lstrlenW (lpString=".1cd") returned 4 [0121.663] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0121.663] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\RICHED20.DLL") returned 68 [0121.663] lstrlenW (lpString=".jpg") returned 4 [0121.663] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0121.663] lstrcmpiW (lpString1=".DLL", lpString2=".waifu") returned -1 [0121.663] lstrlenW (lpString="WISC30.DLL") returned 10 [0121.663] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\WISC30.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\wisc30.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0121.663] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x30afb3c | out: lpFileSize=0x30afb3c*=147344) returned 1 [0121.663] CloseHandle (hObject=0x19c) returned 1 [0121.663] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\WISC30.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\wisc30.dll")) returned 0x20 [0121.664] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\WISC30.DLL.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\wisc30.dll.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0121.664] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\WISC30.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\wisc30.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0121.664] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30afae8 | out: lpNewFilePointer=0x0) returned 1 [0121.664] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30afae8 | out: lpNewFilePointer=0x0) returned 1 [0121.664] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\WISC30.DLL.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\wisc30.dll.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0121.664] GetLastError () returned 0x0 [0121.664] ReadFile (in: hFile=0x19c, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30afaf4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x30afaf4*=0x23f90, lpOverlapped=0x0) returned 1 [0121.679] WriteFile (in: hFile=0x1e4, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0x23fa0, lpNumberOfBytesWritten=0x30af8bc, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x30af8bc*=0x23fa0, lpOverlapped=0x0) returned 1 [0121.681] ReadFile (in: hFile=0x19c, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30afaf4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x30afaf4*=0x0, lpOverlapped=0x0) returned 1 [0121.681] WriteFile (in: hFile=0x1e4, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x30af8bc, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x30af8bc*=0xe8, lpOverlapped=0x0) returned 1 [0121.681] SetEndOfFile (hFile=0x1e4) returned 1 [0121.681] CloseHandle (hObject=0x1e4) returned 1 [0121.681] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30afae8 | out: lpNewFilePointer=0x0) returned 1 [0121.681] SetEndOfFile (hFile=0x19c) returned 1 [0121.682] CloseHandle (hObject=0x19c) returned 1 [0121.682] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\WISC30.DLL.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0121.682] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\WISC30.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\wisc30.dll")) returned 1 [0121.682] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\WISC30.DLL") returned 66 [0121.682] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\WISC30.DLL") returned 66 [0121.682] lstrlenW (lpString=".doc") returned 4 [0121.682] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0121.682] lstrlenW (lpString=".docx") returned 5 [0121.682] lstrcmpiW (lpString1=".docx", lpString2="0.DLL") returned -1 [0121.682] lstrlenW (lpString=".pdf") returned 4 [0121.682] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0121.682] lstrlenW (lpString=".xls") returned 4 [0121.682] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0121.682] lstrlenW (lpString=".xlsx") returned 5 [0121.682] lstrcmpiW (lpString1=".xlsx", lpString2="0.DLL") returned -1 [0121.682] lstrlenW (lpString=".ppt") returned 4 [0121.682] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0121.682] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\WISC30.DLL") returned 66 [0121.682] lstrlenW (lpString=".zip") returned 4 [0121.682] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0121.682] lstrlenW (lpString=".rar") returned 4 [0121.682] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0121.682] lstrlenW (lpString=".bz2") returned 4 [0121.682] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0121.682] lstrlenW (lpString=".7z") returned 3 [0121.683] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0121.683] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\WISC30.DLL") returned 66 [0121.683] lstrlenW (lpString=".dbf") returned 4 [0121.683] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0121.683] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\WISC30.DLL") returned 66 [0121.683] lstrlenW (lpString=".1cd") returned 4 [0121.772] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0121.772] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\WISC30.DLL") returned 66 [0121.772] lstrlenW (lpString=".jpg") returned 4 [0121.772] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0121.772] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\WISC30.DLL") returned 66 [0121.772] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\WISC30.DLL") returned 66 [0121.772] lstrlenW (lpString=".doc") returned 4 [0121.772] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0121.772] lstrlenW (lpString=".docx") returned 5 [0121.772] lstrcmpiW (lpString1=".docx", lpString2="0.DLL") returned -1 [0121.772] lstrlenW (lpString=".pdf") returned 4 [0121.772] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0121.772] lstrlenW (lpString=".xls") returned 4 [0121.772] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0121.772] lstrlenW (lpString=".xlsx") returned 5 [0121.772] lstrcmpiW (lpString1=".xlsx", lpString2="0.DLL") returned -1 [0121.772] lstrlenW (lpString=".ppt") returned 4 [0121.772] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0121.772] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\WISC30.DLL") returned 66 [0121.772] lstrlenW (lpString=".zip") returned 4 [0121.772] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0121.772] lstrlenW (lpString=".rar") returned 4 [0121.772] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0121.772] lstrlenW (lpString=".bz2") returned 4 [0121.772] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0121.772] lstrlenW (lpString=".7z") returned 3 [0121.772] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0121.772] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\WISC30.DLL") returned 66 [0121.772] lstrlenW (lpString=".dbf") returned 4 [0121.773] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0121.773] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\WISC30.DLL") returned 66 [0121.773] lstrlenW (lpString=".1cd") returned 4 [0121.773] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0121.773] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\WISC30.DLL") returned 66 [0121.773] lstrlenW (lpString=".jpg") returned 4 [0121.773] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0121.773] lstrcmpiW (lpString1=".DLL", lpString2=".waifu") returned -1 [0121.773] lstrlenW (lpString="OSPPCEXT.DLL") returned 12 [0121.773] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPCEXT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppcext.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0121.934] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x30afb3c | out: lpFileSize=0x30afb3c*=1828608) returned 1 [0121.934] CloseHandle (hObject=0x1f0) returned 1 [0121.934] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPCEXT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppcext.dll")) returned 0x20 [0121.934] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPCEXT.DLL.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppcext.dll.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0121.934] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPCEXT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppcext.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPCEXT.DLL.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppcext.dll.id-9c354b42.[darknes@420blaze.it].waifu")) returned 1 [0121.935] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPCEXT.DLL.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppcext.dll.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0121.935] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30af88c | out: lpNewFilePointer=0x0) returned 1 [0121.935] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30af84c | out: lpNewFilePointer=0x0) returned 1 [0121.935] ReadFile (in: hFile=0x1f0, lpBuffer=0x3f00058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x30af858, lpOverlapped=0x0 | out: lpBuffer=0x3f00058*, lpNumberOfBytesRead=0x30af858*=0x40000, lpOverlapped=0x0) returned 1 [0121.972] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x94d00, lpNewFilePointer=0x0, dwMoveMethod=0x30af84c | out: lpNewFilePointer=0x0) returned 1 [0121.972] ReadFile (in: hFile=0x1f0, lpBuffer=0x3f40058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x30af858, lpOverlapped=0x0 | out: lpBuffer=0x3f40058*, lpNumberOfBytesRead=0x30af858*=0x40000, lpOverlapped=0x0) returned 1 [0122.057] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x30af88c | out: lpNewFilePointer=0xffffffff) returned 1 [0122.057] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x17e700, lpNewFilePointer=0x0, dwMoveMethod=0x30af84c | out: lpNewFilePointer=0x0) returned 1 [0122.057] ReadFile (in: hFile=0x1f0, lpBuffer=0x3f80058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x30af858, lpOverlapped=0x0 | out: lpBuffer=0x3f80058*, lpNumberOfBytesRead=0x30af858*=0x40000, lpOverlapped=0x0) returned 1 [0122.222] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30afae8 | out: lpNewFilePointer=0x0) returned 1 [0122.222] WriteFile (in: hFile=0x1f0, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x30af8d0, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x30af8d0*=0xc0104, lpOverlapped=0x0) returned 1 [0122.231] SetEndOfFile (hFile=0x1f0) returned 1 [0122.233] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30af89c | out: lpNewFilePointer=0x0) returned 1 [0122.233] WriteFile (in: hFile=0x1f0, lpBuffer=0x44b2070*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x30af8a8, lpOverlapped=0x0 | out: lpBuffer=0x44b2070*, lpNumberOfBytesWritten=0x30af8a8*=0x40000, lpOverlapped=0x0) returned 1 [0122.234] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x94d00, lpNewFilePointer=0x0, dwMoveMethod=0x30af89c | out: lpNewFilePointer=0x0) returned 1 [0122.234] WriteFile (in: hFile=0x1f0, lpBuffer=0x44b2070*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x30af8a8, lpOverlapped=0x0 | out: lpBuffer=0x44b2070*, lpNumberOfBytesWritten=0x30af8a8*=0x40000, lpOverlapped=0x0) returned 1 [0122.236] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x17e700, lpNewFilePointer=0x0, dwMoveMethod=0x30af89c | out: lpNewFilePointer=0x0) returned 1 [0122.236] WriteFile (in: hFile=0x1f0, lpBuffer=0x44b2070*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x30af8a8, lpOverlapped=0x0 | out: lpBuffer=0x44b2070*, lpNumberOfBytesWritten=0x30af8a8*=0x40000, lpOverlapped=0x0) returned 1 [0122.238] CloseHandle (hObject=0x1f0) returned 1 [0122.238] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPCEXT.DLL.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0122.238] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPCEXT.DLL") returned 92 [0122.238] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPCEXT.DLL") returned 92 [0122.238] lstrlenW (lpString=".doc") returned 4 [0122.238] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0122.238] lstrlenW (lpString=".docx") returned 5 [0122.238] lstrcmpiW (lpString1=".docx", lpString2="T.DLL") returned -1 [0122.238] lstrlenW (lpString=".pdf") returned 4 [0122.238] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0122.238] lstrlenW (lpString=".xls") returned 4 [0122.238] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0122.238] lstrlenW (lpString=".xlsx") returned 5 [0122.238] lstrcmpiW (lpString1=".xlsx", lpString2="T.DLL") returned -1 [0122.238] lstrlenW (lpString=".ppt") returned 4 [0122.238] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0122.238] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPCEXT.DLL") returned 92 [0122.238] lstrlenW (lpString=".zip") returned 4 [0122.238] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0122.238] lstrlenW (lpString=".rar") returned 4 [0122.238] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0122.238] lstrlenW (lpString=".bz2") returned 4 [0122.238] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0122.238] lstrlenW (lpString=".7z") returned 3 [0122.238] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0122.238] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPCEXT.DLL") returned 92 [0122.238] lstrlenW (lpString=".dbf") returned 4 [0122.238] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0122.238] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPCEXT.DLL") returned 92 [0122.238] lstrlenW (lpString=".1cd") returned 4 [0122.238] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0122.238] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPCEXT.DLL") returned 92 [0122.238] lstrlenW (lpString=".jpg") returned 4 [0122.239] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0122.239] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPCEXT.DLL") returned 92 [0122.239] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPCEXT.DLL") returned 92 [0122.239] lstrlenW (lpString=".doc") returned 4 [0122.239] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0122.239] lstrlenW (lpString=".docx") returned 5 [0122.239] lstrcmpiW (lpString1=".docx", lpString2="T.DLL") returned -1 [0122.239] lstrlenW (lpString=".pdf") returned 4 [0122.239] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0122.239] lstrlenW (lpString=".xls") returned 4 [0122.239] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0122.239] lstrlenW (lpString=".xlsx") returned 5 [0122.239] lstrcmpiW (lpString1=".xlsx", lpString2="T.DLL") returned -1 [0122.239] lstrlenW (lpString=".ppt") returned 4 [0122.239] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0122.239] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPCEXT.DLL") returned 92 [0122.239] lstrlenW (lpString=".zip") returned 4 [0122.239] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0122.239] lstrlenW (lpString=".rar") returned 4 [0122.239] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0122.239] lstrlenW (lpString=".bz2") returned 4 [0122.239] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0122.239] lstrlenW (lpString=".7z") returned 3 [0122.239] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0122.239] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPCEXT.DLL") returned 92 [0122.239] lstrlenW (lpString=".dbf") returned 4 [0122.239] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0122.239] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPCEXT.DLL") returned 92 [0122.239] lstrlenW (lpString=".1cd") returned 4 [0122.239] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0122.239] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPCEXT.DLL") returned 92 [0122.239] lstrlenW (lpString=".jpg") returned 4 [0122.239] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0122.239] lstrcmpiW (lpString1=".MOF", lpString2=".waifu") returned -1 [0122.239] lstrlenW (lpString="OSPPWMI.MOF") returned 11 [0122.239] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.MOF" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppwmi.mof"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0122.240] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x30afb3c | out: lpFileSize=0x30afb3c*=47710) returned 1 [0122.240] CloseHandle (hObject=0x1f0) returned 1 [0122.240] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.MOF" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppwmi.mof")) returned 0x20 [0122.240] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.MOF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppwmi.mof.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0122.240] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.MOF" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppwmi.mof"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0122.240] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30afae8 | out: lpNewFilePointer=0x0) returned 1 [0122.240] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30afae8 | out: lpNewFilePointer=0x0) returned 1 [0122.240] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.MOF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppwmi.mof.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0122.240] GetLastError () returned 0x0 [0122.240] ReadFile (in: hFile=0x1f0, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30afaf4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x30afaf4*=0xba5e, lpOverlapped=0x0) returned 1 [0122.322] WriteFile (in: hFile=0x218, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0xba60, lpNumberOfBytesWritten=0x30af8bc, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x30af8bc*=0xba60, lpOverlapped=0x0) returned 1 [0122.323] ReadFile (in: hFile=0x1f0, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30afaf4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x30afaf4*=0x0, lpOverlapped=0x0) returned 1 [0122.323] WriteFile (in: hFile=0x218, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x30af8bc, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x30af8bc*=0xea, lpOverlapped=0x0) returned 1 [0122.324] SetEndOfFile (hFile=0x218) returned 1 [0122.324] CloseHandle (hObject=0x218) returned 1 [0122.324] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30afae8 | out: lpNewFilePointer=0x0) returned 1 [0122.324] SetEndOfFile (hFile=0x1f0) returned 1 [0122.324] CloseHandle (hObject=0x1f0) returned 1 [0122.325] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.MOF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0122.325] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.MOF" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppwmi.mof")) returned 1 [0122.325] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.MOF") returned 91 [0122.325] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.MOF") returned 91 [0122.325] lstrlenW (lpString=".doc") returned 4 [0122.325] lstrcmpiW (lpString1=".doc", lpString2=".MOF") returned -1 [0122.325] lstrlenW (lpString=".docx") returned 5 [0122.325] lstrcmpiW (lpString1=".docx", lpString2="I.MOF") returned -1 [0122.325] lstrlenW (lpString=".pdf") returned 4 [0122.325] lstrcmpiW (lpString1=".pdf", lpString2=".MOF") returned 1 [0122.325] lstrlenW (lpString=".xls") returned 4 [0122.325] lstrcmpiW (lpString1=".xls", lpString2=".MOF") returned 1 [0122.325] lstrlenW (lpString=".xlsx") returned 5 [0122.325] lstrcmpiW (lpString1=".xlsx", lpString2="I.MOF") returned -1 [0122.325] lstrlenW (lpString=".ppt") returned 4 [0122.325] lstrcmpiW (lpString1=".ppt", lpString2=".MOF") returned 1 [0122.325] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.MOF") returned 91 [0122.325] lstrlenW (lpString=".zip") returned 4 [0122.325] lstrcmpiW (lpString1=".zip", lpString2=".MOF") returned 1 [0122.325] lstrlenW (lpString=".rar") returned 4 [0122.325] lstrcmpiW (lpString1=".rar", lpString2=".MOF") returned 1 [0122.325] lstrlenW (lpString=".bz2") returned 4 [0122.325] lstrcmpiW (lpString1=".bz2", lpString2=".MOF") returned -1 [0122.325] lstrlenW (lpString=".7z") returned 3 [0122.325] lstrcmpiW (lpString1=".7z", lpString2="MOF") returned -1 [0122.325] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.MOF") returned 91 [0122.325] lstrlenW (lpString=".dbf") returned 4 [0122.325] lstrcmpiW (lpString1=".dbf", lpString2=".MOF") returned -1 [0122.326] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.MOF") returned 91 [0122.326] lstrlenW (lpString=".1cd") returned 4 [0122.326] lstrcmpiW (lpString1=".1cd", lpString2=".MOF") returned -1 [0122.326] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.MOF") returned 91 [0122.326] lstrlenW (lpString=".jpg") returned 4 [0122.326] lstrcmpiW (lpString1=".jpg", lpString2=".MOF") returned -1 [0122.326] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.MOF") returned 91 [0122.326] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.MOF") returned 91 [0122.326] lstrlenW (lpString=".doc") returned 4 [0122.326] lstrcmpiW (lpString1=".doc", lpString2=".MOF") returned -1 [0122.326] lstrlenW (lpString=".docx") returned 5 [0122.326] lstrcmpiW (lpString1=".docx", lpString2="I.MOF") returned -1 [0122.326] lstrlenW (lpString=".pdf") returned 4 [0122.326] lstrcmpiW (lpString1=".pdf", lpString2=".MOF") returned 1 [0122.326] lstrlenW (lpString=".xls") returned 4 [0122.326] lstrcmpiW (lpString1=".xls", lpString2=".MOF") returned 1 [0122.326] lstrlenW (lpString=".xlsx") returned 5 [0122.326] lstrcmpiW (lpString1=".xlsx", lpString2="I.MOF") returned -1 [0122.326] lstrlenW (lpString=".ppt") returned 4 [0122.326] lstrcmpiW (lpString1=".ppt", lpString2=".MOF") returned 1 [0122.326] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.MOF") returned 91 [0122.326] lstrlenW (lpString=".zip") returned 4 [0122.326] lstrcmpiW (lpString1=".zip", lpString2=".MOF") returned 1 [0122.326] lstrlenW (lpString=".rar") returned 4 [0122.326] lstrcmpiW (lpString1=".rar", lpString2=".MOF") returned 1 [0122.326] lstrlenW (lpString=".bz2") returned 4 [0122.326] lstrcmpiW (lpString1=".bz2", lpString2=".MOF") returned -1 [0122.326] lstrlenW (lpString=".7z") returned 3 [0122.326] lstrcmpiW (lpString1=".7z", lpString2="MOF") returned -1 [0122.326] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.MOF") returned 91 [0122.326] lstrlenW (lpString=".dbf") returned 4 [0122.326] lstrcmpiW (lpString1=".dbf", lpString2=".MOF") returned -1 [0122.326] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.MOF") returned 91 [0122.326] lstrlenW (lpString=".1cd") returned 4 [0122.326] lstrcmpiW (lpString1=".1cd", lpString2=".MOF") returned -1 [0122.326] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.MOF") returned 91 [0122.326] lstrlenW (lpString=".jpg") returned 4 [0122.326] lstrcmpiW (lpString1=".jpg", lpString2=".MOF") returned -1 [0122.326] lstrcmpiW (lpString1=".LEX", lpString2=".waifu") returned -1 [0122.326] lstrlenW (lpString="MSWDS_ES.LEX") returned 12 [0122.327] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_ES.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_es.lex"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0122.362] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x30afb3c | out: lpFileSize=0x30afb3c*=395651) returned 1 [0122.362] CloseHandle (hObject=0x180) returned 1 [0122.362] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_ES.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_es.lex")) returned 0x20 [0122.362] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_ES.LEX.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_es.lex.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0122.362] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_ES.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_es.lex"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0122.362] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30afae8 | out: lpNewFilePointer=0x0) returned 1 [0122.362] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30afae8 | out: lpNewFilePointer=0x0) returned 1 [0122.362] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_ES.LEX.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_es.lex.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0122.362] GetLastError () returned 0x0 [0122.362] ReadFile (in: hFile=0x180, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30afaf4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x30afaf4*=0x60983, lpOverlapped=0x0) returned 1 [0122.406] WriteFile (in: hFile=0x1b0, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0x60990, lpNumberOfBytesWritten=0x30af8bc, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x30af8bc*=0x60990, lpOverlapped=0x0) returned 1 [0122.409] ReadFile (in: hFile=0x180, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30afaf4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x30afaf4*=0x0, lpOverlapped=0x0) returned 1 [0122.409] WriteFile (in: hFile=0x1b0, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x30af8bc, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x30af8bc*=0xec, lpOverlapped=0x0) returned 1 [0122.410] SetEndOfFile (hFile=0x1b0) returned 1 [0122.410] CloseHandle (hObject=0x1b0) returned 1 [0122.410] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30afae8 | out: lpNewFilePointer=0x0) returned 1 [0122.410] SetEndOfFile (hFile=0x180) returned 1 [0122.412] CloseHandle (hObject=0x180) returned 1 [0122.412] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_ES.LEX.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0122.425] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_ES.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_es.lex")) returned 1 [0122.425] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_ES.LEX") returned 65 [0122.425] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_ES.LEX") returned 65 [0122.425] lstrlenW (lpString=".doc") returned 4 [0122.425] lstrcmpiW (lpString1=".doc", lpString2=".LEX") returned -1 [0122.425] lstrlenW (lpString=".docx") returned 5 [0122.425] lstrcmpiW (lpString1=".docx", lpString2="S.LEX") returned -1 [0122.425] lstrlenW (lpString=".pdf") returned 4 [0122.425] lstrcmpiW (lpString1=".pdf", lpString2=".LEX") returned 1 [0122.425] lstrlenW (lpString=".xls") returned 4 [0122.425] lstrcmpiW (lpString1=".xls", lpString2=".LEX") returned 1 [0122.425] lstrlenW (lpString=".xlsx") returned 5 [0122.425] lstrcmpiW (lpString1=".xlsx", lpString2="S.LEX") returned -1 [0122.425] lstrlenW (lpString=".ppt") returned 4 [0122.425] lstrcmpiW (lpString1=".ppt", lpString2=".LEX") returned 1 [0122.425] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_ES.LEX") returned 65 [0122.425] lstrlenW (lpString=".zip") returned 4 [0122.425] lstrcmpiW (lpString1=".zip", lpString2=".LEX") returned 1 [0122.425] lstrlenW (lpString=".rar") returned 4 [0122.425] lstrcmpiW (lpString1=".rar", lpString2=".LEX") returned 1 [0122.425] lstrlenW (lpString=".bz2") returned 4 [0122.426] lstrcmpiW (lpString1=".bz2", lpString2=".LEX") returned -1 [0122.426] lstrlenW (lpString=".7z") returned 3 [0122.426] lstrcmpiW (lpString1=".7z", lpString2="LEX") returned -1 [0122.426] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_ES.LEX") returned 65 [0122.426] lstrlenW (lpString=".dbf") returned 4 [0122.426] lstrcmpiW (lpString1=".dbf", lpString2=".LEX") returned -1 [0122.426] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_ES.LEX") returned 65 [0122.426] lstrlenW (lpString=".1cd") returned 4 [0122.426] lstrcmpiW (lpString1=".1cd", lpString2=".LEX") returned -1 [0122.426] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_ES.LEX") returned 65 [0122.426] lstrlenW (lpString=".jpg") returned 4 [0122.426] lstrcmpiW (lpString1=".jpg", lpString2=".LEX") returned -1 [0122.426] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_ES.LEX") returned 65 [0122.426] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_ES.LEX") returned 65 [0122.426] lstrlenW (lpString=".doc") returned 4 [0122.426] lstrcmpiW (lpString1=".doc", lpString2=".LEX") returned -1 [0122.426] lstrlenW (lpString=".docx") returned 5 [0122.426] lstrcmpiW (lpString1=".docx", lpString2="S.LEX") returned -1 [0122.426] lstrlenW (lpString=".pdf") returned 4 [0122.426] lstrcmpiW (lpString1=".pdf", lpString2=".LEX") returned 1 [0122.426] lstrlenW (lpString=".xls") returned 4 [0122.426] lstrcmpiW (lpString1=".xls", lpString2=".LEX") returned 1 [0122.426] lstrlenW (lpString=".xlsx") returned 5 [0122.426] lstrcmpiW (lpString1=".xlsx", lpString2="S.LEX") returned -1 [0122.426] lstrlenW (lpString=".ppt") returned 4 [0122.426] lstrcmpiW (lpString1=".ppt", lpString2=".LEX") returned 1 [0122.426] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_ES.LEX") returned 65 [0122.426] lstrlenW (lpString=".zip") returned 4 [0122.426] lstrcmpiW (lpString1=".zip", lpString2=".LEX") returned 1 [0122.426] lstrlenW (lpString=".rar") returned 4 [0122.426] lstrcmpiW (lpString1=".rar", lpString2=".LEX") returned 1 [0122.426] lstrlenW (lpString=".bz2") returned 4 [0122.426] lstrcmpiW (lpString1=".bz2", lpString2=".LEX") returned -1 [0122.426] lstrlenW (lpString=".7z") returned 3 [0122.426] lstrcmpiW (lpString1=".7z", lpString2="LEX") returned -1 [0122.426] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_ES.LEX") returned 65 [0122.426] lstrlenW (lpString=".dbf") returned 4 [0122.426] lstrcmpiW (lpString1=".dbf", lpString2=".LEX") returned -1 [0122.426] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_ES.LEX") returned 65 [0122.426] lstrlenW (lpString=".1cd") returned 4 [0122.426] lstrcmpiW (lpString1=".1cd", lpString2=".LEX") returned -1 [0122.426] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_ES.LEX") returned 65 [0122.426] lstrlenW (lpString=".jpg") returned 4 [0122.426] lstrcmpiW (lpString1=".jpg", lpString2=".LEX") returned -1 [0122.426] lstrcmpiW (lpString1=".LEX", lpString2=".waifu") returned -1 [0122.427] lstrlenW (lpString="MSWDS_FR.LEX") returned 12 [0122.427] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_FR.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_fr.lex"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0122.920] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x30afb3c | out: lpFileSize=0x30afb3c*=295663) returned 1 [0122.920] CloseHandle (hObject=0x20c) returned 1 [0122.920] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_FR.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_fr.lex")) returned 0x20 [0122.920] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_FR.LEX.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_fr.lex.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0122.920] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_FR.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_fr.lex"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0122.920] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30afae8 | out: lpNewFilePointer=0x0) returned 1 [0122.920] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30afae8 | out: lpNewFilePointer=0x0) returned 1 [0122.920] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_FR.LEX.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_fr.lex.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x23c [0122.921] GetLastError () returned 0x0 [0122.921] ReadFile (in: hFile=0x20c, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30afaf4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x30afaf4*=0x482ef, lpOverlapped=0x0) returned 1 [0123.204] WriteFile (in: hFile=0x23c, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0x482f0, lpNumberOfBytesWritten=0x30af8bc, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x30af8bc*=0x482f0, lpOverlapped=0x0) returned 1 [0123.207] ReadFile (in: hFile=0x20c, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30afaf4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x30afaf4*=0x0, lpOverlapped=0x0) returned 1 [0123.207] WriteFile (in: hFile=0x23c, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x30af8bc, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x30af8bc*=0xec, lpOverlapped=0x0) returned 1 [0123.207] SetEndOfFile (hFile=0x23c) returned 1 [0123.208] CloseHandle (hObject=0x23c) returned 1 [0123.208] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30afae8 | out: lpNewFilePointer=0x0) returned 1 [0123.208] SetEndOfFile (hFile=0x20c) returned 1 [0123.209] CloseHandle (hObject=0x20c) returned 1 [0123.209] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_FR.LEX.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0123.209] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_FR.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_fr.lex")) returned 1 [0123.209] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_FR.LEX") returned 65 [0123.209] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_FR.LEX") returned 65 [0123.209] lstrlenW (lpString=".doc") returned 4 [0123.209] lstrcmpiW (lpString1=".doc", lpString2=".LEX") returned -1 [0123.209] lstrlenW (lpString=".docx") returned 5 [0123.209] lstrcmpiW (lpString1=".docx", lpString2="R.LEX") returned -1 [0123.209] lstrlenW (lpString=".pdf") returned 4 [0123.209] lstrcmpiW (lpString1=".pdf", lpString2=".LEX") returned 1 [0123.209] lstrlenW (lpString=".xls") returned 4 [0123.209] lstrcmpiW (lpString1=".xls", lpString2=".LEX") returned 1 [0123.209] lstrlenW (lpString=".xlsx") returned 5 [0123.209] lstrcmpiW (lpString1=".xlsx", lpString2="R.LEX") returned -1 [0123.209] lstrlenW (lpString=".ppt") returned 4 [0123.209] lstrcmpiW (lpString1=".ppt", lpString2=".LEX") returned 1 [0123.210] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_FR.LEX") returned 65 [0123.210] lstrlenW (lpString=".zip") returned 4 [0123.210] lstrcmpiW (lpString1=".zip", lpString2=".LEX") returned 1 [0123.210] lstrlenW (lpString=".rar") returned 4 [0123.210] lstrcmpiW (lpString1=".rar", lpString2=".LEX") returned 1 [0123.210] lstrlenW (lpString=".bz2") returned 4 [0123.210] lstrcmpiW (lpString1=".bz2", lpString2=".LEX") returned -1 [0123.210] lstrlenW (lpString=".7z") returned 3 [0123.210] lstrcmpiW (lpString1=".7z", lpString2="LEX") returned -1 [0123.210] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_FR.LEX") returned 65 [0123.210] lstrlenW (lpString=".dbf") returned 4 [0123.210] lstrcmpiW (lpString1=".dbf", lpString2=".LEX") returned -1 [0123.210] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_FR.LEX") returned 65 [0123.210] lstrlenW (lpString=".1cd") returned 4 [0123.210] lstrcmpiW (lpString1=".1cd", lpString2=".LEX") returned -1 [0123.210] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_FR.LEX") returned 65 [0123.210] lstrlenW (lpString=".jpg") returned 4 [0123.210] lstrcmpiW (lpString1=".jpg", lpString2=".LEX") returned -1 [0123.210] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_FR.LEX") returned 65 [0123.210] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_FR.LEX") returned 65 [0123.210] lstrlenW (lpString=".doc") returned 4 [0123.210] lstrcmpiW (lpString1=".doc", lpString2=".LEX") returned -1 [0123.210] lstrlenW (lpString=".docx") returned 5 [0123.210] lstrcmpiW (lpString1=".docx", lpString2="R.LEX") returned -1 [0123.210] lstrlenW (lpString=".pdf") returned 4 [0123.210] lstrcmpiW (lpString1=".pdf", lpString2=".LEX") returned 1 [0123.210] lstrlenW (lpString=".xls") returned 4 [0123.210] lstrcmpiW (lpString1=".xls", lpString2=".LEX") returned 1 [0123.210] lstrlenW (lpString=".xlsx") returned 5 [0123.210] lstrcmpiW (lpString1=".xlsx", lpString2="R.LEX") returned -1 [0123.210] lstrlenW (lpString=".ppt") returned 4 [0123.210] lstrcmpiW (lpString1=".ppt", lpString2=".LEX") returned 1 [0123.210] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_FR.LEX") returned 65 [0123.210] lstrlenW (lpString=".zip") returned 4 [0123.210] lstrcmpiW (lpString1=".zip", lpString2=".LEX") returned 1 [0123.210] lstrlenW (lpString=".rar") returned 4 [0123.210] lstrcmpiW (lpString1=".rar", lpString2=".LEX") returned 1 [0123.210] lstrlenW (lpString=".bz2") returned 4 [0123.210] lstrcmpiW (lpString1=".bz2", lpString2=".LEX") returned -1 [0123.210] lstrlenW (lpString=".7z") returned 3 [0123.210] lstrcmpiW (lpString1=".7z", lpString2="LEX") returned -1 [0123.210] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_FR.LEX") returned 65 [0123.210] lstrlenW (lpString=".dbf") returned 4 [0123.210] lstrcmpiW (lpString1=".dbf", lpString2=".LEX") returned -1 [0123.210] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_FR.LEX") returned 65 [0123.210] lstrlenW (lpString=".1cd") returned 4 [0123.210] lstrcmpiW (lpString1=".1cd", lpString2=".LEX") returned -1 [0123.210] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_FR.LEX") returned 65 [0123.210] lstrlenW (lpString=".jpg") returned 4 [0123.210] lstrcmpiW (lpString1=".jpg", lpString2=".LEX") returned -1 [0123.211] lstrcmpiW (lpString1=".INF", lpString2=".waifu") returned -1 [0123.211] lstrlenW (lpString="BLUECALM.INF") returned 12 [0123.211] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\bluecalm.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0123.211] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x30afb3c | out: lpFileSize=0x30afb3c*=551) returned 1 [0123.211] CloseHandle (hObject=0x20c) returned 1 [0123.211] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\bluecalm.inf")) returned 0x20 [0123.211] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\bluecalm.inf.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0123.211] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\bluecalm.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0123.211] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30afae8 | out: lpNewFilePointer=0x0) returned 1 [0123.211] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30afae8 | out: lpNewFilePointer=0x0) returned 1 [0123.211] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\bluecalm.inf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0123.222] GetLastError () returned 0x0 [0123.222] ReadFile (in: hFile=0x20c, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30afaf4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x30afaf4*=0x227, lpOverlapped=0x0) returned 1 [0123.223] WriteFile (in: hFile=0x1a0, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0x230, lpNumberOfBytesWritten=0x30af8bc, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x30af8bc*=0x230, lpOverlapped=0x0) returned 1 [0123.224] ReadFile (in: hFile=0x20c, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30afaf4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x30afaf4*=0x0, lpOverlapped=0x0) returned 1 [0123.224] WriteFile (in: hFile=0x1a0, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x30af8bc, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x30af8bc*=0xec, lpOverlapped=0x0) returned 1 [0123.224] SetEndOfFile (hFile=0x1a0) returned 1 [0123.224] CloseHandle (hObject=0x1a0) returned 1 [0123.224] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30afae8 | out: lpNewFilePointer=0x0) returned 1 [0123.224] SetEndOfFile (hFile=0x20c) returned 1 [0123.224] CloseHandle (hObject=0x20c) returned 1 [0123.224] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0123.225] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\bluecalm.inf")) returned 1 [0123.225] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF") returned 77 [0123.225] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF") returned 77 [0123.225] lstrlenW (lpString=".doc") returned 4 [0123.225] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1 [0123.225] lstrlenW (lpString=".docx") returned 5 [0123.225] lstrcmpiW (lpString1=".docx", lpString2="M.INF") returned -1 [0123.225] lstrlenW (lpString=".pdf") returned 4 [0123.225] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1 [0123.225] lstrlenW (lpString=".xls") returned 4 [0123.225] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1 [0123.225] lstrlenW (lpString=".xlsx") returned 5 [0123.225] lstrcmpiW (lpString1=".xlsx", lpString2="M.INF") returned -1 [0123.225] lstrlenW (lpString=".ppt") returned 4 [0123.225] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1 [0123.225] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF") returned 77 [0123.225] lstrlenW (lpString=".zip") returned 4 [0123.225] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1 [0123.225] lstrlenW (lpString=".rar") returned 4 [0123.225] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1 [0123.225] lstrlenW (lpString=".bz2") returned 4 [0123.225] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1 [0123.225] lstrlenW (lpString=".7z") returned 3 [0123.225] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1 [0123.225] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF") returned 77 [0123.225] lstrlenW (lpString=".dbf") returned 4 [0123.225] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1 [0123.225] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF") returned 77 [0123.225] lstrlenW (lpString=".1cd") returned 4 [0123.225] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1 [0123.225] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF") returned 77 [0123.225] lstrlenW (lpString=".jpg") returned 4 [0123.225] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1 [0123.225] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF") returned 77 [0123.225] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF") returned 77 [0123.225] lstrlenW (lpString=".doc") returned 4 [0123.225] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1 [0123.225] lstrlenW (lpString=".docx") returned 5 [0123.226] lstrcmpiW (lpString1=".docx", lpString2="M.INF") returned -1 [0123.226] lstrlenW (lpString=".pdf") returned 4 [0123.226] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1 [0123.226] lstrlenW (lpString=".xls") returned 4 [0123.226] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1 [0123.226] lstrlenW (lpString=".xlsx") returned 5 [0123.226] lstrcmpiW (lpString1=".xlsx", lpString2="M.INF") returned -1 [0123.226] lstrlenW (lpString=".ppt") returned 4 [0123.226] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1 [0123.226] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF") returned 77 [0123.226] lstrlenW (lpString=".zip") returned 4 [0123.226] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1 [0123.226] lstrlenW (lpString=".rar") returned 4 [0123.226] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1 [0123.226] lstrlenW (lpString=".bz2") returned 4 [0123.226] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1 [0123.226] lstrlenW (lpString=".7z") returned 3 [0123.226] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1 [0123.226] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF") returned 77 [0123.226] lstrlenW (lpString=".dbf") returned 4 [0123.226] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1 [0123.226] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF") returned 77 [0123.226] lstrlenW (lpString=".1cd") returned 4 [0123.226] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1 [0123.226] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF") returned 77 [0123.226] lstrlenW (lpString=".jpg") returned 4 [0123.226] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1 [0123.226] lstrcmpiW (lpString1=".INF", lpString2=".waifu") returned -1 [0123.226] lstrlenW (lpString="BLUEPRNT.INF") returned 12 [0123.226] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\blueprnt.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0123.252] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x30afb3c | out: lpFileSize=0x30afb3c*=549) returned 1 [0123.252] CloseHandle (hObject=0x1f0) returned 1 [0123.252] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\blueprnt.inf")) returned 0x20 [0123.252] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\blueprnt.inf.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0123.252] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\blueprnt.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0123.252] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30afae8 | out: lpNewFilePointer=0x0) returned 1 [0123.252] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30afae8 | out: lpNewFilePointer=0x0) returned 1 [0123.252] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\blueprnt.inf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x23c [0123.253] GetLastError () returned 0x0 [0123.253] ReadFile (in: hFile=0x1f0, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30afaf4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x30afaf4*=0x225, lpOverlapped=0x0) returned 1 [0123.253] WriteFile (in: hFile=0x23c, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0x230, lpNumberOfBytesWritten=0x30af8bc, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x30af8bc*=0x230, lpOverlapped=0x0) returned 1 [0123.254] ReadFile (in: hFile=0x1f0, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30afaf4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x30afaf4*=0x0, lpOverlapped=0x0) returned 1 [0123.254] WriteFile (in: hFile=0x23c, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x30af8bc, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x30af8bc*=0xec, lpOverlapped=0x0) returned 1 [0123.254] SetEndOfFile (hFile=0x23c) returned 1 [0123.254] CloseHandle (hObject=0x23c) returned 1 [0123.254] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30afae8 | out: lpNewFilePointer=0x0) returned 1 [0123.254] SetEndOfFile (hFile=0x1f0) returned 1 [0123.255] CloseHandle (hObject=0x1f0) returned 1 [0123.255] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0123.255] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\blueprnt.inf")) returned 1 [0123.255] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF") returned 77 [0123.255] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF") returned 77 [0123.255] lstrlenW (lpString=".doc") returned 4 [0123.255] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1 [0123.255] lstrlenW (lpString=".docx") returned 5 [0123.255] lstrcmpiW (lpString1=".docx", lpString2="T.INF") returned -1 [0123.255] lstrlenW (lpString=".pdf") returned 4 [0123.255] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1 [0123.255] lstrlenW (lpString=".xls") returned 4 [0123.255] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1 [0123.255] lstrlenW (lpString=".xlsx") returned 5 [0123.255] lstrcmpiW (lpString1=".xlsx", lpString2="T.INF") returned -1 [0123.255] lstrlenW (lpString=".ppt") returned 4 [0123.255] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1 [0123.255] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF") returned 77 [0123.255] lstrlenW (lpString=".zip") returned 4 [0123.255] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1 [0123.255] lstrlenW (lpString=".rar") returned 4 [0123.255] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1 [0123.256] lstrlenW (lpString=".bz2") returned 4 [0123.256] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1 [0123.256] lstrlenW (lpString=".7z") returned 3 [0123.256] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1 [0123.256] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF") returned 77 [0123.256] lstrlenW (lpString=".dbf") returned 4 [0123.256] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1 [0123.256] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF") returned 77 [0123.256] lstrlenW (lpString=".1cd") returned 4 [0123.256] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1 [0123.256] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF") returned 77 [0123.256] lstrlenW (lpString=".jpg") returned 4 [0123.256] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1 [0123.256] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF") returned 77 [0123.256] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF") returned 77 [0123.256] lstrlenW (lpString=".doc") returned 4 [0123.256] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1 [0123.256] lstrlenW (lpString=".docx") returned 5 [0123.256] lstrcmpiW (lpString1=".docx", lpString2="T.INF") returned -1 [0123.256] lstrlenW (lpString=".pdf") returned 4 [0123.256] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1 [0123.256] lstrlenW (lpString=".xls") returned 4 [0123.256] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1 [0123.256] lstrlenW (lpString=".xlsx") returned 5 [0123.256] lstrcmpiW (lpString1=".xlsx", lpString2="T.INF") returned -1 [0123.256] lstrlenW (lpString=".ppt") returned 4 [0123.256] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1 [0123.256] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF") returned 77 [0123.256] lstrlenW (lpString=".zip") returned 4 [0123.256] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1 [0123.256] lstrlenW (lpString=".rar") returned 4 [0123.256] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1 [0123.256] lstrlenW (lpString=".bz2") returned 4 [0123.256] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1 [0123.256] lstrlenW (lpString=".7z") returned 3 [0123.256] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1 [0123.257] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF") returned 77 [0123.257] lstrlenW (lpString=".dbf") returned 4 [0123.257] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1 [0123.257] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF") returned 77 [0123.257] lstrlenW (lpString=".1cd") returned 4 [0123.257] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1 [0123.257] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF") returned 77 [0123.257] lstrlenW (lpString=".jpg") returned 4 [0123.257] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1 [0123.257] lstrcmpiW (lpString1=".INF", lpString2=".waifu") returned -1 [0123.257] lstrlenW (lpString="BREEZE.INF") returned 10 [0123.257] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\breeze.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0123.261] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x30afb3c | out: lpFileSize=0x30afb3c*=450) returned 1 [0123.261] CloseHandle (hObject=0x220) returned 1 [0123.261] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\breeze.inf")) returned 0x20 [0123.261] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\breeze.inf.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0123.261] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\breeze.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0123.261] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30afae8 | out: lpNewFilePointer=0x0) returned 1 [0123.261] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30afae8 | out: lpNewFilePointer=0x0) returned 1 [0123.261] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\breeze.inf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0123.262] GetLastError () returned 0x0 [0123.262] ReadFile (in: hFile=0x220, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30afaf4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x30afaf4*=0x1c2, lpOverlapped=0x0) returned 1 [0123.263] WriteFile (in: hFile=0x1e0, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x30af8bc, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x30af8bc*=0x1d0, lpOverlapped=0x0) returned 1 [0123.263] ReadFile (in: hFile=0x220, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30afaf4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x30afaf4*=0x0, lpOverlapped=0x0) returned 1 [0123.263] WriteFile (in: hFile=0x1e0, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x30af8bc, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x30af8bc*=0xe8, lpOverlapped=0x0) returned 1 [0123.264] SetEndOfFile (hFile=0x1e0) returned 1 [0123.264] CloseHandle (hObject=0x1e0) returned 1 [0123.264] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30afae8 | out: lpNewFilePointer=0x0) returned 1 [0123.264] SetEndOfFile (hFile=0x220) returned 1 [0123.264] CloseHandle (hObject=0x220) returned 1 [0123.264] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0123.264] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\breeze.inf")) returned 1 [0123.265] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF") returned 73 [0123.265] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF") returned 73 [0123.265] lstrlenW (lpString=".doc") returned 4 [0123.265] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1 [0123.265] lstrlenW (lpString=".docx") returned 5 [0123.265] lstrcmpiW (lpString1=".docx", lpString2="E.INF") returned -1 [0123.265] lstrlenW (lpString=".pdf") returned 4 [0123.265] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1 [0123.265] lstrlenW (lpString=".xls") returned 4 [0123.265] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1 [0123.265] lstrlenW (lpString=".xlsx") returned 5 [0123.265] lstrcmpiW (lpString1=".xlsx", lpString2="E.INF") returned -1 [0123.265] lstrlenW (lpString=".ppt") returned 4 [0123.265] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1 [0123.265] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF") returned 73 [0123.265] lstrlenW (lpString=".zip") returned 4 [0123.265] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1 [0123.265] lstrlenW (lpString=".rar") returned 4 [0123.265] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1 [0123.265] lstrlenW (lpString=".bz2") returned 4 [0123.265] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1 [0123.265] lstrlenW (lpString=".7z") returned 3 [0123.265] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1 [0123.265] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF") returned 73 [0123.265] lstrlenW (lpString=".dbf") returned 4 [0123.265] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1 [0123.265] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF") returned 73 [0123.265] lstrlenW (lpString=".1cd") returned 4 [0123.265] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1 [0123.265] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF") returned 73 [0123.265] lstrlenW (lpString=".jpg") returned 4 [0123.265] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1 [0123.265] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF") returned 73 [0123.265] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF") returned 73 [0123.265] lstrlenW (lpString=".doc") returned 4 [0123.265] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1 [0123.265] lstrlenW (lpString=".docx") returned 5 [0123.265] lstrcmpiW (lpString1=".docx", lpString2="E.INF") returned -1 [0123.265] lstrlenW (lpString=".pdf") returned 4 [0123.265] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1 [0123.265] lstrlenW (lpString=".xls") returned 4 [0123.265] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1 [0123.265] lstrlenW (lpString=".xlsx") returned 5 [0123.265] lstrcmpiW (lpString1=".xlsx", lpString2="E.INF") returned -1 [0123.265] lstrlenW (lpString=".ppt") returned 4 [0123.265] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1 [0123.265] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF") returned 73 [0123.266] lstrlenW (lpString=".zip") returned 4 [0123.266] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1 [0123.266] lstrlenW (lpString=".rar") returned 4 [0123.266] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1 [0123.266] lstrlenW (lpString=".bz2") returned 4 [0123.266] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1 [0123.266] lstrlenW (lpString=".7z") returned 3 [0123.266] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1 [0123.266] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF") returned 73 [0123.266] lstrlenW (lpString=".dbf") returned 4 [0123.266] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1 [0123.266] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF") returned 73 [0123.266] lstrlenW (lpString=".1cd") returned 4 [0123.266] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1 [0123.266] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF") returned 73 [0123.266] lstrlenW (lpString=".jpg") returned 4 [0123.266] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1 [0123.266] lstrcmpiW (lpString1=".ELM", lpString2=".waifu") returned -1 [0123.266] lstrlenW (lpString="CANYON.ELM") returned 10 [0123.266] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\canyon.elm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0123.266] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x30afb3c | out: lpFileSize=0x30afb3c*=44745) returned 1 [0123.266] CloseHandle (hObject=0x220) returned 1 [0123.266] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\canyon.elm")) returned 0x20 [0123.267] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\canyon.elm.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0123.267] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\canyon.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0123.267] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30afae8 | out: lpNewFilePointer=0x0) returned 1 [0123.267] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30afae8 | out: lpNewFilePointer=0x0) returned 1 [0123.267] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\canyon.elm.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0123.267] GetLastError () returned 0x0 [0123.267] ReadFile (in: hFile=0x220, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30afaf4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x30afaf4*=0xaec9, lpOverlapped=0x0) returned 1 [0123.287] WriteFile (in: hFile=0x1e0, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0xaed0, lpNumberOfBytesWritten=0x30af8bc, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x30af8bc*=0xaed0, lpOverlapped=0x0) returned 1 [0123.288] ReadFile (in: hFile=0x220, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30afaf4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x30afaf4*=0x0, lpOverlapped=0x0) returned 1 [0123.288] WriteFile (in: hFile=0x1e0, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x30af8bc, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x30af8bc*=0xe8, lpOverlapped=0x0) returned 1 [0123.288] SetEndOfFile (hFile=0x1e0) returned 1 [0123.288] CloseHandle (hObject=0x1e0) returned 1 [0123.288] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30afae8 | out: lpNewFilePointer=0x0) returned 1 [0123.288] SetEndOfFile (hFile=0x220) returned 1 [0123.289] CloseHandle (hObject=0x220) returned 1 [0123.289] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0123.289] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\canyon.elm")) returned 1 [0123.375] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM") returned 73 [0123.375] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM") returned 73 [0123.375] lstrlenW (lpString=".doc") returned 4 [0123.375] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1 [0123.375] lstrlenW (lpString=".docx") returned 5 [0123.375] lstrcmpiW (lpString1=".docx", lpString2="N.ELM") returned -1 [0123.375] lstrlenW (lpString=".pdf") returned 4 [0123.375] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1 [0123.375] lstrlenW (lpString=".xls") returned 4 [0123.375] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1 [0123.375] lstrlenW (lpString=".xlsx") returned 5 [0123.375] lstrcmpiW (lpString1=".xlsx", lpString2="N.ELM") returned -1 [0123.375] lstrlenW (lpString=".ppt") returned 4 [0123.375] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1 [0123.375] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM") returned 73 [0123.375] lstrlenW (lpString=".zip") returned 4 [0123.375] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1 [0123.375] lstrlenW (lpString=".rar") returned 4 [0123.375] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1 [0123.375] lstrlenW (lpString=".bz2") returned 4 [0123.375] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1 [0123.375] lstrlenW (lpString=".7z") returned 3 [0123.375] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1 [0123.375] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM") returned 73 [0123.375] lstrlenW (lpString=".dbf") returned 4 [0123.375] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1 [0123.375] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM") returned 73 [0123.375] lstrlenW (lpString=".1cd") returned 4 [0123.375] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1 [0123.375] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM") returned 73 [0123.375] lstrlenW (lpString=".jpg") returned 4 [0123.375] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1 [0123.375] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM") returned 73 [0123.375] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM") returned 73 [0123.375] lstrlenW (lpString=".doc") returned 4 [0123.375] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1 [0123.375] lstrlenW (lpString=".docx") returned 5 [0123.375] lstrcmpiW (lpString1=".docx", lpString2="N.ELM") returned -1 [0123.375] lstrlenW (lpString=".pdf") returned 4 [0123.375] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1 [0123.375] lstrlenW (lpString=".xls") returned 4 [0123.375] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1 [0123.375] lstrlenW (lpString=".xlsx") returned 5 [0123.375] lstrcmpiW (lpString1=".xlsx", lpString2="N.ELM") returned -1 [0123.375] lstrlenW (lpString=".ppt") returned 4 [0123.375] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1 [0123.376] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM") returned 73 [0123.376] lstrlenW (lpString=".zip") returned 4 [0123.376] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1 [0123.376] lstrlenW (lpString=".rar") returned 4 [0123.376] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1 [0123.376] lstrlenW (lpString=".bz2") returned 4 [0123.376] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1 [0123.376] lstrlenW (lpString=".7z") returned 3 [0123.376] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1 [0123.376] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM") returned 73 [0123.376] lstrlenW (lpString=".dbf") returned 4 [0123.376] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1 [0123.376] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM") returned 73 [0123.376] lstrlenW (lpString=".1cd") returned 4 [0123.376] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1 [0123.376] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM") returned 73 [0123.376] lstrlenW (lpString=".jpg") returned 4 [0123.376] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1 [0123.376] lstrcmpiW (lpString1=".ELM", lpString2=".waifu") returned -1 [0123.376] lstrlenW (lpString="CAPSULES.ELM") returned 12 [0123.376] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\capsules.elm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0123.377] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x30afb3c | out: lpFileSize=0x30afb3c*=57786) returned 1 [0123.377] CloseHandle (hObject=0x220) returned 1 [0123.377] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\capsules.elm")) returned 0x20 [0123.377] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\capsules.elm.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0123.377] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\capsules.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0123.377] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30afae8 | out: lpNewFilePointer=0x0) returned 1 [0123.377] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30afae8 | out: lpNewFilePointer=0x0) returned 1 [0123.377] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\capsules.elm.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0123.378] GetLastError () returned 0x0 [0123.378] ReadFile (in: hFile=0x220, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30afaf4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x30afaf4*=0xe1ba, lpOverlapped=0x0) returned 1 [0123.660] WriteFile (in: hFile=0x1e0, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0xe1c0, lpNumberOfBytesWritten=0x30af8bc, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x30af8bc*=0xe1c0, lpOverlapped=0x0) returned 1 [0124.059] ReadFile (in: hFile=0x220, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30afaf4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x30afaf4*=0x0, lpOverlapped=0x0) returned 1 [0124.059] WriteFile (in: hFile=0x1e0, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x30af8bc, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x30af8bc*=0xec, lpOverlapped=0x0) returned 1 [0124.059] SetEndOfFile (hFile=0x1e0) returned 1 [0124.068] CloseHandle (hObject=0x1e0) returned 1 [0124.068] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30afae8 | out: lpNewFilePointer=0x0) returned 1 [0124.068] SetEndOfFile (hFile=0x220) returned 1 [0124.069] CloseHandle (hObject=0x220) returned 1 [0124.069] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0124.069] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\capsules.elm")) returned 1 [0124.069] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM") returned 77 [0124.069] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM") returned 77 [0124.069] lstrlenW (lpString=".doc") returned 4 [0124.069] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1 [0124.069] lstrlenW (lpString=".docx") returned 5 [0124.069] lstrcmpiW (lpString1=".docx", lpString2="S.ELM") returned -1 [0124.069] lstrlenW (lpString=".pdf") returned 4 [0124.069] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1 [0124.069] lstrlenW (lpString=".xls") returned 4 [0124.069] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1 [0124.069] lstrlenW (lpString=".xlsx") returned 5 [0124.069] lstrcmpiW (lpString1=".xlsx", lpString2="S.ELM") returned -1 [0124.070] lstrlenW (lpString=".ppt") returned 4 [0124.070] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1 [0124.070] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM") returned 77 [0124.070] lstrlenW (lpString=".zip") returned 4 [0124.070] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1 [0124.070] lstrlenW (lpString=".rar") returned 4 [0124.070] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1 [0124.070] lstrlenW (lpString=".bz2") returned 4 [0124.070] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1 [0124.070] lstrlenW (lpString=".7z") returned 3 [0124.070] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1 [0124.070] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM") returned 77 [0124.070] lstrlenW (lpString=".dbf") returned 4 [0124.070] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1 [0124.070] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM") returned 77 [0124.070] lstrlenW (lpString=".1cd") returned 4 [0124.070] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1 [0124.070] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM") returned 77 [0124.070] lstrlenW (lpString=".jpg") returned 4 [0124.070] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1 [0124.070] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM") returned 77 [0124.070] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM") returned 77 [0124.070] lstrlenW (lpString=".doc") returned 4 [0124.070] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1 [0124.070] lstrlenW (lpString=".docx") returned 5 [0124.070] lstrcmpiW (lpString1=".docx", lpString2="S.ELM") returned -1 [0124.070] lstrlenW (lpString=".pdf") returned 4 [0124.070] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1 [0124.070] lstrlenW (lpString=".xls") returned 4 [0124.070] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1 [0124.070] lstrlenW (lpString=".xlsx") returned 5 [0124.070] lstrcmpiW (lpString1=".xlsx", lpString2="S.ELM") returned -1 [0124.070] lstrlenW (lpString=".ppt") returned 4 [0124.070] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1 [0124.070] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM") returned 77 [0124.070] lstrlenW (lpString=".zip") returned 4 [0124.070] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1 [0124.070] lstrlenW (lpString=".rar") returned 4 [0124.070] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1 [0124.070] lstrlenW (lpString=".bz2") returned 4 [0124.070] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1 [0124.070] lstrlenW (lpString=".7z") returned 3 [0124.070] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1 [0124.070] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM") returned 77 [0124.070] lstrlenW (lpString=".dbf") returned 4 [0124.070] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1 [0124.070] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM") returned 77 [0124.070] lstrlenW (lpString=".1cd") returned 4 [0124.071] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1 [0124.071] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM") returned 77 [0124.071] lstrlenW (lpString=".jpg") returned 4 [0124.071] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1 [0124.071] lstrcmpiW (lpString1=".INF", lpString2=".waifu") returned -1 [0124.071] lstrlenW (lpString="COMPASS.INF") returned 11 [0124.071] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\compass.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0124.071] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x30afb3c | out: lpFileSize=0x30afb3c*=486) returned 1 [0124.071] CloseHandle (hObject=0x220) returned 1 [0124.071] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\compass.inf")) returned 0x20 [0124.071] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\compass.inf.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0124.071] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\compass.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0124.071] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30afae8 | out: lpNewFilePointer=0x0) returned 1 [0124.071] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30afae8 | out: lpNewFilePointer=0x0) returned 1 [0124.071] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\compass.inf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0124.072] GetLastError () returned 0x0 [0124.072] ReadFile (in: hFile=0x220, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30afaf4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x30afaf4*=0x1e6, lpOverlapped=0x0) returned 1 [0124.072] WriteFile (in: hFile=0x1e0, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0x1f0, lpNumberOfBytesWritten=0x30af8bc, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x30af8bc*=0x1f0, lpOverlapped=0x0) returned 1 [0124.074] ReadFile (in: hFile=0x220, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30afaf4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x30afaf4*=0x0, lpOverlapped=0x0) returned 1 [0124.074] WriteFile (in: hFile=0x1e0, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x30af8bc, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x30af8bc*=0xea, lpOverlapped=0x0) returned 1 [0124.074] SetEndOfFile (hFile=0x1e0) returned 1 [0124.074] CloseHandle (hObject=0x1e0) returned 1 [0124.074] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30afae8 | out: lpNewFilePointer=0x0) returned 1 [0124.074] SetEndOfFile (hFile=0x220) returned 1 [0124.074] CloseHandle (hObject=0x220) returned 1 [0124.075] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0124.075] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\compass.inf")) returned 1 [0124.075] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF") returned 75 [0124.075] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF") returned 75 [0124.075] lstrlenW (lpString=".doc") returned 4 [0124.075] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1 [0124.075] lstrlenW (lpString=".docx") returned 5 [0124.075] lstrcmpiW (lpString1=".docx", lpString2="S.INF") returned -1 [0124.075] lstrlenW (lpString=".pdf") returned 4 [0124.075] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1 [0124.075] lstrlenW (lpString=".xls") returned 4 [0124.075] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1 [0124.075] lstrlenW (lpString=".xlsx") returned 5 [0124.075] lstrcmpiW (lpString1=".xlsx", lpString2="S.INF") returned -1 [0124.075] lstrlenW (lpString=".ppt") returned 4 [0124.075] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1 [0124.075] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF") returned 75 [0124.075] lstrlenW (lpString=".zip") returned 4 [0124.075] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1 [0124.075] lstrlenW (lpString=".rar") returned 4 [0124.075] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1 [0124.075] lstrlenW (lpString=".bz2") returned 4 [0124.075] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1 [0124.075] lstrlenW (lpString=".7z") returned 3 [0124.075] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1 [0124.075] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF") returned 75 [0124.075] lstrlenW (lpString=".dbf") returned 4 [0124.075] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1 [0124.075] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF") returned 75 [0124.075] lstrlenW (lpString=".1cd") returned 4 [0124.075] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1 [0124.075] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF") returned 75 [0124.075] lstrlenW (lpString=".jpg") returned 4 [0124.075] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1 [0124.076] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF") returned 75 [0124.076] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF") returned 75 [0124.076] lstrlenW (lpString=".doc") returned 4 [0124.076] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1 [0124.076] lstrlenW (lpString=".docx") returned 5 [0124.076] lstrcmpiW (lpString1=".docx", lpString2="S.INF") returned -1 [0124.076] lstrlenW (lpString=".pdf") returned 4 [0124.076] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1 [0124.076] lstrlenW (lpString=".xls") returned 4 [0124.076] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1 [0124.076] lstrlenW (lpString=".xlsx") returned 5 [0124.076] lstrcmpiW (lpString1=".xlsx", lpString2="S.INF") returned -1 [0124.076] lstrlenW (lpString=".ppt") returned 4 [0124.076] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1 [0124.076] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF") returned 75 [0124.076] lstrlenW (lpString=".zip") returned 4 [0124.076] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1 [0124.076] lstrlenW (lpString=".rar") returned 4 [0124.076] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1 [0124.076] lstrlenW (lpString=".bz2") returned 4 [0124.076] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1 [0124.076] lstrlenW (lpString=".7z") returned 3 [0124.076] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1 [0124.076] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF") returned 75 [0124.076] lstrlenW (lpString=".dbf") returned 4 [0124.076] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1 [0124.076] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF") returned 75 [0124.076] lstrlenW (lpString=".1cd") returned 4 [0124.076] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1 [0124.076] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF") returned 75 [0124.076] lstrlenW (lpString=".jpg") returned 4 [0124.076] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1 [0124.076] lstrcmpiW (lpString1=".ELM", lpString2=".waifu") returned -1 [0124.076] lstrlenW (lpString="CONCRETE.ELM") returned 12 [0124.076] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\concrete.elm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0124.077] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x30afb3c | out: lpFileSize=0x30afb3c*=45528) returned 1 [0124.077] CloseHandle (hObject=0x220) returned 1 [0124.077] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\concrete.elm")) returned 0x20 [0124.077] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\concrete.elm.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0124.077] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\concrete.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0124.078] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30afae8 | out: lpNewFilePointer=0x0) returned 1 [0124.141] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30afae8 | out: lpNewFilePointer=0x0) returned 1 [0124.141] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\concrete.elm.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0124.142] GetLastError () returned 0x0 [0124.142] ReadFile (in: hFile=0x220, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30afaf4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x30afaf4*=0xb1d8, lpOverlapped=0x0) returned 1 [0124.226] WriteFile (in: hFile=0x21c, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0xb1e0, lpNumberOfBytesWritten=0x30af8bc, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x30af8bc*=0xb1e0, lpOverlapped=0x0) returned 1 [0124.227] ReadFile (in: hFile=0x220, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30afaf4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x30afaf4*=0x0, lpOverlapped=0x0) returned 1 [0124.227] WriteFile (in: hFile=0x21c, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x30af8bc, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x30af8bc*=0xec, lpOverlapped=0x0) returned 1 [0124.227] SetEndOfFile (hFile=0x21c) returned 1 [0124.227] CloseHandle (hObject=0x21c) returned 1 [0124.227] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30afae8 | out: lpNewFilePointer=0x0) returned 1 [0124.227] SetEndOfFile (hFile=0x220) returned 1 [0124.228] CloseHandle (hObject=0x220) returned 1 [0124.228] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0124.228] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\concrete.elm")) returned 1 [0124.240] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM") returned 77 [0124.240] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM") returned 77 [0124.240] lstrlenW (lpString=".doc") returned 4 [0124.240] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1 [0124.240] lstrlenW (lpString=".docx") returned 5 [0124.240] lstrcmpiW (lpString1=".docx", lpString2="E.ELM") returned -1 [0124.240] lstrlenW (lpString=".pdf") returned 4 [0124.240] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1 [0124.240] lstrlenW (lpString=".xls") returned 4 [0124.240] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1 [0124.240] lstrlenW (lpString=".xlsx") returned 5 [0124.240] lstrcmpiW (lpString1=".xlsx", lpString2="E.ELM") returned -1 [0124.240] lstrlenW (lpString=".ppt") returned 4 [0124.240] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1 [0124.240] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM") returned 77 [0124.240] lstrlenW (lpString=".zip") returned 4 [0124.240] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1 [0124.240] lstrlenW (lpString=".rar") returned 4 [0124.240] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1 [0124.240] lstrlenW (lpString=".bz2") returned 4 [0124.241] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1 [0124.241] lstrlenW (lpString=".7z") returned 3 [0124.241] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1 [0124.241] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM") returned 77 [0124.241] lstrlenW (lpString=".dbf") returned 4 [0124.241] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1 [0124.241] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM") returned 77 [0124.241] lstrlenW (lpString=".1cd") returned 4 [0124.241] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1 [0124.241] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM") returned 77 [0124.241] lstrlenW (lpString=".jpg") returned 4 [0124.241] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1 [0124.241] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM") returned 77 [0124.241] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM") returned 77 [0124.241] lstrlenW (lpString=".doc") returned 4 [0124.241] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1 [0124.241] lstrlenW (lpString=".docx") returned 5 [0124.241] lstrcmpiW (lpString1=".docx", lpString2="E.ELM") returned -1 [0124.241] lstrlenW (lpString=".pdf") returned 4 [0124.241] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1 [0124.241] lstrlenW (lpString=".xls") returned 4 [0124.241] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1 [0124.241] lstrlenW (lpString=".xlsx") returned 5 [0124.241] lstrcmpiW (lpString1=".xlsx", lpString2="E.ELM") returned -1 [0124.241] lstrlenW (lpString=".ppt") returned 4 [0124.241] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1 [0124.241] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM") returned 77 [0124.241] lstrlenW (lpString=".zip") returned 4 [0124.241] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1 [0124.241] lstrlenW (lpString=".rar") returned 4 [0124.241] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1 [0124.241] lstrlenW (lpString=".bz2") returned 4 [0124.241] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1 [0124.241] lstrlenW (lpString=".7z") returned 3 [0124.241] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1 [0124.241] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM") returned 77 [0124.241] lstrlenW (lpString=".dbf") returned 4 [0124.241] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1 [0124.241] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM") returned 77 [0124.241] lstrlenW (lpString=".1cd") returned 4 [0124.241] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1 [0124.241] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM") returned 77 [0124.241] lstrlenW (lpString=".jpg") returned 4 [0124.241] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1 [0124.241] lstrcmpiW (lpString1=".INF", lpString2=".waifu") returned -1 [0124.242] lstrlenW (lpString="ECHO.INF") returned 8 [0124.242] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\echo.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0124.281] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x30afb3c | out: lpFileSize=0x30afb3c*=503) returned 1 [0124.281] CloseHandle (hObject=0x1b0) returned 1 [0124.281] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\echo.inf")) returned 0x20 [0124.281] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\echo.inf.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0124.281] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\echo.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0124.281] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30afae8 | out: lpNewFilePointer=0x0) returned 1 [0124.281] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30afae8 | out: lpNewFilePointer=0x0) returned 1 [0124.282] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\echo.inf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0124.282] GetLastError () returned 0x0 [0124.282] ReadFile (in: hFile=0x1b0, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30afaf4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x30afaf4*=0x1f7, lpOverlapped=0x0) returned 1 [0124.283] WriteFile (in: hFile=0x220, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x30af8bc, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x30af8bc*=0x200, lpOverlapped=0x0) returned 1 [0124.283] ReadFile (in: hFile=0x1b0, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30afaf4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x30afaf4*=0x0, lpOverlapped=0x0) returned 1 [0124.283] WriteFile (in: hFile=0x220, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x30af8bc, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x30af8bc*=0xe4, lpOverlapped=0x0) returned 1 [0124.283] SetEndOfFile (hFile=0x220) returned 1 [0124.284] CloseHandle (hObject=0x220) returned 1 [0124.284] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30afae8 | out: lpNewFilePointer=0x0) returned 1 [0124.284] SetEndOfFile (hFile=0x1b0) returned 1 [0124.284] CloseHandle (hObject=0x1b0) returned 1 [0124.284] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0124.284] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\echo.inf")) returned 1 [0124.284] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF") returned 69 [0124.284] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF") returned 69 [0124.285] lstrlenW (lpString=".doc") returned 4 [0124.285] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1 [0124.285] lstrlenW (lpString=".docx") returned 5 [0124.285] lstrcmpiW (lpString1=".docx", lpString2="O.INF") returned -1 [0124.285] lstrlenW (lpString=".pdf") returned 4 [0124.285] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1 [0124.285] lstrlenW (lpString=".xls") returned 4 [0124.285] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1 [0124.285] lstrlenW (lpString=".xlsx") returned 5 [0124.285] lstrcmpiW (lpString1=".xlsx", lpString2="O.INF") returned -1 [0124.285] lstrlenW (lpString=".ppt") returned 4 [0124.285] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1 [0124.285] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF") returned 69 [0124.285] lstrlenW (lpString=".zip") returned 4 [0124.285] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1 [0124.285] lstrlenW (lpString=".rar") returned 4 [0124.285] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1 [0124.285] lstrlenW (lpString=".bz2") returned 4 [0124.285] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1 [0124.285] lstrlenW (lpString=".7z") returned 3 [0124.285] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1 [0124.285] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF") returned 69 [0124.285] lstrlenW (lpString=".dbf") returned 4 [0124.285] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1 [0124.285] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF") returned 69 [0124.285] lstrlenW (lpString=".1cd") returned 4 [0124.285] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1 [0124.285] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF") returned 69 [0124.285] lstrlenW (lpString=".jpg") returned 4 [0124.285] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1 [0124.285] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF") returned 69 [0124.285] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF") returned 69 [0124.285] lstrlenW (lpString=".doc") returned 4 [0124.285] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1 [0124.285] lstrlenW (lpString=".docx") returned 5 [0124.285] lstrcmpiW (lpString1=".docx", lpString2="O.INF") returned -1 [0124.285] lstrlenW (lpString=".pdf") returned 4 [0124.285] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1 [0124.285] lstrlenW (lpString=".xls") returned 4 [0124.285] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1 [0124.285] lstrlenW (lpString=".xlsx") returned 5 [0124.285] lstrcmpiW (lpString1=".xlsx", lpString2="O.INF") returned -1 [0124.285] lstrlenW (lpString=".ppt") returned 4 [0124.285] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1 [0124.285] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF") returned 69 [0124.285] lstrlenW (lpString=".zip") returned 4 [0124.285] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1 [0124.285] lstrlenW (lpString=".rar") returned 4 [0124.285] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1 [0124.285] lstrlenW (lpString=".bz2") returned 4 [0124.285] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1 [0124.286] lstrlenW (lpString=".7z") returned 3 [0124.286] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1 [0124.286] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF") returned 69 [0124.286] lstrlenW (lpString=".dbf") returned 4 [0124.286] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1 [0124.286] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF") returned 69 [0124.286] lstrlenW (lpString=".1cd") returned 4 [0124.286] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1 [0124.286] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF") returned 69 [0124.286] lstrlenW (lpString=".jpg") returned 4 [0124.286] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1 [0124.286] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30afae8 | out: lpNewFilePointer=0x0) returned 1 [0124.286] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30afae8 | out: lpNewFilePointer=0x0) returned 1 [0124.287] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.INF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\eclipse.inf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0124.287] GetLastError () returned 0x0 [0124.287] ReadFile (in: hFile=0x1b0, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30afaf4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x30afaf4*=0x253, lpOverlapped=0x0) returned 1 [0124.287] WriteFile (in: hFile=0x220, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0x260, lpNumberOfBytesWritten=0x30af8bc, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x30af8bc*=0x260, lpOverlapped=0x0) returned 1 [0124.288] ReadFile (in: hFile=0x1b0, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30afaf4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x30afaf4*=0x0, lpOverlapped=0x0) returned 1 [0124.288] WriteFile (in: hFile=0x220, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x30af8bc, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x30af8bc*=0xea, lpOverlapped=0x0) returned 1 [0124.288] SetEndOfFile (hFile=0x220) returned 1 [0124.288] CloseHandle (hObject=0x220) returned 1 [0124.288] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30afae8 | out: lpNewFilePointer=0x0) returned 1 [0124.289] SetEndOfFile (hFile=0x1b0) returned 1 [0124.303] CloseHandle (hObject=0x1b0) returned 1 [0124.303] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.INF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0124.303] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\eclipse.inf")) returned 1 [0124.303] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.INF") returned 75 [0124.303] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.INF") returned 75 [0124.303] lstrlenW (lpString=".doc") returned 4 [0124.303] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1 [0124.303] lstrlenW (lpString=".docx") returned 5 [0124.303] lstrcmpiW (lpString1=".docx", lpString2="E.INF") returned -1 [0124.303] lstrlenW (lpString=".pdf") returned 4 [0124.303] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1 [0124.303] lstrlenW (lpString=".xls") returned 4 [0124.303] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1 [0124.303] lstrlenW (lpString=".xlsx") returned 5 [0124.303] lstrcmpiW (lpString1=".xlsx", lpString2="E.INF") returned -1 [0124.303] lstrlenW (lpString=".ppt") returned 4 [0124.303] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1 [0124.303] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.INF") returned 75 [0124.303] lstrlenW (lpString=".zip") returned 4 [0124.303] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1 [0124.303] lstrlenW (lpString=".rar") returned 4 [0124.304] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1 [0124.304] lstrlenW (lpString=".bz2") returned 4 [0124.304] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1 [0124.307] lstrlenW (lpString=".7z") returned 3 [0124.307] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1 [0124.307] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.INF") returned 75 [0124.307] lstrlenW (lpString=".dbf") returned 4 [0124.307] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1 [0124.307] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.INF") returned 75 [0124.307] lstrlenW (lpString=".1cd") returned 4 [0124.307] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1 [0124.307] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.INF") returned 75 [0124.307] lstrlenW (lpString=".jpg") returned 4 [0124.307] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1 [0124.308] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30afae8 | out: lpNewFilePointer=0x0) returned 1 [0124.308] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30afae8 | out: lpNewFilePointer=0x0) returned 1 [0124.308] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.INF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\edge.inf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0124.308] GetLastError () returned 0x0 [0124.308] ReadFile (in: hFile=0x1b0, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30afaf4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x30afaf4*=0x211, lpOverlapped=0x0) returned 1 [0124.309] WriteFile (in: hFile=0x20c, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0x220, lpNumberOfBytesWritten=0x30af8bc, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x30af8bc*=0x220, lpOverlapped=0x0) returned 1 [0124.309] ReadFile (in: hFile=0x1b0, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30afaf4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x30afaf4*=0x0, lpOverlapped=0x0) returned 1 [0124.309] WriteFile (in: hFile=0x20c, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x30af8bc, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x30af8bc*=0xe4, lpOverlapped=0x0) returned 1 [0124.310] SetEndOfFile (hFile=0x20c) returned 1 [0124.310] CloseHandle (hObject=0x20c) returned 1 [0124.310] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30afae8 | out: lpNewFilePointer=0x0) returned 1 [0124.310] SetEndOfFile (hFile=0x1b0) returned 1 [0124.343] CloseHandle (hObject=0x1b0) returned 1 [0124.343] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.INF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0124.343] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\edge.inf")) returned 1 [0124.344] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.INF") returned 69 [0124.344] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.INF") returned 69 [0124.344] lstrlenW (lpString=".doc") returned 4 [0124.344] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1 [0124.344] lstrlenW (lpString=".docx") returned 5 [0124.344] lstrcmpiW (lpString1=".docx", lpString2="E.INF") returned -1 [0124.344] lstrlenW (lpString=".pdf") returned 4 [0124.344] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1 [0124.344] lstrlenW (lpString=".xls") returned 4 [0124.344] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1 [0124.344] lstrlenW (lpString=".xlsx") returned 5 [0124.344] lstrcmpiW (lpString1=".xlsx", lpString2="E.INF") returned -1 [0124.344] lstrlenW (lpString=".ppt") returned 4 [0124.344] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1 [0124.344] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.INF") returned 69 [0124.344] lstrlenW (lpString=".zip") returned 4 [0124.344] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1 [0124.344] lstrlenW (lpString=".rar") returned 4 [0124.344] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1 [0124.344] lstrlenW (lpString=".bz2") returned 4 [0124.344] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1 [0124.344] lstrlenW (lpString=".7z") returned 3 [0124.344] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1 [0124.344] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.INF") returned 69 [0124.344] lstrlenW (lpString=".dbf") returned 4 [0124.344] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1 [0124.344] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.INF") returned 69 [0124.344] lstrlenW (lpString=".1cd") returned 4 [0124.344] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1 [0124.344] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.INF") returned 69 [0124.344] lstrlenW (lpString=".jpg") returned 4 [0124.344] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1 [0124.348] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30afae8 | out: lpNewFilePointer=0x0) returned 1 [0124.348] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30afae8 | out: lpNewFilePointer=0x0) returned 1 [0124.348] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\expeditn.inf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x258 [0124.349] GetLastError () returned 0x0 [0124.349] ReadFile (in: hFile=0x254, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30afaf4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x30afaf4*=0x255, lpOverlapped=0x0) returned 1 [0124.349] WriteFile (in: hFile=0x258, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0x260, lpNumberOfBytesWritten=0x30af8bc, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x30af8bc*=0x260, lpOverlapped=0x0) returned 1 [0124.350] ReadFile (in: hFile=0x254, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30afaf4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x30afaf4*=0x0, lpOverlapped=0x0) returned 1 [0124.350] WriteFile (in: hFile=0x258, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x30af8bc, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x30af8bc*=0xec, lpOverlapped=0x0) returned 1 [0124.350] SetEndOfFile (hFile=0x258) returned 1 [0124.350] CloseHandle (hObject=0x258) returned 1 [0124.350] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30afae8 | out: lpNewFilePointer=0x0) returned 1 [0124.350] SetEndOfFile (hFile=0x254) returned 1 [0124.351] CloseHandle (hObject=0x254) returned 1 [0124.351] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0124.351] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\expeditn.inf")) returned 1 [0124.351] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF") returned 77 [0124.351] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF") returned 77 [0124.352] lstrlenW (lpString=".doc") returned 4 [0124.352] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1 [0124.352] lstrlenW (lpString=".docx") returned 5 [0124.352] lstrcmpiW (lpString1=".docx", lpString2="N.INF") returned -1 [0124.352] lstrlenW (lpString=".pdf") returned 4 [0124.352] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1 [0124.352] lstrlenW (lpString=".xls") returned 4 [0124.352] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1 [0124.352] lstrlenW (lpString=".xlsx") returned 5 [0124.352] lstrcmpiW (lpString1=".xlsx", lpString2="N.INF") returned -1 [0124.352] lstrlenW (lpString=".ppt") returned 4 [0124.352] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1 [0124.352] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF") returned 77 [0124.352] lstrlenW (lpString=".zip") returned 4 [0124.352] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1 [0124.352] lstrlenW (lpString=".rar") returned 4 [0124.352] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1 [0124.352] lstrlenW (lpString=".bz2") returned 4 [0124.352] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1 [0124.352] lstrlenW (lpString=".7z") returned 3 [0124.352] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1 [0124.352] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF") returned 77 [0124.352] lstrlenW (lpString=".dbf") returned 4 [0124.352] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1 [0124.352] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF") returned 77 [0124.352] lstrlenW (lpString=".1cd") returned 4 [0124.352] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1 [0124.352] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF") returned 77 [0124.352] lstrlenW (lpString=".jpg") returned 4 [0124.352] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1 [0124.357] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x30afb3c | out: lpFileSize=0x30afb3c*=68048) returned 1 [0124.357] CloseHandle (hObject=0x180) returned 1 [0124.357] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\ice.elm")) returned 0x20 [0124.357] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\ice.elm.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0124.357] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\ice.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0124.357] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30afae8 | out: lpNewFilePointer=0x0) returned 1 [0124.357] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30afae8 | out: lpNewFilePointer=0x0) returned 1 [0124.357] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\ice.elm.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0124.358] GetLastError () returned 0x0 [0124.358] ReadFile (in: hFile=0x180, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30afaf4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x30afaf4*=0x109d0, lpOverlapped=0x0) returned 1 [0124.422] WriteFile (in: hFile=0x20c, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0x109e0, lpNumberOfBytesWritten=0x30af8bc, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x30af8bc*=0x109e0, lpOverlapped=0x0) returned 1 [0124.423] ReadFile (in: hFile=0x180, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30afaf4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x30afaf4*=0x0, lpOverlapped=0x0) returned 1 [0124.423] WriteFile (in: hFile=0x20c, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x30af8bc, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x30af8bc*=0xe2, lpOverlapped=0x0) returned 1 [0124.423] SetEndOfFile (hFile=0x20c) returned 1 [0124.423] CloseHandle (hObject=0x20c) returned 1 [0124.424] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30afae8 | out: lpNewFilePointer=0x0) returned 1 [0124.424] SetEndOfFile (hFile=0x180) returned 1 [0124.424] CloseHandle (hObject=0x180) returned 1 [0124.424] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0124.424] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\ice.elm")) returned 1 [0124.425] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM") returned 67 [0124.425] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM") returned 67 [0124.425] lstrlenW (lpString=".doc") returned 4 [0124.425] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1 [0124.425] lstrlenW (lpString=".docx") returned 5 [0124.425] lstrcmpiW (lpString1=".docx", lpString2="E.ELM") returned -1 [0124.425] lstrlenW (lpString=".pdf") returned 4 [0124.425] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1 [0124.425] lstrlenW (lpString=".xls") returned 4 [0124.425] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1 [0124.425] lstrlenW (lpString=".xlsx") returned 5 [0124.425] lstrcmpiW (lpString1=".xlsx", lpString2="E.ELM") returned -1 [0124.425] lstrlenW (lpString=".ppt") returned 4 [0124.425] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1 [0124.425] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM") returned 67 [0124.425] lstrlenW (lpString=".zip") returned 4 [0124.425] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1 [0124.425] lstrlenW (lpString=".rar") returned 4 [0124.425] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1 [0124.425] lstrlenW (lpString=".bz2") returned 4 [0124.425] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1 [0124.425] lstrlenW (lpString=".7z") returned 3 [0124.425] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1 [0124.425] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM") returned 67 [0124.425] lstrlenW (lpString=".dbf") returned 4 [0124.425] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1 [0124.425] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM") returned 67 [0124.425] lstrlenW (lpString=".1cd") returned 4 [0124.425] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1 [0124.425] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM") returned 67 [0124.425] lstrlenW (lpString=".jpg") returned 4 [0124.425] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1 [0124.426] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x30afb3c | out: lpFileSize=0x30afb3c*=59203) returned 1 [0124.426] CloseHandle (hObject=0x180) returned 1 [0124.426] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\layers.elm")) returned 0x20 [0124.426] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\layers.elm.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0124.426] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\layers.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0124.426] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30afae8 | out: lpNewFilePointer=0x0) returned 1 [0124.426] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30afae8 | out: lpNewFilePointer=0x0) returned 1 [0124.426] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\layers.elm.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0124.427] GetLastError () returned 0x0 [0124.427] ReadFile (in: hFile=0x180, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30afaf4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x30afaf4*=0xe743, lpOverlapped=0x0) returned 1 [0124.501] WriteFile (in: hFile=0x20c, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0xe750, lpNumberOfBytesWritten=0x30af8bc, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x30af8bc*=0xe750, lpOverlapped=0x0) returned 1 [0124.504] ReadFile (in: hFile=0x180, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30afaf4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x30afaf4*=0x0, lpOverlapped=0x0) returned 1 [0124.504] WriteFile (in: hFile=0x20c, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x30af8bc, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x30af8bc*=0xe8, lpOverlapped=0x0) returned 1 [0124.504] SetEndOfFile (hFile=0x20c) returned 1 [0124.504] CloseHandle (hObject=0x20c) returned 1 [0124.504] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30afae8 | out: lpNewFilePointer=0x0) returned 1 [0124.504] SetEndOfFile (hFile=0x180) returned 1 [0124.505] CloseHandle (hObject=0x180) returned 1 [0124.505] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0124.505] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\layers.elm")) returned 1 [0124.505] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM") returned 73 [0124.505] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM") returned 73 [0124.505] lstrlenW (lpString=".doc") returned 4 [0124.505] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1 [0124.505] lstrlenW (lpString=".docx") returned 5 [0124.505] lstrcmpiW (lpString1=".docx", lpString2="S.ELM") returned -1 [0124.505] lstrlenW (lpString=".pdf") returned 4 [0124.505] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1 [0124.505] lstrlenW (lpString=".xls") returned 4 [0124.505] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1 [0124.505] lstrlenW (lpString=".xlsx") returned 5 [0124.505] lstrcmpiW (lpString1=".xlsx", lpString2="S.ELM") returned -1 [0124.505] lstrlenW (lpString=".ppt") returned 4 [0124.505] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1 [0124.505] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM") returned 73 [0124.505] lstrlenW (lpString=".zip") returned 4 [0124.505] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1 [0124.505] lstrlenW (lpString=".rar") returned 4 [0124.505] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1 [0124.505] lstrlenW (lpString=".bz2") returned 4 [0124.505] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1 [0124.505] lstrlenW (lpString=".7z") returned 3 [0124.505] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1 [0124.506] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM") returned 73 [0124.506] lstrlenW (lpString=".dbf") returned 4 [0124.506] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1 [0124.506] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM") returned 73 [0124.506] lstrlenW (lpString=".1cd") returned 4 [0124.506] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1 [0124.506] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM") returned 73 [0124.506] lstrlenW (lpString=".jpg") returned 4 [0124.506] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1 [0124.506] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30afae8 | out: lpNewFilePointer=0x0) returned 1 [0124.506] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30afae8 | out: lpNewFilePointer=0x0) returned 1 [0124.506] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.ELM.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\pixel.elm.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0124.507] GetLastError () returned 0x0 [0124.507] ReadFile (in: hFile=0x180, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30afaf4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x30afaf4*=0xd0e5, lpOverlapped=0x0) returned 1 [0124.570] WriteFile (in: hFile=0x20c, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0xd0f0, lpNumberOfBytesWritten=0x30af8bc, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x30af8bc*=0xd0f0, lpOverlapped=0x0) returned 1 [0124.571] ReadFile (in: hFile=0x180, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30afaf4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x30afaf4*=0x0, lpOverlapped=0x0) returned 1 [0124.571] WriteFile (in: hFile=0x20c, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x30af8bc, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x30af8bc*=0xe6, lpOverlapped=0x0) returned 1 [0124.572] SetEndOfFile (hFile=0x20c) returned 1 [0124.572] CloseHandle (hObject=0x20c) returned 1 [0124.572] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30afae8 | out: lpNewFilePointer=0x0) returned 1 [0124.572] SetEndOfFile (hFile=0x180) returned 1 [0124.572] CloseHandle (hObject=0x180) returned 1 [0124.572] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.ELM.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0124.572] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\pixel.elm")) returned 1 [0124.573] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.ELM") returned 71 [0124.573] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.ELM") returned 71 [0124.573] lstrlenW (lpString=".doc") returned 4 [0124.573] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1 [0124.573] lstrlenW (lpString=".docx") returned 5 [0124.573] lstrcmpiW (lpString1=".docx", lpString2="L.ELM") returned -1 [0124.573] lstrlenW (lpString=".pdf") returned 4 [0124.573] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1 [0124.573] lstrlenW (lpString=".xls") returned 4 [0124.573] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1 [0124.573] lstrlenW (lpString=".xlsx") returned 5 [0124.573] lstrcmpiW (lpString1=".xlsx", lpString2="L.ELM") returned -1 [0124.573] lstrlenW (lpString=".ppt") returned 4 [0124.573] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1 [0124.573] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.ELM") returned 71 [0124.573] lstrlenW (lpString=".zip") returned 4 [0124.573] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1 [0124.573] lstrlenW (lpString=".rar") returned 4 [0124.573] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1 [0124.573] lstrlenW (lpString=".bz2") returned 4 [0124.573] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1 [0124.573] lstrlenW (lpString=".7z") returned 3 [0124.573] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1 [0124.573] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.ELM") returned 71 [0124.573] lstrlenW (lpString=".dbf") returned 4 [0124.573] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1 [0124.573] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.ELM") returned 71 [0124.573] lstrlenW (lpString=".1cd") returned 4 [0124.573] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1 [0124.573] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.ELM") returned 71 [0124.573] lstrlenW (lpString=".jpg") returned 4 [0124.573] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1 [0124.574] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30afae8 | out: lpNewFilePointer=0x0) returned 1 [0124.574] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30afae8 | out: lpNewFilePointer=0x0) returned 1 [0124.574] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.INF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\radial.inf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0124.574] GetLastError () returned 0x0 [0124.574] ReadFile (in: hFile=0x180, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30afaf4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x30afaf4*=0x24a, lpOverlapped=0x0) returned 1 [0124.575] WriteFile (in: hFile=0x20c, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0x250, lpNumberOfBytesWritten=0x30af8bc, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x30af8bc*=0x250, lpOverlapped=0x0) returned 1 [0124.575] ReadFile (in: hFile=0x180, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30afaf4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x30afaf4*=0x0, lpOverlapped=0x0) returned 1 [0124.576] WriteFile (in: hFile=0x20c, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x30af8bc, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x30af8bc*=0xe8, lpOverlapped=0x0) returned 1 [0124.576] SetEndOfFile (hFile=0x20c) returned 1 [0124.576] CloseHandle (hObject=0x20c) returned 1 [0124.576] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30afae8 | out: lpNewFilePointer=0x0) returned 1 [0124.576] SetEndOfFile (hFile=0x180) returned 1 [0124.576] CloseHandle (hObject=0x180) returned 1 [0124.576] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.INF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0124.576] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\radial.inf")) returned 1 [0124.577] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.INF") returned 73 [0124.577] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.INF") returned 73 [0124.577] lstrlenW (lpString=".doc") returned 4 [0124.577] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1 [0124.577] lstrlenW (lpString=".docx") returned 5 [0124.577] lstrcmpiW (lpString1=".docx", lpString2="L.INF") returned -1 [0124.577] lstrlenW (lpString=".pdf") returned 4 [0124.577] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1 [0124.577] lstrlenW (lpString=".xls") returned 4 [0124.577] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1 [0124.577] lstrlenW (lpString=".xlsx") returned 5 [0124.577] lstrcmpiW (lpString1=".xlsx", lpString2="L.INF") returned -1 [0124.577] lstrlenW (lpString=".ppt") returned 4 [0124.577] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1 [0124.577] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.INF") returned 73 [0124.577] lstrlenW (lpString=".zip") returned 4 [0124.577] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1 [0124.577] lstrlenW (lpString=".rar") returned 4 [0124.577] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1 [0124.577] lstrlenW (lpString=".bz2") returned 4 [0124.577] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1 [0124.577] lstrlenW (lpString=".7z") returned 3 [0124.577] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1 [0124.577] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.INF") returned 73 [0124.577] lstrlenW (lpString=".dbf") returned 4 [0124.577] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1 [0124.577] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.INF") returned 73 [0124.577] lstrlenW (lpString=".1cd") returned 4 [0124.577] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1 [0124.577] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.INF") returned 73 [0124.577] lstrlenW (lpString=".jpg") returned 4 [0124.577] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1 [0124.579] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30afae8 | out: lpNewFilePointer=0x0) returned 1 [0124.579] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30afae8 | out: lpNewFilePointer=0x0) returned 1 [0124.579] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.ELM.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\refined.elm.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0124.579] GetLastError () returned 0x0 [0124.579] ReadFile (in: hFile=0x180, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30afaf4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x30afaf4*=0xb30e, lpOverlapped=0x0) returned 1 [0124.581] WriteFile (in: hFile=0x20c, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0xb310, lpNumberOfBytesWritten=0x30af8bc, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x30af8bc*=0xb310, lpOverlapped=0x0) returned 1 [0124.582] ReadFile (in: hFile=0x180, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30afaf4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x30afaf4*=0x0, lpOverlapped=0x0) returned 1 [0124.583] WriteFile (in: hFile=0x20c, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x30af8bc, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x30af8bc*=0xea, lpOverlapped=0x0) returned 1 [0124.583] SetEndOfFile (hFile=0x20c) returned 1 [0124.583] CloseHandle (hObject=0x20c) returned 1 [0124.583] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30afae8 | out: lpNewFilePointer=0x0) returned 1 [0124.583] SetEndOfFile (hFile=0x180) returned 1 [0124.584] CloseHandle (hObject=0x180) returned 1 [0124.584] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.ELM.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0124.584] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\refined.elm")) returned 1 [0124.584] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.ELM") returned 75 [0124.584] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.ELM") returned 75 [0124.584] lstrlenW (lpString=".doc") returned 4 [0124.584] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1 [0124.584] lstrlenW (lpString=".docx") returned 5 [0124.584] lstrcmpiW (lpString1=".docx", lpString2="D.ELM") returned -1 [0124.584] lstrlenW (lpString=".pdf") returned 4 [0124.584] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1 [0124.584] lstrlenW (lpString=".xls") returned 4 [0124.584] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1 [0124.584] lstrlenW (lpString=".xlsx") returned 5 [0124.584] lstrcmpiW (lpString1=".xlsx", lpString2="D.ELM") returned -1 [0124.584] lstrlenW (lpString=".ppt") returned 4 [0124.584] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1 [0124.584] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.ELM") returned 75 [0124.584] lstrlenW (lpString=".zip") returned 4 [0124.584] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1 [0124.584] lstrlenW (lpString=".rar") returned 4 [0124.585] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1 [0124.585] lstrlenW (lpString=".bz2") returned 4 [0124.585] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1 [0124.585] lstrlenW (lpString=".7z") returned 3 [0124.585] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1 [0124.585] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.ELM") returned 75 [0124.585] lstrlenW (lpString=".dbf") returned 4 [0124.585] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1 [0124.585] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.ELM") returned 75 [0124.585] lstrlenW (lpString=".1cd") returned 4 [0124.585] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1 [0124.585] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.ELM") returned 75 [0124.585] lstrlenW (lpString=".jpg") returned 4 [0124.585] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1 [0124.585] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30afae8 | out: lpNewFilePointer=0x0) returned 1 [0124.585] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30afae8 | out: lpNewFilePointer=0x0) returned 1 [0124.585] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\refined.inf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0124.586] GetLastError () returned 0x0 [0124.586] ReadFile (in: hFile=0x180, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30afaf4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x30afaf4*=0x24a, lpOverlapped=0x0) returned 1 [0124.586] WriteFile (in: hFile=0x20c, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0x250, lpNumberOfBytesWritten=0x30af8bc, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x30af8bc*=0x250, lpOverlapped=0x0) returned 1 [0124.587] ReadFile (in: hFile=0x180, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30afaf4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x30afaf4*=0x0, lpOverlapped=0x0) returned 1 [0124.587] WriteFile (in: hFile=0x20c, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x30af8bc, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x30af8bc*=0xea, lpOverlapped=0x0) returned 1 [0124.587] SetEndOfFile (hFile=0x20c) returned 1 [0124.587] CloseHandle (hObject=0x20c) returned 1 [0124.587] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30afae8 | out: lpNewFilePointer=0x0) returned 1 [0124.587] SetEndOfFile (hFile=0x180) returned 1 [0124.588] CloseHandle (hObject=0x180) returned 1 [0124.588] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0124.588] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\refined.inf")) returned 1 [0124.588] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF") returned 75 [0124.588] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF") returned 75 [0124.588] lstrlenW (lpString=".doc") returned 4 [0124.588] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1 [0124.588] lstrlenW (lpString=".docx") returned 5 [0124.588] lstrcmpiW (lpString1=".docx", lpString2="D.INF") returned -1 [0124.588] lstrlenW (lpString=".pdf") returned 4 [0124.588] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1 [0124.588] lstrlenW (lpString=".xls") returned 4 [0124.588] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1 [0124.588] lstrlenW (lpString=".xlsx") returned 5 [0124.588] lstrcmpiW (lpString1=".xlsx", lpString2="D.INF") returned -1 [0124.588] lstrlenW (lpString=".ppt") returned 4 [0124.589] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1 [0124.589] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF") returned 75 [0124.589] lstrlenW (lpString=".zip") returned 4 [0124.589] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1 [0124.589] lstrlenW (lpString=".rar") returned 4 [0124.589] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1 [0124.589] lstrlenW (lpString=".bz2") returned 4 [0124.589] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1 [0124.589] lstrlenW (lpString=".7z") returned 3 [0124.589] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1 [0124.589] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF") returned 75 [0124.589] lstrlenW (lpString=".dbf") returned 4 [0124.589] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1 [0124.589] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF") returned 75 [0124.589] lstrlenW (lpString=".1cd") returned 4 [0124.589] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1 [0124.589] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF") returned 75 [0124.589] lstrlenW (lpString=".jpg") returned 4 [0124.589] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1 [0124.645] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30afae8 | out: lpNewFilePointer=0x0) returned 1 [0124.645] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30afae8 | out: lpNewFilePointer=0x0) returned 1 [0124.645] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.ELM.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\ricepapr.elm.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0124.645] GetLastError () returned 0x0 [0124.645] ReadFile (in: hFile=0x220, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30afaf4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x30afaf4*=0x1205e, lpOverlapped=0x0) returned 1 [0124.739] WriteFile (in: hFile=0x21c, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0x12060, lpNumberOfBytesWritten=0x30af8bc, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x30af8bc*=0x12060, lpOverlapped=0x0) returned 1 [0124.741] ReadFile (in: hFile=0x220, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30afaf4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x30afaf4*=0x0, lpOverlapped=0x0) returned 1 [0124.741] WriteFile (in: hFile=0x21c, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x30af8bc, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x30af8bc*=0xec, lpOverlapped=0x0) returned 1 [0124.741] SetEndOfFile (hFile=0x21c) returned 1 [0124.741] CloseHandle (hObject=0x21c) returned 1 [0124.741] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30afae8 | out: lpNewFilePointer=0x0) returned 1 [0124.741] SetEndOfFile (hFile=0x220) returned 1 [0124.741] CloseHandle (hObject=0x220) returned 1 [0124.742] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.ELM.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0124.742] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\ricepapr.elm")) returned 1 [0124.742] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.ELM") returned 77 [0124.742] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.ELM") returned 77 [0124.742] lstrlenW (lpString=".doc") returned 4 [0124.742] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1 [0124.742] lstrlenW (lpString=".docx") returned 5 [0124.742] lstrcmpiW (lpString1=".docx", lpString2="R.ELM") returned -1 [0124.742] lstrlenW (lpString=".pdf") returned 4 [0124.742] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1 [0124.742] lstrlenW (lpString=".xls") returned 4 [0124.742] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1 [0124.742] lstrlenW (lpString=".xlsx") returned 5 [0124.742] lstrcmpiW (lpString1=".xlsx", lpString2="R.ELM") returned -1 [0124.742] lstrlenW (lpString=".ppt") returned 4 [0124.742] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1 [0124.742] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.ELM") returned 77 [0124.742] lstrlenW (lpString=".zip") returned 4 [0124.742] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1 [0124.742] lstrlenW (lpString=".rar") returned 4 [0124.742] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1 [0124.742] lstrlenW (lpString=".bz2") returned 4 [0124.742] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1 [0124.743] lstrlenW (lpString=".7z") returned 3 [0124.743] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1 [0124.743] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.ELM") returned 77 [0124.743] lstrlenW (lpString=".dbf") returned 4 [0124.743] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1 [0124.743] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.ELM") returned 77 [0124.743] lstrlenW (lpString=".1cd") returned 4 [0124.743] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1 [0124.743] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.ELM") returned 77 [0124.743] lstrlenW (lpString=".jpg") returned 4 [0124.743] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1 [0124.743] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30afae8 | out: lpNewFilePointer=0x0) returned 1 [0124.743] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30afae8 | out: lpNewFilePointer=0x0) returned 1 [0124.743] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.INF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\satin.inf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0124.744] GetLastError () returned 0x0 [0124.744] ReadFile (in: hFile=0x220, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30afaf4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x30afaf4*=0x1c8, lpOverlapped=0x0) returned 1 [0124.744] WriteFile (in: hFile=0x21c, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x30af8bc, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x30af8bc*=0x1d0, lpOverlapped=0x0) returned 1 [0124.745] ReadFile (in: hFile=0x220, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30afaf4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x30afaf4*=0x0, lpOverlapped=0x0) returned 1 [0124.745] WriteFile (in: hFile=0x21c, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x30af8bc, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x30af8bc*=0xe6, lpOverlapped=0x0) returned 1 [0124.745] SetEndOfFile (hFile=0x21c) returned 1 [0124.745] CloseHandle (hObject=0x21c) returned 1 [0124.745] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30afae8 | out: lpNewFilePointer=0x0) returned 1 [0124.745] SetEndOfFile (hFile=0x220) returned 1 [0124.746] CloseHandle (hObject=0x220) returned 1 [0124.746] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.INF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0124.746] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\satin.inf")) returned 1 [0124.748] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.INF") returned 71 [0124.748] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.INF") returned 71 [0124.748] lstrlenW (lpString=".doc") returned 4 [0124.748] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1 [0124.748] lstrlenW (lpString=".docx") returned 5 [0124.748] lstrcmpiW (lpString1=".docx", lpString2="N.INF") returned -1 [0124.748] lstrlenW (lpString=".pdf") returned 4 [0124.748] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1 [0124.748] lstrlenW (lpString=".xls") returned 4 [0124.748] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1 [0124.748] lstrlenW (lpString=".xlsx") returned 5 [0124.748] lstrcmpiW (lpString1=".xlsx", lpString2="N.INF") returned -1 [0124.748] lstrlenW (lpString=".ppt") returned 4 [0124.748] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1 [0124.748] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.INF") returned 71 [0124.748] lstrlenW (lpString=".zip") returned 4 [0124.748] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1 [0124.748] lstrlenW (lpString=".rar") returned 4 [0124.748] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1 [0124.748] lstrlenW (lpString=".bz2") returned 4 [0124.748] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1 [0124.748] lstrlenW (lpString=".7z") returned 3 [0124.748] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1 [0124.748] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.INF") returned 71 [0124.748] lstrlenW (lpString=".dbf") returned 4 [0124.748] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1 [0124.748] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.INF") returned 71 [0124.748] lstrlenW (lpString=".1cd") returned 4 [0124.748] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1 [0124.748] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.INF") returned 71 [0124.748] lstrlenW (lpString=".jpg") returned 4 [0124.748] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1 [0124.749] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30afae8 | out: lpNewFilePointer=0x0) returned 1 [0124.749] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30afae8 | out: lpNewFilePointer=0x0) returned 1 [0124.749] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.ELM.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\sky.elm.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0124.749] GetLastError () returned 0x0 [0124.750] ReadFile (in: hFile=0x220, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30afaf4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x30afaf4*=0x1413d, lpOverlapped=0x0) returned 1 [0124.846] WriteFile (in: hFile=0x21c, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0x14140, lpNumberOfBytesWritten=0x30af8bc, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x30af8bc*=0x14140, lpOverlapped=0x0) returned 1 [0124.847] ReadFile (in: hFile=0x220, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30afaf4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x30afaf4*=0x0, lpOverlapped=0x0) returned 1 [0124.847] WriteFile (in: hFile=0x21c, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x30af8bc, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x30af8bc*=0xe2, lpOverlapped=0x0) returned 1 [0124.847] SetEndOfFile (hFile=0x21c) returned 1 [0124.847] CloseHandle (hObject=0x21c) returned 1 [0124.847] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30afae8 | out: lpNewFilePointer=0x0) returned 1 [0124.847] SetEndOfFile (hFile=0x220) returned 1 [0124.848] CloseHandle (hObject=0x220) returned 1 [0124.848] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.ELM.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0124.848] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\sky.elm")) returned 1 [0124.849] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.ELM") returned 67 [0124.849] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.ELM") returned 67 [0124.849] lstrlenW (lpString=".doc") returned 4 [0124.849] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1 [0124.849] lstrlenW (lpString=".docx") returned 5 [0124.849] lstrcmpiW (lpString1=".docx", lpString2="Y.ELM") returned -1 [0124.849] lstrlenW (lpString=".pdf") returned 4 [0124.849] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1 [0124.849] lstrlenW (lpString=".xls") returned 4 [0124.849] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1 [0124.849] lstrlenW (lpString=".xlsx") returned 5 [0124.849] lstrcmpiW (lpString1=".xlsx", lpString2="Y.ELM") returned -1 [0124.849] lstrlenW (lpString=".ppt") returned 4 [0124.849] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1 [0124.849] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.ELM") returned 67 [0124.849] lstrlenW (lpString=".zip") returned 4 [0124.849] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1 [0124.849] lstrlenW (lpString=".rar") returned 4 [0124.849] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1 [0124.849] lstrlenW (lpString=".bz2") returned 4 [0124.849] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1 [0124.849] lstrlenW (lpString=".7z") returned 3 [0124.849] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1 [0124.849] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.ELM") returned 67 [0124.849] lstrlenW (lpString=".dbf") returned 4 [0124.849] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1 [0124.849] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.ELM") returned 67 [0124.849] lstrlenW (lpString=".1cd") returned 4 [0124.849] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1 [0124.849] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.ELM") returned 67 [0124.849] lstrlenW (lpString=".jpg") returned 4 [0124.849] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1 [0125.360] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30afae8 | out: lpNewFilePointer=0x0) returned 1 [0125.360] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30afae8 | out: lpNewFilePointer=0x0) returned 1 [0125.360] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.INF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\sonora.inf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0125.361] GetLastError () returned 0x0 [0125.361] ReadFile (in: hFile=0x1e4, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30afaf4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x30afaf4*=0x1e4, lpOverlapped=0x0) returned 1 [0125.365] WriteFile (in: hFile=0x170, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0x1f0, lpNumberOfBytesWritten=0x30af8bc, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x30af8bc*=0x1f0, lpOverlapped=0x0) returned 1 [0125.366] ReadFile (in: hFile=0x1e4, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30afaf4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x30afaf4*=0x0, lpOverlapped=0x0) returned 1 [0125.366] WriteFile (in: hFile=0x170, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x30af8bc, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x30af8bc*=0xe8, lpOverlapped=0x0) returned 1 [0125.366] SetEndOfFile (hFile=0x170) returned 1 [0125.366] CloseHandle (hObject=0x170) returned 1 [0125.366] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30afae8 | out: lpNewFilePointer=0x0) returned 1 [0125.366] SetEndOfFile (hFile=0x1e4) returned 1 [0125.367] CloseHandle (hObject=0x1e4) returned 1 [0125.367] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.INF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0125.367] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\sonora.inf")) returned 1 [0125.367] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.INF") returned 73 [0125.367] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.INF") returned 73 [0125.367] lstrlenW (lpString=".doc") returned 4 [0125.367] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1 [0125.367] lstrlenW (lpString=".docx") returned 5 [0125.367] lstrcmpiW (lpString1=".docx", lpString2="A.INF") returned -1 [0125.367] lstrlenW (lpString=".pdf") returned 4 [0125.367] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1 [0125.367] lstrlenW (lpString=".xls") returned 4 [0125.368] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1 [0125.368] lstrlenW (lpString=".xlsx") returned 5 [0125.368] lstrcmpiW (lpString1=".xlsx", lpString2="A.INF") returned -1 [0125.368] lstrlenW (lpString=".ppt") returned 4 [0125.368] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1 [0125.368] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.INF") returned 73 [0125.368] lstrlenW (lpString=".zip") returned 4 [0125.368] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1 [0125.368] lstrlenW (lpString=".rar") returned 4 [0125.368] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1 [0125.368] lstrlenW (lpString=".bz2") returned 4 [0125.368] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1 [0125.368] lstrlenW (lpString=".7z") returned 3 [0125.368] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1 [0125.368] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.INF") returned 73 [0125.368] lstrlenW (lpString=".dbf") returned 4 [0125.368] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1 [0125.368] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.INF") returned 73 [0125.368] lstrlenW (lpString=".1cd") returned 4 [0125.368] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1 [0125.368] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.INF") returned 73 [0125.368] lstrlenW (lpString=".jpg") returned 4 [0125.368] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1 [0125.375] SetFilePointerEx (in: hFile=0x24c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30afae8 | out: lpNewFilePointer=0x0) returned 1 [0125.375] SetFilePointerEx (in: hFile=0x24c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30afae8 | out: lpNewFilePointer=0x0) returned 1 [0125.375] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.INF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\studio.inf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x23c [0125.376] GetLastError () returned 0x0 [0125.376] ReadFile (in: hFile=0x24c, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30afaf4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x30afaf4*=0x242, lpOverlapped=0x0) returned 1 [0125.377] WriteFile (in: hFile=0x23c, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0x250, lpNumberOfBytesWritten=0x30af8bc, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x30af8bc*=0x250, lpOverlapped=0x0) returned 1 [0125.377] ReadFile (in: hFile=0x24c, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30afaf4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x30afaf4*=0x0, lpOverlapped=0x0) returned 1 [0125.377] WriteFile (in: hFile=0x23c, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x30af8bc, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x30af8bc*=0xe8, lpOverlapped=0x0) returned 1 [0125.377] SetEndOfFile (hFile=0x23c) returned 1 [0125.378] CloseHandle (hObject=0x23c) returned 1 [0125.378] SetFilePointerEx (in: hFile=0x24c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30afae8 | out: lpNewFilePointer=0x0) returned 1 [0125.378] SetEndOfFile (hFile=0x24c) returned 1 [0125.378] CloseHandle (hObject=0x24c) returned 1 [0125.378] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.INF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0125.378] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\studio.inf")) returned 1 [0125.379] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.INF") returned 73 [0125.379] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.INF") returned 73 [0125.379] lstrlenW (lpString=".doc") returned 4 [0125.379] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1 [0125.379] lstrlenW (lpString=".docx") returned 5 [0125.379] lstrcmpiW (lpString1=".docx", lpString2="O.INF") returned -1 [0125.379] lstrlenW (lpString=".pdf") returned 4 [0125.379] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1 [0125.379] lstrlenW (lpString=".xls") returned 4 [0125.379] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1 [0125.379] lstrlenW (lpString=".xlsx") returned 5 [0125.379] lstrcmpiW (lpString1=".xlsx", lpString2="O.INF") returned -1 [0125.379] lstrlenW (lpString=".ppt") returned 4 [0125.379] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1 [0125.379] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.INF") returned 73 [0125.379] lstrlenW (lpString=".zip") returned 4 [0125.379] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1 [0125.379] lstrlenW (lpString=".rar") returned 4 [0125.379] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1 [0125.379] lstrlenW (lpString=".bz2") returned 4 [0125.379] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1 [0125.379] lstrlenW (lpString=".7z") returned 3 [0125.379] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1 [0125.379] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.INF") returned 73 [0125.379] lstrlenW (lpString=".dbf") returned 4 [0125.379] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1 [0125.379] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.INF") returned 73 [0125.379] lstrlenW (lpString=".1cd") returned 4 [0125.379] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1 [0125.379] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.INF") returned 73 [0125.379] lstrlenW (lpString=".jpg") returned 4 [0125.379] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1 [0125.382] SetFilePointerEx (in: hFile=0x224, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30afae8 | out: lpNewFilePointer=0x0) returned 1 [0125.382] SetFilePointerEx (in: hFile=0x224, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30afae8 | out: lpNewFilePointer=0x0) returned 1 [0125.382] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\sumipntg.inf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0125.383] GetLastError () returned 0x0 [0125.383] ReadFile (in: hFile=0x224, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30afaf4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x30afaf4*=0x22b, lpOverlapped=0x0) returned 1 [0125.383] WriteFile (in: hFile=0x1f4, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0x230, lpNumberOfBytesWritten=0x30af8bc, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x30af8bc*=0x230, lpOverlapped=0x0) returned 1 [0125.384] ReadFile (in: hFile=0x224, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30afaf4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x30afaf4*=0x0, lpOverlapped=0x0) returned 1 [0125.384] WriteFile (in: hFile=0x1f4, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x30af8bc, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x30af8bc*=0xec, lpOverlapped=0x0) returned 1 [0125.384] SetEndOfFile (hFile=0x1f4) returned 1 [0125.384] CloseHandle (hObject=0x1f4) returned 1 [0125.384] SetFilePointerEx (in: hFile=0x224, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30afae8 | out: lpNewFilePointer=0x0) returned 1 [0125.384] SetEndOfFile (hFile=0x224) returned 1 [0125.386] CloseHandle (hObject=0x224) returned 1 [0125.386] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0125.386] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\sumipntg.inf")) returned 1 [0125.386] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF") returned 77 [0125.386] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF") returned 77 [0125.386] lstrlenW (lpString=".doc") returned 4 [0125.386] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1 [0125.386] lstrlenW (lpString=".docx") returned 5 [0125.386] lstrcmpiW (lpString1=".docx", lpString2="G.INF") returned -1 [0125.386] lstrlenW (lpString=".pdf") returned 4 [0125.386] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1 [0125.386] lstrlenW (lpString=".xls") returned 4 [0125.386] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1 [0125.386] lstrlenW (lpString=".xlsx") returned 5 [0125.386] lstrcmpiW (lpString1=".xlsx", lpString2="G.INF") returned -1 [0125.386] lstrlenW (lpString=".ppt") returned 4 [0125.386] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1 [0125.386] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF") returned 77 [0125.386] lstrlenW (lpString=".zip") returned 4 [0125.386] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1 [0125.386] lstrlenW (lpString=".rar") returned 4 [0125.386] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1 [0125.386] lstrlenW (lpString=".bz2") returned 4 [0125.386] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1 [0125.386] lstrlenW (lpString=".7z") returned 3 [0125.386] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1 [0125.386] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF") returned 77 [0125.386] lstrlenW (lpString=".dbf") returned 4 [0125.386] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1 [0125.386] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF") returned 77 [0125.386] lstrlenW (lpString=".1cd") returned 4 [0125.387] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1 [0125.387] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF") returned 77 [0125.387] lstrlenW (lpString=".jpg") returned 4 [0125.387] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1 [0125.387] SetFilePointerEx (in: hFile=0x224, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30afae8 | out: lpNewFilePointer=0x0) returned 1 [0125.387] SetFilePointerEx (in: hFile=0x224, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30afae8 | out: lpNewFilePointer=0x0) returned 1 [0125.387] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\themes.inf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0125.387] GetLastError () returned 0x0 [0125.387] ReadFile (in: hFile=0x224, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30afaf4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x30afaf4*=0x1c6c, lpOverlapped=0x0) returned 1 [0125.530] WriteFile (in: hFile=0x1f4, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0x1c70, lpNumberOfBytesWritten=0x30af8bc, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x30af8bc*=0x1c70, lpOverlapped=0x0) returned 1 [0125.531] ReadFile (in: hFile=0x224, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30afaf4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x30afaf4*=0x0, lpOverlapped=0x0) returned 1 [0125.531] WriteFile (in: hFile=0x1f4, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x30af8bc, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x30af8bc*=0xe8, lpOverlapped=0x0) returned 1 [0125.531] SetEndOfFile (hFile=0x1f4) returned 1 [0125.531] CloseHandle (hObject=0x1f4) returned 1 [0125.531] SetFilePointerEx (in: hFile=0x224, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30afae8 | out: lpNewFilePointer=0x0) returned 1 [0125.531] SetEndOfFile (hFile=0x224) returned 1 [0125.532] CloseHandle (hObject=0x224) returned 1 [0125.532] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0125.532] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\themes.inf")) returned 1 [0125.532] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF") returned 66 [0125.532] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF") returned 66 [0125.532] lstrlenW (lpString=".doc") returned 4 [0125.532] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1 [0125.532] lstrlenW (lpString=".docx") returned 5 [0125.532] lstrcmpiW (lpString1=".docx", lpString2="S.INF") returned -1 [0125.532] lstrlenW (lpString=".pdf") returned 4 [0125.532] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1 [0125.532] lstrlenW (lpString=".xls") returned 4 [0125.532] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1 [0125.532] lstrlenW (lpString=".xlsx") returned 5 [0125.532] lstrcmpiW (lpString1=".xlsx", lpString2="S.INF") returned -1 [0125.532] lstrlenW (lpString=".ppt") returned 4 [0125.533] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1 [0125.533] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF") returned 66 [0125.533] lstrlenW (lpString=".zip") returned 4 [0125.533] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1 [0125.533] lstrlenW (lpString=".rar") returned 4 [0125.533] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1 [0125.533] lstrlenW (lpString=".bz2") returned 4 [0125.533] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1 [0125.533] lstrlenW (lpString=".7z") returned 3 [0125.533] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1 [0125.533] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF") returned 66 [0125.533] lstrlenW (lpString=".dbf") returned 4 [0125.533] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1 [0125.533] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF") returned 66 [0125.533] lstrlenW (lpString=".1cd") returned 4 [0125.533] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1 [0125.533] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF") returned 66 [0125.533] lstrlenW (lpString=".jpg") returned 4 [0125.533] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1 [0125.533] SetFilePointerEx (in: hFile=0x224, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30afae8 | out: lpNewFilePointer=0x0) returned 1 [0125.533] SetFilePointerEx (in: hFile=0x224, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30afae8 | out: lpNewFilePointer=0x0) returned 1 [0125.533] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\enes\\msb1enes.its.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0125.534] GetLastError () returned 0x0 [0125.534] ReadFile (in: hFile=0x224, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30afaf4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x30afaf4*=0xeed1e, lpOverlapped=0x0) returned 1 [0125.573] WriteFile (in: hFile=0x1f4, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0xeed20, lpNumberOfBytesWritten=0x30af8bc, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x30af8bc*=0xeed20, lpOverlapped=0x0) returned 1 [0125.580] ReadFile (in: hFile=0x224, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30afaf4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x30afaf4*=0x0, lpOverlapped=0x0) returned 1 [0125.580] WriteFile (in: hFile=0x1f4, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x30af8bc, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x30af8bc*=0xec, lpOverlapped=0x0) returned 1 [0125.580] SetEndOfFile (hFile=0x1f4) returned 1 [0125.580] CloseHandle (hObject=0x1f4) returned 1 [0125.580] SetFilePointerEx (in: hFile=0x224, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30afae8 | out: lpNewFilePointer=0x0) returned 1 [0125.580] SetEndOfFile (hFile=0x224) returned 1 [0125.583] CloseHandle (hObject=0x224) returned 1 [0125.583] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0125.583] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\enes\\msb1enes.its")) returned 1 [0125.583] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS") returned 73 [0125.583] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS") returned 73 [0125.583] lstrlenW (lpString=".doc") returned 4 [0125.583] lstrcmpiW (lpString1=".doc", lpString2=".ITS") returned -1 [0125.583] lstrlenW (lpString=".docx") returned 5 [0125.583] lstrcmpiW (lpString1=".docx", lpString2="S.ITS") returned -1 [0125.583] lstrlenW (lpString=".pdf") returned 4 [0125.583] lstrcmpiW (lpString1=".pdf", lpString2=".ITS") returned 1 [0125.584] lstrlenW (lpString=".xls") returned 4 [0125.584] lstrcmpiW (lpString1=".xls", lpString2=".ITS") returned 1 [0125.584] lstrlenW (lpString=".xlsx") returned 5 [0125.584] lstrcmpiW (lpString1=".xlsx", lpString2="S.ITS") returned -1 [0125.584] lstrlenW (lpString=".ppt") returned 4 [0125.584] lstrcmpiW (lpString1=".ppt", lpString2=".ITS") returned 1 [0125.584] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS") returned 73 [0125.584] lstrlenW (lpString=".zip") returned 4 [0125.584] lstrcmpiW (lpString1=".zip", lpString2=".ITS") returned 1 [0125.584] lstrlenW (lpString=".rar") returned 4 [0125.584] lstrcmpiW (lpString1=".rar", lpString2=".ITS") returned 1 [0125.584] lstrlenW (lpString=".bz2") returned 4 [0125.584] lstrcmpiW (lpString1=".bz2", lpString2=".ITS") returned -1 [0125.584] lstrlenW (lpString=".7z") returned 3 [0125.584] lstrcmpiW (lpString1=".7z", lpString2="ITS") returned -1 [0125.584] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS") returned 73 [0125.584] lstrlenW (lpString=".dbf") returned 4 [0125.584] lstrcmpiW (lpString1=".dbf", lpString2=".ITS") returned -1 [0125.584] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS") returned 73 [0125.584] lstrlenW (lpString=".1cd") returned 4 [0125.584] lstrcmpiW (lpString1=".1cd", lpString2=".ITS") returned -1 [0125.584] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS") returned 73 [0125.584] lstrlenW (lpString=".jpg") returned 4 [0125.584] lstrcmpiW (lpString1=".jpg", lpString2=".ITS") returned 1 [0125.584] SetFilePointerEx (in: hFile=0x224, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30afae8 | out: lpNewFilePointer=0x0) returned 1 [0125.584] SetFilePointerEx (in: hFile=0x224, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30afae8 | out: lpNewFilePointer=0x0) returned 1 [0125.584] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.DLL.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\esen\\msb1esen.dll.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0125.585] GetLastError () returned 0x0 [0125.585] ReadFile (in: hFile=0x224, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30afaf4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x30afaf4*=0x38200, lpOverlapped=0x0) returned 1 [0125.603] WriteFile (in: hFile=0x1f4, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0x38210, lpNumberOfBytesWritten=0x30af8bc, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x30af8bc*=0x38210, lpOverlapped=0x0) returned 1 [0125.605] ReadFile (in: hFile=0x224, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30afaf4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x30afaf4*=0x0, lpOverlapped=0x0) returned 1 [0125.605] WriteFile (in: hFile=0x1f4, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x30af8bc, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x30af8bc*=0xec, lpOverlapped=0x0) returned 1 [0125.605] SetEndOfFile (hFile=0x1f4) returned 1 [0125.606] CloseHandle (hObject=0x1f4) returned 1 [0125.606] SetFilePointerEx (in: hFile=0x224, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30afae8 | out: lpNewFilePointer=0x0) returned 1 [0125.606] SetEndOfFile (hFile=0x224) returned 1 [0125.606] CloseHandle (hObject=0x224) returned 1 [0125.606] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.DLL.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0125.607] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\esen\\msb1esen.dll")) returned 1 [0125.607] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.DLL") returned 73 [0125.607] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.DLL") returned 73 [0125.607] lstrlenW (lpString=".doc") returned 4 [0125.607] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0125.607] lstrlenW (lpString=".docx") returned 5 [0125.607] lstrcmpiW (lpString1=".docx", lpString2="N.DLL") returned -1 [0125.607] lstrlenW (lpString=".pdf") returned 4 [0125.607] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0125.607] lstrlenW (lpString=".xls") returned 4 [0125.607] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0125.607] lstrlenW (lpString=".xlsx") returned 5 [0125.607] lstrcmpiW (lpString1=".xlsx", lpString2="N.DLL") returned -1 [0125.607] lstrlenW (lpString=".ppt") returned 4 [0125.607] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0125.607] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.DLL") returned 73 [0125.607] lstrlenW (lpString=".zip") returned 4 [0125.607] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0125.607] lstrlenW (lpString=".rar") returned 4 [0125.607] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0125.607] lstrlenW (lpString=".bz2") returned 4 [0125.607] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0125.607] lstrlenW (lpString=".7z") returned 3 [0125.607] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0125.607] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.DLL") returned 73 [0125.607] lstrlenW (lpString=".dbf") returned 4 [0125.607] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0125.607] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.DLL") returned 73 [0125.607] lstrlenW (lpString=".1cd") returned 4 [0125.608] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0125.608] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.DLL") returned 73 [0125.608] lstrlenW (lpString=".jpg") returned 4 [0125.608] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0125.608] SetFilePointerEx (in: hFile=0x224, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30afae8 | out: lpNewFilePointer=0x0) returned 1 [0125.608] SetFilePointerEx (in: hFile=0x224, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30afae8 | out: lpNewFilePointer=0x0) returned 1 [0125.608] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\esen\\msb1esen.its.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0125.812] GetLastError () returned 0x0 [0125.812] ReadFile (in: hFile=0x224, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30afaf4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x30afaf4*=0xff7f2, lpOverlapped=0x0) returned 1 [0126.212] WriteFile (in: hFile=0x218, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0xff800, lpNumberOfBytesWritten=0x30af8bc, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x30af8bc*=0xff800, lpOverlapped=0x0) returned 1 [0126.220] ReadFile (in: hFile=0x224, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30afaf4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x30afaf4*=0x0, lpOverlapped=0x0) returned 1 [0126.220] WriteFile (in: hFile=0x218, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x30af8bc, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x30af8bc*=0xec, lpOverlapped=0x0) returned 1 [0126.220] SetEndOfFile (hFile=0x218) returned 1 [0126.220] CloseHandle (hObject=0x218) returned 1 [0126.220] SetFilePointerEx (in: hFile=0x224, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30afae8 | out: lpNewFilePointer=0x0) returned 1 [0126.220] SetEndOfFile (hFile=0x224) returned 1 [0126.223] CloseHandle (hObject=0x224) returned 1 [0126.223] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0126.223] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\esen\\msb1esen.its")) returned 1 [0126.223] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS") returned 73 [0126.223] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS") returned 73 [0126.223] lstrlenW (lpString=".doc") returned 4 [0126.223] lstrcmpiW (lpString1=".doc", lpString2=".ITS") returned -1 [0126.223] lstrlenW (lpString=".docx") returned 5 [0126.223] lstrcmpiW (lpString1=".docx", lpString2="N.ITS") returned -1 [0126.223] lstrlenW (lpString=".pdf") returned 4 [0126.223] lstrcmpiW (lpString1=".pdf", lpString2=".ITS") returned 1 [0126.223] lstrlenW (lpString=".xls") returned 4 [0126.223] lstrcmpiW (lpString1=".xls", lpString2=".ITS") returned 1 [0126.223] lstrlenW (lpString=".xlsx") returned 5 [0126.223] lstrcmpiW (lpString1=".xlsx", lpString2="N.ITS") returned -1 [0126.223] lstrlenW (lpString=".ppt") returned 4 [0126.223] lstrcmpiW (lpString1=".ppt", lpString2=".ITS") returned 1 [0126.223] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS") returned 73 [0126.223] lstrlenW (lpString=".zip") returned 4 [0126.223] lstrcmpiW (lpString1=".zip", lpString2=".ITS") returned 1 [0126.224] lstrlenW (lpString=".rar") returned 4 [0126.224] lstrcmpiW (lpString1=".rar", lpString2=".ITS") returned 1 [0126.224] lstrlenW (lpString=".bz2") returned 4 [0126.224] lstrcmpiW (lpString1=".bz2", lpString2=".ITS") returned -1 [0126.224] lstrlenW (lpString=".7z") returned 3 [0126.224] lstrcmpiW (lpString1=".7z", lpString2="ITS") returned -1 [0126.224] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS") returned 73 [0126.224] lstrlenW (lpString=".dbf") returned 4 [0126.224] lstrcmpiW (lpString1=".dbf", lpString2=".ITS") returned -1 [0126.224] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS") returned 73 [0126.224] lstrlenW (lpString=".1cd") returned 4 [0126.224] lstrcmpiW (lpString1=".1cd", lpString2=".ITS") returned -1 [0126.224] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS") returned 73 [0126.224] lstrlenW (lpString=".jpg") returned 4 [0126.224] lstrcmpiW (lpString1=".jpg", lpString2=".ITS") returned 1 [0126.619] SetFilePointerEx (in: hFile=0x238, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30afae8 | out: lpNewFilePointer=0x0) returned 1 [0126.619] SetFilePointerEx (in: hFile=0x238, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x30afae8 | out: lpNewFilePointer=0x0) returned 1 [0126.619] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\fren\\wt61fr.lex.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x240 [0126.619] GetLastError () returned 0x0 [0126.619] ReadFile (hFile=0x238, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x30afaf4, lpOverlapped=0x0) Thread: id = 30 os_tid = 0xba8 [0102.640] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x757c0000 [0102.640] GetProcAddress (hModule=0x757c0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x757ed650 [0102.640] Wow64DisableWow64FsRedirection (in: OldValue=0x342ff50 | out: OldValue=0x342ff50*=0x0) returned 1 [0102.640] lstrlenW (lpString="kernel32.dll") returned 12 [0102.640] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0102.640] Sleep (dwMilliseconds=0x64) [0102.879] lstrcmpiW (lpString1=".xml", lpString2=".waifu") returned 1 [0102.879] lstrlenW (lpString="PublisherMUI.xml") returned 16 [0102.879] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0102.974] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x342ff14 | out: lpFileSize=0x342ff14*=1450) returned 1 [0102.974] CloseHandle (hObject=0x18c) returned 1 [0102.974] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml")) returned 0x2020 [0102.974] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0102.974] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0102.974] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0102.974] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0102.975] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0102.975] GetLastError () returned 0x0 [0102.975] ReadFile (in: hFile=0x18c, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x5aa, lpOverlapped=0x0) returned 1 [0102.979] WriteFile (in: hFile=0x190, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0x5b0, lpOverlapped=0x0) returned 1 [0102.979] ReadFile (in: hFile=0x18c, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x0, lpOverlapped=0x0) returned 1 [0102.979] WriteFile (in: hFile=0x190, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0xf4, lpOverlapped=0x0) returned 1 [0102.979] SetEndOfFile (hFile=0x190) returned 1 [0102.980] CloseHandle (hObject=0x190) returned 1 [0102.980] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0102.980] SetEndOfFile (hFile=0x18c) returned 1 [0102.981] CloseHandle (hObject=0x18c) returned 1 [0102.981] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x2020) returned 1 [0102.981] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml")) returned 1 [0102.981] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0102.981] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0102.981] lstrlenW (lpString=".doc") returned 4 [0102.981] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0102.981] lstrlenW (lpString=".docx") returned 5 [0102.981] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0102.981] lstrlenW (lpString=".pdf") returned 4 [0102.981] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0102.981] lstrlenW (lpString=".xls") returned 4 [0102.981] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0102.981] lstrlenW (lpString=".xlsx") returned 5 [0102.981] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0102.981] lstrlenW (lpString=".ppt") returned 4 [0102.981] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0102.981] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0102.981] lstrlenW (lpString=".zip") returned 4 [0102.981] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0102.981] lstrlenW (lpString=".rar") returned 4 [0102.981] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0102.981] lstrlenW (lpString=".bz2") returned 4 [0102.981] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0102.981] lstrlenW (lpString=".7z") returned 3 [0102.981] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0102.981] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0102.981] lstrlenW (lpString=".dbf") returned 4 [0102.981] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0102.981] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0102.981] lstrlenW (lpString=".1cd") returned 4 [0102.981] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0102.981] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0102.981] lstrlenW (lpString=".jpg") returned 4 [0102.981] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0102.982] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0102.982] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0102.982] lstrlenW (lpString=".doc") returned 4 [0102.982] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0102.982] lstrlenW (lpString=".docx") returned 5 [0102.982] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0102.982] lstrlenW (lpString=".pdf") returned 4 [0102.982] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0102.982] lstrlenW (lpString=".xls") returned 4 [0102.982] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0102.982] lstrlenW (lpString=".xlsx") returned 5 [0102.982] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0102.982] lstrlenW (lpString=".ppt") returned 4 [0102.982] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0102.982] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0102.982] lstrlenW (lpString=".zip") returned 4 [0102.982] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0102.982] lstrlenW (lpString=".rar") returned 4 [0102.982] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0102.982] lstrlenW (lpString=".bz2") returned 4 [0102.982] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0102.982] lstrlenW (lpString=".7z") returned 3 [0102.982] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0102.982] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0102.982] lstrlenW (lpString=".dbf") returned 4 [0102.982] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0102.982] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0102.982] lstrlenW (lpString=".1cd") returned 4 [0102.982] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0102.982] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0102.982] lstrlenW (lpString=".jpg") returned 4 [0102.982] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0102.982] lstrcmpiW (lpString1=".xml", lpString2=".waifu") returned 1 [0102.982] lstrlenW (lpString="Proof.xml") returned 9 [0102.982] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0102.982] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x342ff14 | out: lpFileSize=0x342ff14*=1458) returned 1 [0102.982] CloseHandle (hObject=0x18c) returned 1 [0102.983] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml")) returned 0x2020 [0102.983] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0102.983] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0102.983] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0102.983] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0102.983] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0102.983] GetLastError () returned 0x0 [0102.983] ReadFile (in: hFile=0x18c, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x5b2, lpOverlapped=0x0) returned 1 [0102.984] WriteFile (in: hFile=0x190, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0x5c0, lpOverlapped=0x0) returned 1 [0102.984] ReadFile (in: hFile=0x18c, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x0, lpOverlapped=0x0) returned 1 [0102.984] WriteFile (in: hFile=0x190, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0xe6, lpOverlapped=0x0) returned 1 [0102.985] SetEndOfFile (hFile=0x190) returned 1 [0102.985] CloseHandle (hObject=0x190) returned 1 [0102.985] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0102.985] SetEndOfFile (hFile=0x18c) returned 1 [0102.986] CloseHandle (hObject=0x18c) returned 1 [0102.986] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x2020) returned 1 [0102.986] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml")) returned 1 [0102.986] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0102.986] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0102.986] lstrlenW (lpString=".doc") returned 4 [0102.986] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0102.986] lstrlenW (lpString=".docx") returned 5 [0102.986] lstrcmpiW (lpString1=".docx", lpString2="f.xml") returned -1 [0102.986] lstrlenW (lpString=".pdf") returned 4 [0102.986] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0102.986] lstrlenW (lpString=".xls") returned 4 [0102.986] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0102.986] lstrlenW (lpString=".xlsx") returned 5 [0102.986] lstrcmpiW (lpString1=".xlsx", lpString2="f.xml") returned -1 [0102.986] lstrlenW (lpString=".ppt") returned 4 [0102.986] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0102.986] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0102.986] lstrlenW (lpString=".zip") returned 4 [0102.986] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0102.986] lstrlenW (lpString=".rar") returned 4 [0102.986] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0102.986] lstrlenW (lpString=".bz2") returned 4 [0102.986] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0102.986] lstrlenW (lpString=".7z") returned 3 [0102.987] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0102.987] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0102.987] lstrlenW (lpString=".dbf") returned 4 [0102.987] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0102.987] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0102.987] lstrlenW (lpString=".1cd") returned 4 [0102.987] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0102.987] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0102.987] lstrlenW (lpString=".jpg") returned 4 [0102.987] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0102.987] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0102.987] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0102.987] lstrlenW (lpString=".doc") returned 4 [0102.987] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0102.987] lstrlenW (lpString=".docx") returned 5 [0102.987] lstrcmpiW (lpString1=".docx", lpString2="f.xml") returned -1 [0102.987] lstrlenW (lpString=".pdf") returned 4 [0102.987] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0102.987] lstrlenW (lpString=".xls") returned 4 [0102.987] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0102.987] lstrlenW (lpString=".xlsx") returned 5 [0102.987] lstrcmpiW (lpString1=".xlsx", lpString2="f.xml") returned -1 [0102.987] lstrlenW (lpString=".ppt") returned 4 [0102.987] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0102.987] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0102.987] lstrlenW (lpString=".zip") returned 4 [0102.987] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0102.987] lstrlenW (lpString=".rar") returned 4 [0102.987] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0102.987] lstrlenW (lpString=".bz2") returned 4 [0102.987] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0102.987] lstrlenW (lpString=".7z") returned 3 [0102.987] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0102.987] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0102.987] lstrlenW (lpString=".dbf") returned 4 [0102.987] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0102.987] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0102.987] lstrlenW (lpString=".1cd") returned 4 [0102.987] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0102.987] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0102.987] lstrlenW (lpString=".jpg") returned 4 [0102.987] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0102.987] lstrcmpiW (lpString1=".xml", lpString2=".waifu") returned 1 [0102.987] lstrlenW (lpString="Proofing.xml") returned 12 [0102.988] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0102.988] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x342ff14 | out: lpFileSize=0x342ff14*=811) returned 1 [0102.988] CloseHandle (hObject=0x18c) returned 1 [0102.988] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml")) returned 0x2020 [0102.988] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0102.988] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0102.988] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0102.988] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0102.988] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0102.988] GetLastError () returned 0x0 [0102.988] ReadFile (in: hFile=0x18c, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x32b, lpOverlapped=0x0) returned 1 [0102.989] WriteFile (in: hFile=0x190, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0x330, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0x330, lpOverlapped=0x0) returned 1 [0102.990] ReadFile (in: hFile=0x18c, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x0, lpOverlapped=0x0) returned 1 [0102.990] WriteFile (in: hFile=0x190, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0xec, lpOverlapped=0x0) returned 1 [0102.990] SetEndOfFile (hFile=0x190) returned 1 [0102.990] CloseHandle (hObject=0x190) returned 1 [0102.990] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0102.990] SetEndOfFile (hFile=0x18c) returned 1 [0102.991] CloseHandle (hObject=0x18c) returned 1 [0102.991] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x2020) returned 1 [0102.991] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml")) returned 1 [0102.991] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0102.991] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0102.991] lstrlenW (lpString=".doc") returned 4 [0102.991] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0102.991] lstrlenW (lpString=".docx") returned 5 [0102.991] lstrcmpiW (lpString1=".docx", lpString2="g.xml") returned -1 [0102.991] lstrlenW (lpString=".pdf") returned 4 [0102.991] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0102.991] lstrlenW (lpString=".xls") returned 4 [0102.991] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0102.991] lstrlenW (lpString=".xlsx") returned 5 [0102.991] lstrcmpiW (lpString1=".xlsx", lpString2="g.xml") returned -1 [0102.991] lstrlenW (lpString=".ppt") returned 4 [0102.991] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0102.991] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0102.991] lstrlenW (lpString=".zip") returned 4 [0102.992] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0102.992] lstrlenW (lpString=".rar") returned 4 [0102.992] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0102.992] lstrlenW (lpString=".bz2") returned 4 [0102.992] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0102.992] lstrlenW (lpString=".7z") returned 3 [0102.992] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0102.992] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0102.992] lstrlenW (lpString=".dbf") returned 4 [0102.992] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0102.992] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0102.992] lstrlenW (lpString=".1cd") returned 4 [0102.992] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0102.992] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0102.992] lstrlenW (lpString=".jpg") returned 4 [0102.992] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0102.992] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0102.992] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0102.992] lstrlenW (lpString=".doc") returned 4 [0102.992] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0102.992] lstrlenW (lpString=".docx") returned 5 [0102.992] lstrcmpiW (lpString1=".docx", lpString2="g.xml") returned -1 [0102.992] lstrlenW (lpString=".pdf") returned 4 [0102.992] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0102.992] lstrlenW (lpString=".xls") returned 4 [0102.992] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0102.992] lstrlenW (lpString=".xlsx") returned 5 [0102.992] lstrcmpiW (lpString1=".xlsx", lpString2="g.xml") returned -1 [0102.992] lstrlenW (lpString=".ppt") returned 4 [0102.992] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0102.992] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0102.992] lstrlenW (lpString=".zip") returned 4 [0102.992] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0102.992] lstrlenW (lpString=".rar") returned 4 [0102.992] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0102.992] lstrlenW (lpString=".bz2") returned 4 [0102.992] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0102.992] lstrlenW (lpString=".7z") returned 3 [0102.992] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0102.992] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0102.992] lstrlenW (lpString=".dbf") returned 4 [0102.992] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0102.992] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0102.992] lstrlenW (lpString=".1cd") returned 4 [0102.992] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0102.992] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0102.992] lstrlenW (lpString=".jpg") returned 4 [0102.992] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0102.993] lstrcmpiW (lpString1=".xml", lpString2=".waifu") returned 1 [0102.993] lstrlenW (lpString="Setup.xml") returned 9 [0102.993] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0102.993] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x342ff14 | out: lpFileSize=0x342ff14*=5884) returned 1 [0102.993] CloseHandle (hObject=0x18c) returned 1 [0102.993] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0102.993] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0102.993] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0102.993] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0102.993] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0102.993] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0102.993] GetLastError () returned 0x0 [0102.993] ReadFile (in: hFile=0x18c, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x16fc, lpOverlapped=0x0) returned 1 [0102.994] WriteFile (in: hFile=0x190, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0x1700, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0x1700, lpOverlapped=0x0) returned 1 [0102.995] ReadFile (in: hFile=0x18c, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x0, lpOverlapped=0x0) returned 1 [0102.995] WriteFile (in: hFile=0x190, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0xe6, lpOverlapped=0x0) returned 1 [0102.995] SetEndOfFile (hFile=0x190) returned 1 [0102.995] CloseHandle (hObject=0x190) returned 1 [0102.996] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0102.996] SetEndOfFile (hFile=0x18c) returned 1 [0102.996] CloseHandle (hObject=0x18c) returned 1 [0102.996] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x2020) returned 1 [0102.996] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0102.997] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0102.997] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0102.997] lstrlenW (lpString=".doc") returned 4 [0102.997] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0102.997] lstrlenW (lpString=".docx") returned 5 [0102.997] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0102.997] lstrlenW (lpString=".pdf") returned 4 [0102.997] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0102.997] lstrlenW (lpString=".xls") returned 4 [0102.997] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0102.997] lstrlenW (lpString=".xlsx") returned 5 [0102.997] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0102.997] lstrlenW (lpString=".ppt") returned 4 [0102.997] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0102.997] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0102.997] lstrlenW (lpString=".zip") returned 4 [0102.997] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0102.997] lstrlenW (lpString=".rar") returned 4 [0102.997] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0102.997] lstrlenW (lpString=".bz2") returned 4 [0102.997] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0102.997] lstrlenW (lpString=".7z") returned 3 [0102.997] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0102.997] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0102.997] lstrlenW (lpString=".dbf") returned 4 [0102.997] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0102.997] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0102.997] lstrlenW (lpString=".1cd") returned 4 [0102.997] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0102.997] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0102.997] lstrlenW (lpString=".jpg") returned 4 [0102.997] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0102.997] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0102.997] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0102.997] lstrlenW (lpString=".doc") returned 4 [0102.997] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0102.997] lstrlenW (lpString=".docx") returned 5 [0102.997] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0102.997] lstrlenW (lpString=".pdf") returned 4 [0102.997] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0102.997] lstrlenW (lpString=".xls") returned 4 [0102.997] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0102.997] lstrlenW (lpString=".xlsx") returned 5 [0102.997] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0102.997] lstrlenW (lpString=".ppt") returned 4 [0102.997] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0102.997] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0102.997] lstrlenW (lpString=".zip") returned 4 [0102.997] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0102.997] lstrlenW (lpString=".rar") returned 4 [0102.997] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0102.998] lstrlenW (lpString=".bz2") returned 4 [0102.998] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0102.998] lstrlenW (lpString=".7z") returned 3 [0102.998] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0102.998] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0102.998] lstrlenW (lpString=".dbf") returned 4 [0102.998] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0102.998] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0102.998] lstrlenW (lpString=".1cd") returned 4 [0102.998] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0102.998] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0102.998] lstrlenW (lpString=".jpg") returned 4 [0102.998] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0102.998] lstrcmpiW (lpString1=".xml", lpString2=".waifu") returned 1 [0102.998] lstrlenW (lpString="Office32MUI.xml") returned 15 [0102.998] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0102.998] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x342ff14 | out: lpFileSize=0x342ff14*=1383) returned 1 [0102.998] CloseHandle (hObject=0x18c) returned 1 [0102.999] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml")) returned 0x2020 [0102.999] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0102.999] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0102.999] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0102.999] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0102.999] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0102.999] GetLastError () returned 0x0 [0102.999] ReadFile (in: hFile=0x18c, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x567, lpOverlapped=0x0) returned 1 [0103.000] WriteFile (in: hFile=0x190, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0x570, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0x570, lpOverlapped=0x0) returned 1 [0103.000] ReadFile (in: hFile=0x18c, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x0, lpOverlapped=0x0) returned 1 [0103.001] WriteFile (in: hFile=0x190, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0xf2, lpOverlapped=0x0) returned 1 [0103.001] SetEndOfFile (hFile=0x190) returned 1 [0103.001] CloseHandle (hObject=0x190) returned 1 [0103.001] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0103.001] SetEndOfFile (hFile=0x18c) returned 1 [0103.002] CloseHandle (hObject=0x18c) returned 1 [0103.002] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x2020) returned 1 [0103.002] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml")) returned 1 [0103.002] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0103.003] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0103.003] lstrlenW (lpString=".doc") returned 4 [0103.003] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0103.003] lstrlenW (lpString=".docx") returned 5 [0103.003] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0103.003] lstrlenW (lpString=".pdf") returned 4 [0103.003] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0103.003] lstrlenW (lpString=".xls") returned 4 [0103.003] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0103.003] lstrlenW (lpString=".xlsx") returned 5 [0103.003] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0103.003] lstrlenW (lpString=".ppt") returned 4 [0103.003] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0103.003] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0103.003] lstrlenW (lpString=".zip") returned 4 [0103.003] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0103.003] lstrlenW (lpString=".rar") returned 4 [0103.003] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0103.003] lstrlenW (lpString=".bz2") returned 4 [0103.003] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0103.003] lstrlenW (lpString=".7z") returned 3 [0103.003] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0103.003] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0103.003] lstrlenW (lpString=".dbf") returned 4 [0103.003] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0103.003] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0103.003] lstrlenW (lpString=".1cd") returned 4 [0103.003] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0103.003] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0103.003] lstrlenW (lpString=".jpg") returned 4 [0103.003] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0103.003] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0103.003] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0103.003] lstrlenW (lpString=".doc") returned 4 [0103.003] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0103.003] lstrlenW (lpString=".docx") returned 5 [0103.003] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0103.003] lstrlenW (lpString=".pdf") returned 4 [0103.003] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0103.003] lstrlenW (lpString=".xls") returned 4 [0103.003] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0103.003] lstrlenW (lpString=".xlsx") returned 5 [0103.003] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0103.003] lstrlenW (lpString=".ppt") returned 4 [0103.003] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0103.003] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0103.003] lstrlenW (lpString=".zip") returned 4 [0103.003] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0103.003] lstrlenW (lpString=".rar") returned 4 [0103.003] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0103.004] lstrlenW (lpString=".bz2") returned 4 [0103.004] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0103.004] lstrlenW (lpString=".7z") returned 3 [0103.004] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0103.004] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0103.004] lstrlenW (lpString=".dbf") returned 4 [0103.004] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0103.004] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0103.004] lstrlenW (lpString=".1cd") returned 4 [0103.004] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0103.004] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0103.004] lstrlenW (lpString=".jpg") returned 4 [0103.004] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0103.004] lstrcmpiW (lpString1=".xml", lpString2=".waifu") returned 1 [0103.004] lstrlenW (lpString="Setup.xml") returned 9 [0103.004] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0103.004] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x342ff14 | out: lpFileSize=0x342ff14*=2362) returned 1 [0103.004] CloseHandle (hObject=0x18c) returned 1 [0103.004] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0103.004] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0103.004] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0103.004] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0103.004] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0103.004] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0103.005] GetLastError () returned 0x0 [0103.005] ReadFile (in: hFile=0x18c, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x93a, lpOverlapped=0x0) returned 1 [0103.006] WriteFile (in: hFile=0x190, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0x940, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0x940, lpOverlapped=0x0) returned 1 [0103.006] ReadFile (in: hFile=0x18c, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x0, lpOverlapped=0x0) returned 1 [0103.006] WriteFile (in: hFile=0x190, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0xe6, lpOverlapped=0x0) returned 1 [0103.006] SetEndOfFile (hFile=0x190) returned 1 [0103.006] CloseHandle (hObject=0x190) returned 1 [0103.007] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0103.007] SetEndOfFile (hFile=0x18c) returned 1 [0103.007] CloseHandle (hObject=0x18c) returned 1 [0103.007] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x2020) returned 1 [0103.007] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0103.008] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0103.008] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0103.008] lstrlenW (lpString=".doc") returned 4 [0103.008] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0103.008] lstrlenW (lpString=".docx") returned 5 [0103.008] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0103.008] lstrlenW (lpString=".pdf") returned 4 [0103.008] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0103.008] lstrlenW (lpString=".xls") returned 4 [0103.008] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0103.008] lstrlenW (lpString=".xlsx") returned 5 [0103.008] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0103.008] lstrlenW (lpString=".ppt") returned 4 [0103.008] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0103.008] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0103.008] lstrlenW (lpString=".zip") returned 4 [0103.008] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0103.008] lstrlenW (lpString=".rar") returned 4 [0103.008] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0103.008] lstrlenW (lpString=".bz2") returned 4 [0103.008] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0103.008] lstrlenW (lpString=".7z") returned 3 [0103.008] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0103.008] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0103.008] lstrlenW (lpString=".dbf") returned 4 [0103.008] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0103.008] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0103.008] lstrlenW (lpString=".1cd") returned 4 [0103.008] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0103.008] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0103.008] lstrlenW (lpString=".jpg") returned 4 [0103.008] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0103.008] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0103.008] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0103.008] lstrlenW (lpString=".doc") returned 4 [0103.008] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0103.008] lstrlenW (lpString=".docx") returned 5 [0103.008] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0103.008] lstrlenW (lpString=".pdf") returned 4 [0103.008] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0103.008] lstrlenW (lpString=".xls") returned 4 [0103.008] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0103.009] lstrlenW (lpString=".xlsx") returned 5 [0103.009] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0103.009] lstrlenW (lpString=".ppt") returned 4 [0103.009] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0103.009] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0103.009] lstrlenW (lpString=".zip") returned 4 [0103.009] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0103.009] lstrlenW (lpString=".rar") returned 4 [0103.009] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0103.009] lstrlenW (lpString=".bz2") returned 4 [0103.009] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0103.009] lstrlenW (lpString=".7z") returned 3 [0103.009] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0103.009] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0103.009] lstrlenW (lpString=".dbf") returned 4 [0103.009] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0103.009] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0103.009] lstrlenW (lpString=".1cd") returned 4 [0103.009] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0103.009] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0103.009] lstrlenW (lpString=".jpg") returned 4 [0103.009] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0103.009] lstrcmpiW (lpString1=".xml", lpString2=".waifu") returned 1 [0103.009] lstrlenW (lpString="InfoPathMUI.xml") returned 15 [0103.009] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0103.266] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x342ff14 | out: lpFileSize=0x342ff14*=1231) returned 1 [0103.266] CloseHandle (hObject=0x174) returned 1 [0103.266] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml")) returned 0x2020 [0103.266] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0103.267] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0103.267] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0103.267] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0103.267] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0103.267] GetLastError () returned 0x0 [0103.267] ReadFile (in: hFile=0x174, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x4cf, lpOverlapped=0x0) returned 1 [0103.337] WriteFile (in: hFile=0x184, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0x4d0, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0x4d0, lpOverlapped=0x0) returned 1 [0103.677] ReadFile (in: hFile=0x174, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x0, lpOverlapped=0x0) returned 1 [0103.677] WriteFile (in: hFile=0x184, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0xf2, lpOverlapped=0x0) returned 1 [0103.677] SetEndOfFile (hFile=0x184) returned 1 [0103.677] CloseHandle (hObject=0x184) returned 1 [0103.678] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0103.678] SetEndOfFile (hFile=0x174) returned 1 [0104.103] CloseHandle (hObject=0x174) returned 1 [0104.199] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x2020) returned 1 [0104.199] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml")) returned 1 [0104.199] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0104.199] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0104.199] lstrlenW (lpString=".doc") returned 4 [0104.199] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0104.199] lstrlenW (lpString=".docx") returned 5 [0104.199] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0104.199] lstrlenW (lpString=".pdf") returned 4 [0104.199] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0104.199] lstrlenW (lpString=".xls") returned 4 [0104.199] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0104.199] lstrlenW (lpString=".xlsx") returned 5 [0104.199] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0104.199] lstrlenW (lpString=".ppt") returned 4 [0104.199] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0104.199] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0104.199] lstrlenW (lpString=".zip") returned 4 [0104.199] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0104.199] lstrlenW (lpString=".rar") returned 4 [0104.199] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0104.200] lstrlenW (lpString=".bz2") returned 4 [0104.200] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0104.200] lstrlenW (lpString=".7z") returned 3 [0104.200] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0104.200] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0104.200] lstrlenW (lpString=".dbf") returned 4 [0104.200] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0104.200] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0104.200] lstrlenW (lpString=".1cd") returned 4 [0104.200] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0104.200] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0104.200] lstrlenW (lpString=".jpg") returned 4 [0104.200] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0104.200] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0104.200] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0104.200] lstrlenW (lpString=".doc") returned 4 [0104.200] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0104.200] lstrlenW (lpString=".docx") returned 5 [0104.200] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0104.200] lstrlenW (lpString=".pdf") returned 4 [0104.200] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0104.200] lstrlenW (lpString=".xls") returned 4 [0104.200] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0104.200] lstrlenW (lpString=".xlsx") returned 5 [0104.200] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0104.200] lstrlenW (lpString=".ppt") returned 4 [0104.200] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0104.200] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0104.200] lstrlenW (lpString=".zip") returned 4 [0104.200] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0104.200] lstrlenW (lpString=".rar") returned 4 [0104.200] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0104.200] lstrlenW (lpString=".bz2") returned 4 [0104.200] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0104.200] lstrlenW (lpString=".7z") returned 3 [0104.200] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0104.200] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0104.200] lstrlenW (lpString=".dbf") returned 4 [0104.200] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0104.200] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0104.200] lstrlenW (lpString=".1cd") returned 4 [0104.200] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0104.200] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0104.200] lstrlenW (lpString=".jpg") returned 4 [0104.200] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0104.200] lstrcmpiW (lpString1=".xml", lpString2=".waifu") returned 1 [0104.201] lstrlenW (lpString="Setup.xml") returned 9 [0104.201] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0104.201] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x342ff14 | out: lpFileSize=0x342ff14*=16683) returned 1 [0104.201] CloseHandle (hObject=0x174) returned 1 [0104.201] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0104.201] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0104.202] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0104.202] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0104.202] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0104.202] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0104.202] GetLastError () returned 0x0 [0104.202] ReadFile (in: hFile=0x174, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x412b, lpOverlapped=0x0) returned 1 [0104.203] WriteFile (in: hFile=0x184, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0x4130, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0x4130, lpOverlapped=0x0) returned 1 [0104.567] ReadFile (in: hFile=0x174, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x0, lpOverlapped=0x0) returned 1 [0104.567] WriteFile (in: hFile=0x184, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0xe6, lpOverlapped=0x0) returned 1 [0104.567] SetEndOfFile (hFile=0x184) returned 1 [0104.567] CloseHandle (hObject=0x184) returned 1 [0104.568] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0104.568] SetEndOfFile (hFile=0x174) returned 1 [0104.568] CloseHandle (hObject=0x174) returned 1 [0104.568] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x2020) returned 1 [0104.569] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0104.569] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0104.569] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0104.569] lstrlenW (lpString=".doc") returned 4 [0104.569] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0104.569] lstrlenW (lpString=".docx") returned 5 [0104.569] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0104.569] lstrlenW (lpString=".pdf") returned 4 [0104.569] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0104.569] lstrlenW (lpString=".xls") returned 4 [0104.569] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0104.569] lstrlenW (lpString=".xlsx") returned 5 [0104.569] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0104.569] lstrlenW (lpString=".ppt") returned 4 [0104.569] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0104.569] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0104.569] lstrlenW (lpString=".zip") returned 4 [0104.569] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0104.569] lstrlenW (lpString=".rar") returned 4 [0104.569] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0104.569] lstrlenW (lpString=".bz2") returned 4 [0104.569] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0104.569] lstrlenW (lpString=".7z") returned 3 [0104.569] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0104.569] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0104.569] lstrlenW (lpString=".dbf") returned 4 [0104.569] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0104.569] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0104.569] lstrlenW (lpString=".1cd") returned 4 [0104.569] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0104.569] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0104.569] lstrlenW (lpString=".jpg") returned 4 [0104.569] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0104.569] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0104.569] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0104.569] lstrlenW (lpString=".doc") returned 4 [0104.569] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0104.570] lstrlenW (lpString=".docx") returned 5 [0104.570] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0104.570] lstrlenW (lpString=".pdf") returned 4 [0104.570] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0104.570] lstrlenW (lpString=".xls") returned 4 [0104.570] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0104.570] lstrlenW (lpString=".xlsx") returned 5 [0104.570] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0104.570] lstrlenW (lpString=".ppt") returned 4 [0104.570] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0104.570] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0104.570] lstrlenW (lpString=".zip") returned 4 [0104.570] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0104.570] lstrlenW (lpString=".rar") returned 4 [0104.570] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0104.570] lstrlenW (lpString=".bz2") returned 4 [0104.570] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0104.570] lstrlenW (lpString=".7z") returned 3 [0104.570] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0104.570] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0104.570] lstrlenW (lpString=".dbf") returned 4 [0104.570] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0104.570] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0104.570] lstrlenW (lpString=".1cd") returned 4 [0104.570] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0104.570] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0104.570] lstrlenW (lpString=".jpg") returned 4 [0104.570] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0104.570] lstrcmpiW (lpString1=".xml", lpString2=".waifu") returned 1 [0104.570] lstrlenW (lpString="ipsdan.xml") returned 10 [0104.570] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdan.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdan.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0104.853] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x342ff14 | out: lpFileSize=0x342ff14*=2514) returned 1 [0104.853] CloseHandle (hObject=0x194) returned 1 [0104.853] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdan.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdan.xml")) returned 0x20 [0104.853] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdan.xml.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdan.xml.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0104.853] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdan.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdan.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0104.853] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdan.xml") returned 61 [0104.853] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdan.xml") returned 61 [0104.853] lstrlenW (lpString=".doc") returned 4 [0104.853] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0104.853] lstrlenW (lpString=".docx") returned 5 [0104.853] lstrcmpiW (lpString1=".docx", lpString2="n.xml") returned -1 [0104.853] lstrlenW (lpString=".pdf") returned 4 [0104.853] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0104.853] lstrlenW (lpString=".xls") returned 4 [0104.853] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0104.853] lstrlenW (lpString=".xlsx") returned 5 [0104.853] lstrcmpiW (lpString1=".xlsx", lpString2="n.xml") returned -1 [0104.853] lstrlenW (lpString=".ppt") returned 4 [0104.853] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0104.853] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdan.xml") returned 61 [0104.854] lstrlenW (lpString=".zip") returned 4 [0104.854] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0104.854] lstrlenW (lpString=".rar") returned 4 [0104.854] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0104.854] lstrlenW (lpString=".bz2") returned 4 [0104.854] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0104.854] lstrlenW (lpString=".7z") returned 3 [0104.854] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0104.854] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdan.xml") returned 61 [0104.854] lstrlenW (lpString=".dbf") returned 4 [0104.854] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0104.854] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdan.xml") returned 61 [0104.854] lstrlenW (lpString=".1cd") returned 4 [0104.854] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0104.854] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdan.xml") returned 61 [0104.854] lstrlenW (lpString=".jpg") returned 4 [0104.854] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0104.854] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdan.xml") returned 61 [0104.854] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdan.xml") returned 61 [0104.854] lstrlenW (lpString=".doc") returned 4 [0104.854] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0104.854] lstrlenW (lpString=".docx") returned 5 [0104.854] lstrcmpiW (lpString1=".docx", lpString2="n.xml") returned -1 [0104.854] lstrlenW (lpString=".pdf") returned 4 [0104.854] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0104.854] lstrlenW (lpString=".xls") returned 4 [0104.854] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0104.854] lstrlenW (lpString=".xlsx") returned 5 [0104.854] lstrcmpiW (lpString1=".xlsx", lpString2="n.xml") returned -1 [0104.854] lstrlenW (lpString=".ppt") returned 4 [0104.854] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0104.854] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdan.xml") returned 61 [0104.854] lstrlenW (lpString=".zip") returned 4 [0104.854] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0104.854] lstrlenW (lpString=".rar") returned 4 [0104.854] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0104.854] lstrlenW (lpString=".bz2") returned 4 [0104.854] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0104.854] lstrlenW (lpString=".7z") returned 3 [0104.854] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0104.854] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdan.xml") returned 61 [0104.854] lstrlenW (lpString=".dbf") returned 4 [0104.854] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0104.854] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdan.xml") returned 61 [0104.854] lstrlenW (lpString=".1cd") returned 4 [0104.854] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0104.854] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdan.xml") returned 61 [0104.854] lstrlenW (lpString=".jpg") returned 4 [0104.854] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0104.855] lstrcmpiW (lpString1=".xml", lpString2=".waifu") returned 1 [0104.855] lstrlenW (lpString="ipsen.xml") returned 9 [0104.855] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsen.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsen.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0104.899] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x342ff14 | out: lpFileSize=0x342ff14*=2578) returned 1 [0104.899] CloseHandle (hObject=0x174) returned 1 [0104.899] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsen.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsen.xml")) returned 0x20 [0104.900] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsen.xml.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsen.xml.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0104.900] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsen.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsen.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0104.900] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsen.xml") returned 60 [0104.900] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsen.xml") returned 60 [0104.900] lstrlenW (lpString=".doc") returned 4 [0104.900] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0104.900] lstrlenW (lpString=".docx") returned 5 [0104.900] lstrcmpiW (lpString1=".docx", lpString2="n.xml") returned -1 [0104.900] lstrlenW (lpString=".pdf") returned 4 [0104.900] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0104.900] lstrlenW (lpString=".xls") returned 4 [0104.900] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0104.900] lstrlenW (lpString=".xlsx") returned 5 [0104.900] lstrcmpiW (lpString1=".xlsx", lpString2="n.xml") returned -1 [0104.900] lstrlenW (lpString=".ppt") returned 4 [0104.900] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0104.900] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsen.xml") returned 60 [0104.900] lstrlenW (lpString=".zip") returned 4 [0104.900] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0104.900] lstrlenW (lpString=".rar") returned 4 [0104.900] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0104.900] lstrlenW (lpString=".bz2") returned 4 [0104.900] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0104.900] lstrlenW (lpString=".7z") returned 3 [0104.900] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0104.900] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsen.xml") returned 60 [0104.900] lstrlenW (lpString=".dbf") returned 4 [0104.900] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0104.900] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsen.xml") returned 60 [0104.900] lstrlenW (lpString=".1cd") returned 4 [0104.900] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0104.900] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsen.xml") returned 60 [0104.900] lstrlenW (lpString=".jpg") returned 4 [0104.900] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0104.900] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsen.xml") returned 60 [0104.900] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsen.xml") returned 60 [0104.900] lstrlenW (lpString=".doc") returned 4 [0104.900] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0104.900] lstrlenW (lpString=".docx") returned 5 [0104.900] lstrcmpiW (lpString1=".docx", lpString2="n.xml") returned -1 [0104.900] lstrlenW (lpString=".pdf") returned 4 [0104.900] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0104.900] lstrlenW (lpString=".xls") returned 4 [0104.900] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0104.901] lstrlenW (lpString=".xlsx") returned 5 [0104.901] lstrcmpiW (lpString1=".xlsx", lpString2="n.xml") returned -1 [0104.901] lstrlenW (lpString=".ppt") returned 4 [0104.901] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0104.901] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsen.xml") returned 60 [0104.901] lstrlenW (lpString=".zip") returned 4 [0104.901] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0104.901] lstrlenW (lpString=".rar") returned 4 [0104.901] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0104.901] lstrlenW (lpString=".bz2") returned 4 [0104.901] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0104.901] lstrlenW (lpString=".7z") returned 3 [0104.901] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0104.901] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsen.xml") returned 60 [0104.901] lstrlenW (lpString=".dbf") returned 4 [0104.901] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0104.901] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsen.xml") returned 60 [0104.901] lstrlenW (lpString=".1cd") returned 4 [0104.901] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0104.901] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsen.xml") returned 60 [0104.901] lstrlenW (lpString=".jpg") returned 4 [0104.901] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0104.901] lstrcmpiW (lpString1=".XML", lpString2=".waifu") returned 1 [0104.901] lstrlenW (lpString="AccessMUI.XML") returned 13 [0104.901] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0106.085] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x342ff14 | out: lpFileSize=0x342ff14*=1349) returned 1 [0106.085] CloseHandle (hObject=0x1ac) returned 1 [0106.085] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmui.xml")) returned 0x20 [0106.085] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmui.xml.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0106.085] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0106.085] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0106.085] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0106.085] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmui.xml.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0106.086] GetLastError () returned 0x0 [0106.086] ReadFile (in: hFile=0x1ac, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x545, lpOverlapped=0x0) returned 1 [0106.087] WriteFile (in: hFile=0x18c, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0x550, lpOverlapped=0x0) returned 1 [0106.087] ReadFile (in: hFile=0x1ac, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x0, lpOverlapped=0x0) returned 1 [0106.087] WriteFile (in: hFile=0x18c, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0xee, lpOverlapped=0x0) returned 1 [0106.087] SetEndOfFile (hFile=0x18c) returned 1 [0106.087] CloseHandle (hObject=0x18c) returned 1 [0106.088] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0106.088] SetEndOfFile (hFile=0x1ac) returned 1 [0106.088] CloseHandle (hObject=0x1ac) returned 1 [0106.088] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0106.089] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmui.xml")) returned 1 [0106.089] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106 [0106.089] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106 [0106.089] lstrlenW (lpString=".doc") returned 4 [0106.089] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0106.089] lstrlenW (lpString=".docx") returned 5 [0106.089] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0106.089] lstrlenW (lpString=".pdf") returned 4 [0106.089] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0106.089] lstrlenW (lpString=".xls") returned 4 [0106.089] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0106.089] lstrlenW (lpString=".xlsx") returned 5 [0106.089] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0106.089] lstrlenW (lpString=".ppt") returned 4 [0106.089] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0106.089] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106 [0106.089] lstrlenW (lpString=".zip") returned 4 [0106.089] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0106.089] lstrlenW (lpString=".rar") returned 4 [0106.089] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0106.089] lstrlenW (lpString=".bz2") returned 4 [0106.089] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0106.089] lstrlenW (lpString=".7z") returned 3 [0106.089] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0106.089] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106 [0106.089] lstrlenW (lpString=".dbf") returned 4 [0106.089] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0106.089] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106 [0106.089] lstrlenW (lpString=".1cd") returned 4 [0106.089] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0106.089] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106 [0106.089] lstrlenW (lpString=".jpg") returned 4 [0106.089] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0106.089] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106 [0106.089] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106 [0106.089] lstrlenW (lpString=".doc") returned 4 [0106.089] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0106.089] lstrlenW (lpString=".docx") returned 5 [0106.089] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0106.090] lstrlenW (lpString=".pdf") returned 4 [0106.090] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0106.090] lstrlenW (lpString=".xls") returned 4 [0106.090] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0106.090] lstrlenW (lpString=".xlsx") returned 5 [0106.090] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0106.090] lstrlenW (lpString=".ppt") returned 4 [0106.090] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0106.090] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106 [0106.090] lstrlenW (lpString=".zip") returned 4 [0106.090] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0106.090] lstrlenW (lpString=".rar") returned 4 [0106.090] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0106.090] lstrlenW (lpString=".bz2") returned 4 [0106.090] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0106.090] lstrlenW (lpString=".7z") returned 3 [0106.090] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0106.090] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106 [0106.090] lstrlenW (lpString=".dbf") returned 4 [0106.090] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0106.090] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106 [0106.090] lstrlenW (lpString=".1cd") returned 4 [0106.090] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0106.090] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106 [0106.090] lstrlenW (lpString=".jpg") returned 4 [0106.090] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0106.090] lstrcmpiW (lpString1=".XML", lpString2=".waifu") returned 1 [0106.090] lstrlenW (lpString="SETUP.XML") returned 9 [0106.090] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0106.090] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x342ff14 | out: lpFileSize=0x342ff14*=9352) returned 1 [0106.090] CloseHandle (hObject=0x1ac) returned 1 [0106.090] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.xml")) returned 0x20 [0106.090] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.xml.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0106.091] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0106.091] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0106.091] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0106.091] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.xml.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0106.091] GetLastError () returned 0x0 [0106.091] ReadFile (in: hFile=0x1ac, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x2488, lpOverlapped=0x0) returned 1 [0106.092] WriteFile (in: hFile=0x18c, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0x2490, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0x2490, lpOverlapped=0x0) returned 1 [0106.093] ReadFile (in: hFile=0x1ac, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x0, lpOverlapped=0x0) returned 1 [0106.093] WriteFile (in: hFile=0x18c, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0xe6, lpOverlapped=0x0) returned 1 [0106.093] SetEndOfFile (hFile=0x18c) returned 1 [0106.094] CloseHandle (hObject=0x18c) returned 1 [0106.094] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0106.094] SetEndOfFile (hFile=0x1ac) returned 1 [0106.095] CloseHandle (hObject=0x1ac) returned 1 [0106.095] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0106.095] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.xml")) returned 1 [0106.095] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0106.095] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0106.095] lstrlenW (lpString=".doc") returned 4 [0106.095] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0106.095] lstrlenW (lpString=".docx") returned 5 [0106.095] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0106.095] lstrlenW (lpString=".pdf") returned 4 [0106.095] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0106.095] lstrlenW (lpString=".xls") returned 4 [0106.095] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0106.095] lstrlenW (lpString=".xlsx") returned 5 [0106.095] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0106.095] lstrlenW (lpString=".ppt") returned 4 [0106.095] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0106.095] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0106.095] lstrlenW (lpString=".zip") returned 4 [0106.095] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0106.095] lstrlenW (lpString=".rar") returned 4 [0106.095] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0106.095] lstrlenW (lpString=".bz2") returned 4 [0106.095] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0106.095] lstrlenW (lpString=".7z") returned 3 [0106.095] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0106.096] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0106.096] lstrlenW (lpString=".dbf") returned 4 [0106.096] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0106.096] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0106.096] lstrlenW (lpString=".1cd") returned 4 [0106.096] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0106.096] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0106.096] lstrlenW (lpString=".jpg") returned 4 [0106.096] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0106.096] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0106.096] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0106.096] lstrlenW (lpString=".doc") returned 4 [0106.096] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0106.096] lstrlenW (lpString=".docx") returned 5 [0106.096] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0106.096] lstrlenW (lpString=".pdf") returned 4 [0106.096] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0106.096] lstrlenW (lpString=".xls") returned 4 [0106.096] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0106.096] lstrlenW (lpString=".xlsx") returned 5 [0106.096] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0106.096] lstrlenW (lpString=".ppt") returned 4 [0106.096] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0106.096] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0106.096] lstrlenW (lpString=".zip") returned 4 [0106.096] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0106.096] lstrlenW (lpString=".rar") returned 4 [0106.096] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0106.096] lstrlenW (lpString=".bz2") returned 4 [0106.096] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0106.096] lstrlenW (lpString=".7z") returned 3 [0106.096] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0106.096] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0106.096] lstrlenW (lpString=".dbf") returned 4 [0106.096] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0106.096] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0106.096] lstrlenW (lpString=".1cd") returned 4 [0106.096] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0106.096] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0106.096] lstrlenW (lpString=".jpg") returned 4 [0106.096] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0106.096] lstrcmpiW (lpString1=".XML", lpString2=".waifu") returned 1 [0106.096] lstrlenW (lpString="Office32MUI.XML") returned 15 [0106.096] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\office32mui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0106.097] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x342ff14 | out: lpFileSize=0x342ff14*=1383) returned 1 [0106.097] CloseHandle (hObject=0x1ac) returned 1 [0106.097] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\office32mui.xml")) returned 0x20 [0106.097] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\office32mui.xml.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0106.097] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\office32mui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0106.097] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0106.098] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0106.098] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\office32mui.xml.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0106.099] GetLastError () returned 0x0 [0106.099] ReadFile (in: hFile=0x1ac, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x567, lpOverlapped=0x0) returned 1 [0106.100] WriteFile (in: hFile=0x1c0, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0x570, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0x570, lpOverlapped=0x0) returned 1 [0106.100] ReadFile (in: hFile=0x1ac, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x0, lpOverlapped=0x0) returned 1 [0106.101] WriteFile (in: hFile=0x1c0, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0xf2, lpOverlapped=0x0) returned 1 [0106.101] SetEndOfFile (hFile=0x1c0) returned 1 [0106.101] CloseHandle (hObject=0x1c0) returned 1 [0106.101] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0106.101] SetEndOfFile (hFile=0x1ac) returned 1 [0106.102] CloseHandle (hObject=0x1ac) returned 1 [0106.102] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0106.102] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\office32mui.xml")) returned 1 [0106.102] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0106.102] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0106.102] lstrlenW (lpString=".doc") returned 4 [0106.102] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0106.102] lstrlenW (lpString=".docx") returned 5 [0106.102] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0106.102] lstrlenW (lpString=".pdf") returned 4 [0106.102] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0106.102] lstrlenW (lpString=".xls") returned 4 [0106.102] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0106.102] lstrlenW (lpString=".xlsx") returned 5 [0106.102] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0106.102] lstrlenW (lpString=".ppt") returned 4 [0106.103] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0106.103] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0106.103] lstrlenW (lpString=".zip") returned 4 [0106.103] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0106.103] lstrlenW (lpString=".rar") returned 4 [0106.103] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0106.103] lstrlenW (lpString=".bz2") returned 4 [0106.103] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0106.103] lstrlenW (lpString=".7z") returned 3 [0106.103] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0106.103] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0106.103] lstrlenW (lpString=".dbf") returned 4 [0106.103] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0106.103] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0106.103] lstrlenW (lpString=".1cd") returned 4 [0106.103] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0106.103] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0106.103] lstrlenW (lpString=".jpg") returned 4 [0106.103] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0106.103] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0106.103] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0106.103] lstrlenW (lpString=".doc") returned 4 [0106.103] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0106.103] lstrlenW (lpString=".docx") returned 5 [0106.103] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0106.103] lstrlenW (lpString=".pdf") returned 4 [0106.103] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0106.103] lstrlenW (lpString=".xls") returned 4 [0106.103] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0106.103] lstrlenW (lpString=".xlsx") returned 5 [0106.103] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0106.103] lstrlenW (lpString=".ppt") returned 4 [0106.103] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0106.103] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0106.103] lstrlenW (lpString=".zip") returned 4 [0106.103] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0106.103] lstrlenW (lpString=".rar") returned 4 [0106.103] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0106.103] lstrlenW (lpString=".bz2") returned 4 [0106.103] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0106.103] lstrlenW (lpString=".7z") returned 3 [0106.103] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0106.103] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0106.103] lstrlenW (lpString=".dbf") returned 4 [0106.103] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0106.103] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0106.103] lstrlenW (lpString=".1cd") returned 4 [0106.103] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0106.103] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0106.103] lstrlenW (lpString=".jpg") returned 4 [0106.103] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0106.104] lstrcmpiW (lpString1=".XML", lpString2=".waifu") returned 1 [0106.104] lstrlenW (lpString="SETUP.XML") returned 9 [0106.104] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0106.104] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x342ff14 | out: lpFileSize=0x342ff14*=2362) returned 1 [0106.104] CloseHandle (hObject=0x1ac) returned 1 [0106.104] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\setup.xml")) returned 0x20 [0106.104] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\setup.xml.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0106.104] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0106.104] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0106.104] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0106.104] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\setup.xml.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0106.105] GetLastError () returned 0x0 [0106.105] ReadFile (in: hFile=0x1ac, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x93a, lpOverlapped=0x0) returned 1 [0106.106] WriteFile (in: hFile=0x1c0, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0x940, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0x940, lpOverlapped=0x0) returned 1 [0106.106] ReadFile (in: hFile=0x1ac, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x0, lpOverlapped=0x0) returned 1 [0106.106] WriteFile (in: hFile=0x1c0, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0xe6, lpOverlapped=0x0) returned 1 [0106.106] SetEndOfFile (hFile=0x1c0) returned 1 [0106.106] CloseHandle (hObject=0x1c0) returned 1 [0106.107] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0106.107] SetEndOfFile (hFile=0x1ac) returned 1 [0106.108] CloseHandle (hObject=0x1ac) returned 1 [0106.108] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0106.108] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\setup.xml")) returned 1 [0106.108] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0106.108] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0106.108] lstrlenW (lpString=".doc") returned 4 [0106.108] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0106.108] lstrlenW (lpString=".docx") returned 5 [0106.108] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0106.108] lstrlenW (lpString=".pdf") returned 4 [0106.108] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0106.108] lstrlenW (lpString=".xls") returned 4 [0106.108] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0106.108] lstrlenW (lpString=".xlsx") returned 5 [0106.108] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0106.108] lstrlenW (lpString=".ppt") returned 4 [0106.108] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0106.108] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0106.108] lstrlenW (lpString=".zip") returned 4 [0106.109] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0106.109] lstrlenW (lpString=".rar") returned 4 [0106.109] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0106.109] lstrlenW (lpString=".bz2") returned 4 [0106.109] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0106.109] lstrlenW (lpString=".7z") returned 3 [0106.109] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0106.109] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0106.109] lstrlenW (lpString=".dbf") returned 4 [0106.109] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0106.109] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0106.109] lstrlenW (lpString=".1cd") returned 4 [0106.109] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0106.109] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0106.109] lstrlenW (lpString=".jpg") returned 4 [0106.109] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0106.109] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0106.109] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0106.109] lstrlenW (lpString=".doc") returned 4 [0106.109] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0106.109] lstrlenW (lpString=".docx") returned 5 [0106.109] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0106.109] lstrlenW (lpString=".pdf") returned 4 [0106.109] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0106.109] lstrlenW (lpString=".xls") returned 4 [0106.109] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0106.109] lstrlenW (lpString=".xlsx") returned 5 [0106.109] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0106.109] lstrlenW (lpString=".ppt") returned 4 [0106.109] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0106.109] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0106.109] lstrlenW (lpString=".zip") returned 4 [0106.109] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0106.109] lstrlenW (lpString=".rar") returned 4 [0106.109] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0106.109] lstrlenW (lpString=".bz2") returned 4 [0106.109] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0106.109] lstrlenW (lpString=".7z") returned 3 [0106.109] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0106.109] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0106.109] lstrlenW (lpString=".dbf") returned 4 [0106.109] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0106.109] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0106.109] lstrlenW (lpString=".1cd") returned 4 [0106.109] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0106.109] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0106.109] lstrlenW (lpString=".jpg") returned 4 [0106.109] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0106.110] lstrcmpiW (lpString1=".XML", lpString2=".waifu") returned 1 [0106.110] lstrlenW (lpString="Office32WW.XML") returned 14 [0106.110] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\office32ww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0106.110] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x342ff14 | out: lpFileSize=0x342ff14*=4274) returned 1 [0106.110] CloseHandle (hObject=0x1ac) returned 1 [0106.110] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\office32ww.xml")) returned 0x20 [0106.110] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\office32ww.xml.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0106.110] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\office32ww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0106.110] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0106.110] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0106.110] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\office32ww.xml.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0106.111] GetLastError () returned 0x0 [0106.111] ReadFile (in: hFile=0x1ac, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x10b2, lpOverlapped=0x0) returned 1 [0106.112] WriteFile (in: hFile=0x1c0, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0x10c0, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0x10c0, lpOverlapped=0x0) returned 1 [0106.112] ReadFile (in: hFile=0x1ac, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x0, lpOverlapped=0x0) returned 1 [0106.112] WriteFile (in: hFile=0x1c0, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0xf0, lpOverlapped=0x0) returned 1 [0106.112] SetEndOfFile (hFile=0x1c0) returned 1 [0106.112] CloseHandle (hObject=0x1c0) returned 1 [0106.113] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0106.113] SetEndOfFile (hFile=0x1ac) returned 1 [0106.114] CloseHandle (hObject=0x1ac) returned 1 [0106.114] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0106.114] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\office32ww.xml")) returned 1 [0106.114] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106 [0106.114] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106 [0106.114] lstrlenW (lpString=".doc") returned 4 [0106.114] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0106.114] lstrlenW (lpString=".docx") returned 5 [0106.114] lstrcmpiW (lpString1=".docx", lpString2="W.XML") returned -1 [0106.114] lstrlenW (lpString=".pdf") returned 4 [0106.114] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0106.114] lstrlenW (lpString=".xls") returned 4 [0106.114] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0106.114] lstrlenW (lpString=".xlsx") returned 5 [0106.114] lstrcmpiW (lpString1=".xlsx", lpString2="W.XML") returned -1 [0106.114] lstrlenW (lpString=".ppt") returned 4 [0106.114] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0106.114] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106 [0106.114] lstrlenW (lpString=".zip") returned 4 [0106.114] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0106.114] lstrlenW (lpString=".rar") returned 4 [0106.114] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0106.114] lstrlenW (lpString=".bz2") returned 4 [0106.115] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0106.115] lstrlenW (lpString=".7z") returned 3 [0106.115] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0106.115] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106 [0106.115] lstrlenW (lpString=".dbf") returned 4 [0106.115] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0106.115] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106 [0106.115] lstrlenW (lpString=".1cd") returned 4 [0106.115] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0106.115] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106 [0106.115] lstrlenW (lpString=".jpg") returned 4 [0106.115] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0106.115] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106 [0106.115] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106 [0106.115] lstrlenW (lpString=".doc") returned 4 [0106.115] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0106.115] lstrlenW (lpString=".docx") returned 5 [0106.115] lstrcmpiW (lpString1=".docx", lpString2="W.XML") returned -1 [0106.115] lstrlenW (lpString=".pdf") returned 4 [0106.115] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0106.115] lstrlenW (lpString=".xls") returned 4 [0106.115] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0106.115] lstrlenW (lpString=".xlsx") returned 5 [0106.115] lstrcmpiW (lpString1=".xlsx", lpString2="W.XML") returned -1 [0106.115] lstrlenW (lpString=".ppt") returned 4 [0106.115] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0106.115] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106 [0106.115] lstrlenW (lpString=".zip") returned 4 [0106.115] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0106.115] lstrlenW (lpString=".rar") returned 4 [0106.115] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0106.115] lstrlenW (lpString=".bz2") returned 4 [0106.115] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0106.115] lstrlenW (lpString=".7z") returned 3 [0106.115] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0106.115] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106 [0106.115] lstrlenW (lpString=".dbf") returned 4 [0106.115] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0106.115] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106 [0106.115] lstrlenW (lpString=".1cd") returned 4 [0106.115] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0106.115] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106 [0106.115] lstrlenW (lpString=".jpg") returned 4 [0106.115] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0106.115] lstrcmpiW (lpString1=".XML", lpString2=".waifu") returned 1 [0106.116] lstrlenW (lpString="OneNoteMUI.XML") returned 14 [0106.116] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\onenotemui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0106.116] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x342ff14 | out: lpFileSize=0x342ff14*=1606) returned 1 [0106.116] CloseHandle (hObject=0x1ac) returned 1 [0106.116] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\onenotemui.xml")) returned 0x20 [0106.116] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\onenotemui.xml.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0106.116] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\onenotemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0106.116] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0106.116] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0106.116] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\onenotemui.xml.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0106.117] GetLastError () returned 0x0 [0106.117] ReadFile (in: hFile=0x1ac, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x646, lpOverlapped=0x0) returned 1 [0106.118] WriteFile (in: hFile=0x18c, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0x650, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0x650, lpOverlapped=0x0) returned 1 [0106.119] ReadFile (in: hFile=0x1ac, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x0, lpOverlapped=0x0) returned 1 [0106.119] WriteFile (in: hFile=0x18c, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0xf0, lpOverlapped=0x0) returned 1 [0106.119] SetEndOfFile (hFile=0x18c) returned 1 [0106.119] CloseHandle (hObject=0x18c) returned 1 [0106.119] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0106.119] SetEndOfFile (hFile=0x1ac) returned 1 [0106.120] CloseHandle (hObject=0x1ac) returned 1 [0106.120] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0106.120] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\onenotemui.xml")) returned 1 [0106.120] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0106.120] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0106.120] lstrlenW (lpString=".doc") returned 4 [0106.120] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0106.121] lstrlenW (lpString=".docx") returned 5 [0106.121] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0106.121] lstrlenW (lpString=".pdf") returned 4 [0106.121] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0106.121] lstrlenW (lpString=".xls") returned 4 [0106.121] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0106.121] lstrlenW (lpString=".xlsx") returned 5 [0106.121] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0106.121] lstrlenW (lpString=".ppt") returned 4 [0106.121] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0106.121] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0106.121] lstrlenW (lpString=".zip") returned 4 [0106.121] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0106.121] lstrlenW (lpString=".rar") returned 4 [0106.121] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0106.121] lstrlenW (lpString=".bz2") returned 4 [0106.121] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0106.121] lstrlenW (lpString=".7z") returned 3 [0106.121] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0106.121] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0106.121] lstrlenW (lpString=".dbf") returned 4 [0106.121] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0106.121] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0106.121] lstrlenW (lpString=".1cd") returned 4 [0106.121] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0106.121] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0106.121] lstrlenW (lpString=".jpg") returned 4 [0106.121] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0106.121] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0106.121] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0106.121] lstrlenW (lpString=".doc") returned 4 [0106.121] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0106.121] lstrlenW (lpString=".docx") returned 5 [0106.121] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0106.121] lstrlenW (lpString=".pdf") returned 4 [0106.121] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0106.121] lstrlenW (lpString=".xls") returned 4 [0106.121] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0106.121] lstrlenW (lpString=".xlsx") returned 5 [0106.121] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0106.121] lstrlenW (lpString=".ppt") returned 4 [0106.121] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0106.121] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0106.121] lstrlenW (lpString=".zip") returned 4 [0106.121] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0106.121] lstrlenW (lpString=".rar") returned 4 [0106.121] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0106.121] lstrlenW (lpString=".bz2") returned 4 [0106.121] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0106.121] lstrlenW (lpString=".7z") returned 3 [0106.121] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0106.121] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0106.122] lstrlenW (lpString=".dbf") returned 4 [0106.122] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0106.122] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0106.122] lstrlenW (lpString=".1cd") returned 4 [0106.122] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0106.122] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0106.122] lstrlenW (lpString=".jpg") returned 4 [0106.122] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0106.122] lstrcmpiW (lpString1=".XML", lpString2=".waifu") returned 1 [0106.122] lstrlenW (lpString="SETUP.XML") returned 9 [0106.122] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0106.454] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x342ff14 | out: lpFileSize=0x342ff14*=1988) returned 1 [0106.454] CloseHandle (hObject=0x1d0) returned 1 [0106.454] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\setup.xml")) returned 0x20 [0106.454] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\setup.xml.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0106.454] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0106.455] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0106.455] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0106.455] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\setup.xml.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4 [0106.455] GetLastError () returned 0x0 [0106.455] ReadFile (in: hFile=0x1d0, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x7c4, lpOverlapped=0x0) returned 1 [0106.534] WriteFile (in: hFile=0x1d4, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0x7d0, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0x7d0, lpOverlapped=0x0) returned 1 [0106.534] ReadFile (in: hFile=0x1d0, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x0, lpOverlapped=0x0) returned 1 [0106.534] WriteFile (in: hFile=0x1d4, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0xe6, lpOverlapped=0x0) returned 1 [0106.534] SetEndOfFile (hFile=0x1d4) returned 1 [0106.534] CloseHandle (hObject=0x1d4) returned 1 [0106.535] SetFilePointerEx (in: hFile=0x1d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0106.535] SetEndOfFile (hFile=0x1d0) returned 1 [0106.536] CloseHandle (hObject=0x1d0) returned 1 [0106.536] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0106.536] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\setup.xml")) returned 1 [0106.536] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0106.536] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0106.536] lstrlenW (lpString=".doc") returned 4 [0106.536] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0106.536] lstrlenW (lpString=".docx") returned 5 [0106.536] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0106.536] lstrlenW (lpString=".pdf") returned 4 [0106.536] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0106.536] lstrlenW (lpString=".xls") returned 4 [0106.536] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0106.536] lstrlenW (lpString=".xlsx") returned 5 [0106.536] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0106.536] lstrlenW (lpString=".ppt") returned 4 [0106.536] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0106.536] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0106.536] lstrlenW (lpString=".zip") returned 4 [0106.536] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0106.536] lstrlenW (lpString=".rar") returned 4 [0106.536] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0106.536] lstrlenW (lpString=".bz2") returned 4 [0106.536] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0106.536] lstrlenW (lpString=".7z") returned 3 [0106.536] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0106.537] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0106.537] lstrlenW (lpString=".dbf") returned 4 [0106.537] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0106.537] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0106.537] lstrlenW (lpString=".1cd") returned 4 [0106.537] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0106.537] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0106.537] lstrlenW (lpString=".jpg") returned 4 [0106.537] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0106.537] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0106.537] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0106.537] lstrlenW (lpString=".doc") returned 4 [0106.537] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0106.537] lstrlenW (lpString=".docx") returned 5 [0106.537] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0106.537] lstrlenW (lpString=".pdf") returned 4 [0106.537] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0106.537] lstrlenW (lpString=".xls") returned 4 [0106.537] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0106.537] lstrlenW (lpString=".xlsx") returned 5 [0106.537] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0106.537] lstrlenW (lpString=".ppt") returned 4 [0106.537] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0106.537] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0106.537] lstrlenW (lpString=".zip") returned 4 [0106.537] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0106.537] lstrlenW (lpString=".rar") returned 4 [0106.537] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0106.537] lstrlenW (lpString=".bz2") returned 4 [0106.537] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0106.537] lstrlenW (lpString=".7z") returned 3 [0106.537] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0106.537] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0106.537] lstrlenW (lpString=".dbf") returned 4 [0106.537] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0106.537] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0106.537] lstrlenW (lpString=".1cd") returned 4 [0106.537] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0106.537] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0106.537] lstrlenW (lpString=".jpg") returned 4 [0106.537] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0106.537] lstrcmpiW (lpString1=".XML", lpString2=".waifu") returned 1 [0106.537] lstrlenW (lpString="ProPlusrWW.XML") returned 14 [0106.537] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\proplusrww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4 [0107.545] GetFileSizeEx (in: hFile=0x1d4, lpFileSize=0x342ff14 | out: lpFileSize=0x342ff14*=16852) returned 1 [0107.545] CloseHandle (hObject=0x1d4) returned 1 [0107.545] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\proplusrww.xml")) returned 0x20 [0107.545] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\proplusrww.xml.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0107.545] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\proplusrww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4 [0107.545] SetFilePointerEx (in: hFile=0x1d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0107.545] SetFilePointerEx (in: hFile=0x1d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0107.545] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\proplusrww.xml.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0107.547] GetLastError () returned 0x0 [0107.547] ReadFile (in: hFile=0x1d4, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x41d4, lpOverlapped=0x0) returned 1 [0107.550] WriteFile (in: hFile=0x1b4, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0x41e0, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0x41e0, lpOverlapped=0x0) returned 1 [0107.551] ReadFile (in: hFile=0x1d4, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x0, lpOverlapped=0x0) returned 1 [0107.551] WriteFile (in: hFile=0x1b4, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0xf0, lpOverlapped=0x0) returned 1 [0107.551] SetEndOfFile (hFile=0x1b4) returned 1 [0107.551] CloseHandle (hObject=0x1b4) returned 1 [0107.552] SetFilePointerEx (in: hFile=0x1d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0107.552] SetEndOfFile (hFile=0x1d4) returned 1 [0107.553] CloseHandle (hObject=0x1d4) returned 1 [0107.553] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0107.553] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\proplusrww.xml")) returned 1 [0107.553] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103 [0107.553] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103 [0107.553] lstrlenW (lpString=".doc") returned 4 [0107.553] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0107.553] lstrlenW (lpString=".docx") returned 5 [0107.553] lstrcmpiW (lpString1=".docx", lpString2="W.XML") returned -1 [0107.553] lstrlenW (lpString=".pdf") returned 4 [0107.553] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0107.553] lstrlenW (lpString=".xls") returned 4 [0107.553] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0107.553] lstrlenW (lpString=".xlsx") returned 5 [0107.553] lstrcmpiW (lpString1=".xlsx", lpString2="W.XML") returned -1 [0107.553] lstrlenW (lpString=".ppt") returned 4 [0107.554] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0107.554] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103 [0107.554] lstrlenW (lpString=".zip") returned 4 [0107.554] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0107.554] lstrlenW (lpString=".rar") returned 4 [0107.554] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0107.554] lstrlenW (lpString=".bz2") returned 4 [0107.554] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0107.554] lstrlenW (lpString=".7z") returned 3 [0107.554] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0107.554] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103 [0107.554] lstrlenW (lpString=".dbf") returned 4 [0107.554] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0107.554] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103 [0107.554] lstrlenW (lpString=".1cd") returned 4 [0107.554] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0107.554] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103 [0107.554] lstrlenW (lpString=".jpg") returned 4 [0107.554] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0107.554] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103 [0107.554] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103 [0107.554] lstrlenW (lpString=".doc") returned 4 [0107.554] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0107.554] lstrlenW (lpString=".docx") returned 5 [0107.554] lstrcmpiW (lpString1=".docx", lpString2="W.XML") returned -1 [0107.554] lstrlenW (lpString=".pdf") returned 4 [0107.554] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0107.554] lstrlenW (lpString=".xls") returned 4 [0107.554] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0107.554] lstrlenW (lpString=".xlsx") returned 5 [0107.554] lstrcmpiW (lpString1=".xlsx", lpString2="W.XML") returned -1 [0107.554] lstrlenW (lpString=".ppt") returned 4 [0107.554] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0107.554] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103 [0107.554] lstrlenW (lpString=".zip") returned 4 [0107.554] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0107.554] lstrlenW (lpString=".rar") returned 4 [0107.554] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0107.554] lstrlenW (lpString=".bz2") returned 4 [0107.555] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0107.555] lstrlenW (lpString=".7z") returned 3 [0107.555] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0107.555] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103 [0107.555] lstrlenW (lpString=".dbf") returned 4 [0107.555] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0107.555] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103 [0107.555] lstrlenW (lpString=".1cd") returned 4 [0107.555] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0107.555] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103 [0107.555] lstrlenW (lpString=".jpg") returned 4 [0107.555] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0107.555] lstrcmpiW (lpString1=".XML", lpString2=".waifu") returned 1 [0107.555] lstrlenW (lpString="SETUP.XML") returned 9 [0107.555] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4 [0107.555] GetFileSizeEx (in: hFile=0x1d4, lpFileSize=0x342ff14 | out: lpFileSize=0x342ff14*=31094) returned 1 [0107.555] CloseHandle (hObject=0x1d4) returned 1 [0107.555] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\setup.xml")) returned 0x20 [0107.556] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\setup.xml.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0107.556] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4 [0107.556] SetFilePointerEx (in: hFile=0x1d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0107.556] SetFilePointerEx (in: hFile=0x1d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0107.556] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\setup.xml.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0107.564] GetLastError () returned 0x0 [0107.564] ReadFile (in: hFile=0x1d4, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x7976, lpOverlapped=0x0) returned 1 [0107.566] WriteFile (in: hFile=0x1b4, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0x7980, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0x7980, lpOverlapped=0x0) returned 1 [0107.566] ReadFile (in: hFile=0x1d4, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x0, lpOverlapped=0x0) returned 1 [0107.566] WriteFile (in: hFile=0x1b4, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0xe6, lpOverlapped=0x0) returned 1 [0107.566] SetEndOfFile (hFile=0x1b4) returned 1 [0107.566] CloseHandle (hObject=0x1b4) returned 1 [0107.567] SetFilePointerEx (in: hFile=0x1d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0107.567] SetEndOfFile (hFile=0x1d4) returned 1 [0107.568] CloseHandle (hObject=0x1d4) returned 1 [0107.568] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0107.568] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\setup.xml")) returned 1 [0107.569] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98 [0107.569] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98 [0107.569] lstrlenW (lpString=".doc") returned 4 [0107.569] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0107.569] lstrlenW (lpString=".docx") returned 5 [0107.569] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0107.569] lstrlenW (lpString=".pdf") returned 4 [0107.569] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0107.569] lstrlenW (lpString=".xls") returned 4 [0107.569] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0107.569] lstrlenW (lpString=".xlsx") returned 5 [0107.569] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0107.569] lstrlenW (lpString=".ppt") returned 4 [0107.569] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0107.569] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98 [0107.569] lstrlenW (lpString=".zip") returned 4 [0107.569] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0107.569] lstrlenW (lpString=".rar") returned 4 [0107.569] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0107.569] lstrlenW (lpString=".bz2") returned 4 [0107.569] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0107.569] lstrlenW (lpString=".7z") returned 3 [0107.569] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0107.569] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98 [0107.569] lstrlenW (lpString=".dbf") returned 4 [0107.569] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0107.569] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98 [0107.569] lstrlenW (lpString=".1cd") returned 4 [0107.569] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0107.569] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98 [0107.569] lstrlenW (lpString=".jpg") returned 4 [0107.569] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0107.569] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98 [0107.570] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98 [0107.570] lstrlenW (lpString=".doc") returned 4 [0107.570] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0107.570] lstrlenW (lpString=".docx") returned 5 [0107.570] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0107.570] lstrlenW (lpString=".pdf") returned 4 [0107.570] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0107.570] lstrlenW (lpString=".xls") returned 4 [0107.570] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0107.570] lstrlenW (lpString=".xlsx") returned 5 [0107.570] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0107.570] lstrlenW (lpString=".ppt") returned 4 [0107.570] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0107.570] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98 [0107.570] lstrlenW (lpString=".zip") returned 4 [0107.570] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0107.570] lstrlenW (lpString=".rar") returned 4 [0107.570] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0107.570] lstrlenW (lpString=".bz2") returned 4 [0107.570] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0107.570] lstrlenW (lpString=".7z") returned 3 [0107.570] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0107.570] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98 [0107.570] lstrlenW (lpString=".dbf") returned 4 [0107.570] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0107.570] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98 [0107.570] lstrlenW (lpString=".1cd") returned 4 [0107.570] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0107.570] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98 [0107.570] lstrlenW (lpString=".jpg") returned 4 [0107.570] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0107.570] lstrcmpiW (lpString1=".XML", lpString2=".waifu") returned 1 [0107.570] lstrlenW (lpString="PublisherMUI.XML") returned 16 [0107.570] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\publishermui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4 [0107.571] GetFileSizeEx (in: hFile=0x1d4, lpFileSize=0x342ff14 | out: lpFileSize=0x342ff14*=1450) returned 1 [0107.571] CloseHandle (hObject=0x1d4) returned 1 [0107.571] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\publishermui.xml")) returned 0x20 [0107.572] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\publishermui.xml.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0107.572] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\publishermui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4 [0107.572] SetFilePointerEx (in: hFile=0x1d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0107.572] SetFilePointerEx (in: hFile=0x1d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0107.572] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\publishermui.xml.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0107.573] GetLastError () returned 0x0 [0107.573] ReadFile (in: hFile=0x1d4, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x5aa, lpOverlapped=0x0) returned 1 [0107.575] WriteFile (in: hFile=0x1b4, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0x5b0, lpOverlapped=0x0) returned 1 [0107.575] ReadFile (in: hFile=0x1d4, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x0, lpOverlapped=0x0) returned 1 [0107.575] WriteFile (in: hFile=0x1b4, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0xf4, lpOverlapped=0x0) returned 1 [0107.576] SetEndOfFile (hFile=0x1b4) returned 1 [0107.576] CloseHandle (hObject=0x1b4) returned 1 [0107.576] SetFilePointerEx (in: hFile=0x1d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0107.576] SetEndOfFile (hFile=0x1d4) returned 1 [0107.577] CloseHandle (hObject=0x1d4) returned 1 [0107.577] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0107.578] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\publishermui.xml")) returned 1 [0107.578] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112 [0107.578] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112 [0107.578] lstrlenW (lpString=".doc") returned 4 [0107.578] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0107.578] lstrlenW (lpString=".docx") returned 5 [0107.578] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0107.578] lstrlenW (lpString=".pdf") returned 4 [0107.578] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0107.578] lstrlenW (lpString=".xls") returned 4 [0107.578] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0107.578] lstrlenW (lpString=".xlsx") returned 5 [0107.578] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0107.578] lstrlenW (lpString=".ppt") returned 4 [0107.578] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0107.578] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112 [0107.578] lstrlenW (lpString=".zip") returned 4 [0107.578] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0107.578] lstrlenW (lpString=".rar") returned 4 [0107.578] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0107.578] lstrlenW (lpString=".bz2") returned 4 [0107.578] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0107.578] lstrlenW (lpString=".7z") returned 3 [0107.578] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0107.578] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112 [0107.578] lstrlenW (lpString=".dbf") returned 4 [0107.578] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0107.578] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112 [0107.578] lstrlenW (lpString=".1cd") returned 4 [0107.579] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0107.579] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112 [0107.579] lstrlenW (lpString=".jpg") returned 4 [0107.579] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0107.579] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112 [0107.579] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112 [0107.579] lstrlenW (lpString=".doc") returned 4 [0107.579] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0107.579] lstrlenW (lpString=".docx") returned 5 [0107.579] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0107.579] lstrlenW (lpString=".pdf") returned 4 [0107.579] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0107.579] lstrlenW (lpString=".xls") returned 4 [0107.579] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0107.579] lstrlenW (lpString=".xlsx") returned 5 [0107.579] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0107.579] lstrlenW (lpString=".ppt") returned 4 [0107.579] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0107.579] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112 [0107.579] lstrlenW (lpString=".zip") returned 4 [0107.579] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0107.579] lstrlenW (lpString=".rar") returned 4 [0107.579] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0107.579] lstrlenW (lpString=".bz2") returned 4 [0107.579] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0107.579] lstrlenW (lpString=".7z") returned 3 [0107.579] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0107.579] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112 [0107.579] lstrlenW (lpString=".dbf") returned 4 [0107.579] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0107.579] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112 [0107.579] lstrlenW (lpString=".1cd") returned 4 [0107.579] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0107.579] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112 [0107.579] lstrlenW (lpString=".jpg") returned 4 [0107.579] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0107.580] lstrcmpiW (lpString1=".XML", lpString2=".waifu") returned 1 [0107.580] lstrlenW (lpString="SETUP.XML") returned 9 [0107.580] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0108.054] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x342ff14 | out: lpFileSize=0x342ff14*=1608) returned 1 [0108.054] CloseHandle (hObject=0x1dc) returned 1 [0108.054] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\setup.xml")) returned 0x20 [0108.054] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\setup.xml.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0108.054] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0108.054] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0108.054] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0108.054] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\setup.xml.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0108.054] GetLastError () returned 0x0 [0108.054] ReadFile (in: hFile=0x1dc, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x648, lpOverlapped=0x0) returned 1 [0108.055] WriteFile (in: hFile=0x1ac, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0x650, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0x650, lpOverlapped=0x0) returned 1 [0108.056] ReadFile (in: hFile=0x1dc, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x0, lpOverlapped=0x0) returned 1 [0108.056] WriteFile (in: hFile=0x1ac, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0xe6, lpOverlapped=0x0) returned 1 [0108.056] SetEndOfFile (hFile=0x1ac) returned 1 [0108.056] CloseHandle (hObject=0x1ac) returned 1 [0108.057] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0108.057] SetEndOfFile (hFile=0x1dc) returned 1 [0108.057] CloseHandle (hObject=0x1dc) returned 1 [0108.057] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0108.057] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\setup.xml")) returned 1 [0108.058] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0108.058] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0108.058] lstrlenW (lpString=".doc") returned 4 [0108.058] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0108.058] lstrlenW (lpString=".docx") returned 5 [0108.058] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0108.058] lstrlenW (lpString=".pdf") returned 4 [0108.058] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0108.058] lstrlenW (lpString=".xls") returned 4 [0108.058] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0108.058] lstrlenW (lpString=".xlsx") returned 5 [0108.058] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0108.058] lstrlenW (lpString=".ppt") returned 4 [0108.058] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0108.058] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0108.058] lstrlenW (lpString=".zip") returned 4 [0108.058] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0108.058] lstrlenW (lpString=".rar") returned 4 [0108.058] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0108.058] lstrlenW (lpString=".bz2") returned 4 [0108.058] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0108.058] lstrlenW (lpString=".7z") returned 3 [0108.058] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0108.058] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0108.058] lstrlenW (lpString=".dbf") returned 4 [0108.058] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0108.058] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0108.058] lstrlenW (lpString=".1cd") returned 4 [0108.058] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0108.058] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0108.058] lstrlenW (lpString=".jpg") returned 4 [0108.058] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0108.058] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0108.058] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0108.058] lstrlenW (lpString=".doc") returned 4 [0108.058] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0108.058] lstrlenW (lpString=".docx") returned 5 [0108.058] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0108.058] lstrlenW (lpString=".pdf") returned 4 [0108.058] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0108.058] lstrlenW (lpString=".xls") returned 4 [0108.058] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0108.058] lstrlenW (lpString=".xlsx") returned 5 [0108.058] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0108.058] lstrlenW (lpString=".ppt") returned 4 [0108.059] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0108.059] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0108.059] lstrlenW (lpString=".zip") returned 4 [0108.059] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0108.059] lstrlenW (lpString=".rar") returned 4 [0108.059] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0108.059] lstrlenW (lpString=".bz2") returned 4 [0108.059] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0108.059] lstrlenW (lpString=".7z") returned 3 [0108.059] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0108.059] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0108.059] lstrlenW (lpString=".dbf") returned 4 [0108.059] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0108.059] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0108.059] lstrlenW (lpString=".1cd") returned 4 [0108.059] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0108.059] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0108.059] lstrlenW (lpString=".jpg") returned 4 [0108.059] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0108.059] lstrcmpiW (lpString1=".HTM", lpString2=".waifu") returned -1 [0108.059] lstrlenW (lpString="MCABOUT.HTM") returned 11 [0108.059] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\mcabout.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0108.060] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x342ff14 | out: lpFileSize=0x342ff14*=11463) returned 1 [0108.060] CloseHandle (hObject=0x1dc) returned 1 [0108.060] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\mcabout.htm")) returned 0x20 [0108.060] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\mcabout.htm.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0108.060] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\mcabout.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0108.060] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0108.060] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0108.060] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\mcabout.htm.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0108.061] GetLastError () returned 0x0 [0108.061] ReadFile (in: hFile=0x1dc, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x2cc7, lpOverlapped=0x0) returned 1 [0108.062] WriteFile (in: hFile=0x1ac, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0x2cd0, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0x2cd0, lpOverlapped=0x0) returned 1 [0108.063] ReadFile (in: hFile=0x1dc, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x0, lpOverlapped=0x0) returned 1 [0108.063] WriteFile (in: hFile=0x1ac, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0xea, lpOverlapped=0x0) returned 1 [0108.063] SetEndOfFile (hFile=0x1ac) returned 1 [0108.063] CloseHandle (hObject=0x1ac) returned 1 [0108.064] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0108.064] SetEndOfFile (hFile=0x1dc) returned 1 [0108.064] CloseHandle (hObject=0x1dc) returned 1 [0108.064] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0108.065] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\mcabout.htm")) returned 1 [0108.065] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73 [0108.065] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73 [0108.065] lstrlenW (lpString=".doc") returned 4 [0108.065] lstrcmpiW (lpString1=".doc", lpString2=".HTM") returned -1 [0108.065] lstrlenW (lpString=".docx") returned 5 [0108.065] lstrcmpiW (lpString1=".docx", lpString2="T.HTM") returned -1 [0108.065] lstrlenW (lpString=".pdf") returned 4 [0108.065] lstrcmpiW (lpString1=".pdf", lpString2=".HTM") returned 1 [0108.065] lstrlenW (lpString=".xls") returned 4 [0108.065] lstrcmpiW (lpString1=".xls", lpString2=".HTM") returned 1 [0108.065] lstrlenW (lpString=".xlsx") returned 5 [0108.065] lstrcmpiW (lpString1=".xlsx", lpString2="T.HTM") returned -1 [0108.065] lstrlenW (lpString=".ppt") returned 4 [0108.065] lstrcmpiW (lpString1=".ppt", lpString2=".HTM") returned 1 [0108.065] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73 [0108.065] lstrlenW (lpString=".zip") returned 4 [0108.065] lstrcmpiW (lpString1=".zip", lpString2=".HTM") returned 1 [0108.065] lstrlenW (lpString=".rar") returned 4 [0108.065] lstrcmpiW (lpString1=".rar", lpString2=".HTM") returned 1 [0108.065] lstrlenW (lpString=".bz2") returned 4 [0108.065] lstrcmpiW (lpString1=".bz2", lpString2=".HTM") returned -1 [0108.065] lstrlenW (lpString=".7z") returned 3 [0108.065] lstrcmpiW (lpString1=".7z", lpString2="HTM") returned -1 [0108.065] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73 [0108.065] lstrlenW (lpString=".dbf") returned 4 [0108.065] lstrcmpiW (lpString1=".dbf", lpString2=".HTM") returned -1 [0108.065] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73 [0108.065] lstrlenW (lpString=".1cd") returned 4 [0108.065] lstrcmpiW (lpString1=".1cd", lpString2=".HTM") returned -1 [0108.065] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73 [0108.065] lstrlenW (lpString=".jpg") returned 4 [0108.065] lstrcmpiW (lpString1=".jpg", lpString2=".HTM") returned 1 [0108.065] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73 [0108.065] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73 [0108.065] lstrlenW (lpString=".doc") returned 4 [0108.065] lstrcmpiW (lpString1=".doc", lpString2=".HTM") returned -1 [0108.065] lstrlenW (lpString=".docx") returned 5 [0108.065] lstrcmpiW (lpString1=".docx", lpString2="T.HTM") returned -1 [0108.065] lstrlenW (lpString=".pdf") returned 4 [0108.065] lstrcmpiW (lpString1=".pdf", lpString2=".HTM") returned 1 [0108.065] lstrlenW (lpString=".xls") returned 4 [0108.066] lstrcmpiW (lpString1=".xls", lpString2=".HTM") returned 1 [0108.066] lstrlenW (lpString=".xlsx") returned 5 [0108.066] lstrcmpiW (lpString1=".xlsx", lpString2="T.HTM") returned -1 [0108.066] lstrlenW (lpString=".ppt") returned 4 [0108.066] lstrcmpiW (lpString1=".ppt", lpString2=".HTM") returned 1 [0108.066] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73 [0108.066] lstrlenW (lpString=".zip") returned 4 [0108.066] lstrcmpiW (lpString1=".zip", lpString2=".HTM") returned 1 [0108.066] lstrlenW (lpString=".rar") returned 4 [0108.066] lstrcmpiW (lpString1=".rar", lpString2=".HTM") returned 1 [0108.066] lstrlenW (lpString=".bz2") returned 4 [0108.066] lstrcmpiW (lpString1=".bz2", lpString2=".HTM") returned -1 [0108.066] lstrlenW (lpString=".7z") returned 3 [0108.066] lstrcmpiW (lpString1=".7z", lpString2="HTM") returned -1 [0108.066] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73 [0108.066] lstrlenW (lpString=".dbf") returned 4 [0108.066] lstrcmpiW (lpString1=".dbf", lpString2=".HTM") returned -1 [0108.066] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73 [0108.066] lstrlenW (lpString=".1cd") returned 4 [0108.066] lstrcmpiW (lpString1=".1cd", lpString2=".HTM") returned -1 [0108.066] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73 [0108.066] lstrlenW (lpString=".jpg") returned 4 [0108.066] lstrcmpiW (lpString1=".jpg", lpString2=".HTM") returned 1 [0108.066] lstrcmpiW (lpString1=".XML", lpString2=".waifu") returned 1 [0108.066] lstrlenW (lpString="DATES.XML") returned 9 [0108.066] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\dates.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0108.066] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x342ff14 | out: lpFileSize=0x342ff14*=8918) returned 1 [0108.066] CloseHandle (hObject=0x1dc) returned 1 [0108.066] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\dates.xml")) returned 0x20 [0108.067] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\dates.xml.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0108.067] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\dates.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0108.067] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0108.067] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0108.067] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\dates.xml.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0108.068] GetLastError () returned 0x0 [0108.068] ReadFile (in: hFile=0x1dc, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x22d6, lpOverlapped=0x0) returned 1 [0108.069] WriteFile (in: hFile=0x1ac, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0x22e0, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0x22e0, lpOverlapped=0x0) returned 1 [0108.069] ReadFile (in: hFile=0x1dc, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x0, lpOverlapped=0x0) returned 1 [0108.069] WriteFile (in: hFile=0x1ac, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0xe6, lpOverlapped=0x0) returned 1 [0108.070] SetEndOfFile (hFile=0x1ac) returned 1 [0108.070] CloseHandle (hObject=0x1ac) returned 1 [0108.070] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0108.070] SetEndOfFile (hFile=0x1dc) returned 1 [0108.071] CloseHandle (hObject=0x1dc) returned 1 [0108.071] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0108.071] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\dates.xml")) returned 1 [0108.071] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77 [0108.072] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77 [0108.072] lstrlenW (lpString=".doc") returned 4 [0108.072] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0108.072] lstrlenW (lpString=".docx") returned 5 [0108.072] lstrcmpiW (lpString1=".docx", lpString2="S.XML") returned -1 [0108.072] lstrlenW (lpString=".pdf") returned 4 [0108.072] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0108.072] lstrlenW (lpString=".xls") returned 4 [0108.072] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0108.072] lstrlenW (lpString=".xlsx") returned 5 [0108.072] lstrcmpiW (lpString1=".xlsx", lpString2="S.XML") returned -1 [0108.072] lstrlenW (lpString=".ppt") returned 4 [0108.072] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0108.072] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77 [0108.072] lstrlenW (lpString=".zip") returned 4 [0108.072] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0108.072] lstrlenW (lpString=".rar") returned 4 [0108.072] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0108.072] lstrlenW (lpString=".bz2") returned 4 [0108.072] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0108.072] lstrlenW (lpString=".7z") returned 3 [0108.072] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0108.072] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77 [0108.072] lstrlenW (lpString=".dbf") returned 4 [0108.072] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0108.072] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77 [0108.072] lstrlenW (lpString=".1cd") returned 4 [0108.072] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0108.072] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77 [0108.072] lstrlenW (lpString=".jpg") returned 4 [0108.072] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0108.072] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77 [0108.072] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77 [0108.072] lstrlenW (lpString=".doc") returned 4 [0108.072] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0108.072] lstrlenW (lpString=".docx") returned 5 [0108.072] lstrcmpiW (lpString1=".docx", lpString2="S.XML") returned -1 [0108.072] lstrlenW (lpString=".pdf") returned 4 [0108.072] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0108.072] lstrlenW (lpString=".xls") returned 4 [0108.072] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0108.072] lstrlenW (lpString=".xlsx") returned 5 [0108.072] lstrcmpiW (lpString1=".xlsx", lpString2="S.XML") returned -1 [0108.072] lstrlenW (lpString=".ppt") returned 4 [0108.072] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0108.072] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77 [0108.072] lstrlenW (lpString=".zip") returned 4 [0108.072] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0108.072] lstrlenW (lpString=".rar") returned 4 [0108.072] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0108.073] lstrlenW (lpString=".bz2") returned 4 [0108.073] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0108.073] lstrlenW (lpString=".7z") returned 3 [0108.073] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0108.073] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77 [0108.073] lstrlenW (lpString=".dbf") returned 4 [0108.073] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0108.073] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77 [0108.073] lstrlenW (lpString=".1cd") returned 4 [0108.073] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0108.073] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77 [0108.073] lstrlenW (lpString=".jpg") returned 4 [0108.073] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0108.073] lstrcmpiW (lpString1=".XML", lpString2=".waifu") returned 1 [0108.073] lstrlenW (lpString="PHONE.XML") returned 9 [0108.073] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\phone.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0108.073] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x342ff14 | out: lpFileSize=0x342ff14*=1844) returned 1 [0108.073] CloseHandle (hObject=0x1dc) returned 1 [0108.073] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\phone.xml")) returned 0x20 [0108.073] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\phone.xml.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0108.073] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\phone.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0108.073] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0108.074] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0108.074] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\phone.xml.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0108.074] GetLastError () returned 0x0 [0108.074] ReadFile (in: hFile=0x1dc, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x734, lpOverlapped=0x0) returned 1 [0108.075] WriteFile (in: hFile=0x1ac, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0x740, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0x740, lpOverlapped=0x0) returned 1 [0108.076] ReadFile (in: hFile=0x1dc, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x0, lpOverlapped=0x0) returned 1 [0108.076] WriteFile (in: hFile=0x1ac, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0xe6, lpOverlapped=0x0) returned 1 [0108.076] SetEndOfFile (hFile=0x1ac) returned 1 [0108.076] CloseHandle (hObject=0x1ac) returned 1 [0108.076] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0108.076] SetEndOfFile (hFile=0x1dc) returned 1 [0108.077] CloseHandle (hObject=0x1dc) returned 1 [0108.077] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0108.077] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\phone.xml")) returned 1 [0108.077] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77 [0108.077] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77 [0108.077] lstrlenW (lpString=".doc") returned 4 [0108.077] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0108.077] lstrlenW (lpString=".docx") returned 5 [0108.077] lstrcmpiW (lpString1=".docx", lpString2="E.XML") returned -1 [0108.077] lstrlenW (lpString=".pdf") returned 4 [0108.078] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0108.078] lstrlenW (lpString=".xls") returned 4 [0108.078] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0108.078] lstrlenW (lpString=".xlsx") returned 5 [0108.078] lstrcmpiW (lpString1=".xlsx", lpString2="E.XML") returned -1 [0108.078] lstrlenW (lpString=".ppt") returned 4 [0108.078] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0108.078] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77 [0108.078] lstrlenW (lpString=".zip") returned 4 [0108.078] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0108.078] lstrlenW (lpString=".rar") returned 4 [0108.078] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0108.078] lstrlenW (lpString=".bz2") returned 4 [0108.078] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0108.078] lstrlenW (lpString=".7z") returned 3 [0108.078] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0108.078] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77 [0108.078] lstrlenW (lpString=".dbf") returned 4 [0108.078] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0108.078] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77 [0108.078] lstrlenW (lpString=".1cd") returned 4 [0108.078] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0108.078] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77 [0108.078] lstrlenW (lpString=".jpg") returned 4 [0108.078] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0108.078] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77 [0108.078] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77 [0108.078] lstrlenW (lpString=".doc") returned 4 [0108.078] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0108.078] lstrlenW (lpString=".docx") returned 5 [0108.078] lstrcmpiW (lpString1=".docx", lpString2="E.XML") returned -1 [0108.078] lstrlenW (lpString=".pdf") returned 4 [0108.078] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0108.078] lstrlenW (lpString=".xls") returned 4 [0108.078] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0108.078] lstrlenW (lpString=".xlsx") returned 5 [0108.078] lstrcmpiW (lpString1=".xlsx", lpString2="E.XML") returned -1 [0108.078] lstrlenW (lpString=".ppt") returned 4 [0108.078] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0108.078] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77 [0108.078] lstrlenW (lpString=".zip") returned 4 [0108.078] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0108.078] lstrlenW (lpString=".rar") returned 4 [0108.078] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0108.078] lstrlenW (lpString=".bz2") returned 4 [0108.078] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0108.078] lstrlenW (lpString=".7z") returned 3 [0108.078] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0108.078] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77 [0108.078] lstrlenW (lpString=".dbf") returned 4 [0108.078] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0108.078] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77 [0108.079] lstrlenW (lpString=".1cd") returned 4 [0108.079] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0108.079] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77 [0108.079] lstrlenW (lpString=".jpg") returned 4 [0108.079] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0108.079] lstrcmpiW (lpString1=".DAT", lpString2=".waifu") returned -1 [0108.079] lstrlenW (lpString="STOCKS.DAT") returned 10 [0108.079] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0108.079] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x342ff14 | out: lpFileSize=0x342ff14*=39017) returned 1 [0108.079] CloseHandle (hObject=0x1dc) returned 1 [0108.080] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.dat")) returned 0x20 [0108.080] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.dat.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0108.080] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0108.080] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0108.080] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0108.080] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.dat.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0108.080] GetLastError () returned 0x0 [0108.080] ReadFile (in: hFile=0x1dc, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x9869, lpOverlapped=0x0) returned 1 [0108.084] WriteFile (in: hFile=0x1ac, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0x9870, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0x9870, lpOverlapped=0x0) returned 1 [0108.085] ReadFile (in: hFile=0x1dc, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x0, lpOverlapped=0x0) returned 1 [0108.085] WriteFile (in: hFile=0x1ac, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0xe8, lpOverlapped=0x0) returned 1 [0108.085] SetEndOfFile (hFile=0x1ac) returned 1 [0108.085] CloseHandle (hObject=0x1ac) returned 1 [0108.086] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0108.086] SetEndOfFile (hFile=0x1dc) returned 1 [0108.086] CloseHandle (hObject=0x1dc) returned 1 [0108.086] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0108.086] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.dat")) returned 1 [0108.087] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78 [0108.087] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78 [0108.087] lstrlenW (lpString=".doc") returned 4 [0108.087] lstrcmpiW (lpString1=".doc", lpString2=".DAT") returned 1 [0108.087] lstrlenW (lpString=".docx") returned 5 [0108.087] lstrcmpiW (lpString1=".docx", lpString2="S.DAT") returned -1 [0108.087] lstrlenW (lpString=".pdf") returned 4 [0108.087] lstrcmpiW (lpString1=".pdf", lpString2=".DAT") returned 1 [0108.087] lstrlenW (lpString=".xls") returned 4 [0108.087] lstrcmpiW (lpString1=".xls", lpString2=".DAT") returned 1 [0108.087] lstrlenW (lpString=".xlsx") returned 5 [0108.087] lstrcmpiW (lpString1=".xlsx", lpString2="S.DAT") returned -1 [0108.087] lstrlenW (lpString=".ppt") returned 4 [0108.087] lstrcmpiW (lpString1=".ppt", lpString2=".DAT") returned 1 [0108.087] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78 [0108.087] lstrlenW (lpString=".zip") returned 4 [0108.087] lstrcmpiW (lpString1=".zip", lpString2=".DAT") returned 1 [0108.087] lstrlenW (lpString=".rar") returned 4 [0108.087] lstrcmpiW (lpString1=".rar", lpString2=".DAT") returned 1 [0108.087] lstrlenW (lpString=".bz2") returned 4 [0108.087] lstrcmpiW (lpString1=".bz2", lpString2=".DAT") returned -1 [0108.087] lstrlenW (lpString=".7z") returned 3 [0108.087] lstrcmpiW (lpString1=".7z", lpString2="DAT") returned -1 [0108.087] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78 [0108.087] lstrlenW (lpString=".dbf") returned 4 [0108.087] lstrcmpiW (lpString1=".dbf", lpString2=".DAT") returned 1 [0108.087] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78 [0108.087] lstrlenW (lpString=".1cd") returned 4 [0108.087] lstrcmpiW (lpString1=".1cd", lpString2=".DAT") returned -1 [0108.087] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78 [0108.087] lstrlenW (lpString=".jpg") returned 4 [0108.087] lstrcmpiW (lpString1=".jpg", lpString2=".DAT") returned 1 [0108.087] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78 [0108.087] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78 [0108.087] lstrlenW (lpString=".doc") returned 4 [0108.087] lstrcmpiW (lpString1=".doc", lpString2=".DAT") returned 1 [0108.087] lstrlenW (lpString=".docx") returned 5 [0108.087] lstrcmpiW (lpString1=".docx", lpString2="S.DAT") returned -1 [0108.087] lstrlenW (lpString=".pdf") returned 4 [0108.087] lstrcmpiW (lpString1=".pdf", lpString2=".DAT") returned 1 [0108.087] lstrlenW (lpString=".xls") returned 4 [0108.087] lstrcmpiW (lpString1=".xls", lpString2=".DAT") returned 1 [0108.087] lstrlenW (lpString=".xlsx") returned 5 [0108.087] lstrcmpiW (lpString1=".xlsx", lpString2="S.DAT") returned -1 [0108.087] lstrlenW (lpString=".ppt") returned 4 [0108.087] lstrcmpiW (lpString1=".ppt", lpString2=".DAT") returned 1 [0108.088] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78 [0108.088] lstrlenW (lpString=".zip") returned 4 [0108.088] lstrcmpiW (lpString1=".zip", lpString2=".DAT") returned 1 [0108.088] lstrlenW (lpString=".rar") returned 4 [0108.088] lstrcmpiW (lpString1=".rar", lpString2=".DAT") returned 1 [0108.088] lstrlenW (lpString=".bz2") returned 4 [0108.088] lstrcmpiW (lpString1=".bz2", lpString2=".DAT") returned -1 [0108.088] lstrlenW (lpString=".7z") returned 3 [0108.088] lstrcmpiW (lpString1=".7z", lpString2="DAT") returned -1 [0108.088] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78 [0108.088] lstrlenW (lpString=".dbf") returned 4 [0108.088] lstrcmpiW (lpString1=".dbf", lpString2=".DAT") returned 1 [0108.088] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78 [0108.088] lstrlenW (lpString=".1cd") returned 4 [0108.088] lstrcmpiW (lpString1=".1cd", lpString2=".DAT") returned -1 [0108.088] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78 [0108.088] lstrlenW (lpString=".jpg") returned 4 [0108.088] lstrcmpiW (lpString1=".jpg", lpString2=".DAT") returned 1 [0108.088] lstrcmpiW (lpString1=".XML", lpString2=".waifu") returned 1 [0108.088] lstrlenW (lpString="STOCKS.XML") returned 10 [0108.088] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0108.088] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x342ff14 | out: lpFileSize=0x342ff14*=2687) returned 1 [0108.088] CloseHandle (hObject=0x1dc) returned 1 [0108.088] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.xml")) returned 0x20 [0108.088] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.xml.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0108.088] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0108.089] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0108.089] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0108.089] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.xml.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0108.089] GetLastError () returned 0x0 [0108.089] ReadFile (in: hFile=0x1dc, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0xa7f, lpOverlapped=0x0) returned 1 [0108.306] WriteFile (in: hFile=0x1ac, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0xa80, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0xa80, lpOverlapped=0x0) returned 1 [0110.452] ReadFile (in: hFile=0x1dc, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x0, lpOverlapped=0x0) returned 1 [0110.454] WriteFile (in: hFile=0x1ac, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0xe8, lpOverlapped=0x0) returned 1 [0110.454] SetEndOfFile (hFile=0x1ac) returned 1 [0110.454] CloseHandle (hObject=0x1ac) returned 1 [0110.454] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0110.454] SetEndOfFile (hFile=0x1dc) returned 1 [0110.454] CloseHandle (hObject=0x1dc) returned 1 [0110.454] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0110.455] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.xml")) returned 1 [0110.455] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78 [0110.455] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78 [0110.455] lstrlenW (lpString=".doc") returned 4 [0110.455] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0110.455] lstrlenW (lpString=".docx") returned 5 [0110.455] lstrcmpiW (lpString1=".docx", lpString2="S.XML") returned -1 [0110.455] lstrlenW (lpString=".pdf") returned 4 [0110.455] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0110.455] lstrlenW (lpString=".xls") returned 4 [0110.455] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0110.455] lstrlenW (lpString=".xlsx") returned 5 [0110.455] lstrcmpiW (lpString1=".xlsx", lpString2="S.XML") returned -1 [0110.455] lstrlenW (lpString=".ppt") returned 4 [0110.455] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0110.455] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78 [0110.455] lstrlenW (lpString=".zip") returned 4 [0110.455] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0110.455] lstrlenW (lpString=".rar") returned 4 [0110.455] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0110.455] lstrlenW (lpString=".bz2") returned 4 [0110.455] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0110.455] lstrlenW (lpString=".7z") returned 3 [0110.455] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0110.455] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78 [0110.455] lstrlenW (lpString=".dbf") returned 4 [0110.455] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0110.455] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78 [0110.455] lstrlenW (lpString=".1cd") returned 4 [0110.455] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0110.455] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78 [0110.455] lstrlenW (lpString=".jpg") returned 4 [0110.455] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0110.455] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78 [0110.456] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78 [0110.456] lstrlenW (lpString=".doc") returned 4 [0110.456] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0110.456] lstrlenW (lpString=".docx") returned 5 [0110.456] lstrcmpiW (lpString1=".docx", lpString2="S.XML") returned -1 [0110.456] lstrlenW (lpString=".pdf") returned 4 [0110.456] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0110.456] lstrlenW (lpString=".xls") returned 4 [0110.456] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0110.456] lstrlenW (lpString=".xlsx") returned 5 [0110.456] lstrcmpiW (lpString1=".xlsx", lpString2="S.XML") returned -1 [0110.456] lstrlenW (lpString=".ppt") returned 4 [0110.456] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0110.456] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78 [0110.456] lstrlenW (lpString=".zip") returned 4 [0110.456] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0110.456] lstrlenW (lpString=".rar") returned 4 [0110.456] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0110.456] lstrlenW (lpString=".bz2") returned 4 [0110.456] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0110.456] lstrlenW (lpString=".7z") returned 3 [0110.456] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0110.456] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78 [0110.456] lstrlenW (lpString=".dbf") returned 4 [0110.456] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0110.456] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78 [0110.456] lstrlenW (lpString=".1cd") returned 4 [0110.456] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0110.456] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78 [0110.456] lstrlenW (lpString=".jpg") returned 4 [0110.456] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0110.456] lstrcmpiW (lpString1=".emf", lpString2=".waifu") returned -1 [0110.456] lstrlenW (lpString="Genko_2.emf") returned 11 [0110.456] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_2.emf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0111.294] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x342ff14 | out: lpFileSize=0x342ff14*=10340) returned 1 [0111.300] CloseHandle (hObject=0x1b0) returned 1 [0111.300] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_2.emf")) returned 0x20 [0111.300] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_2.emf.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0111.300] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_2.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0111.300] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0111.300] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0111.301] lstrlenW (lpString=".doc") returned 4 [0111.301] lstrcmpiW (lpString1=".doc", lpString2=".emf") returned -1 [0111.301] lstrlenW (lpString=".docx") returned 5 [0111.301] lstrcmpiW (lpString1=".docx", lpString2="2.emf") returned -1 [0111.301] lstrlenW (lpString=".pdf") returned 4 [0111.301] lstrcmpiW (lpString1=".pdf", lpString2=".emf") returned 1 [0111.301] lstrlenW (lpString=".xls") returned 4 [0111.301] lstrcmpiW (lpString1=".xls", lpString2=".emf") returned 1 [0111.301] lstrlenW (lpString=".xlsx") returned 5 [0111.301] lstrcmpiW (lpString1=".xlsx", lpString2="2.emf") returned -1 [0111.301] lstrlenW (lpString=".ppt") returned 4 [0111.301] lstrcmpiW (lpString1=".ppt", lpString2=".emf") returned 1 [0111.301] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0111.301] lstrlenW (lpString=".zip") returned 4 [0111.301] lstrcmpiW (lpString1=".zip", lpString2=".emf") returned 1 [0111.301] lstrlenW (lpString=".rar") returned 4 [0111.301] lstrcmpiW (lpString1=".rar", lpString2=".emf") returned 1 [0111.301] lstrlenW (lpString=".bz2") returned 4 [0111.301] lstrcmpiW (lpString1=".bz2", lpString2=".emf") returned -1 [0111.301] lstrlenW (lpString=".7z") returned 3 [0111.301] lstrcmpiW (lpString1=".7z", lpString2="emf") returned -1 [0111.301] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0111.301] lstrlenW (lpString=".dbf") returned 4 [0111.301] lstrcmpiW (lpString1=".dbf", lpString2=".emf") returned -1 [0111.301] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0111.301] lstrlenW (lpString=".1cd") returned 4 [0111.301] lstrcmpiW (lpString1=".1cd", lpString2=".emf") returned -1 [0111.301] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0111.301] lstrlenW (lpString=".jpg") returned 4 [0111.301] lstrcmpiW (lpString1=".jpg", lpString2=".emf") returned 1 [0111.301] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0111.301] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0111.301] lstrlenW (lpString=".doc") returned 4 [0111.301] lstrcmpiW (lpString1=".doc", lpString2=".emf") returned -1 [0111.301] lstrlenW (lpString=".docx") returned 5 [0111.301] lstrcmpiW (lpString1=".docx", lpString2="2.emf") returned -1 [0111.301] lstrlenW (lpString=".pdf") returned 4 [0111.301] lstrcmpiW (lpString1=".pdf", lpString2=".emf") returned 1 [0111.301] lstrlenW (lpString=".xls") returned 4 [0111.301] lstrcmpiW (lpString1=".xls", lpString2=".emf") returned 1 [0111.301] lstrlenW (lpString=".xlsx") returned 5 [0111.301] lstrcmpiW (lpString1=".xlsx", lpString2="2.emf") returned -1 [0111.301] lstrlenW (lpString=".ppt") returned 4 [0111.301] lstrcmpiW (lpString1=".ppt", lpString2=".emf") returned 1 [0111.301] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0111.301] lstrlenW (lpString=".zip") returned 4 [0111.301] lstrcmpiW (lpString1=".zip", lpString2=".emf") returned 1 [0111.301] lstrlenW (lpString=".rar") returned 4 [0111.301] lstrcmpiW (lpString1=".rar", lpString2=".emf") returned 1 [0111.301] lstrlenW (lpString=".bz2") returned 4 [0111.302] lstrcmpiW (lpString1=".bz2", lpString2=".emf") returned -1 [0111.302] lstrlenW (lpString=".7z") returned 3 [0111.302] lstrcmpiW (lpString1=".7z", lpString2="emf") returned -1 [0111.302] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0111.302] lstrlenW (lpString=".dbf") returned 4 [0111.302] lstrcmpiW (lpString1=".dbf", lpString2=".emf") returned -1 [0111.302] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0111.302] lstrlenW (lpString=".1cd") returned 4 [0111.302] lstrcmpiW (lpString1=".1cd", lpString2=".emf") returned -1 [0111.302] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0111.302] lstrlenW (lpString=".jpg") returned 4 [0111.302] lstrcmpiW (lpString1=".jpg", lpString2=".emf") returned 1 [0111.302] lstrcmpiW (lpString1=".GIF", lpString2=".waifu") returned -1 [0111.302] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0111.302] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0111.775] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x342ff14 | out: lpFileSize=0x342ff14*=2985) returned 1 [0111.775] CloseHandle (hObject=0x1ec) returned 1 [0111.775] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\preview.gif")) returned 0x20 [0111.775] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\preview.gif.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0111.775] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0111.775] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0111.775] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0111.775] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\preview.gif.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0111.778] GetLastError () returned 0x0 [0111.778] ReadFile (in: hFile=0x1ec, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0xba9, lpOverlapped=0x0) returned 1 [0111.784] WriteFile (in: hFile=0x1f4, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0xbb0, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0xbb0, lpOverlapped=0x0) returned 1 [0111.785] ReadFile (in: hFile=0x1ec, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x0, lpOverlapped=0x0) returned 1 [0111.785] WriteFile (in: hFile=0x1f4, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0xea, lpOverlapped=0x0) returned 1 [0111.785] SetEndOfFile (hFile=0x1f4) returned 1 [0111.785] CloseHandle (hObject=0x1f4) returned 1 [0111.785] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0111.785] SetEndOfFile (hFile=0x1ec) returned 1 [0111.786] CloseHandle (hObject=0x1ec) returned 1 [0111.786] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0111.786] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\preview.gif")) returned 1 [0111.786] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74 [0111.786] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74 [0111.786] lstrlenW (lpString=".doc") returned 4 [0111.786] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0111.786] lstrlenW (lpString=".docx") returned 5 [0111.786] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0111.786] lstrlenW (lpString=".pdf") returned 4 [0111.786] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0111.786] lstrlenW (lpString=".xls") returned 4 [0111.786] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0111.786] lstrlenW (lpString=".xlsx") returned 5 [0111.786] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0111.786] lstrlenW (lpString=".ppt") returned 4 [0111.786] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0111.786] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74 [0111.786] lstrlenW (lpString=".zip") returned 4 [0111.786] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0111.787] lstrlenW (lpString=".rar") returned 4 [0111.787] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0111.787] lstrlenW (lpString=".bz2") returned 4 [0111.787] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0111.787] lstrlenW (lpString=".7z") returned 3 [0111.787] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0111.787] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74 [0111.787] lstrlenW (lpString=".dbf") returned 4 [0111.787] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0111.787] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74 [0111.787] lstrlenW (lpString=".1cd") returned 4 [0111.787] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0111.787] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74 [0111.787] lstrlenW (lpString=".jpg") returned 4 [0111.787] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0111.787] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74 [0111.787] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74 [0111.787] lstrlenW (lpString=".doc") returned 4 [0111.787] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0111.787] lstrlenW (lpString=".docx") returned 5 [0111.787] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0111.787] lstrlenW (lpString=".pdf") returned 4 [0111.787] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0111.787] lstrlenW (lpString=".xls") returned 4 [0111.787] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0111.787] lstrlenW (lpString=".xlsx") returned 5 [0111.787] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0111.787] lstrlenW (lpString=".ppt") returned 4 [0111.787] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0111.787] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74 [0111.787] lstrlenW (lpString=".zip") returned 4 [0111.787] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0111.787] lstrlenW (lpString=".rar") returned 4 [0111.787] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0111.787] lstrlenW (lpString=".bz2") returned 4 [0111.787] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0111.787] lstrlenW (lpString=".7z") returned 3 [0111.787] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0111.787] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74 [0111.787] lstrlenW (lpString=".dbf") returned 4 [0111.787] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0111.787] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74 [0111.787] lstrlenW (lpString=".1cd") returned 4 [0111.787] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0111.787] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74 [0111.787] lstrlenW (lpString=".jpg") returned 4 [0111.787] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0111.788] lstrcmpiW (lpString1=".GIF", lpString2=".waifu") returned -1 [0111.788] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0111.788] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0111.788] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x342ff14 | out: lpFileSize=0x342ff14*=2722) returned 1 [0111.788] CloseHandle (hObject=0x1ec) returned 1 [0111.788] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\preview.gif")) returned 0x20 [0111.788] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\preview.gif.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0111.788] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0111.788] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0111.788] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0111.788] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\preview.gif.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0111.792] GetLastError () returned 0x0 [0111.792] ReadFile (in: hFile=0x1ec, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0xaa2, lpOverlapped=0x0) returned 1 [0111.796] WriteFile (in: hFile=0x1f0, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0xab0, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0xab0, lpOverlapped=0x0) returned 1 [0111.796] ReadFile (in: hFile=0x1ec, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x0, lpOverlapped=0x0) returned 1 [0111.796] WriteFile (in: hFile=0x1f0, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0xea, lpOverlapped=0x0) returned 1 [0111.796] SetEndOfFile (hFile=0x1f0) returned 1 [0111.796] CloseHandle (hObject=0x1f0) returned 1 [0111.796] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0111.797] SetEndOfFile (hFile=0x1ec) returned 1 [0111.797] CloseHandle (hObject=0x1ec) returned 1 [0111.797] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0111.797] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\preview.gif")) returned 1 [0111.798] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74 [0111.798] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74 [0111.798] lstrlenW (lpString=".doc") returned 4 [0111.798] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0111.798] lstrlenW (lpString=".docx") returned 5 [0111.798] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0111.798] lstrlenW (lpString=".pdf") returned 4 [0111.798] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0111.798] lstrlenW (lpString=".xls") returned 4 [0111.798] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0111.798] lstrlenW (lpString=".xlsx") returned 5 [0111.798] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0111.798] lstrlenW (lpString=".ppt") returned 4 [0111.798] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0111.798] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74 [0111.798] lstrlenW (lpString=".zip") returned 4 [0111.798] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0111.798] lstrlenW (lpString=".rar") returned 4 [0111.798] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0111.798] lstrlenW (lpString=".bz2") returned 4 [0111.798] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0111.798] lstrlenW (lpString=".7z") returned 3 [0111.798] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0111.798] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74 [0111.798] lstrlenW (lpString=".dbf") returned 4 [0111.798] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0111.798] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74 [0111.798] lstrlenW (lpString=".1cd") returned 4 [0111.798] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0111.798] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74 [0111.798] lstrlenW (lpString=".jpg") returned 4 [0111.798] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0111.798] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74 [0111.798] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74 [0111.798] lstrlenW (lpString=".doc") returned 4 [0111.798] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0111.798] lstrlenW (lpString=".docx") returned 5 [0111.798] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0111.798] lstrlenW (lpString=".pdf") returned 4 [0111.798] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0111.798] lstrlenW (lpString=".xls") returned 4 [0111.798] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0111.798] lstrlenW (lpString=".xlsx") returned 5 [0111.798] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0111.798] lstrlenW (lpString=".ppt") returned 4 [0111.798] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0111.798] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74 [0111.798] lstrlenW (lpString=".zip") returned 4 [0111.799] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0111.799] lstrlenW (lpString=".rar") returned 4 [0111.799] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0111.799] lstrlenW (lpString=".bz2") returned 4 [0111.799] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0111.799] lstrlenW (lpString=".7z") returned 3 [0111.799] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0111.799] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74 [0111.799] lstrlenW (lpString=".dbf") returned 4 [0111.799] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0111.799] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74 [0111.799] lstrlenW (lpString=".1cd") returned 4 [0111.799] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0111.799] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74 [0111.799] lstrlenW (lpString=".jpg") returned 4 [0111.799] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0111.799] lstrcmpiW (lpString1=".GIF", lpString2=".waifu") returned -1 [0111.799] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0111.799] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0111.799] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x342ff14 | out: lpFileSize=0x342ff14*=945) returned 1 [0111.799] CloseHandle (hObject=0x1ec) returned 1 [0111.799] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\preview.gif")) returned 0x20 [0111.799] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\preview.gif.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0111.800] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0111.800] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0111.800] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0111.800] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\preview.gif.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0111.802] GetLastError () returned 0x0 [0111.802] ReadFile (in: hFile=0x1ec, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x3b1, lpOverlapped=0x0) returned 1 [0111.803] WriteFile (in: hFile=0x1f0, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0x3c0, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0x3c0, lpOverlapped=0x0) returned 1 [0111.804] ReadFile (in: hFile=0x1ec, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x0, lpOverlapped=0x0) returned 1 [0111.804] WriteFile (in: hFile=0x1f0, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0xea, lpOverlapped=0x0) returned 1 [0111.804] SetEndOfFile (hFile=0x1f0) returned 1 [0111.804] CloseHandle (hObject=0x1f0) returned 1 [0111.804] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0111.805] SetEndOfFile (hFile=0x1ec) returned 1 [0111.805] CloseHandle (hObject=0x1ec) returned 1 [0111.805] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0111.805] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\preview.gif")) returned 1 [0111.806] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74 [0111.806] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74 [0111.806] lstrlenW (lpString=".doc") returned 4 [0111.806] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0111.806] lstrlenW (lpString=".docx") returned 5 [0111.806] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0111.806] lstrlenW (lpString=".pdf") returned 4 [0111.806] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0111.806] lstrlenW (lpString=".xls") returned 4 [0111.806] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0111.806] lstrlenW (lpString=".xlsx") returned 5 [0111.806] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0111.806] lstrlenW (lpString=".ppt") returned 4 [0111.806] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0111.806] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74 [0111.806] lstrlenW (lpString=".zip") returned 4 [0111.806] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0111.806] lstrlenW (lpString=".rar") returned 4 [0111.806] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0111.806] lstrlenW (lpString=".bz2") returned 4 [0111.806] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0111.806] lstrlenW (lpString=".7z") returned 3 [0111.806] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0111.806] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74 [0111.806] lstrlenW (lpString=".dbf") returned 4 [0111.806] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0111.806] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74 [0111.806] lstrlenW (lpString=".1cd") returned 4 [0111.806] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0111.806] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74 [0111.806] lstrlenW (lpString=".jpg") returned 4 [0111.807] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0111.807] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74 [0111.807] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74 [0111.807] lstrlenW (lpString=".doc") returned 4 [0111.807] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0111.807] lstrlenW (lpString=".docx") returned 5 [0111.807] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0111.807] lstrlenW (lpString=".pdf") returned 4 [0111.807] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0111.807] lstrlenW (lpString=".xls") returned 4 [0111.807] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0111.807] lstrlenW (lpString=".xlsx") returned 5 [0111.807] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0111.807] lstrlenW (lpString=".ppt") returned 4 [0111.807] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0111.807] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74 [0111.807] lstrlenW (lpString=".zip") returned 4 [0111.807] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0111.807] lstrlenW (lpString=".rar") returned 4 [0111.807] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0111.807] lstrlenW (lpString=".bz2") returned 4 [0111.807] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0111.807] lstrlenW (lpString=".7z") returned 3 [0111.807] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0111.807] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74 [0111.807] lstrlenW (lpString=".dbf") returned 4 [0111.807] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0111.807] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74 [0111.807] lstrlenW (lpString=".1cd") returned 4 [0111.807] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0111.807] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74 [0111.807] lstrlenW (lpString=".jpg") returned 4 [0111.807] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0111.807] lstrcmpiW (lpString1=".PNG", lpString2=".waifu") returned -1 [0111.807] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0111.808] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0111.808] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x342ff14 | out: lpFileSize=0x342ff14*=32607) returned 1 [0111.808] CloseHandle (hObject=0x1ec) returned 1 [0111.808] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\thmbnail.png")) returned 0x20 [0111.808] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\thmbnail.png.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0111.808] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0111.808] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0111.808] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0111.808] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\thmbnail.png.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0111.808] GetLastError () returned 0x0 [0111.809] ReadFile (in: hFile=0x1ec, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x7f5f, lpOverlapped=0x0) returned 1 [0111.810] WriteFile (in: hFile=0x1f0, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0x7f60, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0x7f60, lpOverlapped=0x0) returned 1 [0111.811] ReadFile (in: hFile=0x1ec, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x0, lpOverlapped=0x0) returned 1 [0111.811] WriteFile (in: hFile=0x1f0, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0xec, lpOverlapped=0x0) returned 1 [0111.811] SetEndOfFile (hFile=0x1f0) returned 1 [0111.811] CloseHandle (hObject=0x1f0) returned 1 [0111.811] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0111.811] SetEndOfFile (hFile=0x1ec) returned 1 [0111.812] CloseHandle (hObject=0x1ec) returned 1 [0111.812] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0111.812] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\thmbnail.png")) returned 1 [0111.812] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75 [0111.812] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75 [0111.812] lstrlenW (lpString=".doc") returned 4 [0111.812] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0111.812] lstrlenW (lpString=".docx") returned 5 [0111.812] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0111.812] lstrlenW (lpString=".pdf") returned 4 [0111.812] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0111.812] lstrlenW (lpString=".xls") returned 4 [0111.812] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0111.812] lstrlenW (lpString=".xlsx") returned 5 [0111.812] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0111.812] lstrlenW (lpString=".ppt") returned 4 [0111.812] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0111.812] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75 [0111.812] lstrlenW (lpString=".zip") returned 4 [0111.812] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0111.812] lstrlenW (lpString=".rar") returned 4 [0111.813] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0111.813] lstrlenW (lpString=".bz2") returned 4 [0111.813] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0111.813] lstrlenW (lpString=".7z") returned 3 [0111.813] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0111.813] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75 [0111.813] lstrlenW (lpString=".dbf") returned 4 [0111.813] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0111.813] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75 [0111.813] lstrlenW (lpString=".1cd") returned 4 [0111.813] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0111.813] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75 [0111.813] lstrlenW (lpString=".jpg") returned 4 [0111.813] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0111.813] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75 [0111.813] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75 [0111.813] lstrlenW (lpString=".doc") returned 4 [0111.813] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0111.813] lstrlenW (lpString=".docx") returned 5 [0111.813] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0111.813] lstrlenW (lpString=".pdf") returned 4 [0111.813] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0111.813] lstrlenW (lpString=".xls") returned 4 [0111.813] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0111.813] lstrlenW (lpString=".xlsx") returned 5 [0111.813] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0111.813] lstrlenW (lpString=".ppt") returned 4 [0111.813] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0111.813] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75 [0111.813] lstrlenW (lpString=".zip") returned 4 [0111.813] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0111.813] lstrlenW (lpString=".rar") returned 4 [0111.813] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0111.813] lstrlenW (lpString=".bz2") returned 4 [0111.813] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0111.813] lstrlenW (lpString=".7z") returned 3 [0111.813] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0111.813] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75 [0111.813] lstrlenW (lpString=".dbf") returned 4 [0111.813] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0111.813] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75 [0111.813] lstrlenW (lpString=".1cd") returned 4 [0111.813] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0111.813] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75 [0111.813] lstrlenW (lpString=".jpg") returned 4 [0111.813] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0111.814] lstrcmpiW (lpString1=".GIF", lpString2=".waifu") returned -1 [0111.814] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0111.814] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0111.814] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x342ff14 | out: lpFileSize=0x342ff14*=2044) returned 1 [0111.814] CloseHandle (hObject=0x1ec) returned 1 [0111.815] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\preview.gif")) returned 0x20 [0111.815] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\preview.gif.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0111.815] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0111.815] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0111.815] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0111.815] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\preview.gif.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0111.816] GetLastError () returned 0x0 [0111.816] ReadFile (in: hFile=0x1ec, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x7fc, lpOverlapped=0x0) returned 1 [0111.817] WriteFile (in: hFile=0x180, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0x800, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0x800, lpOverlapped=0x0) returned 1 [0111.818] ReadFile (in: hFile=0x1ec, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x0, lpOverlapped=0x0) returned 1 [0111.818] WriteFile (in: hFile=0x180, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0xea, lpOverlapped=0x0) returned 1 [0111.818] SetEndOfFile (hFile=0x180) returned 1 [0111.818] CloseHandle (hObject=0x180) returned 1 [0111.818] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0111.818] SetEndOfFile (hFile=0x1ec) returned 1 [0111.819] CloseHandle (hObject=0x1ec) returned 1 [0111.819] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0111.819] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\preview.gif")) returned 1 [0111.819] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76 [0111.819] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76 [0111.819] lstrlenW (lpString=".doc") returned 4 [0111.819] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0111.819] lstrlenW (lpString=".docx") returned 5 [0111.819] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0111.819] lstrlenW (lpString=".pdf") returned 4 [0111.819] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0111.819] lstrlenW (lpString=".xls") returned 4 [0111.819] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0111.819] lstrlenW (lpString=".xlsx") returned 5 [0111.819] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0111.819] lstrlenW (lpString=".ppt") returned 4 [0111.819] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0111.819] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76 [0111.819] lstrlenW (lpString=".zip") returned 4 [0111.819] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0111.819] lstrlenW (lpString=".rar") returned 4 [0111.819] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0111.819] lstrlenW (lpString=".bz2") returned 4 [0111.819] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0111.819] lstrlenW (lpString=".7z") returned 3 [0111.819] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0111.820] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76 [0111.820] lstrlenW (lpString=".dbf") returned 4 [0111.820] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0111.820] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76 [0111.820] lstrlenW (lpString=".1cd") returned 4 [0111.820] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0111.820] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76 [0111.820] lstrlenW (lpString=".jpg") returned 4 [0111.820] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0111.820] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76 [0111.820] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76 [0111.820] lstrlenW (lpString=".doc") returned 4 [0111.820] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0111.820] lstrlenW (lpString=".docx") returned 5 [0111.820] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0111.820] lstrlenW (lpString=".pdf") returned 4 [0111.820] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0111.820] lstrlenW (lpString=".xls") returned 4 [0111.820] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0111.820] lstrlenW (lpString=".xlsx") returned 5 [0111.820] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0111.820] lstrlenW (lpString=".ppt") returned 4 [0111.820] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0111.820] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76 [0111.820] lstrlenW (lpString=".zip") returned 4 [0111.820] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0111.820] lstrlenW (lpString=".rar") returned 4 [0111.820] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0111.820] lstrlenW (lpString=".bz2") returned 4 [0111.820] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0111.820] lstrlenW (lpString=".7z") returned 3 [0111.820] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0111.820] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76 [0111.820] lstrlenW (lpString=".dbf") returned 4 [0111.820] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0111.820] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76 [0111.820] lstrlenW (lpString=".1cd") returned 4 [0111.820] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0111.820] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76 [0111.820] lstrlenW (lpString=".jpg") returned 4 [0111.820] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0111.820] lstrcmpiW (lpString1=".PNG", lpString2=".waifu") returned -1 [0111.821] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0111.821] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0111.821] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x342ff14 | out: lpFileSize=0x342ff14*=29925) returned 1 [0111.821] CloseHandle (hObject=0x1ec) returned 1 [0111.821] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\thmbnail.png")) returned 0x20 [0111.821] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\thmbnail.png.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0111.821] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0111.821] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0111.821] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0111.821] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\thmbnail.png.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0111.821] GetLastError () returned 0x0 [0111.821] ReadFile (in: hFile=0x1ec, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x74e5, lpOverlapped=0x0) returned 1 [0111.992] WriteFile (in: hFile=0x180, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0x74f0, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0x74f0, lpOverlapped=0x0) returned 1 [0112.189] ReadFile (in: hFile=0x1ec, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x0, lpOverlapped=0x0) returned 1 [0112.189] WriteFile (in: hFile=0x180, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0xec, lpOverlapped=0x0) returned 1 [0112.189] SetEndOfFile (hFile=0x180) returned 1 [0112.189] CloseHandle (hObject=0x180) returned 1 [0112.189] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0112.189] SetEndOfFile (hFile=0x1ec) returned 1 [0112.190] CloseHandle (hObject=0x1ec) returned 1 [0112.190] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0112.190] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\thmbnail.png")) returned 1 [0112.190] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77 [0112.190] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77 [0112.190] lstrlenW (lpString=".doc") returned 4 [0112.190] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0112.190] lstrlenW (lpString=".docx") returned 5 [0112.190] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0112.190] lstrlenW (lpString=".pdf") returned 4 [0112.190] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0112.190] lstrlenW (lpString=".xls") returned 4 [0112.190] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0112.190] lstrlenW (lpString=".xlsx") returned 5 [0112.190] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0112.190] lstrlenW (lpString=".ppt") returned 4 [0112.190] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0112.190] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77 [0112.190] lstrlenW (lpString=".zip") returned 4 [0112.190] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0112.190] lstrlenW (lpString=".rar") returned 4 [0112.191] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0112.191] lstrlenW (lpString=".bz2") returned 4 [0112.191] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0112.191] lstrlenW (lpString=".7z") returned 3 [0112.191] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0112.191] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77 [0112.191] lstrlenW (lpString=".dbf") returned 4 [0112.191] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0112.191] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77 [0112.191] lstrlenW (lpString=".1cd") returned 4 [0112.191] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0112.191] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77 [0112.191] lstrlenW (lpString=".jpg") returned 4 [0112.191] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0112.191] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77 [0112.191] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77 [0112.191] lstrlenW (lpString=".doc") returned 4 [0112.191] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0112.191] lstrlenW (lpString=".docx") returned 5 [0112.191] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0112.191] lstrlenW (lpString=".pdf") returned 4 [0112.191] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0112.191] lstrlenW (lpString=".xls") returned 4 [0112.191] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0112.191] lstrlenW (lpString=".xlsx") returned 5 [0112.191] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0112.191] lstrlenW (lpString=".ppt") returned 4 [0112.191] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0112.191] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77 [0112.191] lstrlenW (lpString=".zip") returned 4 [0112.191] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0112.191] lstrlenW (lpString=".rar") returned 4 [0112.191] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0112.191] lstrlenW (lpString=".bz2") returned 4 [0112.191] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0112.191] lstrlenW (lpString=".7z") returned 3 [0112.191] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0112.191] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77 [0112.191] lstrlenW (lpString=".dbf") returned 4 [0112.191] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0112.192] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77 [0112.192] lstrlenW (lpString=".1cd") returned 4 [0112.192] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0112.192] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77 [0112.192] lstrlenW (lpString=".jpg") returned 4 [0112.192] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0112.192] lstrcmpiW (lpString1=".PNG", lpString2=".waifu") returned -1 [0112.192] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0112.192] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0112.436] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x342ff14 | out: lpFileSize=0x342ff14*=20575) returned 1 [0112.436] CloseHandle (hObject=0x1f4) returned 1 [0112.436] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\thmbnail.png")) returned 0x20 [0112.436] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\thmbnail.png.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0112.437] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0112.437] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0112.437] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0112.437] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\thmbnail.png.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0112.437] GetLastError () returned 0x0 [0112.437] ReadFile (in: hFile=0x1f4, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x505f, lpOverlapped=0x0) returned 1 [0112.589] WriteFile (in: hFile=0x1f8, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0x5060, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0x5060, lpOverlapped=0x0) returned 1 [0112.590] ReadFile (in: hFile=0x1f4, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x0, lpOverlapped=0x0) returned 1 [0112.590] WriteFile (in: hFile=0x1f8, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0xec, lpOverlapped=0x0) returned 1 [0112.590] SetEndOfFile (hFile=0x1f8) returned 1 [0112.590] CloseHandle (hObject=0x1f8) returned 1 [0112.590] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0112.590] SetEndOfFile (hFile=0x1f4) returned 1 [0112.591] CloseHandle (hObject=0x1f4) returned 1 [0112.591] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0112.591] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\thmbnail.png")) returned 1 [0112.591] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 76 [0112.591] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 76 [0112.591] lstrlenW (lpString=".doc") returned 4 [0112.591] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0112.591] lstrlenW (lpString=".docx") returned 5 [0112.591] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0112.592] lstrlenW (lpString=".pdf") returned 4 [0112.592] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0112.592] lstrlenW (lpString=".xls") returned 4 [0112.592] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0112.592] lstrlenW (lpString=".xlsx") returned 5 [0112.592] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0112.592] lstrlenW (lpString=".ppt") returned 4 [0112.592] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0112.592] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 76 [0112.592] lstrlenW (lpString=".zip") returned 4 [0112.592] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0112.592] lstrlenW (lpString=".rar") returned 4 [0112.592] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0112.592] lstrlenW (lpString=".bz2") returned 4 [0112.592] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0112.592] lstrlenW (lpString=".7z") returned 3 [0112.592] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0112.592] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 76 [0112.592] lstrlenW (lpString=".dbf") returned 4 [0112.592] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0112.592] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 76 [0112.592] lstrlenW (lpString=".1cd") returned 4 [0112.592] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0112.592] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 76 [0112.592] lstrlenW (lpString=".jpg") returned 4 [0112.592] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0112.592] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 76 [0112.592] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 76 [0112.592] lstrlenW (lpString=".doc") returned 4 [0112.592] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0112.592] lstrlenW (lpString=".docx") returned 5 [0112.592] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0112.592] lstrlenW (lpString=".pdf") returned 4 [0112.592] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0112.592] lstrlenW (lpString=".xls") returned 4 [0112.592] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0112.592] lstrlenW (lpString=".xlsx") returned 5 [0112.592] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0112.592] lstrlenW (lpString=".ppt") returned 4 [0112.592] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0112.592] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 76 [0112.592] lstrlenW (lpString=".zip") returned 4 [0112.592] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0112.592] lstrlenW (lpString=".rar") returned 4 [0112.592] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0112.592] lstrlenW (lpString=".bz2") returned 4 [0112.592] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0112.592] lstrlenW (lpString=".7z") returned 3 [0112.592] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0112.593] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 76 [0112.593] lstrlenW (lpString=".dbf") returned 4 [0112.593] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0112.593] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 76 [0112.593] lstrlenW (lpString=".1cd") returned 4 [0112.593] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0112.593] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 76 [0112.593] lstrlenW (lpString=".jpg") returned 4 [0112.593] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0112.593] lstrcmpiW (lpString1=".PNG", lpString2=".waifu") returned -1 [0112.593] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0112.593] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0112.950] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x342ff14 | out: lpFileSize=0x342ff14*=33277) returned 1 [0112.962] CloseHandle (hObject=0x1f0) returned 1 [0112.963] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\thmbnail.png")) returned 0x20 [0112.963] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\thmbnail.png.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0112.963] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0112.963] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0112.963] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0112.963] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\thmbnail.png.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0112.963] GetLastError () returned 0x0 [0112.963] ReadFile (in: hFile=0x1f0, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x81fd, lpOverlapped=0x0) returned 1 [0112.997] WriteFile (in: hFile=0x1d8, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0x8200, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0x8200, lpOverlapped=0x0) returned 1 [0112.998] ReadFile (in: hFile=0x1f0, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x0, lpOverlapped=0x0) returned 1 [0112.998] WriteFile (in: hFile=0x1d8, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0xec, lpOverlapped=0x0) returned 1 [0112.998] SetEndOfFile (hFile=0x1d8) returned 1 [0112.998] CloseHandle (hObject=0x1d8) returned 1 [0112.998] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0112.998] SetEndOfFile (hFile=0x1f0) returned 1 [0112.999] CloseHandle (hObject=0x1f0) returned 1 [0112.999] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0112.999] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\thmbnail.png")) returned 1 [0112.999] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG") returned 77 [0112.999] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG") returned 77 [0112.999] lstrlenW (lpString=".doc") returned 4 [0112.999] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0112.999] lstrlenW (lpString=".docx") returned 5 [0112.999] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0112.999] lstrlenW (lpString=".pdf") returned 4 [0112.999] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0112.999] lstrlenW (lpString=".xls") returned 4 [0112.999] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0112.999] lstrlenW (lpString=".xlsx") returned 5 [0112.999] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0112.999] lstrlenW (lpString=".ppt") returned 4 [0113.000] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0113.000] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG") returned 77 [0113.000] lstrlenW (lpString=".zip") returned 4 [0113.000] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0113.000] lstrlenW (lpString=".rar") returned 4 [0113.000] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0113.000] lstrlenW (lpString=".bz2") returned 4 [0113.000] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0113.000] lstrlenW (lpString=".7z") returned 3 [0113.000] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0113.000] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG") returned 77 [0113.000] lstrlenW (lpString=".dbf") returned 4 [0113.000] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0113.000] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG") returned 77 [0113.000] lstrlenW (lpString=".1cd") returned 4 [0113.000] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0113.000] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG") returned 77 [0113.000] lstrlenW (lpString=".jpg") returned 4 [0113.000] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0113.000] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG") returned 77 [0113.000] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG") returned 77 [0113.000] lstrlenW (lpString=".doc") returned 4 [0113.000] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0113.000] lstrlenW (lpString=".docx") returned 5 [0113.000] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0113.000] lstrlenW (lpString=".pdf") returned 4 [0113.000] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0113.000] lstrlenW (lpString=".xls") returned 4 [0113.000] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0113.000] lstrlenW (lpString=".xlsx") returned 5 [0113.000] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0113.000] lstrlenW (lpString=".ppt") returned 4 [0113.000] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0113.000] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG") returned 77 [0113.000] lstrlenW (lpString=".zip") returned 4 [0113.000] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0113.000] lstrlenW (lpString=".rar") returned 4 [0113.000] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0113.000] lstrlenW (lpString=".bz2") returned 4 [0113.000] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0113.000] lstrlenW (lpString=".7z") returned 3 [0113.000] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0113.000] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG") returned 77 [0113.000] lstrlenW (lpString=".dbf") returned 4 [0113.000] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0113.000] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG") returned 77 [0113.000] lstrlenW (lpString=".1cd") returned 4 [0113.000] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0113.000] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG") returned 77 [0113.000] lstrlenW (lpString=".jpg") returned 4 [0113.000] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0113.001] lstrcmpiW (lpString1=".GIF", lpString2=".waifu") returned -1 [0113.001] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0113.001] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0113.001] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x342ff14 | out: lpFileSize=0x342ff14*=1354) returned 1 [0113.001] CloseHandle (hObject=0x1f0) returned 1 [0113.001] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\preview.gif")) returned 0x20 [0113.001] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\preview.gif.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0113.001] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0113.001] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0113.001] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0113.001] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\preview.gif.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0113.843] GetLastError () returned 0x0 [0113.843] ReadFile (in: hFile=0x1f0, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x54a, lpOverlapped=0x0) returned 1 [0113.844] WriteFile (in: hFile=0x1c0, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0x550, lpOverlapped=0x0) returned 1 [0113.845] ReadFile (in: hFile=0x1f0, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x0, lpOverlapped=0x0) returned 1 [0113.845] WriteFile (in: hFile=0x1c0, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0xea, lpOverlapped=0x0) returned 1 [0113.845] SetEndOfFile (hFile=0x1c0) returned 1 [0113.845] CloseHandle (hObject=0x1c0) returned 1 [0113.846] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0113.846] SetEndOfFile (hFile=0x1f0) returned 1 [0113.846] CloseHandle (hObject=0x1f0) returned 1 [0113.846] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0113.846] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\preview.gif")) returned 1 [0113.847] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned 76 [0113.847] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned 76 [0113.847] lstrlenW (lpString=".doc") returned 4 [0113.847] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0113.847] lstrlenW (lpString=".docx") returned 5 [0113.847] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0113.847] lstrlenW (lpString=".pdf") returned 4 [0113.847] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0113.847] lstrlenW (lpString=".xls") returned 4 [0113.847] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0113.847] lstrlenW (lpString=".xlsx") returned 5 [0113.847] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0113.847] lstrlenW (lpString=".ppt") returned 4 [0113.847] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0113.847] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned 76 [0113.847] lstrlenW (lpString=".zip") returned 4 [0113.847] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0113.847] lstrlenW (lpString=".rar") returned 4 [0113.847] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0113.847] lstrlenW (lpString=".bz2") returned 4 [0113.847] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0113.847] lstrlenW (lpString=".7z") returned 3 [0113.847] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0113.847] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned 76 [0113.847] lstrlenW (lpString=".dbf") returned 4 [0113.847] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0113.847] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned 76 [0113.847] lstrlenW (lpString=".1cd") returned 4 [0113.847] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0113.847] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned 76 [0113.847] lstrlenW (lpString=".jpg") returned 4 [0113.847] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0113.847] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned 76 [0113.847] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned 76 [0113.847] lstrlenW (lpString=".doc") returned 4 [0113.847] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0113.847] lstrlenW (lpString=".docx") returned 5 [0113.847] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0113.847] lstrlenW (lpString=".pdf") returned 4 [0113.847] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0113.847] lstrlenW (lpString=".xls") returned 4 [0113.848] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0113.848] lstrlenW (lpString=".xlsx") returned 5 [0113.848] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0113.848] lstrlenW (lpString=".ppt") returned 4 [0113.848] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0113.848] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned 76 [0113.848] lstrlenW (lpString=".zip") returned 4 [0113.848] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0113.848] lstrlenW (lpString=".rar") returned 4 [0113.848] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0113.848] lstrlenW (lpString=".bz2") returned 4 [0113.848] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0113.848] lstrlenW (lpString=".7z") returned 3 [0113.848] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0113.848] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned 76 [0113.848] lstrlenW (lpString=".dbf") returned 4 [0113.848] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0113.848] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned 76 [0113.848] lstrlenW (lpString=".1cd") returned 4 [0113.848] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0113.848] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned 76 [0113.848] lstrlenW (lpString=".jpg") returned 4 [0113.848] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0113.848] lstrcmpiW (lpString1=".GIF", lpString2=".waifu") returned -1 [0113.848] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0113.848] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0113.848] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x342ff14 | out: lpFileSize=0x342ff14*=2552) returned 1 [0113.849] CloseHandle (hObject=0x1f0) returned 1 [0113.849] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\preview.gif")) returned 0x20 [0113.849] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\preview.gif.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0113.849] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0113.849] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0113.849] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0113.849] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\preview.gif.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0113.850] GetLastError () returned 0x0 [0113.850] ReadFile (in: hFile=0x1f0, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x9f8, lpOverlapped=0x0) returned 1 [0113.852] WriteFile (in: hFile=0x1c0, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0xa00, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0xa00, lpOverlapped=0x0) returned 1 [0113.853] ReadFile (in: hFile=0x1f0, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x0, lpOverlapped=0x0) returned 1 [0113.853] WriteFile (in: hFile=0x1c0, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0xea, lpOverlapped=0x0) returned 1 [0113.853] SetEndOfFile (hFile=0x1c0) returned 1 [0113.853] CloseHandle (hObject=0x1c0) returned 1 [0113.853] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0113.853] SetEndOfFile (hFile=0x1f0) returned 1 [0113.854] CloseHandle (hObject=0x1f0) returned 1 [0113.854] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0113.854] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\preview.gif")) returned 1 [0113.854] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71 [0113.854] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71 [0113.854] lstrlenW (lpString=".doc") returned 4 [0113.854] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0113.854] lstrlenW (lpString=".docx") returned 5 [0113.854] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0113.854] lstrlenW (lpString=".pdf") returned 4 [0113.854] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0113.854] lstrlenW (lpString=".xls") returned 4 [0113.855] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0113.855] lstrlenW (lpString=".xlsx") returned 5 [0113.855] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0113.855] lstrlenW (lpString=".ppt") returned 4 [0113.855] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0113.855] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71 [0113.855] lstrlenW (lpString=".zip") returned 4 [0113.855] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0113.855] lstrlenW (lpString=".rar") returned 4 [0113.855] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0113.855] lstrlenW (lpString=".bz2") returned 4 [0113.855] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0113.855] lstrlenW (lpString=".7z") returned 3 [0113.855] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0113.855] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71 [0113.855] lstrlenW (lpString=".dbf") returned 4 [0113.855] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0113.855] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71 [0113.855] lstrlenW (lpString=".1cd") returned 4 [0113.855] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0113.855] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71 [0113.855] lstrlenW (lpString=".jpg") returned 4 [0113.855] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0113.855] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71 [0113.855] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71 [0113.855] lstrlenW (lpString=".doc") returned 4 [0113.855] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0113.855] lstrlenW (lpString=".docx") returned 5 [0113.855] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0113.855] lstrlenW (lpString=".pdf") returned 4 [0113.855] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0113.855] lstrlenW (lpString=".xls") returned 4 [0113.855] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0113.855] lstrlenW (lpString=".xlsx") returned 5 [0113.855] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0113.855] lstrlenW (lpString=".ppt") returned 4 [0113.855] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0113.855] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71 [0113.855] lstrlenW (lpString=".zip") returned 4 [0113.855] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0113.855] lstrlenW (lpString=".rar") returned 4 [0113.855] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0113.855] lstrlenW (lpString=".bz2") returned 4 [0113.855] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0113.855] lstrlenW (lpString=".7z") returned 3 [0113.855] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0113.855] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71 [0113.855] lstrlenW (lpString=".dbf") returned 4 [0113.855] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0113.855] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71 [0113.855] lstrlenW (lpString=".1cd") returned 4 [0113.855] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0113.856] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71 [0113.856] lstrlenW (lpString=".jpg") returned 4 [0113.856] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0113.856] lstrcmpiW (lpString1=".PNG", lpString2=".waifu") returned -1 [0113.856] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0113.856] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0113.857] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x342ff14 | out: lpFileSize=0x342ff14*=18817) returned 1 [0113.857] CloseHandle (hObject=0x1f0) returned 1 [0113.857] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\thmbnail.png")) returned 0x20 [0113.857] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\thmbnail.png.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0113.857] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0113.857] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0113.857] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0113.857] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\thmbnail.png.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0113.858] GetLastError () returned 0x0 [0113.858] ReadFile (in: hFile=0x1f0, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x4981, lpOverlapped=0x0) returned 1 [0113.859] WriteFile (in: hFile=0x1c0, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0x4990, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0x4990, lpOverlapped=0x0) returned 1 [0113.860] ReadFile (in: hFile=0x1f0, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x0, lpOverlapped=0x0) returned 1 [0113.860] WriteFile (in: hFile=0x1c0, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0xec, lpOverlapped=0x0) returned 1 [0113.860] SetEndOfFile (hFile=0x1c0) returned 1 [0113.860] CloseHandle (hObject=0x1c0) returned 1 [0113.860] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0113.860] SetEndOfFile (hFile=0x1f0) returned 1 [0113.861] CloseHandle (hObject=0x1f0) returned 1 [0113.861] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0113.861] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\thmbnail.png")) returned 1 [0113.861] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72 [0113.861] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72 [0113.861] lstrlenW (lpString=".doc") returned 4 [0113.861] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0113.861] lstrlenW (lpString=".docx") returned 5 [0113.861] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0113.861] lstrlenW (lpString=".pdf") returned 4 [0113.861] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0113.861] lstrlenW (lpString=".xls") returned 4 [0113.861] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0113.861] lstrlenW (lpString=".xlsx") returned 5 [0113.861] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0113.861] lstrlenW (lpString=".ppt") returned 4 [0113.861] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0113.861] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72 [0113.861] lstrlenW (lpString=".zip") returned 4 [0113.861] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0113.861] lstrlenW (lpString=".rar") returned 4 [0113.861] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0113.861] lstrlenW (lpString=".bz2") returned 4 [0113.861] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0113.862] lstrlenW (lpString=".7z") returned 3 [0113.862] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0113.862] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72 [0113.862] lstrlenW (lpString=".dbf") returned 4 [0113.862] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0113.862] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72 [0113.862] lstrlenW (lpString=".1cd") returned 4 [0113.862] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0113.862] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72 [0113.862] lstrlenW (lpString=".jpg") returned 4 [0113.862] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0113.862] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72 [0113.862] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72 [0113.862] lstrlenW (lpString=".doc") returned 4 [0113.862] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0113.862] lstrlenW (lpString=".docx") returned 5 [0113.862] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0113.862] lstrlenW (lpString=".pdf") returned 4 [0113.862] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0113.862] lstrlenW (lpString=".xls") returned 4 [0113.862] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0113.862] lstrlenW (lpString=".xlsx") returned 5 [0113.862] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0113.862] lstrlenW (lpString=".ppt") returned 4 [0113.862] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0113.862] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72 [0113.862] lstrlenW (lpString=".zip") returned 4 [0113.862] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0113.862] lstrlenW (lpString=".rar") returned 4 [0113.862] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0113.862] lstrlenW (lpString=".bz2") returned 4 [0113.862] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0113.862] lstrlenW (lpString=".7z") returned 3 [0113.862] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0113.862] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72 [0113.862] lstrlenW (lpString=".dbf") returned 4 [0113.862] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0113.862] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72 [0113.862] lstrlenW (lpString=".1cd") returned 4 [0113.862] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0113.862] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72 [0113.862] lstrlenW (lpString=".jpg") returned 4 [0113.862] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0113.862] lstrcmpiW (lpString1=".GIF", lpString2=".waifu") returned -1 [0113.862] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0113.862] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0113.863] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x342ff14 | out: lpFileSize=0x342ff14*=5179) returned 1 [0113.863] CloseHandle (hObject=0x1f0) returned 1 [0113.863] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\preview.gif")) returned 0x20 [0113.863] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\preview.gif.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0113.863] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0113.863] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0113.863] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0113.863] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\preview.gif.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0113.864] GetLastError () returned 0x0 [0113.864] ReadFile (in: hFile=0x1f0, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x143b, lpOverlapped=0x0) returned 1 [0113.866] WriteFile (in: hFile=0x1d8, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0x1440, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0x1440, lpOverlapped=0x0) returned 1 [0113.867] ReadFile (in: hFile=0x1f0, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x0, lpOverlapped=0x0) returned 1 [0113.867] WriteFile (in: hFile=0x1d8, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0xea, lpOverlapped=0x0) returned 1 [0113.867] SetEndOfFile (hFile=0x1d8) returned 1 [0113.867] CloseHandle (hObject=0x1d8) returned 1 [0113.867] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0113.867] SetEndOfFile (hFile=0x1f0) returned 1 [0113.868] CloseHandle (hObject=0x1f0) returned 1 [0113.868] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0113.869] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\preview.gif")) returned 1 [0113.869] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74 [0113.869] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74 [0113.869] lstrlenW (lpString=".doc") returned 4 [0113.869] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0113.869] lstrlenW (lpString=".docx") returned 5 [0113.869] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0113.869] lstrlenW (lpString=".pdf") returned 4 [0113.869] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0113.869] lstrlenW (lpString=".xls") returned 4 [0113.869] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0113.869] lstrlenW (lpString=".xlsx") returned 5 [0113.869] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0113.869] lstrlenW (lpString=".ppt") returned 4 [0113.869] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0113.869] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74 [0113.869] lstrlenW (lpString=".zip") returned 4 [0113.869] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0113.869] lstrlenW (lpString=".rar") returned 4 [0113.869] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0113.869] lstrlenW (lpString=".bz2") returned 4 [0113.869] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0113.869] lstrlenW (lpString=".7z") returned 3 [0113.869] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0113.869] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74 [0113.869] lstrlenW (lpString=".dbf") returned 4 [0113.869] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0113.869] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74 [0113.869] lstrlenW (lpString=".1cd") returned 4 [0113.869] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0113.869] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74 [0113.869] lstrlenW (lpString=".jpg") returned 4 [0113.869] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0113.869] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74 [0113.869] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74 [0113.869] lstrlenW (lpString=".doc") returned 4 [0113.869] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0113.869] lstrlenW (lpString=".docx") returned 5 [0113.870] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0113.870] lstrlenW (lpString=".pdf") returned 4 [0113.870] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0113.870] lstrlenW (lpString=".xls") returned 4 [0113.870] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0113.870] lstrlenW (lpString=".xlsx") returned 5 [0113.870] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0113.870] lstrlenW (lpString=".ppt") returned 4 [0113.870] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0113.870] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74 [0113.870] lstrlenW (lpString=".zip") returned 4 [0113.870] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0113.870] lstrlenW (lpString=".rar") returned 4 [0113.870] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0113.870] lstrlenW (lpString=".bz2") returned 4 [0113.870] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0113.870] lstrlenW (lpString=".7z") returned 3 [0113.870] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0113.870] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74 [0113.870] lstrlenW (lpString=".dbf") returned 4 [0113.870] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0113.870] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74 [0113.870] lstrlenW (lpString=".1cd") returned 4 [0113.870] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0113.870] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74 [0113.870] lstrlenW (lpString=".jpg") returned 4 [0113.870] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0113.870] lstrcmpiW (lpString1=".PNG", lpString2=".waifu") returned -1 [0113.870] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0113.870] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0113.870] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x342ff14 | out: lpFileSize=0x342ff14*=33559) returned 1 [0113.870] CloseHandle (hObject=0x1f0) returned 1 [0113.871] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\thmbnail.png")) returned 0x20 [0113.871] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\thmbnail.png.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0113.871] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0113.871] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0113.871] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0113.871] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\thmbnail.png.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0113.871] GetLastError () returned 0x0 [0113.871] ReadFile (in: hFile=0x1f0, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x8317, lpOverlapped=0x0) returned 1 [0113.873] WriteFile (in: hFile=0x1d8, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0x8320, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0x8320, lpOverlapped=0x0) returned 1 [0113.874] ReadFile (in: hFile=0x1f0, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x0, lpOverlapped=0x0) returned 1 [0113.874] WriteFile (in: hFile=0x1d8, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0xec, lpOverlapped=0x0) returned 1 [0113.874] SetEndOfFile (hFile=0x1d8) returned 1 [0113.874] CloseHandle (hObject=0x1d8) returned 1 [0113.874] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0113.874] SetEndOfFile (hFile=0x1f0) returned 1 [0113.874] CloseHandle (hObject=0x1f0) returned 1 [0113.875] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0113.875] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\thmbnail.png")) returned 1 [0113.875] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG") returned 75 [0113.875] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG") returned 75 [0113.875] lstrlenW (lpString=".doc") returned 4 [0113.875] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0113.875] lstrlenW (lpString=".docx") returned 5 [0113.875] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0113.875] lstrlenW (lpString=".pdf") returned 4 [0113.875] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0113.875] lstrlenW (lpString=".xls") returned 4 [0113.875] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0113.875] lstrlenW (lpString=".xlsx") returned 5 [0113.875] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0113.875] lstrlenW (lpString=".ppt") returned 4 [0113.875] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0113.875] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG") returned 75 [0113.875] lstrlenW (lpString=".zip") returned 4 [0113.875] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0113.875] lstrlenW (lpString=".rar") returned 4 [0113.875] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0113.875] lstrlenW (lpString=".bz2") returned 4 [0113.875] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0113.875] lstrlenW (lpString=".7z") returned 3 [0113.875] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0113.875] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG") returned 75 [0113.875] lstrlenW (lpString=".dbf") returned 4 [0113.875] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0113.875] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG") returned 75 [0113.875] lstrlenW (lpString=".1cd") returned 4 [0113.875] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0113.875] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG") returned 75 [0113.875] lstrlenW (lpString=".jpg") returned 4 [0113.875] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0113.876] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG") returned 75 [0113.876] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG") returned 75 [0113.876] lstrlenW (lpString=".doc") returned 4 [0113.876] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0113.876] lstrlenW (lpString=".docx") returned 5 [0113.876] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0113.876] lstrlenW (lpString=".pdf") returned 4 [0113.876] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0113.876] lstrlenW (lpString=".xls") returned 4 [0113.876] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0113.876] lstrlenW (lpString=".xlsx") returned 5 [0113.876] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0113.876] lstrlenW (lpString=".ppt") returned 4 [0113.876] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0113.876] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG") returned 75 [0113.876] lstrlenW (lpString=".zip") returned 4 [0113.876] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0113.876] lstrlenW (lpString=".rar") returned 4 [0113.876] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0113.876] lstrlenW (lpString=".bz2") returned 4 [0113.876] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0113.876] lstrlenW (lpString=".7z") returned 3 [0113.876] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0113.876] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG") returned 75 [0113.876] lstrlenW (lpString=".dbf") returned 4 [0113.876] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0113.876] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG") returned 75 [0113.876] lstrlenW (lpString=".1cd") returned 4 [0113.876] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0113.876] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG") returned 75 [0113.876] lstrlenW (lpString=".jpg") returned 4 [0113.876] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0113.876] lstrcmpiW (lpString1=".GIF", lpString2=".waifu") returned -1 [0113.876] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0113.876] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0113.877] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x342ff14 | out: lpFileSize=0x342ff14*=2476) returned 1 [0113.877] CloseHandle (hObject=0x1f0) returned 1 [0113.877] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\preview.gif")) returned 0x20 [0113.877] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\preview.gif.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0113.877] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0113.877] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0113.877] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0113.877] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\preview.gif.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0114.083] GetLastError () returned 0x0 [0114.083] ReadFile (in: hFile=0x1f0, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x9ac, lpOverlapped=0x0) returned 1 [0114.084] WriteFile (in: hFile=0x1d8, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0x9b0, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0x9b0, lpOverlapped=0x0) returned 1 [0114.085] ReadFile (in: hFile=0x1f0, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x0, lpOverlapped=0x0) returned 1 [0114.085] WriteFile (in: hFile=0x1d8, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0xea, lpOverlapped=0x0) returned 1 [0114.085] SetEndOfFile (hFile=0x1d8) returned 1 [0114.085] CloseHandle (hObject=0x1d8) returned 1 [0114.085] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0114.085] SetEndOfFile (hFile=0x1f0) returned 1 [0114.312] CloseHandle (hObject=0x1f0) returned 1 [0114.312] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0114.312] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\preview.gif")) returned 1 [0114.312] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72 [0114.312] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72 [0114.312] lstrlenW (lpString=".doc") returned 4 [0114.312] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0114.312] lstrlenW (lpString=".docx") returned 5 [0114.312] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0114.312] lstrlenW (lpString=".pdf") returned 4 [0114.312] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0114.312] lstrlenW (lpString=".xls") returned 4 [0114.312] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0114.313] lstrlenW (lpString=".xlsx") returned 5 [0114.313] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0114.313] lstrlenW (lpString=".ppt") returned 4 [0114.313] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0114.313] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72 [0114.313] lstrlenW (lpString=".zip") returned 4 [0114.313] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0114.313] lstrlenW (lpString=".rar") returned 4 [0114.313] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0114.313] lstrlenW (lpString=".bz2") returned 4 [0114.313] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0114.313] lstrlenW (lpString=".7z") returned 3 [0114.313] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0114.313] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72 [0114.313] lstrlenW (lpString=".dbf") returned 4 [0114.313] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0114.313] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72 [0114.313] lstrlenW (lpString=".1cd") returned 4 [0114.313] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0114.313] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72 [0114.313] lstrlenW (lpString=".jpg") returned 4 [0114.313] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0114.313] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72 [0114.313] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72 [0114.313] lstrlenW (lpString=".doc") returned 4 [0114.313] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0114.313] lstrlenW (lpString=".docx") returned 5 [0114.313] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0114.313] lstrlenW (lpString=".pdf") returned 4 [0114.313] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0114.313] lstrlenW (lpString=".xls") returned 4 [0114.313] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0114.313] lstrlenW (lpString=".xlsx") returned 5 [0114.313] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0114.313] lstrlenW (lpString=".ppt") returned 4 [0114.313] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0114.313] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72 [0114.313] lstrlenW (lpString=".zip") returned 4 [0114.313] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0114.313] lstrlenW (lpString=".rar") returned 4 [0114.313] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0114.313] lstrlenW (lpString=".bz2") returned 4 [0114.313] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0114.313] lstrlenW (lpString=".7z") returned 3 [0114.313] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0114.313] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72 [0114.313] lstrlenW (lpString=".dbf") returned 4 [0114.313] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0114.313] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72 [0114.313] lstrlenW (lpString=".1cd") returned 4 [0114.314] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0114.314] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72 [0114.314] lstrlenW (lpString=".jpg") returned 4 [0114.314] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0114.314] lstrcmpiW (lpString1=".PNG", lpString2=".waifu") returned -1 [0114.314] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0114.314] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0114.491] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x342ff14 | out: lpFileSize=0x342ff14*=11573) returned 1 [0114.491] CloseHandle (hObject=0x1f0) returned 1 [0114.491] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\thmbnail.png")) returned 0x20 [0114.491] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\thmbnail.png.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0114.492] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0114.492] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0114.492] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0114.492] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\thmbnail.png.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0114.494] GetLastError () returned 0x0 [0114.494] ReadFile (in: hFile=0x1f0, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x2d35, lpOverlapped=0x0) returned 1 [0114.495] WriteFile (in: hFile=0x1f8, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0x2d40, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0x2d40, lpOverlapped=0x0) returned 1 [0114.514] ReadFile (in: hFile=0x1f0, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x0, lpOverlapped=0x0) returned 1 [0114.514] WriteFile (in: hFile=0x1f8, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0xec, lpOverlapped=0x0) returned 1 [0114.515] SetEndOfFile (hFile=0x1f8) returned 1 [0114.515] CloseHandle (hObject=0x1f8) returned 1 [0114.515] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0114.515] SetEndOfFile (hFile=0x1f0) returned 1 [0114.516] CloseHandle (hObject=0x1f0) returned 1 [0114.516] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0114.516] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\thmbnail.png")) returned 1 [0114.516] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76 [0114.516] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76 [0114.516] lstrlenW (lpString=".doc") returned 4 [0114.516] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0114.516] lstrlenW (lpString=".docx") returned 5 [0114.516] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0114.516] lstrlenW (lpString=".pdf") returned 4 [0114.516] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0114.516] lstrlenW (lpString=".xls") returned 4 [0114.516] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0114.516] lstrlenW (lpString=".xlsx") returned 5 [0114.517] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0114.517] lstrlenW (lpString=".ppt") returned 4 [0114.517] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0114.517] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76 [0114.517] lstrlenW (lpString=".zip") returned 4 [0114.517] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0114.517] lstrlenW (lpString=".rar") returned 4 [0114.517] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0114.517] lstrlenW (lpString=".bz2") returned 4 [0114.517] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0114.517] lstrlenW (lpString=".7z") returned 3 [0114.517] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0114.517] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76 [0114.517] lstrlenW (lpString=".dbf") returned 4 [0114.517] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0114.517] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76 [0114.517] lstrlenW (lpString=".1cd") returned 4 [0114.517] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0114.517] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76 [0114.517] lstrlenW (lpString=".jpg") returned 4 [0114.517] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0114.517] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76 [0114.517] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76 [0114.517] lstrlenW (lpString=".doc") returned 4 [0114.517] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0114.517] lstrlenW (lpString=".docx") returned 5 [0114.517] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0114.517] lstrlenW (lpString=".pdf") returned 4 [0114.517] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0114.517] lstrlenW (lpString=".xls") returned 4 [0114.517] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0114.517] lstrlenW (lpString=".xlsx") returned 5 [0114.518] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0114.518] lstrlenW (lpString=".ppt") returned 4 [0114.518] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0114.518] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76 [0114.518] lstrlenW (lpString=".zip") returned 4 [0114.518] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0114.518] lstrlenW (lpString=".rar") returned 4 [0114.518] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0114.518] lstrlenW (lpString=".bz2") returned 4 [0114.518] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0114.518] lstrlenW (lpString=".7z") returned 3 [0114.518] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0114.518] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76 [0114.518] lstrlenW (lpString=".dbf") returned 4 [0114.518] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0114.518] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76 [0114.518] lstrlenW (lpString=".1cd") returned 4 [0114.518] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0114.518] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76 [0114.518] lstrlenW (lpString=".jpg") returned 4 [0114.518] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0114.518] lstrcmpiW (lpString1=".PNG", lpString2=".waifu") returned -1 [0114.518] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0114.518] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0114.878] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x342ff14 | out: lpFileSize=0x342ff14*=47962) returned 1 [0114.878] CloseHandle (hObject=0x1c0) returned 1 [0114.878] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\thmbnail.png")) returned 0x20 [0114.878] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\thmbnail.png.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0114.878] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0114.878] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0114.878] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0114.878] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\thmbnail.png.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0114.879] GetLastError () returned 0x0 [0114.879] ReadFile (in: hFile=0x1c0, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0xbb5a, lpOverlapped=0x0) returned 1 [0114.881] WriteFile (in: hFile=0x1f0, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0xbb60, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0xbb60, lpOverlapped=0x0) returned 1 [0114.882] ReadFile (in: hFile=0x1c0, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x0, lpOverlapped=0x0) returned 1 [0114.882] WriteFile (in: hFile=0x1f0, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0xec, lpOverlapped=0x0) returned 1 [0114.882] SetEndOfFile (hFile=0x1f0) returned 1 [0114.882] CloseHandle (hObject=0x1f0) returned 1 [0114.882] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0114.882] SetEndOfFile (hFile=0x1c0) returned 1 [0114.883] CloseHandle (hObject=0x1c0) returned 1 [0114.883] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0114.883] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\thmbnail.png")) returned 1 [0114.883] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG") returned 76 [0114.883] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG") returned 76 [0114.883] lstrlenW (lpString=".doc") returned 4 [0114.883] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0114.883] lstrlenW (lpString=".docx") returned 5 [0114.883] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0114.883] lstrlenW (lpString=".pdf") returned 4 [0114.883] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0114.883] lstrlenW (lpString=".xls") returned 4 [0114.883] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0114.883] lstrlenW (lpString=".xlsx") returned 5 [0114.883] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0114.883] lstrlenW (lpString=".ppt") returned 4 [0114.883] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0114.883] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG") returned 76 [0114.883] lstrlenW (lpString=".zip") returned 4 [0114.883] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0114.884] lstrlenW (lpString=".rar") returned 4 [0114.884] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0114.884] lstrlenW (lpString=".bz2") returned 4 [0114.884] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0114.884] lstrlenW (lpString=".7z") returned 3 [0114.884] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0114.884] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG") returned 76 [0114.884] lstrlenW (lpString=".dbf") returned 4 [0114.884] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0114.884] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG") returned 76 [0114.884] lstrlenW (lpString=".1cd") returned 4 [0114.884] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0114.884] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG") returned 76 [0114.884] lstrlenW (lpString=".jpg") returned 4 [0114.884] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0114.884] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG") returned 76 [0114.884] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG") returned 76 [0114.884] lstrlenW (lpString=".doc") returned 4 [0114.884] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0114.884] lstrlenW (lpString=".docx") returned 5 [0114.884] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0114.884] lstrlenW (lpString=".pdf") returned 4 [0114.884] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0114.884] lstrlenW (lpString=".xls") returned 4 [0114.884] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0114.884] lstrlenW (lpString=".xlsx") returned 5 [0114.884] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0114.884] lstrlenW (lpString=".ppt") returned 4 [0114.884] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0114.884] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG") returned 76 [0114.884] lstrlenW (lpString=".zip") returned 4 [0114.884] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0114.884] lstrlenW (lpString=".rar") returned 4 [0114.884] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0114.884] lstrlenW (lpString=".bz2") returned 4 [0114.884] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0114.884] lstrlenW (lpString=".7z") returned 3 [0114.884] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0114.884] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG") returned 76 [0114.884] lstrlenW (lpString=".dbf") returned 4 [0114.884] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0114.884] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG") returned 76 [0114.884] lstrlenW (lpString=".1cd") returned 4 [0114.884] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0114.884] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG") returned 76 [0114.884] lstrlenW (lpString=".jpg") returned 4 [0114.884] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0114.885] lstrcmpiW (lpString1=".GIF", lpString2=".waifu") returned -1 [0114.885] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0114.885] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0114.885] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x342ff14 | out: lpFileSize=0x342ff14*=2527) returned 1 [0114.885] CloseHandle (hObject=0x1c0) returned 1 [0114.885] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\preview.gif")) returned 0x20 [0114.885] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\preview.gif.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0114.885] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0114.885] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0114.885] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0114.885] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\preview.gif.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0114.887] GetLastError () returned 0x0 [0114.887] ReadFile (in: hFile=0x1c0, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x9df, lpOverlapped=0x0) returned 1 [0114.890] WriteFile (in: hFile=0x1f0, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0x9e0, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0x9e0, lpOverlapped=0x0) returned 1 [0114.892] ReadFile (in: hFile=0x1c0, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x0, lpOverlapped=0x0) returned 1 [0114.892] WriteFile (in: hFile=0x1f0, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0xea, lpOverlapped=0x0) returned 1 [0114.892] SetEndOfFile (hFile=0x1f0) returned 1 [0114.892] CloseHandle (hObject=0x1f0) returned 1 [0114.892] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0114.892] SetEndOfFile (hFile=0x1c0) returned 1 [0114.892] CloseHandle (hObject=0x1c0) returned 1 [0114.892] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0114.893] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\preview.gif")) returned 1 [0114.893] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF") returned 74 [0114.893] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF") returned 74 [0114.893] lstrlenW (lpString=".doc") returned 4 [0114.893] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0114.893] lstrlenW (lpString=".docx") returned 5 [0114.893] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0114.893] lstrlenW (lpString=".pdf") returned 4 [0114.893] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0114.893] lstrlenW (lpString=".xls") returned 4 [0114.893] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0114.893] lstrlenW (lpString=".xlsx") returned 5 [0114.893] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0114.893] lstrlenW (lpString=".ppt") returned 4 [0114.893] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0114.893] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF") returned 74 [0114.893] lstrlenW (lpString=".zip") returned 4 [0114.893] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0114.893] lstrlenW (lpString=".rar") returned 4 [0114.893] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0114.893] lstrlenW (lpString=".bz2") returned 4 [0114.893] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0114.893] lstrlenW (lpString=".7z") returned 3 [0114.893] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0114.893] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF") returned 74 [0114.893] lstrlenW (lpString=".dbf") returned 4 [0114.893] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0114.893] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF") returned 74 [0114.893] lstrlenW (lpString=".1cd") returned 4 [0114.893] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0114.893] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF") returned 74 [0114.893] lstrlenW (lpString=".jpg") returned 4 [0114.893] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0114.893] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF") returned 74 [0114.893] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF") returned 74 [0114.894] lstrlenW (lpString=".doc") returned 4 [0114.894] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0114.894] lstrlenW (lpString=".docx") returned 5 [0114.894] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0114.894] lstrlenW (lpString=".pdf") returned 4 [0114.894] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0114.894] lstrlenW (lpString=".xls") returned 4 [0114.894] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0114.894] lstrlenW (lpString=".xlsx") returned 5 [0114.894] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0114.894] lstrlenW (lpString=".ppt") returned 4 [0114.894] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0114.894] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF") returned 74 [0114.894] lstrlenW (lpString=".zip") returned 4 [0114.894] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0114.894] lstrlenW (lpString=".rar") returned 4 [0114.894] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0114.894] lstrlenW (lpString=".bz2") returned 4 [0114.894] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0114.894] lstrlenW (lpString=".7z") returned 3 [0114.894] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0114.894] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF") returned 74 [0114.894] lstrlenW (lpString=".dbf") returned 4 [0114.894] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0114.894] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF") returned 74 [0114.894] lstrlenW (lpString=".1cd") returned 4 [0114.894] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0114.894] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF") returned 74 [0114.894] lstrlenW (lpString=".jpg") returned 4 [0114.894] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0114.894] lstrcmpiW (lpString1=".PNG", lpString2=".waifu") returned -1 [0114.894] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0114.894] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0114.895] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x342ff14 | out: lpFileSize=0x342ff14*=19525) returned 1 [0114.895] CloseHandle (hObject=0x1c0) returned 1 [0114.895] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\thmbnail.png")) returned 0x20 [0114.895] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\thmbnail.png.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0114.895] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0114.895] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0114.895] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0114.895] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\thmbnail.png.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0114.896] GetLastError () returned 0x0 [0114.896] ReadFile (in: hFile=0x1c0, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x4c45, lpOverlapped=0x0) returned 1 [0114.897] WriteFile (in: hFile=0x1f0, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0x4c50, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0x4c50, lpOverlapped=0x0) returned 1 [0114.899] ReadFile (in: hFile=0x1c0, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x0, lpOverlapped=0x0) returned 1 [0114.899] WriteFile (in: hFile=0x1f0, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0xec, lpOverlapped=0x0) returned 1 [0114.899] SetEndOfFile (hFile=0x1f0) returned 1 [0114.899] CloseHandle (hObject=0x1f0) returned 1 [0114.899] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0114.899] SetEndOfFile (hFile=0x1c0) returned 1 [0114.900] CloseHandle (hObject=0x1c0) returned 1 [0114.900] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0114.900] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\thmbnail.png")) returned 1 [0114.900] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG") returned 75 [0114.900] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG") returned 75 [0114.900] lstrlenW (lpString=".doc") returned 4 [0114.900] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0114.900] lstrlenW (lpString=".docx") returned 5 [0114.900] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0114.900] lstrlenW (lpString=".pdf") returned 4 [0114.900] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0114.900] lstrlenW (lpString=".xls") returned 4 [0114.900] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0114.900] lstrlenW (lpString=".xlsx") returned 5 [0114.900] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0114.900] lstrlenW (lpString=".ppt") returned 4 [0114.900] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0114.901] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG") returned 75 [0114.901] lstrlenW (lpString=".zip") returned 4 [0114.901] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0114.901] lstrlenW (lpString=".rar") returned 4 [0114.901] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0114.901] lstrlenW (lpString=".bz2") returned 4 [0114.901] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0114.901] lstrlenW (lpString=".7z") returned 3 [0114.901] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0114.901] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG") returned 75 [0114.901] lstrlenW (lpString=".dbf") returned 4 [0114.901] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0114.901] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG") returned 75 [0114.901] lstrlenW (lpString=".1cd") returned 4 [0114.901] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0114.901] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG") returned 75 [0114.901] lstrlenW (lpString=".jpg") returned 4 [0114.901] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0114.901] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG") returned 75 [0114.901] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG") returned 75 [0114.901] lstrlenW (lpString=".doc") returned 4 [0114.901] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0114.901] lstrlenW (lpString=".docx") returned 5 [0114.901] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0114.901] lstrlenW (lpString=".pdf") returned 4 [0114.901] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0114.901] lstrlenW (lpString=".xls") returned 4 [0114.901] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0114.901] lstrlenW (lpString=".xlsx") returned 5 [0114.901] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0114.901] lstrlenW (lpString=".ppt") returned 4 [0114.901] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0114.901] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG") returned 75 [0114.901] lstrlenW (lpString=".zip") returned 4 [0114.901] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0114.901] lstrlenW (lpString=".rar") returned 4 [0114.901] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0114.901] lstrlenW (lpString=".bz2") returned 4 [0114.901] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0114.901] lstrlenW (lpString=".7z") returned 3 [0114.901] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0114.901] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG") returned 75 [0114.901] lstrlenW (lpString=".dbf") returned 4 [0114.901] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0114.901] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG") returned 75 [0114.901] lstrlenW (lpString=".1cd") returned 4 [0114.901] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0114.901] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG") returned 75 [0114.901] lstrlenW (lpString=".jpg") returned 4 [0114.901] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0114.902] lstrcmpiW (lpString1=".GIF", lpString2=".waifu") returned -1 [0114.902] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0114.902] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0114.902] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x342ff14 | out: lpFileSize=0x342ff14*=1737) returned 1 [0114.902] CloseHandle (hObject=0x1c0) returned 1 [0114.902] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\preview.gif")) returned 0x20 [0114.902] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\preview.gif.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0114.902] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0114.902] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0114.902] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0114.902] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\preview.gif.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0114.904] GetLastError () returned 0x0 [0114.904] ReadFile (in: hFile=0x1c0, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x6c9, lpOverlapped=0x0) returned 1 [0114.904] WriteFile (in: hFile=0x208, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0x6d0, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0x6d0, lpOverlapped=0x0) returned 1 [0114.905] ReadFile (in: hFile=0x1c0, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x0, lpOverlapped=0x0) returned 1 [0114.905] WriteFile (in: hFile=0x208, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0xea, lpOverlapped=0x0) returned 1 [0114.905] SetEndOfFile (hFile=0x208) returned 1 [0114.905] CloseHandle (hObject=0x208) returned 1 [0114.905] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0114.905] SetEndOfFile (hFile=0x1c0) returned 1 [0114.906] CloseHandle (hObject=0x1c0) returned 1 [0114.906] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0114.906] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\preview.gif")) returned 1 [0114.906] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF") returned 76 [0114.906] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF") returned 76 [0114.906] lstrlenW (lpString=".doc") returned 4 [0114.906] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0114.907] lstrlenW (lpString=".docx") returned 5 [0114.907] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0114.907] lstrlenW (lpString=".pdf") returned 4 [0114.907] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0114.907] lstrlenW (lpString=".xls") returned 4 [0114.907] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0114.907] lstrlenW (lpString=".xlsx") returned 5 [0114.907] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0114.907] lstrlenW (lpString=".ppt") returned 4 [0114.907] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0114.907] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF") returned 76 [0114.907] lstrlenW (lpString=".zip") returned 4 [0114.907] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0114.907] lstrlenW (lpString=".rar") returned 4 [0114.907] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0114.907] lstrlenW (lpString=".bz2") returned 4 [0114.907] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0114.907] lstrlenW (lpString=".7z") returned 3 [0114.907] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0114.907] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF") returned 76 [0114.907] lstrlenW (lpString=".dbf") returned 4 [0114.907] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0114.907] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF") returned 76 [0114.907] lstrlenW (lpString=".1cd") returned 4 [0114.907] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0114.907] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF") returned 76 [0114.907] lstrlenW (lpString=".jpg") returned 4 [0114.907] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0114.907] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF") returned 76 [0114.907] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF") returned 76 [0114.907] lstrlenW (lpString=".doc") returned 4 [0114.907] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0114.907] lstrlenW (lpString=".docx") returned 5 [0114.907] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0114.907] lstrlenW (lpString=".pdf") returned 4 [0114.907] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0114.907] lstrlenW (lpString=".xls") returned 4 [0114.907] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0114.907] lstrlenW (lpString=".xlsx") returned 5 [0114.907] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0114.907] lstrlenW (lpString=".ppt") returned 4 [0114.907] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0114.907] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF") returned 76 [0114.907] lstrlenW (lpString=".zip") returned 4 [0114.907] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0114.907] lstrlenW (lpString=".rar") returned 4 [0114.907] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0114.907] lstrlenW (lpString=".bz2") returned 4 [0114.907] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0114.907] lstrlenW (lpString=".7z") returned 3 [0114.908] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0114.908] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF") returned 76 [0114.908] lstrlenW (lpString=".dbf") returned 4 [0114.908] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0114.908] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF") returned 76 [0114.908] lstrlenW (lpString=".1cd") returned 4 [0114.908] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0114.908] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF") returned 76 [0114.908] lstrlenW (lpString=".jpg") returned 4 [0114.908] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0114.908] lstrcmpiW (lpString1=".PNG", lpString2=".waifu") returned -1 [0114.908] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0114.908] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0114.908] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x342ff14 | out: lpFileSize=0x342ff14*=33479) returned 1 [0114.908] CloseHandle (hObject=0x1c0) returned 1 [0114.908] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\thmbnail.png")) returned 0x20 [0114.908] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\thmbnail.png.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0114.908] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0114.908] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0114.909] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0114.909] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\thmbnail.png.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0114.909] GetLastError () returned 0x0 [0114.909] ReadFile (in: hFile=0x1c0, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x82c7, lpOverlapped=0x0) returned 1 [0114.910] WriteFile (in: hFile=0x208, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0x82d0, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0x82d0, lpOverlapped=0x0) returned 1 [0114.911] ReadFile (in: hFile=0x1c0, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x0, lpOverlapped=0x0) returned 1 [0114.911] WriteFile (in: hFile=0x208, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0xec, lpOverlapped=0x0) returned 1 [0114.911] SetEndOfFile (hFile=0x208) returned 1 [0114.911] CloseHandle (hObject=0x208) returned 1 [0114.911] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0114.912] SetEndOfFile (hFile=0x1c0) returned 1 [0114.912] CloseHandle (hObject=0x1c0) returned 1 [0114.912] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0114.912] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\thmbnail.png")) returned 1 [0114.913] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG") returned 77 [0114.913] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG") returned 77 [0114.913] lstrlenW (lpString=".doc") returned 4 [0114.913] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0114.913] lstrlenW (lpString=".docx") returned 5 [0114.913] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0114.913] lstrlenW (lpString=".pdf") returned 4 [0114.913] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0114.913] lstrlenW (lpString=".xls") returned 4 [0114.913] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0114.913] lstrlenW (lpString=".xlsx") returned 5 [0114.913] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0114.913] lstrlenW (lpString=".ppt") returned 4 [0114.913] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0114.913] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG") returned 77 [0114.913] lstrlenW (lpString=".zip") returned 4 [0114.913] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0114.913] lstrlenW (lpString=".rar") returned 4 [0114.913] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0114.913] lstrlenW (lpString=".bz2") returned 4 [0114.913] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0114.913] lstrlenW (lpString=".7z") returned 3 [0114.913] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0114.913] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG") returned 77 [0114.913] lstrlenW (lpString=".dbf") returned 4 [0114.913] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0114.913] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG") returned 77 [0114.913] lstrlenW (lpString=".1cd") returned 4 [0114.913] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0114.913] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG") returned 77 [0114.913] lstrlenW (lpString=".jpg") returned 4 [0114.913] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0114.913] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG") returned 77 [0114.913] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG") returned 77 [0114.913] lstrlenW (lpString=".doc") returned 4 [0114.913] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0114.913] lstrlenW (lpString=".docx") returned 5 [0114.913] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0114.913] lstrlenW (lpString=".pdf") returned 4 [0114.913] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0114.913] lstrlenW (lpString=".xls") returned 4 [0114.913] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0114.913] lstrlenW (lpString=".xlsx") returned 5 [0114.913] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0114.913] lstrlenW (lpString=".ppt") returned 4 [0114.913] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0114.913] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG") returned 77 [0114.914] lstrlenW (lpString=".zip") returned 4 [0114.914] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0114.914] lstrlenW (lpString=".rar") returned 4 [0114.914] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0114.914] lstrlenW (lpString=".bz2") returned 4 [0114.914] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0114.914] lstrlenW (lpString=".7z") returned 3 [0114.914] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0114.914] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG") returned 77 [0114.914] lstrlenW (lpString=".dbf") returned 4 [0114.914] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0114.914] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG") returned 77 [0114.914] lstrlenW (lpString=".1cd") returned 4 [0114.914] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0114.914] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG") returned 77 [0114.914] lstrlenW (lpString=".jpg") returned 4 [0114.914] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0114.914] lstrcmpiW (lpString1=".GIF", lpString2=".waifu") returned -1 [0114.914] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0114.914] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0114.914] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x342ff14 | out: lpFileSize=0x342ff14*=1675) returned 1 [0114.914] CloseHandle (hObject=0x1c0) returned 1 [0114.914] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\preview.gif")) returned 0x20 [0114.914] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\preview.gif.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0114.915] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0114.915] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0114.915] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0114.915] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\preview.gif.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0115.185] GetLastError () returned 0x0 [0115.185] ReadFile (in: hFile=0x1c0, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x68b, lpOverlapped=0x0) returned 1 [0115.187] WriteFile (in: hFile=0x20c, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0x690, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0x690, lpOverlapped=0x0) returned 1 [0115.188] ReadFile (in: hFile=0x1c0, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x0, lpOverlapped=0x0) returned 1 [0115.188] WriteFile (in: hFile=0x20c, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0xea, lpOverlapped=0x0) returned 1 [0115.188] SetEndOfFile (hFile=0x20c) returned 1 [0115.188] CloseHandle (hObject=0x20c) returned 1 [0115.188] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0115.188] SetEndOfFile (hFile=0x1c0) returned 1 [0115.188] CloseHandle (hObject=0x1c0) returned 1 [0115.189] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0115.189] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\preview.gif")) returned 1 [0115.189] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF") returned 74 [0115.189] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF") returned 74 [0115.189] lstrlenW (lpString=".doc") returned 4 [0115.189] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0115.189] lstrlenW (lpString=".docx") returned 5 [0115.189] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0115.189] lstrlenW (lpString=".pdf") returned 4 [0115.189] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0115.189] lstrlenW (lpString=".xls") returned 4 [0115.189] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0115.189] lstrlenW (lpString=".xlsx") returned 5 [0115.189] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0115.189] lstrlenW (lpString=".ppt") returned 4 [0115.189] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0115.189] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF") returned 74 [0115.189] lstrlenW (lpString=".zip") returned 4 [0115.189] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0115.189] lstrlenW (lpString=".rar") returned 4 [0115.189] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0115.189] lstrlenW (lpString=".bz2") returned 4 [0115.189] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0115.189] lstrlenW (lpString=".7z") returned 3 [0115.189] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0115.189] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF") returned 74 [0115.189] lstrlenW (lpString=".dbf") returned 4 [0115.189] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0115.189] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF") returned 74 [0115.189] lstrlenW (lpString=".1cd") returned 4 [0115.189] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0115.189] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF") returned 74 [0115.190] lstrlenW (lpString=".jpg") returned 4 [0115.190] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0115.190] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF") returned 74 [0115.190] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF") returned 74 [0115.190] lstrlenW (lpString=".doc") returned 4 [0115.190] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0115.190] lstrlenW (lpString=".docx") returned 5 [0115.190] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0115.190] lstrlenW (lpString=".pdf") returned 4 [0115.190] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0115.190] lstrlenW (lpString=".xls") returned 4 [0115.190] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0115.190] lstrlenW (lpString=".xlsx") returned 5 [0115.190] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0115.190] lstrlenW (lpString=".ppt") returned 4 [0115.190] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0115.190] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF") returned 74 [0115.190] lstrlenW (lpString=".zip") returned 4 [0115.190] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0115.190] lstrlenW (lpString=".rar") returned 4 [0115.190] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0115.190] lstrlenW (lpString=".bz2") returned 4 [0115.190] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0115.190] lstrlenW (lpString=".7z") returned 3 [0115.190] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0115.190] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF") returned 74 [0115.190] lstrlenW (lpString=".dbf") returned 4 [0115.190] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0115.190] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF") returned 74 [0115.190] lstrlenW (lpString=".1cd") returned 4 [0115.190] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0115.190] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF") returned 74 [0115.190] lstrlenW (lpString=".jpg") returned 4 [0115.190] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0115.190] lstrcmpiW (lpString1=".GIF", lpString2=".waifu") returned -1 [0115.190] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0115.190] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0115.192] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x342ff14 | out: lpFileSize=0x342ff14*=1571) returned 1 [0115.192] CloseHandle (hObject=0x1c0) returned 1 [0115.192] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\preview.gif")) returned 0x20 [0115.192] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\preview.gif.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0115.192] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0115.192] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0115.192] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0115.192] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\preview.gif.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0115.193] GetLastError () returned 0x0 [0115.193] ReadFile (in: hFile=0x1c0, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x623, lpOverlapped=0x0) returned 1 [0115.194] WriteFile (in: hFile=0x20c, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0x630, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0x630, lpOverlapped=0x0) returned 1 [0115.195] ReadFile (in: hFile=0x1c0, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x0, lpOverlapped=0x0) returned 1 [0115.195] WriteFile (in: hFile=0x20c, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0xea, lpOverlapped=0x0) returned 1 [0115.195] SetEndOfFile (hFile=0x20c) returned 1 [0115.195] CloseHandle (hObject=0x20c) returned 1 [0115.195] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0115.195] SetEndOfFile (hFile=0x1c0) returned 1 [0115.196] CloseHandle (hObject=0x1c0) returned 1 [0115.196] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0115.196] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\preview.gif")) returned 1 [0115.196] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF") returned 76 [0115.196] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF") returned 76 [0115.196] lstrlenW (lpString=".doc") returned 4 [0115.196] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0115.196] lstrlenW (lpString=".docx") returned 5 [0115.196] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0115.196] lstrlenW (lpString=".pdf") returned 4 [0115.196] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0115.196] lstrlenW (lpString=".xls") returned 4 [0115.196] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0115.197] lstrlenW (lpString=".xlsx") returned 5 [0115.197] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0115.197] lstrlenW (lpString=".ppt") returned 4 [0115.197] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0115.197] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF") returned 76 [0115.197] lstrlenW (lpString=".zip") returned 4 [0115.197] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0115.197] lstrlenW (lpString=".rar") returned 4 [0115.197] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0115.197] lstrlenW (lpString=".bz2") returned 4 [0115.197] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0115.197] lstrlenW (lpString=".7z") returned 3 [0115.197] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0115.197] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF") returned 76 [0115.197] lstrlenW (lpString=".dbf") returned 4 [0115.197] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0115.197] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF") returned 76 [0115.197] lstrlenW (lpString=".1cd") returned 4 [0115.197] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0115.197] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF") returned 76 [0115.197] lstrlenW (lpString=".jpg") returned 4 [0115.197] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0115.197] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF") returned 76 [0115.197] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF") returned 76 [0115.197] lstrlenW (lpString=".doc") returned 4 [0115.197] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0115.197] lstrlenW (lpString=".docx") returned 5 [0115.197] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0115.197] lstrlenW (lpString=".pdf") returned 4 [0115.197] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0115.197] lstrlenW (lpString=".xls") returned 4 [0115.197] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0115.197] lstrlenW (lpString=".xlsx") returned 5 [0115.197] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0115.197] lstrlenW (lpString=".ppt") returned 4 [0115.197] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0115.197] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF") returned 76 [0115.197] lstrlenW (lpString=".zip") returned 4 [0115.197] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0115.197] lstrlenW (lpString=".rar") returned 4 [0115.197] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0115.197] lstrlenW (lpString=".bz2") returned 4 [0115.197] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0115.197] lstrlenW (lpString=".7z") returned 3 [0115.197] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0115.197] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF") returned 76 [0115.197] lstrlenW (lpString=".dbf") returned 4 [0115.197] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0115.197] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF") returned 76 [0115.197] lstrlenW (lpString=".1cd") returned 4 [0115.198] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0115.198] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF") returned 76 [0115.198] lstrlenW (lpString=".jpg") returned 4 [0115.198] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0115.198] lstrcmpiW (lpString1=".PNG", lpString2=".waifu") returned -1 [0115.198] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0115.198] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0115.198] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x342ff14 | out: lpFileSize=0x342ff14*=30170) returned 1 [0115.198] CloseHandle (hObject=0x1c0) returned 1 [0115.199] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\thmbnail.png")) returned 0x20 [0115.199] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\thmbnail.png.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0115.199] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0115.199] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0115.199] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0115.199] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\thmbnail.png.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0115.199] GetLastError () returned 0x0 [0115.199] ReadFile (in: hFile=0x1c0, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x75da, lpOverlapped=0x0) returned 1 [0115.200] WriteFile (in: hFile=0x20c, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0x75e0, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0x75e0, lpOverlapped=0x0) returned 1 [0115.201] ReadFile (in: hFile=0x1c0, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x0, lpOverlapped=0x0) returned 1 [0115.201] WriteFile (in: hFile=0x20c, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0xec, lpOverlapped=0x0) returned 1 [0115.201] SetEndOfFile (hFile=0x20c) returned 1 [0115.201] CloseHandle (hObject=0x20c) returned 1 [0115.202] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0115.202] SetEndOfFile (hFile=0x1c0) returned 1 [0115.202] CloseHandle (hObject=0x1c0) returned 1 [0115.202] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0115.202] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\thmbnail.png")) returned 1 [0115.205] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG") returned 77 [0115.205] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG") returned 77 [0115.205] lstrlenW (lpString=".doc") returned 4 [0115.205] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0115.205] lstrlenW (lpString=".docx") returned 5 [0115.205] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0115.205] lstrlenW (lpString=".pdf") returned 4 [0115.205] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0115.205] lstrlenW (lpString=".xls") returned 4 [0115.205] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0115.205] lstrlenW (lpString=".xlsx") returned 5 [0115.205] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0115.205] lstrlenW (lpString=".ppt") returned 4 [0115.205] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0115.205] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG") returned 77 [0115.205] lstrlenW (lpString=".zip") returned 4 [0115.205] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0115.205] lstrlenW (lpString=".rar") returned 4 [0115.205] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0115.205] lstrlenW (lpString=".bz2") returned 4 [0115.205] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0115.205] lstrlenW (lpString=".7z") returned 3 [0115.205] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0115.205] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG") returned 77 [0115.205] lstrlenW (lpString=".dbf") returned 4 [0115.205] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0115.205] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG") returned 77 [0115.205] lstrlenW (lpString=".1cd") returned 4 [0115.205] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0115.205] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG") returned 77 [0115.205] lstrlenW (lpString=".jpg") returned 4 [0115.205] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0115.205] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG") returned 77 [0115.205] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG") returned 77 [0115.205] lstrlenW (lpString=".doc") returned 4 [0115.206] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0115.206] lstrlenW (lpString=".docx") returned 5 [0115.206] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0115.206] lstrlenW (lpString=".pdf") returned 4 [0115.206] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0115.206] lstrlenW (lpString=".xls") returned 4 [0115.206] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0115.206] lstrlenW (lpString=".xlsx") returned 5 [0115.206] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0115.206] lstrlenW (lpString=".ppt") returned 4 [0115.206] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0115.206] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG") returned 77 [0115.206] lstrlenW (lpString=".zip") returned 4 [0115.206] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0115.206] lstrlenW (lpString=".rar") returned 4 [0115.206] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0115.206] lstrlenW (lpString=".bz2") returned 4 [0115.206] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0115.206] lstrlenW (lpString=".7z") returned 3 [0115.206] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0115.206] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG") returned 77 [0115.206] lstrlenW (lpString=".dbf") returned 4 [0115.206] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0115.206] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG") returned 77 [0115.206] lstrlenW (lpString=".1cd") returned 4 [0115.206] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0115.206] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG") returned 77 [0115.206] lstrlenW (lpString=".jpg") returned 4 [0115.206] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0115.206] lstrcmpiW (lpString1=".CHM", lpString2=".waifu") returned -1 [0115.206] lstrlenW (lpString="FM20.CHM") returned 8 [0115.206] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\fm20.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0115.207] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x342ff14 | out: lpFileSize=0x342ff14*=334427) returned 1 [0115.207] CloseHandle (hObject=0x1c0) returned 1 [0115.207] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\fm20.chm")) returned 0x20 [0115.207] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\fm20.chm.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0115.207] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\fm20.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0115.207] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0115.207] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0115.207] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\fm20.chm.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0115.208] GetLastError () returned 0x0 [0115.208] ReadFile (in: hFile=0x1c0, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x51a5b, lpOverlapped=0x0) returned 1 [0115.216] WriteFile (in: hFile=0x20c, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0x51a60, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0x51a60, lpOverlapped=0x0) returned 1 [0115.220] ReadFile (in: hFile=0x1c0, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x0, lpOverlapped=0x0) returned 1 [0115.220] WriteFile (in: hFile=0x20c, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0xe4, lpOverlapped=0x0) returned 1 [0115.220] SetEndOfFile (hFile=0x20c) returned 1 [0115.220] CloseHandle (hObject=0x20c) returned 1 [0115.220] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0115.220] SetEndOfFile (hFile=0x1c0) returned 1 [0115.222] CloseHandle (hObject=0x1c0) returned 1 [0115.222] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0115.222] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\fm20.chm")) returned 1 [0115.222] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM") returned 69 [0115.223] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM") returned 69 [0115.223] lstrlenW (lpString=".doc") returned 4 [0115.223] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0115.223] lstrlenW (lpString=".docx") returned 5 [0115.223] lstrcmpiW (lpString1=".docx", lpString2="0.CHM") returned -1 [0115.223] lstrlenW (lpString=".pdf") returned 4 [0115.223] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0115.223] lstrlenW (lpString=".xls") returned 4 [0115.223] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0115.223] lstrlenW (lpString=".xlsx") returned 5 [0115.223] lstrcmpiW (lpString1=".xlsx", lpString2="0.CHM") returned -1 [0115.223] lstrlenW (lpString=".ppt") returned 4 [0115.223] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0115.223] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM") returned 69 [0115.223] lstrlenW (lpString=".zip") returned 4 [0115.223] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0115.223] lstrlenW (lpString=".rar") returned 4 [0115.223] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0115.223] lstrlenW (lpString=".bz2") returned 4 [0115.223] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0115.223] lstrlenW (lpString=".7z") returned 3 [0115.223] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0115.223] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM") returned 69 [0115.223] lstrlenW (lpString=".dbf") returned 4 [0115.223] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0115.223] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM") returned 69 [0115.223] lstrlenW (lpString=".1cd") returned 4 [0115.223] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0115.223] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM") returned 69 [0115.223] lstrlenW (lpString=".jpg") returned 4 [0115.223] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0115.223] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM") returned 69 [0115.223] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM") returned 69 [0115.223] lstrlenW (lpString=".doc") returned 4 [0115.223] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0115.223] lstrlenW (lpString=".docx") returned 5 [0115.224] lstrcmpiW (lpString1=".docx", lpString2="0.CHM") returned -1 [0115.224] lstrlenW (lpString=".pdf") returned 4 [0115.224] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0115.224] lstrlenW (lpString=".xls") returned 4 [0115.224] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0115.224] lstrlenW (lpString=".xlsx") returned 5 [0115.224] lstrcmpiW (lpString1=".xlsx", lpString2="0.CHM") returned -1 [0115.224] lstrlenW (lpString=".ppt") returned 4 [0115.224] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0115.224] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM") returned 69 [0115.224] lstrlenW (lpString=".zip") returned 4 [0115.224] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0115.224] lstrlenW (lpString=".rar") returned 4 [0115.224] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0115.224] lstrlenW (lpString=".bz2") returned 4 [0115.224] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0115.224] lstrlenW (lpString=".7z") returned 3 [0115.224] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0115.224] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM") returned 69 [0115.224] lstrlenW (lpString=".dbf") returned 4 [0115.224] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0115.224] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM") returned 69 [0115.224] lstrlenW (lpString=".1cd") returned 4 [0115.224] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0115.224] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM") returned 69 [0115.224] lstrlenW (lpString=".jpg") returned 4 [0115.224] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0115.406] lstrcmpiW (lpString1=".png", lpString2=".waifu") returned -1 [0115.406] lstrlenW (lpString="16to9Squareframe_SelectionSubpicture.png") returned 40 [0115.406] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0115.737] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x342ff14 | out: lpFileSize=0x342ff14*=3286) returned 1 [0115.738] CloseHandle (hObject=0x1fc) returned 1 [0115.738] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_selectionsubpicture.png")) returned 0x20 [0115.738] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_selectionsubpicture.png.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0115.738] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0115.738] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png") returned 84 [0115.738] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png") returned 84 [0115.738] lstrlenW (lpString=".doc") returned 4 [0115.738] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0115.738] lstrlenW (lpString=".docx") returned 5 [0115.738] lstrcmpiW (lpString1=".docx", lpString2="e.png") returned -1 [0115.738] lstrlenW (lpString=".pdf") returned 4 [0115.738] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0115.738] lstrlenW (lpString=".xls") returned 4 [0115.738] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0115.738] lstrlenW (lpString=".xlsx") returned 5 [0115.738] lstrcmpiW (lpString1=".xlsx", lpString2="e.png") returned -1 [0115.738] lstrlenW (lpString=".ppt") returned 4 [0115.738] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0115.738] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png") returned 84 [0115.738] lstrlenW (lpString=".zip") returned 4 [0115.738] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0115.738] lstrlenW (lpString=".rar") returned 4 [0115.738] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0115.738] lstrlenW (lpString=".bz2") returned 4 [0115.738] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0115.738] lstrlenW (lpString=".7z") returned 3 [0115.738] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0115.738] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png") returned 84 [0115.738] lstrlenW (lpString=".dbf") returned 4 [0115.738] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0115.738] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png") returned 84 [0115.738] lstrlenW (lpString=".1cd") returned 4 [0115.738] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0115.738] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png") returned 84 [0115.738] lstrlenW (lpString=".jpg") returned 4 [0115.738] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0115.738] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png") returned 84 [0115.738] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png") returned 84 [0115.738] lstrlenW (lpString=".doc") returned 4 [0115.738] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0115.739] lstrlenW (lpString=".docx") returned 5 [0115.739] lstrcmpiW (lpString1=".docx", lpString2="e.png") returned -1 [0115.739] lstrlenW (lpString=".pdf") returned 4 [0115.739] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0115.739] lstrlenW (lpString=".xls") returned 4 [0115.739] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0115.739] lstrlenW (lpString=".xlsx") returned 5 [0115.739] lstrcmpiW (lpString1=".xlsx", lpString2="e.png") returned -1 [0115.739] lstrlenW (lpString=".ppt") returned 4 [0115.739] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0115.739] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png") returned 84 [0115.739] lstrlenW (lpString=".zip") returned 4 [0115.739] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0115.739] lstrlenW (lpString=".rar") returned 4 [0115.739] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0115.739] lstrlenW (lpString=".bz2") returned 4 [0115.739] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0115.739] lstrlenW (lpString=".7z") returned 3 [0115.739] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0115.739] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png") returned 84 [0115.739] lstrlenW (lpString=".dbf") returned 4 [0115.739] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0115.739] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png") returned 84 [0115.739] lstrlenW (lpString=".1cd") returned 4 [0115.739] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0115.739] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png") returned 84 [0115.739] lstrlenW (lpString=".jpg") returned 4 [0115.739] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0115.739] lstrcmpiW (lpString1=".png", lpString2=".waifu") returned -1 [0115.739] lstrlenW (lpString="4to3Squareframe_SelectionSubpicture.png") returned 39 [0115.739] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\4to3squareframe_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0115.740] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x342ff14 | out: lpFileSize=0x342ff14*=3304) returned 1 [0115.740] CloseHandle (hObject=0x1fc) returned 1 [0115.740] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\4to3squareframe_selectionsubpicture.png")) returned 0x20 [0115.740] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_SelectionSubpicture.png.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\4to3squareframe_selectionsubpicture.png.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0115.740] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\4to3squareframe_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0115.740] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_SelectionSubpicture.png") returned 83 [0115.740] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_SelectionSubpicture.png") returned 83 [0115.740] lstrlenW (lpString=".doc") returned 4 [0115.740] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0115.740] lstrlenW (lpString=".docx") returned 5 [0115.740] lstrcmpiW (lpString1=".docx", lpString2="e.png") returned -1 [0115.740] lstrlenW (lpString=".pdf") returned 4 [0115.740] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0115.740] lstrlenW (lpString=".xls") returned 4 [0115.740] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0115.740] lstrlenW (lpString=".xlsx") returned 5 [0115.740] lstrcmpiW (lpString1=".xlsx", lpString2="e.png") returned -1 [0115.740] lstrlenW (lpString=".ppt") returned 4 [0115.740] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0115.740] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_SelectionSubpicture.png") returned 83 [0115.740] lstrlenW (lpString=".zip") returned 4 [0115.740] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0115.740] lstrlenW (lpString=".rar") returned 4 [0115.740] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0115.740] lstrlenW (lpString=".bz2") returned 4 [0115.740] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0115.740] lstrlenW (lpString=".7z") returned 3 [0115.740] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0115.740] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_SelectionSubpicture.png") returned 83 [0115.740] lstrlenW (lpString=".dbf") returned 4 [0115.740] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0115.740] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_SelectionSubpicture.png") returned 83 [0115.740] lstrlenW (lpString=".1cd") returned 4 [0115.740] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0115.740] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_SelectionSubpicture.png") returned 83 [0115.740] lstrlenW (lpString=".jpg") returned 4 [0115.740] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0115.740] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_SelectionSubpicture.png") returned 83 [0115.741] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_SelectionSubpicture.png") returned 83 [0115.741] lstrlenW (lpString=".doc") returned 4 [0115.741] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0115.741] lstrlenW (lpString=".docx") returned 5 [0115.741] lstrcmpiW (lpString1=".docx", lpString2="e.png") returned -1 [0115.741] lstrlenW (lpString=".pdf") returned 4 [0115.741] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0115.741] lstrlenW (lpString=".xls") returned 4 [0115.741] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0115.741] lstrlenW (lpString=".xlsx") returned 5 [0115.741] lstrcmpiW (lpString1=".xlsx", lpString2="e.png") returned -1 [0115.741] lstrlenW (lpString=".ppt") returned 4 [0115.741] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0115.741] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_SelectionSubpicture.png") returned 83 [0115.741] lstrlenW (lpString=".zip") returned 4 [0115.741] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0115.741] lstrlenW (lpString=".rar") returned 4 [0115.741] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0115.741] lstrlenW (lpString=".bz2") returned 4 [0115.741] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0115.741] lstrlenW (lpString=".7z") returned 3 [0115.741] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0115.741] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_SelectionSubpicture.png") returned 83 [0115.741] lstrlenW (lpString=".dbf") returned 4 [0115.741] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0115.741] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_SelectionSubpicture.png") returned 83 [0115.741] lstrlenW (lpString=".1cd") returned 4 [0115.741] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0115.741] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_SelectionSubpicture.png") returned 83 [0115.741] lstrlenW (lpString=".jpg") returned 4 [0115.741] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0115.741] lstrcmpiW (lpString1=".png", lpString2=".waifu") returned -1 [0115.741] lstrlenW (lpString="4to3Squareframe_VideoInset.png") returned 30 [0115.741] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_VideoInset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\4to3squareframe_videoinset.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0115.741] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x342ff14 | out: lpFileSize=0x342ff14*=3467) returned 1 [0115.741] CloseHandle (hObject=0x1fc) returned 1 [0115.741] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_VideoInset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\4to3squareframe_videoinset.png")) returned 0x20 [0115.742] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_VideoInset.png.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\4to3squareframe_videoinset.png.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0115.742] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_VideoInset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\4to3squareframe_videoinset.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0115.742] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_VideoInset.png") returned 74 [0115.742] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_VideoInset.png") returned 74 [0115.742] lstrlenW (lpString=".doc") returned 4 [0115.742] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0115.742] lstrlenW (lpString=".docx") returned 5 [0115.742] lstrcmpiW (lpString1=".docx", lpString2="t.png") returned -1 [0115.742] lstrlenW (lpString=".pdf") returned 4 [0115.742] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0115.742] lstrlenW (lpString=".xls") returned 4 [0115.742] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0115.742] lstrlenW (lpString=".xlsx") returned 5 [0115.742] lstrcmpiW (lpString1=".xlsx", lpString2="t.png") returned -1 [0115.742] lstrlenW (lpString=".ppt") returned 4 [0115.742] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0115.742] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_VideoInset.png") returned 74 [0115.742] lstrlenW (lpString=".zip") returned 4 [0115.742] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0115.742] lstrlenW (lpString=".rar") returned 4 [0115.742] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0115.742] lstrlenW (lpString=".bz2") returned 4 [0115.742] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0115.742] lstrlenW (lpString=".7z") returned 3 [0115.742] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0115.742] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_VideoInset.png") returned 74 [0115.742] lstrlenW (lpString=".dbf") returned 4 [0115.742] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0115.742] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_VideoInset.png") returned 74 [0115.742] lstrlenW (lpString=".1cd") returned 4 [0115.742] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0115.742] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_VideoInset.png") returned 74 [0115.742] lstrlenW (lpString=".jpg") returned 4 [0115.742] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0115.742] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_VideoInset.png") returned 74 [0115.742] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_VideoInset.png") returned 74 [0115.742] lstrlenW (lpString=".doc") returned 4 [0115.742] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0115.742] lstrlenW (lpString=".docx") returned 5 [0115.742] lstrcmpiW (lpString1=".docx", lpString2="t.png") returned -1 [0115.742] lstrlenW (lpString=".pdf") returned 4 [0115.742] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0115.742] lstrlenW (lpString=".xls") returned 4 [0115.742] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0115.742] lstrlenW (lpString=".xlsx") returned 5 [0115.743] lstrcmpiW (lpString1=".xlsx", lpString2="t.png") returned -1 [0115.743] lstrlenW (lpString=".ppt") returned 4 [0115.743] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0115.743] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_VideoInset.png") returned 74 [0115.743] lstrlenW (lpString=".zip") returned 4 [0115.743] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0115.743] lstrlenW (lpString=".rar") returned 4 [0115.743] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0115.743] lstrlenW (lpString=".bz2") returned 4 [0115.743] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0115.743] lstrlenW (lpString=".7z") returned 3 [0115.743] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0115.743] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_VideoInset.png") returned 74 [0115.743] lstrlenW (lpString=".dbf") returned 4 [0115.743] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0115.743] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_VideoInset.png") returned 74 [0115.743] lstrlenW (lpString=".1cd") returned 4 [0115.743] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0115.743] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_VideoInset.png") returned 74 [0115.743] lstrlenW (lpString=".jpg") returned 4 [0115.743] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0115.743] lstrcmpiW (lpString1=".png", lpString2=".waifu") returned -1 [0115.744] lstrlenW (lpString="babyblue.png") returned 12 [0115.744] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyblue.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0115.745] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x342ff14 | out: lpFileSize=0x342ff14*=12349) returned 1 [0115.745] CloseHandle (hObject=0x1fc) returned 1 [0115.745] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyblue.png")) returned 0x20 [0115.745] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyblue.png.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0115.745] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyblue.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0115.745] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png") returned 64 [0115.745] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png") returned 64 [0115.746] lstrlenW (lpString=".doc") returned 4 [0115.746] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0115.746] lstrlenW (lpString=".docx") returned 5 [0115.746] lstrcmpiW (lpString1=".docx", lpString2="e.png") returned -1 [0115.746] lstrlenW (lpString=".pdf") returned 4 [0115.746] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0115.746] lstrlenW (lpString=".xls") returned 4 [0115.746] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0115.746] lstrlenW (lpString=".xlsx") returned 5 [0115.746] lstrcmpiW (lpString1=".xlsx", lpString2="e.png") returned -1 [0115.746] lstrlenW (lpString=".ppt") returned 4 [0115.746] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0115.746] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png") returned 64 [0115.746] lstrlenW (lpString=".zip") returned 4 [0115.746] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0115.746] lstrlenW (lpString=".rar") returned 4 [0115.746] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0115.746] lstrlenW (lpString=".bz2") returned 4 [0115.746] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0115.746] lstrlenW (lpString=".7z") returned 3 [0115.746] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0115.746] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png") returned 64 [0115.746] lstrlenW (lpString=".dbf") returned 4 [0115.746] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0115.746] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png") returned 64 [0115.746] lstrlenW (lpString=".1cd") returned 4 [0115.746] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0115.746] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png") returned 64 [0115.746] lstrlenW (lpString=".jpg") returned 4 [0115.746] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0115.746] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png") returned 64 [0115.746] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png") returned 64 [0115.746] lstrlenW (lpString=".doc") returned 4 [0115.746] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0115.746] lstrlenW (lpString=".docx") returned 5 [0115.746] lstrcmpiW (lpString1=".docx", lpString2="e.png") returned -1 [0115.746] lstrlenW (lpString=".pdf") returned 4 [0115.746] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0115.746] lstrlenW (lpString=".xls") returned 4 [0115.746] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0115.746] lstrlenW (lpString=".xlsx") returned 5 [0115.746] lstrcmpiW (lpString1=".xlsx", lpString2="e.png") returned -1 [0115.746] lstrlenW (lpString=".ppt") returned 4 [0115.746] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0115.747] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png") returned 64 [0115.747] lstrlenW (lpString=".zip") returned 4 [0115.747] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0115.747] lstrlenW (lpString=".rar") returned 4 [0115.747] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0115.747] lstrlenW (lpString=".bz2") returned 4 [0115.747] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0115.747] lstrlenW (lpString=".7z") returned 3 [0115.747] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0115.747] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png") returned 64 [0115.747] lstrlenW (lpString=".dbf") returned 4 [0115.747] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0115.747] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png") returned 64 [0115.747] lstrlenW (lpString=".1cd") returned 4 [0115.747] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0115.747] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png") returned 64 [0115.747] lstrlenW (lpString=".jpg") returned 4 [0115.747] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0115.747] lstrcmpiW (lpString1=".wmv", lpString2=".waifu") returned 1 [0115.747] lstrlenW (lpString="BabyBoyMainBackground.wmv") returned 25 [0115.747] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymainbackground.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0115.748] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x342ff14 | out: lpFileSize=0x342ff14*=341322) returned 1 [0115.748] CloseHandle (hObject=0x1fc) returned 1 [0115.748] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymainbackground.wmv")) returned 0x20 [0115.748] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground.wmv.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymainbackground.wmv.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0115.748] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymainbackground.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0115.748] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground.wmv") returned 77 [0115.748] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground.wmv") returned 77 [0115.748] lstrlenW (lpString=".doc") returned 4 [0115.748] lstrcmpiW (lpString1=".doc", lpString2=".wmv") returned -1 [0115.748] lstrlenW (lpString=".docx") returned 5 [0115.748] lstrcmpiW (lpString1=".docx", lpString2="d.wmv") returned -1 [0115.748] lstrlenW (lpString=".pdf") returned 4 [0115.748] lstrcmpiW (lpString1=".pdf", lpString2=".wmv") returned -1 [0115.748] lstrlenW (lpString=".xls") returned 4 [0115.748] lstrcmpiW (lpString1=".xls", lpString2=".wmv") returned 1 [0115.748] lstrlenW (lpString=".xlsx") returned 5 [0115.748] lstrcmpiW (lpString1=".xlsx", lpString2="d.wmv") returned -1 [0115.748] lstrlenW (lpString=".ppt") returned 4 [0115.748] lstrcmpiW (lpString1=".ppt", lpString2=".wmv") returned -1 [0115.748] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground.wmv") returned 77 [0115.748] lstrlenW (lpString=".zip") returned 4 [0115.748] lstrcmpiW (lpString1=".zip", lpString2=".wmv") returned 1 [0115.748] lstrlenW (lpString=".rar") returned 4 [0115.748] lstrcmpiW (lpString1=".rar", lpString2=".wmv") returned -1 [0115.748] lstrlenW (lpString=".bz2") returned 4 [0115.748] lstrcmpiW (lpString1=".bz2", lpString2=".wmv") returned -1 [0115.748] lstrlenW (lpString=".7z") returned 3 [0115.748] lstrcmpiW (lpString1=".7z", lpString2="wmv") returned -1 [0115.749] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground.wmv") returned 77 [0115.749] lstrlenW (lpString=".dbf") returned 4 [0115.749] lstrcmpiW (lpString1=".dbf", lpString2=".wmv") returned -1 [0115.749] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground.wmv") returned 77 [0115.749] lstrlenW (lpString=".1cd") returned 4 [0115.749] lstrcmpiW (lpString1=".1cd", lpString2=".wmv") returned -1 [0115.749] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground.wmv") returned 77 [0115.749] lstrlenW (lpString=".jpg") returned 4 [0115.749] lstrcmpiW (lpString1=".jpg", lpString2=".wmv") returned -1 [0115.749] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground.wmv") returned 77 [0115.749] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground.wmv") returned 77 [0115.749] lstrlenW (lpString=".doc") returned 4 [0115.749] lstrcmpiW (lpString1=".doc", lpString2=".wmv") returned -1 [0115.749] lstrlenW (lpString=".docx") returned 5 [0115.749] lstrcmpiW (lpString1=".docx", lpString2="d.wmv") returned -1 [0115.749] lstrlenW (lpString=".pdf") returned 4 [0115.749] lstrcmpiW (lpString1=".pdf", lpString2=".wmv") returned -1 [0115.749] lstrlenW (lpString=".xls") returned 4 [0115.749] lstrcmpiW (lpString1=".xls", lpString2=".wmv") returned 1 [0115.749] lstrlenW (lpString=".xlsx") returned 5 [0115.749] lstrcmpiW (lpString1=".xlsx", lpString2="d.wmv") returned -1 [0115.749] lstrlenW (lpString=".ppt") returned 4 [0115.749] lstrcmpiW (lpString1=".ppt", lpString2=".wmv") returned -1 [0115.749] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground.wmv") returned 77 [0115.749] lstrlenW (lpString=".zip") returned 4 [0115.749] lstrcmpiW (lpString1=".zip", lpString2=".wmv") returned 1 [0115.749] lstrlenW (lpString=".rar") returned 4 [0115.749] lstrcmpiW (lpString1=".rar", lpString2=".wmv") returned -1 [0115.750] lstrlenW (lpString=".bz2") returned 4 [0115.750] lstrcmpiW (lpString1=".bz2", lpString2=".wmv") returned -1 [0115.750] lstrlenW (lpString=".7z") returned 3 [0115.750] lstrcmpiW (lpString1=".7z", lpString2="wmv") returned -1 [0115.750] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground.wmv") returned 77 [0115.750] lstrlenW (lpString=".dbf") returned 4 [0115.750] lstrcmpiW (lpString1=".dbf", lpString2=".wmv") returned -1 [0115.750] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground.wmv") returned 77 [0115.750] lstrlenW (lpString=".1cd") returned 4 [0115.750] lstrcmpiW (lpString1=".1cd", lpString2=".wmv") returned -1 [0115.750] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground.wmv") returned 77 [0115.750] lstrlenW (lpString=".jpg") returned 4 [0115.750] lstrcmpiW (lpString1=".jpg", lpString2=".wmv") returned -1 [0115.750] lstrcmpiW (lpString1=".wmv", lpString2=".waifu") returned 1 [0115.750] lstrlenW (lpString="BabyBoyMainBackground_PAL.wmv") returned 29 [0115.750] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymainbackground_pal.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0115.750] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x342ff14 | out: lpFileSize=0x342ff14*=325322) returned 1 [0115.750] CloseHandle (hObject=0x1fc) returned 1 [0115.751] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymainbackground_pal.wmv")) returned 0x20 [0115.751] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground_PAL.wmv.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymainbackground_pal.wmv.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0115.751] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymainbackground_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0115.751] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground_PAL.wmv") returned 81 [0115.751] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground_PAL.wmv") returned 81 [0115.751] lstrlenW (lpString=".doc") returned 4 [0115.751] lstrcmpiW (lpString1=".doc", lpString2=".wmv") returned -1 [0115.751] lstrlenW (lpString=".docx") returned 5 [0115.751] lstrcmpiW (lpString1=".docx", lpString2="L.wmv") returned -1 [0115.751] lstrlenW (lpString=".pdf") returned 4 [0115.751] lstrcmpiW (lpString1=".pdf", lpString2=".wmv") returned -1 [0115.751] lstrlenW (lpString=".xls") returned 4 [0115.751] lstrcmpiW (lpString1=".xls", lpString2=".wmv") returned 1 [0115.751] lstrlenW (lpString=".xlsx") returned 5 [0115.751] lstrcmpiW (lpString1=".xlsx", lpString2="L.wmv") returned -1 [0115.751] lstrlenW (lpString=".ppt") returned 4 [0115.751] lstrcmpiW (lpString1=".ppt", lpString2=".wmv") returned -1 [0115.751] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground_PAL.wmv") returned 81 [0115.751] lstrlenW (lpString=".zip") returned 4 [0115.751] lstrcmpiW (lpString1=".zip", lpString2=".wmv") returned 1 [0115.751] lstrlenW (lpString=".rar") returned 4 [0115.751] lstrcmpiW (lpString1=".rar", lpString2=".wmv") returned -1 [0115.751] lstrlenW (lpString=".bz2") returned 4 [0115.751] lstrcmpiW (lpString1=".bz2", lpString2=".wmv") returned -1 [0115.751] lstrlenW (lpString=".7z") returned 3 [0115.751] lstrcmpiW (lpString1=".7z", lpString2="wmv") returned -1 [0115.751] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground_PAL.wmv") returned 81 [0115.751] lstrlenW (lpString=".dbf") returned 4 [0115.751] lstrcmpiW (lpString1=".dbf", lpString2=".wmv") returned -1 [0117.522] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0117.522] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0117.522] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\as90.xsl.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0117.522] GetLastError () returned 0x0 [0117.522] ReadFile (in: hFile=0x1e0, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x4932, lpOverlapped=0x0) returned 1 [0117.531] WriteFile (in: hFile=0x20c, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0x4940, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0x4940, lpOverlapped=0x0) returned 1 [0117.532] ReadFile (in: hFile=0x1e0, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x0, lpOverlapped=0x0) returned 1 [0117.532] WriteFile (in: hFile=0x20c, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0xe4, lpOverlapped=0x0) returned 1 [0117.532] SetEndOfFile (hFile=0x20c) returned 1 [0117.532] CloseHandle (hObject=0x20c) returned 1 [0117.533] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0117.533] SetEndOfFile (hFile=0x1e0) returned 1 [0117.533] CloseHandle (hObject=0x1e0) returned 1 [0117.533] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0117.533] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\as90.xsl")) returned 1 [0117.534] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl") returned 76 [0117.534] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl") returned 76 [0117.534] lstrlenW (lpString=".doc") returned 4 [0117.534] lstrcmpiW (lpString1=".doc", lpString2=".xsl") returned -1 [0117.534] lstrlenW (lpString=".docx") returned 5 [0117.534] lstrcmpiW (lpString1=".docx", lpString2="0.xsl") returned -1 [0117.534] lstrlenW (lpString=".pdf") returned 4 [0117.534] lstrcmpiW (lpString1=".pdf", lpString2=".xsl") returned -1 [0117.534] lstrlenW (lpString=".xls") returned 4 [0117.534] lstrcmpiW (lpString1=".xls", lpString2=".xsl") returned -1 [0117.534] lstrlenW (lpString=".xlsx") returned 5 [0117.534] lstrcmpiW (lpString1=".xlsx", lpString2="0.xsl") returned -1 [0117.534] lstrlenW (lpString=".ppt") returned 4 [0117.534] lstrcmpiW (lpString1=".ppt", lpString2=".xsl") returned -1 [0117.534] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl") returned 76 [0117.534] lstrlenW (lpString=".zip") returned 4 [0117.534] lstrcmpiW (lpString1=".zip", lpString2=".xsl") returned 1 [0117.534] lstrlenW (lpString=".rar") returned 4 [0117.534] lstrcmpiW (lpString1=".rar", lpString2=".xsl") returned -1 [0117.534] lstrlenW (lpString=".bz2") returned 4 [0117.534] lstrcmpiW (lpString1=".bz2", lpString2=".xsl") returned -1 [0117.534] lstrlenW (lpString=".7z") returned 3 [0117.534] lstrcmpiW (lpString1=".7z", lpString2="xsl") returned -1 [0117.534] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl") returned 76 [0117.534] lstrlenW (lpString=".dbf") returned 4 [0117.534] lstrcmpiW (lpString1=".dbf", lpString2=".xsl") returned -1 [0117.534] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl") returned 76 [0117.534] lstrlenW (lpString=".1cd") returned 4 [0117.534] lstrcmpiW (lpString1=".1cd", lpString2=".xsl") returned -1 [0117.534] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl") returned 76 [0117.534] lstrlenW (lpString=".jpg") returned 4 [0117.534] lstrcmpiW (lpString1=".jpg", lpString2=".xsl") returned -1 [0117.534] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl") returned 76 [0117.534] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl") returned 76 [0117.534] lstrlenW (lpString=".doc") returned 4 [0117.534] lstrcmpiW (lpString1=".doc", lpString2=".xsl") returned -1 [0117.534] lstrlenW (lpString=".docx") returned 5 [0117.534] lstrcmpiW (lpString1=".docx", lpString2="0.xsl") returned -1 [0117.534] lstrlenW (lpString=".pdf") returned 4 [0117.534] lstrcmpiW (lpString1=".pdf", lpString2=".xsl") returned -1 [0117.534] lstrlenW (lpString=".xls") returned 4 [0117.534] lstrcmpiW (lpString1=".xls", lpString2=".xsl") returned -1 [0117.534] lstrlenW (lpString=".xlsx") returned 5 [0117.535] lstrcmpiW (lpString1=".xlsx", lpString2="0.xsl") returned -1 [0117.535] lstrlenW (lpString=".ppt") returned 4 [0117.535] lstrcmpiW (lpString1=".ppt", lpString2=".xsl") returned -1 [0117.535] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl") returned 76 [0117.535] lstrlenW (lpString=".zip") returned 4 [0117.535] lstrcmpiW (lpString1=".zip", lpString2=".xsl") returned 1 [0117.535] lstrlenW (lpString=".rar") returned 4 [0117.535] lstrcmpiW (lpString1=".rar", lpString2=".xsl") returned -1 [0117.535] lstrlenW (lpString=".bz2") returned 4 [0117.535] lstrcmpiW (lpString1=".bz2", lpString2=".xsl") returned -1 [0117.535] lstrlenW (lpString=".7z") returned 3 [0117.535] lstrcmpiW (lpString1=".7z", lpString2="xsl") returned -1 [0117.535] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl") returned 76 [0117.535] lstrlenW (lpString=".dbf") returned 4 [0117.535] lstrcmpiW (lpString1=".dbf", lpString2=".xsl") returned -1 [0117.535] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl") returned 76 [0117.535] lstrlenW (lpString=".1cd") returned 4 [0117.535] lstrcmpiW (lpString1=".1cd", lpString2=".xsl") returned -1 [0117.535] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl") returned 76 [0117.535] lstrlenW (lpString=".jpg") returned 4 [0117.535] lstrcmpiW (lpString1=".jpg", lpString2=".xsl") returned -1 [0117.535] lstrcmpiW (lpString1=".xsl", lpString2=".waifu") returned 1 [0117.535] lstrlenW (lpString="Sybase.xsl") returned 10 [0117.535] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sybase.xsl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0117.561] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x342ff14 | out: lpFileSize=0x342ff14*=29790) returned 1 [0117.561] CloseHandle (hObject=0x180) returned 1 [0117.561] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sybase.xsl")) returned 0x20 [0117.561] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sybase.xsl.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0117.561] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sybase.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0117.561] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0117.562] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0117.562] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sybase.xsl.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0117.562] GetLastError () returned 0x0 [0117.562] ReadFile (in: hFile=0x180, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x745e, lpOverlapped=0x0) returned 1 [0117.583] WriteFile (in: hFile=0x1c0, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0x7460, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0x7460, lpOverlapped=0x0) returned 1 [0117.584] ReadFile (in: hFile=0x180, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x0, lpOverlapped=0x0) returned 1 [0117.584] WriteFile (in: hFile=0x1c0, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0xe8, lpOverlapped=0x0) returned 1 [0117.584] SetEndOfFile (hFile=0x1c0) returned 1 [0117.584] CloseHandle (hObject=0x1c0) returned 1 [0117.585] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0117.585] SetEndOfFile (hFile=0x180) returned 1 [0117.586] CloseHandle (hObject=0x180) returned 1 [0117.586] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0117.586] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sybase.xsl")) returned 1 [0117.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl") returned 78 [0117.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl") returned 78 [0117.586] lstrlenW (lpString=".doc") returned 4 [0117.586] lstrcmpiW (lpString1=".doc", lpString2=".xsl") returned -1 [0117.586] lstrlenW (lpString=".docx") returned 5 [0117.586] lstrcmpiW (lpString1=".docx", lpString2="e.xsl") returned -1 [0117.586] lstrlenW (lpString=".pdf") returned 4 [0117.586] lstrcmpiW (lpString1=".pdf", lpString2=".xsl") returned -1 [0117.586] lstrlenW (lpString=".xls") returned 4 [0117.586] lstrcmpiW (lpString1=".xls", lpString2=".xsl") returned -1 [0117.587] lstrlenW (lpString=".xlsx") returned 5 [0117.587] lstrcmpiW (lpString1=".xlsx", lpString2="e.xsl") returned -1 [0117.587] lstrlenW (lpString=".ppt") returned 4 [0117.587] lstrcmpiW (lpString1=".ppt", lpString2=".xsl") returned -1 [0117.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl") returned 78 [0117.587] lstrlenW (lpString=".zip") returned 4 [0117.587] lstrcmpiW (lpString1=".zip", lpString2=".xsl") returned 1 [0117.587] lstrlenW (lpString=".rar") returned 4 [0117.587] lstrcmpiW (lpString1=".rar", lpString2=".xsl") returned -1 [0117.587] lstrlenW (lpString=".bz2") returned 4 [0117.587] lstrcmpiW (lpString1=".bz2", lpString2=".xsl") returned -1 [0117.587] lstrlenW (lpString=".7z") returned 3 [0117.587] lstrcmpiW (lpString1=".7z", lpString2="xsl") returned -1 [0117.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl") returned 78 [0117.587] lstrlenW (lpString=".dbf") returned 4 [0117.587] lstrcmpiW (lpString1=".dbf", lpString2=".xsl") returned -1 [0117.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl") returned 78 [0117.587] lstrlenW (lpString=".1cd") returned 4 [0117.587] lstrcmpiW (lpString1=".1cd", lpString2=".xsl") returned -1 [0117.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl") returned 78 [0117.587] lstrlenW (lpString=".jpg") returned 4 [0117.587] lstrcmpiW (lpString1=".jpg", lpString2=".xsl") returned -1 [0117.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl") returned 78 [0117.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl") returned 78 [0117.595] lstrlenW (lpString=".doc") returned 4 [0117.595] lstrcmpiW (lpString1=".doc", lpString2=".xsl") returned -1 [0117.595] lstrlenW (lpString=".docx") returned 5 [0117.595] lstrcmpiW (lpString1=".docx", lpString2="e.xsl") returned -1 [0117.595] lstrlenW (lpString=".pdf") returned 4 [0117.595] lstrcmpiW (lpString1=".pdf", lpString2=".xsl") returned -1 [0117.595] lstrlenW (lpString=".xls") returned 4 [0117.595] lstrcmpiW (lpString1=".xls", lpString2=".xsl") returned -1 [0117.595] lstrlenW (lpString=".xlsx") returned 5 [0117.595] lstrcmpiW (lpString1=".xlsx", lpString2="e.xsl") returned -1 [0117.595] lstrlenW (lpString=".ppt") returned 4 [0117.595] lstrcmpiW (lpString1=".ppt", lpString2=".xsl") returned -1 [0117.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl") returned 78 [0117.595] lstrlenW (lpString=".zip") returned 4 [0117.595] lstrcmpiW (lpString1=".zip", lpString2=".xsl") returned 1 [0117.595] lstrlenW (lpString=".rar") returned 4 [0117.595] lstrcmpiW (lpString1=".rar", lpString2=".xsl") returned -1 [0117.595] lstrlenW (lpString=".bz2") returned 4 [0117.595] lstrcmpiW (lpString1=".bz2", lpString2=".xsl") returned -1 [0117.595] lstrlenW (lpString=".7z") returned 3 [0117.595] lstrcmpiW (lpString1=".7z", lpString2="xsl") returned -1 [0117.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl") returned 78 [0117.595] lstrlenW (lpString=".dbf") returned 4 [0117.595] lstrcmpiW (lpString1=".dbf", lpString2=".xsl") returned -1 [0117.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl") returned 78 [0117.595] lstrlenW (lpString=".1cd") returned 4 [0117.595] lstrcmpiW (lpString1=".1cd", lpString2=".xsl") returned -1 [0117.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl") returned 78 [0117.595] lstrlenW (lpString=".jpg") returned 4 [0117.595] lstrcmpiW (lpString1=".jpg", lpString2=".xsl") returned -1 [0117.595] lstrcmpiW (lpString1=".GIF", lpString2=".waifu") returned -1 [0117.595] lstrlenW (lpString="AG00037_.GIF") returned 12 [0117.595] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00037_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0117.596] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x342ff14 | out: lpFileSize=0x342ff14*=6684) returned 1 [0117.596] CloseHandle (hObject=0x1e0) returned 1 [0117.596] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00037_.gif")) returned 0x20 [0117.596] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00037_.gif.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0117.596] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00037_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0117.596] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0117.596] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0117.596] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00037_.gif.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0117.597] GetLastError () returned 0x0 [0117.597] ReadFile (in: hFile=0x1e0, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x1a1c, lpOverlapped=0x0) returned 1 [0117.637] WriteFile (in: hFile=0x20c, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0x1a20, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0x1a20, lpOverlapped=0x0) returned 1 [0117.638] ReadFile (in: hFile=0x1e0, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x0, lpOverlapped=0x0) returned 1 [0117.638] WriteFile (in: hFile=0x20c, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0xec, lpOverlapped=0x0) returned 1 [0117.638] SetEndOfFile (hFile=0x20c) returned 1 [0117.638] CloseHandle (hObject=0x20c) returned 1 [0117.638] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0117.638] SetEndOfFile (hFile=0x1e0) returned 1 [0117.639] CloseHandle (hObject=0x1e0) returned 1 [0117.639] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0117.639] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00037_.gif")) returned 1 [0117.639] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 63 [0117.639] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 63 [0117.639] lstrlenW (lpString=".doc") returned 4 [0117.639] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0117.639] lstrlenW (lpString=".docx") returned 5 [0117.639] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0117.639] lstrlenW (lpString=".pdf") returned 4 [0117.639] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0117.639] lstrlenW (lpString=".xls") returned 4 [0117.639] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0117.639] lstrlenW (lpString=".xlsx") returned 5 [0117.639] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0117.639] lstrlenW (lpString=".ppt") returned 4 [0117.639] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0117.639] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 63 [0117.639] lstrlenW (lpString=".zip") returned 4 [0117.639] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0117.639] lstrlenW (lpString=".rar") returned 4 [0117.639] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0117.639] lstrlenW (lpString=".bz2") returned 4 [0117.639] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0117.639] lstrlenW (lpString=".7z") returned 3 [0117.639] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0117.639] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 63 [0117.639] lstrlenW (lpString=".dbf") returned 4 [0117.639] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0117.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 63 [0117.640] lstrlenW (lpString=".1cd") returned 4 [0117.640] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0117.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 63 [0117.640] lstrlenW (lpString=".jpg") returned 4 [0117.640] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0117.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 63 [0117.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 63 [0117.640] lstrlenW (lpString=".doc") returned 4 [0117.640] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0117.640] lstrlenW (lpString=".docx") returned 5 [0117.640] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0117.640] lstrlenW (lpString=".pdf") returned 4 [0117.640] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0117.640] lstrlenW (lpString=".xls") returned 4 [0117.640] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0117.640] lstrlenW (lpString=".xlsx") returned 5 [0117.640] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0117.640] lstrlenW (lpString=".ppt") returned 4 [0117.640] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0117.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 63 [0117.640] lstrlenW (lpString=".zip") returned 4 [0117.640] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0117.640] lstrlenW (lpString=".rar") returned 4 [0117.640] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0117.640] lstrlenW (lpString=".bz2") returned 4 [0117.640] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0117.640] lstrlenW (lpString=".7z") returned 3 [0117.640] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0117.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 63 [0117.640] lstrlenW (lpString=".dbf") returned 4 [0117.640] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0117.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 63 [0117.640] lstrlenW (lpString=".1cd") returned 4 [0117.640] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0117.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 63 [0117.640] lstrlenW (lpString=".jpg") returned 4 [0117.640] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0117.640] lstrcmpiW (lpString1=".GIF", lpString2=".waifu") returned -1 [0117.640] lstrlenW (lpString="AG00052_.GIF") returned 12 [0117.640] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00052_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0117.641] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x342ff14 | out: lpFileSize=0x342ff14*=7686) returned 1 [0117.641] CloseHandle (hObject=0x1e0) returned 1 [0117.641] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00052_.gif")) returned 0x20 [0117.641] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00052_.gif.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0117.641] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00052_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0117.641] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0117.641] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0117.641] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00052_.gif.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0117.641] GetLastError () returned 0x0 [0117.641] ReadFile (in: hFile=0x1e0, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x1e06, lpOverlapped=0x0) returned 1 [0117.661] WriteFile (in: hFile=0x20c, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0x1e10, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0x1e10, lpOverlapped=0x0) returned 1 [0117.662] ReadFile (in: hFile=0x1e0, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x0, lpOverlapped=0x0) returned 1 [0117.662] WriteFile (in: hFile=0x20c, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0xec, lpOverlapped=0x0) returned 1 [0117.662] SetEndOfFile (hFile=0x20c) returned 1 [0117.662] CloseHandle (hObject=0x20c) returned 1 [0117.662] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0117.662] SetEndOfFile (hFile=0x1e0) returned 1 [0117.663] CloseHandle (hObject=0x1e0) returned 1 [0117.663] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0117.663] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00052_.gif")) returned 1 [0117.663] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 63 [0117.663] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 63 [0117.663] lstrlenW (lpString=".doc") returned 4 [0117.663] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0117.663] lstrlenW (lpString=".docx") returned 5 [0117.664] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0117.664] lstrlenW (lpString=".pdf") returned 4 [0117.664] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0117.664] lstrlenW (lpString=".xls") returned 4 [0117.664] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0117.664] lstrlenW (lpString=".xlsx") returned 5 [0117.664] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0117.664] lstrlenW (lpString=".ppt") returned 4 [0117.664] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0117.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 63 [0117.664] lstrlenW (lpString=".zip") returned 4 [0117.664] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0117.664] lstrlenW (lpString=".rar") returned 4 [0117.664] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0117.664] lstrlenW (lpString=".bz2") returned 4 [0117.664] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0117.664] lstrlenW (lpString=".7z") returned 3 [0117.664] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0117.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 63 [0117.664] lstrlenW (lpString=".dbf") returned 4 [0117.664] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0117.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 63 [0117.664] lstrlenW (lpString=".1cd") returned 4 [0117.664] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0117.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 63 [0117.664] lstrlenW (lpString=".jpg") returned 4 [0117.664] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0117.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 63 [0117.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 63 [0117.664] lstrlenW (lpString=".doc") returned 4 [0117.664] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0117.664] lstrlenW (lpString=".docx") returned 5 [0117.664] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0117.664] lstrlenW (lpString=".pdf") returned 4 [0117.664] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0117.664] lstrlenW (lpString=".xls") returned 4 [0117.664] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0117.664] lstrlenW (lpString=".xlsx") returned 5 [0117.664] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0117.664] lstrlenW (lpString=".ppt") returned 4 [0117.664] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0117.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 63 [0117.664] lstrlenW (lpString=".zip") returned 4 [0117.664] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0117.664] lstrlenW (lpString=".rar") returned 4 [0117.664] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0117.664] lstrlenW (lpString=".bz2") returned 4 [0117.664] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0117.664] lstrlenW (lpString=".7z") returned 3 [0117.665] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0117.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 63 [0117.665] lstrlenW (lpString=".dbf") returned 4 [0117.665] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0117.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 63 [0117.665] lstrlenW (lpString=".1cd") returned 4 [0117.665] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0117.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 63 [0117.665] lstrlenW (lpString=".jpg") returned 4 [0117.665] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0117.665] lstrcmpiW (lpString1=".GIF", lpString2=".waifu") returned -1 [0117.665] lstrlenW (lpString="AG00090_.GIF") returned 12 [0117.665] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00090_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0117.665] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x342ff14 | out: lpFileSize=0x342ff14*=517) returned 1 [0117.665] CloseHandle (hObject=0x1e0) returned 1 [0117.665] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00090_.gif")) returned 0x20 [0117.665] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00090_.gif.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0117.665] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00090_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0117.665] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0117.665] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0117.666] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00090_.gif.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0117.666] GetLastError () returned 0x0 [0117.666] ReadFile (in: hFile=0x1e0, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x205, lpOverlapped=0x0) returned 1 [0117.667] WriteFile (in: hFile=0x20c, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0x210, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0x210, lpOverlapped=0x0) returned 1 [0117.667] ReadFile (in: hFile=0x1e0, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x0, lpOverlapped=0x0) returned 1 [0117.667] WriteFile (in: hFile=0x20c, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0xec, lpOverlapped=0x0) returned 1 [0117.667] SetEndOfFile (hFile=0x20c) returned 1 [0117.668] CloseHandle (hObject=0x20c) returned 1 [0117.668] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0117.668] SetEndOfFile (hFile=0x1e0) returned 1 [0117.668] CloseHandle (hObject=0x1e0) returned 1 [0117.668] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0117.669] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00090_.gif")) returned 1 [0117.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 63 [0117.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 63 [0117.670] lstrlenW (lpString=".doc") returned 4 [0117.670] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0117.670] lstrlenW (lpString=".docx") returned 5 [0117.670] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0117.670] lstrlenW (lpString=".pdf") returned 4 [0117.670] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0117.670] lstrlenW (lpString=".xls") returned 4 [0117.670] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0117.670] lstrlenW (lpString=".xlsx") returned 5 [0117.670] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0117.670] lstrlenW (lpString=".ppt") returned 4 [0117.670] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0117.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 63 [0117.670] lstrlenW (lpString=".zip") returned 4 [0117.670] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0117.670] lstrlenW (lpString=".rar") returned 4 [0117.670] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0117.670] lstrlenW (lpString=".bz2") returned 4 [0117.670] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0117.670] lstrlenW (lpString=".7z") returned 3 [0117.670] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0117.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 63 [0117.671] lstrlenW (lpString=".dbf") returned 4 [0117.671] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0117.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 63 [0117.671] lstrlenW (lpString=".1cd") returned 4 [0117.671] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0117.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 63 [0117.671] lstrlenW (lpString=".jpg") returned 4 [0117.671] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0117.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 63 [0117.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 63 [0117.671] lstrlenW (lpString=".doc") returned 4 [0117.671] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0117.671] lstrlenW (lpString=".docx") returned 5 [0117.671] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0117.671] lstrlenW (lpString=".pdf") returned 4 [0117.671] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0117.671] lstrlenW (lpString=".xls") returned 4 [0117.671] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0117.671] lstrlenW (lpString=".xlsx") returned 5 [0117.671] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0117.671] lstrlenW (lpString=".ppt") returned 4 [0117.671] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0117.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 63 [0117.671] lstrlenW (lpString=".zip") returned 4 [0117.671] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0117.671] lstrlenW (lpString=".rar") returned 4 [0117.671] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0117.671] lstrlenW (lpString=".bz2") returned 4 [0117.671] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0117.671] lstrlenW (lpString=".7z") returned 3 [0117.671] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0117.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 63 [0117.671] lstrlenW (lpString=".dbf") returned 4 [0117.671] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0117.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 63 [0117.671] lstrlenW (lpString=".1cd") returned 4 [0117.671] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0117.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 63 [0117.671] lstrlenW (lpString=".jpg") returned 4 [0117.671] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0117.671] lstrcmpiW (lpString1=".GIF", lpString2=".waifu") returned -1 [0117.671] lstrlenW (lpString="AG00092_.GIF") returned 12 [0117.671] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00092_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0117.672] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x342ff14 | out: lpFileSize=0x342ff14*=502) returned 1 [0117.672] CloseHandle (hObject=0x1e0) returned 1 [0117.672] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00092_.gif")) returned 0x20 [0117.672] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00092_.gif.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0117.672] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00092_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0117.672] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0117.672] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0117.672] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00092_.gif.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0117.672] GetLastError () returned 0x0 [0117.672] ReadFile (in: hFile=0x1e0, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x1f6, lpOverlapped=0x0) returned 1 [0117.673] WriteFile (in: hFile=0x20c, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0x200, lpOverlapped=0x0) returned 1 [0117.674] ReadFile (in: hFile=0x1e0, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x0, lpOverlapped=0x0) returned 1 [0117.674] WriteFile (in: hFile=0x20c, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0xec, lpOverlapped=0x0) returned 1 [0117.674] SetEndOfFile (hFile=0x20c) returned 1 [0117.674] CloseHandle (hObject=0x20c) returned 1 [0117.674] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0117.674] SetEndOfFile (hFile=0x1e0) returned 1 [0117.675] CloseHandle (hObject=0x1e0) returned 1 [0117.675] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0117.675] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00092_.gif")) returned 1 [0117.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 63 [0117.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 63 [0117.675] lstrlenW (lpString=".doc") returned 4 [0117.675] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0117.675] lstrlenW (lpString=".docx") returned 5 [0117.675] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0117.675] lstrlenW (lpString=".pdf") returned 4 [0117.675] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0117.675] lstrlenW (lpString=".xls") returned 4 [0117.675] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0117.675] lstrlenW (lpString=".xlsx") returned 5 [0117.675] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0117.675] lstrlenW (lpString=".ppt") returned 4 [0117.675] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0117.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 63 [0117.675] lstrlenW (lpString=".zip") returned 4 [0117.675] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0117.675] lstrlenW (lpString=".rar") returned 4 [0117.675] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0117.675] lstrlenW (lpString=".bz2") returned 4 [0117.675] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0117.675] lstrlenW (lpString=".7z") returned 3 [0117.675] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0117.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 63 [0117.675] lstrlenW (lpString=".dbf") returned 4 [0117.675] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0117.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 63 [0117.676] lstrlenW (lpString=".1cd") returned 4 [0117.676] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0117.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 63 [0117.676] lstrlenW (lpString=".jpg") returned 4 [0117.676] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0117.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 63 [0117.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 63 [0117.676] lstrlenW (lpString=".doc") returned 4 [0117.676] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0117.676] lstrlenW (lpString=".docx") returned 5 [0117.676] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0117.676] lstrlenW (lpString=".pdf") returned 4 [0117.676] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0117.676] lstrlenW (lpString=".xls") returned 4 [0117.676] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0117.676] lstrlenW (lpString=".xlsx") returned 5 [0117.676] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0117.676] lstrlenW (lpString=".ppt") returned 4 [0117.676] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0117.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 63 [0117.676] lstrlenW (lpString=".zip") returned 4 [0117.676] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0117.676] lstrlenW (lpString=".rar") returned 4 [0117.676] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0117.676] lstrlenW (lpString=".bz2") returned 4 [0117.676] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0117.676] lstrlenW (lpString=".7z") returned 3 [0117.676] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0117.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 63 [0117.676] lstrlenW (lpString=".dbf") returned 4 [0117.676] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0117.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 63 [0117.676] lstrlenW (lpString=".1cd") returned 4 [0117.676] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0117.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 63 [0117.676] lstrlenW (lpString=".jpg") returned 4 [0117.676] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0117.677] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x342ff14 | out: lpFileSize=0x342ff14*=12702) returned 1 [0117.677] CloseHandle (hObject=0x1e0) returned 1 [0117.677] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00103_.gif")) returned 0x20 [0117.677] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00103_.gif.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0117.677] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00103_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0117.677] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0117.678] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0117.678] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00103_.gif.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0117.678] GetLastError () returned 0x0 [0117.678] ReadFile (in: hFile=0x1e0, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x319e, lpOverlapped=0x0) returned 1 [0117.716] WriteFile (in: hFile=0x20c, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0x31a0, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0x31a0, lpOverlapped=0x0) returned 1 [0117.717] ReadFile (in: hFile=0x1e0, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x0, lpOverlapped=0x0) returned 1 [0117.717] WriteFile (in: hFile=0x20c, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0xec, lpOverlapped=0x0) returned 1 [0117.717] SetEndOfFile (hFile=0x20c) returned 1 [0117.717] CloseHandle (hObject=0x20c) returned 1 [0117.717] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0117.717] SetEndOfFile (hFile=0x1e0) returned 1 [0117.718] CloseHandle (hObject=0x1e0) returned 1 [0117.718] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0117.718] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00103_.gif")) returned 1 [0117.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 63 [0117.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 63 [0117.718] lstrlenW (lpString=".doc") returned 4 [0117.718] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0117.719] lstrlenW (lpString=".docx") returned 5 [0117.719] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0117.719] lstrlenW (lpString=".pdf") returned 4 [0117.719] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0117.719] lstrlenW (lpString=".xls") returned 4 [0117.719] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0117.719] lstrlenW (lpString=".xlsx") returned 5 [0117.719] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0117.719] lstrlenW (lpString=".ppt") returned 4 [0117.719] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0117.719] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 63 [0117.719] lstrlenW (lpString=".zip") returned 4 [0117.719] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0117.719] lstrlenW (lpString=".rar") returned 4 [0117.719] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0117.719] lstrlenW (lpString=".bz2") returned 4 [0117.719] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0117.719] lstrlenW (lpString=".7z") returned 3 [0117.719] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0117.719] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 63 [0117.719] lstrlenW (lpString=".dbf") returned 4 [0117.719] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0117.719] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 63 [0117.719] lstrlenW (lpString=".1cd") returned 4 [0117.719] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0117.719] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 63 [0117.719] lstrlenW (lpString=".jpg") returned 4 [0117.719] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0117.720] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x342ff14 | out: lpFileSize=0x342ff14*=2596) returned 1 [0117.720] CloseHandle (hObject=0x1e0) returned 1 [0117.720] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00135_.gif")) returned 0x20 [0117.720] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00135_.gif.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0117.720] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00135_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0117.720] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0117.720] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0117.720] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00135_.gif.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0117.721] GetLastError () returned 0x0 [0117.721] ReadFile (in: hFile=0x1e0, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0xa24, lpOverlapped=0x0) returned 1 [0117.731] WriteFile (in: hFile=0x20c, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0xa30, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0xa30, lpOverlapped=0x0) returned 1 [0117.731] ReadFile (in: hFile=0x1e0, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x0, lpOverlapped=0x0) returned 1 [0117.731] WriteFile (in: hFile=0x20c, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0xec, lpOverlapped=0x0) returned 1 [0117.731] SetEndOfFile (hFile=0x20c) returned 1 [0117.731] CloseHandle (hObject=0x20c) returned 1 [0117.732] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0117.732] SetEndOfFile (hFile=0x1e0) returned 1 [0117.732] CloseHandle (hObject=0x1e0) returned 1 [0117.732] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0117.732] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00135_.gif")) returned 1 [0117.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 63 [0117.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 63 [0117.733] lstrlenW (lpString=".doc") returned 4 [0117.733] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0117.733] lstrlenW (lpString=".docx") returned 5 [0117.733] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0117.733] lstrlenW (lpString=".pdf") returned 4 [0117.733] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0117.733] lstrlenW (lpString=".xls") returned 4 [0117.733] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0117.733] lstrlenW (lpString=".xlsx") returned 5 [0117.733] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0117.733] lstrlenW (lpString=".ppt") returned 4 [0117.733] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0117.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 63 [0117.733] lstrlenW (lpString=".zip") returned 4 [0117.733] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0117.733] lstrlenW (lpString=".rar") returned 4 [0117.733] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0117.733] lstrlenW (lpString=".bz2") returned 4 [0117.733] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0117.733] lstrlenW (lpString=".7z") returned 3 [0117.733] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0117.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 63 [0117.733] lstrlenW (lpString=".dbf") returned 4 [0117.733] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0117.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 63 [0117.733] lstrlenW (lpString=".1cd") returned 4 [0117.733] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0117.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 63 [0117.733] lstrlenW (lpString=".jpg") returned 4 [0117.733] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0117.733] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x342ff14 | out: lpFileSize=0x342ff14*=15308) returned 1 [0117.733] CloseHandle (hObject=0x1e0) returned 1 [0117.734] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00142_.gif")) returned 0x20 [0117.734] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00142_.gif.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0117.734] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00142_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0117.734] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0117.734] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0117.734] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00142_.gif.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0117.734] GetLastError () returned 0x0 [0117.734] ReadFile (in: hFile=0x1e0, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x3bcc, lpOverlapped=0x0) returned 1 [0117.749] WriteFile (in: hFile=0x20c, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0x3bd0, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0x3bd0, lpOverlapped=0x0) returned 1 [0117.749] ReadFile (in: hFile=0x1e0, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x0, lpOverlapped=0x0) returned 1 [0117.750] WriteFile (in: hFile=0x20c, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0xec, lpOverlapped=0x0) returned 1 [0117.750] SetEndOfFile (hFile=0x20c) returned 1 [0117.750] CloseHandle (hObject=0x20c) returned 1 [0117.750] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0117.750] SetEndOfFile (hFile=0x1e0) returned 1 [0117.750] CloseHandle (hObject=0x1e0) returned 1 [0117.751] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0117.751] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00142_.gif")) returned 1 [0117.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 63 [0117.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 63 [0117.751] lstrlenW (lpString=".doc") returned 4 [0117.751] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0117.751] lstrlenW (lpString=".docx") returned 5 [0117.751] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0117.751] lstrlenW (lpString=".pdf") returned 4 [0117.751] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0117.751] lstrlenW (lpString=".xls") returned 4 [0117.751] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0117.751] lstrlenW (lpString=".xlsx") returned 5 [0117.751] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0117.751] lstrlenW (lpString=".ppt") returned 4 [0117.751] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0117.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 63 [0117.751] lstrlenW (lpString=".zip") returned 4 [0117.751] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0117.751] lstrlenW (lpString=".rar") returned 4 [0117.751] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0117.751] lstrlenW (lpString=".bz2") returned 4 [0117.751] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0117.751] lstrlenW (lpString=".7z") returned 3 [0117.751] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0117.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 63 [0117.751] lstrlenW (lpString=".dbf") returned 4 [0117.751] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0117.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 63 [0117.751] lstrlenW (lpString=".1cd") returned 4 [0117.751] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0117.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 63 [0117.752] lstrlenW (lpString=".jpg") returned 4 [0117.752] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0117.752] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x342ff14 | out: lpFileSize=0x342ff14*=4955) returned 1 [0117.752] CloseHandle (hObject=0x1e0) returned 1 [0117.752] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00157_.gif")) returned 0x20 [0117.752] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00157_.gif.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0117.752] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00157_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0117.752] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0117.753] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0117.753] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00157_.gif.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0117.753] GetLastError () returned 0x0 [0117.753] ReadFile (in: hFile=0x1e0, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x135b, lpOverlapped=0x0) returned 1 [0117.761] WriteFile (in: hFile=0x20c, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0x1360, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0x1360, lpOverlapped=0x0) returned 1 [0117.762] ReadFile (in: hFile=0x1e0, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x0, lpOverlapped=0x0) returned 1 [0117.762] WriteFile (in: hFile=0x20c, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0xec, lpOverlapped=0x0) returned 1 [0117.762] SetEndOfFile (hFile=0x20c) returned 1 [0117.762] CloseHandle (hObject=0x20c) returned 1 [0117.762] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0117.762] SetEndOfFile (hFile=0x1e0) returned 1 [0117.763] CloseHandle (hObject=0x1e0) returned 1 [0117.763] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0117.763] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00157_.gif")) returned 1 [0117.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 63 [0117.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 63 [0117.763] lstrlenW (lpString=".doc") returned 4 [0117.763] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0117.763] lstrlenW (lpString=".docx") returned 5 [0117.763] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0117.763] lstrlenW (lpString=".pdf") returned 4 [0117.763] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0117.763] lstrlenW (lpString=".xls") returned 4 [0117.763] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0117.763] lstrlenW (lpString=".xlsx") returned 5 [0117.763] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0117.763] lstrlenW (lpString=".ppt") returned 4 [0117.764] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0117.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 63 [0117.764] lstrlenW (lpString=".zip") returned 4 [0117.764] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0117.764] lstrlenW (lpString=".rar") returned 4 [0117.764] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0117.764] lstrlenW (lpString=".bz2") returned 4 [0117.764] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0117.764] lstrlenW (lpString=".7z") returned 3 [0117.764] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0117.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 63 [0117.764] lstrlenW (lpString=".dbf") returned 4 [0117.764] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0117.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 63 [0117.764] lstrlenW (lpString=".1cd") returned 4 [0117.764] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0117.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 63 [0117.764] lstrlenW (lpString=".jpg") returned 4 [0117.764] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0117.764] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x342ff14 | out: lpFileSize=0x342ff14*=1146) returned 1 [0117.764] CloseHandle (hObject=0x1e0) returned 1 [0117.764] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00160_.gif")) returned 0x20 [0117.764] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00160_.gif.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0117.764] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00160_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0117.765] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0117.765] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0117.765] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00160_.gif.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0117.765] GetLastError () returned 0x0 [0117.765] ReadFile (in: hFile=0x1e0, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x47a, lpOverlapped=0x0) returned 1 [0117.781] WriteFile (in: hFile=0x20c, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0x480, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0x480, lpOverlapped=0x0) returned 1 [0117.781] ReadFile (in: hFile=0x1e0, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x0, lpOverlapped=0x0) returned 1 [0117.781] WriteFile (in: hFile=0x20c, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0xec, lpOverlapped=0x0) returned 1 [0117.781] SetEndOfFile (hFile=0x20c) returned 1 [0117.781] CloseHandle (hObject=0x20c) returned 1 [0117.782] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0117.782] SetEndOfFile (hFile=0x1e0) returned 1 [0117.782] CloseHandle (hObject=0x1e0) returned 1 [0117.782] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0117.782] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00160_.gif")) returned 1 [0117.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 63 [0117.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 63 [0117.792] lstrlenW (lpString=".doc") returned 4 [0117.792] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0117.792] lstrlenW (lpString=".docx") returned 5 [0117.792] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0117.792] lstrlenW (lpString=".pdf") returned 4 [0117.792] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0117.792] lstrlenW (lpString=".xls") returned 4 [0117.792] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0117.792] lstrlenW (lpString=".xlsx") returned 5 [0117.792] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0117.792] lstrlenW (lpString=".ppt") returned 4 [0117.792] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0117.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 63 [0117.792] lstrlenW (lpString=".zip") returned 4 [0117.792] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0117.792] lstrlenW (lpString=".rar") returned 4 [0117.792] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0117.792] lstrlenW (lpString=".bz2") returned 4 [0117.792] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0117.792] lstrlenW (lpString=".7z") returned 3 [0117.792] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0117.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 63 [0117.792] lstrlenW (lpString=".dbf") returned 4 [0117.792] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0117.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 63 [0117.793] lstrlenW (lpString=".1cd") returned 4 [0117.793] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0117.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 63 [0117.793] lstrlenW (lpString=".jpg") returned 4 [0117.793] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0117.800] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x342ff14 | out: lpFileSize=0x342ff14*=8582) returned 1 [0117.800] CloseHandle (hObject=0x20c) returned 1 [0117.801] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00165_.gif")) returned 0x20 [0117.801] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00165_.gif.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0117.801] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00165_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0117.801] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0117.801] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0117.801] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00165_.gif.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0117.801] GetLastError () returned 0x0 [0117.801] ReadFile (in: hFile=0x20c, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x2186, lpOverlapped=0x0) returned 1 [0117.834] WriteFile (in: hFile=0x1f4, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0x2190, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0x2190, lpOverlapped=0x0) returned 1 [0117.835] ReadFile (in: hFile=0x20c, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x0, lpOverlapped=0x0) returned 1 [0117.835] WriteFile (in: hFile=0x1f4, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0xec, lpOverlapped=0x0) returned 1 [0117.835] SetEndOfFile (hFile=0x1f4) returned 1 [0117.835] CloseHandle (hObject=0x1f4) returned 1 [0117.835] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0117.835] SetEndOfFile (hFile=0x20c) returned 1 [0117.836] CloseHandle (hObject=0x20c) returned 1 [0117.836] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0117.836] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00165_.gif")) returned 1 [0117.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 63 [0117.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 63 [0117.836] lstrlenW (lpString=".doc") returned 4 [0117.836] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0117.836] lstrlenW (lpString=".docx") returned 5 [0117.836] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0117.836] lstrlenW (lpString=".pdf") returned 4 [0117.836] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0117.836] lstrlenW (lpString=".xls") returned 4 [0117.836] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0117.836] lstrlenW (lpString=".xlsx") returned 5 [0117.836] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0117.836] lstrlenW (lpString=".ppt") returned 4 [0117.836] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0117.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 63 [0117.836] lstrlenW (lpString=".zip") returned 4 [0117.836] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0117.836] lstrlenW (lpString=".rar") returned 4 [0117.837] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0117.837] lstrlenW (lpString=".bz2") returned 4 [0117.837] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0117.837] lstrlenW (lpString=".7z") returned 3 [0117.837] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0117.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 63 [0117.837] lstrlenW (lpString=".dbf") returned 4 [0117.837] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0117.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 63 [0117.837] lstrlenW (lpString=".1cd") returned 4 [0117.837] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0117.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 63 [0117.837] lstrlenW (lpString=".jpg") returned 4 [0117.837] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0117.837] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x342ff14 | out: lpFileSize=0x342ff14*=4390) returned 1 [0117.838] CloseHandle (hObject=0x20c) returned 1 [0117.838] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00172_.gif")) returned 0x20 [0117.838] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00172_.gif.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0117.838] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00172_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0117.838] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0117.838] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0117.838] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00172_.gif.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0117.838] GetLastError () returned 0x0 [0117.838] ReadFile (in: hFile=0x20c, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x1126, lpOverlapped=0x0) returned 1 [0117.857] WriteFile (in: hFile=0x1f4, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0x1130, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0x1130, lpOverlapped=0x0) returned 1 [0117.857] ReadFile (in: hFile=0x20c, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x0, lpOverlapped=0x0) returned 1 [0117.857] WriteFile (in: hFile=0x1f4, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0xec, lpOverlapped=0x0) returned 1 [0117.857] SetEndOfFile (hFile=0x1f4) returned 1 [0117.858] CloseHandle (hObject=0x1f4) returned 1 [0117.858] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0117.858] SetEndOfFile (hFile=0x20c) returned 1 [0117.858] CloseHandle (hObject=0x20c) returned 1 [0117.858] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0117.859] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00172_.gif")) returned 1 [0117.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 63 [0117.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 63 [0117.859] lstrlenW (lpString=".doc") returned 4 [0117.859] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0117.859] lstrlenW (lpString=".docx") returned 5 [0117.859] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0117.859] lstrlenW (lpString=".pdf") returned 4 [0117.859] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0117.859] lstrlenW (lpString=".xls") returned 4 [0117.859] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0117.859] lstrlenW (lpString=".xlsx") returned 5 [0117.859] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0117.859] lstrlenW (lpString=".ppt") returned 4 [0117.859] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0117.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 63 [0117.859] lstrlenW (lpString=".zip") returned 4 [0117.859] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0117.859] lstrlenW (lpString=".rar") returned 4 [0117.859] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0117.859] lstrlenW (lpString=".bz2") returned 4 [0117.859] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0117.859] lstrlenW (lpString=".7z") returned 3 [0117.859] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0117.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 63 [0117.859] lstrlenW (lpString=".dbf") returned 4 [0117.859] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0117.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 63 [0117.859] lstrlenW (lpString=".1cd") returned 4 [0117.859] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0117.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 63 [0117.859] lstrlenW (lpString=".jpg") returned 4 [0117.859] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0117.860] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x342ff14 | out: lpFileSize=0x342ff14*=3026) returned 1 [0117.860] CloseHandle (hObject=0x20c) returned 1 [0117.860] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00010_.wmf")) returned 0x20 [0117.860] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00010_.wmf.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0117.860] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00010_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0117.860] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0117.860] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0117.861] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00010_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0117.861] GetLastError () returned 0x0 [0117.861] ReadFile (in: hFile=0x20c, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0xbd2, lpOverlapped=0x0) returned 1 [0117.862] WriteFile (in: hFile=0x1f4, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0xbe0, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0xbe0, lpOverlapped=0x0) returned 1 [0117.863] ReadFile (in: hFile=0x20c, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x0, lpOverlapped=0x0) returned 1 [0117.863] WriteFile (in: hFile=0x1f4, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0xec, lpOverlapped=0x0) returned 1 [0117.863] SetEndOfFile (hFile=0x1f4) returned 1 [0117.863] CloseHandle (hObject=0x1f4) returned 1 [0117.863] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0117.863] SetEndOfFile (hFile=0x20c) returned 1 [0117.864] CloseHandle (hObject=0x20c) returned 1 [0117.864] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0117.864] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00010_.wmf")) returned 1 [0117.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 63 [0117.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 63 [0117.864] lstrlenW (lpString=".doc") returned 4 [0117.864] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0117.864] lstrlenW (lpString=".docx") returned 5 [0117.864] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0117.864] lstrlenW (lpString=".pdf") returned 4 [0117.864] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0117.864] lstrlenW (lpString=".xls") returned 4 [0117.864] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0117.865] lstrlenW (lpString=".xlsx") returned 5 [0117.865] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0117.865] lstrlenW (lpString=".ppt") returned 4 [0117.865] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0117.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 63 [0117.865] lstrlenW (lpString=".zip") returned 4 [0117.865] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0117.865] lstrlenW (lpString=".rar") returned 4 [0117.865] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0117.865] lstrlenW (lpString=".bz2") returned 4 [0117.865] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0117.865] lstrlenW (lpString=".7z") returned 3 [0117.865] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0117.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 63 [0117.865] lstrlenW (lpString=".dbf") returned 4 [0117.865] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0117.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 63 [0117.865] lstrlenW (lpString=".1cd") returned 4 [0117.865] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0117.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 63 [0117.865] lstrlenW (lpString=".jpg") returned 4 [0117.865] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0117.865] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x342ff14 | out: lpFileSize=0x342ff14*=4734) returned 1 [0117.865] CloseHandle (hObject=0x20c) returned 1 [0117.866] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00015_.wmf")) returned 0x20 [0117.866] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00015_.wmf.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0117.866] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00015_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0117.866] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0117.866] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0117.866] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00015_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0117.866] GetLastError () returned 0x0 [0117.866] ReadFile (in: hFile=0x20c, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x127e, lpOverlapped=0x0) returned 1 [0117.907] WriteFile (in: hFile=0x1f4, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0x1280, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0x1280, lpOverlapped=0x0) returned 1 [0117.908] ReadFile (in: hFile=0x20c, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x0, lpOverlapped=0x0) returned 1 [0117.908] WriteFile (in: hFile=0x1f4, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0xec, lpOverlapped=0x0) returned 1 [0117.908] SetEndOfFile (hFile=0x1f4) returned 1 [0117.908] CloseHandle (hObject=0x1f4) returned 1 [0117.908] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0117.908] SetEndOfFile (hFile=0x20c) returned 1 [0117.909] CloseHandle (hObject=0x20c) returned 1 [0117.909] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0117.909] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00015_.wmf")) returned 1 [0117.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 63 [0117.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 63 [0117.909] lstrlenW (lpString=".doc") returned 4 [0117.909] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0117.909] lstrlenW (lpString=".docx") returned 5 [0117.909] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0117.909] lstrlenW (lpString=".pdf") returned 4 [0117.909] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0117.909] lstrlenW (lpString=".xls") returned 4 [0117.909] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0117.910] lstrlenW (lpString=".xlsx") returned 5 [0117.910] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0117.910] lstrlenW (lpString=".ppt") returned 4 [0117.910] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0117.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 63 [0117.910] lstrlenW (lpString=".zip") returned 4 [0117.910] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0117.910] lstrlenW (lpString=".rar") returned 4 [0117.910] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0117.910] lstrlenW (lpString=".bz2") returned 4 [0117.910] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0117.910] lstrlenW (lpString=".7z") returned 3 [0117.910] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0117.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 63 [0117.910] lstrlenW (lpString=".dbf") returned 4 [0117.910] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0117.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 63 [0117.910] lstrlenW (lpString=".1cd") returned 4 [0117.910] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0117.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 63 [0117.910] lstrlenW (lpString=".jpg") returned 4 [0117.910] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0117.965] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0117.965] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0117.965] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00914_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0117.966] GetLastError () returned 0x0 [0117.966] ReadFile (in: hFile=0x218, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x2a50, lpOverlapped=0x0) returned 1 [0118.171] WriteFile (in: hFile=0x1d8, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0x2a60, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0x2a60, lpOverlapped=0x0) returned 1 [0118.173] ReadFile (in: hFile=0x218, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x0, lpOverlapped=0x0) returned 1 [0118.173] WriteFile (in: hFile=0x1d8, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0xec, lpOverlapped=0x0) returned 1 [0118.174] SetEndOfFile (hFile=0x1d8) returned 1 [0118.174] CloseHandle (hObject=0x1d8) returned 1 [0118.174] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0118.174] SetEndOfFile (hFile=0x218) returned 1 [0118.174] CloseHandle (hObject=0x218) returned 1 [0118.175] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0118.175] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00914_.wmf")) returned 1 [0118.175] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 63 [0118.175] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 63 [0118.175] lstrlenW (lpString=".doc") returned 4 [0118.175] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0118.175] lstrlenW (lpString=".docx") returned 5 [0118.175] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0118.175] lstrlenW (lpString=".pdf") returned 4 [0118.175] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0118.175] lstrlenW (lpString=".xls") returned 4 [0118.175] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0118.175] lstrlenW (lpString=".xlsx") returned 5 [0118.175] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0118.175] lstrlenW (lpString=".ppt") returned 4 [0118.175] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0118.176] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 63 [0118.176] lstrlenW (lpString=".zip") returned 4 [0118.176] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0118.176] lstrlenW (lpString=".rar") returned 4 [0118.176] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0118.176] lstrlenW (lpString=".bz2") returned 4 [0118.176] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0118.176] lstrlenW (lpString=".7z") returned 3 [0118.176] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0118.176] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 63 [0118.176] lstrlenW (lpString=".dbf") returned 4 [0118.176] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0118.176] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 63 [0118.176] lstrlenW (lpString=".1cd") returned 4 [0118.176] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0118.176] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 63 [0118.176] lstrlenW (lpString=".jpg") returned 4 [0118.176] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0118.176] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x342ff14 | out: lpFileSize=0x342ff14*=27858) returned 1 [0118.176] CloseHandle (hObject=0x218) returned 1 [0118.176] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01174_.wmf")) returned 0x20 [0118.176] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01174_.wmf.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0118.176] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01174_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0118.177] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0118.177] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0118.177] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01174_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0118.177] GetLastError () returned 0x0 [0118.177] ReadFile (in: hFile=0x218, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x6cd2, lpOverlapped=0x0) returned 1 [0118.178] WriteFile (in: hFile=0x1d8, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0x6ce0, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0x6ce0, lpOverlapped=0x0) returned 1 [0118.179] ReadFile (in: hFile=0x218, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x0, lpOverlapped=0x0) returned 1 [0118.179] WriteFile (in: hFile=0x1d8, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0xec, lpOverlapped=0x0) returned 1 [0118.179] SetEndOfFile (hFile=0x1d8) returned 1 [0118.179] CloseHandle (hObject=0x1d8) returned 1 [0118.179] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0118.179] SetEndOfFile (hFile=0x218) returned 1 [0118.180] CloseHandle (hObject=0x218) returned 1 [0118.180] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0118.180] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01174_.wmf")) returned 1 [0118.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 63 [0118.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 63 [0118.180] lstrlenW (lpString=".doc") returned 4 [0118.180] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0118.180] lstrlenW (lpString=".docx") returned 5 [0118.180] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0118.180] lstrlenW (lpString=".pdf") returned 4 [0118.180] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0118.180] lstrlenW (lpString=".xls") returned 4 [0118.181] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0118.181] lstrlenW (lpString=".xlsx") returned 5 [0118.181] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0118.181] lstrlenW (lpString=".ppt") returned 4 [0118.181] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0118.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 63 [0118.181] lstrlenW (lpString=".zip") returned 4 [0118.181] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0118.181] lstrlenW (lpString=".rar") returned 4 [0118.181] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0118.181] lstrlenW (lpString=".bz2") returned 4 [0118.181] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0118.181] lstrlenW (lpString=".7z") returned 3 [0118.181] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0118.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 63 [0118.181] lstrlenW (lpString=".dbf") returned 4 [0118.181] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0118.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 63 [0118.181] lstrlenW (lpString=".1cd") returned 4 [0118.181] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0118.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 63 [0118.181] lstrlenW (lpString=".jpg") returned 4 [0118.181] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0118.181] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x342ff14 | out: lpFileSize=0x342ff14*=3746) returned 1 [0118.181] CloseHandle (hObject=0x218) returned 1 [0118.181] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01184_.wmf")) returned 0x20 [0118.181] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01184_.wmf.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0118.181] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01184_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0118.182] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0118.182] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0118.182] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01184_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0118.182] GetLastError () returned 0x0 [0118.182] ReadFile (in: hFile=0x218, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0xea2, lpOverlapped=0x0) returned 1 [0118.383] WriteFile (in: hFile=0x1d8, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0xeb0, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0xeb0, lpOverlapped=0x0) returned 1 [0118.689] ReadFile (in: hFile=0x218, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x0, lpOverlapped=0x0) returned 1 [0118.689] WriteFile (in: hFile=0x1d8, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0xec, lpOverlapped=0x0) returned 1 [0118.689] SetEndOfFile (hFile=0x1d8) returned 1 [0118.689] CloseHandle (hObject=0x1d8) returned 1 [0118.689] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0118.689] SetEndOfFile (hFile=0x218) returned 1 [0118.869] CloseHandle (hObject=0x218) returned 1 [0118.959] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0118.959] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01184_.wmf")) returned 1 [0118.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 63 [0118.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 63 [0118.997] lstrlenW (lpString=".doc") returned 4 [0118.997] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0118.997] lstrlenW (lpString=".docx") returned 5 [0118.998] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0118.998] lstrlenW (lpString=".pdf") returned 4 [0118.998] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0118.998] lstrlenW (lpString=".xls") returned 4 [0118.998] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0118.998] lstrlenW (lpString=".xlsx") returned 5 [0118.998] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0118.998] lstrlenW (lpString=".ppt") returned 4 [0118.998] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0118.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 63 [0118.998] lstrlenW (lpString=".zip") returned 4 [0118.998] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0118.998] lstrlenW (lpString=".rar") returned 4 [0118.998] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0118.998] lstrlenW (lpString=".bz2") returned 4 [0118.998] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0118.998] lstrlenW (lpString=".7z") returned 3 [0118.998] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0118.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 63 [0118.998] lstrlenW (lpString=".dbf") returned 4 [0118.998] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0118.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 63 [0118.998] lstrlenW (lpString=".1cd") returned 4 [0118.998] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0118.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 63 [0118.998] lstrlenW (lpString=".jpg") returned 4 [0118.998] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0118.998] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0118.998] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0118.998] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01545_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0118.999] GetLastError () returned 0x0 [0118.999] ReadFile (in: hFile=0x1d8, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x1ccc, lpOverlapped=0x0) returned 1 [0119.022] WriteFile (in: hFile=0x16c, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0x1cd0, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0x1cd0, lpOverlapped=0x0) returned 1 [0119.023] ReadFile (in: hFile=0x1d8, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x0, lpOverlapped=0x0) returned 1 [0119.023] WriteFile (in: hFile=0x16c, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0xec, lpOverlapped=0x0) returned 1 [0119.023] SetEndOfFile (hFile=0x16c) returned 1 [0119.023] CloseHandle (hObject=0x16c) returned 1 [0119.023] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0119.023] SetEndOfFile (hFile=0x1d8) returned 1 [0119.023] CloseHandle (hObject=0x1d8) returned 1 [0119.024] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0119.024] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01545_.wmf")) returned 1 [0119.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 63 [0119.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 63 [0119.024] lstrlenW (lpString=".doc") returned 4 [0119.024] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0119.024] lstrlenW (lpString=".docx") returned 5 [0119.024] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0119.024] lstrlenW (lpString=".pdf") returned 4 [0119.024] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0119.024] lstrlenW (lpString=".xls") returned 4 [0119.024] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0119.024] lstrlenW (lpString=".xlsx") returned 5 [0119.024] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0119.024] lstrlenW (lpString=".ppt") returned 4 [0119.025] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0119.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 63 [0119.025] lstrlenW (lpString=".zip") returned 4 [0119.025] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0119.025] lstrlenW (lpString=".rar") returned 4 [0119.025] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0119.025] lstrlenW (lpString=".bz2") returned 4 [0119.025] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0119.025] lstrlenW (lpString=".7z") returned 3 [0119.025] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0119.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 63 [0119.025] lstrlenW (lpString=".dbf") returned 4 [0119.025] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0119.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 63 [0119.025] lstrlenW (lpString=".1cd") returned 4 [0119.025] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0119.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 63 [0119.025] lstrlenW (lpString=".jpg") returned 4 [0119.025] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0119.025] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x342ff14 | out: lpFileSize=0x342ff14*=6632) returned 1 [0119.025] CloseHandle (hObject=0x1d8) returned 1 [0119.025] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02559_.wmf")) returned 0x20 [0119.026] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02559_.wmf.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0119.026] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02559_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0119.026] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0119.026] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0119.026] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02559_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0119.026] GetLastError () returned 0x0 [0119.026] ReadFile (in: hFile=0x1d8, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x19e8, lpOverlapped=0x0) returned 1 [0119.039] WriteFile (in: hFile=0x16c, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0x19f0, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0x19f0, lpOverlapped=0x0) returned 1 [0119.040] ReadFile (in: hFile=0x1d8, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x0, lpOverlapped=0x0) returned 1 [0119.040] WriteFile (in: hFile=0x16c, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0xec, lpOverlapped=0x0) returned 1 [0119.040] SetEndOfFile (hFile=0x16c) returned 1 [0119.040] CloseHandle (hObject=0x16c) returned 1 [0119.040] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0119.040] SetEndOfFile (hFile=0x1d8) returned 1 [0119.041] CloseHandle (hObject=0x1d8) returned 1 [0119.041] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0119.041] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02559_.wmf")) returned 1 [0119.043] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 63 [0119.043] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 63 [0119.043] lstrlenW (lpString=".doc") returned 4 [0119.043] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0119.043] lstrlenW (lpString=".docx") returned 5 [0119.043] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0119.043] lstrlenW (lpString=".pdf") returned 4 [0119.043] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0119.043] lstrlenW (lpString=".xls") returned 4 [0119.043] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0119.043] lstrlenW (lpString=".xlsx") returned 5 [0119.043] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0119.043] lstrlenW (lpString=".ppt") returned 4 [0119.043] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0119.043] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 63 [0119.043] lstrlenW (lpString=".zip") returned 4 [0119.043] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0119.043] lstrlenW (lpString=".rar") returned 4 [0119.043] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0119.043] lstrlenW (lpString=".bz2") returned 4 [0119.043] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0119.043] lstrlenW (lpString=".7z") returned 3 [0119.043] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0119.043] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 63 [0119.043] lstrlenW (lpString=".dbf") returned 4 [0119.044] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0119.044] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 63 [0119.044] lstrlenW (lpString=".1cd") returned 4 [0119.044] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0119.044] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 63 [0119.044] lstrlenW (lpString=".jpg") returned 4 [0119.044] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0119.044] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x342ff14 | out: lpFileSize=0x342ff14*=9240) returned 1 [0119.044] CloseHandle (hObject=0x16c) returned 1 [0119.044] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an03500_.wmf")) returned 0x20 [0119.044] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an03500_.wmf.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0119.045] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an03500_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0119.045] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0119.045] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0119.045] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an03500_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0119.045] GetLastError () returned 0x0 [0119.045] ReadFile (in: hFile=0x16c, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x2418, lpOverlapped=0x0) returned 1 [0119.071] WriteFile (in: hFile=0x1e4, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0x2420, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0x2420, lpOverlapped=0x0) returned 1 [0119.072] ReadFile (in: hFile=0x16c, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x0, lpOverlapped=0x0) returned 1 [0119.072] WriteFile (in: hFile=0x1e4, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0xec, lpOverlapped=0x0) returned 1 [0119.072] SetEndOfFile (hFile=0x1e4) returned 1 [0119.072] CloseHandle (hObject=0x1e4) returned 1 [0119.072] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0119.072] SetEndOfFile (hFile=0x16c) returned 1 [0119.073] CloseHandle (hObject=0x16c) returned 1 [0119.073] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0119.073] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an03500_.wmf")) returned 1 [0119.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 63 [0119.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 63 [0119.073] lstrlenW (lpString=".doc") returned 4 [0119.073] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0119.073] lstrlenW (lpString=".docx") returned 5 [0119.073] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0119.073] lstrlenW (lpString=".pdf") returned 4 [0119.073] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0119.073] lstrlenW (lpString=".xls") returned 4 [0119.073] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0119.073] lstrlenW (lpString=".xlsx") returned 5 [0119.073] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0119.073] lstrlenW (lpString=".ppt") returned 4 [0119.073] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0119.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 63 [0119.073] lstrlenW (lpString=".zip") returned 4 [0119.073] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0119.073] lstrlenW (lpString=".rar") returned 4 [0119.073] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0119.073] lstrlenW (lpString=".bz2") returned 4 [0119.073] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0119.073] lstrlenW (lpString=".7z") returned 3 [0119.073] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0119.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 63 [0119.073] lstrlenW (lpString=".dbf") returned 4 [0119.073] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0119.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 63 [0119.073] lstrlenW (lpString=".1cd") returned 4 [0119.074] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0119.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 63 [0119.074] lstrlenW (lpString=".jpg") returned 4 [0119.074] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0119.074] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x342ff14 | out: lpFileSize=0x342ff14*=2344) returned 1 [0119.074] CloseHandle (hObject=0x16c) returned 1 [0119.074] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04108_.wmf")) returned 0x20 [0119.074] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04108_.wmf.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0119.074] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04108_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0119.074] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0119.075] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0119.075] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04108_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0119.075] GetLastError () returned 0x0 [0119.075] ReadFile (in: hFile=0x16c, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x928, lpOverlapped=0x0) returned 1 [0119.081] WriteFile (in: hFile=0x1e4, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0x930, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0x930, lpOverlapped=0x0) returned 1 [0119.082] ReadFile (in: hFile=0x16c, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x0, lpOverlapped=0x0) returned 1 [0119.082] WriteFile (in: hFile=0x1e4, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0xec, lpOverlapped=0x0) returned 1 [0119.082] SetEndOfFile (hFile=0x1e4) returned 1 [0119.082] CloseHandle (hObject=0x1e4) returned 1 [0119.082] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0119.082] SetEndOfFile (hFile=0x16c) returned 1 [0119.083] CloseHandle (hObject=0x16c) returned 1 [0119.083] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0119.083] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04108_.wmf")) returned 1 [0119.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 63 [0119.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 63 [0119.083] lstrlenW (lpString=".doc") returned 4 [0119.083] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0119.083] lstrlenW (lpString=".docx") returned 5 [0119.083] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0119.083] lstrlenW (lpString=".pdf") returned 4 [0119.083] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0119.083] lstrlenW (lpString=".xls") returned 4 [0119.083] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0119.083] lstrlenW (lpString=".xlsx") returned 5 [0119.083] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0119.083] lstrlenW (lpString=".ppt") returned 4 [0119.083] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0119.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 63 [0119.083] lstrlenW (lpString=".zip") returned 4 [0119.084] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0119.084] lstrlenW (lpString=".rar") returned 4 [0119.084] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0119.084] lstrlenW (lpString=".bz2") returned 4 [0119.084] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0119.084] lstrlenW (lpString=".7z") returned 3 [0119.084] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0119.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 63 [0119.084] lstrlenW (lpString=".dbf") returned 4 [0119.084] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0119.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 63 [0119.084] lstrlenW (lpString=".1cd") returned 4 [0119.084] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0119.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 63 [0119.084] lstrlenW (lpString=".jpg") returned 4 [0119.084] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0119.084] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x342ff14 | out: lpFileSize=0x342ff14*=3416) returned 1 [0119.084] CloseHandle (hObject=0x16c) returned 1 [0119.085] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04134_.wmf")) returned 0x20 [0119.085] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04134_.wmf.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0119.085] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04134_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0119.085] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0119.085] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0119.085] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04134_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0119.085] GetLastError () returned 0x0 [0119.085] ReadFile (in: hFile=0x16c, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0xd58, lpOverlapped=0x0) returned 1 [0119.141] WriteFile (in: hFile=0x1e4, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0xd60, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0xd60, lpOverlapped=0x0) returned 1 [0119.141] ReadFile (in: hFile=0x16c, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x0, lpOverlapped=0x0) returned 1 [0119.141] WriteFile (in: hFile=0x1e4, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0xec, lpOverlapped=0x0) returned 1 [0119.141] SetEndOfFile (hFile=0x1e4) returned 1 [0119.141] CloseHandle (hObject=0x1e4) returned 1 [0119.142] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0119.142] SetEndOfFile (hFile=0x16c) returned 1 [0119.142] CloseHandle (hObject=0x16c) returned 1 [0119.142] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0119.142] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04134_.wmf")) returned 1 [0119.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 63 [0119.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 63 [0119.153] lstrlenW (lpString=".doc") returned 4 [0119.153] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0119.153] lstrlenW (lpString=".docx") returned 5 [0119.153] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0119.153] lstrlenW (lpString=".pdf") returned 4 [0119.153] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0119.153] lstrlenW (lpString=".xls") returned 4 [0119.153] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0119.153] lstrlenW (lpString=".xlsx") returned 5 [0119.153] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0119.153] lstrlenW (lpString=".ppt") returned 4 [0119.153] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0119.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 63 [0119.153] lstrlenW (lpString=".zip") returned 4 [0119.153] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0119.153] lstrlenW (lpString=".rar") returned 4 [0119.153] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0119.153] lstrlenW (lpString=".bz2") returned 4 [0119.153] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0119.153] lstrlenW (lpString=".7z") returned 3 [0119.153] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0119.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 63 [0119.153] lstrlenW (lpString=".dbf") returned 4 [0119.153] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0119.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 63 [0119.153] lstrlenW (lpString=".1cd") returned 4 [0119.153] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0119.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 63 [0119.153] lstrlenW (lpString=".jpg") returned 4 [0119.153] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0119.154] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0119.155] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0119.155] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04191_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0119.155] GetLastError () returned 0x0 [0119.155] ReadFile (in: hFile=0x16c, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x19ec, lpOverlapped=0x0) returned 1 [0119.243] WriteFile (in: hFile=0x1e4, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0x19f0, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0x19f0, lpOverlapped=0x0) returned 1 [0119.244] ReadFile (in: hFile=0x16c, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x0, lpOverlapped=0x0) returned 1 [0119.244] WriteFile (in: hFile=0x1e4, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0xec, lpOverlapped=0x0) returned 1 [0119.244] SetEndOfFile (hFile=0x1e4) returned 1 [0119.244] CloseHandle (hObject=0x1e4) returned 1 [0119.244] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0119.245] SetEndOfFile (hFile=0x16c) returned 1 [0119.245] CloseHandle (hObject=0x16c) returned 1 [0119.245] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0119.245] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04191_.wmf")) returned 1 [0119.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 63 [0119.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 63 [0119.246] lstrlenW (lpString=".doc") returned 4 [0119.246] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0119.246] lstrlenW (lpString=".docx") returned 5 [0119.246] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0119.246] lstrlenW (lpString=".pdf") returned 4 [0119.246] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0119.246] lstrlenW (lpString=".xls") returned 4 [0119.246] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0119.246] lstrlenW (lpString=".xlsx") returned 5 [0119.246] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0119.246] lstrlenW (lpString=".ppt") returned 4 [0119.246] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0119.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 63 [0119.246] lstrlenW (lpString=".zip") returned 4 [0119.246] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0119.246] lstrlenW (lpString=".rar") returned 4 [0119.246] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0119.246] lstrlenW (lpString=".bz2") returned 4 [0119.246] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0119.246] lstrlenW (lpString=".7z") returned 3 [0119.246] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0119.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 63 [0119.246] lstrlenW (lpString=".dbf") returned 4 [0119.246] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0119.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 63 [0119.246] lstrlenW (lpString=".1cd") returned 4 [0119.246] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0119.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 63 [0119.246] lstrlenW (lpString=".jpg") returned 4 [0119.246] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0119.247] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x342ff14 | out: lpFileSize=0x342ff14*=8492) returned 1 [0119.247] CloseHandle (hObject=0x16c) returned 1 [0119.247] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04225_.wmf")) returned 0x20 [0119.247] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04225_.wmf.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0119.247] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04225_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0119.247] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0119.247] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0119.247] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04225_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0119.247] GetLastError () returned 0x0 [0119.247] ReadFile (in: hFile=0x16c, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x212c, lpOverlapped=0x0) returned 1 [0119.262] WriteFile (in: hFile=0x1e4, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0x2130, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0x2130, lpOverlapped=0x0) returned 1 [0119.262] ReadFile (in: hFile=0x16c, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x0, lpOverlapped=0x0) returned 1 [0119.262] WriteFile (in: hFile=0x1e4, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0xec, lpOverlapped=0x0) returned 1 [0119.263] SetEndOfFile (hFile=0x1e4) returned 1 [0119.263] CloseHandle (hObject=0x1e4) returned 1 [0119.263] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0119.263] SetEndOfFile (hFile=0x16c) returned 1 [0119.263] CloseHandle (hObject=0x16c) returned 1 [0119.263] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0119.264] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04225_.wmf")) returned 1 [0119.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 63 [0119.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 63 [0119.264] lstrlenW (lpString=".doc") returned 4 [0119.264] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0119.264] lstrlenW (lpString=".docx") returned 5 [0119.264] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0119.264] lstrlenW (lpString=".pdf") returned 4 [0119.264] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0119.264] lstrlenW (lpString=".xls") returned 4 [0119.264] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0119.264] lstrlenW (lpString=".xlsx") returned 5 [0119.264] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0119.264] lstrlenW (lpString=".ppt") returned 4 [0119.264] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0119.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 63 [0119.264] lstrlenW (lpString=".zip") returned 4 [0119.264] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0119.264] lstrlenW (lpString=".rar") returned 4 [0119.264] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0119.264] lstrlenW (lpString=".bz2") returned 4 [0119.264] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0119.264] lstrlenW (lpString=".7z") returned 3 [0119.264] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0119.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 63 [0119.264] lstrlenW (lpString=".dbf") returned 4 [0119.264] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0119.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 63 [0119.265] lstrlenW (lpString=".1cd") returned 4 [0119.265] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0119.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 63 [0119.265] lstrlenW (lpString=".jpg") returned 4 [0119.265] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0119.265] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x342ff14 | out: lpFileSize=0x342ff14*=7804) returned 1 [0119.265] CloseHandle (hObject=0x16c) returned 1 [0119.265] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04235_.wmf")) returned 0x20 [0119.265] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04235_.wmf.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0119.265] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04235_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0119.266] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0119.266] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0119.266] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04235_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0119.469] GetLastError () returned 0x0 [0119.469] ReadFile (in: hFile=0x16c, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x1e7c, lpOverlapped=0x0) returned 1 [0119.494] WriteFile (in: hFile=0x194, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0x1e80, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0x1e80, lpOverlapped=0x0) returned 1 [0119.495] ReadFile (in: hFile=0x16c, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x0, lpOverlapped=0x0) returned 1 [0119.495] WriteFile (in: hFile=0x194, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0xec, lpOverlapped=0x0) returned 1 [0119.495] SetEndOfFile (hFile=0x194) returned 1 [0119.495] CloseHandle (hObject=0x194) returned 1 [0119.495] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0119.495] SetEndOfFile (hFile=0x16c) returned 1 [0119.496] CloseHandle (hObject=0x16c) returned 1 [0119.496] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0119.496] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04235_.wmf")) returned 1 [0119.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 63 [0119.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 63 [0119.496] lstrlenW (lpString=".doc") returned 4 [0119.496] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0119.496] lstrlenW (lpString=".docx") returned 5 [0119.496] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0119.496] lstrlenW (lpString=".pdf") returned 4 [0119.496] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0119.496] lstrlenW (lpString=".xls") returned 4 [0119.496] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0119.496] lstrlenW (lpString=".xlsx") returned 5 [0119.496] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0119.496] lstrlenW (lpString=".ppt") returned 4 [0119.496] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0119.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 63 [0119.497] lstrlenW (lpString=".zip") returned 4 [0119.497] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0119.497] lstrlenW (lpString=".rar") returned 4 [0119.497] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0119.497] lstrlenW (lpString=".bz2") returned 4 [0119.497] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0119.497] lstrlenW (lpString=".7z") returned 3 [0119.497] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0119.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 63 [0119.497] lstrlenW (lpString=".dbf") returned 4 [0119.497] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0119.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 63 [0119.497] lstrlenW (lpString=".1cd") returned 4 [0119.497] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0119.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 63 [0119.497] lstrlenW (lpString=".jpg") returned 4 [0119.497] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0119.497] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x342ff14 | out: lpFileSize=0x342ff14*=7804) returned 1 [0119.497] CloseHandle (hObject=0x16c) returned 1 [0119.498] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04267_.wmf")) returned 0x20 [0119.499] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04267_.wmf.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0119.499] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04267_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0119.499] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0119.499] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0119.499] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04267_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0119.499] GetLastError () returned 0x0 [0119.499] ReadFile (in: hFile=0x16c, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x1e7c, lpOverlapped=0x0) returned 1 [0119.528] WriteFile (in: hFile=0x194, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0x1e80, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0x1e80, lpOverlapped=0x0) returned 1 [0119.529] ReadFile (in: hFile=0x16c, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x0, lpOverlapped=0x0) returned 1 [0119.529] WriteFile (in: hFile=0x194, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0xec, lpOverlapped=0x0) returned 1 [0119.529] SetEndOfFile (hFile=0x194) returned 1 [0119.529] CloseHandle (hObject=0x194) returned 1 [0119.529] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0119.529] SetEndOfFile (hFile=0x16c) returned 1 [0119.530] CloseHandle (hObject=0x16c) returned 1 [0119.530] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0119.530] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04267_.wmf")) returned 1 [0119.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 63 [0119.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 63 [0119.530] lstrlenW (lpString=".doc") returned 4 [0119.531] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0119.531] lstrlenW (lpString=".docx") returned 5 [0119.531] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0119.531] lstrlenW (lpString=".pdf") returned 4 [0119.531] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0119.531] lstrlenW (lpString=".xls") returned 4 [0119.531] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0119.531] lstrlenW (lpString=".xlsx") returned 5 [0119.531] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0119.531] lstrlenW (lpString=".ppt") returned 4 [0119.531] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0119.531] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 63 [0119.531] lstrlenW (lpString=".zip") returned 4 [0119.531] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0119.531] lstrlenW (lpString=".rar") returned 4 [0119.531] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0119.531] lstrlenW (lpString=".bz2") returned 4 [0119.531] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0119.531] lstrlenW (lpString=".7z") returned 3 [0119.531] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0119.531] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 63 [0119.531] lstrlenW (lpString=".dbf") returned 4 [0119.531] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0119.531] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 63 [0119.531] lstrlenW (lpString=".1cd") returned 4 [0119.531] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0119.531] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 63 [0119.531] lstrlenW (lpString=".jpg") returned 4 [0119.531] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0119.531] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x342ff14 | out: lpFileSize=0x342ff14*=3228) returned 1 [0119.531] CloseHandle (hObject=0x16c) returned 1 [0119.532] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04355_.wmf")) returned 0x20 [0119.532] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04355_.wmf.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0119.532] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04355_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0119.532] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0119.532] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0119.532] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04355_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0119.532] GetLastError () returned 0x0 [0119.532] ReadFile (in: hFile=0x16c, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0xc9c, lpOverlapped=0x0) returned 1 [0119.608] WriteFile (in: hFile=0x194, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0xca0, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0xca0, lpOverlapped=0x0) returned 1 [0119.608] ReadFile (in: hFile=0x16c, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x0, lpOverlapped=0x0) returned 1 [0119.609] WriteFile (in: hFile=0x194, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0xec, lpOverlapped=0x0) returned 1 [0119.609] SetEndOfFile (hFile=0x194) returned 1 [0119.609] CloseHandle (hObject=0x194) returned 1 [0119.609] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0119.609] SetEndOfFile (hFile=0x16c) returned 1 [0119.609] CloseHandle (hObject=0x16c) returned 1 [0119.609] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0119.615] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04355_.wmf")) returned 1 [0119.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 63 [0119.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 63 [0119.615] lstrlenW (lpString=".doc") returned 4 [0119.615] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0119.615] lstrlenW (lpString=".docx") returned 5 [0119.615] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0119.615] lstrlenW (lpString=".pdf") returned 4 [0119.615] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0119.615] lstrlenW (lpString=".xls") returned 4 [0119.615] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0119.615] lstrlenW (lpString=".xlsx") returned 5 [0119.615] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0119.615] lstrlenW (lpString=".ppt") returned 4 [0119.615] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0119.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 63 [0119.615] lstrlenW (lpString=".zip") returned 4 [0119.615] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0119.615] lstrlenW (lpString=".rar") returned 4 [0119.615] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0119.615] lstrlenW (lpString=".bz2") returned 4 [0119.615] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0119.615] lstrlenW (lpString=".7z") returned 3 [0119.615] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0119.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 63 [0119.615] lstrlenW (lpString=".dbf") returned 4 [0119.615] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0119.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 63 [0119.615] lstrlenW (lpString=".1cd") returned 4 [0119.615] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0119.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 63 [0119.616] lstrlenW (lpString=".jpg") returned 4 [0119.616] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0119.672] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x342ff14 | out: lpFileSize=0x342ff14*=4870) returned 1 [0119.673] CloseHandle (hObject=0x19c) returned 1 [0119.673] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00116_.wmf")) returned 0x20 [0119.673] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00116_.wmf.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0119.673] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00116_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0119.673] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0119.673] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0119.673] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00116_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0119.673] GetLastError () returned 0x0 [0119.673] ReadFile (in: hFile=0x19c, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x1306, lpOverlapped=0x0) returned 1 [0119.704] WriteFile (in: hFile=0x1f4, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0x1310, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0x1310, lpOverlapped=0x0) returned 1 [0119.704] ReadFile (in: hFile=0x19c, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x0, lpOverlapped=0x0) returned 1 [0119.704] WriteFile (in: hFile=0x1f4, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0xec, lpOverlapped=0x0) returned 1 [0119.705] SetEndOfFile (hFile=0x1f4) returned 1 [0119.705] CloseHandle (hObject=0x1f4) returned 1 [0119.705] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0119.705] SetEndOfFile (hFile=0x19c) returned 1 [0119.705] CloseHandle (hObject=0x19c) returned 1 [0119.705] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0119.706] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00116_.wmf")) returned 1 [0119.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 63 [0119.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 63 [0119.706] lstrlenW (lpString=".doc") returned 4 [0119.706] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0119.706] lstrlenW (lpString=".docx") returned 5 [0119.706] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0119.706] lstrlenW (lpString=".pdf") returned 4 [0119.706] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0119.706] lstrlenW (lpString=".xls") returned 4 [0119.706] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0119.706] lstrlenW (lpString=".xlsx") returned 5 [0119.706] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0119.706] lstrlenW (lpString=".ppt") returned 4 [0119.706] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0119.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 63 [0119.706] lstrlenW (lpString=".zip") returned 4 [0119.706] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0119.706] lstrlenW (lpString=".rar") returned 4 [0119.706] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0119.706] lstrlenW (lpString=".bz2") returned 4 [0119.706] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0119.706] lstrlenW (lpString=".7z") returned 3 [0119.706] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0119.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 63 [0119.706] lstrlenW (lpString=".dbf") returned 4 [0119.706] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0119.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 63 [0119.706] lstrlenW (lpString=".1cd") returned 4 [0119.706] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0119.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 63 [0119.707] lstrlenW (lpString=".jpg") returned 4 [0119.707] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0119.771] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0119.771] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0119.771] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00160_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0119.771] GetLastError () returned 0x0 [0119.771] ReadFile (in: hFile=0x19c, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x57f4, lpOverlapped=0x0) returned 1 [0119.810] WriteFile (in: hFile=0x218, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0x5800, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0x5800, lpOverlapped=0x0) returned 1 [0119.810] ReadFile (in: hFile=0x19c, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x0, lpOverlapped=0x0) returned 1 [0119.811] WriteFile (in: hFile=0x218, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0xec, lpOverlapped=0x0) returned 1 [0119.811] SetEndOfFile (hFile=0x218) returned 1 [0119.811] CloseHandle (hObject=0x218) returned 1 [0119.811] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0119.811] SetEndOfFile (hFile=0x19c) returned 1 [0119.812] CloseHandle (hObject=0x19c) returned 1 [0119.812] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0119.812] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00160_.wmf")) returned 1 [0119.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 63 [0119.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 63 [0119.812] lstrlenW (lpString=".doc") returned 4 [0119.812] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0119.812] lstrlenW (lpString=".docx") returned 5 [0119.812] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0119.812] lstrlenW (lpString=".pdf") returned 4 [0119.812] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0119.812] lstrlenW (lpString=".xls") returned 4 [0119.813] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0119.813] lstrlenW (lpString=".xlsx") returned 5 [0119.813] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0119.813] lstrlenW (lpString=".ppt") returned 4 [0119.813] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0119.813] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 63 [0119.813] lstrlenW (lpString=".zip") returned 4 [0119.813] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0119.813] lstrlenW (lpString=".rar") returned 4 [0119.813] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0119.813] lstrlenW (lpString=".bz2") returned 4 [0119.813] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0119.813] lstrlenW (lpString=".7z") returned 3 [0119.813] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0119.813] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 63 [0119.813] lstrlenW (lpString=".dbf") returned 4 [0119.813] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0119.813] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 63 [0119.813] lstrlenW (lpString=".1cd") returned 4 [0119.813] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0119.813] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 63 [0119.813] lstrlenW (lpString=".jpg") returned 4 [0119.813] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0119.813] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x342ff14 | out: lpFileSize=0x342ff14*=24320) returned 1 [0119.813] CloseHandle (hObject=0x19c) returned 1 [0119.813] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08758_.wmf")) returned 0x20 [0119.813] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08758_.wmf.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0119.814] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08758_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0119.814] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0119.814] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0119.814] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08758_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0119.814] GetLastError () returned 0x0 [0119.814] ReadFile (in: hFile=0x19c, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x5f00, lpOverlapped=0x0) returned 1 [0119.846] WriteFile (in: hFile=0x218, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0x5f10, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0x5f10, lpOverlapped=0x0) returned 1 [0119.847] ReadFile (in: hFile=0x19c, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x0, lpOverlapped=0x0) returned 1 [0119.847] WriteFile (in: hFile=0x218, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0xec, lpOverlapped=0x0) returned 1 [0119.848] SetEndOfFile (hFile=0x218) returned 1 [0119.848] CloseHandle (hObject=0x218) returned 1 [0119.848] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0119.848] SetEndOfFile (hFile=0x19c) returned 1 [0119.848] CloseHandle (hObject=0x19c) returned 1 [0119.848] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0119.849] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08758_.wmf")) returned 1 [0119.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 63 [0119.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 63 [0119.849] lstrlenW (lpString=".doc") returned 4 [0119.849] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0119.849] lstrlenW (lpString=".docx") returned 5 [0119.849] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0119.849] lstrlenW (lpString=".pdf") returned 4 [0119.849] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0119.849] lstrlenW (lpString=".xls") returned 4 [0119.849] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0119.849] lstrlenW (lpString=".xlsx") returned 5 [0119.849] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0119.849] lstrlenW (lpString=".ppt") returned 4 [0119.849] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0119.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 63 [0119.849] lstrlenW (lpString=".zip") returned 4 [0119.849] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0119.849] lstrlenW (lpString=".rar") returned 4 [0119.849] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0119.849] lstrlenW (lpString=".bz2") returned 4 [0119.849] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0119.849] lstrlenW (lpString=".7z") returned 3 [0119.849] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0119.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 63 [0119.849] lstrlenW (lpString=".dbf") returned 4 [0119.850] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0119.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 63 [0119.850] lstrlenW (lpString=".1cd") returned 4 [0119.850] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0119.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 63 [0119.850] lstrlenW (lpString=".jpg") returned 4 [0119.850] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0119.850] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x342ff14 | out: lpFileSize=0x342ff14*=40206) returned 1 [0119.850] CloseHandle (hObject=0x19c) returned 1 [0119.850] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08868_.wmf")) returned 0x20 [0119.850] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08868_.wmf.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0119.850] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08868_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0119.850] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0119.850] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0119.850] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08868_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0119.851] GetLastError () returned 0x0 [0119.851] ReadFile (in: hFile=0x19c, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x9d0e, lpOverlapped=0x0) returned 1 [0119.876] WriteFile (in: hFile=0x218, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0x9d10, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0x9d10, lpOverlapped=0x0) returned 1 [0119.877] ReadFile (in: hFile=0x19c, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x0, lpOverlapped=0x0) returned 1 [0119.877] WriteFile (in: hFile=0x218, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0xec, lpOverlapped=0x0) returned 1 [0119.877] SetEndOfFile (hFile=0x218) returned 1 [0119.877] CloseHandle (hObject=0x218) returned 1 [0119.877] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0119.877] SetEndOfFile (hFile=0x19c) returned 1 [0119.878] CloseHandle (hObject=0x19c) returned 1 [0119.878] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0119.878] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08868_.wmf")) returned 1 [0119.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 63 [0119.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 63 [0119.878] lstrlenW (lpString=".doc") returned 4 [0119.878] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0119.878] lstrlenW (lpString=".docx") returned 5 [0119.878] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0119.878] lstrlenW (lpString=".pdf") returned 4 [0119.878] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0119.878] lstrlenW (lpString=".xls") returned 4 [0119.879] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0119.879] lstrlenW (lpString=".xlsx") returned 5 [0119.879] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0119.879] lstrlenW (lpString=".ppt") returned 4 [0119.879] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0119.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 63 [0119.879] lstrlenW (lpString=".zip") returned 4 [0119.879] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0119.879] lstrlenW (lpString=".rar") returned 4 [0119.879] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0119.879] lstrlenW (lpString=".bz2") returned 4 [0119.879] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0119.879] lstrlenW (lpString=".7z") returned 3 [0119.879] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0119.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 63 [0119.879] lstrlenW (lpString=".dbf") returned 4 [0119.879] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0119.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 63 [0119.879] lstrlenW (lpString=".1cd") returned 4 [0119.879] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0119.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 63 [0119.879] lstrlenW (lpString=".jpg") returned 4 [0119.879] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0119.879] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x342ff14 | out: lpFileSize=0x342ff14*=7966) returned 1 [0119.879] CloseHandle (hObject=0x19c) returned 1 [0119.879] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09664_.wmf")) returned 0x20 [0119.880] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09664_.wmf.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0119.880] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09664_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0119.880] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0119.880] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0119.880] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09664_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0119.880] GetLastError () returned 0x0 [0119.880] ReadFile (in: hFile=0x19c, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x1f1e, lpOverlapped=0x0) returned 1 [0119.894] WriteFile (in: hFile=0x218, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0x1f20, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0x1f20, lpOverlapped=0x0) returned 1 [0119.895] ReadFile (in: hFile=0x19c, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x0, lpOverlapped=0x0) returned 1 [0119.895] WriteFile (in: hFile=0x218, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0xec, lpOverlapped=0x0) returned 1 [0119.895] SetEndOfFile (hFile=0x218) returned 1 [0119.895] CloseHandle (hObject=0x218) returned 1 [0119.895] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0119.895] SetEndOfFile (hFile=0x19c) returned 1 [0119.896] CloseHandle (hObject=0x19c) returned 1 [0119.896] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0119.896] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09664_.wmf")) returned 1 [0119.896] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 63 [0119.896] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 63 [0119.896] lstrlenW (lpString=".doc") returned 4 [0119.896] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0119.896] lstrlenW (lpString=".docx") returned 5 [0119.896] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0119.896] lstrlenW (lpString=".pdf") returned 4 [0119.896] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0119.896] lstrlenW (lpString=".xls") returned 4 [0119.896] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0119.896] lstrlenW (lpString=".xlsx") returned 5 [0119.896] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0119.896] lstrlenW (lpString=".ppt") returned 4 [0119.896] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0119.896] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 63 [0119.896] lstrlenW (lpString=".zip") returned 4 [0119.896] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0119.896] lstrlenW (lpString=".rar") returned 4 [0119.896] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0119.896] lstrlenW (lpString=".bz2") returned 4 [0119.896] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0119.896] lstrlenW (lpString=".7z") returned 3 [0119.896] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0119.896] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 63 [0119.897] lstrlenW (lpString=".dbf") returned 4 [0119.897] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0119.897] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 63 [0119.897] lstrlenW (lpString=".1cd") returned 4 [0119.897] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0119.897] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 63 [0119.897] lstrlenW (lpString=".jpg") returned 4 [0119.897] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0119.902] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0119.902] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0119.902] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10972_.gif.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0119.903] GetLastError () returned 0x0 [0119.903] ReadFile (in: hFile=0x19c, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x4edd, lpOverlapped=0x0) returned 1 [0119.913] WriteFile (in: hFile=0x218, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0x4ee0, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0x4ee0, lpOverlapped=0x0) returned 1 [0119.914] ReadFile (in: hFile=0x19c, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x0, lpOverlapped=0x0) returned 1 [0119.914] WriteFile (in: hFile=0x218, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0xec, lpOverlapped=0x0) returned 1 [0119.914] SetEndOfFile (hFile=0x218) returned 1 [0119.914] CloseHandle (hObject=0x218) returned 1 [0119.914] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0119.914] SetEndOfFile (hFile=0x19c) returned 1 [0119.915] CloseHandle (hObject=0x19c) returned 1 [0119.916] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0119.916] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10972_.gif")) returned 1 [0119.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 63 [0119.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 63 [0119.916] lstrlenW (lpString=".doc") returned 4 [0119.916] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0119.916] lstrlenW (lpString=".docx") returned 5 [0119.916] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0119.916] lstrlenW (lpString=".pdf") returned 4 [0119.916] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0119.916] lstrlenW (lpString=".xls") returned 4 [0119.916] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0119.916] lstrlenW (lpString=".xlsx") returned 5 [0119.916] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0119.916] lstrlenW (lpString=".ppt") returned 4 [0119.916] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0119.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 63 [0119.916] lstrlenW (lpString=".zip") returned 4 [0119.916] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0119.916] lstrlenW (lpString=".rar") returned 4 [0119.916] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0119.916] lstrlenW (lpString=".bz2") returned 4 [0119.916] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0119.916] lstrlenW (lpString=".7z") returned 3 [0119.916] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0119.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 63 [0119.916] lstrlenW (lpString=".dbf") returned 4 [0119.916] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0119.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 63 [0119.917] lstrlenW (lpString=".1cd") returned 4 [0119.917] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0119.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 63 [0119.917] lstrlenW (lpString=".jpg") returned 4 [0119.917] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0120.067] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x342ff14 | out: lpFileSize=0x342ff14*=15733) returned 1 [0120.067] CloseHandle (hObject=0x1e0) returned 1 [0120.067] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19582_.gif")) returned 0x20 [0120.067] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19582_.gif.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0120.068] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19582_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0120.068] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0120.068] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0120.068] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19582_.gif.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0120.068] GetLastError () returned 0x0 [0120.068] ReadFile (in: hFile=0x1e0, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x3d75, lpOverlapped=0x0) returned 1 [0120.225] WriteFile (in: hFile=0x1b0, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0x3d80, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0x3d80, lpOverlapped=0x0) returned 1 [0120.226] ReadFile (in: hFile=0x1e0, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x0, lpOverlapped=0x0) returned 1 [0120.226] WriteFile (in: hFile=0x1b0, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0xec, lpOverlapped=0x0) returned 1 [0120.226] SetEndOfFile (hFile=0x1b0) returned 1 [0120.227] CloseHandle (hObject=0x1b0) returned 1 [0120.227] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0120.227] SetEndOfFile (hFile=0x1e0) returned 1 [0120.227] CloseHandle (hObject=0x1e0) returned 1 [0120.227] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0120.228] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19582_.gif")) returned 1 [0120.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 63 [0120.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 63 [0120.228] lstrlenW (lpString=".doc") returned 4 [0120.228] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0120.228] lstrlenW (lpString=".docx") returned 5 [0120.228] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0120.228] lstrlenW (lpString=".pdf") returned 4 [0120.228] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0120.228] lstrlenW (lpString=".xls") returned 4 [0120.228] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0120.228] lstrlenW (lpString=".xlsx") returned 5 [0120.228] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0120.228] lstrlenW (lpString=".ppt") returned 4 [0120.228] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0120.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 63 [0120.228] lstrlenW (lpString=".zip") returned 4 [0120.228] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0120.228] lstrlenW (lpString=".rar") returned 4 [0120.228] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0120.228] lstrlenW (lpString=".bz2") returned 4 [0120.228] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0120.228] lstrlenW (lpString=".7z") returned 3 [0120.228] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0120.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 63 [0120.228] lstrlenW (lpString=".dbf") returned 4 [0120.229] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0120.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 63 [0120.229] lstrlenW (lpString=".1cd") returned 4 [0120.229] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0120.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 63 [0120.229] lstrlenW (lpString=".jpg") returned 4 [0120.229] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0120.229] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x342ff14 | out: lpFileSize=0x342ff14*=18304) returned 1 [0120.229] CloseHandle (hObject=0x1e0) returned 1 [0120.229] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19988_.wmf")) returned 0x20 [0120.229] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19988_.wmf.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0120.230] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19988_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0120.230] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0120.230] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0120.230] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19988_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0120.230] GetLastError () returned 0x0 [0120.230] ReadFile (in: hFile=0x1e0, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x4780, lpOverlapped=0x0) returned 1 [0120.255] WriteFile (in: hFile=0x1b0, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0x4790, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0x4790, lpOverlapped=0x0) returned 1 [0120.256] ReadFile (in: hFile=0x1e0, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x0, lpOverlapped=0x0) returned 1 [0120.256] WriteFile (in: hFile=0x1b0, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0xec, lpOverlapped=0x0) returned 1 [0120.256] SetEndOfFile (hFile=0x1b0) returned 1 [0120.256] CloseHandle (hObject=0x1b0) returned 1 [0120.256] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0120.256] SetEndOfFile (hFile=0x1e0) returned 1 [0120.257] CloseHandle (hObject=0x1e0) returned 1 [0120.257] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0120.257] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19988_.wmf")) returned 1 [0120.444] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 63 [0120.444] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 63 [0120.444] lstrlenW (lpString=".doc") returned 4 [0120.444] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0120.444] lstrlenW (lpString=".docx") returned 5 [0120.444] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0120.444] lstrlenW (lpString=".pdf") returned 4 [0120.444] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0120.444] lstrlenW (lpString=".xls") returned 4 [0120.445] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0120.445] lstrlenW (lpString=".xlsx") returned 5 [0120.445] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0120.445] lstrlenW (lpString=".ppt") returned 4 [0120.445] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0120.445] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 63 [0120.445] lstrlenW (lpString=".zip") returned 4 [0120.445] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0120.445] lstrlenW (lpString=".rar") returned 4 [0120.445] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0120.445] lstrlenW (lpString=".bz2") returned 4 [0120.445] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0120.445] lstrlenW (lpString=".7z") returned 3 [0120.445] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0120.445] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 63 [0120.445] lstrlenW (lpString=".dbf") returned 4 [0120.445] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0120.445] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 63 [0120.445] lstrlenW (lpString=".1cd") returned 4 [0120.445] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0120.445] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 63 [0120.445] lstrlenW (lpString=".jpg") returned 4 [0120.445] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0120.465] SetFilePointerEx (in: hFile=0x224, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0120.465] SetFilePointerEx (in: hFile=0x224, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0120.465] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00045_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0120.465] GetLastError () returned 0x0 [0120.465] ReadFile (in: hFile=0x224, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x1eb6, lpOverlapped=0x0) returned 1 [0120.564] WriteFile (in: hFile=0x19c, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0x1ec0, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0x1ec0, lpOverlapped=0x0) returned 1 [0120.564] ReadFile (in: hFile=0x224, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x0, lpOverlapped=0x0) returned 1 [0120.565] WriteFile (in: hFile=0x19c, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0xec, lpOverlapped=0x0) returned 1 [0120.565] SetEndOfFile (hFile=0x19c) returned 1 [0120.565] CloseHandle (hObject=0x19c) returned 1 [0120.565] SetFilePointerEx (in: hFile=0x224, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0120.565] SetEndOfFile (hFile=0x224) returned 1 [0120.565] CloseHandle (hObject=0x224) returned 1 [0120.565] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0120.566] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00045_.wmf")) returned 1 [0120.566] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 63 [0120.566] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 63 [0120.566] lstrlenW (lpString=".doc") returned 4 [0120.566] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0120.566] lstrlenW (lpString=".docx") returned 5 [0120.566] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0120.566] lstrlenW (lpString=".pdf") returned 4 [0120.566] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0120.566] lstrlenW (lpString=".xls") returned 4 [0120.566] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0120.566] lstrlenW (lpString=".xlsx") returned 5 [0120.566] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0120.566] lstrlenW (lpString=".ppt") returned 4 [0120.566] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0120.566] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 63 [0120.566] lstrlenW (lpString=".zip") returned 4 [0120.566] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0120.566] lstrlenW (lpString=".rar") returned 4 [0120.566] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0120.566] lstrlenW (lpString=".bz2") returned 4 [0120.566] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0120.566] lstrlenW (lpString=".7z") returned 3 [0120.566] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0120.566] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 63 [0120.566] lstrlenW (lpString=".dbf") returned 4 [0120.566] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0120.566] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 63 [0120.566] lstrlenW (lpString=".1cd") returned 4 [0120.566] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0120.566] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 63 [0120.566] lstrlenW (lpString=".jpg") returned 4 [0120.566] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0120.567] GetFileSizeEx (in: hFile=0x224, lpFileSize=0x342ff14 | out: lpFileSize=0x342ff14*=1696) returned 1 [0120.567] CloseHandle (hObject=0x224) returned 1 [0120.567] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00148_.wmf")) returned 0x20 [0120.567] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00148_.wmf.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0120.567] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00148_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x224 [0120.567] SetFilePointerEx (in: hFile=0x224, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0120.567] SetFilePointerEx (in: hFile=0x224, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0120.567] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00148_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0120.567] GetLastError () returned 0x0 [0120.567] ReadFile (in: hFile=0x224, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x6a0, lpOverlapped=0x0) returned 1 [0120.580] WriteFile (in: hFile=0x19c, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0x6b0, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0x6b0, lpOverlapped=0x0) returned 1 [0120.581] ReadFile (in: hFile=0x224, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x0, lpOverlapped=0x0) returned 1 [0120.581] WriteFile (in: hFile=0x19c, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0xec, lpOverlapped=0x0) returned 1 [0120.581] SetEndOfFile (hFile=0x19c) returned 1 [0120.582] CloseHandle (hObject=0x19c) returned 1 [0120.582] SetFilePointerEx (in: hFile=0x224, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0120.582] SetEndOfFile (hFile=0x224) returned 1 [0120.583] CloseHandle (hObject=0x224) returned 1 [0120.583] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0120.583] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00148_.wmf")) returned 1 [0120.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 63 [0120.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 63 [0120.584] lstrlenW (lpString=".doc") returned 4 [0120.584] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0120.584] lstrlenW (lpString=".docx") returned 5 [0120.584] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0120.584] lstrlenW (lpString=".pdf") returned 4 [0120.584] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0120.584] lstrlenW (lpString=".xls") returned 4 [0120.584] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0120.584] lstrlenW (lpString=".xlsx") returned 5 [0120.585] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0120.585] lstrlenW (lpString=".ppt") returned 4 [0120.585] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0120.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 63 [0120.585] lstrlenW (lpString=".zip") returned 4 [0120.585] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0120.585] lstrlenW (lpString=".rar") returned 4 [0120.585] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0120.585] lstrlenW (lpString=".bz2") returned 4 [0120.585] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0120.585] lstrlenW (lpString=".7z") returned 3 [0120.585] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0120.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 63 [0120.585] lstrlenW (lpString=".dbf") returned 4 [0120.585] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0120.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 63 [0120.585] lstrlenW (lpString=".1cd") returned 4 [0120.585] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0120.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 63 [0120.585] lstrlenW (lpString=".jpg") returned 4 [0120.585] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0120.587] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0120.587] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0120.587] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00195_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0120.587] GetLastError () returned 0x0 [0120.587] ReadFile (in: hFile=0x170, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x1f86, lpOverlapped=0x0) returned 1 [0120.603] WriteFile (in: hFile=0x228, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0x1f90, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0x1f90, lpOverlapped=0x0) returned 1 [0120.603] ReadFile (in: hFile=0x170, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x0, lpOverlapped=0x0) returned 1 [0120.604] WriteFile (in: hFile=0x228, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0xec, lpOverlapped=0x0) returned 1 [0120.604] SetEndOfFile (hFile=0x228) returned 1 [0120.604] CloseHandle (hObject=0x228) returned 1 [0120.604] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0120.604] SetEndOfFile (hFile=0x170) returned 1 [0120.605] CloseHandle (hObject=0x170) returned 1 [0120.605] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0120.605] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00195_.wmf")) returned 1 [0120.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 63 [0120.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 63 [0120.605] lstrlenW (lpString=".doc") returned 4 [0120.605] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0120.605] lstrlenW (lpString=".docx") returned 5 [0120.605] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0120.605] lstrlenW (lpString=".pdf") returned 4 [0120.605] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0120.605] lstrlenW (lpString=".xls") returned 4 [0120.605] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0120.605] lstrlenW (lpString=".xlsx") returned 5 [0120.605] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0120.605] lstrlenW (lpString=".ppt") returned 4 [0120.605] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0120.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 63 [0120.605] lstrlenW (lpString=".zip") returned 4 [0120.605] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0120.605] lstrlenW (lpString=".rar") returned 4 [0120.605] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0120.605] lstrlenW (lpString=".bz2") returned 4 [0120.605] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0120.605] lstrlenW (lpString=".7z") returned 3 [0120.605] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0120.606] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 63 [0120.606] lstrlenW (lpString=".dbf") returned 4 [0120.606] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0120.606] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 63 [0120.606] lstrlenW (lpString=".1cd") returned 4 [0120.606] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0120.606] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 63 [0120.606] lstrlenW (lpString=".jpg") returned 4 [0120.606] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0120.606] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x342ff14 | out: lpFileSize=0x342ff14*=14444) returned 1 [0120.606] CloseHandle (hObject=0x170) returned 1 [0120.606] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00247_.wmf")) returned 0x20 [0120.606] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00247_.wmf.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0120.606] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00247_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0120.606] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0120.606] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0120.606] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00247_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0120.607] GetLastError () returned 0x0 [0120.607] ReadFile (in: hFile=0x170, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x386c, lpOverlapped=0x0) returned 1 [0120.638] WriteFile (in: hFile=0x228, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0x3870, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0x3870, lpOverlapped=0x0) returned 1 [0120.638] ReadFile (in: hFile=0x170, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x0, lpOverlapped=0x0) returned 1 [0120.639] WriteFile (in: hFile=0x228, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0xec, lpOverlapped=0x0) returned 1 [0120.679] SetEndOfFile (hFile=0x228) returned 1 [0120.679] CloseHandle (hObject=0x228) returned 1 [0120.679] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0120.679] SetEndOfFile (hFile=0x170) returned 1 [0120.680] CloseHandle (hObject=0x170) returned 1 [0120.680] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0120.680] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00247_.wmf")) returned 1 [0120.680] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 63 [0120.680] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 63 [0120.680] lstrlenW (lpString=".doc") returned 4 [0120.680] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0120.680] lstrlenW (lpString=".docx") returned 5 [0120.680] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0120.680] lstrlenW (lpString=".pdf") returned 4 [0120.680] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0120.680] lstrlenW (lpString=".xls") returned 4 [0120.680] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0120.680] lstrlenW (lpString=".xlsx") returned 5 [0120.680] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0120.680] lstrlenW (lpString=".ppt") returned 4 [0120.680] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0120.680] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 63 [0120.680] lstrlenW (lpString=".zip") returned 4 [0120.680] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0120.680] lstrlenW (lpString=".rar") returned 4 [0120.680] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0120.680] lstrlenW (lpString=".bz2") returned 4 [0120.680] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0120.680] lstrlenW (lpString=".7z") returned 3 [0120.680] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0120.680] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 63 [0120.680] lstrlenW (lpString=".dbf") returned 4 [0120.680] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0120.680] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 63 [0120.681] lstrlenW (lpString=".1cd") returned 4 [0120.681] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0120.681] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 63 [0120.681] lstrlenW (lpString=".jpg") returned 4 [0120.681] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0120.681] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x342ff14 | out: lpFileSize=0x342ff14*=5272) returned 1 [0120.681] CloseHandle (hObject=0x170) returned 1 [0120.681] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00269_.wmf")) returned 0x20 [0120.681] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00269_.wmf.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0120.681] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00269_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0120.681] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0120.681] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0120.681] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00269_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0120.681] GetLastError () returned 0x0 [0120.681] ReadFile (in: hFile=0x170, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x1498, lpOverlapped=0x0) returned 1 [0120.697] WriteFile (in: hFile=0x228, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0x14a0, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0x14a0, lpOverlapped=0x0) returned 1 [0120.698] ReadFile (in: hFile=0x170, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x0, lpOverlapped=0x0) returned 1 [0120.698] WriteFile (in: hFile=0x228, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0xec, lpOverlapped=0x0) returned 1 [0120.698] SetEndOfFile (hFile=0x228) returned 1 [0120.698] CloseHandle (hObject=0x228) returned 1 [0120.698] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0120.698] SetEndOfFile (hFile=0x170) returned 1 [0120.698] CloseHandle (hObject=0x170) returned 1 [0120.698] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0120.699] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00269_.wmf")) returned 1 [0120.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 63 [0120.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 63 [0120.703] lstrlenW (lpString=".doc") returned 4 [0120.703] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0120.703] lstrlenW (lpString=".docx") returned 5 [0120.703] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0120.703] lstrlenW (lpString=".pdf") returned 4 [0120.703] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0120.703] lstrlenW (lpString=".xls") returned 4 [0120.703] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0120.703] lstrlenW (lpString=".xlsx") returned 5 [0120.703] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0120.703] lstrlenW (lpString=".ppt") returned 4 [0120.703] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0120.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 63 [0120.704] lstrlenW (lpString=".zip") returned 4 [0120.704] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0120.704] lstrlenW (lpString=".rar") returned 4 [0120.704] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0120.704] lstrlenW (lpString=".bz2") returned 4 [0120.704] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0120.704] lstrlenW (lpString=".7z") returned 3 [0120.704] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0120.704] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 63 [0120.704] lstrlenW (lpString=".dbf") returned 4 [0120.704] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0120.704] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 63 [0120.704] lstrlenW (lpString=".1cd") returned 4 [0120.704] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0120.704] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 63 [0120.704] lstrlenW (lpString=".jpg") returned 4 [0120.704] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0120.704] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x342ff14 | out: lpFileSize=0x342ff14*=812) returned 1 [0120.704] CloseHandle (hObject=0x170) returned 1 [0120.704] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00296_.wmf")) returned 0x20 [0120.704] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00296_.wmf.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0120.705] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00296_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0120.705] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0120.705] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0120.705] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00296_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0120.705] GetLastError () returned 0x0 [0120.705] ReadFile (in: hFile=0x170, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x32c, lpOverlapped=0x0) returned 1 [0120.741] WriteFile (in: hFile=0x228, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0x330, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0x330, lpOverlapped=0x0) returned 1 [0120.742] ReadFile (in: hFile=0x170, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x0, lpOverlapped=0x0) returned 1 [0120.742] WriteFile (in: hFile=0x228, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0xec, lpOverlapped=0x0) returned 1 [0120.742] SetEndOfFile (hFile=0x228) returned 1 [0120.742] CloseHandle (hObject=0x228) returned 1 [0120.742] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0120.743] SetEndOfFile (hFile=0x170) returned 1 [0120.743] CloseHandle (hObject=0x170) returned 1 [0120.743] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0120.743] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00296_.wmf")) returned 1 [0120.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 63 [0120.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 63 [0120.743] lstrlenW (lpString=".doc") returned 4 [0120.743] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0120.744] lstrlenW (lpString=".docx") returned 5 [0120.744] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0120.744] lstrlenW (lpString=".pdf") returned 4 [0120.744] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0120.744] lstrlenW (lpString=".xls") returned 4 [0120.744] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0120.744] lstrlenW (lpString=".xlsx") returned 5 [0120.744] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0120.744] lstrlenW (lpString=".ppt") returned 4 [0120.744] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0120.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 63 [0120.744] lstrlenW (lpString=".zip") returned 4 [0120.744] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0120.744] lstrlenW (lpString=".rar") returned 4 [0120.744] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0120.744] lstrlenW (lpString=".bz2") returned 4 [0120.744] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0120.744] lstrlenW (lpString=".7z") returned 3 [0120.744] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0120.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 63 [0120.744] lstrlenW (lpString=".dbf") returned 4 [0120.744] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0120.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 63 [0120.744] lstrlenW (lpString=".1cd") returned 4 [0120.744] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0120.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 63 [0120.744] lstrlenW (lpString=".jpg") returned 4 [0120.744] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0120.744] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x342ff14 | out: lpFileSize=0x342ff14*=27552) returned 1 [0120.744] CloseHandle (hObject=0x170) returned 1 [0120.745] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00526_.wmf")) returned 0x20 [0120.745] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00526_.wmf.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0120.745] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00526_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0120.745] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0120.745] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0120.745] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00526_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0120.745] GetLastError () returned 0x0 [0120.745] ReadFile (in: hFile=0x170, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x6ba0, lpOverlapped=0x0) returned 1 [0120.813] WriteFile (in: hFile=0x228, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0x6bb0, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0x6bb0, lpOverlapped=0x0) returned 1 [0120.814] ReadFile (in: hFile=0x170, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x0, lpOverlapped=0x0) returned 1 [0120.814] WriteFile (in: hFile=0x228, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0xec, lpOverlapped=0x0) returned 1 [0120.814] SetEndOfFile (hFile=0x228) returned 1 [0120.814] CloseHandle (hObject=0x228) returned 1 [0120.814] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0120.814] SetEndOfFile (hFile=0x170) returned 1 [0120.814] CloseHandle (hObject=0x170) returned 1 [0120.815] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0120.815] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00526_.wmf")) returned 1 [0120.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 63 [0120.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 63 [0120.815] lstrlenW (lpString=".doc") returned 4 [0120.815] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0120.815] lstrlenW (lpString=".docx") returned 5 [0120.815] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0120.815] lstrlenW (lpString=".pdf") returned 4 [0120.815] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0120.815] lstrlenW (lpString=".xls") returned 4 [0120.815] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0120.815] lstrlenW (lpString=".xlsx") returned 5 [0120.815] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0120.815] lstrlenW (lpString=".ppt") returned 4 [0120.815] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0120.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 63 [0120.815] lstrlenW (lpString=".zip") returned 4 [0120.815] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0120.815] lstrlenW (lpString=".rar") returned 4 [0120.815] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0120.815] lstrlenW (lpString=".bz2") returned 4 [0120.815] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0120.815] lstrlenW (lpString=".7z") returned 3 [0120.815] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0120.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 63 [0120.815] lstrlenW (lpString=".dbf") returned 4 [0120.815] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0120.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 63 [0120.815] lstrlenW (lpString=".1cd") returned 4 [0120.815] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0120.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 63 [0120.815] lstrlenW (lpString=".jpg") returned 4 [0120.815] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0120.822] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0120.822] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0120.822] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00078_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0120.822] GetLastError () returned 0x0 [0120.822] ReadFile (in: hFile=0x170, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x5a4, lpOverlapped=0x0) returned 1 [0120.838] WriteFile (in: hFile=0x228, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0x5b0, lpOverlapped=0x0) returned 1 [0120.838] ReadFile (in: hFile=0x170, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x0, lpOverlapped=0x0) returned 1 [0120.838] WriteFile (in: hFile=0x228, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0xec, lpOverlapped=0x0) returned 1 [0120.838] SetEndOfFile (hFile=0x228) returned 1 [0120.839] CloseHandle (hObject=0x228) returned 1 [0120.839] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0120.839] SetEndOfFile (hFile=0x170) returned 1 [0120.839] CloseHandle (hObject=0x170) returned 1 [0120.839] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0120.839] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00078_.wmf")) returned 1 [0120.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 63 [0120.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 63 [0120.840] lstrlenW (lpString=".doc") returned 4 [0120.840] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0120.840] lstrlenW (lpString=".docx") returned 5 [0120.840] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0120.840] lstrlenW (lpString=".pdf") returned 4 [0120.840] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0120.840] lstrlenW (lpString=".xls") returned 4 [0120.840] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0120.840] lstrlenW (lpString=".xlsx") returned 5 [0120.840] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0120.840] lstrlenW (lpString=".ppt") returned 4 [0120.840] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0120.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 63 [0120.840] lstrlenW (lpString=".zip") returned 4 [0120.840] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0120.840] lstrlenW (lpString=".rar") returned 4 [0120.840] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0120.840] lstrlenW (lpString=".bz2") returned 4 [0120.840] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0120.840] lstrlenW (lpString=".7z") returned 3 [0120.840] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0120.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 63 [0120.840] lstrlenW (lpString=".dbf") returned 4 [0120.840] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0120.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 63 [0120.840] lstrlenW (lpString=".1cd") returned 4 [0120.840] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0120.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 63 [0120.840] lstrlenW (lpString=".jpg") returned 4 [0120.840] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0120.841] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x342ff14 | out: lpFileSize=0x342ff14*=2378) returned 1 [0120.841] CloseHandle (hObject=0x170) returned 1 [0120.841] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00100_.wmf")) returned 0x20 [0120.841] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00100_.wmf.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0120.841] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00100_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0120.841] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0120.841] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0120.842] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00100_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0120.842] GetLastError () returned 0x0 [0120.842] ReadFile (in: hFile=0x170, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x94a, lpOverlapped=0x0) returned 1 [0120.894] WriteFile (in: hFile=0x228, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0x950, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0x950, lpOverlapped=0x0) returned 1 [0120.895] ReadFile (in: hFile=0x170, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x0, lpOverlapped=0x0) returned 1 [0120.895] WriteFile (in: hFile=0x228, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0xec, lpOverlapped=0x0) returned 1 [0120.895] SetEndOfFile (hFile=0x228) returned 1 [0120.895] CloseHandle (hObject=0x228) returned 1 [0120.895] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0120.895] SetEndOfFile (hFile=0x170) returned 1 [0120.896] CloseHandle (hObject=0x170) returned 1 [0120.896] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0120.896] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00100_.wmf")) returned 1 [0120.896] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 63 [0120.896] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 63 [0120.896] lstrlenW (lpString=".doc") returned 4 [0120.896] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0120.896] lstrlenW (lpString=".docx") returned 5 [0120.896] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0120.896] lstrlenW (lpString=".pdf") returned 4 [0120.896] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0120.896] lstrlenW (lpString=".xls") returned 4 [0120.896] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0120.896] lstrlenW (lpString=".xlsx") returned 5 [0120.896] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0120.896] lstrlenW (lpString=".ppt") returned 4 [0120.896] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0120.896] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 63 [0120.897] lstrlenW (lpString=".zip") returned 4 [0120.897] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0120.897] lstrlenW (lpString=".rar") returned 4 [0120.897] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0120.897] lstrlenW (lpString=".bz2") returned 4 [0120.897] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0120.897] lstrlenW (lpString=".7z") returned 3 [0120.897] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0120.897] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 63 [0120.897] lstrlenW (lpString=".dbf") returned 4 [0120.897] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0120.897] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 63 [0120.897] lstrlenW (lpString=".1cd") returned 4 [0120.897] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0120.897] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 63 [0120.897] lstrlenW (lpString=".jpg") returned 4 [0120.897] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0120.897] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x342ff14 | out: lpFileSize=0x342ff14*=3104) returned 1 [0120.897] CloseHandle (hObject=0x170) returned 1 [0120.897] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00200_.wmf")) returned 0x20 [0120.897] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00200_.wmf.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0120.897] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00200_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0120.897] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0120.897] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0120.897] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00200_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0120.898] GetLastError () returned 0x0 [0120.898] ReadFile (in: hFile=0x170, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0xc20, lpOverlapped=0x0) returned 1 [0120.918] WriteFile (in: hFile=0x228, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0xc30, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0xc30, lpOverlapped=0x0) returned 1 [0120.919] ReadFile (in: hFile=0x170, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x0, lpOverlapped=0x0) returned 1 [0120.919] WriteFile (in: hFile=0x228, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0xec, lpOverlapped=0x0) returned 1 [0120.919] SetEndOfFile (hFile=0x228) returned 1 [0120.919] CloseHandle (hObject=0x228) returned 1 [0120.919] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0120.919] SetEndOfFile (hFile=0x170) returned 1 [0120.920] CloseHandle (hObject=0x170) returned 1 [0120.920] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0120.920] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00200_.wmf")) returned 1 [0120.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 63 [0120.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 63 [0120.920] lstrlenW (lpString=".doc") returned 4 [0120.920] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0120.920] lstrlenW (lpString=".docx") returned 5 [0120.920] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0120.920] lstrlenW (lpString=".pdf") returned 4 [0120.920] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0120.920] lstrlenW (lpString=".xls") returned 4 [0120.920] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0120.920] lstrlenW (lpString=".xlsx") returned 5 [0120.920] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0120.920] lstrlenW (lpString=".ppt") returned 4 [0120.920] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0120.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 63 [0120.920] lstrlenW (lpString=".zip") returned 4 [0120.920] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0120.920] lstrlenW (lpString=".rar") returned 4 [0120.920] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0120.920] lstrlenW (lpString=".bz2") returned 4 [0120.920] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0120.920] lstrlenW (lpString=".7z") returned 3 [0120.920] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0120.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 63 [0120.920] lstrlenW (lpString=".dbf") returned 4 [0120.920] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0120.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 63 [0120.920] lstrlenW (lpString=".1cd") returned 4 [0120.920] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0120.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 63 [0120.920] lstrlenW (lpString=".jpg") returned 4 [0120.921] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0120.921] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x342ff14 | out: lpFileSize=0x342ff14*=1212) returned 1 [0120.921] CloseHandle (hObject=0x170) returned 1 [0120.921] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00438_.wmf")) returned 0x20 [0120.921] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00438_.wmf.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0120.921] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00438_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0120.921] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0120.921] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0120.921] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00438_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0120.921] GetLastError () returned 0x0 [0120.921] ReadFile (in: hFile=0x170, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x4bc, lpOverlapped=0x0) returned 1 [0120.939] WriteFile (in: hFile=0x228, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0x4c0, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0x4c0, lpOverlapped=0x0) returned 1 [0120.940] ReadFile (in: hFile=0x170, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x0, lpOverlapped=0x0) returned 1 [0120.940] WriteFile (in: hFile=0x228, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0xec, lpOverlapped=0x0) returned 1 [0120.940] SetEndOfFile (hFile=0x228) returned 1 [0120.940] CloseHandle (hObject=0x228) returned 1 [0120.940] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0120.940] SetEndOfFile (hFile=0x170) returned 1 [0120.941] CloseHandle (hObject=0x170) returned 1 [0120.941] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0120.941] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00438_.wmf")) returned 1 [0120.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 63 [0120.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 63 [0120.941] lstrlenW (lpString=".doc") returned 4 [0120.941] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0120.941] lstrlenW (lpString=".docx") returned 5 [0120.941] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0120.941] lstrlenW (lpString=".pdf") returned 4 [0120.941] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0120.941] lstrlenW (lpString=".xls") returned 4 [0120.941] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0120.941] lstrlenW (lpString=".xlsx") returned 5 [0120.941] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0120.941] lstrlenW (lpString=".ppt") returned 4 [0120.941] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0120.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 63 [0120.941] lstrlenW (lpString=".zip") returned 4 [0120.941] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0120.941] lstrlenW (lpString=".rar") returned 4 [0120.941] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0120.941] lstrlenW (lpString=".bz2") returned 4 [0120.941] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0120.941] lstrlenW (lpString=".7z") returned 3 [0120.941] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0120.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 63 [0120.941] lstrlenW (lpString=".dbf") returned 4 [0120.941] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0120.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 63 [0120.941] lstrlenW (lpString=".1cd") returned 4 [0120.942] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0120.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 63 [0120.942] lstrlenW (lpString=".jpg") returned 4 [0120.942] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0120.942] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x342ff14 | out: lpFileSize=0x342ff14*=5580) returned 1 [0120.942] CloseHandle (hObject=0x170) returned 1 [0120.942] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00440_.wmf")) returned 0x20 [0120.942] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00440_.wmf.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0120.942] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00440_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0120.942] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0120.942] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0120.942] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00440_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0120.943] GetLastError () returned 0x0 [0120.943] ReadFile (in: hFile=0x170, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x15cc, lpOverlapped=0x0) returned 1 [0120.944] WriteFile (in: hFile=0x228, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0x15d0, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0x15d0, lpOverlapped=0x0) returned 1 [0120.944] ReadFile (in: hFile=0x170, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x0, lpOverlapped=0x0) returned 1 [0120.944] WriteFile (in: hFile=0x228, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0xec, lpOverlapped=0x0) returned 1 [0120.944] SetEndOfFile (hFile=0x228) returned 1 [0120.944] CloseHandle (hObject=0x228) returned 1 [0120.944] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0120.944] SetEndOfFile (hFile=0x170) returned 1 [0120.945] CloseHandle (hObject=0x170) returned 1 [0120.945] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0120.945] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00440_.wmf")) returned 1 [0120.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 63 [0120.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 63 [0120.946] lstrlenW (lpString=".doc") returned 4 [0120.946] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0120.946] lstrlenW (lpString=".docx") returned 5 [0120.946] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0120.946] lstrlenW (lpString=".pdf") returned 4 [0120.946] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0120.946] lstrlenW (lpString=".xls") returned 4 [0120.946] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0120.946] lstrlenW (lpString=".xlsx") returned 5 [0120.946] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0120.946] lstrlenW (lpString=".ppt") returned 4 [0120.946] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0120.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 63 [0120.946] lstrlenW (lpString=".zip") returned 4 [0120.946] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0120.946] lstrlenW (lpString=".rar") returned 4 [0120.946] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0120.946] lstrlenW (lpString=".bz2") returned 4 [0120.946] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0120.946] lstrlenW (lpString=".7z") returned 3 [0120.946] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0120.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 63 [0120.946] lstrlenW (lpString=".dbf") returned 4 [0120.946] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0120.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 63 [0120.946] lstrlenW (lpString=".1cd") returned 4 [0120.946] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0120.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 63 [0120.946] lstrlenW (lpString=".jpg") returned 4 [0120.946] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0120.946] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x342ff14 | out: lpFileSize=0x342ff14*=3524) returned 1 [0120.946] CloseHandle (hObject=0x170) returned 1 [0120.946] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00441_.wmf")) returned 0x20 [0120.946] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00441_.wmf.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0120.946] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00441_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0120.947] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0120.947] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0120.947] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00441_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0120.947] GetLastError () returned 0x0 [0120.947] ReadFile (in: hFile=0x170, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0xdc4, lpOverlapped=0x0) returned 1 [0120.990] WriteFile (in: hFile=0x228, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0xdd0, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0xdd0, lpOverlapped=0x0) returned 1 [0120.991] ReadFile (in: hFile=0x170, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x0, lpOverlapped=0x0) returned 1 [0120.991] WriteFile (in: hFile=0x228, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0xec, lpOverlapped=0x0) returned 1 [0120.991] SetEndOfFile (hFile=0x228) returned 1 [0120.991] CloseHandle (hObject=0x228) returned 1 [0120.991] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0120.991] SetEndOfFile (hFile=0x170) returned 1 [0120.991] CloseHandle (hObject=0x170) returned 1 [0120.991] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0120.992] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00441_.wmf")) returned 1 [0120.992] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 63 [0120.992] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 63 [0120.992] lstrlenW (lpString=".doc") returned 4 [0120.992] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0120.992] lstrlenW (lpString=".docx") returned 5 [0120.992] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0120.992] lstrlenW (lpString=".pdf") returned 4 [0120.992] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0120.992] lstrlenW (lpString=".xls") returned 4 [0120.992] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0120.992] lstrlenW (lpString=".xlsx") returned 5 [0120.992] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0120.992] lstrlenW (lpString=".ppt") returned 4 [0120.992] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0120.992] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 63 [0120.992] lstrlenW (lpString=".zip") returned 4 [0120.992] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0120.992] lstrlenW (lpString=".rar") returned 4 [0120.992] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0120.992] lstrlenW (lpString=".bz2") returned 4 [0120.992] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0120.992] lstrlenW (lpString=".7z") returned 3 [0120.992] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0120.992] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 63 [0120.992] lstrlenW (lpString=".dbf") returned 4 [0120.992] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0120.992] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 63 [0120.992] lstrlenW (lpString=".1cd") returned 4 [0120.992] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0120.992] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 63 [0120.992] lstrlenW (lpString=".jpg") returned 4 [0120.992] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0120.993] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x342ff14 | out: lpFileSize=0x342ff14*=3896) returned 1 [0120.993] CloseHandle (hObject=0x170) returned 1 [0120.993] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00444_.wmf")) returned 0x20 [0120.993] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00444_.wmf.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0120.993] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00444_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0120.993] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0120.993] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0120.993] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00444_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0120.994] GetLastError () returned 0x0 [0120.994] ReadFile (in: hFile=0x170, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0xf38, lpOverlapped=0x0) returned 1 [0121.028] WriteFile (in: hFile=0x228, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0xf40, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0xf40, lpOverlapped=0x0) returned 1 [0121.029] ReadFile (in: hFile=0x170, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x0, lpOverlapped=0x0) returned 1 [0121.029] WriteFile (in: hFile=0x228, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0xec, lpOverlapped=0x0) returned 1 [0121.029] SetEndOfFile (hFile=0x228) returned 1 [0121.029] CloseHandle (hObject=0x228) returned 1 [0121.029] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0121.029] SetEndOfFile (hFile=0x170) returned 1 [0121.030] CloseHandle (hObject=0x170) returned 1 [0121.030] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0121.030] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00444_.wmf")) returned 1 [0121.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 63 [0121.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 63 [0121.030] lstrlenW (lpString=".doc") returned 4 [0121.030] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0121.030] lstrlenW (lpString=".docx") returned 5 [0121.030] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0121.030] lstrlenW (lpString=".pdf") returned 4 [0121.030] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0121.030] lstrlenW (lpString=".xls") returned 4 [0121.030] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0121.030] lstrlenW (lpString=".xlsx") returned 5 [0121.030] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0121.030] lstrlenW (lpString=".ppt") returned 4 [0121.030] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0121.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 63 [0121.030] lstrlenW (lpString=".zip") returned 4 [0121.030] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0121.030] lstrlenW (lpString=".rar") returned 4 [0121.030] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0121.030] lstrlenW (lpString=".bz2") returned 4 [0121.030] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0121.030] lstrlenW (lpString=".7z") returned 3 [0121.030] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0121.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 63 [0121.030] lstrlenW (lpString=".dbf") returned 4 [0121.031] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0121.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 63 [0121.031] lstrlenW (lpString=".1cd") returned 4 [0121.031] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0121.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 63 [0121.031] lstrlenW (lpString=".jpg") returned 4 [0121.031] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0121.031] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x342ff14 | out: lpFileSize=0x342ff14*=3796) returned 1 [0121.031] CloseHandle (hObject=0x170) returned 1 [0121.031] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00445_.wmf")) returned 0x20 [0121.031] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00445_.wmf.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0121.031] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00445_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0121.032] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0121.032] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0121.032] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00445_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0121.032] GetLastError () returned 0x0 [0121.032] ReadFile (in: hFile=0x170, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0xed4, lpOverlapped=0x0) returned 1 [0121.033] WriteFile (in: hFile=0x228, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0xee0, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0xee0, lpOverlapped=0x0) returned 1 [0121.034] ReadFile (in: hFile=0x170, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x0, lpOverlapped=0x0) returned 1 [0121.034] WriteFile (in: hFile=0x228, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0xec, lpOverlapped=0x0) returned 1 [0121.034] SetEndOfFile (hFile=0x228) returned 1 [0121.034] CloseHandle (hObject=0x228) returned 1 [0121.034] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0121.034] SetEndOfFile (hFile=0x170) returned 1 [0121.035] CloseHandle (hObject=0x170) returned 1 [0121.035] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0121.035] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00445_.wmf")) returned 1 [0121.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 63 [0121.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 63 [0121.035] lstrlenW (lpString=".doc") returned 4 [0121.035] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0121.035] lstrlenW (lpString=".docx") returned 5 [0121.035] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0121.035] lstrlenW (lpString=".pdf") returned 4 [0121.035] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0121.035] lstrlenW (lpString=".xls") returned 4 [0121.035] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0121.035] lstrlenW (lpString=".xlsx") returned 5 [0121.035] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0121.035] lstrlenW (lpString=".ppt") returned 4 [0121.035] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0121.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 63 [0121.035] lstrlenW (lpString=".zip") returned 4 [0121.035] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0121.035] lstrlenW (lpString=".rar") returned 4 [0121.035] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0121.035] lstrlenW (lpString=".bz2") returned 4 [0121.035] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0121.035] lstrlenW (lpString=".7z") returned 3 [0121.036] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0121.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 63 [0121.036] lstrlenW (lpString=".dbf") returned 4 [0121.036] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0121.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 63 [0121.036] lstrlenW (lpString=".1cd") returned 4 [0121.036] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0121.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 63 [0121.036] lstrlenW (lpString=".jpg") returned 4 [0121.036] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0121.036] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x342ff14 | out: lpFileSize=0x342ff14*=2436) returned 1 [0121.036] CloseHandle (hObject=0x170) returned 1 [0121.036] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00453_.wmf")) returned 0x20 [0121.036] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00453_.wmf.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0121.036] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00453_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0121.036] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0121.036] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0121.036] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00453_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0121.037] GetLastError () returned 0x0 [0121.037] ReadFile (in: hFile=0x170, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x984, lpOverlapped=0x0) returned 1 [0121.048] WriteFile (in: hFile=0x228, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0x990, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0x990, lpOverlapped=0x0) returned 1 [0121.049] ReadFile (in: hFile=0x170, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x0, lpOverlapped=0x0) returned 1 [0121.049] WriteFile (in: hFile=0x228, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0xec, lpOverlapped=0x0) returned 1 [0121.049] SetEndOfFile (hFile=0x228) returned 1 [0121.049] CloseHandle (hObject=0x228) returned 1 [0121.049] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0121.049] SetEndOfFile (hFile=0x170) returned 1 [0121.050] CloseHandle (hObject=0x170) returned 1 [0121.050] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0121.050] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00453_.wmf")) returned 1 [0121.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 63 [0121.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 63 [0121.050] lstrlenW (lpString=".doc") returned 4 [0121.050] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0121.050] lstrlenW (lpString=".docx") returned 5 [0121.050] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0121.050] lstrlenW (lpString=".pdf") returned 4 [0121.050] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0121.050] lstrlenW (lpString=".xls") returned 4 [0121.050] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0121.050] lstrlenW (lpString=".xlsx") returned 5 [0121.050] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0121.050] lstrlenW (lpString=".ppt") returned 4 [0121.050] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0121.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 63 [0121.050] lstrlenW (lpString=".zip") returned 4 [0121.050] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0121.050] lstrlenW (lpString=".rar") returned 4 [0121.050] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0121.051] lstrlenW (lpString=".bz2") returned 4 [0121.051] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0121.051] lstrlenW (lpString=".7z") returned 3 [0121.051] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0121.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 63 [0121.051] lstrlenW (lpString=".dbf") returned 4 [0121.051] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0121.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 63 [0121.051] lstrlenW (lpString=".1cd") returned 4 [0121.051] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0121.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 63 [0121.051] lstrlenW (lpString=".jpg") returned 4 [0121.051] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0121.051] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x342ff14 | out: lpFileSize=0x342ff14*=3494) returned 1 [0121.051] CloseHandle (hObject=0x170) returned 1 [0121.051] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01634_.wmf")) returned 0x20 [0121.051] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01634_.wmf.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0121.051] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01634_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0121.051] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0121.051] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0121.051] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01634_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0121.052] GetLastError () returned 0x0 [0121.052] ReadFile (in: hFile=0x170, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0xda6, lpOverlapped=0x0) returned 1 [0121.137] WriteFile (in: hFile=0x228, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0xdb0, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0xdb0, lpOverlapped=0x0) returned 1 [0121.138] ReadFile (in: hFile=0x170, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x0, lpOverlapped=0x0) returned 1 [0121.138] WriteFile (in: hFile=0x228, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0xec, lpOverlapped=0x0) returned 1 [0121.138] SetEndOfFile (hFile=0x228) returned 1 [0121.138] CloseHandle (hObject=0x228) returned 1 [0121.138] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0121.138] SetEndOfFile (hFile=0x170) returned 1 [0121.139] CloseHandle (hObject=0x170) returned 1 [0121.139] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0121.139] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01634_.wmf")) returned 1 [0121.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 63 [0121.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 63 [0121.139] lstrlenW (lpString=".doc") returned 4 [0121.139] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0121.139] lstrlenW (lpString=".docx") returned 5 [0121.139] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0121.139] lstrlenW (lpString=".pdf") returned 4 [0121.140] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0121.140] lstrlenW (lpString=".xls") returned 4 [0121.140] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0121.140] lstrlenW (lpString=".xlsx") returned 5 [0121.140] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0121.140] lstrlenW (lpString=".ppt") returned 4 [0121.140] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0121.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 63 [0121.140] lstrlenW (lpString=".zip") returned 4 [0121.140] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0121.140] lstrlenW (lpString=".rar") returned 4 [0121.140] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0121.140] lstrlenW (lpString=".bz2") returned 4 [0121.140] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0121.140] lstrlenW (lpString=".7z") returned 3 [0121.140] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0121.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 63 [0121.140] lstrlenW (lpString=".dbf") returned 4 [0121.140] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0121.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 63 [0121.140] lstrlenW (lpString=".1cd") returned 4 [0121.140] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0121.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 63 [0121.140] lstrlenW (lpString=".jpg") returned 4 [0121.140] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0121.140] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x342ff14 | out: lpFileSize=0x342ff14*=1874) returned 1 [0121.140] CloseHandle (hObject=0x170) returned 1 [0121.140] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01636_.wmf")) returned 0x20 [0121.140] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01636_.wmf.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0121.140] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01636_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0121.141] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0121.141] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0121.141] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01636_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0121.141] GetLastError () returned 0x0 [0121.141] ReadFile (in: hFile=0x170, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x752, lpOverlapped=0x0) returned 1 [0121.149] WriteFile (in: hFile=0x228, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0x760, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0x760, lpOverlapped=0x0) returned 1 [0121.153] ReadFile (in: hFile=0x170, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x0, lpOverlapped=0x0) returned 1 [0121.153] WriteFile (in: hFile=0x228, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0xec, lpOverlapped=0x0) returned 1 [0121.153] SetEndOfFile (hFile=0x228) returned 1 [0121.153] CloseHandle (hObject=0x228) returned 1 [0121.153] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0121.153] SetEndOfFile (hFile=0x170) returned 1 [0121.154] CloseHandle (hObject=0x170) returned 1 [0121.154] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0121.154] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01636_.wmf")) returned 1 [0121.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 63 [0121.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 63 [0121.154] lstrlenW (lpString=".doc") returned 4 [0121.154] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0121.154] lstrlenW (lpString=".docx") returned 5 [0121.154] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0121.154] lstrlenW (lpString=".pdf") returned 4 [0121.154] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0121.154] lstrlenW (lpString=".xls") returned 4 [0121.154] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0121.154] lstrlenW (lpString=".xlsx") returned 5 [0121.154] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0121.154] lstrlenW (lpString=".ppt") returned 4 [0121.154] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0121.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 63 [0121.154] lstrlenW (lpString=".zip") returned 4 [0121.154] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0121.155] lstrlenW (lpString=".rar") returned 4 [0121.155] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0121.155] lstrlenW (lpString=".bz2") returned 4 [0121.155] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0121.155] lstrlenW (lpString=".7z") returned 3 [0121.155] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0121.155] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 63 [0121.155] lstrlenW (lpString=".dbf") returned 4 [0121.155] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0121.155] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 63 [0121.155] lstrlenW (lpString=".1cd") returned 4 [0121.155] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0121.155] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 63 [0121.155] lstrlenW (lpString=".jpg") returned 4 [0121.155] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0121.155] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x342ff14 | out: lpFileSize=0x342ff14*=10538) returned 1 [0121.155] CloseHandle (hObject=0x170) returned 1 [0121.155] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01638_.wmf")) returned 0x20 [0121.155] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01638_.wmf.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0121.155] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01638_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0121.155] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0121.155] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0121.156] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01638_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0121.156] GetLastError () returned 0x0 [0121.156] ReadFile (in: hFile=0x170, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x292a, lpOverlapped=0x0) returned 1 [0121.175] WriteFile (in: hFile=0x228, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0x2930, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0x2930, lpOverlapped=0x0) returned 1 [0121.176] ReadFile (in: hFile=0x170, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x0, lpOverlapped=0x0) returned 1 [0121.176] WriteFile (in: hFile=0x228, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0xec, lpOverlapped=0x0) returned 1 [0121.176] SetEndOfFile (hFile=0x228) returned 1 [0121.231] CloseHandle (hObject=0x228) returned 1 [0121.231] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0121.231] SetEndOfFile (hFile=0x170) returned 1 [0121.232] CloseHandle (hObject=0x170) returned 1 [0121.232] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0121.232] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01638_.wmf")) returned 1 [0121.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 63 [0121.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 63 [0121.249] lstrlenW (lpString=".doc") returned 4 [0121.249] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0121.249] lstrlenW (lpString=".docx") returned 5 [0121.249] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0121.249] lstrlenW (lpString=".pdf") returned 4 [0121.249] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0121.249] lstrlenW (lpString=".xls") returned 4 [0121.249] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0121.249] lstrlenW (lpString=".xlsx") returned 5 [0121.249] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0121.249] lstrlenW (lpString=".ppt") returned 4 [0121.249] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0121.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 63 [0121.249] lstrlenW (lpString=".zip") returned 4 [0121.249] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0121.249] lstrlenW (lpString=".rar") returned 4 [0121.249] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0121.249] lstrlenW (lpString=".bz2") returned 4 [0121.249] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0121.249] lstrlenW (lpString=".7z") returned 3 [0121.249] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0121.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 63 [0121.249] lstrlenW (lpString=".dbf") returned 4 [0121.249] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0121.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 63 [0121.249] lstrlenW (lpString=".1cd") returned 4 [0121.249] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0121.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 63 [0121.249] lstrlenW (lpString=".jpg") returned 4 [0121.249] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0121.250] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0121.250] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0121.251] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\classic1.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0121.251] GetLastError () returned 0x0 [0121.251] ReadFile (in: hFile=0x1f4, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x976, lpOverlapped=0x0) returned 1 [0121.350] WriteFile (in: hFile=0x1c0, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0x980, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0x980, lpOverlapped=0x0) returned 1 [0121.351] ReadFile (in: hFile=0x1f4, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x0, lpOverlapped=0x0) returned 1 [0121.351] WriteFile (in: hFile=0x1c0, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0xec, lpOverlapped=0x0) returned 1 [0121.351] SetEndOfFile (hFile=0x1c0) returned 1 [0121.351] CloseHandle (hObject=0x1c0) returned 1 [0121.351] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0121.351] SetEndOfFile (hFile=0x1f4) returned 1 [0121.352] CloseHandle (hObject=0x1f4) returned 1 [0121.352] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0121.352] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\classic1.wmf")) returned 1 [0121.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 63 [0121.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 63 [0121.352] lstrlenW (lpString=".doc") returned 4 [0121.352] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0121.352] lstrlenW (lpString=".docx") returned 5 [0121.352] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0121.352] lstrlenW (lpString=".pdf") returned 4 [0121.352] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0121.352] lstrlenW (lpString=".xls") returned 4 [0121.352] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0121.352] lstrlenW (lpString=".xlsx") returned 5 [0121.352] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0121.352] lstrlenW (lpString=".ppt") returned 4 [0121.352] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0121.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 63 [0121.352] lstrlenW (lpString=".zip") returned 4 [0121.352] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0121.352] lstrlenW (lpString=".rar") returned 4 [0121.352] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0121.352] lstrlenW (lpString=".bz2") returned 4 [0121.352] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0121.352] lstrlenW (lpString=".7z") returned 3 [0121.353] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0121.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 63 [0121.353] lstrlenW (lpString=".dbf") returned 4 [0121.353] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0121.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 63 [0121.353] lstrlenW (lpString=".1cd") returned 4 [0121.353] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0121.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 63 [0121.353] lstrlenW (lpString=".jpg") returned 4 [0121.353] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0121.355] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x342ff14 | out: lpFileSize=0x342ff14*=10326) returned 1 [0121.355] CloseHandle (hObject=0x1f4) returned 1 [0121.355] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cupinst.wmf")) returned 0x20 [0121.355] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cupinst.wmf.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0121.355] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cupinst.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0121.356] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0121.356] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0121.356] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cupinst.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0121.356] GetLastError () returned 0x0 [0121.356] ReadFile (in: hFile=0x1f4, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x2856, lpOverlapped=0x0) returned 1 [0121.368] WriteFile (in: hFile=0x1c0, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0x2860, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0x2860, lpOverlapped=0x0) returned 1 [0121.369] ReadFile (in: hFile=0x1f4, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x0, lpOverlapped=0x0) returned 1 [0121.369] WriteFile (in: hFile=0x1c0, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0xea, lpOverlapped=0x0) returned 1 [0121.369] SetEndOfFile (hFile=0x1c0) returned 1 [0121.369] CloseHandle (hObject=0x1c0) returned 1 [0121.369] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0121.369] SetEndOfFile (hFile=0x1f4) returned 1 [0121.369] CloseHandle (hObject=0x1f4) returned 1 [0121.369] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0121.370] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cupinst.wmf")) returned 1 [0121.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 62 [0121.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 62 [0121.423] lstrlenW (lpString=".doc") returned 4 [0121.424] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0121.424] lstrlenW (lpString=".docx") returned 5 [0121.424] lstrcmpiW (lpString1=".docx", lpString2="T.WMF") returned -1 [0121.424] lstrlenW (lpString=".pdf") returned 4 [0121.424] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0121.424] lstrlenW (lpString=".xls") returned 4 [0121.424] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0121.424] lstrlenW (lpString=".xlsx") returned 5 [0121.424] lstrcmpiW (lpString1=".xlsx", lpString2="T.WMF") returned -1 [0121.424] lstrlenW (lpString=".ppt") returned 4 [0121.424] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0121.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 62 [0121.424] lstrlenW (lpString=".zip") returned 4 [0121.424] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0121.424] lstrlenW (lpString=".rar") returned 4 [0121.424] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0121.424] lstrlenW (lpString=".bz2") returned 4 [0121.424] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0121.424] lstrlenW (lpString=".7z") returned 3 [0121.424] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0121.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 62 [0121.424] lstrlenW (lpString=".dbf") returned 4 [0121.424] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0121.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 62 [0121.424] lstrlenW (lpString=".1cd") returned 4 [0121.424] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0121.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 62 [0121.424] lstrlenW (lpString=".jpg") returned 4 [0121.424] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0121.425] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0121.425] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0121.425] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00261_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00261_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0121.425] GetLastError () returned 0x0 [0121.425] ReadFile (in: hFile=0x1f4, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x9456, lpOverlapped=0x0) returned 1 [0121.450] WriteFile (in: hFile=0x1c0, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0x9460, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0x9460, lpOverlapped=0x0) returned 1 [0121.450] ReadFile (in: hFile=0x1f4, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x0, lpOverlapped=0x0) returned 1 [0121.451] WriteFile (in: hFile=0x1c0, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0xec, lpOverlapped=0x0) returned 1 [0121.451] SetEndOfFile (hFile=0x1c0) returned 1 [0121.451] CloseHandle (hObject=0x1c0) returned 1 [0121.451] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0121.451] SetEndOfFile (hFile=0x1f4) returned 1 [0121.451] CloseHandle (hObject=0x1f4) returned 1 [0121.451] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00261_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0121.451] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00261_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00261_.wmf")) returned 1 [0121.452] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 63 [0121.452] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 63 [0121.452] lstrlenW (lpString=".doc") returned 4 [0121.452] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0121.452] lstrlenW (lpString=".docx") returned 5 [0121.452] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0121.452] lstrlenW (lpString=".pdf") returned 4 [0121.452] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0121.452] lstrlenW (lpString=".xls") returned 4 [0121.452] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0121.452] lstrlenW (lpString=".xlsx") returned 5 [0121.452] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0121.452] lstrlenW (lpString=".ppt") returned 4 [0121.452] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0121.452] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 63 [0121.452] lstrlenW (lpString=".zip") returned 4 [0121.452] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0121.452] lstrlenW (lpString=".rar") returned 4 [0121.452] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0121.452] lstrlenW (lpString=".bz2") returned 4 [0121.452] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0121.452] lstrlenW (lpString=".7z") returned 3 [0121.452] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0121.452] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 63 [0121.452] lstrlenW (lpString=".dbf") returned 4 [0121.452] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0121.452] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 63 [0121.452] lstrlenW (lpString=".1cd") returned 4 [0121.452] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0121.452] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 63 [0121.452] lstrlenW (lpString=".jpg") returned 4 [0121.452] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0121.457] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0121.457] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0121.457] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00372_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00372_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0121.458] GetLastError () returned 0x0 [0121.458] ReadFile (in: hFile=0x1f4, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x318, lpOverlapped=0x0) returned 1 [0121.516] WriteFile (in: hFile=0x1c0, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0x320, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0x320, lpOverlapped=0x0) returned 1 [0121.517] ReadFile (in: hFile=0x1f4, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x0, lpOverlapped=0x0) returned 1 [0121.517] WriteFile (in: hFile=0x1c0, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0xec, lpOverlapped=0x0) returned 1 [0121.517] SetEndOfFile (hFile=0x1c0) returned 1 [0121.517] CloseHandle (hObject=0x1c0) returned 1 [0121.517] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0121.517] SetEndOfFile (hFile=0x1f4) returned 1 [0121.517] CloseHandle (hObject=0x1f4) returned 1 [0121.518] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00372_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0121.518] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00372_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00372_.wmf")) returned 1 [0121.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00372_.WMF") returned 63 [0121.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00372_.WMF") returned 63 [0121.518] lstrlenW (lpString=".doc") returned 4 [0121.518] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0121.518] lstrlenW (lpString=".docx") returned 5 [0121.518] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0121.518] lstrlenW (lpString=".pdf") returned 4 [0121.518] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0121.518] lstrlenW (lpString=".xls") returned 4 [0121.518] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0121.518] lstrlenW (lpString=".xlsx") returned 5 [0121.518] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0121.518] lstrlenW (lpString=".ppt") returned 4 [0121.518] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0121.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00372_.WMF") returned 63 [0121.518] lstrlenW (lpString=".zip") returned 4 [0121.518] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0121.518] lstrlenW (lpString=".rar") returned 4 [0121.518] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0121.518] lstrlenW (lpString=".bz2") returned 4 [0121.518] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0121.518] lstrlenW (lpString=".7z") returned 3 [0121.518] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0121.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00372_.WMF") returned 63 [0121.518] lstrlenW (lpString=".dbf") returned 4 [0121.518] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0121.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00372_.WMF") returned 63 [0121.518] lstrlenW (lpString=".1cd") returned 4 [0121.519] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0121.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00372_.WMF") returned 63 [0121.519] lstrlenW (lpString=".jpg") returned 4 [0121.519] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0121.519] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x342ff14 | out: lpFileSize=0x342ff14*=712) returned 1 [0121.519] CloseHandle (hObject=0x1f4) returned 1 [0121.519] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00419_.wmf")) returned 0x20 [0121.519] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00419_.wmf.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0121.519] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00419_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0121.519] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0121.519] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0121.519] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00419_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0121.520] GetLastError () returned 0x0 [0121.520] ReadFile (in: hFile=0x1f4, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x2c8, lpOverlapped=0x0) returned 1 [0121.527] WriteFile (in: hFile=0x1c0, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0x2d0, lpOverlapped=0x0) returned 1 [0121.528] ReadFile (in: hFile=0x1f4, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x0, lpOverlapped=0x0) returned 1 [0121.528] WriteFile (in: hFile=0x1c0, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0xec, lpOverlapped=0x0) returned 1 [0121.528] SetEndOfFile (hFile=0x1c0) returned 1 [0121.528] CloseHandle (hObject=0x1c0) returned 1 [0121.528] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0121.528] SetEndOfFile (hFile=0x1f4) returned 1 [0121.529] CloseHandle (hObject=0x1f4) returned 1 [0121.529] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0121.529] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00419_.wmf")) returned 1 [0121.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF") returned 63 [0121.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF") returned 63 [0121.529] lstrlenW (lpString=".doc") returned 4 [0121.529] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0121.529] lstrlenW (lpString=".docx") returned 5 [0121.529] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0121.529] lstrlenW (lpString=".pdf") returned 4 [0121.529] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0121.529] lstrlenW (lpString=".xls") returned 4 [0121.529] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0121.529] lstrlenW (lpString=".xlsx") returned 5 [0121.529] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0121.529] lstrlenW (lpString=".ppt") returned 4 [0121.529] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0121.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF") returned 63 [0121.529] lstrlenW (lpString=".zip") returned 4 [0121.529] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0121.529] lstrlenW (lpString=".rar") returned 4 [0121.529] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0121.529] lstrlenW (lpString=".bz2") returned 4 [0121.529] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0121.529] lstrlenW (lpString=".7z") returned 3 [0121.529] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0121.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF") returned 63 [0121.529] lstrlenW (lpString=".dbf") returned 4 [0121.529] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0121.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF") returned 63 [0121.529] lstrlenW (lpString=".1cd") returned 4 [0121.530] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0121.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF") returned 63 [0121.530] lstrlenW (lpString=".jpg") returned 4 [0121.530] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0121.539] GetFileSizeEx (in: hFile=0x21c, lpFileSize=0x342ff14 | out: lpFileSize=0x342ff14*=2952) returned 1 [0121.539] CloseHandle (hObject=0x21c) returned 1 [0121.539] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00448_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00448_.wmf")) returned 0x20 [0121.539] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00448_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00448_.wmf.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0121.539] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00448_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00448_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0121.540] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0121.540] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0121.540] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00448_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00448_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0121.540] GetLastError () returned 0x0 [0121.540] ReadFile (in: hFile=0x21c, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0xb88, lpOverlapped=0x0) returned 1 [0121.597] WriteFile (in: hFile=0x1ec, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0xb90, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0xb90, lpOverlapped=0x0) returned 1 [0121.597] ReadFile (in: hFile=0x21c, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x0, lpOverlapped=0x0) returned 1 [0121.597] WriteFile (in: hFile=0x1ec, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0xec, lpOverlapped=0x0) returned 1 [0121.597] SetEndOfFile (hFile=0x1ec) returned 1 [0121.598] CloseHandle (hObject=0x1ec) returned 1 [0121.598] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0121.598] SetEndOfFile (hFile=0x21c) returned 1 [0121.598] CloseHandle (hObject=0x21c) returned 1 [0121.598] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00448_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0121.598] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00448_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00448_.wmf")) returned 1 [0121.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00448_.WMF") returned 63 [0121.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00448_.WMF") returned 63 [0121.598] lstrlenW (lpString=".doc") returned 4 [0121.599] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0121.599] lstrlenW (lpString=".docx") returned 5 [0121.599] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0121.599] lstrlenW (lpString=".pdf") returned 4 [0121.599] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0121.599] lstrlenW (lpString=".xls") returned 4 [0121.599] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0121.599] lstrlenW (lpString=".xlsx") returned 5 [0121.599] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0121.599] lstrlenW (lpString=".ppt") returned 4 [0121.599] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0121.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00448_.WMF") returned 63 [0121.599] lstrlenW (lpString=".zip") returned 4 [0121.599] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0121.599] lstrlenW (lpString=".rar") returned 4 [0121.599] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0121.599] lstrlenW (lpString=".bz2") returned 4 [0121.599] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0121.599] lstrlenW (lpString=".7z") returned 3 [0121.599] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0121.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00448_.WMF") returned 63 [0121.599] lstrlenW (lpString=".dbf") returned 4 [0121.599] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0121.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00448_.WMF") returned 63 [0121.599] lstrlenW (lpString=".1cd") returned 4 [0121.599] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0121.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00448_.WMF") returned 63 [0121.599] lstrlenW (lpString=".jpg") returned 4 [0121.599] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0121.599] GetFileSizeEx (in: hFile=0x21c, lpFileSize=0x342ff14 | out: lpFileSize=0x342ff14*=14820) returned 1 [0121.599] CloseHandle (hObject=0x21c) returned 1 [0121.599] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01039_.wmf")) returned 0x20 [0121.599] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01039_.wmf.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0121.600] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01039_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0121.600] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0121.600] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0121.600] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01039_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0121.600] GetLastError () returned 0x0 [0121.600] ReadFile (in: hFile=0x21c, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x39e4, lpOverlapped=0x0) returned 1 [0121.624] WriteFile (in: hFile=0x1ec, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0x39f0, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0x39f0, lpOverlapped=0x0) returned 1 [0121.625] ReadFile (in: hFile=0x21c, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x0, lpOverlapped=0x0) returned 1 [0121.625] WriteFile (in: hFile=0x1ec, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0xec, lpOverlapped=0x0) returned 1 [0121.625] SetEndOfFile (hFile=0x1ec) returned 1 [0121.625] CloseHandle (hObject=0x1ec) returned 1 [0121.625] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0121.625] SetEndOfFile (hFile=0x21c) returned 1 [0121.625] CloseHandle (hObject=0x21c) returned 1 [0121.625] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0121.626] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01039_.wmf")) returned 1 [0121.626] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF") returned 63 [0121.626] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF") returned 63 [0121.626] lstrlenW (lpString=".doc") returned 4 [0121.626] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0121.626] lstrlenW (lpString=".docx") returned 5 [0121.626] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0121.626] lstrlenW (lpString=".pdf") returned 4 [0121.626] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0121.626] lstrlenW (lpString=".xls") returned 4 [0121.626] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0121.626] lstrlenW (lpString=".xlsx") returned 5 [0121.626] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0121.626] lstrlenW (lpString=".ppt") returned 4 [0121.626] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0121.626] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF") returned 63 [0121.626] lstrlenW (lpString=".zip") returned 4 [0121.626] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0121.626] lstrlenW (lpString=".rar") returned 4 [0121.626] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0121.626] lstrlenW (lpString=".bz2") returned 4 [0121.626] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0121.626] lstrlenW (lpString=".7z") returned 3 [0121.626] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0121.626] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF") returned 63 [0121.626] lstrlenW (lpString=".dbf") returned 4 [0121.626] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0121.626] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF") returned 63 [0121.626] lstrlenW (lpString=".1cd") returned 4 [0121.626] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0121.626] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF") returned 63 [0121.626] lstrlenW (lpString=".jpg") returned 4 [0121.626] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0121.626] GetFileSizeEx (in: hFile=0x21c, lpFileSize=0x342ff14 | out: lpFileSize=0x342ff14*=3692) returned 1 [0121.627] CloseHandle (hObject=0x21c) returned 1 [0121.627] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01138_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01138_.wmf")) returned 0x20 [0121.627] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01138_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01138_.wmf.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0121.627] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01138_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01138_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0121.627] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0121.627] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0121.627] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01138_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01138_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0121.627] GetLastError () returned 0x0 [0121.627] ReadFile (in: hFile=0x21c, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0xe6c, lpOverlapped=0x0) returned 1 [0121.638] WriteFile (in: hFile=0x1ec, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0xe70, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0xe70, lpOverlapped=0x0) returned 1 [0121.638] ReadFile (in: hFile=0x21c, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x0, lpOverlapped=0x0) returned 1 [0121.638] WriteFile (in: hFile=0x1ec, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0xec, lpOverlapped=0x0) returned 1 [0121.639] SetEndOfFile (hFile=0x1ec) returned 1 [0121.665] CloseHandle (hObject=0x1ec) returned 1 [0121.665] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0121.665] SetEndOfFile (hFile=0x21c) returned 1 [0121.666] CloseHandle (hObject=0x21c) returned 1 [0121.666] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01138_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0121.666] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01138_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01138_.wmf")) returned 1 [0121.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01138_.WMF") returned 63 [0121.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01138_.WMF") returned 63 [0121.666] lstrlenW (lpString=".doc") returned 4 [0121.666] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0121.666] lstrlenW (lpString=".docx") returned 5 [0121.667] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0121.667] lstrlenW (lpString=".pdf") returned 4 [0121.667] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0121.667] lstrlenW (lpString=".xls") returned 4 [0121.667] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0121.667] lstrlenW (lpString=".xlsx") returned 5 [0121.667] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0121.667] lstrlenW (lpString=".ppt") returned 4 [0121.667] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0121.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01138_.WMF") returned 63 [0121.667] lstrlenW (lpString=".zip") returned 4 [0121.667] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0121.667] lstrlenW (lpString=".rar") returned 4 [0121.667] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0121.667] lstrlenW (lpString=".bz2") returned 4 [0121.667] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0121.667] lstrlenW (lpString=".7z") returned 3 [0121.667] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0121.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01138_.WMF") returned 63 [0121.667] lstrlenW (lpString=".dbf") returned 4 [0121.667] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0121.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01138_.WMF") returned 63 [0121.668] lstrlenW (lpString=".1cd") returned 4 [0121.668] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0121.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01138_.WMF") returned 63 [0121.668] lstrlenW (lpString=".jpg") returned 4 [0121.668] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0121.668] GetFileSizeEx (in: hFile=0x21c, lpFileSize=0x342ff14 | out: lpFileSize=0x342ff14*=3616) returned 1 [0121.668] CloseHandle (hObject=0x21c) returned 1 [0121.668] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01140_.wmf")) returned 0x20 [0121.668] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01140_.wmf.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0121.668] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01140_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0121.669] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0121.669] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0121.669] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01140_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0121.669] GetLastError () returned 0x0 [0121.669] ReadFile (in: hFile=0x21c, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0xe20, lpOverlapped=0x0) returned 1 [0121.726] WriteFile (in: hFile=0x1ec, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0xe30, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0xe30, lpOverlapped=0x0) returned 1 [0121.726] ReadFile (in: hFile=0x21c, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x0, lpOverlapped=0x0) returned 1 [0121.726] WriteFile (in: hFile=0x1ec, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0xec, lpOverlapped=0x0) returned 1 [0121.726] SetEndOfFile (hFile=0x1ec) returned 1 [0121.727] CloseHandle (hObject=0x1ec) returned 1 [0121.727] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0121.727] SetEndOfFile (hFile=0x21c) returned 1 [0121.727] CloseHandle (hObject=0x21c) returned 1 [0121.727] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0121.727] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01140_.wmf")) returned 1 [0121.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF") returned 63 [0121.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF") returned 63 [0121.728] lstrlenW (lpString=".doc") returned 4 [0121.728] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0121.728] lstrlenW (lpString=".docx") returned 5 [0121.728] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0121.728] lstrlenW (lpString=".pdf") returned 4 [0121.728] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0121.728] lstrlenW (lpString=".xls") returned 4 [0121.728] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0121.728] lstrlenW (lpString=".xlsx") returned 5 [0121.728] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0121.728] lstrlenW (lpString=".ppt") returned 4 [0121.728] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0121.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF") returned 63 [0121.728] lstrlenW (lpString=".zip") returned 4 [0121.728] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0121.728] lstrlenW (lpString=".rar") returned 4 [0121.728] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0121.728] lstrlenW (lpString=".bz2") returned 4 [0121.728] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0121.728] lstrlenW (lpString=".7z") returned 3 [0121.728] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0121.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF") returned 63 [0121.728] lstrlenW (lpString=".dbf") returned 4 [0121.728] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0121.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF") returned 63 [0121.728] lstrlenW (lpString=".1cd") returned 4 [0121.728] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0121.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF") returned 63 [0121.728] lstrlenW (lpString=".jpg") returned 4 [0121.728] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0121.728] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0121.728] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0121.728] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01162_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01162_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0121.729] GetLastError () returned 0x0 [0121.729] ReadFile (in: hFile=0x21c, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x8fc, lpOverlapped=0x0) returned 1 [0121.751] WriteFile (in: hFile=0x1ec, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0x900, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0x900, lpOverlapped=0x0) returned 1 [0121.751] ReadFile (in: hFile=0x21c, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x0, lpOverlapped=0x0) returned 1 [0121.752] WriteFile (in: hFile=0x1ec, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0xec, lpOverlapped=0x0) returned 1 [0121.752] SetEndOfFile (hFile=0x1ec) returned 1 [0121.752] CloseHandle (hObject=0x1ec) returned 1 [0121.752] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0121.752] SetEndOfFile (hFile=0x21c) returned 1 [0121.752] CloseHandle (hObject=0x21c) returned 1 [0121.752] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01162_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0121.752] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01162_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01162_.wmf")) returned 1 [0121.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 63 [0121.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 63 [0121.753] lstrlenW (lpString=".doc") returned 4 [0121.753] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0121.753] lstrlenW (lpString=".docx") returned 5 [0121.753] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0121.753] lstrlenW (lpString=".pdf") returned 4 [0121.753] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0121.753] lstrlenW (lpString=".xls") returned 4 [0121.753] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0121.753] lstrlenW (lpString=".xlsx") returned 5 [0121.753] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0121.753] lstrlenW (lpString=".ppt") returned 4 [0121.753] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0121.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 63 [0121.753] lstrlenW (lpString=".zip") returned 4 [0121.753] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0121.753] lstrlenW (lpString=".rar") returned 4 [0121.753] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0121.753] lstrlenW (lpString=".bz2") returned 4 [0121.753] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0121.753] lstrlenW (lpString=".7z") returned 3 [0121.753] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0121.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 63 [0121.753] lstrlenW (lpString=".dbf") returned 4 [0121.753] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0121.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 63 [0121.753] lstrlenW (lpString=".1cd") returned 4 [0121.753] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0121.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 63 [0121.753] lstrlenW (lpString=".jpg") returned 4 [0121.753] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0121.754] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0121.754] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0121.754] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01168_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0121.754] GetLastError () returned 0x0 [0121.754] ReadFile (in: hFile=0x21c, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x7d4, lpOverlapped=0x0) returned 1 [0121.767] WriteFile (in: hFile=0x1ec, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0x7e0, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0x7e0, lpOverlapped=0x0) returned 1 [0121.768] ReadFile (in: hFile=0x21c, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x0, lpOverlapped=0x0) returned 1 [0121.768] WriteFile (in: hFile=0x1ec, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0xec, lpOverlapped=0x0) returned 1 [0121.768] SetEndOfFile (hFile=0x1ec) returned 1 [0121.768] CloseHandle (hObject=0x1ec) returned 1 [0121.768] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0121.768] SetEndOfFile (hFile=0x21c) returned 1 [0121.769] CloseHandle (hObject=0x21c) returned 1 [0121.769] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0121.769] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01168_.wmf")) returned 1 [0121.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 63 [0121.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 63 [0121.769] lstrlenW (lpString=".doc") returned 4 [0121.769] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0121.769] lstrlenW (lpString=".docx") returned 5 [0121.769] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0121.769] lstrlenW (lpString=".pdf") returned 4 [0121.769] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0121.769] lstrlenW (lpString=".xls") returned 4 [0121.769] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0121.769] lstrlenW (lpString=".xlsx") returned 5 [0121.769] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0121.769] lstrlenW (lpString=".ppt") returned 4 [0121.769] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0121.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 63 [0121.769] lstrlenW (lpString=".zip") returned 4 [0121.769] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0121.769] lstrlenW (lpString=".rar") returned 4 [0121.769] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0121.769] lstrlenW (lpString=".bz2") returned 4 [0121.769] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0121.769] lstrlenW (lpString=".7z") returned 3 [0121.769] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0121.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 63 [0121.769] lstrlenW (lpString=".dbf") returned 4 [0121.769] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0121.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 63 [0121.769] lstrlenW (lpString=".1cd") returned 4 [0121.770] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0121.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 63 [0121.770] lstrlenW (lpString=".jpg") returned 4 [0121.770] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0121.971] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0121.983] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0121.983] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01169_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0121.984] GetLastError () returned 0x0 [0121.984] ReadFile (in: hFile=0x22c, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x7e4, lpOverlapped=0x0) returned 1 [0122.006] WriteFile (in: hFile=0x228, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0x7f0, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0x7f0, lpOverlapped=0x0) returned 1 [0122.007] ReadFile (in: hFile=0x22c, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x0, lpOverlapped=0x0) returned 1 [0122.007] WriteFile (in: hFile=0x228, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0xec, lpOverlapped=0x0) returned 1 [0122.007] SetEndOfFile (hFile=0x228) returned 1 [0122.007] CloseHandle (hObject=0x228) returned 1 [0122.007] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0122.007] SetEndOfFile (hFile=0x22c) returned 1 [0122.007] CloseHandle (hObject=0x22c) returned 1 [0122.008] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0122.008] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01169_.wmf")) returned 1 [0122.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 63 [0122.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 63 [0122.008] lstrlenW (lpString=".doc") returned 4 [0122.009] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0122.009] lstrlenW (lpString=".docx") returned 5 [0122.009] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0122.009] lstrlenW (lpString=".pdf") returned 4 [0122.009] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0122.009] lstrlenW (lpString=".xls") returned 4 [0122.009] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0122.009] lstrlenW (lpString=".xlsx") returned 5 [0122.009] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0122.009] lstrlenW (lpString=".ppt") returned 4 [0122.009] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0122.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 63 [0122.009] lstrlenW (lpString=".zip") returned 4 [0122.009] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0122.009] lstrlenW (lpString=".rar") returned 4 [0122.009] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0122.009] lstrlenW (lpString=".bz2") returned 4 [0122.009] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0122.009] lstrlenW (lpString=".7z") returned 3 [0122.009] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0122.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 63 [0122.009] lstrlenW (lpString=".dbf") returned 4 [0122.009] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0122.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 63 [0122.009] lstrlenW (lpString=".1cd") returned 4 [0122.009] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0122.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 63 [0122.009] lstrlenW (lpString=".jpg") returned 4 [0122.009] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0122.010] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0122.010] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0122.010] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01176_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01176_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0122.010] GetLastError () returned 0x0 [0122.010] ReadFile (in: hFile=0x22c, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x760, lpOverlapped=0x0) returned 1 [0122.020] WriteFile (in: hFile=0x228, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0x770, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0x770, lpOverlapped=0x0) returned 1 [0122.021] ReadFile (in: hFile=0x22c, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x0, lpOverlapped=0x0) returned 1 [0122.021] WriteFile (in: hFile=0x228, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0xec, lpOverlapped=0x0) returned 1 [0122.021] SetEndOfFile (hFile=0x228) returned 1 [0122.021] CloseHandle (hObject=0x228) returned 1 [0122.021] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0122.021] SetEndOfFile (hFile=0x22c) returned 1 [0122.022] CloseHandle (hObject=0x22c) returned 1 [0122.022] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01176_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0122.022] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01176_.wmf")) returned 1 [0122.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 63 [0122.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 63 [0122.022] lstrlenW (lpString=".doc") returned 4 [0122.022] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0122.022] lstrlenW (lpString=".docx") returned 5 [0122.022] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0122.022] lstrlenW (lpString=".pdf") returned 4 [0122.023] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0122.023] lstrlenW (lpString=".xls") returned 4 [0122.023] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0122.023] lstrlenW (lpString=".xlsx") returned 5 [0122.023] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0122.023] lstrlenW (lpString=".ppt") returned 4 [0122.023] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0122.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 63 [0122.023] lstrlenW (lpString=".zip") returned 4 [0122.023] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0122.023] lstrlenW (lpString=".rar") returned 4 [0122.023] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0122.023] lstrlenW (lpString=".bz2") returned 4 [0122.023] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0122.023] lstrlenW (lpString=".7z") returned 3 [0122.023] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0122.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 63 [0122.023] lstrlenW (lpString=".dbf") returned 4 [0122.023] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0122.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 63 [0122.023] lstrlenW (lpString=".1cd") returned 4 [0122.023] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0122.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 63 [0122.023] lstrlenW (lpString=".jpg") returned 4 [0122.023] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0122.023] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0122.023] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0122.023] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01180_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01180_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0122.024] GetLastError () returned 0x0 [0122.024] ReadFile (in: hFile=0x22c, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x824, lpOverlapped=0x0) returned 1 [0122.076] WriteFile (in: hFile=0x228, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0x830, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0x830, lpOverlapped=0x0) returned 1 [0122.077] ReadFile (in: hFile=0x22c, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x0, lpOverlapped=0x0) returned 1 [0122.077] WriteFile (in: hFile=0x228, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0xec, lpOverlapped=0x0) returned 1 [0122.077] SetEndOfFile (hFile=0x228) returned 1 [0122.077] CloseHandle (hObject=0x228) returned 1 [0122.077] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0122.077] SetEndOfFile (hFile=0x22c) returned 1 [0122.078] CloseHandle (hObject=0x22c) returned 1 [0122.078] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01180_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0122.078] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01180_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01180_.wmf")) returned 1 [0122.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 63 [0122.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 63 [0122.078] lstrlenW (lpString=".doc") returned 4 [0122.078] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0122.078] lstrlenW (lpString=".docx") returned 5 [0122.078] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0122.078] lstrlenW (lpString=".pdf") returned 4 [0122.078] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0122.078] lstrlenW (lpString=".xls") returned 4 [0122.078] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0122.078] lstrlenW (lpString=".xlsx") returned 5 [0122.079] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0122.079] lstrlenW (lpString=".ppt") returned 4 [0122.079] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0122.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 63 [0122.079] lstrlenW (lpString=".zip") returned 4 [0122.079] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0122.079] lstrlenW (lpString=".rar") returned 4 [0122.079] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0122.079] lstrlenW (lpString=".bz2") returned 4 [0122.079] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0122.079] lstrlenW (lpString=".7z") returned 3 [0122.079] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0122.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 63 [0122.079] lstrlenW (lpString=".dbf") returned 4 [0122.079] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0122.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 63 [0122.079] lstrlenW (lpString=".1cd") returned 4 [0122.079] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0122.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 63 [0122.079] lstrlenW (lpString=".jpg") returned 4 [0122.079] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0122.079] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0122.079] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0122.079] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01186_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01186_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0122.080] GetLastError () returned 0x0 [0122.080] ReadFile (in: hFile=0x22c, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x2174, lpOverlapped=0x0) returned 1 [0122.209] WriteFile (in: hFile=0x228, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0x2180, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0x2180, lpOverlapped=0x0) returned 1 [0122.210] ReadFile (in: hFile=0x22c, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x0, lpOverlapped=0x0) returned 1 [0122.210] WriteFile (in: hFile=0x228, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0xec, lpOverlapped=0x0) returned 1 [0122.210] SetEndOfFile (hFile=0x228) returned 1 [0122.252] CloseHandle (hObject=0x228) returned 1 [0122.252] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0122.252] SetEndOfFile (hFile=0x22c) returned 1 [0122.252] CloseHandle (hObject=0x22c) returned 1 [0122.252] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01186_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0122.253] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01186_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01186_.wmf")) returned 1 [0122.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 63 [0122.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 63 [0122.262] lstrlenW (lpString=".doc") returned 4 [0122.262] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0122.262] lstrlenW (lpString=".docx") returned 5 [0122.262] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0122.262] lstrlenW (lpString=".pdf") returned 4 [0122.262] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0122.262] lstrlenW (lpString=".xls") returned 4 [0122.262] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0122.262] lstrlenW (lpString=".xlsx") returned 5 [0122.262] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0122.262] lstrlenW (lpString=".ppt") returned 4 [0122.262] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0122.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 63 [0122.262] lstrlenW (lpString=".zip") returned 4 [0122.262] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0122.262] lstrlenW (lpString=".rar") returned 4 [0122.262] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0122.262] lstrlenW (lpString=".bz2") returned 4 [0122.262] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0122.262] lstrlenW (lpString=".7z") returned 3 [0122.262] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0122.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 63 [0122.262] lstrlenW (lpString=".dbf") returned 4 [0122.262] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0122.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 63 [0122.262] lstrlenW (lpString=".1cd") returned 4 [0122.262] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0122.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 63 [0122.262] lstrlenW (lpString=".jpg") returned 4 [0122.262] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0122.263] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0122.263] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0122.263] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01586_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0122.263] GetLastError () returned 0x0 [0122.263] ReadFile (in: hFile=0x220, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x914, lpOverlapped=0x0) returned 1 [0122.327] WriteFile (in: hFile=0x1a0, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0x920, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0x920, lpOverlapped=0x0) returned 1 [0122.329] ReadFile (in: hFile=0x220, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x0, lpOverlapped=0x0) returned 1 [0122.329] WriteFile (in: hFile=0x1a0, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0xec, lpOverlapped=0x0) returned 1 [0122.329] SetEndOfFile (hFile=0x1a0) returned 1 [0122.329] CloseHandle (hObject=0x1a0) returned 1 [0122.329] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0122.329] SetEndOfFile (hFile=0x220) returned 1 [0122.330] CloseHandle (hObject=0x220) returned 1 [0122.330] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0122.330] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01586_.wmf")) returned 1 [0122.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 63 [0122.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 63 [0122.334] lstrlenW (lpString=".doc") returned 4 [0122.334] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0122.334] lstrlenW (lpString=".docx") returned 5 [0122.334] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0122.334] lstrlenW (lpString=".pdf") returned 4 [0122.334] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0122.334] lstrlenW (lpString=".xls") returned 4 [0122.334] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0122.334] lstrlenW (lpString=".xlsx") returned 5 [0122.334] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0122.334] lstrlenW (lpString=".ppt") returned 4 [0122.334] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0122.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 63 [0122.334] lstrlenW (lpString=".zip") returned 4 [0122.334] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0122.334] lstrlenW (lpString=".rar") returned 4 [0122.334] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0122.334] lstrlenW (lpString=".bz2") returned 4 [0122.334] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0122.334] lstrlenW (lpString=".7z") returned 3 [0122.335] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0122.335] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 63 [0122.335] lstrlenW (lpString=".dbf") returned 4 [0122.335] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0122.335] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 63 [0122.335] lstrlenW (lpString=".1cd") returned 4 [0122.335] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0122.335] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 63 [0122.335] lstrlenW (lpString=".jpg") returned 4 [0122.335] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0122.335] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0122.335] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0122.335] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01793_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0122.336] GetLastError () returned 0x0 [0122.336] ReadFile (in: hFile=0x220, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0xcb4, lpOverlapped=0x0) returned 1 [0122.389] WriteFile (in: hFile=0x1a0, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0xcc0, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0xcc0, lpOverlapped=0x0) returned 1 [0122.390] ReadFile (in: hFile=0x220, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x0, lpOverlapped=0x0) returned 1 [0122.390] WriteFile (in: hFile=0x1a0, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0xec, lpOverlapped=0x0) returned 1 [0122.390] SetEndOfFile (hFile=0x1a0) returned 1 [0122.390] CloseHandle (hObject=0x1a0) returned 1 [0122.390] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0122.390] SetEndOfFile (hFile=0x220) returned 1 [0122.391] CloseHandle (hObject=0x220) returned 1 [0122.391] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0122.391] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01793_.wmf")) returned 1 [0122.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 63 [0122.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 63 [0122.392] lstrlenW (lpString=".doc") returned 4 [0122.392] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0122.392] lstrlenW (lpString=".docx") returned 5 [0122.392] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0122.392] lstrlenW (lpString=".pdf") returned 4 [0122.392] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0122.392] lstrlenW (lpString=".xls") returned 4 [0122.392] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0122.392] lstrlenW (lpString=".xlsx") returned 5 [0122.392] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0122.392] lstrlenW (lpString=".ppt") returned 4 [0122.392] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0122.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 63 [0122.392] lstrlenW (lpString=".zip") returned 4 [0122.392] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0122.392] lstrlenW (lpString=".rar") returned 4 [0122.392] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0122.392] lstrlenW (lpString=".bz2") returned 4 [0122.392] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0122.392] lstrlenW (lpString=".7z") returned 3 [0122.392] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0122.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 63 [0122.392] lstrlenW (lpString=".dbf") returned 4 [0122.392] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0122.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 63 [0122.392] lstrlenW (lpString=".1cd") returned 4 [0122.392] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0122.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 63 [0122.392] lstrlenW (lpString=".jpg") returned 4 [0122.392] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0122.393] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x342ff14 | out: lpFileSize=0x342ff14*=1382) returned 1 [0122.393] CloseHandle (hObject=0x220) returned 1 [0122.393] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00010_.wmf")) returned 0x20 [0122.393] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00010_.wmf.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0122.393] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00010_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0122.393] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0122.394] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0122.394] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00010_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0122.394] GetLastError () returned 0x0 [0122.394] ReadFile (in: hFile=0x220, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x566, lpOverlapped=0x0) returned 1 [0122.395] WriteFile (in: hFile=0x1a0, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0x570, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0x570, lpOverlapped=0x0) returned 1 [0122.396] ReadFile (in: hFile=0x220, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x0, lpOverlapped=0x0) returned 1 [0122.396] WriteFile (in: hFile=0x1a0, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0xec, lpOverlapped=0x0) returned 1 [0122.396] SetEndOfFile (hFile=0x1a0) returned 1 [0122.396] CloseHandle (hObject=0x1a0) returned 1 [0122.396] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0122.396] SetEndOfFile (hFile=0x220) returned 1 [0122.397] CloseHandle (hObject=0x220) returned 1 [0122.397] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0122.397] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00010_.wmf")) returned 1 [0122.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF") returned 63 [0122.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF") returned 63 [0122.397] lstrlenW (lpString=".doc") returned 4 [0122.397] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0122.397] lstrlenW (lpString=".docx") returned 5 [0122.397] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0122.398] lstrlenW (lpString=".pdf") returned 4 [0122.398] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0122.398] lstrlenW (lpString=".xls") returned 4 [0122.398] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0122.398] lstrlenW (lpString=".xlsx") returned 5 [0122.398] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0122.398] lstrlenW (lpString=".ppt") returned 4 [0122.398] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0122.398] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF") returned 63 [0122.398] lstrlenW (lpString=".zip") returned 4 [0122.398] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0122.398] lstrlenW (lpString=".rar") returned 4 [0122.398] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0122.398] lstrlenW (lpString=".bz2") returned 4 [0122.398] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0122.398] lstrlenW (lpString=".7z") returned 3 [0122.398] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0122.398] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF") returned 63 [0122.398] lstrlenW (lpString=".dbf") returned 4 [0122.398] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0122.398] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF") returned 63 [0122.398] lstrlenW (lpString=".1cd") returned 4 [0122.398] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0122.398] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF") returned 63 [0122.398] lstrlenW (lpString=".jpg") returned 4 [0122.398] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0122.399] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0122.399] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0122.399] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00019_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0122.399] GetLastError () returned 0x0 [0122.399] ReadFile (in: hFile=0x220, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x32f2, lpOverlapped=0x0) returned 1 [0122.441] WriteFile (in: hFile=0x1a0, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0x3300, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0x3300, lpOverlapped=0x0) returned 1 [0122.442] ReadFile (in: hFile=0x220, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x0, lpOverlapped=0x0) returned 1 [0122.442] WriteFile (in: hFile=0x1a0, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0xec, lpOverlapped=0x0) returned 1 [0122.442] SetEndOfFile (hFile=0x1a0) returned 1 [0122.442] CloseHandle (hObject=0x1a0) returned 1 [0122.442] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0122.443] SetEndOfFile (hFile=0x220) returned 1 [0122.443] CloseHandle (hObject=0x220) returned 1 [0122.443] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0122.443] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00019_.wmf")) returned 1 [0122.463] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF") returned 63 [0122.463] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF") returned 63 [0122.463] lstrlenW (lpString=".doc") returned 4 [0122.463] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0122.463] lstrlenW (lpString=".docx") returned 5 [0122.463] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0122.463] lstrlenW (lpString=".pdf") returned 4 [0122.463] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0122.463] lstrlenW (lpString=".xls") returned 4 [0122.463] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0122.463] lstrlenW (lpString=".xlsx") returned 5 [0122.463] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0122.463] lstrlenW (lpString=".ppt") returned 4 [0122.463] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0122.463] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF") returned 63 [0122.464] lstrlenW (lpString=".zip") returned 4 [0122.464] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0122.464] lstrlenW (lpString=".rar") returned 4 [0122.464] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0122.464] lstrlenW (lpString=".bz2") returned 4 [0122.464] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0122.464] lstrlenW (lpString=".7z") returned 3 [0122.464] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0122.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF") returned 63 [0122.464] lstrlenW (lpString=".dbf") returned 4 [0122.464] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0122.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF") returned 63 [0122.464] lstrlenW (lpString=".1cd") returned 4 [0122.464] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0122.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF") returned 63 [0122.464] lstrlenW (lpString=".jpg") returned 4 [0122.464] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0122.465] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x342ff14 | out: lpFileSize=0x342ff14*=6938) returned 1 [0122.465] CloseHandle (hObject=0x208) returned 1 [0122.466] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00202_.wmf")) returned 0x20 [0122.466] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00202_.wmf.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0122.466] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00202_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0122.466] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0122.466] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0122.466] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00202_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0122.467] GetLastError () returned 0x0 [0122.467] ReadFile (in: hFile=0x208, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x1b1a, lpOverlapped=0x0) returned 1 [0122.488] WriteFile (in: hFile=0x230, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0x1b20, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0x1b20, lpOverlapped=0x0) returned 1 [0122.488] ReadFile (in: hFile=0x208, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x0, lpOverlapped=0x0) returned 1 [0122.488] WriteFile (in: hFile=0x230, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0xec, lpOverlapped=0x0) returned 1 [0122.488] SetEndOfFile (hFile=0x230) returned 1 [0122.488] CloseHandle (hObject=0x230) returned 1 [0122.489] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0122.489] SetEndOfFile (hFile=0x208) returned 1 [0122.489] CloseHandle (hObject=0x208) returned 1 [0122.489] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0122.489] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00202_.wmf")) returned 1 [0122.489] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF") returned 63 [0122.489] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF") returned 63 [0122.489] lstrlenW (lpString=".doc") returned 4 [0122.490] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0122.490] lstrlenW (lpString=".docx") returned 5 [0122.490] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0122.490] lstrlenW (lpString=".pdf") returned 4 [0122.490] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0122.490] lstrlenW (lpString=".xls") returned 4 [0122.490] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0122.490] lstrlenW (lpString=".xlsx") returned 5 [0122.490] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0122.490] lstrlenW (lpString=".ppt") returned 4 [0122.490] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0122.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF") returned 63 [0122.490] lstrlenW (lpString=".zip") returned 4 [0122.490] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0122.490] lstrlenW (lpString=".rar") returned 4 [0122.490] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0122.490] lstrlenW (lpString=".bz2") returned 4 [0122.490] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0122.490] lstrlenW (lpString=".7z") returned 3 [0122.490] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0122.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF") returned 63 [0122.490] lstrlenW (lpString=".dbf") returned 4 [0122.490] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0122.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF") returned 63 [0122.490] lstrlenW (lpString=".1cd") returned 4 [0122.490] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0122.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF") returned 63 [0122.490] lstrlenW (lpString=".jpg") returned 4 [0122.490] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0122.491] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0122.491] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0122.491] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00242_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00242_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0122.491] GetLastError () returned 0x0 [0122.491] ReadFile (in: hFile=0x208, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x1a7c, lpOverlapped=0x0) returned 1 [0122.542] WriteFile (in: hFile=0x230, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0x1a80, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0x1a80, lpOverlapped=0x0) returned 1 [0122.543] ReadFile (in: hFile=0x208, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x0, lpOverlapped=0x0) returned 1 [0122.543] WriteFile (in: hFile=0x230, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0xec, lpOverlapped=0x0) returned 1 [0122.543] SetEndOfFile (hFile=0x230) returned 1 [0122.543] CloseHandle (hObject=0x230) returned 1 [0122.543] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0122.543] SetEndOfFile (hFile=0x208) returned 1 [0122.544] CloseHandle (hObject=0x208) returned 1 [0122.544] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00242_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0122.544] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00242_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00242_.wmf")) returned 1 [0122.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 63 [0122.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 63 [0122.544] lstrlenW (lpString=".doc") returned 4 [0122.544] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0122.544] lstrlenW (lpString=".docx") returned 5 [0122.544] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0122.544] lstrlenW (lpString=".pdf") returned 4 [0122.544] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0122.544] lstrlenW (lpString=".xls") returned 4 [0122.544] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0122.545] lstrlenW (lpString=".xlsx") returned 5 [0122.545] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0122.545] lstrlenW (lpString=".ppt") returned 4 [0122.545] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0122.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 63 [0122.545] lstrlenW (lpString=".zip") returned 4 [0122.545] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0122.545] lstrlenW (lpString=".rar") returned 4 [0122.545] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0122.545] lstrlenW (lpString=".bz2") returned 4 [0122.545] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0122.545] lstrlenW (lpString=".7z") returned 3 [0122.545] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0122.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 63 [0122.545] lstrlenW (lpString=".dbf") returned 4 [0122.545] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0122.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 63 [0122.545] lstrlenW (lpString=".1cd") returned 4 [0122.545] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0122.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 63 [0122.545] lstrlenW (lpString=".jpg") returned 4 [0122.545] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0122.546] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0122.546] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0122.546] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00076_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00076_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0122.546] GetLastError () returned 0x0 [0122.546] ReadFile (in: hFile=0x208, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x2eda, lpOverlapped=0x0) returned 1 [0122.632] WriteFile (in: hFile=0x230, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0x2ee0, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0x2ee0, lpOverlapped=0x0) returned 1 [0122.632] ReadFile (in: hFile=0x208, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x0, lpOverlapped=0x0) returned 1 [0122.632] WriteFile (in: hFile=0x230, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0xec, lpOverlapped=0x0) returned 1 [0122.632] SetEndOfFile (hFile=0x230) returned 1 [0122.633] CloseHandle (hObject=0x230) returned 1 [0122.633] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0122.633] SetEndOfFile (hFile=0x208) returned 1 [0122.633] CloseHandle (hObject=0x208) returned 1 [0122.633] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00076_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0122.633] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00076_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00076_.wmf")) returned 1 [0122.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 63 [0122.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 63 [0122.634] lstrlenW (lpString=".doc") returned 4 [0122.634] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0122.634] lstrlenW (lpString=".docx") returned 5 [0122.634] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0122.634] lstrlenW (lpString=".pdf") returned 4 [0122.634] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0122.634] lstrlenW (lpString=".xls") returned 4 [0122.634] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0122.634] lstrlenW (lpString=".xlsx") returned 5 [0122.634] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0122.634] lstrlenW (lpString=".ppt") returned 4 [0122.634] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0122.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 63 [0122.634] lstrlenW (lpString=".zip") returned 4 [0122.634] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0122.634] lstrlenW (lpString=".rar") returned 4 [0122.634] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0122.634] lstrlenW (lpString=".bz2") returned 4 [0122.634] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0122.634] lstrlenW (lpString=".7z") returned 3 [0122.634] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0122.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 63 [0122.634] lstrlenW (lpString=".dbf") returned 4 [0122.634] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0122.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 63 [0122.634] lstrlenW (lpString=".1cd") returned 4 [0122.634] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0122.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 63 [0122.634] lstrlenW (lpString=".jpg") returned 4 [0122.634] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0122.635] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0122.635] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0122.635] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00090_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0122.635] GetLastError () returned 0x0 [0122.635] ReadFile (in: hFile=0x208, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x3772, lpOverlapped=0x0) returned 1 [0122.922] WriteFile (in: hFile=0x230, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0x3780, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0x3780, lpOverlapped=0x0) returned 1 [0122.922] ReadFile (in: hFile=0x208, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x0, lpOverlapped=0x0) returned 1 [0122.923] WriteFile (in: hFile=0x230, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0xec, lpOverlapped=0x0) returned 1 [0122.923] SetEndOfFile (hFile=0x230) returned 1 [0122.923] CloseHandle (hObject=0x230) returned 1 [0122.923] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0122.923] SetEndOfFile (hFile=0x208) returned 1 [0122.923] CloseHandle (hObject=0x208) returned 1 [0122.923] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0122.924] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00090_.wmf")) returned 1 [0122.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 63 [0122.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 63 [0122.924] lstrlenW (lpString=".doc") returned 4 [0122.924] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0122.924] lstrlenW (lpString=".docx") returned 5 [0122.924] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0122.924] lstrlenW (lpString=".pdf") returned 4 [0122.924] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0122.924] lstrlenW (lpString=".xls") returned 4 [0122.924] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0122.924] lstrlenW (lpString=".xlsx") returned 5 [0122.924] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0122.924] lstrlenW (lpString=".ppt") returned 4 [0122.924] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0122.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 63 [0122.924] lstrlenW (lpString=".zip") returned 4 [0122.924] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0122.924] lstrlenW (lpString=".rar") returned 4 [0122.924] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0122.924] lstrlenW (lpString=".bz2") returned 4 [0122.924] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0122.924] lstrlenW (lpString=".7z") returned 3 [0122.924] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0122.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 63 [0122.924] lstrlenW (lpString=".dbf") returned 4 [0122.924] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0122.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 63 [0122.924] lstrlenW (lpString=".1cd") returned 4 [0122.924] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0122.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 63 [0122.924] lstrlenW (lpString=".jpg") returned 4 [0122.924] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0122.926] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0122.926] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0122.926] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00459_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00459_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0122.952] GetLastError () returned 0x0 [0122.952] ReadFile (in: hFile=0x208, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x43fe, lpOverlapped=0x0) returned 1 [0123.021] WriteFile (in: hFile=0x230, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0x4400, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0x4400, lpOverlapped=0x0) returned 1 [0123.022] ReadFile (in: hFile=0x208, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x0, lpOverlapped=0x0) returned 1 [0123.022] WriteFile (in: hFile=0x230, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0xec, lpOverlapped=0x0) returned 1 [0123.022] SetEndOfFile (hFile=0x230) returned 1 [0123.022] CloseHandle (hObject=0x230) returned 1 [0123.022] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0123.022] SetEndOfFile (hFile=0x208) returned 1 [0123.023] CloseHandle (hObject=0x208) returned 1 [0123.023] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00459_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0123.023] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00459_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00459_.wmf")) returned 1 [0123.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 63 [0123.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 63 [0123.024] lstrlenW (lpString=".doc") returned 4 [0123.024] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0123.024] lstrlenW (lpString=".docx") returned 5 [0123.024] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0123.024] lstrlenW (lpString=".pdf") returned 4 [0123.024] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0123.024] lstrlenW (lpString=".xls") returned 4 [0123.024] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0123.024] lstrlenW (lpString=".xlsx") returned 5 [0123.024] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0123.024] lstrlenW (lpString=".ppt") returned 4 [0123.024] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0123.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 63 [0123.024] lstrlenW (lpString=".zip") returned 4 [0123.024] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0123.024] lstrlenW (lpString=".rar") returned 4 [0123.024] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0123.024] lstrlenW (lpString=".bz2") returned 4 [0123.024] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0123.024] lstrlenW (lpString=".7z") returned 3 [0123.024] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0123.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 63 [0123.024] lstrlenW (lpString=".dbf") returned 4 [0123.024] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0123.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 63 [0123.024] lstrlenW (lpString=".1cd") returned 4 [0123.025] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0123.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 63 [0123.025] lstrlenW (lpString=".jpg") returned 4 [0123.025] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0123.029] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0123.029] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0123.029] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00779_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00779_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0123.030] GetLastError () returned 0x0 [0123.030] ReadFile (in: hFile=0x21c, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x2332, lpOverlapped=0x0) returned 1 [0123.074] WriteFile (in: hFile=0x218, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0x2340, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0x2340, lpOverlapped=0x0) returned 1 [0123.074] ReadFile (in: hFile=0x21c, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x0, lpOverlapped=0x0) returned 1 [0123.074] WriteFile (in: hFile=0x218, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0xec, lpOverlapped=0x0) returned 1 [0123.074] SetEndOfFile (hFile=0x218) returned 1 [0123.075] CloseHandle (hObject=0x218) returned 1 [0123.075] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0123.075] SetEndOfFile (hFile=0x21c) returned 1 [0123.075] CloseHandle (hObject=0x21c) returned 1 [0123.075] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00779_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0123.075] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00779_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00779_.wmf")) returned 1 [0123.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 63 [0123.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 63 [0123.076] lstrlenW (lpString=".doc") returned 4 [0123.076] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0123.076] lstrlenW (lpString=".docx") returned 5 [0123.076] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0123.076] lstrlenW (lpString=".pdf") returned 4 [0123.076] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0123.076] lstrlenW (lpString=".xls") returned 4 [0123.076] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0123.076] lstrlenW (lpString=".xlsx") returned 5 [0123.076] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0123.076] lstrlenW (lpString=".ppt") returned 4 [0123.076] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0123.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 63 [0123.076] lstrlenW (lpString=".zip") returned 4 [0123.076] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0123.076] lstrlenW (lpString=".rar") returned 4 [0123.076] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0123.076] lstrlenW (lpString=".bz2") returned 4 [0123.076] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0123.076] lstrlenW (lpString=".7z") returned 3 [0123.076] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0123.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 63 [0123.076] lstrlenW (lpString=".dbf") returned 4 [0123.076] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0123.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 63 [0123.076] lstrlenW (lpString=".1cd") returned 4 [0123.076] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0123.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 63 [0123.076] lstrlenW (lpString=".jpg") returned 4 [0123.076] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0123.077] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0123.077] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0123.077] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01074_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01074_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0123.077] GetLastError () returned 0x0 [0123.077] ReadFile (in: hFile=0x21c, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x121a, lpOverlapped=0x0) returned 1 [0123.142] WriteFile (in: hFile=0x218, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0x1220, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0x1220, lpOverlapped=0x0) returned 1 [0123.143] ReadFile (in: hFile=0x21c, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x0, lpOverlapped=0x0) returned 1 [0123.143] WriteFile (in: hFile=0x218, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0xec, lpOverlapped=0x0) returned 1 [0123.143] SetEndOfFile (hFile=0x218) returned 1 [0123.143] CloseHandle (hObject=0x218) returned 1 [0123.143] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0123.143] SetEndOfFile (hFile=0x21c) returned 1 [0123.143] CloseHandle (hObject=0x21c) returned 1 [0123.143] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01074_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0123.144] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01074_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01074_.wmf")) returned 1 [0123.144] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 63 [0123.144] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 63 [0123.144] lstrlenW (lpString=".doc") returned 4 [0123.144] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0123.144] lstrlenW (lpString=".docx") returned 5 [0123.144] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0123.144] lstrlenW (lpString=".pdf") returned 4 [0123.144] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0123.144] lstrlenW (lpString=".xls") returned 4 [0123.144] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0123.144] lstrlenW (lpString=".xlsx") returned 5 [0123.144] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0123.144] lstrlenW (lpString=".ppt") returned 4 [0123.144] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0123.144] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 63 [0123.144] lstrlenW (lpString=".zip") returned 4 [0123.144] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0123.144] lstrlenW (lpString=".rar") returned 4 [0123.144] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0123.144] lstrlenW (lpString=".bz2") returned 4 [0123.144] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0123.144] lstrlenW (lpString=".7z") returned 3 [0123.144] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0123.144] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 63 [0123.144] lstrlenW (lpString=".dbf") returned 4 [0123.144] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0123.144] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 63 [0123.144] lstrlenW (lpString=".1cd") returned 4 [0123.144] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0123.144] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 63 [0123.144] lstrlenW (lpString=".jpg") returned 4 [0123.145] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0123.145] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0123.145] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0123.145] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01176_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0123.145] GetLastError () returned 0x0 [0123.145] ReadFile (in: hFile=0x21c, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x1378, lpOverlapped=0x0) returned 1 [0123.160] WriteFile (in: hFile=0x218, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0x1380, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0x1380, lpOverlapped=0x0) returned 1 [0123.160] ReadFile (in: hFile=0x21c, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x0, lpOverlapped=0x0) returned 1 [0123.160] WriteFile (in: hFile=0x218, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0xec, lpOverlapped=0x0) returned 1 [0123.161] SetEndOfFile (hFile=0x218) returned 1 [0123.161] CloseHandle (hObject=0x218) returned 1 [0123.161] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0123.161] SetEndOfFile (hFile=0x21c) returned 1 [0123.162] CloseHandle (hObject=0x21c) returned 1 [0123.162] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0123.162] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01176_.wmf")) returned 1 [0123.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 63 [0123.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 63 [0123.171] lstrlenW (lpString=".doc") returned 4 [0123.171] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0123.171] lstrlenW (lpString=".docx") returned 5 [0123.171] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0123.171] lstrlenW (lpString=".pdf") returned 4 [0123.171] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0123.171] lstrlenW (lpString=".xls") returned 4 [0123.171] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0123.171] lstrlenW (lpString=".xlsx") returned 5 [0123.171] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0123.171] lstrlenW (lpString=".ppt") returned 4 [0123.171] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0123.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 63 [0123.171] lstrlenW (lpString=".zip") returned 4 [0123.171] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0123.171] lstrlenW (lpString=".rar") returned 4 [0123.171] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0123.171] lstrlenW (lpString=".bz2") returned 4 [0123.171] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0123.171] lstrlenW (lpString=".7z") returned 3 [0123.171] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0123.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 63 [0123.171] lstrlenW (lpString=".dbf") returned 4 [0123.171] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0123.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 63 [0123.171] lstrlenW (lpString=".1cd") returned 4 [0123.171] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0123.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 63 [0123.171] lstrlenW (lpString=".jpg") returned 4 [0123.171] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0123.172] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0123.172] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0123.172] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01193_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01193_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0123.172] GetLastError () returned 0x0 [0123.172] ReadFile (in: hFile=0x1a0, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x488, lpOverlapped=0x0) returned 1 [0123.197] WriteFile (in: hFile=0x1f0, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0x490, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0x490, lpOverlapped=0x0) returned 1 [0123.199] ReadFile (in: hFile=0x1a0, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x0, lpOverlapped=0x0) returned 1 [0123.199] WriteFile (in: hFile=0x1f0, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0xec, lpOverlapped=0x0) returned 1 [0123.199] SetEndOfFile (hFile=0x1f0) returned 1 [0123.199] CloseHandle (hObject=0x1f0) returned 1 [0123.199] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0123.199] SetEndOfFile (hFile=0x1a0) returned 1 [0123.199] CloseHandle (hObject=0x1a0) returned 1 [0123.199] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01193_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0123.200] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01193_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01193_.wmf")) returned 1 [0123.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 63 [0123.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 63 [0123.200] lstrlenW (lpString=".doc") returned 4 [0123.200] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0123.200] lstrlenW (lpString=".docx") returned 5 [0123.200] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0123.200] lstrlenW (lpString=".pdf") returned 4 [0123.200] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0123.200] lstrlenW (lpString=".xls") returned 4 [0123.200] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0123.200] lstrlenW (lpString=".xlsx") returned 5 [0123.200] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0123.200] lstrlenW (lpString=".ppt") returned 4 [0123.200] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0123.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 63 [0123.200] lstrlenW (lpString=".zip") returned 4 [0123.200] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0123.200] lstrlenW (lpString=".rar") returned 4 [0123.200] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0123.200] lstrlenW (lpString=".bz2") returned 4 [0123.200] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0123.200] lstrlenW (lpString=".7z") returned 3 [0123.200] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0123.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 63 [0123.200] lstrlenW (lpString=".dbf") returned 4 [0123.200] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0123.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 63 [0123.200] lstrlenW (lpString=".1cd") returned 4 [0123.201] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0123.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 63 [0123.201] lstrlenW (lpString=".jpg") returned 4 [0123.201] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0123.201] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0123.201] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0123.201] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01657_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0123.201] GetLastError () returned 0x0 [0123.201] ReadFile (in: hFile=0x1a0, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x76ce, lpOverlapped=0x0) returned 1 [0123.213] WriteFile (in: hFile=0x1f0, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0x76d0, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0x76d0, lpOverlapped=0x0) returned 1 [0123.214] ReadFile (in: hFile=0x1a0, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x0, lpOverlapped=0x0) returned 1 [0123.214] WriteFile (in: hFile=0x1f0, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0xec, lpOverlapped=0x0) returned 1 [0123.214] SetEndOfFile (hFile=0x1f0) returned 1 [0123.214] CloseHandle (hObject=0x1f0) returned 1 [0123.215] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0123.215] SetEndOfFile (hFile=0x1a0) returned 1 [0123.216] CloseHandle (hObject=0x1a0) returned 1 [0123.216] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0123.216] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01657_.wmf")) returned 1 [0123.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 63 [0123.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 63 [0123.251] lstrlenW (lpString=".doc") returned 4 [0123.251] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0123.251] lstrlenW (lpString=".docx") returned 5 [0123.251] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0123.251] lstrlenW (lpString=".pdf") returned 4 [0123.251] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0123.251] lstrlenW (lpString=".xls") returned 4 [0123.251] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0123.251] lstrlenW (lpString=".xlsx") returned 5 [0123.251] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0123.251] lstrlenW (lpString=".ppt") returned 4 [0123.251] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0123.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 63 [0123.251] lstrlenW (lpString=".zip") returned 4 [0123.251] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0123.251] lstrlenW (lpString=".rar") returned 4 [0123.251] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0123.251] lstrlenW (lpString=".bz2") returned 4 [0123.251] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0123.251] lstrlenW (lpString=".7z") returned 3 [0123.251] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0123.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 63 [0123.251] lstrlenW (lpString=".dbf") returned 4 [0123.251] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0123.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 63 [0123.251] lstrlenW (lpString=".1cd") returned 4 [0123.251] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0123.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 63 [0123.251] lstrlenW (lpString=".jpg") returned 4 [0123.251] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0123.276] SetFilePointerEx (in: hFile=0x238, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0123.276] SetFilePointerEx (in: hFile=0x238, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0123.276] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01658_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01658_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0123.276] GetLastError () returned 0x0 [0123.276] ReadFile (in: hFile=0x238, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x4604, lpOverlapped=0x0) returned 1 [0123.326] WriteFile (in: hFile=0x16c, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0x4610, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0x4610, lpOverlapped=0x0) returned 1 [0123.327] ReadFile (in: hFile=0x238, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x0, lpOverlapped=0x0) returned 1 [0123.327] WriteFile (in: hFile=0x16c, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0xec, lpOverlapped=0x0) returned 1 [0123.327] SetEndOfFile (hFile=0x16c) returned 1 [0123.327] CloseHandle (hObject=0x16c) returned 1 [0123.327] SetFilePointerEx (in: hFile=0x238, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0123.327] SetEndOfFile (hFile=0x238) returned 1 [0123.328] CloseHandle (hObject=0x238) returned 1 [0123.328] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01658_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0123.328] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01658_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01658_.wmf")) returned 1 [0123.329] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01658_.WMF") returned 63 [0123.329] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01658_.WMF") returned 63 [0123.329] lstrlenW (lpString=".doc") returned 4 [0123.329] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0123.329] lstrlenW (lpString=".docx") returned 5 [0123.329] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0123.329] lstrlenW (lpString=".pdf") returned 4 [0123.329] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0123.329] lstrlenW (lpString=".xls") returned 4 [0123.329] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0123.329] lstrlenW (lpString=".xlsx") returned 5 [0123.329] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0123.329] lstrlenW (lpString=".ppt") returned 4 [0123.329] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0123.329] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01658_.WMF") returned 63 [0123.329] lstrlenW (lpString=".zip") returned 4 [0123.329] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0123.329] lstrlenW (lpString=".rar") returned 4 [0123.329] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0123.329] lstrlenW (lpString=".bz2") returned 4 [0123.329] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0123.329] lstrlenW (lpString=".7z") returned 3 [0123.329] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0123.329] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01658_.WMF") returned 63 [0123.329] lstrlenW (lpString=".dbf") returned 4 [0123.329] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0123.329] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01658_.WMF") returned 63 [0123.329] lstrlenW (lpString=".1cd") returned 4 [0123.329] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0123.329] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01658_.WMF") returned 63 [0123.329] lstrlenW (lpString=".jpg") returned 4 [0123.329] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0123.329] SetFilePointerEx (in: hFile=0x238, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0123.329] SetFilePointerEx (in: hFile=0x238, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0123.330] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02097_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02097_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0123.330] GetLastError () returned 0x0 [0123.330] ReadFile (in: hFile=0x238, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x61c, lpOverlapped=0x0) returned 1 [0123.337] WriteFile (in: hFile=0x16c, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0x620, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0x620, lpOverlapped=0x0) returned 1 [0123.338] ReadFile (in: hFile=0x238, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x0, lpOverlapped=0x0) returned 1 [0123.338] WriteFile (in: hFile=0x16c, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0xec, lpOverlapped=0x0) returned 1 [0123.338] SetEndOfFile (hFile=0x16c) returned 1 [0123.338] CloseHandle (hObject=0x16c) returned 1 [0123.338] SetFilePointerEx (in: hFile=0x238, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0123.338] SetEndOfFile (hFile=0x238) returned 1 [0123.339] CloseHandle (hObject=0x238) returned 1 [0123.339] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02097_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0123.339] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02097_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02097_.wmf")) returned 1 [0123.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02097_.WMF") returned 63 [0123.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02097_.WMF") returned 63 [0123.339] lstrlenW (lpString=".doc") returned 4 [0123.339] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0123.339] lstrlenW (lpString=".docx") returned 5 [0123.339] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0123.340] lstrlenW (lpString=".pdf") returned 4 [0123.340] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0123.340] lstrlenW (lpString=".xls") returned 4 [0123.340] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0123.340] lstrlenW (lpString=".xlsx") returned 5 [0123.340] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0123.340] lstrlenW (lpString=".ppt") returned 4 [0123.340] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0123.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02097_.WMF") returned 63 [0123.340] lstrlenW (lpString=".zip") returned 4 [0123.340] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0123.340] lstrlenW (lpString=".rar") returned 4 [0123.340] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0123.340] lstrlenW (lpString=".bz2") returned 4 [0123.340] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0123.340] lstrlenW (lpString=".7z") returned 3 [0123.340] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0123.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02097_.WMF") returned 63 [0123.340] lstrlenW (lpString=".dbf") returned 4 [0123.340] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0123.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02097_.WMF") returned 63 [0123.340] lstrlenW (lpString=".1cd") returned 4 [0123.340] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0123.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02097_.WMF") returned 63 [0123.340] lstrlenW (lpString=".jpg") returned 4 [0123.340] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0123.342] SetFilePointerEx (in: hFile=0x238, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0123.342] SetFilePointerEx (in: hFile=0x238, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0123.342] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02115_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02115_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0123.342] GetLastError () returned 0x0 [0123.342] ReadFile (in: hFile=0x238, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x1234, lpOverlapped=0x0) returned 1 [0123.442] WriteFile (in: hFile=0x16c, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0x1240, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0x1240, lpOverlapped=0x0) returned 1 [0124.046] ReadFile (in: hFile=0x238, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x0, lpOverlapped=0x0) returned 1 [0124.046] WriteFile (in: hFile=0x16c, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0xec, lpOverlapped=0x0) returned 1 [0124.046] SetEndOfFile (hFile=0x16c) returned 1 [0124.046] CloseHandle (hObject=0x16c) returned 1 [0124.046] SetFilePointerEx (in: hFile=0x238, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0124.046] SetEndOfFile (hFile=0x238) returned 1 [0124.047] CloseHandle (hObject=0x238) returned 1 [0124.047] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02115_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0124.047] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02115_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02115_.wmf")) returned 1 [0124.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02115_.WMF") returned 63 [0124.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02115_.WMF") returned 63 [0124.047] lstrlenW (lpString=".doc") returned 4 [0124.047] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0124.047] lstrlenW (lpString=".docx") returned 5 [0124.047] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0124.047] lstrlenW (lpString=".pdf") returned 4 [0124.047] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0124.047] lstrlenW (lpString=".xls") returned 4 [0124.047] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0124.047] lstrlenW (lpString=".xlsx") returned 5 [0124.048] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0124.048] lstrlenW (lpString=".ppt") returned 4 [0124.048] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0124.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02115_.WMF") returned 63 [0124.048] lstrlenW (lpString=".zip") returned 4 [0124.048] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0124.048] lstrlenW (lpString=".rar") returned 4 [0124.048] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0124.048] lstrlenW (lpString=".bz2") returned 4 [0124.048] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0124.048] lstrlenW (lpString=".7z") returned 3 [0124.048] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0124.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02115_.WMF") returned 63 [0124.048] lstrlenW (lpString=".dbf") returned 4 [0124.048] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0124.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02115_.WMF") returned 63 [0124.048] lstrlenW (lpString=".1cd") returned 4 [0124.048] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0124.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02115_.WMF") returned 63 [0124.048] lstrlenW (lpString=".jpg") returned 4 [0124.049] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0124.049] SetFilePointerEx (in: hFile=0x238, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0124.049] SetFilePointerEx (in: hFile=0x238, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0124.049] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00057_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00057_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0124.050] GetLastError () returned 0x0 [0124.050] ReadFile (in: hFile=0x238, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0xeb4, lpOverlapped=0x0) returned 1 [0124.056] WriteFile (in: hFile=0x16c, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0xec0, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0xec0, lpOverlapped=0x0) returned 1 [0124.057] ReadFile (in: hFile=0x238, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x0, lpOverlapped=0x0) returned 1 [0124.057] WriteFile (in: hFile=0x16c, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0xec, lpOverlapped=0x0) returned 1 [0124.057] SetEndOfFile (hFile=0x16c) returned 1 [0124.057] CloseHandle (hObject=0x16c) returned 1 [0124.057] SetFilePointerEx (in: hFile=0x238, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0124.057] SetEndOfFile (hFile=0x238) returned 1 [0124.058] CloseHandle (hObject=0x238) returned 1 [0124.058] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00057_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0124.058] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00057_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00057_.wmf")) returned 1 [0124.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00057_.WMF") returned 63 [0124.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00057_.WMF") returned 63 [0124.233] lstrlenW (lpString=".doc") returned 4 [0124.233] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0124.233] lstrlenW (lpString=".docx") returned 5 [0124.233] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0124.233] lstrlenW (lpString=".pdf") returned 4 [0124.233] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0124.233] lstrlenW (lpString=".xls") returned 4 [0124.233] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0124.233] lstrlenW (lpString=".xlsx") returned 5 [0124.233] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0124.233] lstrlenW (lpString=".ppt") returned 4 [0124.233] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0124.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00057_.WMF") returned 63 [0124.233] lstrlenW (lpString=".zip") returned 4 [0124.234] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0124.234] lstrlenW (lpString=".rar") returned 4 [0124.234] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0124.234] lstrlenW (lpString=".bz2") returned 4 [0124.234] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0124.234] lstrlenW (lpString=".7z") returned 3 [0124.234] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0124.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00057_.WMF") returned 63 [0124.234] lstrlenW (lpString=".dbf") returned 4 [0124.234] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0124.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00057_.WMF") returned 63 [0124.234] lstrlenW (lpString=".1cd") returned 4 [0124.234] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0124.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00057_.WMF") returned 63 [0124.234] lstrlenW (lpString=".jpg") returned 4 [0124.234] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0124.358] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0124.358] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0124.359] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00231_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00231_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0124.359] GetLastError () returned 0x0 [0124.359] ReadFile (in: hFile=0x218, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x8b8, lpOverlapped=0x0) returned 1 [0124.361] WriteFile (in: hFile=0x1e0, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0x8c0, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0x8c0, lpOverlapped=0x0) returned 1 [0124.361] ReadFile (in: hFile=0x218, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x0, lpOverlapped=0x0) returned 1 [0124.361] WriteFile (in: hFile=0x1e0, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0xec, lpOverlapped=0x0) returned 1 [0124.361] SetEndOfFile (hFile=0x1e0) returned 1 [0124.361] CloseHandle (hObject=0x1e0) returned 1 [0124.361] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0124.361] SetEndOfFile (hFile=0x218) returned 1 [0124.362] CloseHandle (hObject=0x218) returned 1 [0124.362] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00231_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0124.362] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00231_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00231_.wmf")) returned 1 [0124.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 63 [0124.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 63 [0124.363] lstrlenW (lpString=".doc") returned 4 [0124.363] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0124.363] lstrlenW (lpString=".docx") returned 5 [0124.363] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0124.363] lstrlenW (lpString=".pdf") returned 4 [0124.363] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0124.363] lstrlenW (lpString=".xls") returned 4 [0124.363] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0124.363] lstrlenW (lpString=".xlsx") returned 5 [0124.363] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0124.363] lstrlenW (lpString=".ppt") returned 4 [0124.363] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0124.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 63 [0124.363] lstrlenW (lpString=".zip") returned 4 [0124.363] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0124.363] lstrlenW (lpString=".rar") returned 4 [0124.363] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0124.363] lstrlenW (lpString=".bz2") returned 4 [0124.363] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0124.363] lstrlenW (lpString=".7z") returned 3 [0124.363] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0124.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 63 [0124.363] lstrlenW (lpString=".dbf") returned 4 [0124.363] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0124.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 63 [0124.363] lstrlenW (lpString=".1cd") returned 4 [0124.363] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0124.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 63 [0124.363] lstrlenW (lpString=".jpg") returned 4 [0124.363] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0124.363] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0124.363] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0124.364] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00236_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00236_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0124.364] GetLastError () returned 0x0 [0124.364] ReadFile (in: hFile=0x218, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0xcd6, lpOverlapped=0x0) returned 1 [0124.412] WriteFile (in: hFile=0x1e0, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0xce0, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0xce0, lpOverlapped=0x0) returned 1 [0124.412] ReadFile (in: hFile=0x218, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x0, lpOverlapped=0x0) returned 1 [0124.412] WriteFile (in: hFile=0x1e0, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0xec, lpOverlapped=0x0) returned 1 [0124.412] SetEndOfFile (hFile=0x1e0) returned 1 [0124.412] CloseHandle (hObject=0x1e0) returned 1 [0124.413] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0124.413] SetEndOfFile (hFile=0x218) returned 1 [0124.413] CloseHandle (hObject=0x218) returned 1 [0124.413] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00236_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0124.413] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00236_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00236_.wmf")) returned 1 [0124.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 63 [0124.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 63 [0124.414] lstrlenW (lpString=".doc") returned 4 [0124.414] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0124.414] lstrlenW (lpString=".docx") returned 5 [0124.414] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0124.414] lstrlenW (lpString=".pdf") returned 4 [0124.414] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0124.414] lstrlenW (lpString=".xls") returned 4 [0124.414] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0124.414] lstrlenW (lpString=".xlsx") returned 5 [0124.414] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0124.414] lstrlenW (lpString=".ppt") returned 4 [0124.414] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0124.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 63 [0124.414] lstrlenW (lpString=".zip") returned 4 [0124.414] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0124.414] lstrlenW (lpString=".rar") returned 4 [0124.414] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0124.414] lstrlenW (lpString=".bz2") returned 4 [0124.414] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0124.414] lstrlenW (lpString=".7z") returned 3 [0124.414] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0124.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 63 [0124.414] lstrlenW (lpString=".dbf") returned 4 [0124.414] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0124.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 63 [0124.414] lstrlenW (lpString=".1cd") returned 4 [0124.414] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0124.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 63 [0124.414] lstrlenW (lpString=".jpg") returned 4 [0124.414] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0124.444] SetFilePointerEx (in: hFile=0x244, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0124.444] SetFilePointerEx (in: hFile=0x244, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0124.444] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00260_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00260_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x248 [0124.445] GetLastError () returned 0x0 [0124.445] ReadFile (in: hFile=0x244, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0xe4e, lpOverlapped=0x0) returned 1 [0124.500] WriteFile (in: hFile=0x248, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0xe50, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0xe50, lpOverlapped=0x0) returned 1 [0124.561] ReadFile (in: hFile=0x244, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x0, lpOverlapped=0x0) returned 1 [0124.561] WriteFile (in: hFile=0x248, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0xec, lpOverlapped=0x0) returned 1 [0124.561] SetEndOfFile (hFile=0x248) returned 1 [0124.561] CloseHandle (hObject=0x248) returned 1 [0124.561] SetFilePointerEx (in: hFile=0x244, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0124.562] SetEndOfFile (hFile=0x244) returned 1 [0124.562] CloseHandle (hObject=0x244) returned 1 [0124.562] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00260_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0124.562] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00260_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00260_.wmf")) returned 1 [0124.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 63 [0124.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 63 [0124.563] lstrlenW (lpString=".doc") returned 4 [0124.563] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0124.563] lstrlenW (lpString=".docx") returned 5 [0124.563] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0124.563] lstrlenW (lpString=".pdf") returned 4 [0124.563] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0124.563] lstrlenW (lpString=".xls") returned 4 [0124.563] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0124.563] lstrlenW (lpString=".xlsx") returned 5 [0124.563] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0124.563] lstrlenW (lpString=".ppt") returned 4 [0124.563] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0124.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 63 [0124.563] lstrlenW (lpString=".zip") returned 4 [0124.563] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0124.563] lstrlenW (lpString=".rar") returned 4 [0124.563] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0124.563] lstrlenW (lpString=".bz2") returned 4 [0124.563] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0124.563] lstrlenW (lpString=".7z") returned 3 [0124.563] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0124.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 63 [0124.563] lstrlenW (lpString=".dbf") returned 4 [0124.563] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0124.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 63 [0124.563] lstrlenW (lpString=".1cd") returned 4 [0124.563] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0124.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 63 [0124.563] lstrlenW (lpString=".jpg") returned 4 [0124.563] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0124.636] SetFilePointerEx (in: hFile=0x248, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0124.636] SetFilePointerEx (in: hFile=0x248, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0124.636] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00443_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00443_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0124.636] GetLastError () returned 0x0 [0124.636] ReadFile (in: hFile=0x248, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0xce2, lpOverlapped=0x0) returned 1 [0124.706] WriteFile (in: hFile=0x1a0, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0xcf0, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0xcf0, lpOverlapped=0x0) returned 1 [0124.707] ReadFile (in: hFile=0x248, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x0, lpOverlapped=0x0) returned 1 [0124.707] WriteFile (in: hFile=0x1a0, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0xec, lpOverlapped=0x0) returned 1 [0124.707] SetEndOfFile (hFile=0x1a0) returned 1 [0124.707] CloseHandle (hObject=0x1a0) returned 1 [0124.707] SetFilePointerEx (in: hFile=0x248, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0124.707] SetEndOfFile (hFile=0x248) returned 1 [0124.708] CloseHandle (hObject=0x248) returned 1 [0124.708] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00443_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0124.708] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00443_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00443_.wmf")) returned 1 [0124.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00443_.WMF") returned 63 [0124.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00443_.WMF") returned 63 [0124.756] lstrlenW (lpString=".doc") returned 4 [0124.756] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0124.756] lstrlenW (lpString=".docx") returned 5 [0124.756] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0124.756] lstrlenW (lpString=".pdf") returned 4 [0124.756] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0124.757] lstrlenW (lpString=".xls") returned 4 [0124.757] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0124.757] lstrlenW (lpString=".xlsx") returned 5 [0124.757] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0124.757] lstrlenW (lpString=".ppt") returned 4 [0124.757] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0124.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00443_.WMF") returned 63 [0124.757] lstrlenW (lpString=".zip") returned 4 [0124.757] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0124.757] lstrlenW (lpString=".rar") returned 4 [0124.757] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0124.757] lstrlenW (lpString=".bz2") returned 4 [0124.757] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0124.757] lstrlenW (lpString=".7z") returned 3 [0124.757] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0124.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00443_.WMF") returned 63 [0124.757] lstrlenW (lpString=".dbf") returned 4 [0124.757] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0124.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00443_.WMF") returned 63 [0124.757] lstrlenW (lpString=".1cd") returned 4 [0124.757] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0124.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00443_.WMF") returned 63 [0124.757] lstrlenW (lpString=".jpg") returned 4 [0124.757] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0124.757] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0124.761] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0124.761] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00601_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00601_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x248 [0124.761] GetLastError () returned 0x0 [0124.761] ReadFile (in: hFile=0x218, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x5bc, lpOverlapped=0x0) returned 1 [0124.772] WriteFile (in: hFile=0x248, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0x5c0, lpOverlapped=0x0) returned 1 [0124.772] ReadFile (in: hFile=0x218, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x0, lpOverlapped=0x0) returned 1 [0124.772] WriteFile (in: hFile=0x248, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0xec, lpOverlapped=0x0) returned 1 [0124.772] SetEndOfFile (hFile=0x248) returned 1 [0124.772] CloseHandle (hObject=0x248) returned 1 [0124.773] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0124.773] SetEndOfFile (hFile=0x218) returned 1 [0124.773] CloseHandle (hObject=0x218) returned 1 [0124.773] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00601_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0124.773] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00601_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00601_.wmf")) returned 1 [0124.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00601_.WMF") returned 63 [0124.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00601_.WMF") returned 63 [0124.774] lstrlenW (lpString=".doc") returned 4 [0124.774] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0124.774] lstrlenW (lpString=".docx") returned 5 [0124.774] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0124.774] lstrlenW (lpString=".pdf") returned 4 [0124.774] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0124.774] lstrlenW (lpString=".xls") returned 4 [0124.774] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0124.774] lstrlenW (lpString=".xlsx") returned 5 [0124.774] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0124.774] lstrlenW (lpString=".ppt") returned 4 [0124.774] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0124.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00601_.WMF") returned 63 [0124.774] lstrlenW (lpString=".zip") returned 4 [0124.774] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0124.774] lstrlenW (lpString=".rar") returned 4 [0124.774] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0124.774] lstrlenW (lpString=".bz2") returned 4 [0124.774] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0124.774] lstrlenW (lpString=".7z") returned 3 [0124.774] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0124.796] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00601_.WMF") returned 63 [0124.796] lstrlenW (lpString=".dbf") returned 4 [0124.796] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0124.796] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00601_.WMF") returned 63 [0124.796] lstrlenW (lpString=".1cd") returned 4 [0124.796] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0124.796] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00601_.WMF") returned 63 [0124.796] lstrlenW (lpString=".jpg") returned 4 [0124.796] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0124.796] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x342ff14 | out: lpFileSize=0x342ff14*=1400) returned 1 [0124.796] CloseHandle (hObject=0x218) returned 1 [0124.796] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00602_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00602_.wmf")) returned 0x20 [0124.796] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00602_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00602_.wmf.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0124.796] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00602_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00602_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0124.797] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0124.797] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0124.797] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00602_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00602_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x248 [0124.797] GetLastError () returned 0x0 [0124.797] ReadFile (in: hFile=0x218, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x578, lpOverlapped=0x0) returned 1 [0124.823] WriteFile (in: hFile=0x248, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0x580, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0x580, lpOverlapped=0x0) returned 1 [0124.824] ReadFile (in: hFile=0x218, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x0, lpOverlapped=0x0) returned 1 [0124.824] WriteFile (in: hFile=0x248, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0xec, lpOverlapped=0x0) returned 1 [0124.824] SetEndOfFile (hFile=0x248) returned 1 [0124.829] CloseHandle (hObject=0x248) returned 1 [0124.829] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0124.829] SetEndOfFile (hFile=0x218) returned 1 [0124.829] CloseHandle (hObject=0x218) returned 1 [0124.829] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00602_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0124.829] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00602_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00602_.wmf")) returned 1 [0124.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00602_.WMF") returned 63 [0124.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00602_.WMF") returned 63 [0124.830] lstrlenW (lpString=".doc") returned 4 [0124.830] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0124.830] lstrlenW (lpString=".docx") returned 5 [0124.830] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0124.830] lstrlenW (lpString=".pdf") returned 4 [0124.830] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0124.830] lstrlenW (lpString=".xls") returned 4 [0124.830] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0124.830] lstrlenW (lpString=".xlsx") returned 5 [0124.830] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0124.830] lstrlenW (lpString=".ppt") returned 4 [0124.830] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0124.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00602_.WMF") returned 63 [0124.830] lstrlenW (lpString=".zip") returned 4 [0124.830] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0124.830] lstrlenW (lpString=".rar") returned 4 [0124.830] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0124.830] lstrlenW (lpString=".bz2") returned 4 [0124.830] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0124.830] lstrlenW (lpString=".7z") returned 3 [0124.830] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0124.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00602_.WMF") returned 63 [0124.830] lstrlenW (lpString=".dbf") returned 4 [0124.830] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0124.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00602_.WMF") returned 63 [0124.830] lstrlenW (lpString=".1cd") returned 4 [0124.830] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0124.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00602_.WMF") returned 63 [0124.830] lstrlenW (lpString=".jpg") returned 4 [0124.830] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0124.830] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x342ff14 | out: lpFileSize=0x342ff14*=2116) returned 1 [0124.830] CloseHandle (hObject=0x218) returned 1 [0124.830] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00625_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00625_.wmf")) returned 0x20 [0124.830] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00625_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00625_.wmf.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0124.831] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00625_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00625_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0124.831] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0124.831] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0124.831] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00625_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00625_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x248 [0124.831] GetLastError () returned 0x0 [0124.831] ReadFile (in: hFile=0x218, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x844, lpOverlapped=0x0) returned 1 [0124.886] WriteFile (in: hFile=0x248, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0x850, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0x850, lpOverlapped=0x0) returned 1 [0124.886] ReadFile (in: hFile=0x218, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x0, lpOverlapped=0x0) returned 1 [0124.886] WriteFile (in: hFile=0x248, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0xec, lpOverlapped=0x0) returned 1 [0124.887] SetEndOfFile (hFile=0x248) returned 1 [0124.887] CloseHandle (hObject=0x248) returned 1 [0124.887] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0124.887] SetEndOfFile (hFile=0x218) returned 1 [0124.887] CloseHandle (hObject=0x218) returned 1 [0124.887] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00625_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0124.887] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00625_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00625_.wmf")) returned 1 [0124.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 63 [0124.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 63 [0124.888] lstrlenW (lpString=".doc") returned 4 [0124.888] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0124.888] lstrlenW (lpString=".docx") returned 5 [0124.888] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0124.888] lstrlenW (lpString=".pdf") returned 4 [0124.888] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0124.888] lstrlenW (lpString=".xls") returned 4 [0124.888] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0124.888] lstrlenW (lpString=".xlsx") returned 5 [0124.888] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0124.888] lstrlenW (lpString=".ppt") returned 4 [0124.888] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0124.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 63 [0124.888] lstrlenW (lpString=".zip") returned 4 [0124.888] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0124.888] lstrlenW (lpString=".rar") returned 4 [0124.888] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0124.888] lstrlenW (lpString=".bz2") returned 4 [0124.888] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0124.888] lstrlenW (lpString=".7z") returned 3 [0124.888] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0124.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 63 [0124.888] lstrlenW (lpString=".dbf") returned 4 [0124.888] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0124.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 63 [0124.888] lstrlenW (lpString=".1cd") returned 4 [0124.888] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0124.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 63 [0124.888] lstrlenW (lpString=".jpg") returned 4 [0124.888] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0124.888] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x342ff14 | out: lpFileSize=0x342ff14*=9300) returned 1 [0124.888] CloseHandle (hObject=0x218) returned 1 [0124.889] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00681_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00681_.wmf")) returned 0x20 [0124.889] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00681_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00681_.wmf.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0124.889] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00681_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00681_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0124.889] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0124.889] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0124.889] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00681_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00681_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x248 [0124.889] GetLastError () returned 0x0 [0124.889] ReadFile (in: hFile=0x218, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x2454, lpOverlapped=0x0) returned 1 [0124.954] WriteFile (in: hFile=0x248, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0x2460, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0x2460, lpOverlapped=0x0) returned 1 [0124.954] ReadFile (in: hFile=0x218, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x0, lpOverlapped=0x0) returned 1 [0124.954] WriteFile (in: hFile=0x248, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0xec, lpOverlapped=0x0) returned 1 [0124.955] SetEndOfFile (hFile=0x248) returned 1 [0124.955] CloseHandle (hObject=0x248) returned 1 [0124.955] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0124.955] SetEndOfFile (hFile=0x218) returned 1 [0124.955] CloseHandle (hObject=0x218) returned 1 [0124.955] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00681_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0124.955] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00681_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00681_.wmf")) returned 1 [0124.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00681_.WMF") returned 63 [0124.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00681_.WMF") returned 63 [0124.956] lstrlenW (lpString=".doc") returned 4 [0124.956] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0124.956] lstrlenW (lpString=".docx") returned 5 [0124.956] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0124.956] lstrlenW (lpString=".pdf") returned 4 [0124.956] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0124.956] lstrlenW (lpString=".xls") returned 4 [0124.956] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0124.956] lstrlenW (lpString=".xlsx") returned 5 [0124.956] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0124.956] lstrlenW (lpString=".ppt") returned 4 [0124.956] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0124.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00681_.WMF") returned 63 [0124.956] lstrlenW (lpString=".zip") returned 4 [0124.956] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0124.956] lstrlenW (lpString=".rar") returned 4 [0124.956] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0124.956] lstrlenW (lpString=".bz2") returned 4 [0124.956] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0124.956] lstrlenW (lpString=".7z") returned 3 [0124.956] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0124.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00681_.WMF") returned 63 [0124.956] lstrlenW (lpString=".dbf") returned 4 [0124.956] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0124.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00681_.WMF") returned 63 [0124.956] lstrlenW (lpString=".1cd") returned 4 [0124.956] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0124.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00681_.WMF") returned 63 [0124.956] lstrlenW (lpString=".jpg") returned 4 [0124.956] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0124.957] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0124.957] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0124.957] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00693_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00693_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x248 [0124.957] GetLastError () returned 0x0 [0124.957] ReadFile (in: hFile=0x218, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x1bba, lpOverlapped=0x0) returned 1 [0124.980] WriteFile (in: hFile=0x248, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0x1bc0, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0x1bc0, lpOverlapped=0x0) returned 1 [0124.980] ReadFile (in: hFile=0x218, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x0, lpOverlapped=0x0) returned 1 [0124.981] WriteFile (in: hFile=0x248, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0xec, lpOverlapped=0x0) returned 1 [0124.981] SetEndOfFile (hFile=0x248) returned 1 [0124.981] CloseHandle (hObject=0x248) returned 1 [0124.981] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0124.981] SetEndOfFile (hFile=0x218) returned 1 [0124.981] CloseHandle (hObject=0x218) returned 1 [0124.981] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00693_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0124.982] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00693_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00693_.wmf")) returned 1 [0124.982] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 63 [0124.982] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 63 [0124.982] lstrlenW (lpString=".doc") returned 4 [0124.982] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0124.982] lstrlenW (lpString=".docx") returned 5 [0124.982] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0124.982] lstrlenW (lpString=".pdf") returned 4 [0124.982] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0124.982] lstrlenW (lpString=".xls") returned 4 [0124.982] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0124.982] lstrlenW (lpString=".xlsx") returned 5 [0124.982] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0124.982] lstrlenW (lpString=".ppt") returned 4 [0124.982] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0124.982] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 63 [0124.982] lstrlenW (lpString=".zip") returned 4 [0124.982] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0124.982] lstrlenW (lpString=".rar") returned 4 [0124.982] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0124.982] lstrlenW (lpString=".bz2") returned 4 [0124.982] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0124.982] lstrlenW (lpString=".7z") returned 3 [0124.982] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0124.982] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 63 [0124.982] lstrlenW (lpString=".dbf") returned 4 [0124.982] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0124.982] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 63 [0124.982] lstrlenW (lpString=".1cd") returned 4 [0124.982] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0124.982] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 63 [0124.982] lstrlenW (lpString=".jpg") returned 4 [0124.982] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0124.983] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0124.983] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0124.983] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01058_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01058_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x248 [0124.983] GetLastError () returned 0x0 [0124.983] ReadFile (in: hFile=0x218, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0xac4, lpOverlapped=0x0) returned 1 [0124.989] WriteFile (in: hFile=0x248, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0xad0, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0xad0, lpOverlapped=0x0) returned 1 [0124.990] ReadFile (in: hFile=0x218, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x0, lpOverlapped=0x0) returned 1 [0124.990] WriteFile (in: hFile=0x248, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0xec, lpOverlapped=0x0) returned 1 [0124.990] SetEndOfFile (hFile=0x248) returned 1 [0124.990] CloseHandle (hObject=0x248) returned 1 [0124.990] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0124.990] SetEndOfFile (hFile=0x218) returned 1 [0124.991] CloseHandle (hObject=0x218) returned 1 [0124.991] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01058_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0124.991] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01058_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01058_.wmf")) returned 1 [0124.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 63 [0124.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 63 [0124.991] lstrlenW (lpString=".doc") returned 4 [0124.991] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0124.991] lstrlenW (lpString=".docx") returned 5 [0124.991] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0124.991] lstrlenW (lpString=".pdf") returned 4 [0124.991] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0124.991] lstrlenW (lpString=".xls") returned 4 [0124.991] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0124.991] lstrlenW (lpString=".xlsx") returned 5 [0124.991] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0124.991] lstrlenW (lpString=".ppt") returned 4 [0124.991] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0124.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 63 [0124.991] lstrlenW (lpString=".zip") returned 4 [0124.992] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0124.992] lstrlenW (lpString=".rar") returned 4 [0124.992] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0124.992] lstrlenW (lpString=".bz2") returned 4 [0124.992] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0124.992] lstrlenW (lpString=".7z") returned 3 [0124.992] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0124.992] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 63 [0124.992] lstrlenW (lpString=".dbf") returned 4 [0124.992] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0124.992] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 63 [0124.992] lstrlenW (lpString=".1cd") returned 4 [0124.992] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0124.992] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 63 [0124.992] lstrlenW (lpString=".jpg") returned 4 [0124.992] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0124.992] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0124.992] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0124.992] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01080_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01080_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x248 [0124.993] GetLastError () returned 0x0 [0124.994] ReadFile (in: hFile=0x218, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x1388, lpOverlapped=0x0) returned 1 [0125.003] WriteFile (in: hFile=0x248, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0x1390, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0x1390, lpOverlapped=0x0) returned 1 [0125.003] ReadFile (in: hFile=0x218, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x0, lpOverlapped=0x0) returned 1 [0125.003] WriteFile (in: hFile=0x248, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0xec, lpOverlapped=0x0) returned 1 [0125.003] SetEndOfFile (hFile=0x248) returned 1 [0125.004] CloseHandle (hObject=0x248) returned 1 [0125.004] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0125.004] SetEndOfFile (hFile=0x218) returned 1 [0125.005] CloseHandle (hObject=0x218) returned 1 [0125.005] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01080_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0125.005] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01080_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01080_.wmf")) returned 1 [0125.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 63 [0125.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 63 [0125.005] lstrlenW (lpString=".doc") returned 4 [0125.005] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0125.005] lstrlenW (lpString=".docx") returned 5 [0125.005] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0125.005] lstrlenW (lpString=".pdf") returned 4 [0125.005] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0125.005] lstrlenW (lpString=".xls") returned 4 [0125.005] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0125.005] lstrlenW (lpString=".xlsx") returned 5 [0125.005] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0125.006] lstrlenW (lpString=".ppt") returned 4 [0125.006] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0125.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 63 [0125.006] lstrlenW (lpString=".zip") returned 4 [0125.006] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0125.006] lstrlenW (lpString=".rar") returned 4 [0125.006] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0125.006] lstrlenW (lpString=".bz2") returned 4 [0125.006] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0125.006] lstrlenW (lpString=".7z") returned 3 [0125.006] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0125.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 63 [0125.006] lstrlenW (lpString=".dbf") returned 4 [0125.006] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0125.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 63 [0125.006] lstrlenW (lpString=".1cd") returned 4 [0125.006] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0125.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 63 [0125.006] lstrlenW (lpString=".jpg") returned 4 [0125.006] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0125.006] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0125.006] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0125.006] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01291_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01291_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x248 [0125.007] GetLastError () returned 0x0 [0125.007] ReadFile (in: hFile=0x218, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x3dbe, lpOverlapped=0x0) returned 1 [0125.008] WriteFile (in: hFile=0x248, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0x3dc0, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0x3dc0, lpOverlapped=0x0) returned 1 [0125.009] ReadFile (in: hFile=0x218, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x0, lpOverlapped=0x0) returned 1 [0125.009] WriteFile (in: hFile=0x248, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0xec, lpOverlapped=0x0) returned 1 [0125.009] SetEndOfFile (hFile=0x248) returned 1 [0125.010] CloseHandle (hObject=0x248) returned 1 [0125.010] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0125.010] SetEndOfFile (hFile=0x218) returned 1 [0125.011] CloseHandle (hObject=0x218) returned 1 [0125.011] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01291_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0125.011] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01291_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01291_.wmf")) returned 1 [0125.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 63 [0125.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 63 [0125.011] lstrlenW (lpString=".doc") returned 4 [0125.011] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0125.011] lstrlenW (lpString=".docx") returned 5 [0125.011] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0125.011] lstrlenW (lpString=".pdf") returned 4 [0125.011] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0125.011] lstrlenW (lpString=".xls") returned 4 [0125.011] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0125.011] lstrlenW (lpString=".xlsx") returned 5 [0125.011] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0125.011] lstrlenW (lpString=".ppt") returned 4 [0125.012] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0125.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 63 [0125.012] lstrlenW (lpString=".zip") returned 4 [0125.012] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0125.012] lstrlenW (lpString=".rar") returned 4 [0125.012] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0125.012] lstrlenW (lpString=".bz2") returned 4 [0125.012] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0125.012] lstrlenW (lpString=".7z") returned 3 [0125.012] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0125.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 63 [0125.012] lstrlenW (lpString=".dbf") returned 4 [0125.012] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0125.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 63 [0125.012] lstrlenW (lpString=".1cd") returned 4 [0125.012] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0125.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 63 [0125.012] lstrlenW (lpString=".jpg") returned 4 [0125.012] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0125.012] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0125.012] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0125.012] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01329_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01329_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x248 [0125.013] GetLastError () returned 0x0 [0125.013] ReadFile (in: hFile=0x218, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x1780, lpOverlapped=0x0) returned 1 [0125.028] WriteFile (in: hFile=0x248, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0x1790, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0x1790, lpOverlapped=0x0) returned 1 [0125.029] ReadFile (in: hFile=0x218, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x0, lpOverlapped=0x0) returned 1 [0125.029] WriteFile (in: hFile=0x248, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0xec, lpOverlapped=0x0) returned 1 [0125.029] SetEndOfFile (hFile=0x248) returned 1 [0125.029] CloseHandle (hObject=0x248) returned 1 [0125.029] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0125.029] SetEndOfFile (hFile=0x218) returned 1 [0125.030] CloseHandle (hObject=0x218) returned 1 [0125.030] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01329_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0125.030] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01329_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01329_.wmf")) returned 1 [0125.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 63 [0125.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 63 [0125.030] lstrlenW (lpString=".doc") returned 4 [0125.031] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0125.031] lstrlenW (lpString=".docx") returned 5 [0125.031] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0125.031] lstrlenW (lpString=".pdf") returned 4 [0125.031] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0125.031] lstrlenW (lpString=".xls") returned 4 [0125.031] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0125.031] lstrlenW (lpString=".xlsx") returned 5 [0125.031] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0125.031] lstrlenW (lpString=".ppt") returned 4 [0125.031] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0125.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 63 [0125.031] lstrlenW (lpString=".zip") returned 4 [0125.031] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0125.031] lstrlenW (lpString=".rar") returned 4 [0125.031] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0125.031] lstrlenW (lpString=".bz2") returned 4 [0125.031] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0125.031] lstrlenW (lpString=".7z") returned 3 [0125.031] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0125.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 63 [0125.031] lstrlenW (lpString=".dbf") returned 4 [0125.031] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0125.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 63 [0125.031] lstrlenW (lpString=".1cd") returned 4 [0125.031] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0125.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 63 [0125.031] lstrlenW (lpString=".jpg") returned 4 [0125.031] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0125.032] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0125.032] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0125.032] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01759_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01759_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x248 [0125.033] GetLastError () returned 0x0 [0125.033] ReadFile (in: hFile=0x218, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x1526, lpOverlapped=0x0) returned 1 [0125.039] WriteFile (in: hFile=0x248, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0x1530, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0x1530, lpOverlapped=0x0) returned 1 [0125.040] ReadFile (in: hFile=0x218, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x0, lpOverlapped=0x0) returned 1 [0125.040] WriteFile (in: hFile=0x248, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0xec, lpOverlapped=0x0) returned 1 [0125.040] SetEndOfFile (hFile=0x248) returned 1 [0125.040] CloseHandle (hObject=0x248) returned 1 [0125.040] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0125.040] SetEndOfFile (hFile=0x218) returned 1 [0125.041] CloseHandle (hObject=0x218) returned 1 [0125.041] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01759_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0125.041] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01759_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01759_.wmf")) returned 1 [0125.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 63 [0125.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 63 [0125.041] lstrlenW (lpString=".doc") returned 4 [0125.041] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0125.041] lstrlenW (lpString=".docx") returned 5 [0125.041] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0125.041] lstrlenW (lpString=".pdf") returned 4 [0125.041] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0125.041] lstrlenW (lpString=".xls") returned 4 [0125.041] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0125.041] lstrlenW (lpString=".xlsx") returned 5 [0125.041] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0125.041] lstrlenW (lpString=".ppt") returned 4 [0125.041] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0125.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 63 [0125.041] lstrlenW (lpString=".zip") returned 4 [0125.042] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0125.042] lstrlenW (lpString=".rar") returned 4 [0125.042] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0125.042] lstrlenW (lpString=".bz2") returned 4 [0125.042] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0125.042] lstrlenW (lpString=".7z") returned 3 [0125.042] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0125.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 63 [0125.042] lstrlenW (lpString=".dbf") returned 4 [0125.042] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0125.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 63 [0125.042] lstrlenW (lpString=".1cd") returned 4 [0125.042] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0125.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 63 [0125.042] lstrlenW (lpString=".jpg") returned 4 [0125.042] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0125.042] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0125.042] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0125.042] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01875_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01875_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x248 [0125.043] GetLastError () returned 0x0 [0125.043] ReadFile (in: hFile=0x218, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0xa38, lpOverlapped=0x0) returned 1 [0125.053] WriteFile (in: hFile=0x248, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0xa40, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0xa40, lpOverlapped=0x0) returned 1 [0125.054] ReadFile (in: hFile=0x218, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x0, lpOverlapped=0x0) returned 1 [0125.054] WriteFile (in: hFile=0x248, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0xec, lpOverlapped=0x0) returned 1 [0125.054] SetEndOfFile (hFile=0x248) returned 1 [0125.054] CloseHandle (hObject=0x248) returned 1 [0125.054] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0125.054] SetEndOfFile (hFile=0x218) returned 1 [0125.054] CloseHandle (hObject=0x218) returned 1 [0125.054] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01875_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0125.055] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01875_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01875_.wmf")) returned 1 [0125.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 63 [0125.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 63 [0125.055] lstrlenW (lpString=".doc") returned 4 [0125.055] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0125.055] lstrlenW (lpString=".docx") returned 5 [0125.055] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0125.055] lstrlenW (lpString=".pdf") returned 4 [0125.055] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0125.055] lstrlenW (lpString=".xls") returned 4 [0125.055] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0125.055] lstrlenW (lpString=".xlsx") returned 5 [0125.055] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0125.055] lstrlenW (lpString=".ppt") returned 4 [0125.055] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0125.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 63 [0125.055] lstrlenW (lpString=".zip") returned 4 [0125.055] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0125.055] lstrlenW (lpString=".rar") returned 4 [0125.055] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0125.055] lstrlenW (lpString=".bz2") returned 4 [0125.055] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0125.055] lstrlenW (lpString=".7z") returned 3 [0125.055] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0125.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 63 [0125.056] lstrlenW (lpString=".dbf") returned 4 [0125.056] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0125.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 63 [0125.056] lstrlenW (lpString=".1cd") returned 4 [0125.056] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0125.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 63 [0125.056] lstrlenW (lpString=".jpg") returned 4 [0125.056] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0125.056] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0125.056] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0125.056] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01923_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01923_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x248 [0125.056] GetLastError () returned 0x0 [0125.056] ReadFile (in: hFile=0x218, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x6852, lpOverlapped=0x0) returned 1 [0125.058] WriteFile (in: hFile=0x248, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0x6860, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0x6860, lpOverlapped=0x0) returned 1 [0125.059] ReadFile (in: hFile=0x218, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x0, lpOverlapped=0x0) returned 1 [0125.059] WriteFile (in: hFile=0x248, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0xec, lpOverlapped=0x0) returned 1 [0125.059] SetEndOfFile (hFile=0x248) returned 1 [0125.059] CloseHandle (hObject=0x248) returned 1 [0125.059] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0125.059] SetEndOfFile (hFile=0x218) returned 1 [0125.060] CloseHandle (hObject=0x218) returned 1 [0125.060] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01923_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0125.060] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01923_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01923_.wmf")) returned 1 [0125.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 63 [0125.061] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 63 [0125.061] lstrlenW (lpString=".doc") returned 4 [0125.061] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0125.061] lstrlenW (lpString=".docx") returned 5 [0125.061] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0125.061] lstrlenW (lpString=".pdf") returned 4 [0125.061] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0125.061] lstrlenW (lpString=".xls") returned 4 [0125.061] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0125.061] lstrlenW (lpString=".xlsx") returned 5 [0125.061] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0125.061] lstrlenW (lpString=".ppt") returned 4 [0125.061] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0125.061] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 63 [0125.061] lstrlenW (lpString=".zip") returned 4 [0125.061] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0125.061] lstrlenW (lpString=".rar") returned 4 [0125.061] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0125.061] lstrlenW (lpString=".bz2") returned 4 [0125.061] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0125.061] lstrlenW (lpString=".7z") returned 3 [0125.061] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0125.061] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 63 [0125.061] lstrlenW (lpString=".dbf") returned 4 [0125.061] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0125.061] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 63 [0125.061] lstrlenW (lpString=".1cd") returned 4 [0125.061] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0125.061] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 63 [0125.061] lstrlenW (lpString=".jpg") returned 4 [0125.061] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0125.061] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0125.062] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0125.062] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02155_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02155_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x248 [0125.062] GetLastError () returned 0x0 [0125.062] ReadFile (in: hFile=0x218, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0xa90, lpOverlapped=0x0) returned 1 [0125.370] WriteFile (in: hFile=0x248, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0xaa0, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0xaa0, lpOverlapped=0x0) returned 1 [0125.370] ReadFile (in: hFile=0x218, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x0, lpOverlapped=0x0) returned 1 [0125.370] WriteFile (in: hFile=0x248, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0xec, lpOverlapped=0x0) returned 1 [0125.371] SetEndOfFile (hFile=0x248) returned 1 [0125.393] CloseHandle (hObject=0x248) returned 1 [0125.393] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0125.393] SetEndOfFile (hFile=0x218) returned 1 [0125.407] CloseHandle (hObject=0x218) returned 1 [0125.407] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02155_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0125.407] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02155_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02155_.wmf")) returned 1 [0125.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 63 [0125.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 63 [0125.407] lstrlenW (lpString=".doc") returned 4 [0125.407] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0125.407] lstrlenW (lpString=".docx") returned 5 [0125.407] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0125.407] lstrlenW (lpString=".pdf") returned 4 [0125.407] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0125.407] lstrlenW (lpString=".xls") returned 4 [0125.407] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0125.407] lstrlenW (lpString=".xlsx") returned 5 [0125.407] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0125.407] lstrlenW (lpString=".ppt") returned 4 [0125.407] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0125.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 63 [0125.407] lstrlenW (lpString=".zip") returned 4 [0125.407] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0125.407] lstrlenW (lpString=".rar") returned 4 [0125.407] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0125.407] lstrlenW (lpString=".bz2") returned 4 [0125.407] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0125.407] lstrlenW (lpString=".7z") returned 3 [0125.407] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0125.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 63 [0125.407] lstrlenW (lpString=".dbf") returned 4 [0125.407] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0125.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 63 [0125.407] lstrlenW (lpString=".1cd") returned 4 [0125.408] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0125.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 63 [0125.408] lstrlenW (lpString=".jpg") returned 4 [0125.408] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0125.408] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0125.408] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0125.408] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00426_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00426_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0125.408] GetLastError () returned 0x0 [0125.408] ReadFile (in: hFile=0x218, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x10ca8, lpOverlapped=0x0) returned 1 [0125.423] WriteFile (in: hFile=0x1f8, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0x10cb0, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0x10cb0, lpOverlapped=0x0) returned 1 [0125.424] ReadFile (in: hFile=0x218, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x0, lpOverlapped=0x0) returned 1 [0125.424] WriteFile (in: hFile=0x1f8, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0xec, lpOverlapped=0x0) returned 1 [0125.424] SetEndOfFile (hFile=0x1f8) returned 1 [0125.429] CloseHandle (hObject=0x1f8) returned 1 [0125.429] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0125.429] SetEndOfFile (hFile=0x218) returned 1 [0125.430] CloseHandle (hObject=0x218) returned 1 [0125.430] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00426_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0125.430] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00426_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00426_.wmf")) returned 1 [0125.431] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 63 [0125.431] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 63 [0125.431] lstrlenW (lpString=".doc") returned 4 [0125.431] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0125.431] lstrlenW (lpString=".docx") returned 5 [0125.431] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0125.431] lstrlenW (lpString=".pdf") returned 4 [0125.431] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0125.431] lstrlenW (lpString=".xls") returned 4 [0125.431] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0125.431] lstrlenW (lpString=".xlsx") returned 5 [0125.431] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0125.431] lstrlenW (lpString=".ppt") returned 4 [0125.431] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0125.431] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 63 [0125.431] lstrlenW (lpString=".zip") returned 4 [0125.431] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0125.431] lstrlenW (lpString=".rar") returned 4 [0125.431] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0125.431] lstrlenW (lpString=".bz2") returned 4 [0125.431] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0125.431] lstrlenW (lpString=".7z") returned 3 [0125.431] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0125.431] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 63 [0125.432] lstrlenW (lpString=".dbf") returned 4 [0125.432] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0125.432] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 63 [0125.432] lstrlenW (lpString=".1cd") returned 4 [0125.432] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0125.432] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 63 [0125.432] lstrlenW (lpString=".jpg") returned 4 [0125.432] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0125.432] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x342ff14 | out: lpFileSize=0x342ff14*=1074) returned 1 [0125.432] CloseHandle (hObject=0x218) returned 1 [0125.432] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00177_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00177_.wmf")) returned 0x20 [0125.432] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00177_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00177_.wmf.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0125.432] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00177_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00177_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0125.433] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0125.433] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0125.433] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00177_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00177_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0125.433] GetLastError () returned 0x0 [0125.434] ReadFile (in: hFile=0x218, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x432, lpOverlapped=0x0) returned 1 [0125.807] WriteFile (in: hFile=0x1f8, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0x440, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0x440, lpOverlapped=0x0) returned 1 [0125.808] ReadFile (in: hFile=0x218, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x0, lpOverlapped=0x0) returned 1 [0125.808] WriteFile (in: hFile=0x1f8, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0xec, lpOverlapped=0x0) returned 1 [0125.808] SetEndOfFile (hFile=0x1f8) returned 1 [0125.808] CloseHandle (hObject=0x1f8) returned 1 [0125.808] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0125.808] SetEndOfFile (hFile=0x218) returned 1 [0125.809] CloseHandle (hObject=0x218) returned 1 [0125.809] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00177_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0125.809] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00177_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00177_.wmf")) returned 1 [0126.043] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00177_.WMF") returned 63 [0126.043] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00177_.WMF") returned 63 [0126.043] lstrlenW (lpString=".doc") returned 4 [0126.043] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0126.043] lstrlenW (lpString=".docx") returned 5 [0126.043] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0126.043] lstrlenW (lpString=".pdf") returned 4 [0126.043] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0126.043] lstrlenW (lpString=".xls") returned 4 [0126.043] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0126.043] lstrlenW (lpString=".xlsx") returned 5 [0126.043] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0126.043] lstrlenW (lpString=".ppt") returned 4 [0126.043] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0126.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00177_.WMF") returned 63 [0126.063] lstrlenW (lpString=".zip") returned 4 [0126.063] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0126.063] lstrlenW (lpString=".rar") returned 4 [0126.064] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0126.064] lstrlenW (lpString=".bz2") returned 4 [0126.064] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0126.064] lstrlenW (lpString=".7z") returned 3 [0126.064] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0126.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00177_.WMF") returned 63 [0126.064] lstrlenW (lpString=".dbf") returned 4 [0126.064] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0126.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00177_.WMF") returned 63 [0126.064] lstrlenW (lpString=".1cd") returned 4 [0126.064] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0126.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00177_.WMF") returned 63 [0126.064] lstrlenW (lpString=".jpg") returned 4 [0126.064] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0126.064] SetFilePointerEx (in: hFile=0x234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0126.064] SetFilePointerEx (in: hFile=0x234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0126.064] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00919_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00919_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0126.064] GetLastError () returned 0x0 [0126.064] ReadFile (in: hFile=0x234, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x1b08, lpOverlapped=0x0) returned 1 [0126.068] WriteFile (in: hFile=0x1ec, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0x1b10, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0x1b10, lpOverlapped=0x0) returned 1 [0126.068] ReadFile (in: hFile=0x234, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x0, lpOverlapped=0x0) returned 1 [0126.068] WriteFile (in: hFile=0x1ec, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0xec, lpOverlapped=0x0) returned 1 [0126.068] SetEndOfFile (hFile=0x1ec) returned 1 [0126.069] CloseHandle (hObject=0x1ec) returned 1 [0126.069] SetFilePointerEx (in: hFile=0x234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0126.069] SetEndOfFile (hFile=0x234) returned 1 [0126.069] CloseHandle (hObject=0x234) returned 1 [0126.069] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00919_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0126.069] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00919_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00919_.wmf")) returned 1 [0126.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00919_.WMF") returned 63 [0126.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00919_.WMF") returned 63 [0126.070] lstrlenW (lpString=".doc") returned 4 [0126.070] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0126.070] lstrlenW (lpString=".docx") returned 5 [0126.070] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0126.070] lstrlenW (lpString=".pdf") returned 4 [0126.070] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0126.070] lstrlenW (lpString=".xls") returned 4 [0126.070] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0126.070] lstrlenW (lpString=".xlsx") returned 5 [0126.070] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0126.070] lstrlenW (lpString=".ppt") returned 4 [0126.070] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0126.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00919_.WMF") returned 63 [0126.070] lstrlenW (lpString=".zip") returned 4 [0126.070] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0126.070] lstrlenW (lpString=".rar") returned 4 [0126.070] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0126.070] lstrlenW (lpString=".bz2") returned 4 [0126.070] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0126.070] lstrlenW (lpString=".7z") returned 3 [0126.070] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0126.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00919_.WMF") returned 63 [0126.070] lstrlenW (lpString=".dbf") returned 4 [0126.070] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0126.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00919_.WMF") returned 63 [0126.070] lstrlenW (lpString=".1cd") returned 4 [0126.070] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0126.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00919_.WMF") returned 63 [0126.071] lstrlenW (lpString=".jpg") returned 4 [0126.071] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0126.072] SetFilePointerEx (in: hFile=0x234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0126.072] SetFilePointerEx (in: hFile=0x234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0126.072] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00956_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00956_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0126.072] GetLastError () returned 0x0 [0126.072] ReadFile (in: hFile=0x234, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x4e8, lpOverlapped=0x0) returned 1 [0126.180] WriteFile (in: hFile=0x1ec, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0x4f0, lpOverlapped=0x0) returned 1 [0126.181] ReadFile (in: hFile=0x234, lpBuffer=0x4010020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x342fecc, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesRead=0x342fecc*=0x0, lpOverlapped=0x0) returned 1 [0126.181] WriteFile (in: hFile=0x1ec, lpBuffer=0x4010020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x342fc94, lpOverlapped=0x0 | out: lpBuffer=0x4010020*, lpNumberOfBytesWritten=0x342fc94*=0xec, lpOverlapped=0x0) returned 1 [0126.181] SetEndOfFile (hFile=0x1ec) returned 1 [0126.579] CloseHandle (hObject=0x1ec) returned 1 [0126.579] SetFilePointerEx (in: hFile=0x234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x342fec0 | out: lpNewFilePointer=0x0) returned 1 [0126.579] SetEndOfFile (hFile=0x234) returned 1 [0126.580] CloseHandle (hObject=0x234) returned 1 [0126.580] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00956_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0126.580] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00956_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00956_.wmf")) Thread: id = 31 os_tid = 0xbac [0102.641] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x757c0000 [0102.641] GetProcAddress (hModule=0x757c0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x757ed650 [0102.641] Wow64DisableWow64FsRedirection (in: OldValue=0x354f900 | out: OldValue=0x354f900*=0x0) returned 1 [0102.641] lstrlenW (lpString="kernel32.dll") returned 12 [0102.641] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0102.641] Sleep (dwMilliseconds=0x64) [0102.880] lstrcmpiW (lpString1=".ttf", lpString2=".waifu") returned -1 [0102.880] lstrlenW (lpString="kor_boot.ttf") returned 12 [0102.880] CreateFileW (lpFileName="C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0103.018] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x354f8c4 | out: lpFileSize=0x354f8c4*=2371360) returned 1 [0103.019] CloseHandle (hObject=0x18c) returned 1 [0103.019] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf")) returned 0x20 [0103.019] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\kor_boot.ttf.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\boot\\fonts\\kor_boot.ttf.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0103.019] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\kor_boot.ttf.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\boot\\fonts\\kor_boot.ttf.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0 [0103.019] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0103.019] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0103.019] lstrlenW (lpString=".doc") returned 4 [0103.019] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0103.019] lstrlenW (lpString=".docx") returned 5 [0103.019] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0103.019] lstrlenW (lpString=".pdf") returned 4 [0103.019] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0103.019] lstrlenW (lpString=".xls") returned 4 [0103.019] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0103.019] lstrlenW (lpString=".xlsx") returned 5 [0103.019] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0103.019] lstrlenW (lpString=".ppt") returned 4 [0103.019] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0103.019] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0103.019] lstrlenW (lpString=".zip") returned 4 [0103.019] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0103.019] lstrlenW (lpString=".rar") returned 4 [0103.019] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0103.019] lstrlenW (lpString=".bz2") returned 4 [0103.019] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0103.019] lstrlenW (lpString=".7z") returned 3 [0103.019] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0103.019] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0103.019] lstrlenW (lpString=".dbf") returned 4 [0103.019] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0103.019] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0103.019] lstrlenW (lpString=".1cd") returned 4 [0103.019] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0103.019] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0103.019] lstrlenW (lpString=".jpg") returned 4 [0103.019] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0103.019] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0103.019] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0103.020] lstrlenW (lpString=".doc") returned 4 [0103.020] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0103.020] lstrlenW (lpString=".docx") returned 5 [0103.020] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0103.020] lstrlenW (lpString=".pdf") returned 4 [0103.020] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0103.020] lstrlenW (lpString=".xls") returned 4 [0103.020] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0103.020] lstrlenW (lpString=".xlsx") returned 5 [0103.020] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0103.020] lstrlenW (lpString=".ppt") returned 4 [0103.020] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0103.020] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0103.020] lstrlenW (lpString=".zip") returned 4 [0103.020] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0103.020] lstrlenW (lpString=".rar") returned 4 [0103.020] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0103.020] lstrlenW (lpString=".bz2") returned 4 [0103.020] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0103.020] lstrlenW (lpString=".7z") returned 3 [0103.020] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0103.020] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0103.020] lstrlenW (lpString=".dbf") returned 4 [0103.020] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0103.020] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0103.020] lstrlenW (lpString=".1cd") returned 4 [0103.020] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0103.020] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0103.020] lstrlenW (lpString=".jpg") returned 4 [0103.020] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0103.020] lstrcmpiW (lpString1=".mui", lpString2=".waifu") returned -1 [0103.020] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0103.020] CreateFileW (lpFileName="C:\\Boot\\fr-FR\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0103.020] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x354f8c4 | out: lpFileSize=0x354f8c4*=93248) returned 1 [0103.020] CloseHandle (hObject=0x18c) returned 1 [0103.020] GetFileAttributesW (lpFileName="C:\\Boot\\fr-FR\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui")) returned 0x20 [0103.021] GetFileAttributesW (lpFileName="C:\\Boot\\fr-FR\\bootmgr.exe.mui.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0103.021] CreateFileW (lpFileName="C:\\Boot\\fr-FR\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0103.021] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0103.021] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0103.021] lstrlenW (lpString=".doc") returned 4 [0103.021] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0103.021] lstrlenW (lpString=".docx") returned 5 [0103.021] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0103.021] lstrlenW (lpString=".pdf") returned 4 [0103.021] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0103.021] lstrlenW (lpString=".xls") returned 4 [0103.021] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0103.021] lstrlenW (lpString=".xlsx") returned 5 [0103.021] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0103.021] lstrlenW (lpString=".ppt") returned 4 [0103.021] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0103.021] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0103.021] lstrlenW (lpString=".zip") returned 4 [0103.021] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0103.021] lstrlenW (lpString=".rar") returned 4 [0103.021] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0103.021] lstrlenW (lpString=".bz2") returned 4 [0103.021] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0103.021] lstrlenW (lpString=".7z") returned 3 [0103.021] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0103.021] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0103.021] lstrlenW (lpString=".dbf") returned 4 [0103.021] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0103.021] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0103.021] lstrlenW (lpString=".1cd") returned 4 [0103.021] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0103.021] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0103.021] lstrlenW (lpString=".jpg") returned 4 [0103.021] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0103.021] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0103.021] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0103.021] lstrlenW (lpString=".doc") returned 4 [0103.021] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0103.021] lstrlenW (lpString=".docx") returned 5 [0103.021] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0103.021] lstrlenW (lpString=".pdf") returned 4 [0103.021] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0103.022] lstrlenW (lpString=".xls") returned 4 [0103.022] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0103.022] lstrlenW (lpString=".xlsx") returned 5 [0103.022] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0103.022] lstrlenW (lpString=".ppt") returned 4 [0103.022] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0103.022] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0103.022] lstrlenW (lpString=".zip") returned 4 [0103.022] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0103.022] lstrlenW (lpString=".rar") returned 4 [0103.022] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0103.022] lstrlenW (lpString=".bz2") returned 4 [0103.022] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0103.022] lstrlenW (lpString=".7z") returned 3 [0103.022] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0103.022] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0103.022] lstrlenW (lpString=".dbf") returned 4 [0103.022] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0103.022] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0103.022] lstrlenW (lpString=".1cd") returned 4 [0103.022] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0103.022] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0103.022] lstrlenW (lpString=".jpg") returned 4 [0103.022] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0103.022] lstrcmpiW (lpString1=".mui", lpString2=".waifu") returned -1 [0103.022] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0103.022] CreateFileW (lpFileName="C:\\Boot\\hu-HU\\bootmgr.exe.mui" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0103.022] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x354f8c4 | out: lpFileSize=0x354f8c4*=90688) returned 1 [0103.022] CloseHandle (hObject=0x18c) returned 1 [0103.022] GetFileAttributesW (lpFileName="C:\\Boot\\hu-HU\\bootmgr.exe.mui" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui")) returned 0x20 [0103.022] GetFileAttributesW (lpFileName="C:\\Boot\\hu-HU\\bootmgr.exe.mui.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0103.022] CreateFileW (lpFileName="C:\\Boot\\hu-HU\\bootmgr.exe.mui" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0103.022] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29 [0103.023] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29 [0103.023] lstrlenW (lpString=".doc") returned 4 [0103.023] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0103.023] lstrlenW (lpString=".docx") returned 5 [0103.023] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0103.023] lstrlenW (lpString=".pdf") returned 4 [0103.023] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0103.023] lstrlenW (lpString=".xls") returned 4 [0103.023] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0103.023] lstrlenW (lpString=".xlsx") returned 5 [0103.023] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0103.023] lstrlenW (lpString=".ppt") returned 4 [0103.023] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0103.023] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29 [0103.023] lstrlenW (lpString=".zip") returned 4 [0103.023] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0103.023] lstrlenW (lpString=".rar") returned 4 [0103.023] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0103.023] lstrlenW (lpString=".bz2") returned 4 [0103.023] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0103.023] lstrlenW (lpString=".7z") returned 3 [0103.023] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0103.023] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29 [0103.023] lstrlenW (lpString=".dbf") returned 4 [0103.023] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0103.023] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29 [0103.023] lstrlenW (lpString=".1cd") returned 4 [0103.023] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0103.023] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29 [0103.023] lstrlenW (lpString=".jpg") returned 4 [0103.023] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0103.023] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29 [0103.023] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29 [0103.023] lstrlenW (lpString=".doc") returned 4 [0103.023] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0103.023] lstrlenW (lpString=".docx") returned 5 [0103.023] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0103.023] lstrlenW (lpString=".pdf") returned 4 [0103.023] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0103.023] lstrlenW (lpString=".xls") returned 4 [0103.023] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0103.023] lstrlenW (lpString=".xlsx") returned 5 [0103.023] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0103.023] lstrlenW (lpString=".ppt") returned 4 [0103.023] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0103.023] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29 [0103.023] lstrlenW (lpString=".zip") returned 4 [0103.023] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0103.023] lstrlenW (lpString=".rar") returned 4 [0103.023] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0103.024] lstrlenW (lpString=".bz2") returned 4 [0103.024] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0103.024] lstrlenW (lpString=".7z") returned 3 [0103.024] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0103.024] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29 [0103.024] lstrlenW (lpString=".dbf") returned 4 [0103.024] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0103.024] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29 [0103.024] lstrlenW (lpString=".1cd") returned 4 [0103.024] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0103.024] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29 [0103.024] lstrlenW (lpString=".jpg") returned 4 [0103.024] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0103.024] lstrcmpiW (lpString1=".mui", lpString2=".waifu") returned -1 [0103.024] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0103.024] CreateFileW (lpFileName="C:\\Boot\\it-IT\\bootmgr.exe.mui" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0103.024] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x354f8c4 | out: lpFileSize=0x354f8c4*=90704) returned 1 [0103.024] CloseHandle (hObject=0x18c) returned 1 [0103.024] GetFileAttributesW (lpFileName="C:\\Boot\\it-IT\\bootmgr.exe.mui" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui")) returned 0x20 [0103.024] GetFileAttributesW (lpFileName="C:\\Boot\\it-IT\\bootmgr.exe.mui.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0103.024] CreateFileW (lpFileName="C:\\Boot\\it-IT\\bootmgr.exe.mui" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0103.024] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29 [0103.024] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29 [0103.024] lstrlenW (lpString=".doc") returned 4 [0103.024] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0103.024] lstrlenW (lpString=".docx") returned 5 [0103.024] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0103.024] lstrlenW (lpString=".pdf") returned 4 [0103.024] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0103.024] lstrlenW (lpString=".xls") returned 4 [0103.024] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0103.024] lstrlenW (lpString=".xlsx") returned 5 [0103.024] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0103.025] lstrlenW (lpString=".ppt") returned 4 [0103.025] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0103.025] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29 [0103.025] lstrlenW (lpString=".zip") returned 4 [0103.025] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0103.025] lstrlenW (lpString=".rar") returned 4 [0103.025] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0103.025] lstrlenW (lpString=".bz2") returned 4 [0103.025] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0103.025] lstrlenW (lpString=".7z") returned 3 [0103.025] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0103.025] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29 [0103.025] lstrlenW (lpString=".dbf") returned 4 [0103.025] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0103.025] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29 [0103.025] lstrlenW (lpString=".1cd") returned 4 [0103.025] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0103.025] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29 [0103.025] lstrlenW (lpString=".jpg") returned 4 [0103.025] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0103.025] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29 [0103.025] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29 [0103.025] lstrlenW (lpString=".doc") returned 4 [0103.025] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0103.025] lstrlenW (lpString=".docx") returned 5 [0103.025] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0103.025] lstrlenW (lpString=".pdf") returned 4 [0103.025] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0103.025] lstrlenW (lpString=".xls") returned 4 [0103.025] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0103.025] lstrlenW (lpString=".xlsx") returned 5 [0103.025] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0103.025] lstrlenW (lpString=".ppt") returned 4 [0103.025] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0103.025] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29 [0103.025] lstrlenW (lpString=".zip") returned 4 [0103.025] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0103.025] lstrlenW (lpString=".rar") returned 4 [0103.025] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0103.025] lstrlenW (lpString=".bz2") returned 4 [0103.025] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0103.025] lstrlenW (lpString=".7z") returned 3 [0103.026] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0103.026] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29 [0103.026] lstrlenW (lpString=".dbf") returned 4 [0103.026] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0103.026] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29 [0103.026] lstrlenW (lpString=".1cd") returned 4 [0103.026] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0103.026] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29 [0103.026] lstrlenW (lpString=".jpg") returned 4 [0103.026] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0103.026] lstrcmpiW (lpString1=".mui", lpString2=".waifu") returned -1 [0103.026] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0103.026] CreateFileW (lpFileName="C:\\Boot\\ja-JP\\bootmgr.exe.mui" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0103.026] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x354f8c4 | out: lpFileSize=0x354f8c4*=76352) returned 1 [0103.026] CloseHandle (hObject=0x18c) returned 1 [0103.026] GetFileAttributesW (lpFileName="C:\\Boot\\ja-JP\\bootmgr.exe.mui" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui")) returned 0x20 [0103.026] GetFileAttributesW (lpFileName="C:\\Boot\\ja-JP\\bootmgr.exe.mui.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0103.026] CreateFileW (lpFileName="C:\\Boot\\ja-JP\\bootmgr.exe.mui" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0103.026] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29 [0103.026] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29 [0103.026] lstrlenW (lpString=".doc") returned 4 [0103.026] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0103.026] lstrlenW (lpString=".docx") returned 5 [0103.026] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0103.026] lstrlenW (lpString=".pdf") returned 4 [0103.026] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0103.026] lstrlenW (lpString=".xls") returned 4 [0103.026] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0103.026] lstrlenW (lpString=".xlsx") returned 5 [0103.026] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0103.026] lstrlenW (lpString=".ppt") returned 4 [0103.026] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0103.027] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29 [0103.027] lstrlenW (lpString=".zip") returned 4 [0103.027] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0103.027] lstrlenW (lpString=".rar") returned 4 [0103.027] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0103.027] lstrlenW (lpString=".bz2") returned 4 [0103.027] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0103.027] lstrlenW (lpString=".7z") returned 3 [0103.027] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0103.027] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29 [0103.027] lstrlenW (lpString=".dbf") returned 4 [0103.027] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0103.027] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29 [0103.027] lstrlenW (lpString=".1cd") returned 4 [0103.027] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0103.027] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29 [0103.027] lstrlenW (lpString=".jpg") returned 4 [0103.027] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0103.027] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29 [0103.027] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29 [0103.027] lstrlenW (lpString=".doc") returned 4 [0103.027] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0103.027] lstrlenW (lpString=".docx") returned 5 [0103.027] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0103.027] lstrlenW (lpString=".pdf") returned 4 [0103.027] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0103.027] lstrlenW (lpString=".xls") returned 4 [0103.027] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0103.027] lstrlenW (lpString=".xlsx") returned 5 [0103.027] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0103.027] lstrlenW (lpString=".ppt") returned 4 [0103.027] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0103.027] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29 [0103.027] lstrlenW (lpString=".zip") returned 4 [0103.027] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0103.027] lstrlenW (lpString=".rar") returned 4 [0103.027] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0103.027] lstrlenW (lpString=".bz2") returned 4 [0103.027] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0103.027] lstrlenW (lpString=".7z") returned 3 [0103.027] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0103.027] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29 [0103.027] lstrlenW (lpString=".dbf") returned 4 [0103.027] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0103.027] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29 [0103.027] lstrlenW (lpString=".1cd") returned 4 [0103.027] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0103.027] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29 [0103.027] lstrlenW (lpString=".jpg") returned 4 [0103.027] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0103.028] lstrcmpiW (lpString1=".mui", lpString2=".waifu") returned -1 [0103.028] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0103.028] CreateFileW (lpFileName="C:\\Boot\\ko-KR\\bootmgr.exe.mui" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0103.028] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x354f8c4 | out: lpFileSize=0x354f8c4*=75344) returned 1 [0103.028] CloseHandle (hObject=0x18c) returned 1 [0103.028] GetFileAttributesW (lpFileName="C:\\Boot\\ko-KR\\bootmgr.exe.mui" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui")) returned 0x20 [0103.028] GetFileAttributesW (lpFileName="C:\\Boot\\ko-KR\\bootmgr.exe.mui.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0103.028] CreateFileW (lpFileName="C:\\Boot\\ko-KR\\bootmgr.exe.mui" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0103.028] lstrlenW (lpString="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29 [0103.028] lstrlenW (lpString="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29 [0103.028] lstrlenW (lpString=".doc") returned 4 [0103.028] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0103.028] lstrlenW (lpString=".docx") returned 5 [0103.028] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0103.028] lstrlenW (lpString=".pdf") returned 4 [0103.028] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0103.028] lstrlenW (lpString=".xls") returned 4 [0103.028] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0103.028] lstrlenW (lpString=".xlsx") returned 5 [0103.028] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0103.028] lstrlenW (lpString=".ppt") returned 4 [0103.028] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0103.028] lstrlenW (lpString="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29 [0103.028] lstrlenW (lpString=".zip") returned 4 [0103.028] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0103.028] lstrlenW (lpString=".rar") returned 4 [0103.028] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0103.028] lstrlenW (lpString=".bz2") returned 4 [0103.028] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0103.028] lstrlenW (lpString=".7z") returned 3 [0103.028] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0103.028] lstrlenW (lpString="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29 [0103.028] lstrlenW (lpString=".dbf") returned 4 [0103.028] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0103.029] lstrlenW (lpString="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29 [0103.029] lstrlenW (lpString=".1cd") returned 4 [0103.029] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0103.029] lstrlenW (lpString="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29 [0103.029] lstrlenW (lpString=".jpg") returned 4 [0103.029] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0103.029] lstrlenW (lpString="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29 [0103.029] lstrlenW (lpString="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29 [0103.029] lstrlenW (lpString=".doc") returned 4 [0103.029] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0103.029] lstrlenW (lpString=".docx") returned 5 [0103.029] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0103.029] lstrlenW (lpString=".pdf") returned 4 [0103.029] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0103.029] lstrlenW (lpString=".xls") returned 4 [0103.029] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0103.029] lstrlenW (lpString=".xlsx") returned 5 [0103.029] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0103.029] lstrlenW (lpString=".ppt") returned 4 [0103.029] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0103.029] lstrlenW (lpString="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29 [0103.029] lstrlenW (lpString=".zip") returned 4 [0103.029] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0103.029] lstrlenW (lpString=".rar") returned 4 [0103.029] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0103.029] lstrlenW (lpString=".bz2") returned 4 [0103.029] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0103.029] lstrlenW (lpString=".7z") returned 3 [0103.029] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0103.029] lstrlenW (lpString="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29 [0103.029] lstrlenW (lpString=".dbf") returned 4 [0103.029] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0103.029] lstrlenW (lpString="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29 [0103.029] lstrlenW (lpString=".1cd") returned 4 [0103.029] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0103.029] lstrlenW (lpString="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29 [0103.029] lstrlenW (lpString=".jpg") returned 4 [0103.029] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0103.029] lstrcmpiW (lpString1=".exe", lpString2=".waifu") returned -1 [0103.029] lstrlenW (lpString="memtest.exe") returned 11 [0103.029] CreateFileW (lpFileName="C:\\Boot\\memtest.exe" (normalized: "c:\\boot\\memtest.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0103.030] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x354f8c4 | out: lpFileSize=0x354f8c4*=485760) returned 1 [0103.030] CloseHandle (hObject=0x18c) returned 1 [0103.030] GetFileAttributesW (lpFileName="C:\\Boot\\memtest.exe" (normalized: "c:\\boot\\memtest.exe")) returned 0x20 [0103.030] GetFileAttributesW (lpFileName="C:\\Boot\\memtest.exe.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\boot\\memtest.exe.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0103.030] CreateFileW (lpFileName="C:\\Boot\\memtest.exe" (normalized: "c:\\boot\\memtest.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0103.030] lstrlenW (lpString="C:\\Boot\\memtest.exe") returned 19 [0103.030] lstrlenW (lpString="C:\\Boot\\memtest.exe") returned 19 [0103.030] lstrlenW (lpString=".doc") returned 4 [0103.030] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0103.030] lstrlenW (lpString=".docx") returned 5 [0103.030] lstrcmpiW (lpString1=".docx", lpString2="t.exe") returned -1 [0103.030] lstrlenW (lpString=".pdf") returned 4 [0103.030] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0103.030] lstrlenW (lpString=".xls") returned 4 [0103.030] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0103.030] lstrlenW (lpString=".xlsx") returned 5 [0103.030] lstrcmpiW (lpString1=".xlsx", lpString2="t.exe") returned -1 [0103.030] lstrlenW (lpString=".ppt") returned 4 [0103.030] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0103.030] lstrlenW (lpString="C:\\Boot\\memtest.exe") returned 19 [0103.030] lstrlenW (lpString=".zip") returned 4 [0103.030] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0103.030] lstrlenW (lpString=".rar") returned 4 [0103.030] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0103.030] lstrlenW (lpString=".bz2") returned 4 [0103.030] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0103.030] lstrlenW (lpString=".7z") returned 3 [0103.030] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0103.032] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x354f8c4 | out: lpFileSize=0x354f8c4*=16972987) returned 1 [0103.032] CloseHandle (hObject=0x18c) returned 1 [0103.032] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excellr.cab")) returned 0x2020 [0103.032] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excellr.cab.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0103.032] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excellr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excellr.cab.id-9c354b42.[darknes@420blaze.it].waifu")) returned 1 [0103.032] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excellr.cab.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0103.033] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f614 | out: lpNewFilePointer=0x0) returned 1 [0103.033] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f5d4 | out: lpNewFilePointer=0x0) returned 1 [0103.033] ReadFile (in: hFile=0x18c, lpBuffer=0x4120058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x354f5e0, lpOverlapped=0x0 | out: lpBuffer=0x4120058*, lpNumberOfBytesRead=0x354f5e0*=0x40000, lpOverlapped=0x0) returned 1 [0103.038] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x56543e, lpNewFilePointer=0x0, dwMoveMethod=0x354f5d4 | out: lpNewFilePointer=0x0) returned 1 [0103.038] ReadFile (in: hFile=0x18c, lpBuffer=0x4160058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x354f5e0, lpOverlapped=0x0 | out: lpBuffer=0x4160058*, lpNumberOfBytesRead=0x354f5e0*=0x40000, lpOverlapped=0x0) returned 1 [0103.041] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x354f614 | out: lpNewFilePointer=0xffffffff) returned 1 [0103.041] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0xfefcbb, lpNewFilePointer=0x0, dwMoveMethod=0x354f5d4 | out: lpNewFilePointer=0x0) returned 1 [0103.041] ReadFile (in: hFile=0x18c, lpBuffer=0x41a0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x354f5e0, lpOverlapped=0x0 | out: lpBuffer=0x41a0058*, lpNumberOfBytesRead=0x354f5e0*=0x40000, lpOverlapped=0x0) returned 1 [0103.055] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f870 | out: lpNewFilePointer=0x0) returned 1 [0103.055] WriteFile (in: hFile=0x18c, lpBuffer=0x4120020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x354f658, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesWritten=0x354f658*=0xc0102, lpOverlapped=0x0) returned 1 [0103.272] SetEndOfFile (hFile=0x18c) returned 1 [0103.274] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f624 | out: lpNewFilePointer=0x0) returned 1 [0103.274] WriteFile (in: hFile=0x18c, lpBuffer=0x44d40a0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x354f630, lpOverlapped=0x0 | out: lpBuffer=0x44d40a0*, lpNumberOfBytesWritten=0x354f630*=0x40000, lpOverlapped=0x0) returned 1 [0103.275] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x56543e, lpNewFilePointer=0x0, dwMoveMethod=0x354f624 | out: lpNewFilePointer=0x0) returned 1 [0103.275] WriteFile (in: hFile=0x18c, lpBuffer=0x44d40a0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x354f630, lpOverlapped=0x0 | out: lpBuffer=0x44d40a0*, lpNumberOfBytesWritten=0x354f630*=0x40000, lpOverlapped=0x0) returned 1 [0103.276] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0xfefcbb, lpNewFilePointer=0x0, dwMoveMethod=0x354f624 | out: lpNewFilePointer=0x0) returned 1 [0103.276] WriteFile (in: hFile=0x18c, lpBuffer=0x44d40a0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x354f630, lpOverlapped=0x0 | out: lpBuffer=0x44d40a0*, lpNumberOfBytesWritten=0x354f630*=0x40000, lpOverlapped=0x0) returned 1 [0103.277] CloseHandle (hObject=0x18c) returned 1 [0104.759] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x2020) returned 1 [0104.759] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0104.759] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0104.759] lstrlenW (lpString=".doc") returned 4 [0104.759] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0104.759] lstrlenW (lpString=".docx") returned 5 [0104.759] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0104.759] lstrlenW (lpString=".pdf") returned 4 [0104.759] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0104.759] lstrlenW (lpString=".xls") returned 4 [0104.759] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0104.759] lstrlenW (lpString=".xlsx") returned 5 [0104.759] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0104.759] lstrlenW (lpString=".ppt") returned 4 [0104.759] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0104.759] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0104.759] lstrlenW (lpString=".zip") returned 4 [0104.759] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0104.759] lstrlenW (lpString=".rar") returned 4 [0104.759] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0104.759] lstrlenW (lpString=".bz2") returned 4 [0104.759] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0104.759] lstrlenW (lpString=".7z") returned 3 [0104.759] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0104.759] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0104.759] lstrlenW (lpString=".dbf") returned 4 [0104.759] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0104.759] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0104.759] lstrlenW (lpString=".1cd") returned 4 [0104.759] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0104.759] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0104.760] lstrlenW (lpString=".jpg") returned 4 [0104.760] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0104.760] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0104.760] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0104.760] lstrlenW (lpString=".doc") returned 4 [0104.760] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0104.760] lstrlenW (lpString=".docx") returned 5 [0104.760] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0104.760] lstrlenW (lpString=".pdf") returned 4 [0104.760] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0104.760] lstrlenW (lpString=".xls") returned 4 [0104.760] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0104.760] lstrlenW (lpString=".xlsx") returned 5 [0104.760] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0104.760] lstrlenW (lpString=".ppt") returned 4 [0104.760] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0104.760] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0104.760] lstrlenW (lpString=".zip") returned 4 [0104.760] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0104.760] lstrlenW (lpString=".rar") returned 4 [0104.760] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0104.760] lstrlenW (lpString=".bz2") returned 4 [0104.760] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0104.760] lstrlenW (lpString=".7z") returned 3 [0104.760] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0104.760] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0104.760] lstrlenW (lpString=".dbf") returned 4 [0104.760] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0104.760] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0104.760] lstrlenW (lpString=".1cd") returned 4 [0104.760] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0104.760] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0104.760] lstrlenW (lpString=".jpg") returned 4 [0104.760] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0104.760] lstrcmpiW (lpString1=".msi", lpString2=".waifu") returned -1 [0104.760] lstrlenW (lpString="OutlookMUI.msi") returned 14 [0104.760] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0104.760] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x354f8c4 | out: lpFileSize=0x354f8c4*=2865664) returned 1 [0104.761] CloseHandle (hObject=0x180) returned 1 [0104.761] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.msi")) returned 0x2020 [0104.761] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.msi.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0104.761] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.msi.id-9c354b42.[darknes@420blaze.it].waifu")) returned 1 [0104.761] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.msi.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0104.761] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f614 | out: lpNewFilePointer=0x0) returned 1 [0104.761] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f5d4 | out: lpNewFilePointer=0x0) returned 1 [0104.761] ReadFile (in: hFile=0x180, lpBuffer=0x4120058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x354f5e0, lpOverlapped=0x0 | out: lpBuffer=0x4120058*, lpNumberOfBytesRead=0x354f5e0*=0x40000, lpOverlapped=0x0) returned 1 [0104.820] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xe9355, lpNewFilePointer=0x0, dwMoveMethod=0x354f5d4 | out: lpNewFilePointer=0x0) returned 1 [0104.820] ReadFile (in: hFile=0x180, lpBuffer=0x4160058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x354f5e0, lpOverlapped=0x0 | out: lpBuffer=0x4160058*, lpNumberOfBytesRead=0x354f5e0*=0x40000, lpOverlapped=0x0) returned 1 [0104.824] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x354f614 | out: lpNewFilePointer=0xffffffff) returned 1 [0104.824] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x27ba00, lpNewFilePointer=0x0, dwMoveMethod=0x354f5d4 | out: lpNewFilePointer=0x0) returned 1 [0104.824] ReadFile (in: hFile=0x180, lpBuffer=0x41a0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x354f5e0, lpOverlapped=0x0 | out: lpBuffer=0x41a0058*, lpNumberOfBytesRead=0x354f5e0*=0x40000, lpOverlapped=0x0) returned 1 [0104.836] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f870 | out: lpNewFilePointer=0x0) returned 1 [0104.836] WriteFile (in: hFile=0x180, lpBuffer=0x4120020*, nNumberOfBytesToWrite=0xc0108, lpNumberOfBytesWritten=0x354f658, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesWritten=0x354f658*=0xc0108, lpOverlapped=0x0) returned 1 [0104.843] SetEndOfFile (hFile=0x180) returned 1 [0104.845] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f624 | out: lpNewFilePointer=0x0) returned 1 [0104.845] WriteFile (in: hFile=0x180, lpBuffer=0x45250c0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x354f630, lpOverlapped=0x0 | out: lpBuffer=0x45250c0*, lpNumberOfBytesWritten=0x354f630*=0x40000, lpOverlapped=0x0) returned 1 [0104.846] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xe9355, lpNewFilePointer=0x0, dwMoveMethod=0x354f624 | out: lpNewFilePointer=0x0) returned 1 [0104.846] WriteFile (in: hFile=0x180, lpBuffer=0x45250c0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x354f630, lpOverlapped=0x0 | out: lpBuffer=0x45250c0*, lpNumberOfBytesWritten=0x354f630*=0x40000, lpOverlapped=0x0) returned 1 [0104.848] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x27ba00, lpNewFilePointer=0x0, dwMoveMethod=0x354f624 | out: lpNewFilePointer=0x0) returned 1 [0104.848] WriteFile (in: hFile=0x180, lpBuffer=0x45250c0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x354f630, lpOverlapped=0x0 | out: lpBuffer=0x45250c0*, lpNumberOfBytesWritten=0x354f630*=0x40000, lpOverlapped=0x0) returned 1 [0104.850] CloseHandle (hObject=0x180) returned 1 [0105.442] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x2020) returned 1 [0105.442] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0105.442] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0105.442] lstrlenW (lpString=".doc") returned 4 [0105.442] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0105.442] lstrlenW (lpString=".docx") returned 5 [0105.442] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0105.442] lstrlenW (lpString=".pdf") returned 4 [0105.442] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0105.442] lstrlenW (lpString=".xls") returned 4 [0105.442] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0105.442] lstrlenW (lpString=".xlsx") returned 5 [0105.442] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0105.442] lstrlenW (lpString=".ppt") returned 4 [0105.442] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0105.442] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0105.442] lstrlenW (lpString=".zip") returned 4 [0105.442] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0105.442] lstrlenW (lpString=".rar") returned 4 [0105.442] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0105.442] lstrlenW (lpString=".bz2") returned 4 [0105.442] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0105.442] lstrlenW (lpString=".7z") returned 3 [0105.442] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0105.442] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0105.442] lstrlenW (lpString=".dbf") returned 4 [0105.443] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0105.443] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0105.443] lstrlenW (lpString=".1cd") returned 4 [0105.443] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0105.443] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0105.443] lstrlenW (lpString=".jpg") returned 4 [0105.443] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0105.443] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0105.443] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0105.443] lstrlenW (lpString=".doc") returned 4 [0105.443] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0105.443] lstrlenW (lpString=".docx") returned 5 [0105.443] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0105.443] lstrlenW (lpString=".pdf") returned 4 [0105.443] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0105.443] lstrlenW (lpString=".xls") returned 4 [0105.443] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0105.443] lstrlenW (lpString=".xlsx") returned 5 [0105.443] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0105.443] lstrlenW (lpString=".ppt") returned 4 [0105.443] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0105.443] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0105.443] lstrlenW (lpString=".zip") returned 4 [0105.443] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0105.443] lstrlenW (lpString=".rar") returned 4 [0105.443] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0105.443] lstrlenW (lpString=".bz2") returned 4 [0105.443] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0105.444] lstrlenW (lpString=".7z") returned 3 [0105.444] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0105.444] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0105.444] lstrlenW (lpString=".dbf") returned 4 [0105.444] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0105.444] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0105.444] lstrlenW (lpString=".1cd") returned 4 [0105.444] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0105.444] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0105.444] lstrlenW (lpString=".jpg") returned 4 [0105.444] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0105.444] lstrcmpiW (lpString1=".cab", lpString2=".waifu") returned -1 [0105.444] lstrlenW (lpString="Proof.cab") returned 9 [0105.444] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0105.444] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x354f8c4 | out: lpFileSize=0x354f8c4*=11482605) returned 1 [0105.444] CloseHandle (hObject=0x180) returned 1 [0105.444] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.cab")) returned 0x2020 [0105.444] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.cab.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0105.444] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.cab.id-9c354b42.[darknes@420blaze.it].waifu")) returned 1 [0105.700] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.cab.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0105.700] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f614 | out: lpNewFilePointer=0x0) returned 1 [0105.700] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f5d4 | out: lpNewFilePointer=0x0) returned 1 [0105.700] ReadFile (in: hFile=0x180, lpBuffer=0x4120058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x354f5e0, lpOverlapped=0x0 | out: lpBuffer=0x4120058*, lpNumberOfBytesRead=0x354f5e0*=0x40000, lpOverlapped=0x0) returned 1 [0105.703] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x3a674f, lpNewFilePointer=0x0, dwMoveMethod=0x354f5d4 | out: lpNewFilePointer=0x0) returned 1 [0105.703] ReadFile (in: hFile=0x180, lpBuffer=0x4160058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x354f5e0, lpOverlapped=0x0 | out: lpBuffer=0x4160058*, lpNumberOfBytesRead=0x354f5e0*=0x40000, lpOverlapped=0x0) returned 1 [0105.708] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x354f614 | out: lpNewFilePointer=0xffffffff) returned 1 [0105.708] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xab35ed, lpNewFilePointer=0x0, dwMoveMethod=0x354f5d4 | out: lpNewFilePointer=0x0) returned 1 [0105.708] ReadFile (in: hFile=0x180, lpBuffer=0x41a0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x354f5e0, lpOverlapped=0x0 | out: lpBuffer=0x41a0058*, lpNumberOfBytesRead=0x354f5e0*=0x40000, lpOverlapped=0x0) returned 1 [0105.890] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f870 | out: lpNewFilePointer=0x0) returned 1 [0105.890] WriteFile (in: hFile=0x180, lpBuffer=0x4120020*, nNumberOfBytesToWrite=0xc00fe, lpNumberOfBytesWritten=0x354f658, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesWritten=0x354f658*=0xc00fe, lpOverlapped=0x0) returned 1 [0105.897] SetEndOfFile (hFile=0x180) returned 1 [0105.899] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f624 | out: lpNewFilePointer=0x0) returned 1 [0105.899] WriteFile (in: hFile=0x180, lpBuffer=0x45140b0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x354f630, lpOverlapped=0x0 | out: lpBuffer=0x45140b0*, lpNumberOfBytesWritten=0x354f630*=0x40000, lpOverlapped=0x0) returned 1 [0105.900] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x3a674f, lpNewFilePointer=0x0, dwMoveMethod=0x354f624 | out: lpNewFilePointer=0x0) returned 1 [0105.900] WriteFile (in: hFile=0x180, lpBuffer=0x45140b0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x354f630, lpOverlapped=0x0 | out: lpBuffer=0x45140b0*, lpNumberOfBytesWritten=0x354f630*=0x40000, lpOverlapped=0x0) returned 1 [0105.901] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xab35ed, lpNewFilePointer=0x0, dwMoveMethod=0x354f624 | out: lpNewFilePointer=0x0) returned 1 [0105.901] WriteFile (in: hFile=0x180, lpBuffer=0x45140b0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x354f630, lpOverlapped=0x0 | out: lpBuffer=0x45140b0*, lpNumberOfBytesWritten=0x354f630*=0x40000, lpOverlapped=0x0) returned 1 [0105.903] CloseHandle (hObject=0x180) returned 1 [0106.754] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x2020) returned 1 [0107.721] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81 [0107.721] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81 [0107.721] lstrlenW (lpString=".doc") returned 4 [0107.721] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0107.721] lstrlenW (lpString=".docx") returned 5 [0107.721] lstrcmpiW (lpString1=".docx", lpString2="f.cab") returned -1 [0107.721] lstrlenW (lpString=".pdf") returned 4 [0107.721] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0107.721] lstrlenW (lpString=".xls") returned 4 [0107.722] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0107.722] lstrlenW (lpString=".xlsx") returned 5 [0107.722] lstrcmpiW (lpString1=".xlsx", lpString2="f.cab") returned -1 [0107.722] lstrlenW (lpString=".ppt") returned 4 [0107.722] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0107.722] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81 [0107.722] lstrlenW (lpString=".zip") returned 4 [0107.722] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0107.722] lstrlenW (lpString=".rar") returned 4 [0107.722] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0107.722] lstrlenW (lpString=".bz2") returned 4 [0107.722] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0107.722] lstrlenW (lpString=".7z") returned 3 [0107.722] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0107.722] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81 [0107.722] lstrlenW (lpString=".dbf") returned 4 [0107.722] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0107.722] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81 [0107.722] lstrlenW (lpString=".1cd") returned 4 [0107.722] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0107.722] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81 [0107.722] lstrlenW (lpString=".jpg") returned 4 [0107.722] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0107.722] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81 [0107.722] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81 [0107.722] lstrlenW (lpString=".doc") returned 4 [0107.722] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0107.722] lstrlenW (lpString=".docx") returned 5 [0107.722] lstrcmpiW (lpString1=".docx", lpString2="f.cab") returned -1 [0107.722] lstrlenW (lpString=".pdf") returned 4 [0107.722] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0107.722] lstrlenW (lpString=".xls") returned 4 [0107.722] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0107.722] lstrlenW (lpString=".xlsx") returned 5 [0107.722] lstrcmpiW (lpString1=".xlsx", lpString2="f.cab") returned -1 [0107.722] lstrlenW (lpString=".ppt") returned 4 [0107.722] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0107.722] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81 [0107.722] lstrlenW (lpString=".zip") returned 4 [0107.722] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0107.722] lstrlenW (lpString=".rar") returned 4 [0107.722] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0107.722] lstrlenW (lpString=".bz2") returned 4 [0107.722] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0107.722] lstrlenW (lpString=".7z") returned 3 [0107.722] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0107.722] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81 [0107.722] lstrlenW (lpString=".dbf") returned 4 [0107.722] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0107.722] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81 [0107.723] lstrlenW (lpString=".1cd") returned 4 [0107.723] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0107.723] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81 [0107.723] lstrlenW (lpString=".jpg") returned 4 [0107.723] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0107.723] lstrcmpiW (lpString1=".msi", lpString2=".waifu") returned -1 [0107.723] lstrlenW (lpString="Proofing.msi") returned 12 [0107.723] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0107.723] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x354f8c4 | out: lpFileSize=0x354f8c4*=868864) returned 1 [0107.723] CloseHandle (hObject=0x1a0) returned 1 [0107.723] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.msi")) returned 0x2020 [0107.723] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.msi.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0107.723] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0107.723] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f870 | out: lpNewFilePointer=0x0) returned 1 [0107.723] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f870 | out: lpNewFilePointer=0x0) returned 1 [0107.723] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.msi.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0107.724] GetLastError () returned 0x0 [0107.724] ReadFile (in: hFile=0x1a0, lpBuffer=0x4120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x354f87c, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesRead=0x354f87c*=0xd4200, lpOverlapped=0x0) returned 1 [0107.738] WriteFile (in: hFile=0x1bc, lpBuffer=0x4120020*, nNumberOfBytesToWrite=0xd4210, lpNumberOfBytesWritten=0x354f644, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesWritten=0x354f644*=0xd4210, lpOverlapped=0x0) returned 1 [0107.744] ReadFile (in: hFile=0x1a0, lpBuffer=0x4120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x354f87c, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesRead=0x354f87c*=0x0, lpOverlapped=0x0) returned 1 [0107.745] WriteFile (in: hFile=0x1bc, lpBuffer=0x4120020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x354f644, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesWritten=0x354f644*=0xec, lpOverlapped=0x0) returned 1 [0107.745] SetEndOfFile (hFile=0x1bc) returned 1 [0107.745] CloseHandle (hObject=0x1bc) returned 1 [0107.750] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f870 | out: lpNewFilePointer=0x0) returned 1 [0107.750] SetEndOfFile (hFile=0x1a0) returned 1 [0107.752] CloseHandle (hObject=0x1a0) returned 1 [0107.752] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x2020) returned 1 [0107.752] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.msi")) returned 1 [0107.753] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75 [0107.753] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75 [0107.753] lstrlenW (lpString=".doc") returned 4 [0107.753] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0107.753] lstrlenW (lpString=".docx") returned 5 [0107.753] lstrcmpiW (lpString1=".docx", lpString2="g.msi") returned -1 [0107.753] lstrlenW (lpString=".pdf") returned 4 [0107.753] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0107.753] lstrlenW (lpString=".xls") returned 4 [0107.753] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0107.753] lstrlenW (lpString=".xlsx") returned 5 [0107.753] lstrcmpiW (lpString1=".xlsx", lpString2="g.msi") returned -1 [0107.753] lstrlenW (lpString=".ppt") returned 4 [0107.753] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0107.753] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75 [0107.753] lstrlenW (lpString=".zip") returned 4 [0107.753] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0107.753] lstrlenW (lpString=".rar") returned 4 [0107.753] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0107.753] lstrlenW (lpString=".bz2") returned 4 [0107.753] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0107.753] lstrlenW (lpString=".7z") returned 3 [0107.753] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0107.753] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75 [0107.753] lstrlenW (lpString=".dbf") returned 4 [0107.753] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0107.753] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75 [0107.753] lstrlenW (lpString=".1cd") returned 4 [0107.753] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0107.753] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75 [0107.753] lstrlenW (lpString=".jpg") returned 4 [0107.753] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0107.753] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75 [0107.753] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75 [0107.753] lstrlenW (lpString=".doc") returned 4 [0107.753] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0107.753] lstrlenW (lpString=".docx") returned 5 [0107.753] lstrcmpiW (lpString1=".docx", lpString2="g.msi") returned -1 [0107.753] lstrlenW (lpString=".pdf") returned 4 [0107.753] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0107.753] lstrlenW (lpString=".xls") returned 4 [0107.753] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0107.753] lstrlenW (lpString=".xlsx") returned 5 [0107.753] lstrcmpiW (lpString1=".xlsx", lpString2="g.msi") returned -1 [0107.754] lstrlenW (lpString=".ppt") returned 4 [0107.754] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0107.754] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75 [0107.754] lstrlenW (lpString=".zip") returned 4 [0107.754] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0107.754] lstrlenW (lpString=".rar") returned 4 [0107.754] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0107.754] lstrlenW (lpString=".bz2") returned 4 [0107.754] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0107.754] lstrlenW (lpString=".7z") returned 3 [0107.754] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0107.754] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75 [0107.754] lstrlenW (lpString=".dbf") returned 4 [0107.754] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0107.754] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75 [0107.754] lstrlenW (lpString=".1cd") returned 4 [0107.754] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0107.754] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75 [0107.754] lstrlenW (lpString=".jpg") returned 4 [0107.754] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0107.754] lstrcmpiW (lpString1=".msi", lpString2=".waifu") returned -1 [0107.754] lstrlenW (lpString="Office32MUI.msi") returned 15 [0107.754] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0107.754] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x354f8c4 | out: lpFileSize=0x354f8c4*=873984) returned 1 [0107.754] CloseHandle (hObject=0x1a0) returned 1 [0107.754] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.msi")) returned 0x2020 [0107.755] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.msi.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0107.755] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0107.755] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f870 | out: lpNewFilePointer=0x0) returned 1 [0107.755] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f870 | out: lpNewFilePointer=0x0) returned 1 [0107.755] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.msi.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0107.755] GetLastError () returned 0x0 [0107.755] ReadFile (in: hFile=0x1a0, lpBuffer=0x4120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x354f87c, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesRead=0x354f87c*=0xd5600, lpOverlapped=0x0) returned 1 [0107.826] WriteFile (in: hFile=0x1bc, lpBuffer=0x4120020*, nNumberOfBytesToWrite=0xd5610, lpNumberOfBytesWritten=0x354f644, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesWritten=0x354f644*=0xd5610, lpOverlapped=0x0) returned 1 [0107.833] ReadFile (in: hFile=0x1a0, lpBuffer=0x4120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x354f87c, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesRead=0x354f87c*=0x0, lpOverlapped=0x0) returned 1 [0107.833] WriteFile (in: hFile=0x1bc, lpBuffer=0x4120020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x354f644, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesWritten=0x354f644*=0xf2, lpOverlapped=0x0) returned 1 [0107.833] SetEndOfFile (hFile=0x1bc) returned 1 [0107.833] CloseHandle (hObject=0x1bc) returned 1 [0107.838] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f870 | out: lpNewFilePointer=0x0) returned 1 [0107.838] SetEndOfFile (hFile=0x1a0) returned 1 [0107.840] CloseHandle (hObject=0x1a0) returned 1 [0107.840] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x2020) returned 1 [0107.841] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.msi")) returned 1 [0107.841] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78 [0107.841] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78 [0107.841] lstrlenW (lpString=".doc") returned 4 [0107.841] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0107.841] lstrlenW (lpString=".docx") returned 5 [0107.841] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0107.841] lstrlenW (lpString=".pdf") returned 4 [0107.841] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0107.841] lstrlenW (lpString=".xls") returned 4 [0107.841] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0107.841] lstrlenW (lpString=".xlsx") returned 5 [0107.841] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0107.841] lstrlenW (lpString=".ppt") returned 4 [0107.841] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0107.841] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78 [0107.841] lstrlenW (lpString=".zip") returned 4 [0107.841] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0107.841] lstrlenW (lpString=".rar") returned 4 [0107.841] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0107.841] lstrlenW (lpString=".bz2") returned 4 [0107.841] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0107.841] lstrlenW (lpString=".7z") returned 3 [0107.841] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0107.841] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78 [0107.841] lstrlenW (lpString=".dbf") returned 4 [0107.841] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0107.841] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78 [0107.841] lstrlenW (lpString=".1cd") returned 4 [0107.841] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0107.841] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78 [0107.841] lstrlenW (lpString=".jpg") returned 4 [0107.841] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0107.841] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78 [0107.841] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78 [0107.841] lstrlenW (lpString=".doc") returned 4 [0107.841] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0107.841] lstrlenW (lpString=".docx") returned 5 [0107.841] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0107.841] lstrlenW (lpString=".pdf") returned 4 [0107.841] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0107.842] lstrlenW (lpString=".xls") returned 4 [0107.842] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0107.842] lstrlenW (lpString=".xlsx") returned 5 [0107.842] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0107.842] lstrlenW (lpString=".ppt") returned 4 [0107.842] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0107.842] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78 [0107.842] lstrlenW (lpString=".zip") returned 4 [0107.842] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0107.842] lstrlenW (lpString=".rar") returned 4 [0107.842] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0107.842] lstrlenW (lpString=".bz2") returned 4 [0107.842] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0107.842] lstrlenW (lpString=".7z") returned 3 [0107.842] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0107.842] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78 [0107.842] lstrlenW (lpString=".dbf") returned 4 [0107.842] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0107.842] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78 [0107.842] lstrlenW (lpString=".1cd") returned 4 [0107.842] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0107.842] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78 [0107.842] lstrlenW (lpString=".jpg") returned 4 [0107.842] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0107.842] lstrcmpiW (lpString1=".msi", lpString2=".waifu") returned -1 [0107.842] lstrlenW (lpString="InfoPathMUI.msi") returned 15 [0107.842] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0107.842] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x354f8c4 | out: lpFileSize=0x354f8c4*=3124224) returned 1 [0107.842] CloseHandle (hObject=0x1a0) returned 1 [0107.842] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.msi")) returned 0x2020 [0107.842] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.msi.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0107.842] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.msi.id-9c354b42.[darknes@420blaze.it].waifu")) returned 1 [0107.843] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.msi.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0107.843] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f614 | out: lpNewFilePointer=0x0) returned 1 [0107.843] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f5d4 | out: lpNewFilePointer=0x0) returned 1 [0107.843] ReadFile (in: hFile=0x1a0, lpBuffer=0x4120058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x354f5e0, lpOverlapped=0x0 | out: lpBuffer=0x4120058*, lpNumberOfBytesRead=0x354f5e0*=0x40000, lpOverlapped=0x0) returned 1 [0107.884] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0xfe400, lpNewFilePointer=0x0, dwMoveMethod=0x354f5d4 | out: lpNewFilePointer=0x0) returned 1 [0107.884] ReadFile (in: hFile=0x1a0, lpBuffer=0x4160058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x354f5e0, lpOverlapped=0x0 | out: lpBuffer=0x4160058*, lpNumberOfBytesRead=0x354f5e0*=0x40000, lpOverlapped=0x0) returned 1 [0108.239] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x354f614 | out: lpNewFilePointer=0xffffffff) returned 1 [0108.239] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x2bac00, lpNewFilePointer=0x0, dwMoveMethod=0x354f5d4 | out: lpNewFilePointer=0x0) returned 1 [0108.239] ReadFile (in: hFile=0x1a0, lpBuffer=0x41a0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x354f5e0, lpOverlapped=0x0 | out: lpBuffer=0x41a0058*, lpNumberOfBytesRead=0x354f5e0*=0x40000, lpOverlapped=0x0) returned 1 [0108.252] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f870 | out: lpNewFilePointer=0x0) returned 1 [0108.252] WriteFile (in: hFile=0x1a0, lpBuffer=0x4120020*, nNumberOfBytesToWrite=0xc010a, lpNumberOfBytesWritten=0x354f658, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesWritten=0x354f658*=0xc010a, lpOverlapped=0x0) returned 1 [0108.259] SetEndOfFile (hFile=0x1a0) returned 1 [0108.259] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f624 | out: lpNewFilePointer=0x0) returned 1 [0108.259] WriteFile (in: hFile=0x1a0, lpBuffer=0x44b2070*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x354f630, lpOverlapped=0x0 | out: lpBuffer=0x44b2070*, lpNumberOfBytesWritten=0x354f630*=0x40000, lpOverlapped=0x0) returned 1 [0108.260] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0xfe400, lpNewFilePointer=0x0, dwMoveMethod=0x354f624 | out: lpNewFilePointer=0x0) returned 1 [0108.260] WriteFile (in: hFile=0x1a0, lpBuffer=0x44b2070*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x354f630, lpOverlapped=0x0 | out: lpBuffer=0x44b2070*, lpNumberOfBytesWritten=0x354f630*=0x40000, lpOverlapped=0x0) returned 1 [0108.262] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x2bac00, lpNewFilePointer=0x0, dwMoveMethod=0x354f624 | out: lpNewFilePointer=0x0) returned 1 [0108.262] WriteFile (in: hFile=0x1a0, lpBuffer=0x44b2070*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x354f630, lpOverlapped=0x0 | out: lpBuffer=0x44b2070*, lpNumberOfBytesWritten=0x354f630*=0x40000, lpOverlapped=0x0) returned 1 [0108.264] CloseHandle (hObject=0x1a0) returned 1 [0110.607] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x2020) returned 1 [0110.607] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78 [0110.607] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78 [0110.607] lstrlenW (lpString=".doc") returned 4 [0110.607] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0110.607] lstrlenW (lpString=".docx") returned 5 [0110.607] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0110.607] lstrlenW (lpString=".pdf") returned 4 [0110.607] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0110.607] lstrlenW (lpString=".xls") returned 4 [0110.607] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0110.607] lstrlenW (lpString=".xlsx") returned 5 [0110.607] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0110.607] lstrlenW (lpString=".ppt") returned 4 [0110.607] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0110.608] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78 [0110.608] lstrlenW (lpString=".zip") returned 4 [0110.608] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0110.608] lstrlenW (lpString=".rar") returned 4 [0110.608] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0110.608] lstrlenW (lpString=".bz2") returned 4 [0110.608] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0110.608] lstrlenW (lpString=".7z") returned 3 [0110.608] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0110.608] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78 [0110.608] lstrlenW (lpString=".dbf") returned 4 [0110.608] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0110.608] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78 [0110.608] lstrlenW (lpString=".1cd") returned 4 [0110.608] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0110.608] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78 [0110.608] lstrlenW (lpString=".jpg") returned 4 [0110.608] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0110.608] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78 [0110.608] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78 [0110.608] lstrlenW (lpString=".doc") returned 4 [0110.608] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0110.608] lstrlenW (lpString=".docx") returned 5 [0110.608] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0110.608] lstrlenW (lpString=".pdf") returned 4 [0110.608] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0110.608] lstrlenW (lpString=".xls") returned 4 [0110.608] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0110.608] lstrlenW (lpString=".xlsx") returned 5 [0110.608] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0110.608] lstrlenW (lpString=".ppt") returned 4 [0110.608] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0110.608] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78 [0110.608] lstrlenW (lpString=".zip") returned 4 [0110.608] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0110.608] lstrlenW (lpString=".rar") returned 4 [0110.608] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0110.608] lstrlenW (lpString=".bz2") returned 4 [0110.608] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0110.608] lstrlenW (lpString=".7z") returned 3 [0110.608] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0110.608] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78 [0110.608] lstrlenW (lpString=".dbf") returned 4 [0110.609] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0110.609] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78 [0110.609] lstrlenW (lpString=".1cd") returned 4 [0110.609] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0110.609] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78 [0110.609] lstrlenW (lpString=".jpg") returned 4 [0110.609] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0110.609] lstrcmpiW (lpString1=".msi", lpString2=".waifu") returned -1 [0110.609] lstrlenW (lpString="OneNoteMUI.msi") returned 14 [0110.609] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0110.609] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x354f8c4 | out: lpFileSize=0x354f8c4*=2503680) returned 1 [0110.609] CloseHandle (hObject=0x1a0) returned 1 [0110.609] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.msi")) returned 0x2020 [0110.609] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.msi.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0110.609] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.msi.id-9c354b42.[darknes@420blaze.it].waifu")) returned 1 [0110.610] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.msi.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0110.610] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f614 | out: lpNewFilePointer=0x0) returned 1 [0110.610] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f5d4 | out: lpNewFilePointer=0x0) returned 1 [0110.610] ReadFile (in: hFile=0x1a0, lpBuffer=0x4120058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x354f5e0, lpOverlapped=0x0 | out: lpBuffer=0x4120058*, lpNumberOfBytesRead=0x354f5e0*=0x40000, lpOverlapped=0x0) returned 1 [0110.797] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0xcbc00, lpNewFilePointer=0x0, dwMoveMethod=0x354f5d4 | out: lpNewFilePointer=0x0) returned 1 [0110.797] ReadFile (in: hFile=0x1a0, lpBuffer=0x4160058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x354f5e0, lpOverlapped=0x0 | out: lpBuffer=0x4160058*, lpNumberOfBytesRead=0x354f5e0*=0x40000, lpOverlapped=0x0) returned 1 [0110.804] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x354f614 | out: lpNewFilePointer=0xffffffff) returned 1 [0110.804] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x223400, lpNewFilePointer=0x0, dwMoveMethod=0x354f5d4 | out: lpNewFilePointer=0x0) returned 1 [0110.804] ReadFile (in: hFile=0x1a0, lpBuffer=0x41a0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x354f5e0, lpOverlapped=0x0 | out: lpBuffer=0x41a0058*, lpNumberOfBytesRead=0x354f5e0*=0x40000, lpOverlapped=0x0) returned 1 [0110.822] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f870 | out: lpNewFilePointer=0x0) returned 1 [0110.822] WriteFile (in: hFile=0x1a0, lpBuffer=0x4120020*, nNumberOfBytesToWrite=0xc0108, lpNumberOfBytesWritten=0x354f658, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesWritten=0x354f658*=0xc0108, lpOverlapped=0x0) returned 1 [0110.830] SetEndOfFile (hFile=0x1a0) returned 1 [0110.832] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f624 | out: lpNewFilePointer=0x0) returned 1 [0110.833] WriteFile (in: hFile=0x1a0, lpBuffer=0x44b2070*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x354f630, lpOverlapped=0x0 | out: lpBuffer=0x44b2070*, lpNumberOfBytesWritten=0x354f630*=0x40000, lpOverlapped=0x0) returned 1 [0110.834] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0xcbc00, lpNewFilePointer=0x0, dwMoveMethod=0x354f624 | out: lpNewFilePointer=0x0) returned 1 [0110.834] WriteFile (in: hFile=0x1a0, lpBuffer=0x44b2070*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x354f630, lpOverlapped=0x0 | out: lpBuffer=0x44b2070*, lpNumberOfBytesWritten=0x354f630*=0x40000, lpOverlapped=0x0) returned 1 [0110.836] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x223400, lpNewFilePointer=0x0, dwMoveMethod=0x354f624 | out: lpNewFilePointer=0x0) returned 1 [0110.836] WriteFile (in: hFile=0x1a0, lpBuffer=0x44b2070*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x354f630, lpOverlapped=0x0 | out: lpBuffer=0x44b2070*, lpNumberOfBytesWritten=0x354f630*=0x40000, lpOverlapped=0x0) returned 1 [0110.838] CloseHandle (hObject=0x1a0) returned 1 [0110.839] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x2020) returned 1 [0110.839] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77 [0110.839] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77 [0110.839] lstrlenW (lpString=".doc") returned 4 [0110.839] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0110.839] lstrlenW (lpString=".docx") returned 5 [0110.839] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0110.839] lstrlenW (lpString=".pdf") returned 4 [0110.839] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0110.839] lstrlenW (lpString=".xls") returned 4 [0110.839] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0110.839] lstrlenW (lpString=".xlsx") returned 5 [0110.839] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0110.839] lstrlenW (lpString=".ppt") returned 4 [0110.839] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0110.839] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77 [0110.839] lstrlenW (lpString=".zip") returned 4 [0110.839] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0110.839] lstrlenW (lpString=".rar") returned 4 [0110.839] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0110.839] lstrlenW (lpString=".bz2") returned 4 [0110.839] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0110.839] lstrlenW (lpString=".7z") returned 3 [0110.839] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0110.839] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77 [0110.839] lstrlenW (lpString=".dbf") returned 4 [0110.839] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0110.839] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77 [0110.839] lstrlenW (lpString=".1cd") returned 4 [0110.839] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0110.839] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77 [0110.839] lstrlenW (lpString=".jpg") returned 4 [0110.839] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0110.840] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77 [0110.840] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77 [0110.840] lstrlenW (lpString=".doc") returned 4 [0110.840] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0110.840] lstrlenW (lpString=".docx") returned 5 [0110.840] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0110.840] lstrlenW (lpString=".pdf") returned 4 [0110.840] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0110.840] lstrlenW (lpString=".xls") returned 4 [0110.840] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0110.840] lstrlenW (lpString=".xlsx") returned 5 [0110.840] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0110.840] lstrlenW (lpString=".ppt") returned 4 [0110.840] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0110.840] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77 [0110.840] lstrlenW (lpString=".zip") returned 4 [0110.840] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0110.840] lstrlenW (lpString=".rar") returned 4 [0110.840] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0110.840] lstrlenW (lpString=".bz2") returned 4 [0110.840] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0110.840] lstrlenW (lpString=".7z") returned 3 [0110.840] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0110.840] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77 [0110.840] lstrlenW (lpString=".dbf") returned 4 [0110.840] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0110.840] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77 [0110.840] lstrlenW (lpString=".1cd") returned 4 [0110.840] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0110.840] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77 [0110.840] lstrlenW (lpString=".jpg") returned 4 [0110.840] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0110.840] lstrcmpiW (lpString1=".cab", lpString2=".waifu") returned -1 [0110.840] lstrlenW (lpString="GrooveLR.cab") returned 12 [0110.840] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovelr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0110.841] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x354f8c4 | out: lpFileSize=0x354f8c4*=4095519) returned 1 [0111.510] CloseHandle (hObject=0x1a0) returned 1 [0111.510] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovelr.cab")) returned 0x2020 [0111.510] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovelr.cab.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0111.510] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovelr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovelr.cab.id-9c354b42.[darknes@420blaze.it].waifu")) returned 1 [0111.511] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovelr.cab.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0111.511] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f614 | out: lpNewFilePointer=0x0) returned 1 [0111.511] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f5d4 | out: lpNewFilePointer=0x0) returned 1 [0111.511] ReadFile (in: hFile=0x1a0, lpBuffer=0x4120058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x354f5e0, lpOverlapped=0x0 | out: lpBuffer=0x4120058*, lpNumberOfBytesRead=0x354f5e0*=0x40000, lpOverlapped=0x0) returned 1 [0111.514] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x14d4b5, lpNewFilePointer=0x0, dwMoveMethod=0x354f5d4 | out: lpNewFilePointer=0x0) returned 1 [0111.514] ReadFile (in: hFile=0x1a0, lpBuffer=0x4160058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x354f5e0, lpOverlapped=0x0 | out: lpBuffer=0x4160058*, lpNumberOfBytesRead=0x354f5e0*=0x40000, lpOverlapped=0x0) returned 1 [0111.516] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x354f614 | out: lpNewFilePointer=0xffffffff) returned 1 [0111.517] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x3a7e1f, lpNewFilePointer=0x0, dwMoveMethod=0x354f5d4 | out: lpNewFilePointer=0x0) returned 1 [0111.517] ReadFile (in: hFile=0x1a0, lpBuffer=0x41a0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x354f5e0, lpOverlapped=0x0 | out: lpBuffer=0x41a0058*, lpNumberOfBytesRead=0x354f5e0*=0x40000, lpOverlapped=0x0) returned 1 [0111.529] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f870 | out: lpNewFilePointer=0x0) returned 1 [0111.530] WriteFile (in: hFile=0x1a0, lpBuffer=0x4120020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x354f658, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesWritten=0x354f658*=0xc0104, lpOverlapped=0x0) returned 1 [0111.539] SetEndOfFile (hFile=0x1a0) returned 1 [0111.541] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f624 | out: lpNewFilePointer=0x0) returned 1 [0111.542] WriteFile (in: hFile=0x1a0, lpBuffer=0x45540b8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x354f630, lpOverlapped=0x0 | out: lpBuffer=0x45540b8*, lpNumberOfBytesWritten=0x354f630*=0x40000, lpOverlapped=0x0) returned 1 [0111.543] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x14d4b5, lpNewFilePointer=0x0, dwMoveMethod=0x354f624 | out: lpNewFilePointer=0x0) returned 1 [0111.543] WriteFile (in: hFile=0x1a0, lpBuffer=0x45540b8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x354f630, lpOverlapped=0x0 | out: lpBuffer=0x45540b8*, lpNumberOfBytesWritten=0x354f630*=0x40000, lpOverlapped=0x0) returned 1 [0111.545] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x3a7e1f, lpNewFilePointer=0x0, dwMoveMethod=0x354f624 | out: lpNewFilePointer=0x0) returned 1 [0111.545] WriteFile (in: hFile=0x1a0, lpBuffer=0x45540b8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x354f630, lpOverlapped=0x0 | out: lpBuffer=0x45540b8*, lpNumberOfBytesWritten=0x354f630*=0x40000, lpOverlapped=0x0) returned 1 [0111.546] CloseHandle (hObject=0x1a0) returned 1 [0111.546] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x2020) returned 1 [0111.547] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75 [0111.547] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75 [0111.547] lstrlenW (lpString=".doc") returned 4 [0111.547] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0111.547] lstrlenW (lpString=".docx") returned 5 [0111.547] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0111.547] lstrlenW (lpString=".pdf") returned 4 [0111.547] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0111.547] lstrlenW (lpString=".xls") returned 4 [0111.547] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0111.547] lstrlenW (lpString=".xlsx") returned 5 [0111.547] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0111.547] lstrlenW (lpString=".ppt") returned 4 [0111.547] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0111.547] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75 [0111.547] lstrlenW (lpString=".zip") returned 4 [0111.547] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0111.547] lstrlenW (lpString=".rar") returned 4 [0111.547] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0111.547] lstrlenW (lpString=".bz2") returned 4 [0111.547] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0111.547] lstrlenW (lpString=".7z") returned 3 [0111.548] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0111.548] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75 [0111.548] lstrlenW (lpString=".dbf") returned 4 [0111.548] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0111.548] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75 [0111.548] lstrlenW (lpString=".1cd") returned 4 [0111.548] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0111.548] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75 [0111.548] lstrlenW (lpString=".jpg") returned 4 [0111.548] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0111.548] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75 [0111.548] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75 [0111.548] lstrlenW (lpString=".doc") returned 4 [0111.548] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0111.548] lstrlenW (lpString=".docx") returned 5 [0111.548] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0111.548] lstrlenW (lpString=".pdf") returned 4 [0111.548] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0111.548] lstrlenW (lpString=".xls") returned 4 [0111.548] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0111.548] lstrlenW (lpString=".xlsx") returned 5 [0111.548] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0111.548] lstrlenW (lpString=".ppt") returned 4 [0111.548] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0111.548] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75 [0111.548] lstrlenW (lpString=".zip") returned 4 [0111.548] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0111.548] lstrlenW (lpString=".rar") returned 4 [0111.548] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0111.548] lstrlenW (lpString=".bz2") returned 4 [0111.548] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0111.549] lstrlenW (lpString=".7z") returned 3 [0111.549] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0111.549] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75 [0111.549] lstrlenW (lpString=".dbf") returned 4 [0111.549] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0111.549] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75 [0111.549] lstrlenW (lpString=".1cd") returned 4 [0111.549] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0111.549] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75 [0111.549] lstrlenW (lpString=".jpg") returned 4 [0111.549] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0111.549] lstrcmpiW (lpString1=".manifest", lpString2=".waifu") returned -1 [0111.549] lstrlenW (lpString="Microsoft.VC90.CRT.manifest") returned 27 [0111.549] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\microsoft.vc90.crt.manifest"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0111.877] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x354f8c4 | out: lpFileSize=0x354f8c4*=1857) returned 1 [0111.877] CloseHandle (hObject=0x200) returned 1 [0111.877] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\microsoft.vc90.crt.manifest")) returned 0x2020 [0111.877] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\microsoft.vc90.crt.manifest.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0111.877] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\microsoft.vc90.crt.manifest"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0111.877] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f870 | out: lpNewFilePointer=0x0) returned 1 [0111.877] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f870 | out: lpNewFilePointer=0x0) returned 1 [0111.877] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\microsoft.vc90.crt.manifest.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0111.877] GetLastError () returned 0x0 [0111.877] ReadFile (in: hFile=0x200, lpBuffer=0x4120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x354f87c, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesRead=0x354f87c*=0x741, lpOverlapped=0x0) returned 1 [0111.878] WriteFile (in: hFile=0x204, lpBuffer=0x4120020*, nNumberOfBytesToWrite=0x750, lpNumberOfBytesWritten=0x354f644, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesWritten=0x354f644*=0x750, lpOverlapped=0x0) returned 1 [0112.061] ReadFile (in: hFile=0x200, lpBuffer=0x4120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x354f87c, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesRead=0x354f87c*=0x0, lpOverlapped=0x0) returned 1 [0112.061] WriteFile (in: hFile=0x204, lpBuffer=0x4120020*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x354f644, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesWritten=0x354f644*=0x10a, lpOverlapped=0x0) returned 1 [0112.061] SetEndOfFile (hFile=0x204) returned 1 [0112.061] CloseHandle (hObject=0x204) returned 1 [0112.061] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f870 | out: lpNewFilePointer=0x0) returned 1 [0112.061] SetEndOfFile (hFile=0x200) returned 1 [0112.061] CloseHandle (hObject=0x200) returned 1 [0112.062] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x2020) returned 1 [0112.062] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\microsoft.vc90.crt.manifest")) returned 1 [0112.062] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90 [0112.062] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90 [0112.062] lstrlenW (lpString=".doc") returned 4 [0112.062] lstrcmpiW (lpString1=".doc", lpString2="fest") returned -1 [0112.062] lstrlenW (lpString=".docx") returned 5 [0112.062] lstrcmpiW (lpString1=".docx", lpString2="ifest") returned -1 [0112.062] lstrlenW (lpString=".pdf") returned 4 [0112.062] lstrcmpiW (lpString1=".pdf", lpString2="fest") returned -1 [0112.062] lstrlenW (lpString=".xls") returned 4 [0112.062] lstrcmpiW (lpString1=".xls", lpString2="fest") returned -1 [0112.062] lstrlenW (lpString=".xlsx") returned 5 [0112.062] lstrcmpiW (lpString1=".xlsx", lpString2="ifest") returned -1 [0112.062] lstrlenW (lpString=".ppt") returned 4 [0112.062] lstrcmpiW (lpString1=".ppt", lpString2="fest") returned -1 [0112.062] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90 [0112.062] lstrlenW (lpString=".zip") returned 4 [0112.062] lstrcmpiW (lpString1=".zip", lpString2="fest") returned -1 [0112.062] lstrlenW (lpString=".rar") returned 4 [0112.062] lstrcmpiW (lpString1=".rar", lpString2="fest") returned -1 [0112.062] lstrlenW (lpString=".bz2") returned 4 [0112.062] lstrcmpiW (lpString1=".bz2", lpString2="fest") returned -1 [0112.062] lstrlenW (lpString=".7z") returned 3 [0112.062] lstrcmpiW (lpString1=".7z", lpString2="est") returned -1 [0112.062] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90 [0112.062] lstrlenW (lpString=".dbf") returned 4 [0112.062] lstrcmpiW (lpString1=".dbf", lpString2="fest") returned -1 [0112.063] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90 [0112.063] lstrlenW (lpString=".1cd") returned 4 [0112.063] lstrcmpiW (lpString1=".1cd", lpString2="fest") returned -1 [0112.063] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90 [0112.063] lstrlenW (lpString=".jpg") returned 4 [0112.063] lstrcmpiW (lpString1=".jpg", lpString2="fest") returned -1 [0112.063] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90 [0112.063] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90 [0112.063] lstrlenW (lpString=".doc") returned 4 [0112.063] lstrcmpiW (lpString1=".doc", lpString2="fest") returned -1 [0112.063] lstrlenW (lpString=".docx") returned 5 [0112.063] lstrcmpiW (lpString1=".docx", lpString2="ifest") returned -1 [0112.063] lstrlenW (lpString=".pdf") returned 4 [0112.063] lstrcmpiW (lpString1=".pdf", lpString2="fest") returned -1 [0112.063] lstrlenW (lpString=".xls") returned 4 [0112.063] lstrcmpiW (lpString1=".xls", lpString2="fest") returned -1 [0112.063] lstrlenW (lpString=".xlsx") returned 5 [0112.063] lstrcmpiW (lpString1=".xlsx", lpString2="ifest") returned -1 [0112.063] lstrlenW (lpString=".ppt") returned 4 [0112.063] lstrcmpiW (lpString1=".ppt", lpString2="fest") returned -1 [0112.063] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90 [0112.063] lstrlenW (lpString=".zip") returned 4 [0112.063] lstrcmpiW (lpString1=".zip", lpString2="fest") returned -1 [0112.063] lstrlenW (lpString=".rar") returned 4 [0112.063] lstrcmpiW (lpString1=".rar", lpString2="fest") returned -1 [0112.063] lstrlenW (lpString=".bz2") returned 4 [0112.063] lstrcmpiW (lpString1=".bz2", lpString2="fest") returned -1 [0112.063] lstrlenW (lpString=".7z") returned 3 [0112.063] lstrcmpiW (lpString1=".7z", lpString2="est") returned -1 [0112.063] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90 [0112.063] lstrlenW (lpString=".dbf") returned 4 [0112.063] lstrcmpiW (lpString1=".dbf", lpString2="fest") returned -1 [0112.063] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90 [0112.063] lstrlenW (lpString=".1cd") returned 4 [0112.063] lstrcmpiW (lpString1=".1cd", lpString2="fest") returned -1 [0112.063] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90 [0112.063] lstrlenW (lpString=".jpg") returned 4 [0112.063] lstrcmpiW (lpString1=".jpg", lpString2="fest") returned -1 [0112.063] lstrcmpiW (lpString1=".msi", lpString2=".waifu") returned -1 [0112.063] lstrlenW (lpString="OfficeMUI.msi") returned 13 [0112.063] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0112.064] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x354f8c4 | out: lpFileSize=0x354f8c4*=3702272) returned 1 [0112.064] CloseHandle (hObject=0x200) returned 1 [0112.064] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.msi")) returned 0x2020 [0112.064] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.msi.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0112.064] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.msi.id-9c354b42.[darknes@420blaze.it].waifu")) returned 1 [0112.064] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.msi.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0112.065] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f614 | out: lpNewFilePointer=0x0) returned 1 [0112.065] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f5d4 | out: lpNewFilePointer=0x0) returned 1 [0112.065] ReadFile (in: hFile=0x200, lpBuffer=0x4120058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x354f5e0, lpOverlapped=0x0 | out: lpBuffer=0x4120058*, lpNumberOfBytesRead=0x354f5e0*=0x40000, lpOverlapped=0x0) returned 1 [0112.068] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x12d4aa, lpNewFilePointer=0x0, dwMoveMethod=0x354f5d4 | out: lpNewFilePointer=0x0) returned 1 [0112.068] ReadFile (in: hFile=0x200, lpBuffer=0x4160058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x354f5e0, lpOverlapped=0x0 | out: lpBuffer=0x4160058*, lpNumberOfBytesRead=0x354f5e0*=0x40000, lpOverlapped=0x0) returned 1 [0112.072] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x354f614 | out: lpNewFilePointer=0xffffffff) returned 1 [0112.072] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x347e00, lpNewFilePointer=0x0, dwMoveMethod=0x354f5d4 | out: lpNewFilePointer=0x0) returned 1 [0112.072] ReadFile (in: hFile=0x200, lpBuffer=0x41a0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x354f5e0, lpOverlapped=0x0 | out: lpBuffer=0x41a0058*, lpNumberOfBytesRead=0x354f5e0*=0x40000, lpOverlapped=0x0) returned 1 [0112.085] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f870 | out: lpNewFilePointer=0x0) returned 1 [0112.085] WriteFile (in: hFile=0x200, lpBuffer=0x4120020*, nNumberOfBytesToWrite=0xc0106, lpNumberOfBytesWritten=0x354f658, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesWritten=0x354f658*=0xc0106, lpOverlapped=0x0) returned 1 [0112.093] SetEndOfFile (hFile=0x200) returned 1 [0112.095] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f624 | out: lpNewFilePointer=0x0) returned 1 [0112.095] WriteFile (in: hFile=0x200, lpBuffer=0x44b2070*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x354f630, lpOverlapped=0x0 | out: lpBuffer=0x44b2070*, lpNumberOfBytesWritten=0x354f630*=0x40000, lpOverlapped=0x0) returned 1 [0112.096] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x12d4aa, lpNewFilePointer=0x0, dwMoveMethod=0x354f624 | out: lpNewFilePointer=0x0) returned 1 [0112.096] WriteFile (in: hFile=0x200, lpBuffer=0x44b2070*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x354f630, lpOverlapped=0x0 | out: lpBuffer=0x44b2070*, lpNumberOfBytesWritten=0x354f630*=0x40000, lpOverlapped=0x0) returned 1 [0112.098] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x347e00, lpNewFilePointer=0x0, dwMoveMethod=0x354f624 | out: lpNewFilePointer=0x0) returned 1 [0112.098] WriteFile (in: hFile=0x200, lpBuffer=0x44b2070*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x354f630, lpOverlapped=0x0 | out: lpBuffer=0x44b2070*, lpNumberOfBytesWritten=0x354f630*=0x40000, lpOverlapped=0x0) returned 1 [0112.100] CloseHandle (hObject=0x200) returned 1 [0112.100] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x2020) returned 1 [0112.100] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76 [0112.101] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76 [0112.101] lstrlenW (lpString=".doc") returned 4 [0112.101] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0112.101] lstrlenW (lpString=".docx") returned 5 [0112.101] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0112.101] lstrlenW (lpString=".pdf") returned 4 [0112.101] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0112.101] lstrlenW (lpString=".xls") returned 4 [0112.101] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0112.101] lstrlenW (lpString=".xlsx") returned 5 [0112.101] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0112.101] lstrlenW (lpString=".ppt") returned 4 [0112.101] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0112.101] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76 [0112.101] lstrlenW (lpString=".zip") returned 4 [0112.101] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0112.101] lstrlenW (lpString=".rar") returned 4 [0112.101] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0112.101] lstrlenW (lpString=".bz2") returned 4 [0112.101] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0112.101] lstrlenW (lpString=".7z") returned 3 [0112.101] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0112.101] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76 [0112.101] lstrlenW (lpString=".dbf") returned 4 [0112.101] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0112.101] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76 [0112.101] lstrlenW (lpString=".1cd") returned 4 [0112.101] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0112.101] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76 [0112.101] lstrlenW (lpString=".jpg") returned 4 [0112.101] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0112.101] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76 [0112.101] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76 [0112.101] lstrlenW (lpString=".doc") returned 4 [0112.101] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0112.101] lstrlenW (lpString=".docx") returned 5 [0112.101] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0112.102] lstrlenW (lpString=".pdf") returned 4 [0112.102] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0112.102] lstrlenW (lpString=".xls") returned 4 [0112.102] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0112.102] lstrlenW (lpString=".xlsx") returned 5 [0112.102] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0112.102] lstrlenW (lpString=".ppt") returned 4 [0112.102] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0112.102] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76 [0112.102] lstrlenW (lpString=".zip") returned 4 [0112.102] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0112.102] lstrlenW (lpString=".rar") returned 4 [0112.102] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0112.102] lstrlenW (lpString=".bz2") returned 4 [0112.102] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0112.102] lstrlenW (lpString=".7z") returned 3 [0112.102] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0112.102] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76 [0112.102] lstrlenW (lpString=".dbf") returned 4 [0112.102] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0112.102] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76 [0112.102] lstrlenW (lpString=".1cd") returned 4 [0112.102] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0112.102] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76 [0112.102] lstrlenW (lpString=".jpg") returned 4 [0112.102] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0112.102] lstrcmpiW (lpString1=".msi", lpString2=".waifu") returned -1 [0112.102] lstrlenW (lpString="OfficeMUISet.msi") returned 16 [0112.102] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0112.103] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x354f8c4 | out: lpFileSize=0x354f8c4*=868864) returned 1 [0112.103] CloseHandle (hObject=0x200) returned 1 [0112.103] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.msi")) returned 0x2020 [0112.103] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.msi.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0112.103] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0112.103] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f870 | out: lpNewFilePointer=0x0) returned 1 [0112.103] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f870 | out: lpNewFilePointer=0x0) returned 1 [0112.103] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.msi.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0112.103] GetLastError () returned 0x0 [0112.104] ReadFile (in: hFile=0x200, lpBuffer=0x4120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x354f87c, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesRead=0x354f87c*=0xd4200, lpOverlapped=0x0) returned 1 [0112.264] WriteFile (in: hFile=0x204, lpBuffer=0x4120020*, nNumberOfBytesToWrite=0xd4210, lpNumberOfBytesWritten=0x354f644, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesWritten=0x354f644*=0xd4210, lpOverlapped=0x0) returned 1 [0112.272] ReadFile (in: hFile=0x200, lpBuffer=0x4120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x354f87c, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesRead=0x354f87c*=0x0, lpOverlapped=0x0) returned 1 [0112.272] WriteFile (in: hFile=0x204, lpBuffer=0x4120020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x354f644, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesWritten=0x354f644*=0xf4, lpOverlapped=0x0) returned 1 [0112.272] SetEndOfFile (hFile=0x204) returned 1 [0112.272] CloseHandle (hObject=0x204) returned 1 [0112.272] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f870 | out: lpNewFilePointer=0x0) returned 1 [0112.272] SetEndOfFile (hFile=0x200) returned 1 [0112.275] CloseHandle (hObject=0x200) returned 1 [0112.275] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x2020) returned 1 [0112.275] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.msi")) returned 1 [0112.275] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79 [0112.275] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79 [0112.275] lstrlenW (lpString=".doc") returned 4 [0112.275] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0112.275] lstrlenW (lpString=".docx") returned 5 [0112.275] lstrcmpiW (lpString1=".docx", lpString2="t.msi") returned -1 [0112.275] lstrlenW (lpString=".pdf") returned 4 [0112.275] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0112.275] lstrlenW (lpString=".xls") returned 4 [0112.275] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0112.275] lstrlenW (lpString=".xlsx") returned 5 [0112.275] lstrcmpiW (lpString1=".xlsx", lpString2="t.msi") returned -1 [0112.275] lstrlenW (lpString=".ppt") returned 4 [0112.275] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0112.275] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79 [0112.275] lstrlenW (lpString=".zip") returned 4 [0112.275] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0112.275] lstrlenW (lpString=".rar") returned 4 [0112.275] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0112.275] lstrlenW (lpString=".bz2") returned 4 [0112.275] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0112.275] lstrlenW (lpString=".7z") returned 3 [0112.275] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0112.275] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79 [0112.276] lstrlenW (lpString=".dbf") returned 4 [0112.276] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0112.276] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79 [0112.276] lstrlenW (lpString=".1cd") returned 4 [0112.276] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0112.276] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79 [0112.276] lstrlenW (lpString=".jpg") returned 4 [0112.276] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0112.276] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79 [0112.276] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79 [0112.276] lstrlenW (lpString=".doc") returned 4 [0112.276] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0112.276] lstrlenW (lpString=".docx") returned 5 [0112.276] lstrcmpiW (lpString1=".docx", lpString2="t.msi") returned -1 [0112.276] lstrlenW (lpString=".pdf") returned 4 [0112.276] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0112.276] lstrlenW (lpString=".xls") returned 4 [0112.276] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0112.276] lstrlenW (lpString=".xlsx") returned 5 [0112.276] lstrcmpiW (lpString1=".xlsx", lpString2="t.msi") returned -1 [0112.276] lstrlenW (lpString=".ppt") returned 4 [0112.276] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0112.276] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79 [0112.276] lstrlenW (lpString=".zip") returned 4 [0112.276] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0112.276] lstrlenW (lpString=".rar") returned 4 [0112.276] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0112.276] lstrlenW (lpString=".bz2") returned 4 [0112.276] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0112.276] lstrlenW (lpString=".7z") returned 3 [0112.276] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0112.276] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79 [0112.276] lstrlenW (lpString=".dbf") returned 4 [0112.276] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0112.276] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79 [0112.276] lstrlenW (lpString=".1cd") returned 4 [0112.276] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0112.276] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79 [0112.276] lstrlenW (lpString=".jpg") returned 4 [0112.276] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0112.276] lstrcmpiW (lpString1=".msi", lpString2=".waifu") returned -1 [0112.276] lstrlenW (lpString="Office32WW.msi") returned 14 [0112.277] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0112.277] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x354f8c4 | out: lpFileSize=0x354f8c4*=1992192) returned 1 [0112.277] CloseHandle (hObject=0x200) returned 1 [0112.277] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.msi")) returned 0x2020 [0112.277] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.msi.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0112.277] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.msi.id-9c354b42.[darknes@420blaze.it].waifu")) returned 1 [0112.278] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.msi.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0112.278] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f614 | out: lpNewFilePointer=0x0) returned 1 [0112.278] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f5d4 | out: lpNewFilePointer=0x0) returned 1 [0112.278] ReadFile (in: hFile=0x200, lpBuffer=0x4120058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x354f5e0, lpOverlapped=0x0 | out: lpBuffer=0x4120058*, lpNumberOfBytesRead=0x354f5e0*=0x40000, lpOverlapped=0x0) returned 1 [0112.281] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0xa2200, lpNewFilePointer=0x0, dwMoveMethod=0x354f5d4 | out: lpNewFilePointer=0x0) returned 1 [0112.281] ReadFile (in: hFile=0x200, lpBuffer=0x4160058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x354f5e0, lpOverlapped=0x0 | out: lpBuffer=0x4160058*, lpNumberOfBytesRead=0x354f5e0*=0x40000, lpOverlapped=0x0) returned 1 [0112.290] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x354f614 | out: lpNewFilePointer=0xffffffff) returned 1 [0112.290] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x1a6600, lpNewFilePointer=0x0, dwMoveMethod=0x354f5d4 | out: lpNewFilePointer=0x0) returned 1 [0112.291] ReadFile (in: hFile=0x200, lpBuffer=0x41a0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x354f5e0, lpOverlapped=0x0 | out: lpBuffer=0x41a0058*, lpNumberOfBytesRead=0x354f5e0*=0x40000, lpOverlapped=0x0) returned 1 [0112.305] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f870 | out: lpNewFilePointer=0x0) returned 1 [0112.305] WriteFile (in: hFile=0x200, lpBuffer=0x4120020*, nNumberOfBytesToWrite=0xc0108, lpNumberOfBytesWritten=0x354f658, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesWritten=0x354f658*=0xc0108, lpOverlapped=0x0) returned 1 [0112.461] SetEndOfFile (hFile=0x200) returned 1 [0112.463] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f624 | out: lpNewFilePointer=0x0) returned 1 [0112.463] WriteFile (in: hFile=0x200, lpBuffer=0x45a40e0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x354f630, lpOverlapped=0x0 | out: lpBuffer=0x45a40e0*, lpNumberOfBytesWritten=0x354f630*=0x40000, lpOverlapped=0x0) returned 1 [0112.464] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0xa2200, lpNewFilePointer=0x0, dwMoveMethod=0x354f624 | out: lpNewFilePointer=0x0) returned 1 [0112.464] WriteFile (in: hFile=0x200, lpBuffer=0x45a40e0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x354f630, lpOverlapped=0x0 | out: lpBuffer=0x45a40e0*, lpNumberOfBytesWritten=0x354f630*=0x40000, lpOverlapped=0x0) returned 1 [0112.465] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x1a6600, lpNewFilePointer=0x0, dwMoveMethod=0x354f624 | out: lpNewFilePointer=0x0) returned 1 [0112.465] WriteFile (in: hFile=0x200, lpBuffer=0x45a40e0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x354f630, lpOverlapped=0x0 | out: lpBuffer=0x45a40e0*, lpNumberOfBytesWritten=0x354f630*=0x40000, lpOverlapped=0x0) returned 1 [0112.467] CloseHandle (hObject=0x200) returned 1 [0112.467] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x2020) returned 1 [0112.467] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0112.467] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0112.467] lstrlenW (lpString=".doc") returned 4 [0112.467] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0112.467] lstrlenW (lpString=".docx") returned 5 [0112.467] lstrcmpiW (lpString1=".docx", lpString2="W.msi") returned -1 [0112.467] lstrlenW (lpString=".pdf") returned 4 [0112.467] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0112.467] lstrlenW (lpString=".xls") returned 4 [0112.467] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0112.467] lstrlenW (lpString=".xlsx") returned 5 [0112.467] lstrcmpiW (lpString1=".xlsx", lpString2="W.msi") returned -1 [0112.467] lstrlenW (lpString=".ppt") returned 4 [0112.467] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0112.467] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0112.467] lstrlenW (lpString=".zip") returned 4 [0112.467] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0112.467] lstrlenW (lpString=".rar") returned 4 [0112.467] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0112.467] lstrlenW (lpString=".bz2") returned 4 [0112.467] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0112.467] lstrlenW (lpString=".7z") returned 3 [0112.467] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0112.468] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0112.468] lstrlenW (lpString=".dbf") returned 4 [0112.468] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0112.468] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0112.468] lstrlenW (lpString=".1cd") returned 4 [0112.468] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0112.468] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0112.468] lstrlenW (lpString=".jpg") returned 4 [0112.468] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0112.468] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0112.468] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0112.468] lstrlenW (lpString=".doc") returned 4 [0112.468] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0112.468] lstrlenW (lpString=".docx") returned 5 [0112.468] lstrcmpiW (lpString1=".docx", lpString2="W.msi") returned -1 [0112.468] lstrlenW (lpString=".pdf") returned 4 [0112.468] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0112.468] lstrlenW (lpString=".xls") returned 4 [0112.468] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0112.468] lstrlenW (lpString=".xlsx") returned 5 [0112.468] lstrcmpiW (lpString1=".xlsx", lpString2="W.msi") returned -1 [0112.468] lstrlenW (lpString=".ppt") returned 4 [0112.468] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0112.468] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0112.468] lstrlenW (lpString=".zip") returned 4 [0112.468] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0112.468] lstrlenW (lpString=".rar") returned 4 [0112.468] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0112.468] lstrlenW (lpString=".bz2") returned 4 [0112.468] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0112.468] lstrlenW (lpString=".7z") returned 3 [0112.468] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0112.468] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0112.468] lstrlenW (lpString=".dbf") returned 4 [0112.468] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0112.468] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0112.468] lstrlenW (lpString=".1cd") returned 4 [0112.468] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0112.468] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0112.468] lstrlenW (lpString=".jpg") returned 4 [0112.468] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0112.468] lstrcmpiW (lpString1=".xrm-ms", lpString2=".waifu") returned 1 [0112.468] lstrlenW (lpString="pkeyconfig-office.xrm-ms") returned 24 [0112.468] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0112.469] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x354f8c4 | out: lpFileSize=0x354f8c4*=715834) returned 1 [0112.469] CloseHandle (hObject=0x200) returned 1 [0112.469] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms")) returned 0x2020 [0112.469] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0112.469] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0112.469] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f870 | out: lpNewFilePointer=0x0) returned 1 [0112.469] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f870 | out: lpNewFilePointer=0x0) returned 1 [0112.469] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0112.469] GetLastError () returned 0x0 [0112.469] ReadFile (in: hFile=0x200, lpBuffer=0x4120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x354f87c, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesRead=0x354f87c*=0xaec3a, lpOverlapped=0x0) returned 1 [0112.573] WriteFile (in: hFile=0x1fc, lpBuffer=0x4120020*, nNumberOfBytesToWrite=0xaec40, lpNumberOfBytesWritten=0x354f644, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesWritten=0x354f644*=0xaec40, lpOverlapped=0x0) returned 1 [0112.579] ReadFile (in: hFile=0x200, lpBuffer=0x4120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x354f87c, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesRead=0x354f87c*=0x0, lpOverlapped=0x0) returned 1 [0112.579] WriteFile (in: hFile=0x1fc, lpBuffer=0x4120020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x354f644, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesWritten=0x354f644*=0x104, lpOverlapped=0x0) returned 1 [0112.579] SetEndOfFile (hFile=0x1fc) returned 1 [0112.579] CloseHandle (hObject=0x1fc) returned 1 [0112.579] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f870 | out: lpNewFilePointer=0x0) returned 1 [0112.579] SetEndOfFile (hFile=0x200) returned 1 [0112.581] CloseHandle (hObject=0x200) returned 1 [0112.581] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x2020) returned 1 [0112.581] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms")) returned 1 [0112.581] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0112.581] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0112.581] lstrlenW (lpString=".doc") returned 4 [0112.581] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0112.581] lstrlenW (lpString=".docx") returned 5 [0112.581] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0112.581] lstrlenW (lpString=".pdf") returned 4 [0112.581] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0112.581] lstrlenW (lpString=".xls") returned 4 [0112.581] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0112.581] lstrlenW (lpString=".xlsx") returned 5 [0112.582] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0112.582] lstrlenW (lpString=".ppt") returned 4 [0112.582] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0112.582] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0112.582] lstrlenW (lpString=".zip") returned 4 [0112.582] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0112.582] lstrlenW (lpString=".rar") returned 4 [0112.582] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0112.582] lstrlenW (lpString=".bz2") returned 4 [0112.582] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0112.582] lstrlenW (lpString=".7z") returned 3 [0112.582] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0112.582] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0112.582] lstrlenW (lpString=".dbf") returned 4 [0112.582] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0112.582] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0112.582] lstrlenW (lpString=".1cd") returned 4 [0112.582] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0112.582] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0112.582] lstrlenW (lpString=".jpg") returned 4 [0112.582] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0112.582] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0112.582] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0112.582] lstrlenW (lpString=".doc") returned 4 [0112.582] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0112.582] lstrlenW (lpString=".docx") returned 5 [0112.582] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0112.582] lstrlenW (lpString=".pdf") returned 4 [0112.582] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0112.582] lstrlenW (lpString=".xls") returned 4 [0112.582] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0112.582] lstrlenW (lpString=".xlsx") returned 5 [0112.582] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0112.582] lstrlenW (lpString=".ppt") returned 4 [0112.582] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0112.582] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0112.582] lstrlenW (lpString=".zip") returned 4 [0112.583] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0112.583] lstrlenW (lpString=".rar") returned 4 [0112.583] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0112.583] lstrlenW (lpString=".bz2") returned 4 [0112.583] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0112.583] lstrlenW (lpString=".7z") returned 3 [0112.583] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0112.583] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0112.583] lstrlenW (lpString=".dbf") returned 4 [0112.583] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0112.583] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0112.583] lstrlenW (lpString=".1cd") returned 4 [0112.583] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0112.583] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0112.583] lstrlenW (lpString=".jpg") returned 4 [0112.583] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0112.583] lstrcmpiW (lpString1=".cab", lpString2=".waifu") returned -1 [0112.583] lstrlenW (lpString="ProPrWW.cab") returned 11 [0112.583] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0112.900] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x354f8c4 | out: lpFileSize=0x354f8c4*=177720283) returned 1 [0112.900] CloseHandle (hObject=0x1c0) returned 1 [0112.901] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww.cab")) returned 0x2020 [0112.901] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww.cab.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0112.901] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww.cab.id-9c354b42.[darknes@420blaze.it].waifu")) returned 1 [0112.901] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww.cab.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0112.901] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f614 | out: lpNewFilePointer=0x0) returned 1 [0112.902] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f5d4 | out: lpNewFilePointer=0x0) returned 1 [0112.902] ReadFile (in: hFile=0x1c0, lpBuffer=0x4120058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x354f5e0, lpOverlapped=0x0 | out: lpBuffer=0x4120058*, lpNumberOfBytesRead=0x354f5e0*=0x40000, lpOverlapped=0x0) returned 1 [0112.923] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x387ee9e, lpNewFilePointer=0x0, dwMoveMethod=0x354f5d4 | out: lpNewFilePointer=0x0) returned 1 [0112.923] ReadFile (in: hFile=0x1c0, lpBuffer=0x4160058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x354f5e0, lpOverlapped=0x0 | out: lpBuffer=0x4160058*, lpNumberOfBytesRead=0x354f5e0*=0x40000, lpOverlapped=0x0) returned 1 [0112.995] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x354f614 | out: lpNewFilePointer=0xffffffff) returned 1 [0112.995] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0xa93cbdb, lpNewFilePointer=0x0, dwMoveMethod=0x354f5d4 | out: lpNewFilePointer=0x0) returned 1 [0112.995] ReadFile (in: hFile=0x1c0, lpBuffer=0x41a0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x354f5e0, lpOverlapped=0x0 | out: lpBuffer=0x41a0058*, lpNumberOfBytesRead=0x354f5e0*=0x40000, lpOverlapped=0x0) returned 1 [0113.014] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f870 | out: lpNewFilePointer=0x0) returned 1 [0113.014] WriteFile (in: hFile=0x1c0, lpBuffer=0x4120020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x354f658, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesWritten=0x354f658*=0xc0102, lpOverlapped=0x0) returned 1 [0113.022] SetEndOfFile (hFile=0x1c0) returned 1 [0113.022] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f624 | out: lpNewFilePointer=0x0) returned 1 [0113.022] WriteFile (in: hFile=0x1c0, lpBuffer=0x45840d0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x354f630, lpOverlapped=0x0 | out: lpBuffer=0x45840d0*, lpNumberOfBytesWritten=0x354f630*=0x40000, lpOverlapped=0x0) returned 1 [0113.023] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x387ee9e, lpNewFilePointer=0x0, dwMoveMethod=0x354f624 | out: lpNewFilePointer=0x0) returned 1 [0113.023] WriteFile (in: hFile=0x1c0, lpBuffer=0x45840d0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x354f630, lpOverlapped=0x0 | out: lpBuffer=0x45840d0*, lpNumberOfBytesWritten=0x354f630*=0x40000, lpOverlapped=0x0) returned 1 [0113.023] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0xa93cbdb, lpNewFilePointer=0x0, dwMoveMethod=0x354f624 | out: lpNewFilePointer=0x0) returned 1 [0113.023] WriteFile (in: hFile=0x1c0, lpBuffer=0x45840d0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x354f630, lpOverlapped=0x0 | out: lpBuffer=0x45840d0*, lpNumberOfBytesWritten=0x354f630*=0x40000, lpOverlapped=0x0) returned 1 [0113.808] CloseHandle (hObject=0x1c0) returned 1 [0113.808] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x2020) returned 1 [0113.808] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74 [0113.808] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74 [0113.808] lstrlenW (lpString=".doc") returned 4 [0113.808] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0113.808] lstrlenW (lpString=".docx") returned 5 [0113.808] lstrcmpiW (lpString1=".docx", lpString2="W.cab") returned -1 [0113.808] lstrlenW (lpString=".pdf") returned 4 [0113.808] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0113.808] lstrlenW (lpString=".xls") returned 4 [0113.808] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0113.808] lstrlenW (lpString=".xlsx") returned 5 [0113.808] lstrcmpiW (lpString1=".xlsx", lpString2="W.cab") returned -1 [0113.808] lstrlenW (lpString=".ppt") returned 4 [0113.808] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0113.808] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74 [0113.809] lstrlenW (lpString=".zip") returned 4 [0113.809] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0113.809] lstrlenW (lpString=".rar") returned 4 [0113.809] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0113.809] lstrlenW (lpString=".bz2") returned 4 [0113.809] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0113.809] lstrlenW (lpString=".7z") returned 3 [0113.809] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0113.809] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74 [0113.809] lstrlenW (lpString=".dbf") returned 4 [0113.809] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0113.809] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74 [0113.809] lstrlenW (lpString=".1cd") returned 4 [0113.809] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0113.809] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74 [0113.809] lstrlenW (lpString=".jpg") returned 4 [0113.809] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0113.809] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74 [0113.809] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74 [0113.809] lstrlenW (lpString=".doc") returned 4 [0113.809] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0113.809] lstrlenW (lpString=".docx") returned 5 [0113.809] lstrcmpiW (lpString1=".docx", lpString2="W.cab") returned -1 [0113.809] lstrlenW (lpString=".pdf") returned 4 [0113.809] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0113.809] lstrlenW (lpString=".xls") returned 4 [0113.809] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0113.809] lstrlenW (lpString=".xlsx") returned 5 [0113.809] lstrcmpiW (lpString1=".xlsx", lpString2="W.cab") returned -1 [0113.809] lstrlenW (lpString=".ppt") returned 4 [0113.809] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0113.809] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74 [0113.809] lstrlenW (lpString=".zip") returned 4 [0113.809] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0113.809] lstrlenW (lpString=".rar") returned 4 [0113.809] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0113.810] lstrlenW (lpString=".bz2") returned 4 [0113.810] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0113.810] lstrlenW (lpString=".7z") returned 3 [0113.810] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0113.810] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74 [0113.810] lstrlenW (lpString=".dbf") returned 4 [0113.810] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0113.810] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74 [0113.810] lstrlenW (lpString=".1cd") returned 4 [0113.810] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0113.810] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74 [0113.810] lstrlenW (lpString=".jpg") returned 4 [0113.810] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0113.810] lstrcmpiW (lpString1=".exe", lpString2=".waifu") returned -1 [0113.810] lstrlenW (lpString="ose.exe") returned 7 [0113.810] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\ose.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0114.087] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x354f8c4 | out: lpFileSize=0x354f8c4*=174440) returned 1 [0114.087] CloseHandle (hObject=0x1d8) returned 1 [0114.087] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\ose.exe")) returned 0x2020 [0114.087] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\ose.exe.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0114.087] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\ose.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0114.087] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f870 | out: lpNewFilePointer=0x0) returned 1 [0114.087] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f870 | out: lpNewFilePointer=0x0) returned 1 [0114.087] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\ose.exe.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0114.088] GetLastError () returned 0x0 [0114.088] ReadFile (in: hFile=0x1d8, lpBuffer=0x4120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x354f87c, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesRead=0x354f87c*=0x2a968, lpOverlapped=0x0) returned 1 [0114.108] WriteFile (in: hFile=0x1ec, lpBuffer=0x4120020*, nNumberOfBytesToWrite=0x2a970, lpNumberOfBytesWritten=0x354f644, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesWritten=0x354f644*=0x2a970, lpOverlapped=0x0) returned 1 [0114.110] ReadFile (in: hFile=0x1d8, lpBuffer=0x4120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x354f87c, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesRead=0x354f87c*=0x0, lpOverlapped=0x0) returned 1 [0114.110] WriteFile (in: hFile=0x1ec, lpBuffer=0x4120020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x354f644, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesWritten=0x354f644*=0xe2, lpOverlapped=0x0) returned 1 [0114.110] SetEndOfFile (hFile=0x1ec) returned 1 [0114.110] CloseHandle (hObject=0x1ec) returned 1 [0114.110] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f870 | out: lpNewFilePointer=0x0) returned 1 [0114.110] SetEndOfFile (hFile=0x1d8) returned 1 [0114.111] CloseHandle (hObject=0x1d8) returned 1 [0114.111] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x2020) returned 1 [0114.111] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\ose.exe")) returned 1 [0114.283] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0114.283] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0114.283] lstrlenW (lpString=".doc") returned 4 [0114.283] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0114.283] lstrlenW (lpString=".docx") returned 5 [0114.284] lstrcmpiW (lpString1=".docx", lpString2="e.exe") returned -1 [0114.284] lstrlenW (lpString=".pdf") returned 4 [0114.284] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0114.284] lstrlenW (lpString=".xls") returned 4 [0114.284] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0114.284] lstrlenW (lpString=".xlsx") returned 5 [0114.284] lstrcmpiW (lpString1=".xlsx", lpString2="e.exe") returned -1 [0114.284] lstrlenW (lpString=".ppt") returned 4 [0114.284] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0114.284] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0114.284] lstrlenW (lpString=".zip") returned 4 [0114.284] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0114.284] lstrlenW (lpString=".rar") returned 4 [0114.284] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0114.284] lstrlenW (lpString=".bz2") returned 4 [0114.284] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0114.284] lstrlenW (lpString=".7z") returned 3 [0114.284] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0114.284] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0114.284] lstrlenW (lpString=".dbf") returned 4 [0114.284] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0114.284] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0114.284] lstrlenW (lpString=".1cd") returned 4 [0114.284] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0114.284] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0114.284] lstrlenW (lpString=".jpg") returned 4 [0114.284] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0114.284] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0114.284] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0114.284] lstrlenW (lpString=".doc") returned 4 [0114.284] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0114.284] lstrlenW (lpString=".docx") returned 5 [0114.284] lstrcmpiW (lpString1=".docx", lpString2="e.exe") returned -1 [0114.284] lstrlenW (lpString=".pdf") returned 4 [0114.284] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0114.284] lstrlenW (lpString=".xls") returned 4 [0114.284] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0114.284] lstrlenW (lpString=".xlsx") returned 5 [0114.284] lstrcmpiW (lpString1=".xlsx", lpString2="e.exe") returned -1 [0114.284] lstrlenW (lpString=".ppt") returned 4 [0114.284] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0114.284] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0114.284] lstrlenW (lpString=".zip") returned 4 [0114.284] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0114.284] lstrlenW (lpString=".rar") returned 4 [0114.284] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0114.284] lstrlenW (lpString=".bz2") returned 4 [0114.284] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0114.284] lstrlenW (lpString=".7z") returned 3 [0114.284] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0114.284] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0114.285] lstrlenW (lpString=".dbf") returned 4 [0114.285] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0114.285] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0114.285] lstrlenW (lpString=".1cd") returned 4 [0114.285] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0114.285] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0114.285] lstrlenW (lpString=".jpg") returned 4 [0114.285] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0114.285] lstrcmpiW (lpString1=".cab", lpString2=".waifu") returned -1 [0114.285] lstrlenW (lpString="OWOW32WW.cab") returned 12 [0114.285] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\owow32ww.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0114.648] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x354f8c4 | out: lpFileSize=0x354f8c4*=36233052) returned 1 [0114.648] CloseHandle (hObject=0x1d8) returned 1 [0114.648] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\owow32ww.cab")) returned 0x2020 [0114.648] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\owow32ww.cab.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0114.649] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\owow32ww.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\owow32ww.cab.id-9c354b42.[darknes@420blaze.it].waifu")) returned 1 [0114.835] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\owow32ww.cab.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0114.835] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f614 | out: lpNewFilePointer=0x0) returned 1 [0114.835] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f5d4 | out: lpNewFilePointer=0x0) returned 1 [0114.835] ReadFile (in: hFile=0x1e4, lpBuffer=0x4120058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x354f5e0, lpOverlapped=0x0 | out: lpBuffer=0x4120058*, lpNumberOfBytesRead=0x354f5e0*=0x40000, lpOverlapped=0x0) returned 1 [0114.839] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0xb84a74, lpNewFilePointer=0x0, dwMoveMethod=0x354f5d4 | out: lpNewFilePointer=0x0) returned 1 [0114.839] ReadFile (in: hFile=0x1e4, lpBuffer=0x4160058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x354f5e0, lpOverlapped=0x0 | out: lpBuffer=0x4160058*, lpNumberOfBytesRead=0x354f5e0*=0x40000, lpOverlapped=0x0) returned 1 [0114.841] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x354f614 | out: lpNewFilePointer=0xffffffff) returned 1 [0114.841] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x224df5c, lpNewFilePointer=0x0, dwMoveMethod=0x354f5d4 | out: lpNewFilePointer=0x0) returned 1 [0114.842] ReadFile (in: hFile=0x1e4, lpBuffer=0x41a0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x354f5e0, lpOverlapped=0x0 | out: lpBuffer=0x41a0058*, lpNumberOfBytesRead=0x354f5e0*=0x40000, lpOverlapped=0x0) returned 1 [0114.857] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f870 | out: lpNewFilePointer=0x0) returned 1 [0114.857] WriteFile (in: hFile=0x1e4, lpBuffer=0x4120020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x354f658, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesWritten=0x354f658*=0xc0104, lpOverlapped=0x0) returned 1 [0114.865] SetEndOfFile (hFile=0x1e4) returned 1 [0114.865] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f624 | out: lpNewFilePointer=0x0) returned 1 [0114.865] WriteFile (in: hFile=0x1e4, lpBuffer=0x45840d0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x354f630, lpOverlapped=0x0 | out: lpBuffer=0x45840d0*, lpNumberOfBytesWritten=0x354f630*=0x40000, lpOverlapped=0x0) returned 1 [0114.866] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0xb84a74, lpNewFilePointer=0x0, dwMoveMethod=0x354f624 | out: lpNewFilePointer=0x0) returned 1 [0114.866] WriteFile (in: hFile=0x1e4, lpBuffer=0x45840d0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x354f630, lpOverlapped=0x0 | out: lpBuffer=0x45840d0*, lpNumberOfBytesWritten=0x354f630*=0x40000, lpOverlapped=0x0) returned 1 [0114.866] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x224df5c, lpNewFilePointer=0x0, dwMoveMethod=0x354f624 | out: lpNewFilePointer=0x0) returned 1 [0114.866] WriteFile (in: hFile=0x1e4, lpBuffer=0x45840d0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x354f630, lpOverlapped=0x0 | out: lpBuffer=0x45840d0*, lpNumberOfBytesWritten=0x354f630*=0x40000, lpOverlapped=0x0) returned 1 [0114.868] CloseHandle (hObject=0x1e4) returned 1 [0114.868] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x2020) returned 1 [0114.868] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0114.868] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0114.868] lstrlenW (lpString=".doc") returned 4 [0114.868] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0114.868] lstrlenW (lpString=".docx") returned 5 [0114.868] lstrcmpiW (lpString1=".docx", lpString2="W.cab") returned -1 [0114.868] lstrlenW (lpString=".pdf") returned 4 [0114.868] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0114.868] lstrlenW (lpString=".xls") returned 4 [0114.868] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0114.868] lstrlenW (lpString=".xlsx") returned 5 [0114.868] lstrcmpiW (lpString1=".xlsx", lpString2="W.cab") returned -1 [0114.868] lstrlenW (lpString=".ppt") returned 4 [0114.868] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0114.868] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0114.869] lstrlenW (lpString=".zip") returned 4 [0114.869] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0114.869] lstrlenW (lpString=".rar") returned 4 [0114.869] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0114.869] lstrlenW (lpString=".bz2") returned 4 [0114.869] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0114.869] lstrlenW (lpString=".7z") returned 3 [0114.869] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0114.869] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0114.869] lstrlenW (lpString=".dbf") returned 4 [0114.869] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0114.869] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0114.869] lstrlenW (lpString=".1cd") returned 4 [0114.869] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0114.869] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0114.869] lstrlenW (lpString=".jpg") returned 4 [0114.869] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0114.869] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0114.869] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0114.869] lstrlenW (lpString=".doc") returned 4 [0114.869] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0114.869] lstrlenW (lpString=".docx") returned 5 [0114.869] lstrcmpiW (lpString1=".docx", lpString2="W.cab") returned -1 [0114.869] lstrlenW (lpString=".pdf") returned 4 [0114.869] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0114.869] lstrlenW (lpString=".xls") returned 4 [0114.869] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0114.869] lstrlenW (lpString=".xlsx") returned 5 [0114.869] lstrcmpiW (lpString1=".xlsx", lpString2="W.cab") returned -1 [0114.869] lstrlenW (lpString=".ppt") returned 4 [0114.869] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0114.869] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0114.869] lstrlenW (lpString=".zip") returned 4 [0114.869] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0114.869] lstrlenW (lpString=".rar") returned 4 [0114.869] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0114.869] lstrlenW (lpString=".bz2") returned 4 [0114.869] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0114.869] lstrlenW (lpString=".7z") returned 3 [0114.869] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0114.869] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0114.869] lstrlenW (lpString=".dbf") returned 4 [0114.869] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0114.869] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0114.869] lstrlenW (lpString=".1cd") returned 4 [0114.869] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0114.869] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0114.869] lstrlenW (lpString=".jpg") returned 4 [0114.869] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0114.870] lstrcmpiW (lpString1=".sys", lpString2=".waifu") returned -1 [0114.870] lstrlenW (lpString="pagefile.sys") returned 12 [0114.870] CreateFileW (lpFileName="C:\\pagefile.sys" (normalized: "c:\\pagefile.sys"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0114.870] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0114.870] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0114.870] lstrlenW (lpString=".doc") returned 4 [0114.870] lstrcmpiW (lpString1=".doc", lpString2=".sys") returned -1 [0114.870] lstrlenW (lpString=".docx") returned 5 [0114.870] lstrcmpiW (lpString1=".docx", lpString2="e.sys") returned -1 [0114.870] lstrlenW (lpString=".pdf") returned 4 [0114.870] lstrcmpiW (lpString1=".pdf", lpString2=".sys") returned -1 [0114.870] lstrlenW (lpString=".xls") returned 4 [0114.870] lstrcmpiW (lpString1=".xls", lpString2=".sys") returned 1 [0114.870] lstrlenW (lpString=".xlsx") returned 5 [0114.870] lstrcmpiW (lpString1=".xlsx", lpString2="e.sys") returned -1 [0114.870] lstrlenW (lpString=".ppt") returned 4 [0114.870] lstrcmpiW (lpString1=".ppt", lpString2=".sys") returned -1 [0114.870] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0114.870] lstrlenW (lpString=".zip") returned 4 [0114.870] lstrcmpiW (lpString1=".zip", lpString2=".sys") returned 1 [0114.870] lstrlenW (lpString=".rar") returned 4 [0114.870] lstrcmpiW (lpString1=".rar", lpString2=".sys") returned -1 [0114.870] lstrlenW (lpString=".bz2") returned 4 [0114.870] lstrcmpiW (lpString1=".bz2", lpString2=".sys") returned -1 [0114.870] lstrlenW (lpString=".7z") returned 3 [0114.870] lstrcmpiW (lpString1=".7z", lpString2="sys") returned -1 [0114.870] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0114.870] lstrlenW (lpString=".dbf") returned 4 [0114.870] lstrcmpiW (lpString1=".dbf", lpString2=".sys") returned -1 [0114.870] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0114.870] lstrlenW (lpString=".1cd") returned 4 [0114.870] lstrcmpiW (lpString1=".1cd", lpString2=".sys") returned -1 [0114.870] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0114.870] lstrlenW (lpString=".jpg") returned 4 [0114.870] lstrcmpiW (lpString1=".jpg", lpString2=".sys") returned -1 [0114.870] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0114.870] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0114.870] lstrlenW (lpString=".doc") returned 4 [0114.870] lstrcmpiW (lpString1=".doc", lpString2=".sys") returned -1 [0114.870] lstrlenW (lpString=".docx") returned 5 [0114.870] lstrcmpiW (lpString1=".docx", lpString2="e.sys") returned -1 [0114.870] lstrlenW (lpString=".pdf") returned 4 [0114.870] lstrcmpiW (lpString1=".pdf", lpString2=".sys") returned -1 [0114.870] lstrlenW (lpString=".xls") returned 4 [0114.870] lstrcmpiW (lpString1=".xls", lpString2=".sys") returned 1 [0114.871] lstrlenW (lpString=".xlsx") returned 5 [0114.871] lstrcmpiW (lpString1=".xlsx", lpString2="e.sys") returned -1 [0114.871] lstrlenW (lpString=".ppt") returned 4 [0114.871] lstrcmpiW (lpString1=".ppt", lpString2=".sys") returned -1 [0114.871] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0114.871] lstrlenW (lpString=".zip") returned 4 [0114.871] lstrcmpiW (lpString1=".zip", lpString2=".sys") returned 1 [0114.871] lstrlenW (lpString=".rar") returned 4 [0114.871] lstrcmpiW (lpString1=".rar", lpString2=".sys") returned -1 [0114.871] lstrlenW (lpString=".bz2") returned 4 [0114.871] lstrcmpiW (lpString1=".bz2", lpString2=".sys") returned -1 [0114.871] lstrlenW (lpString=".7z") returned 3 [0114.871] lstrcmpiW (lpString1=".7z", lpString2="sys") returned -1 [0114.871] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0114.871] lstrlenW (lpString=".dbf") returned 4 [0114.871] lstrcmpiW (lpString1=".dbf", lpString2=".sys") returned -1 [0114.871] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0114.871] lstrlenW (lpString=".1cd") returned 4 [0114.871] lstrcmpiW (lpString1=".1cd", lpString2=".sys") returned -1 [0114.871] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0114.871] lstrlenW (lpString=".jpg") returned 4 [0114.871] lstrcmpiW (lpString1=".jpg", lpString2=".sys") returned -1 [0114.871] lstrcmpiW (lpString1=".DLL", lpString2=".waifu") returned -1 [0114.871] lstrlenW (lpString="MSADDNDR.DLL") returned 12 [0114.871] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL" (normalized: "c:\\program files\\common files\\designer\\msaddndr.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0115.009] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x354f8c4 | out: lpFileSize=0x354f8c4*=99136) returned 1 [0115.009] CloseHandle (hObject=0x180) returned 1 [0115.009] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL" (normalized: "c:\\program files\\common files\\designer\\msaddndr.dll")) returned 0x20 [0115.010] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\designer\\msaddndr.dll.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0115.010] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL" (normalized: "c:\\program files\\common files\\designer\\msaddndr.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0115.010] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f870 | out: lpNewFilePointer=0x0) returned 1 [0115.010] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f870 | out: lpNewFilePointer=0x0) returned 1 [0115.010] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\designer\\msaddndr.dll.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0115.010] GetLastError () returned 0x0 [0115.010] ReadFile (in: hFile=0x180, lpBuffer=0x4120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x354f87c, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesRead=0x354f87c*=0x18340, lpOverlapped=0x0) returned 1 [0115.012] WriteFile (in: hFile=0x164, lpBuffer=0x4120020*, nNumberOfBytesToWrite=0x18350, lpNumberOfBytesWritten=0x354f644, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesWritten=0x354f644*=0x18350, lpOverlapped=0x0) returned 1 [0115.016] ReadFile (in: hFile=0x180, lpBuffer=0x4120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x354f87c, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesRead=0x354f87c*=0x0, lpOverlapped=0x0) returned 1 [0115.016] WriteFile (in: hFile=0x164, lpBuffer=0x4120020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x354f644, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesWritten=0x354f644*=0xec, lpOverlapped=0x0) returned 1 [0115.016] SetEndOfFile (hFile=0x164) returned 1 [0115.016] CloseHandle (hObject=0x164) returned 1 [0115.016] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f870 | out: lpNewFilePointer=0x0) returned 1 [0115.016] SetEndOfFile (hFile=0x180) returned 1 [0115.017] CloseHandle (hObject=0x180) returned 1 [0115.017] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0115.017] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL" (normalized: "c:\\program files\\common files\\designer\\msaddndr.dll")) returned 1 [0115.017] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL") returned 51 [0115.017] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL") returned 51 [0115.017] lstrlenW (lpString=".doc") returned 4 [0115.017] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0115.017] lstrlenW (lpString=".docx") returned 5 [0115.017] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1 [0115.017] lstrlenW (lpString=".pdf") returned 4 [0115.017] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0115.017] lstrlenW (lpString=".xls") returned 4 [0115.017] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0115.017] lstrlenW (lpString=".xlsx") returned 5 [0115.017] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1 [0115.017] lstrlenW (lpString=".ppt") returned 4 [0115.017] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0115.017] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL") returned 51 [0115.017] lstrlenW (lpString=".zip") returned 4 [0115.017] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0115.017] lstrlenW (lpString=".rar") returned 4 [0115.017] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0115.017] lstrlenW (lpString=".bz2") returned 4 [0115.018] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0115.018] lstrlenW (lpString=".7z") returned 3 [0115.018] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0115.018] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL") returned 51 [0115.018] lstrlenW (lpString=".dbf") returned 4 [0115.018] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0115.018] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL") returned 51 [0115.018] lstrlenW (lpString=".1cd") returned 4 [0115.018] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0115.018] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL") returned 51 [0115.018] lstrlenW (lpString=".jpg") returned 4 [0115.018] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0115.018] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL") returned 51 [0115.018] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL") returned 51 [0115.018] lstrlenW (lpString=".doc") returned 4 [0115.018] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0115.018] lstrlenW (lpString=".docx") returned 5 [0115.018] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1 [0115.018] lstrlenW (lpString=".pdf") returned 4 [0115.018] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0115.018] lstrlenW (lpString=".xls") returned 4 [0115.018] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0115.018] lstrlenW (lpString=".xlsx") returned 5 [0115.018] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1 [0115.018] lstrlenW (lpString=".ppt") returned 4 [0115.018] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0115.018] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL") returned 51 [0115.018] lstrlenW (lpString=".zip") returned 4 [0115.018] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0115.018] lstrlenW (lpString=".rar") returned 4 [0115.018] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0115.018] lstrlenW (lpString=".bz2") returned 4 [0115.018] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0115.018] lstrlenW (lpString=".7z") returned 3 [0115.018] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0115.018] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL") returned 51 [0115.018] lstrlenW (lpString=".dbf") returned 4 [0115.018] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0115.018] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL") returned 51 [0115.018] lstrlenW (lpString=".1cd") returned 4 [0115.018] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0115.018] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL") returned 51 [0115.018] lstrlenW (lpString=".jpg") returned 4 [0115.018] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0115.018] lstrcmpiW (lpString1=".EXE", lpString2=".waifu") returned -1 [0115.018] lstrlenW (lpString="DWTRIG20.EXE") returned 12 [0115.019] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dwtrig20.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0115.515] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x354f8c4 | out: lpFileSize=0x354f8c4*=629664) returned 1 [0115.515] CloseHandle (hObject=0x1f8) returned 1 [0115.515] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dwtrig20.exe")) returned 0x20 [0115.515] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dwtrig20.exe.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0115.515] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dwtrig20.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0115.515] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f870 | out: lpNewFilePointer=0x0) returned 1 [0115.515] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f870 | out: lpNewFilePointer=0x0) returned 1 [0115.516] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dwtrig20.exe.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0115.522] GetLastError () returned 0x0 [0115.522] ReadFile (in: hFile=0x1f8, lpBuffer=0x4120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x354f87c, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesRead=0x354f87c*=0x99ba0, lpOverlapped=0x0) returned 1 [0115.536] WriteFile (in: hFile=0x1f0, lpBuffer=0x4120020*, nNumberOfBytesToWrite=0x99bb0, lpNumberOfBytesWritten=0x354f644, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesWritten=0x354f644*=0x99bb0, lpOverlapped=0x0) returned 1 [0115.542] ReadFile (in: hFile=0x1f8, lpBuffer=0x4120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x354f87c, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesRead=0x354f87c*=0x0, lpOverlapped=0x0) returned 1 [0115.542] WriteFile (in: hFile=0x1f0, lpBuffer=0x4120020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x354f644, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesWritten=0x354f644*=0xec, lpOverlapped=0x0) returned 1 [0115.542] SetEndOfFile (hFile=0x1f0) returned 1 [0115.542] CloseHandle (hObject=0x1f0) returned 1 [0115.542] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f870 | out: lpNewFilePointer=0x0) returned 1 [0115.542] SetEndOfFile (hFile=0x1f8) returned 1 [0115.544] CloseHandle (hObject=0x1f8) returned 1 [0115.544] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0115.544] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dwtrig20.exe")) returned 1 [0115.544] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE") returned 62 [0115.544] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE") returned 62 [0115.544] lstrlenW (lpString=".doc") returned 4 [0115.544] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0115.544] lstrlenW (lpString=".docx") returned 5 [0115.544] lstrcmpiW (lpString1=".docx", lpString2="0.EXE") returned -1 [0115.544] lstrlenW (lpString=".pdf") returned 4 [0115.544] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0115.544] lstrlenW (lpString=".xls") returned 4 [0115.544] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0115.544] lstrlenW (lpString=".xlsx") returned 5 [0115.544] lstrcmpiW (lpString1=".xlsx", lpString2="0.EXE") returned -1 [0115.545] lstrlenW (lpString=".ppt") returned 4 [0115.545] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0115.545] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE") returned 62 [0115.545] lstrlenW (lpString=".zip") returned 4 [0115.545] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0115.545] lstrlenW (lpString=".rar") returned 4 [0115.545] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0115.545] lstrlenW (lpString=".bz2") returned 4 [0115.545] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0115.545] lstrlenW (lpString=".7z") returned 3 [0115.545] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0115.545] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE") returned 62 [0115.545] lstrlenW (lpString=".dbf") returned 4 [0115.545] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0115.545] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE") returned 62 [0115.545] lstrlenW (lpString=".1cd") returned 4 [0115.545] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0115.545] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE") returned 62 [0115.545] lstrlenW (lpString=".jpg") returned 4 [0115.545] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0115.545] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE") returned 62 [0115.545] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE") returned 62 [0115.545] lstrlenW (lpString=".doc") returned 4 [0115.545] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0115.545] lstrlenW (lpString=".docx") returned 5 [0115.545] lstrcmpiW (lpString1=".docx", lpString2="0.EXE") returned -1 [0115.545] lstrlenW (lpString=".pdf") returned 4 [0115.545] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0115.545] lstrlenW (lpString=".xls") returned 4 [0115.545] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0115.545] lstrlenW (lpString=".xlsx") returned 5 [0115.545] lstrcmpiW (lpString1=".xlsx", lpString2="0.EXE") returned -1 [0115.545] lstrlenW (lpString=".ppt") returned 4 [0115.545] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0115.545] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE") returned 62 [0115.545] lstrlenW (lpString=".zip") returned 4 [0115.545] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0115.545] lstrlenW (lpString=".rar") returned 4 [0115.545] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0115.545] lstrlenW (lpString=".bz2") returned 4 [0115.545] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0115.545] lstrlenW (lpString=".7z") returned 3 [0115.545] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0115.545] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE") returned 62 [0115.545] lstrlenW (lpString=".dbf") returned 4 [0115.545] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0115.545] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE") returned 62 [0115.545] lstrlenW (lpString=".1cd") returned 4 [0115.545] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0115.545] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE") returned 62 [0115.545] lstrlenW (lpString=".jpg") returned 4 [0115.545] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0115.546] lstrcmpiW (lpString1=".DLL", lpString2=".waifu") returned -1 [0115.546] lstrlenW (lpString="VISFILT.DLL") returned 11 [0115.546] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\visfilt.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0115.653] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x354f8c4 | out: lpFileSize=0x354f8c4*=2124664) returned 1 [0115.653] CloseHandle (hObject=0x20c) returned 1 [0115.653] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\visfilt.dll")) returned 0x20 [0115.653] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\visfilt.dll.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0115.653] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\visfilt.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\visfilt.dll.id-9c354b42.[darknes@420blaze.it].waifu")) returned 1 [0115.654] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\visfilt.dll.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0115.655] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f614 | out: lpNewFilePointer=0x0) returned 1 [0115.655] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f5d4 | out: lpNewFilePointer=0x0) returned 1 [0115.655] ReadFile (in: hFile=0x20c, lpBuffer=0x4120058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x354f5e0, lpOverlapped=0x0 | out: lpBuffer=0x4120058*, lpNumberOfBytesRead=0x354f5e0*=0x40000, lpOverlapped=0x0) returned 1 [0115.668] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0xace7d, lpNewFilePointer=0x0, dwMoveMethod=0x354f5d4 | out: lpNewFilePointer=0x0) returned 1 [0115.668] ReadFile (in: hFile=0x20c, lpBuffer=0x4160058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x354f5e0, lpOverlapped=0x0 | out: lpBuffer=0x4160058*, lpNumberOfBytesRead=0x354f5e0*=0x40000, lpOverlapped=0x0) returned 1 [0115.670] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x354f614 | out: lpNewFilePointer=0xffffffff) returned 1 [0115.671] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x1c6b78, lpNewFilePointer=0x0, dwMoveMethod=0x354f5d4 | out: lpNewFilePointer=0x0) returned 1 [0115.671] ReadFile (in: hFile=0x20c, lpBuffer=0x41a0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x354f5e0, lpOverlapped=0x0 | out: lpBuffer=0x41a0058*, lpNumberOfBytesRead=0x354f5e0*=0x40000, lpOverlapped=0x0) returned 1 [0115.890] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f870 | out: lpNewFilePointer=0x0) returned 1 [0115.890] WriteFile (in: hFile=0x20c, lpBuffer=0x4120020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x354f658, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesWritten=0x354f658*=0xc0102, lpOverlapped=0x0) returned 1 [0115.897] SetEndOfFile (hFile=0x20c) returned 1 [0115.977] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f624 | out: lpNewFilePointer=0x0) returned 1 [0115.977] WriteFile (in: hFile=0x20c, lpBuffer=0x4554008*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x354f630, lpOverlapped=0x0 | out: lpBuffer=0x4554008*, lpNumberOfBytesWritten=0x354f630*=0x40000, lpOverlapped=0x0) returned 1 [0116.131] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0xace7d, lpNewFilePointer=0x0, dwMoveMethod=0x354f624 | out: lpNewFilePointer=0x0) returned 1 [0116.131] WriteFile (in: hFile=0x20c, lpBuffer=0x4554008*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x354f630, lpOverlapped=0x0 | out: lpBuffer=0x4554008*, lpNumberOfBytesWritten=0x354f630*=0x40000, lpOverlapped=0x0) returned 1 [0116.133] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x1c6b78, lpNewFilePointer=0x0, dwMoveMethod=0x354f624 | out: lpNewFilePointer=0x0) returned 1 [0116.133] WriteFile (in: hFile=0x20c, lpBuffer=0x4554008*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x354f630, lpOverlapped=0x0 | out: lpBuffer=0x4554008*, lpNumberOfBytesWritten=0x354f630*=0x40000, lpOverlapped=0x0) returned 1 [0116.134] CloseHandle (hObject=0x20c) returned 1 [0116.134] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0116.135] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL") returned 66 [0116.135] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL") returned 66 [0116.135] lstrlenW (lpString=".doc") returned 4 [0116.135] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0116.135] lstrlenW (lpString=".docx") returned 5 [0116.135] lstrcmpiW (lpString1=".docx", lpString2="T.DLL") returned -1 [0116.135] lstrlenW (lpString=".pdf") returned 4 [0116.135] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0116.135] lstrlenW (lpString=".xls") returned 4 [0116.135] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0116.135] lstrlenW (lpString=".xlsx") returned 5 [0116.135] lstrcmpiW (lpString1=".xlsx", lpString2="T.DLL") returned -1 [0116.135] lstrlenW (lpString=".ppt") returned 4 [0116.135] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0116.135] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL") returned 66 [0116.135] lstrlenW (lpString=".zip") returned 4 [0116.135] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0116.135] lstrlenW (lpString=".rar") returned 4 [0116.135] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0116.135] lstrlenW (lpString=".bz2") returned 4 [0116.135] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0116.135] lstrlenW (lpString=".7z") returned 3 [0116.135] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0116.135] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL") returned 66 [0116.135] lstrlenW (lpString=".dbf") returned 4 [0116.135] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0116.135] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL") returned 66 [0116.135] lstrlenW (lpString=".1cd") returned 4 [0116.135] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0116.136] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL") returned 66 [0116.136] lstrlenW (lpString=".jpg") returned 4 [0116.136] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0116.136] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL") returned 66 [0116.136] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL") returned 66 [0116.136] lstrlenW (lpString=".doc") returned 4 [0116.136] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0116.136] lstrlenW (lpString=".docx") returned 5 [0116.136] lstrcmpiW (lpString1=".docx", lpString2="T.DLL") returned -1 [0116.136] lstrlenW (lpString=".pdf") returned 4 [0116.136] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0116.136] lstrlenW (lpString=".xls") returned 4 [0116.136] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0116.136] lstrlenW (lpString=".xlsx") returned 5 [0116.136] lstrcmpiW (lpString1=".xlsx", lpString2="T.DLL") returned -1 [0116.136] lstrlenW (lpString=".ppt") returned 4 [0116.136] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0116.136] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL") returned 66 [0116.136] lstrlenW (lpString=".zip") returned 4 [0116.136] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0116.136] lstrlenW (lpString=".rar") returned 4 [0116.136] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0116.136] lstrlenW (lpString=".bz2") returned 4 [0116.136] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0116.136] lstrlenW (lpString=".7z") returned 3 [0116.136] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0116.136] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL") returned 66 [0116.136] lstrlenW (lpString=".dbf") returned 4 [0116.136] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0116.136] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL") returned 66 [0116.136] lstrlenW (lpString=".1cd") returned 4 [0116.136] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0116.136] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL") returned 66 [0116.136] lstrlenW (lpString=".jpg") returned 4 [0116.136] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0116.137] lstrcmpiW (lpString1=".FLT", lpString2=".waifu") returned -1 [0116.137] lstrlenW (lpString="PICTIM32.FLT") returned 12 [0116.137] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\pictim32.flt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0116.137] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x354f8c4 | out: lpFileSize=0x354f8c4*=73080) returned 1 [0116.137] CloseHandle (hObject=0x20c) returned 1 [0116.137] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\pictim32.flt")) returned 0x20 [0116.137] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\pictim32.flt.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0116.137] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\pictim32.flt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0116.137] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f870 | out: lpNewFilePointer=0x0) returned 1 [0116.137] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f870 | out: lpNewFilePointer=0x0) returned 1 [0116.137] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\pictim32.flt.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0116.240] GetLastError () returned 0x0 [0116.240] ReadFile (in: hFile=0x20c, lpBuffer=0x4120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x354f87c, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesRead=0x354f87c*=0x11d78, lpOverlapped=0x0) returned 1 [0116.251] WriteFile (in: hFile=0x1f4, lpBuffer=0x4120020*, nNumberOfBytesToWrite=0x11d80, lpNumberOfBytesWritten=0x354f644, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesWritten=0x354f644*=0x11d80, lpOverlapped=0x0) returned 1 [0116.252] ReadFile (in: hFile=0x20c, lpBuffer=0x4120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x354f87c, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesRead=0x354f87c*=0x0, lpOverlapped=0x0) returned 1 [0116.252] WriteFile (in: hFile=0x1f4, lpBuffer=0x4120020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x354f644, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesWritten=0x354f644*=0xec, lpOverlapped=0x0) returned 1 [0116.252] SetEndOfFile (hFile=0x1f4) returned 1 [0116.252] CloseHandle (hObject=0x1f4) returned 1 [0116.252] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f870 | out: lpNewFilePointer=0x0) returned 1 [0116.252] SetEndOfFile (hFile=0x20c) returned 1 [0116.253] CloseHandle (hObject=0x20c) returned 1 [0116.253] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0116.253] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\pictim32.flt")) returned 1 [0116.253] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT") returned 67 [0116.253] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT") returned 67 [0116.253] lstrlenW (lpString=".doc") returned 4 [0116.253] lstrcmpiW (lpString1=".doc", lpString2=".FLT") returned -1 [0116.253] lstrlenW (lpString=".docx") returned 5 [0116.253] lstrcmpiW (lpString1=".docx", lpString2="2.FLT") returned -1 [0116.253] lstrlenW (lpString=".pdf") returned 4 [0116.253] lstrcmpiW (lpString1=".pdf", lpString2=".FLT") returned 1 [0116.253] lstrlenW (lpString=".xls") returned 4 [0116.253] lstrcmpiW (lpString1=".xls", lpString2=".FLT") returned 1 [0116.253] lstrlenW (lpString=".xlsx") returned 5 [0116.253] lstrcmpiW (lpString1=".xlsx", lpString2="2.FLT") returned -1 [0116.253] lstrlenW (lpString=".ppt") returned 4 [0116.254] lstrcmpiW (lpString1=".ppt", lpString2=".FLT") returned 1 [0116.254] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT") returned 67 [0116.254] lstrlenW (lpString=".zip") returned 4 [0116.254] lstrcmpiW (lpString1=".zip", lpString2=".FLT") returned 1 [0116.254] lstrlenW (lpString=".rar") returned 4 [0116.254] lstrcmpiW (lpString1=".rar", lpString2=".FLT") returned 1 [0116.254] lstrlenW (lpString=".bz2") returned 4 [0116.254] lstrcmpiW (lpString1=".bz2", lpString2=".FLT") returned -1 [0116.254] lstrlenW (lpString=".7z") returned 3 [0116.254] lstrcmpiW (lpString1=".7z", lpString2="FLT") returned -1 [0116.254] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT") returned 67 [0116.254] lstrlenW (lpString=".dbf") returned 4 [0116.254] lstrcmpiW (lpString1=".dbf", lpString2=".FLT") returned -1 [0116.254] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT") returned 67 [0116.254] lstrlenW (lpString=".1cd") returned 4 [0116.254] lstrcmpiW (lpString1=".1cd", lpString2=".FLT") returned -1 [0116.254] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT") returned 67 [0116.254] lstrlenW (lpString=".jpg") returned 4 [0116.254] lstrcmpiW (lpString1=".jpg", lpString2=".FLT") returned 1 [0116.254] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT") returned 67 [0116.254] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT") returned 67 [0116.254] lstrlenW (lpString=".doc") returned 4 [0116.254] lstrcmpiW (lpString1=".doc", lpString2=".FLT") returned -1 [0116.254] lstrlenW (lpString=".docx") returned 5 [0116.254] lstrcmpiW (lpString1=".docx", lpString2="2.FLT") returned -1 [0116.254] lstrlenW (lpString=".pdf") returned 4 [0116.254] lstrcmpiW (lpString1=".pdf", lpString2=".FLT") returned 1 [0116.254] lstrlenW (lpString=".xls") returned 4 [0116.254] lstrcmpiW (lpString1=".xls", lpString2=".FLT") returned 1 [0116.254] lstrlenW (lpString=".xlsx") returned 5 [0116.254] lstrcmpiW (lpString1=".xlsx", lpString2="2.FLT") returned -1 [0116.254] lstrlenW (lpString=".ppt") returned 4 [0116.254] lstrcmpiW (lpString1=".ppt", lpString2=".FLT") returned 1 [0116.254] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT") returned 67 [0116.254] lstrlenW (lpString=".zip") returned 4 [0116.254] lstrcmpiW (lpString1=".zip", lpString2=".FLT") returned 1 [0116.254] lstrlenW (lpString=".rar") returned 4 [0116.254] lstrcmpiW (lpString1=".rar", lpString2=".FLT") returned 1 [0116.254] lstrlenW (lpString=".bz2") returned 4 [0116.254] lstrcmpiW (lpString1=".bz2", lpString2=".FLT") returned -1 [0116.254] lstrlenW (lpString=".7z") returned 3 [0116.254] lstrcmpiW (lpString1=".7z", lpString2="FLT") returned -1 [0116.254] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT") returned 67 [0116.254] lstrlenW (lpString=".dbf") returned 4 [0116.254] lstrcmpiW (lpString1=".dbf", lpString2=".FLT") returned -1 [0116.254] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT") returned 67 [0116.255] lstrlenW (lpString=".1cd") returned 4 [0116.255] lstrcmpiW (lpString1=".1cd", lpString2=".FLT") returned -1 [0116.255] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT") returned 67 [0116.255] lstrlenW (lpString=".jpg") returned 4 [0116.255] lstrcmpiW (lpString1=".jpg", lpString2=".FLT") returned 1 [0116.255] lstrcmpiW (lpString1=".dll", lpString2=".waifu") returned -1 [0116.255] lstrlenW (lpString="msitss55.dll") returned 12 [0116.255] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\msitss55.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0116.393] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x354f8c4 | out: lpFileSize=0x354f8c4*=430080) returned 1 [0116.393] CloseHandle (hObject=0x1e4) returned 1 [0116.393] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\msitss55.dll")) returned 0x20 [0116.393] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\msitss55.dll.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0116.393] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\msitss55.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0116.394] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f870 | out: lpNewFilePointer=0x0) returned 1 [0116.394] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f870 | out: lpNewFilePointer=0x0) returned 1 [0116.394] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\msitss55.dll.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0116.394] GetLastError () returned 0x0 [0116.394] ReadFile (in: hFile=0x1e4, lpBuffer=0x4120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x354f87c, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesRead=0x354f87c*=0x69000, lpOverlapped=0x0) returned 1 [0116.401] WriteFile (in: hFile=0x1f0, lpBuffer=0x4120020*, nNumberOfBytesToWrite=0x69010, lpNumberOfBytesWritten=0x354f644, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesWritten=0x354f644*=0x69010, lpOverlapped=0x0) returned 1 [0116.404] ReadFile (in: hFile=0x1e4, lpBuffer=0x4120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x354f87c, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesRead=0x354f87c*=0x0, lpOverlapped=0x0) returned 1 [0116.404] WriteFile (in: hFile=0x1f0, lpBuffer=0x4120020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x354f644, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesWritten=0x354f644*=0xec, lpOverlapped=0x0) returned 1 [0116.404] SetEndOfFile (hFile=0x1f0) returned 1 [0116.404] CloseHandle (hObject=0x1f0) returned 1 [0116.405] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f870 | out: lpNewFilePointer=0x0) returned 1 [0116.405] SetEndOfFile (hFile=0x1e4) returned 1 [0116.406] CloseHandle (hObject=0x1e4) returned 1 [0116.406] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0116.406] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\msitss55.dll")) returned 1 [0116.406] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll") returned 64 [0116.406] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll") returned 64 [0116.406] lstrlenW (lpString=".doc") returned 4 [0116.406] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0116.406] lstrlenW (lpString=".docx") returned 5 [0116.406] lstrcmpiW (lpString1=".docx", lpString2="5.dll") returned -1 [0116.406] lstrlenW (lpString=".pdf") returned 4 [0116.406] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0116.406] lstrlenW (lpString=".xls") returned 4 [0116.406] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0116.406] lstrlenW (lpString=".xlsx") returned 5 [0116.406] lstrcmpiW (lpString1=".xlsx", lpString2="5.dll") returned -1 [0116.407] lstrlenW (lpString=".ppt") returned 4 [0116.407] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0116.407] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll") returned 64 [0116.407] lstrlenW (lpString=".zip") returned 4 [0116.407] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0116.407] lstrlenW (lpString=".rar") returned 4 [0116.407] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0116.407] lstrlenW (lpString=".bz2") returned 4 [0116.407] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0116.407] lstrlenW (lpString=".7z") returned 3 [0116.407] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0116.407] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll") returned 64 [0116.407] lstrlenW (lpString=".dbf") returned 4 [0116.407] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0116.407] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll") returned 64 [0116.407] lstrlenW (lpString=".1cd") returned 4 [0116.407] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0116.407] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll") returned 64 [0116.407] lstrlenW (lpString=".jpg") returned 4 [0116.407] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0116.407] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll") returned 64 [0116.407] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll") returned 64 [0116.407] lstrlenW (lpString=".doc") returned 4 [0116.407] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0116.407] lstrlenW (lpString=".docx") returned 5 [0116.407] lstrcmpiW (lpString1=".docx", lpString2="5.dll") returned -1 [0116.407] lstrlenW (lpString=".pdf") returned 4 [0116.407] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0116.407] lstrlenW (lpString=".xls") returned 4 [0116.407] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0116.407] lstrlenW (lpString=".xlsx") returned 5 [0116.407] lstrcmpiW (lpString1=".xlsx", lpString2="5.dll") returned -1 [0116.407] lstrlenW (lpString=".ppt") returned 4 [0116.407] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0116.407] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll") returned 64 [0116.407] lstrlenW (lpString=".zip") returned 4 [0116.407] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0116.407] lstrlenW (lpString=".rar") returned 4 [0116.407] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0116.407] lstrlenW (lpString=".bz2") returned 4 [0116.407] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0116.407] lstrlenW (lpString=".7z") returned 3 [0116.407] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0116.407] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll") returned 64 [0116.407] lstrlenW (lpString=".dbf") returned 4 [0116.407] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0116.407] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll") returned 64 [0116.407] lstrlenW (lpString=".1cd") returned 4 [0116.407] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0116.407] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll") returned 64 [0116.407] lstrlenW (lpString=".jpg") returned 4 [0116.408] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0116.408] lstrcmpiW (lpString1=".mui", lpString2=".waifu") returned -1 [0116.408] lstrlenW (lpString="FlickLearningWizard.exe.mui") returned 27 [0116.408] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\FlickLearningWizard.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\flicklearningwizard.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0116.410] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x354f8c4 | out: lpFileSize=0x354f8c4*=8704) returned 1 [0116.410] CloseHandle (hObject=0x1e4) returned 1 [0116.410] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\FlickLearningWizard.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\flicklearningwizard.exe.mui")) returned 0x20 [0116.410] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\FlickLearningWizard.exe.mui.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\flicklearningwizard.exe.mui.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0116.410] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\FlickLearningWizard.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\flicklearningwizard.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0116.410] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\FlickLearningWizard.exe.mui") returned 84 [0116.410] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\FlickLearningWizard.exe.mui") returned 84 [0116.410] lstrlenW (lpString=".doc") returned 4 [0116.410] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0116.410] lstrlenW (lpString=".docx") returned 5 [0116.410] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0116.410] lstrlenW (lpString=".pdf") returned 4 [0116.410] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0116.410] lstrlenW (lpString=".xls") returned 4 [0116.410] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0116.410] lstrlenW (lpString=".xlsx") returned 5 [0116.410] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0116.410] lstrlenW (lpString=".ppt") returned 4 [0116.410] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0116.410] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\FlickLearningWizard.exe.mui") returned 84 [0116.410] lstrlenW (lpString=".zip") returned 4 [0116.410] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0116.410] lstrlenW (lpString=".rar") returned 4 [0116.410] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0116.410] lstrlenW (lpString=".bz2") returned 4 [0116.410] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0116.410] lstrlenW (lpString=".7z") returned 3 [0116.410] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0116.411] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\FlickLearningWizard.exe.mui") returned 84 [0116.411] lstrlenW (lpString=".dbf") returned 4 [0116.411] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0116.411] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\FlickLearningWizard.exe.mui") returned 84 [0116.411] lstrlenW (lpString=".1cd") returned 4 [0116.411] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0116.411] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\FlickLearningWizard.exe.mui") returned 84 [0116.411] lstrlenW (lpString=".jpg") returned 4 [0116.411] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0116.411] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\FlickLearningWizard.exe.mui") returned 84 [0116.411] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\FlickLearningWizard.exe.mui") returned 84 [0116.411] lstrlenW (lpString=".doc") returned 4 [0116.411] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0116.411] lstrlenW (lpString=".docx") returned 5 [0116.411] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0116.411] lstrlenW (lpString=".pdf") returned 4 [0116.411] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0116.411] lstrlenW (lpString=".xls") returned 4 [0116.411] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0116.411] lstrlenW (lpString=".xlsx") returned 5 [0116.411] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0116.411] lstrlenW (lpString=".ppt") returned 4 [0116.411] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0116.411] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\FlickLearningWizard.exe.mui") returned 84 [0116.411] lstrlenW (lpString=".zip") returned 4 [0116.411] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0116.411] lstrlenW (lpString=".rar") returned 4 [0116.411] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0116.411] lstrlenW (lpString=".bz2") returned 4 [0116.411] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0116.411] lstrlenW (lpString=".7z") returned 3 [0116.411] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0116.411] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\FlickLearningWizard.exe.mui") returned 84 [0116.411] lstrlenW (lpString=".dbf") returned 4 [0116.411] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0116.411] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\FlickLearningWizard.exe.mui") returned 84 [0116.411] lstrlenW (lpString=".1cd") returned 4 [0116.411] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0116.411] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\FlickLearningWizard.exe.mui") returned 84 [0116.411] lstrlenW (lpString=".jpg") returned 4 [0116.411] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0116.411] lstrcmpiW (lpString1=".mui", lpString2=".waifu") returned -1 [0116.412] lstrlenW (lpString="InkObj.dll.mui") returned 14 [0116.412] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inkobj.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0116.418] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x354f8c4 | out: lpFileSize=0x354f8c4*=4608) returned 1 [0116.418] CloseHandle (hObject=0x1e4) returned 1 [0116.418] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inkobj.dll.mui")) returned 0x20 [0116.418] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inkobj.dll.mui.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0116.418] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inkobj.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0116.418] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui") returned 71 [0116.418] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui") returned 71 [0116.418] lstrlenW (lpString=".doc") returned 4 [0116.418] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0116.418] lstrlenW (lpString=".docx") returned 5 [0116.418] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0116.418] lstrlenW (lpString=".pdf") returned 4 [0116.418] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0116.418] lstrlenW (lpString=".xls") returned 4 [0116.418] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0116.418] lstrlenW (lpString=".xlsx") returned 5 [0116.418] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0116.418] lstrlenW (lpString=".ppt") returned 4 [0116.418] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0116.418] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui") returned 71 [0116.418] lstrlenW (lpString=".zip") returned 4 [0116.418] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0116.418] lstrlenW (lpString=".rar") returned 4 [0116.418] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0116.418] lstrlenW (lpString=".bz2") returned 4 [0116.418] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0116.418] lstrlenW (lpString=".7z") returned 3 [0116.418] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0116.418] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui") returned 71 [0116.418] lstrlenW (lpString=".dbf") returned 4 [0116.418] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0116.418] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui") returned 71 [0116.418] lstrlenW (lpString=".1cd") returned 4 [0116.418] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0116.418] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui") returned 71 [0116.418] lstrlenW (lpString=".jpg") returned 4 [0116.418] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0116.419] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui") returned 71 [0116.419] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui") returned 71 [0116.419] lstrlenW (lpString=".doc") returned 4 [0116.419] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0116.419] lstrlenW (lpString=".docx") returned 5 [0116.419] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0116.419] lstrlenW (lpString=".pdf") returned 4 [0116.419] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0116.419] lstrlenW (lpString=".xls") returned 4 [0116.419] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0116.419] lstrlenW (lpString=".xlsx") returned 5 [0116.419] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0116.419] lstrlenW (lpString=".ppt") returned 4 [0116.419] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0116.419] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui") returned 71 [0116.419] lstrlenW (lpString=".zip") returned 4 [0116.419] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0116.419] lstrlenW (lpString=".rar") returned 4 [0116.419] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0116.419] lstrlenW (lpString=".bz2") returned 4 [0116.419] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0116.419] lstrlenW (lpString=".7z") returned 3 [0116.419] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0116.419] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui") returned 71 [0116.419] lstrlenW (lpString=".dbf") returned 4 [0116.419] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0116.419] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui") returned 71 [0116.419] lstrlenW (lpString=".1cd") returned 4 [0116.419] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0116.419] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui") returned 71 [0116.419] lstrlenW (lpString=".jpg") returned 4 [0116.419] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0116.419] lstrcmpiW (lpString1=".mui", lpString2=".waifu") returned -1 [0116.419] lstrlenW (lpString="InkWatson.exe.mui") returned 17 [0116.419] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inkwatson.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0116.424] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x354f8c4 | out: lpFileSize=0x354f8c4*=9216) returned 1 [0116.424] CloseHandle (hObject=0x1e4) returned 1 [0116.424] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inkwatson.exe.mui")) returned 0x20 [0116.424] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inkwatson.exe.mui.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0116.424] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inkwatson.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0116.424] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui") returned 74 [0116.424] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui") returned 74 [0116.424] lstrlenW (lpString=".doc") returned 4 [0116.424] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0116.424] lstrlenW (lpString=".docx") returned 5 [0116.424] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0116.424] lstrlenW (lpString=".pdf") returned 4 [0116.424] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0116.424] lstrlenW (lpString=".xls") returned 4 [0116.424] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0116.424] lstrlenW (lpString=".xlsx") returned 5 [0116.424] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0116.424] lstrlenW (lpString=".ppt") returned 4 [0116.425] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0116.425] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui") returned 74 [0116.425] lstrlenW (lpString=".zip") returned 4 [0116.425] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0116.425] lstrlenW (lpString=".rar") returned 4 [0116.425] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0116.425] lstrlenW (lpString=".bz2") returned 4 [0116.425] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0116.425] lstrlenW (lpString=".7z") returned 3 [0116.425] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0116.425] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui") returned 74 [0116.425] lstrlenW (lpString=".dbf") returned 4 [0116.425] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0116.425] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui") returned 74 [0116.425] lstrlenW (lpString=".1cd") returned 4 [0116.425] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0116.425] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui") returned 74 [0116.425] lstrlenW (lpString=".jpg") returned 4 [0116.425] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0116.425] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui") returned 74 [0116.425] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui") returned 74 [0116.425] lstrlenW (lpString=".doc") returned 4 [0116.425] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0116.425] lstrlenW (lpString=".docx") returned 5 [0116.425] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0116.425] lstrlenW (lpString=".pdf") returned 4 [0116.425] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0116.425] lstrlenW (lpString=".xls") returned 4 [0116.425] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0116.425] lstrlenW (lpString=".xlsx") returned 5 [0116.425] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0116.425] lstrlenW (lpString=".ppt") returned 4 [0116.425] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0116.425] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui") returned 74 [0116.425] lstrlenW (lpString=".zip") returned 4 [0116.425] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0116.425] lstrlenW (lpString=".rar") returned 4 [0116.425] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0116.425] lstrlenW (lpString=".bz2") returned 4 [0116.425] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0116.425] lstrlenW (lpString=".7z") returned 3 [0116.425] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0116.425] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui") returned 74 [0116.425] lstrlenW (lpString=".dbf") returned 4 [0116.425] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0116.425] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui") returned 74 [0116.425] lstrlenW (lpString=".1cd") returned 4 [0116.425] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0116.425] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui") returned 74 [0116.426] lstrlenW (lpString=".jpg") returned 4 [0116.426] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0116.426] lstrcmpiW (lpString1=".mui", lpString2=".waifu") returned -1 [0116.426] lstrlenW (lpString="InputPersonalization.exe.mui") returned 28 [0116.426] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InputPersonalization.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inputpersonalization.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0116.427] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x354f8c4 | out: lpFileSize=0x354f8c4*=2560) returned 1 [0116.427] CloseHandle (hObject=0x1e4) returned 1 [0116.427] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InputPersonalization.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inputpersonalization.exe.mui")) returned 0x20 [0116.427] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InputPersonalization.exe.mui.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inputpersonalization.exe.mui.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0116.427] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InputPersonalization.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inputpersonalization.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0116.427] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InputPersonalization.exe.mui") returned 85 [0116.427] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InputPersonalization.exe.mui") returned 85 [0116.427] lstrlenW (lpString=".doc") returned 4 [0116.427] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0116.427] lstrlenW (lpString=".docx") returned 5 [0116.427] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0116.427] lstrlenW (lpString=".pdf") returned 4 [0116.427] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0116.427] lstrlenW (lpString=".xls") returned 4 [0116.427] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0116.427] lstrlenW (lpString=".xlsx") returned 5 [0116.427] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0116.427] lstrlenW (lpString=".ppt") returned 4 [0116.427] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0116.427] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InputPersonalization.exe.mui") returned 85 [0116.427] lstrlenW (lpString=".zip") returned 4 [0116.427] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0116.427] lstrlenW (lpString=".rar") returned 4 [0116.427] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0116.427] lstrlenW (lpString=".bz2") returned 4 [0116.427] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0116.427] lstrlenW (lpString=".7z") returned 3 [0116.427] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0116.427] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InputPersonalization.exe.mui") returned 85 [0116.427] lstrlenW (lpString=".dbf") returned 4 [0116.427] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0116.427] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InputPersonalization.exe.mui") returned 85 [0116.427] lstrlenW (lpString=".1cd") returned 4 [0116.427] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0116.427] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InputPersonalization.exe.mui") returned 85 [0116.427] lstrlenW (lpString=".jpg") returned 4 [0116.428] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0116.428] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InputPersonalization.exe.mui") returned 85 [0116.428] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InputPersonalization.exe.mui") returned 85 [0116.428] lstrlenW (lpString=".doc") returned 4 [0116.428] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0116.428] lstrlenW (lpString=".docx") returned 5 [0116.428] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0116.428] lstrlenW (lpString=".pdf") returned 4 [0116.428] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0116.428] lstrlenW (lpString=".xls") returned 4 [0116.428] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0116.428] lstrlenW (lpString=".xlsx") returned 5 [0116.428] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0116.428] lstrlenW (lpString=".ppt") returned 4 [0116.428] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0116.428] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InputPersonalization.exe.mui") returned 85 [0116.428] lstrlenW (lpString=".zip") returned 4 [0116.428] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0116.428] lstrlenW (lpString=".rar") returned 4 [0116.428] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0116.428] lstrlenW (lpString=".bz2") returned 4 [0116.428] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0116.428] lstrlenW (lpString=".7z") returned 3 [0116.428] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0116.428] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InputPersonalization.exe.mui") returned 85 [0116.428] lstrlenW (lpString=".dbf") returned 4 [0116.428] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0116.428] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InputPersonalization.exe.mui") returned 85 [0116.428] lstrlenW (lpString=".1cd") returned 4 [0116.428] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0116.428] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InputPersonalization.exe.mui") returned 85 [0116.428] lstrlenW (lpString=".jpg") returned 4 [0116.428] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0116.428] lstrcmpiW (lpString1=".mui", lpString2=".waifu") returned -1 [0116.428] lstrlenW (lpString="IPSEventLogMsg.dll.mui") returned 22 [0116.428] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IPSEventLogMsg.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipseventlogmsg.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0116.429] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x354f8c4 | out: lpFileSize=0x354f8c4*=22528) returned 1 [0116.429] CloseHandle (hObject=0x1e4) returned 1 [0116.429] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IPSEventLogMsg.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipseventlogmsg.dll.mui")) returned 0x20 [0116.429] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IPSEventLogMsg.dll.mui.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipseventlogmsg.dll.mui.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0116.429] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IPSEventLogMsg.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipseventlogmsg.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0116.429] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IPSEventLogMsg.dll.mui") returned 79 [0116.429] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IPSEventLogMsg.dll.mui") returned 79 [0116.429] lstrlenW (lpString=".doc") returned 4 [0116.429] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0116.429] lstrlenW (lpString=".docx") returned 5 [0116.429] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0116.429] lstrlenW (lpString=".pdf") returned 4 [0116.429] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0116.429] lstrlenW (lpString=".xls") returned 4 [0116.429] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0116.429] lstrlenW (lpString=".xlsx") returned 5 [0116.429] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0116.429] lstrlenW (lpString=".ppt") returned 4 [0116.429] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0116.429] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IPSEventLogMsg.dll.mui") returned 79 [0116.429] lstrlenW (lpString=".zip") returned 4 [0116.429] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0116.429] lstrlenW (lpString=".rar") returned 4 [0116.429] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0116.429] lstrlenW (lpString=".bz2") returned 4 [0116.429] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0116.429] lstrlenW (lpString=".7z") returned 3 [0116.429] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0116.429] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IPSEventLogMsg.dll.mui") returned 79 [0116.429] lstrlenW (lpString=".dbf") returned 4 [0116.429] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0116.429] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IPSEventLogMsg.dll.mui") returned 79 [0116.429] lstrlenW (lpString=".1cd") returned 4 [0116.429] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0116.429] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IPSEventLogMsg.dll.mui") returned 79 [0116.429] lstrlenW (lpString=".jpg") returned 4 [0116.429] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0116.430] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IPSEventLogMsg.dll.mui") returned 79 [0116.430] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IPSEventLogMsg.dll.mui") returned 79 [0116.430] lstrlenW (lpString=".doc") returned 4 [0116.430] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0116.430] lstrlenW (lpString=".docx") returned 5 [0116.430] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0116.430] lstrlenW (lpString=".pdf") returned 4 [0116.430] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0116.430] lstrlenW (lpString=".xls") returned 4 [0116.430] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0116.430] lstrlenW (lpString=".xlsx") returned 5 [0116.430] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0116.430] lstrlenW (lpString=".ppt") returned 4 [0116.430] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0116.430] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IPSEventLogMsg.dll.mui") returned 79 [0116.430] lstrlenW (lpString=".zip") returned 4 [0116.430] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0116.430] lstrlenW (lpString=".rar") returned 4 [0116.430] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0116.430] lstrlenW (lpString=".bz2") returned 4 [0116.430] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0116.430] lstrlenW (lpString=".7z") returned 3 [0116.430] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0116.430] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IPSEventLogMsg.dll.mui") returned 79 [0116.430] lstrlenW (lpString=".dbf") returned 4 [0116.430] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0116.430] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IPSEventLogMsg.dll.mui") returned 79 [0116.430] lstrlenW (lpString=".1cd") returned 4 [0116.430] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0116.430] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IPSEventLogMsg.dll.mui") returned 79 [0116.430] lstrlenW (lpString=".jpg") returned 4 [0116.430] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0116.430] lstrcmpiW (lpString1=".mui", lpString2=".waifu") returned -1 [0116.430] lstrlenW (lpString="IpsMigrationPlugin.dll.mui") returned 26 [0116.430] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipsmigrationplugin.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0116.431] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x354f8c4 | out: lpFileSize=0x354f8c4*=2560) returned 1 [0116.431] CloseHandle (hObject=0x1e4) returned 1 [0116.431] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipsmigrationplugin.dll.mui")) returned 0x20 [0116.431] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipsmigrationplugin.dll.mui.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0116.431] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipsmigrationplugin.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0116.431] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui") returned 83 [0116.431] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui") returned 83 [0116.431] lstrlenW (lpString=".doc") returned 4 [0116.431] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0116.431] lstrlenW (lpString=".docx") returned 5 [0116.431] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0116.431] lstrlenW (lpString=".pdf") returned 4 [0116.431] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0116.431] lstrlenW (lpString=".xls") returned 4 [0116.431] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0116.431] lstrlenW (lpString=".xlsx") returned 5 [0116.431] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0116.431] lstrlenW (lpString=".ppt") returned 4 [0116.431] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0116.431] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui") returned 83 [0116.431] lstrlenW (lpString=".zip") returned 4 [0116.431] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0116.431] lstrlenW (lpString=".rar") returned 4 [0116.431] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0116.431] lstrlenW (lpString=".bz2") returned 4 [0116.431] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0116.431] lstrlenW (lpString=".7z") returned 3 [0116.431] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0116.431] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui") returned 83 [0116.431] lstrlenW (lpString=".dbf") returned 4 [0116.431] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0116.846] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f870 | out: lpNewFilePointer=0x0) returned 1 [0116.846] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f870 | out: lpNewFilePointer=0x0) returned 1 [0116.846] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\acerecr.dll.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0116.846] GetLastError () returned 0x0 [0116.846] ReadFile (in: hFile=0x1f0, lpBuffer=0x4120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x354f87c, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesRead=0x354f87c*=0x51d0, lpOverlapped=0x0) returned 1 [0117.364] WriteFile (in: hFile=0x208, lpBuffer=0x4120020*, nNumberOfBytesToWrite=0x51e0, lpNumberOfBytesWritten=0x354f644, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesWritten=0x354f644*=0x51e0, lpOverlapped=0x0) returned 1 [0117.365] ReadFile (in: hFile=0x1f0, lpBuffer=0x4120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x354f87c, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesRead=0x354f87c*=0x0, lpOverlapped=0x0) returned 1 [0117.365] WriteFile (in: hFile=0x208, lpBuffer=0x4120020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x354f644, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesWritten=0x354f644*=0xea, lpOverlapped=0x0) returned 1 [0117.365] SetEndOfFile (hFile=0x208) returned 1 [0117.365] CloseHandle (hObject=0x208) returned 1 [0117.365] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f870 | out: lpNewFilePointer=0x0) returned 1 [0117.365] SetEndOfFile (hFile=0x1f0) returned 1 [0117.402] CloseHandle (hObject=0x1f0) returned 1 [0117.403] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0117.403] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\acerecr.dll")) returned 1 [0117.409] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL") returned 72 [0117.409] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL") returned 72 [0117.409] lstrlenW (lpString=".doc") returned 4 [0117.409] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0117.409] lstrlenW (lpString=".docx") returned 5 [0117.409] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1 [0117.409] lstrlenW (lpString=".pdf") returned 4 [0117.409] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0117.409] lstrlenW (lpString=".xls") returned 4 [0117.409] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0117.409] lstrlenW (lpString=".xlsx") returned 5 [0117.409] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1 [0117.409] lstrlenW (lpString=".ppt") returned 4 [0117.409] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0117.409] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL") returned 72 [0117.409] lstrlenW (lpString=".zip") returned 4 [0117.409] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0117.409] lstrlenW (lpString=".rar") returned 4 [0117.410] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0117.410] lstrlenW (lpString=".bz2") returned 4 [0117.410] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0117.410] lstrlenW (lpString=".7z") returned 3 [0117.410] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0117.410] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL") returned 72 [0117.410] lstrlenW (lpString=".dbf") returned 4 [0117.410] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0117.410] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL") returned 72 [0117.410] lstrlenW (lpString=".1cd") returned 4 [0117.410] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0117.410] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL") returned 72 [0117.410] lstrlenW (lpString=".jpg") returned 4 [0117.410] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0117.410] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL") returned 72 [0117.410] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL") returned 72 [0117.410] lstrlenW (lpString=".doc") returned 4 [0117.410] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0117.410] lstrlenW (lpString=".docx") returned 5 [0117.410] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1 [0117.410] lstrlenW (lpString=".pdf") returned 4 [0117.410] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0117.410] lstrlenW (lpString=".xls") returned 4 [0117.410] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0117.410] lstrlenW (lpString=".xlsx") returned 5 [0117.410] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1 [0117.410] lstrlenW (lpString=".ppt") returned 4 [0117.410] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0117.410] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL") returned 72 [0117.410] lstrlenW (lpString=".zip") returned 4 [0117.410] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0117.410] lstrlenW (lpString=".rar") returned 4 [0117.410] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0117.410] lstrlenW (lpString=".bz2") returned 4 [0117.411] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0117.411] lstrlenW (lpString=".7z") returned 3 [0117.411] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0117.411] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL") returned 72 [0117.411] lstrlenW (lpString=".dbf") returned 4 [0117.411] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0117.411] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL") returned 72 [0117.411] lstrlenW (lpString=".1cd") returned 4 [0117.411] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0117.411] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL") returned 72 [0117.411] lstrlenW (lpString=".jpg") returned 4 [0117.411] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0117.411] lstrcmpiW (lpString1=".IDX_DLL", lpString2=".waifu") returned -1 [0117.411] lstrlenW (lpString="MSOINTL.DLL.IDX_DLL") returned 19 [0117.411] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.dll.idx_dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0117.412] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x354f8c4 | out: lpFileSize=0x354f8c4*=55680) returned 1 [0117.412] CloseHandle (hObject=0x1f0) returned 1 [0117.412] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.dll.idx_dll")) returned 0x20 [0117.412] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.dll.idx_dll.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0117.412] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.dll.idx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0117.412] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f870 | out: lpNewFilePointer=0x0) returned 1 [0117.412] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f870 | out: lpNewFilePointer=0x0) returned 1 [0117.412] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.dll.idx_dll.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0117.412] GetLastError () returned 0x0 [0117.412] ReadFile (in: hFile=0x1f0, lpBuffer=0x4120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x354f87c, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesRead=0x354f87c*=0xd980, lpOverlapped=0x0) returned 1 [0117.470] WriteFile (in: hFile=0x1d8, lpBuffer=0x4120020*, nNumberOfBytesToWrite=0xd990, lpNumberOfBytesWritten=0x354f644, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesWritten=0x354f644*=0xd990, lpOverlapped=0x0) returned 1 [0117.471] ReadFile (in: hFile=0x1f0, lpBuffer=0x4120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x354f87c, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesRead=0x354f87c*=0x0, lpOverlapped=0x0) returned 1 [0117.471] WriteFile (in: hFile=0x1d8, lpBuffer=0x4120020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x354f644, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesWritten=0x354f644*=0xfa, lpOverlapped=0x0) returned 1 [0117.472] SetEndOfFile (hFile=0x1d8) returned 1 [0117.472] CloseHandle (hObject=0x1d8) returned 1 [0117.472] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f870 | out: lpNewFilePointer=0x0) returned 1 [0117.472] SetEndOfFile (hFile=0x1f0) returned 1 [0117.472] CloseHandle (hObject=0x1f0) returned 1 [0117.472] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0117.473] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.dll.idx_dll")) returned 1 [0117.473] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL") returned 80 [0117.473] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL") returned 80 [0117.473] lstrlenW (lpString=".doc") returned 4 [0117.473] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0117.473] lstrlenW (lpString=".docx") returned 5 [0117.473] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0117.473] lstrlenW (lpString=".pdf") returned 4 [0117.473] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0117.473] lstrlenW (lpString=".xls") returned 4 [0117.473] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0117.473] lstrlenW (lpString=".xlsx") returned 5 [0117.473] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0117.473] lstrlenW (lpString=".ppt") returned 4 [0117.473] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0117.473] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL") returned 80 [0117.473] lstrlenW (lpString=".zip") returned 4 [0117.473] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0117.473] lstrlenW (lpString=".rar") returned 4 [0117.473] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0117.473] lstrlenW (lpString=".bz2") returned 4 [0117.473] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0117.473] lstrlenW (lpString=".7z") returned 3 [0117.473] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0117.473] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL") returned 80 [0117.473] lstrlenW (lpString=".dbf") returned 4 [0117.473] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0117.473] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL") returned 80 [0117.473] lstrlenW (lpString=".1cd") returned 4 [0117.473] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0117.473] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL") returned 80 [0117.473] lstrlenW (lpString=".jpg") returned 4 [0117.473] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0117.474] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL") returned 80 [0117.474] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL") returned 80 [0117.474] lstrlenW (lpString=".doc") returned 4 [0117.474] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0117.474] lstrlenW (lpString=".docx") returned 5 [0117.474] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0117.474] lstrlenW (lpString=".pdf") returned 4 [0117.474] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0117.474] lstrlenW (lpString=".xls") returned 4 [0117.474] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0117.474] lstrlenW (lpString=".xlsx") returned 5 [0117.474] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0117.474] lstrlenW (lpString=".ppt") returned 4 [0117.474] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0117.474] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL") returned 80 [0117.474] lstrlenW (lpString=".zip") returned 4 [0117.474] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0117.474] lstrlenW (lpString=".rar") returned 4 [0117.474] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0117.474] lstrlenW (lpString=".bz2") returned 4 [0117.474] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0117.474] lstrlenW (lpString=".7z") returned 3 [0117.474] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0117.474] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL") returned 80 [0117.474] lstrlenW (lpString=".dbf") returned 4 [0117.474] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0117.474] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL") returned 80 [0117.474] lstrlenW (lpString=".1cd") returned 4 [0117.474] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0117.474] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL") returned 80 [0117.474] lstrlenW (lpString=".jpg") returned 4 [0117.474] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0117.474] lstrcmpiW (lpString1=".DLL", lpString2=".waifu") returned -1 [0117.474] lstrlenW (lpString="MSSOAPR3.DLL") returned 12 [0117.474] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\mssoapr3.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0117.475] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x354f8c4 | out: lpFileSize=0x354f8c4*=41864) returned 1 [0117.475] CloseHandle (hObject=0x1f0) returned 1 [0117.475] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\mssoapr3.dll")) returned 0x20 [0117.475] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\mssoapr3.dll.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0117.475] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\mssoapr3.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0117.475] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f870 | out: lpNewFilePointer=0x0) returned 1 [0117.475] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f870 | out: lpNewFilePointer=0x0) returned 1 [0117.475] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\mssoapr3.dll.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0117.476] GetLastError () returned 0x0 [0117.476] ReadFile (in: hFile=0x1f0, lpBuffer=0x4120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x354f87c, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesRead=0x354f87c*=0xa388, lpOverlapped=0x0) returned 1 [0117.496] WriteFile (in: hFile=0x1d8, lpBuffer=0x4120020*, nNumberOfBytesToWrite=0xa390, lpNumberOfBytesWritten=0x354f644, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesWritten=0x354f644*=0xa390, lpOverlapped=0x0) returned 1 [0117.497] ReadFile (in: hFile=0x1f0, lpBuffer=0x4120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x354f87c, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesRead=0x354f87c*=0x0, lpOverlapped=0x0) returned 1 [0117.497] WriteFile (in: hFile=0x1d8, lpBuffer=0x4120020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x354f644, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesWritten=0x354f644*=0xec, lpOverlapped=0x0) returned 1 [0117.497] SetEndOfFile (hFile=0x1d8) returned 1 [0117.497] CloseHandle (hObject=0x1d8) returned 1 [0117.497] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f870 | out: lpNewFilePointer=0x0) returned 1 [0117.498] SetEndOfFile (hFile=0x1f0) returned 1 [0117.498] CloseHandle (hObject=0x1f0) returned 1 [0117.498] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0117.498] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\mssoapr3.dll")) returned 1 [0117.499] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL") returned 73 [0117.499] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL") returned 73 [0117.499] lstrlenW (lpString=".doc") returned 4 [0117.499] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0117.499] lstrlenW (lpString=".docx") returned 5 [0117.499] lstrcmpiW (lpString1=".docx", lpString2="3.DLL") returned -1 [0117.499] lstrlenW (lpString=".pdf") returned 4 [0117.499] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0117.499] lstrlenW (lpString=".xls") returned 4 [0117.499] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0117.499] lstrlenW (lpString=".xlsx") returned 5 [0117.499] lstrcmpiW (lpString1=".xlsx", lpString2="3.DLL") returned -1 [0117.499] lstrlenW (lpString=".ppt") returned 4 [0117.499] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0117.499] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL") returned 73 [0117.499] lstrlenW (lpString=".zip") returned 4 [0117.499] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0117.499] lstrlenW (lpString=".rar") returned 4 [0117.499] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0117.499] lstrlenW (lpString=".bz2") returned 4 [0117.499] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0117.499] lstrlenW (lpString=".7z") returned 3 [0117.499] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0117.499] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL") returned 73 [0117.499] lstrlenW (lpString=".dbf") returned 4 [0117.499] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0117.499] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL") returned 73 [0117.499] lstrlenW (lpString=".1cd") returned 4 [0117.499] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0117.499] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL") returned 73 [0117.499] lstrlenW (lpString=".jpg") returned 4 [0117.499] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0117.499] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL") returned 73 [0117.499] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL") returned 73 [0117.499] lstrlenW (lpString=".doc") returned 4 [0117.499] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0117.499] lstrlenW (lpString=".docx") returned 5 [0117.499] lstrcmpiW (lpString1=".docx", lpString2="3.DLL") returned -1 [0117.499] lstrlenW (lpString=".pdf") returned 4 [0117.499] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0117.499] lstrlenW (lpString=".xls") returned 4 [0117.499] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0117.499] lstrlenW (lpString=".xlsx") returned 5 [0117.499] lstrcmpiW (lpString1=".xlsx", lpString2="3.DLL") returned -1 [0117.499] lstrlenW (lpString=".ppt") returned 4 [0117.499] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0117.499] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL") returned 73 [0117.499] lstrlenW (lpString=".zip") returned 4 [0117.499] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0117.500] lstrlenW (lpString=".rar") returned 4 [0117.500] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0117.500] lstrlenW (lpString=".bz2") returned 4 [0117.500] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0117.500] lstrlenW (lpString=".7z") returned 3 [0117.500] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0117.500] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL") returned 73 [0117.500] lstrlenW (lpString=".dbf") returned 4 [0117.500] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0117.500] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL") returned 73 [0117.500] lstrlenW (lpString=".1cd") returned 4 [0117.500] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0117.500] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL") returned 73 [0117.500] lstrlenW (lpString=".jpg") returned 4 [0117.500] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0117.500] lstrcmpiW (lpString1=".DLL", lpString2=".waifu") returned -1 [0117.500] lstrlenW (lpString="OARPMANR.DLL") returned 12 [0117.500] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\oarpmanr.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0117.500] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x354f8c4 | out: lpFileSize=0x354f8c4*=11656) returned 1 [0117.500] CloseHandle (hObject=0x1f0) returned 1 [0117.500] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\oarpmanr.dll")) returned 0x20 [0117.500] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\oarpmanr.dll.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0117.501] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\oarpmanr.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0117.501] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f870 | out: lpNewFilePointer=0x0) returned 1 [0117.501] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f870 | out: lpNewFilePointer=0x0) returned 1 [0117.501] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\oarpmanr.dll.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0117.501] GetLastError () returned 0x0 [0117.501] ReadFile (in: hFile=0x1f0, lpBuffer=0x4120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x354f87c, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesRead=0x354f87c*=0x2d88, lpOverlapped=0x0) returned 1 [0117.579] WriteFile (in: hFile=0x1d8, lpBuffer=0x4120020*, nNumberOfBytesToWrite=0x2d90, lpNumberOfBytesWritten=0x354f644, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesWritten=0x354f644*=0x2d90, lpOverlapped=0x0) returned 1 [0117.580] ReadFile (in: hFile=0x1f0, lpBuffer=0x4120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x354f87c, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesRead=0x354f87c*=0x0, lpOverlapped=0x0) returned 1 [0117.580] WriteFile (in: hFile=0x1d8, lpBuffer=0x4120020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x354f644, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesWritten=0x354f644*=0xec, lpOverlapped=0x0) returned 1 [0117.580] SetEndOfFile (hFile=0x1d8) returned 1 [0117.601] CloseHandle (hObject=0x1d8) returned 1 [0117.601] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f870 | out: lpNewFilePointer=0x0) returned 1 [0117.601] SetEndOfFile (hFile=0x1f0) returned 1 [0117.601] CloseHandle (hObject=0x1f0) returned 1 [0117.602] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0117.602] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\oarpmanr.dll")) returned 1 [0117.897] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL") returned 73 [0117.897] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL") returned 73 [0117.897] lstrlenW (lpString=".doc") returned 4 [0117.897] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0117.897] lstrlenW (lpString=".docx") returned 5 [0117.897] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1 [0117.897] lstrlenW (lpString=".pdf") returned 4 [0117.897] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0117.897] lstrlenW (lpString=".xls") returned 4 [0117.897] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0117.897] lstrlenW (lpString=".xlsx") returned 5 [0117.898] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1 [0117.898] lstrlenW (lpString=".ppt") returned 4 [0117.898] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0117.898] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL") returned 73 [0117.898] lstrlenW (lpString=".zip") returned 4 [0117.898] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0117.898] lstrlenW (lpString=".rar") returned 4 [0117.898] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0117.898] lstrlenW (lpString=".bz2") returned 4 [0117.898] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0117.898] lstrlenW (lpString=".7z") returned 3 [0117.898] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0117.898] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL") returned 73 [0117.898] lstrlenW (lpString=".dbf") returned 4 [0117.898] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0117.898] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL") returned 73 [0117.898] lstrlenW (lpString=".1cd") returned 4 [0117.898] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0117.898] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL") returned 73 [0117.898] lstrlenW (lpString=".jpg") returned 4 [0117.898] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0117.898] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL") returned 73 [0117.898] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL") returned 73 [0117.898] lstrlenW (lpString=".doc") returned 4 [0117.898] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0117.898] lstrlenW (lpString=".docx") returned 5 [0117.898] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1 [0117.898] lstrlenW (lpString=".pdf") returned 4 [0117.898] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0117.898] lstrlenW (lpString=".xls") returned 4 [0117.898] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0117.898] lstrlenW (lpString=".xlsx") returned 5 [0117.898] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1 [0117.898] lstrlenW (lpString=".ppt") returned 4 [0117.898] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0117.898] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL") returned 73 [0117.898] lstrlenW (lpString=".zip") returned 4 [0117.898] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0117.898] lstrlenW (lpString=".rar") returned 4 [0117.898] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0117.898] lstrlenW (lpString=".bz2") returned 4 [0117.898] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0117.898] lstrlenW (lpString=".7z") returned 3 [0117.898] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0117.898] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL") returned 73 [0117.898] lstrlenW (lpString=".dbf") returned 4 [0117.898] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0117.898] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL") returned 73 [0117.898] lstrlenW (lpString=".1cd") returned 4 [0117.899] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0117.899] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL") returned 73 [0117.899] lstrlenW (lpString=".jpg") returned 4 [0117.899] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0117.899] lstrcmpiW (lpString1=".DLL", lpString2=".waifu") returned -1 [0117.899] lstrlenW (lpString="ACECORE.DLL") returned 11 [0117.899] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acecore.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0117.900] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x354f8c4 | out: lpFileSize=0x354f8c4*=3213192) returned 1 [0117.900] CloseHandle (hObject=0x208) returned 1 [0117.900] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acecore.dll")) returned 0x20 [0117.900] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acecore.dll.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0117.900] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acecore.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acecore.dll.id-9c354b42.[darknes@420blaze.it].waifu")) returned 1 [0117.901] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acecore.dll.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0117.901] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f614 | out: lpNewFilePointer=0x0) returned 1 [0117.901] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f5d4 | out: lpNewFilePointer=0x0) returned 1 [0117.901] ReadFile (in: hFile=0x208, lpBuffer=0x4120058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x354f5e0, lpOverlapped=0x0 | out: lpBuffer=0x4120058*, lpNumberOfBytesRead=0x354f5e0*=0x40000, lpOverlapped=0x0) returned 1 [0117.928] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x1057d8, lpNewFilePointer=0x0, dwMoveMethod=0x354f5d4 | out: lpNewFilePointer=0x0) returned 1 [0117.928] ReadFile (in: hFile=0x208, lpBuffer=0x4160058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x354f5e0, lpOverlapped=0x0 | out: lpBuffer=0x4160058*, lpNumberOfBytesRead=0x354f5e0*=0x40000, lpOverlapped=0x0) returned 1 [0118.011] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x354f614 | out: lpNewFilePointer=0xffffffff) returned 1 [0118.011] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x2d0788, lpNewFilePointer=0x0, dwMoveMethod=0x354f5d4 | out: lpNewFilePointer=0x0) returned 1 [0118.011] ReadFile (in: hFile=0x208, lpBuffer=0x41a0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x354f5e0, lpOverlapped=0x0 | out: lpBuffer=0x41a0058*, lpNumberOfBytesRead=0x354f5e0*=0x40000, lpOverlapped=0x0) returned 1 [0118.431] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f870 | out: lpNewFilePointer=0x0) returned 1 [0118.431] WriteFile (in: hFile=0x208, lpBuffer=0x4120020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x354f658, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesWritten=0x354f658*=0xc0102, lpOverlapped=0x0) returned 1 [0118.897] SetEndOfFile (hFile=0x208) returned 1 [0118.900] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f624 | out: lpNewFilePointer=0x0) returned 1 [0118.900] WriteFile (in: hFile=0x208, lpBuffer=0x4554008*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x354f630, lpOverlapped=0x0 | out: lpBuffer=0x4554008*, lpNumberOfBytesWritten=0x354f630*=0x40000, lpOverlapped=0x0) returned 1 [0118.901] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x1057d8, lpNewFilePointer=0x0, dwMoveMethod=0x354f624 | out: lpNewFilePointer=0x0) returned 1 [0118.901] WriteFile (in: hFile=0x208, lpBuffer=0x4554008*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x354f630, lpOverlapped=0x0 | out: lpBuffer=0x4554008*, lpNumberOfBytesWritten=0x354f630*=0x40000, lpOverlapped=0x0) returned 1 [0118.903] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x2d0788, lpNewFilePointer=0x0, dwMoveMethod=0x354f624 | out: lpNewFilePointer=0x0) returned 1 [0118.903] WriteFile (in: hFile=0x208, lpBuffer=0x4554008*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x354f630, lpOverlapped=0x0 | out: lpBuffer=0x4554008*, lpNumberOfBytesWritten=0x354f630*=0x40000, lpOverlapped=0x0) returned 1 [0118.906] CloseHandle (hObject=0x208) returned 1 [0118.906] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0118.906] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL") returned 67 [0118.906] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL") returned 67 [0118.906] lstrlenW (lpString=".doc") returned 4 [0118.906] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0118.906] lstrlenW (lpString=".docx") returned 5 [0118.906] lstrcmpiW (lpString1=".docx", lpString2="E.DLL") returned -1 [0118.906] lstrlenW (lpString=".pdf") returned 4 [0118.906] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0118.906] lstrlenW (lpString=".xls") returned 4 [0118.906] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0118.906] lstrlenW (lpString=".xlsx") returned 5 [0118.906] lstrcmpiW (lpString1=".xlsx", lpString2="E.DLL") returned -1 [0118.906] lstrlenW (lpString=".ppt") returned 4 [0118.907] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0118.907] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL") returned 67 [0118.907] lstrlenW (lpString=".zip") returned 4 [0118.907] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0118.907] lstrlenW (lpString=".rar") returned 4 [0118.907] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0118.907] lstrlenW (lpString=".bz2") returned 4 [0118.907] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0118.907] lstrlenW (lpString=".7z") returned 3 [0118.907] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0118.907] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL") returned 67 [0118.907] lstrlenW (lpString=".dbf") returned 4 [0118.907] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0118.907] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL") returned 67 [0118.907] lstrlenW (lpString=".1cd") returned 4 [0118.907] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0118.907] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL") returned 67 [0118.907] lstrlenW (lpString=".jpg") returned 4 [0118.907] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0118.907] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL") returned 67 [0118.907] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL") returned 67 [0118.907] lstrlenW (lpString=".doc") returned 4 [0118.907] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0118.907] lstrlenW (lpString=".docx") returned 5 [0118.907] lstrcmpiW (lpString1=".docx", lpString2="E.DLL") returned -1 [0118.907] lstrlenW (lpString=".pdf") returned 4 [0118.907] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0118.907] lstrlenW (lpString=".xls") returned 4 [0118.907] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0118.907] lstrlenW (lpString=".xlsx") returned 5 [0118.907] lstrcmpiW (lpString1=".xlsx", lpString2="E.DLL") returned -1 [0118.907] lstrlenW (lpString=".ppt") returned 4 [0118.907] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0118.907] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL") returned 67 [0118.907] lstrlenW (lpString=".zip") returned 4 [0118.907] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0118.907] lstrlenW (lpString=".rar") returned 4 [0118.907] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0118.907] lstrlenW (lpString=".bz2") returned 4 [0118.907] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0118.907] lstrlenW (lpString=".7z") returned 3 [0118.907] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0118.907] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL") returned 67 [0118.907] lstrlenW (lpString=".dbf") returned 4 [0118.907] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0118.907] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL") returned 67 [0118.907] lstrlenW (lpString=".1cd") returned 4 [0118.907] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0118.907] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL") returned 67 [0118.907] lstrlenW (lpString=".jpg") returned 4 [0118.907] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0118.908] lstrcmpiW (lpString1=".DLL", lpString2=".waifu") returned -1 [0118.908] lstrlenW (lpString="ACEEXCL.DLL") returned 11 [0118.908] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceexcl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0118.908] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x354f8c4 | out: lpFileSize=0x354f8c4*=899992) returned 1 [0118.908] CloseHandle (hObject=0x208) returned 1 [0118.908] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceexcl.dll")) returned 0x20 [0118.908] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceexcl.dll.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0118.908] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceexcl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0118.908] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f870 | out: lpNewFilePointer=0x0) returned 1 [0118.908] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f870 | out: lpNewFilePointer=0x0) returned 1 [0118.909] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceexcl.dll.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0118.909] GetLastError () returned 0x0 [0118.909] ReadFile (in: hFile=0x208, lpBuffer=0x4120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x354f87c, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesRead=0x354f87c*=0xdbb98, lpOverlapped=0x0) returned 1 [0118.985] WriteFile (in: hFile=0x21c, lpBuffer=0x4120020*, nNumberOfBytesToWrite=0xdbba0, lpNumberOfBytesWritten=0x354f644, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesWritten=0x354f644*=0xdbba0, lpOverlapped=0x0) returned 1 [0118.993] ReadFile (in: hFile=0x208, lpBuffer=0x4120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x354f87c, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesRead=0x354f87c*=0x0, lpOverlapped=0x0) returned 1 [0118.993] WriteFile (in: hFile=0x21c, lpBuffer=0x4120020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x354f644, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesWritten=0x354f644*=0xea, lpOverlapped=0x0) returned 1 [0118.993] SetEndOfFile (hFile=0x21c) returned 1 [0119.201] CloseHandle (hObject=0x21c) returned 1 [0119.201] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f870 | out: lpNewFilePointer=0x0) returned 1 [0119.201] SetEndOfFile (hFile=0x208) returned 1 [0119.204] CloseHandle (hObject=0x208) returned 1 [0119.204] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0119.204] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceexcl.dll")) returned 1 [0119.204] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL") returned 67 [0119.204] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL") returned 67 [0119.204] lstrlenW (lpString=".doc") returned 4 [0119.204] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0119.204] lstrlenW (lpString=".docx") returned 5 [0119.204] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0119.204] lstrlenW (lpString=".pdf") returned 4 [0119.204] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0119.204] lstrlenW (lpString=".xls") returned 4 [0119.204] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0119.204] lstrlenW (lpString=".xlsx") returned 5 [0119.204] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0119.204] lstrlenW (lpString=".ppt") returned 4 [0119.204] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0119.204] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL") returned 67 [0119.204] lstrlenW (lpString=".zip") returned 4 [0119.204] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0119.204] lstrlenW (lpString=".rar") returned 4 [0119.205] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0119.205] lstrlenW (lpString=".bz2") returned 4 [0119.205] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0119.205] lstrlenW (lpString=".7z") returned 3 [0119.205] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0119.205] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL") returned 67 [0119.205] lstrlenW (lpString=".dbf") returned 4 [0119.205] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0119.205] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL") returned 67 [0119.205] lstrlenW (lpString=".1cd") returned 4 [0119.205] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0119.205] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL") returned 67 [0119.205] lstrlenW (lpString=".jpg") returned 4 [0119.205] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0119.205] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL") returned 67 [0119.205] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL") returned 67 [0119.205] lstrlenW (lpString=".doc") returned 4 [0119.205] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0119.205] lstrlenW (lpString=".docx") returned 5 [0119.205] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0119.205] lstrlenW (lpString=".pdf") returned 4 [0119.205] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0119.205] lstrlenW (lpString=".xls") returned 4 [0119.205] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0119.205] lstrlenW (lpString=".xlsx") returned 5 [0119.205] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0119.205] lstrlenW (lpString=".ppt") returned 4 [0119.205] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0119.205] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL") returned 67 [0119.205] lstrlenW (lpString=".zip") returned 4 [0119.205] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0119.205] lstrlenW (lpString=".rar") returned 4 [0119.205] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0119.205] lstrlenW (lpString=".bz2") returned 4 [0119.205] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0119.205] lstrlenW (lpString=".7z") returned 3 [0119.205] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0119.205] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL") returned 67 [0119.205] lstrlenW (lpString=".dbf") returned 4 [0119.205] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0119.205] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL") returned 67 [0119.205] lstrlenW (lpString=".1cd") returned 4 [0119.205] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0119.205] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL") returned 67 [0119.206] lstrlenW (lpString=".jpg") returned 4 [0119.206] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0119.206] lstrcmpiW (lpString1=".DLL", lpString2=".waifu") returned -1 [0119.206] lstrlenW (lpString="ACEOLEDB.DLL") returned 12 [0119.206] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEOLEDB.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceoledb.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0119.209] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x354f8c4 | out: lpFileSize=0x354f8c4*=537504) returned 1 [0119.209] CloseHandle (hObject=0x208) returned 1 [0119.209] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEOLEDB.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceoledb.dll")) returned 0x20 [0119.209] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEOLEDB.DLL.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceoledb.dll.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0119.209] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEOLEDB.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceoledb.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0119.209] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f870 | out: lpNewFilePointer=0x0) returned 1 [0119.209] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f870 | out: lpNewFilePointer=0x0) returned 1 [0119.210] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEOLEDB.DLL.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceoledb.dll.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0119.210] GetLastError () returned 0x0 [0119.210] ReadFile (in: hFile=0x208, lpBuffer=0x4120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x354f87c, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesRead=0x354f87c*=0x833a0, lpOverlapped=0x0) returned 1 [0119.305] WriteFile (in: hFile=0x21c, lpBuffer=0x4120020*, nNumberOfBytesToWrite=0x833b0, lpNumberOfBytesWritten=0x354f644, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesWritten=0x354f644*=0x833b0, lpOverlapped=0x0) returned 1 [0119.311] ReadFile (in: hFile=0x208, lpBuffer=0x4120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x354f87c, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesRead=0x354f87c*=0x0, lpOverlapped=0x0) returned 1 [0119.311] WriteFile (in: hFile=0x21c, lpBuffer=0x4120020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x354f644, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesWritten=0x354f644*=0xec, lpOverlapped=0x0) returned 1 [0119.311] SetEndOfFile (hFile=0x21c) returned 1 [0119.311] CloseHandle (hObject=0x21c) returned 1 [0119.312] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f870 | out: lpNewFilePointer=0x0) returned 1 [0119.312] SetEndOfFile (hFile=0x208) returned 1 [0119.315] CloseHandle (hObject=0x208) returned 1 [0119.315] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEOLEDB.DLL.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0119.315] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEOLEDB.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceoledb.dll")) returned 1 [0119.315] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEOLEDB.DLL") returned 68 [0119.315] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEOLEDB.DLL") returned 68 [0119.315] lstrlenW (lpString=".doc") returned 4 [0119.315] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0119.315] lstrlenW (lpString=".docx") returned 5 [0119.315] lstrcmpiW (lpString1=".docx", lpString2="B.DLL") returned -1 [0119.315] lstrlenW (lpString=".pdf") returned 4 [0119.315] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0119.315] lstrlenW (lpString=".xls") returned 4 [0119.315] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0119.315] lstrlenW (lpString=".xlsx") returned 5 [0119.315] lstrcmpiW (lpString1=".xlsx", lpString2="B.DLL") returned -1 [0119.315] lstrlenW (lpString=".ppt") returned 4 [0119.316] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0119.316] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEOLEDB.DLL") returned 68 [0119.316] lstrlenW (lpString=".zip") returned 4 [0119.316] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0119.316] lstrlenW (lpString=".rar") returned 4 [0119.316] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0119.316] lstrlenW (lpString=".bz2") returned 4 [0119.316] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0119.316] lstrlenW (lpString=".7z") returned 3 [0119.316] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0119.316] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEOLEDB.DLL") returned 68 [0119.316] lstrlenW (lpString=".dbf") returned 4 [0119.316] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0119.316] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEOLEDB.DLL") returned 68 [0119.316] lstrlenW (lpString=".1cd") returned 4 [0119.316] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0119.316] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEOLEDB.DLL") returned 68 [0119.316] lstrlenW (lpString=".jpg") returned 4 [0119.316] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0119.316] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEOLEDB.DLL") returned 68 [0119.316] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEOLEDB.DLL") returned 68 [0119.316] lstrlenW (lpString=".doc") returned 4 [0119.316] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0119.316] lstrlenW (lpString=".docx") returned 5 [0119.316] lstrcmpiW (lpString1=".docx", lpString2="B.DLL") returned -1 [0119.316] lstrlenW (lpString=".pdf") returned 4 [0119.316] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0119.316] lstrlenW (lpString=".xls") returned 4 [0119.316] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0119.316] lstrlenW (lpString=".xlsx") returned 5 [0119.316] lstrcmpiW (lpString1=".xlsx", lpString2="B.DLL") returned -1 [0119.316] lstrlenW (lpString=".ppt") returned 4 [0119.316] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0119.316] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEOLEDB.DLL") returned 68 [0119.316] lstrlenW (lpString=".zip") returned 4 [0119.316] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0119.316] lstrlenW (lpString=".rar") returned 4 [0119.316] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0119.316] lstrlenW (lpString=".bz2") returned 4 [0119.316] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0119.316] lstrlenW (lpString=".7z") returned 3 [0119.316] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0119.317] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEOLEDB.DLL") returned 68 [0119.317] lstrlenW (lpString=".dbf") returned 4 [0119.317] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0119.317] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEOLEDB.DLL") returned 68 [0119.317] lstrlenW (lpString=".1cd") returned 4 [0119.317] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0119.317] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEOLEDB.DLL") returned 68 [0119.317] lstrlenW (lpString=".jpg") returned 4 [0119.317] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0119.317] lstrcmpiW (lpString1=".DLL", lpString2=".waifu") returned -1 [0119.317] lstrlenW (lpString="ACEREP.DLL") returned 10 [0119.317] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEREP.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acerep.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0119.318] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x354f8c4 | out: lpFileSize=0x354f8c4*=691616) returned 1 [0119.318] CloseHandle (hObject=0x208) returned 1 [0119.318] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEREP.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acerep.dll")) returned 0x20 [0119.318] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEREP.DLL.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acerep.dll.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0119.318] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEREP.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acerep.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0119.318] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f870 | out: lpNewFilePointer=0x0) returned 1 [0119.318] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f870 | out: lpNewFilePointer=0x0) returned 1 [0119.318] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEREP.DLL.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acerep.dll.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0119.319] GetLastError () returned 0x0 [0119.319] ReadFile (in: hFile=0x208, lpBuffer=0x4120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x354f87c, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesRead=0x354f87c*=0xa8da0, lpOverlapped=0x0) returned 1 [0119.376] WriteFile (in: hFile=0x21c, lpBuffer=0x4120020*, nNumberOfBytesToWrite=0xa8db0, lpNumberOfBytesWritten=0x354f644, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesWritten=0x354f644*=0xa8db0, lpOverlapped=0x0) returned 1 [0119.381] ReadFile (in: hFile=0x208, lpBuffer=0x4120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x354f87c, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesRead=0x354f87c*=0x0, lpOverlapped=0x0) returned 1 [0119.381] WriteFile (in: hFile=0x21c, lpBuffer=0x4120020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x354f644, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesWritten=0x354f644*=0xe8, lpOverlapped=0x0) returned 1 [0119.381] SetEndOfFile (hFile=0x21c) returned 1 [0119.381] CloseHandle (hObject=0x21c) returned 1 [0119.382] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f870 | out: lpNewFilePointer=0x0) returned 1 [0119.382] SetEndOfFile (hFile=0x208) returned 1 [0119.384] CloseHandle (hObject=0x208) returned 1 [0119.384] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEREP.DLL.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0119.384] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEREP.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acerep.dll")) returned 1 [0119.384] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEREP.DLL") returned 66 [0119.384] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEREP.DLL") returned 66 [0119.384] lstrlenW (lpString=".doc") returned 4 [0119.384] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0119.384] lstrlenW (lpString=".docx") returned 5 [0119.384] lstrcmpiW (lpString1=".docx", lpString2="P.DLL") returned -1 [0119.384] lstrlenW (lpString=".pdf") returned 4 [0119.384] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0119.384] lstrlenW (lpString=".xls") returned 4 [0119.384] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0119.384] lstrlenW (lpString=".xlsx") returned 5 [0119.384] lstrcmpiW (lpString1=".xlsx", lpString2="P.DLL") returned -1 [0119.384] lstrlenW (lpString=".ppt") returned 4 [0119.384] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0119.384] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEREP.DLL") returned 66 [0119.384] lstrlenW (lpString=".zip") returned 4 [0119.384] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0119.384] lstrlenW (lpString=".rar") returned 4 [0119.385] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0119.385] lstrlenW (lpString=".bz2") returned 4 [0119.385] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0119.385] lstrlenW (lpString=".7z") returned 3 [0119.385] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0119.385] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEREP.DLL") returned 66 [0119.385] lstrlenW (lpString=".dbf") returned 4 [0119.385] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0119.385] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEREP.DLL") returned 66 [0119.385] lstrlenW (lpString=".1cd") returned 4 [0119.385] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0119.385] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEREP.DLL") returned 66 [0119.385] lstrlenW (lpString=".jpg") returned 4 [0119.385] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0119.385] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEREP.DLL") returned 66 [0119.385] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEREP.DLL") returned 66 [0119.385] lstrlenW (lpString=".doc") returned 4 [0119.385] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0119.385] lstrlenW (lpString=".docx") returned 5 [0119.385] lstrcmpiW (lpString1=".docx", lpString2="P.DLL") returned -1 [0119.385] lstrlenW (lpString=".pdf") returned 4 [0119.385] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0119.385] lstrlenW (lpString=".xls") returned 4 [0119.385] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0119.385] lstrlenW (lpString=".xlsx") returned 5 [0119.385] lstrcmpiW (lpString1=".xlsx", lpString2="P.DLL") returned -1 [0119.385] lstrlenW (lpString=".ppt") returned 4 [0119.385] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0119.385] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEREP.DLL") returned 66 [0119.385] lstrlenW (lpString=".zip") returned 4 [0119.385] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0119.385] lstrlenW (lpString=".rar") returned 4 [0119.385] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0119.385] lstrlenW (lpString=".bz2") returned 4 [0119.385] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0119.385] lstrlenW (lpString=".7z") returned 3 [0119.385] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0119.385] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEREP.DLL") returned 66 [0119.385] lstrlenW (lpString=".dbf") returned 4 [0119.385] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0119.385] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEREP.DLL") returned 66 [0119.385] lstrlenW (lpString=".1cd") returned 4 [0119.385] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0119.385] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEREP.DLL") returned 66 [0119.385] lstrlenW (lpString=".jpg") returned 4 [0119.385] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0119.386] lstrcmpiW (lpString1=".DLL", lpString2=".waifu") returned -1 [0119.386] lstrlenW (lpString="ACEWSS.DLL") returned 10 [0119.386] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWSS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acewss.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0119.406] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x354f8c4 | out: lpFileSize=0x354f8c4*=318368) returned 1 [0119.406] CloseHandle (hObject=0x208) returned 1 [0119.406] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWSS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acewss.dll")) returned 0x20 [0119.406] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWSS.DLL.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acewss.dll.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0119.407] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWSS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acewss.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0119.407] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f870 | out: lpNewFilePointer=0x0) returned 1 [0119.407] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f870 | out: lpNewFilePointer=0x0) returned 1 [0119.407] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWSS.DLL.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acewss.dll.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0119.408] GetLastError () returned 0x0 [0119.408] ReadFile (in: hFile=0x208, lpBuffer=0x4120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x354f87c, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesRead=0x354f87c*=0x4dba0, lpOverlapped=0x0) returned 1 [0119.429] WriteFile (in: hFile=0x21c, lpBuffer=0x4120020*, nNumberOfBytesToWrite=0x4dbb0, lpNumberOfBytesWritten=0x354f644, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesWritten=0x354f644*=0x4dbb0, lpOverlapped=0x0) returned 1 [0119.432] ReadFile (in: hFile=0x208, lpBuffer=0x4120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x354f87c, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesRead=0x354f87c*=0x0, lpOverlapped=0x0) returned 1 [0119.432] WriteFile (in: hFile=0x21c, lpBuffer=0x4120020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x354f644, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesWritten=0x354f644*=0xe8, lpOverlapped=0x0) returned 1 [0119.432] SetEndOfFile (hFile=0x21c) returned 1 [0119.432] CloseHandle (hObject=0x21c) returned 1 [0119.432] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f870 | out: lpNewFilePointer=0x0) returned 1 [0119.432] SetEndOfFile (hFile=0x208) returned 1 [0119.434] CloseHandle (hObject=0x208) returned 1 [0119.434] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWSS.DLL.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0119.434] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWSS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acewss.dll")) returned 1 [0119.434] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWSS.DLL") returned 66 [0119.434] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWSS.DLL") returned 66 [0119.434] lstrlenW (lpString=".doc") returned 4 [0119.434] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0119.434] lstrlenW (lpString=".docx") returned 5 [0119.434] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0119.434] lstrlenW (lpString=".pdf") returned 4 [0119.434] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0119.434] lstrlenW (lpString=".xls") returned 4 [0119.434] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0119.434] lstrlenW (lpString=".xlsx") returned 5 [0119.434] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0119.434] lstrlenW (lpString=".ppt") returned 4 [0119.434] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0119.434] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWSS.DLL") returned 66 [0119.434] lstrlenW (lpString=".zip") returned 4 [0119.434] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0119.435] lstrlenW (lpString=".rar") returned 4 [0119.435] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0119.435] lstrlenW (lpString=".bz2") returned 4 [0119.435] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0119.435] lstrlenW (lpString=".7z") returned 3 [0119.435] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0119.435] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWSS.DLL") returned 66 [0119.435] lstrlenW (lpString=".dbf") returned 4 [0119.435] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0119.435] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWSS.DLL") returned 66 [0119.435] lstrlenW (lpString=".1cd") returned 4 [0119.435] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0119.435] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWSS.DLL") returned 66 [0119.435] lstrlenW (lpString=".jpg") returned 4 [0119.435] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0119.435] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWSS.DLL") returned 66 [0119.435] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWSS.DLL") returned 66 [0119.435] lstrlenW (lpString=".doc") returned 4 [0119.435] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0119.435] lstrlenW (lpString=".docx") returned 5 [0119.435] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0119.435] lstrlenW (lpString=".pdf") returned 4 [0119.435] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0119.435] lstrlenW (lpString=".xls") returned 4 [0119.435] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0119.435] lstrlenW (lpString=".xlsx") returned 5 [0119.435] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0119.435] lstrlenW (lpString=".ppt") returned 4 [0119.435] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0119.435] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWSS.DLL") returned 66 [0119.435] lstrlenW (lpString=".zip") returned 4 [0119.435] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0119.435] lstrlenW (lpString=".rar") returned 4 [0119.435] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0119.435] lstrlenW (lpString=".bz2") returned 4 [0119.435] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0119.435] lstrlenW (lpString=".7z") returned 3 [0119.435] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0119.435] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWSS.DLL") returned 66 [0119.435] lstrlenW (lpString=".dbf") returned 4 [0119.435] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0119.435] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWSS.DLL") returned 66 [0119.435] lstrlenW (lpString=".1cd") returned 4 [0119.435] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0119.435] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWSS.DLL") returned 66 [0119.435] lstrlenW (lpString=".jpg") returned 4 [0119.435] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0119.436] lstrcmpiW (lpString1=".DLL", lpString2=".waifu") returned -1 [0119.436] lstrlenW (lpString="ACEXBE.DLL") returned 10 [0119.436] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEXBE.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acexbe.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0119.437] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x354f8c4 | out: lpFileSize=0x354f8c4*=502168) returned 1 [0119.437] CloseHandle (hObject=0x208) returned 1 [0119.437] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEXBE.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acexbe.dll")) returned 0x20 [0119.437] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEXBE.DLL.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acexbe.dll.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0119.437] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEXBE.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acexbe.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0119.437] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f870 | out: lpNewFilePointer=0x0) returned 1 [0119.437] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f870 | out: lpNewFilePointer=0x0) returned 1 [0119.437] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEXBE.DLL.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acexbe.dll.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0119.438] GetLastError () returned 0x0 [0119.438] ReadFile (in: hFile=0x208, lpBuffer=0x4120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x354f87c, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesRead=0x354f87c*=0x7a998, lpOverlapped=0x0) returned 1 [0119.480] WriteFile (in: hFile=0x21c, lpBuffer=0x4120020*, nNumberOfBytesToWrite=0x7a9a0, lpNumberOfBytesWritten=0x354f644, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesWritten=0x354f644*=0x7a9a0, lpOverlapped=0x0) returned 1 [0119.485] ReadFile (in: hFile=0x208, lpBuffer=0x4120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x354f87c, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesRead=0x354f87c*=0x0, lpOverlapped=0x0) returned 1 [0119.485] WriteFile (in: hFile=0x21c, lpBuffer=0x4120020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x354f644, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesWritten=0x354f644*=0xe8, lpOverlapped=0x0) returned 1 [0119.486] SetEndOfFile (hFile=0x21c) returned 1 [0119.486] CloseHandle (hObject=0x21c) returned 1 [0119.486] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f870 | out: lpNewFilePointer=0x0) returned 1 [0119.486] SetEndOfFile (hFile=0x208) returned 1 [0119.488] CloseHandle (hObject=0x208) returned 1 [0119.488] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEXBE.DLL.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0119.488] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEXBE.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acexbe.dll")) returned 1 [0119.488] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEXBE.DLL") returned 66 [0119.488] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEXBE.DLL") returned 66 [0119.488] lstrlenW (lpString=".doc") returned 4 [0119.488] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0119.488] lstrlenW (lpString=".docx") returned 5 [0119.488] lstrcmpiW (lpString1=".docx", lpString2="E.DLL") returned -1 [0119.488] lstrlenW (lpString=".pdf") returned 4 [0119.488] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0119.488] lstrlenW (lpString=".xls") returned 4 [0119.488] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0119.488] lstrlenW (lpString=".xlsx") returned 5 [0119.488] lstrcmpiW (lpString1=".xlsx", lpString2="E.DLL") returned -1 [0119.488] lstrlenW (lpString=".ppt") returned 4 [0119.488] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0119.488] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEXBE.DLL") returned 66 [0119.488] lstrlenW (lpString=".zip") returned 4 [0119.488] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0119.488] lstrlenW (lpString=".rar") returned 4 [0119.488] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0119.488] lstrlenW (lpString=".bz2") returned 4 [0119.489] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0119.489] lstrlenW (lpString=".7z") returned 3 [0119.489] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0119.489] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEXBE.DLL") returned 66 [0119.489] lstrlenW (lpString=".dbf") returned 4 [0119.489] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0119.489] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEXBE.DLL") returned 66 [0119.489] lstrlenW (lpString=".1cd") returned 4 [0119.489] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0119.489] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEXBE.DLL") returned 66 [0119.489] lstrlenW (lpString=".jpg") returned 4 [0119.489] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0119.489] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEXBE.DLL") returned 66 [0119.489] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEXBE.DLL") returned 66 [0119.489] lstrlenW (lpString=".doc") returned 4 [0119.489] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0119.489] lstrlenW (lpString=".docx") returned 5 [0119.489] lstrcmpiW (lpString1=".docx", lpString2="E.DLL") returned -1 [0119.489] lstrlenW (lpString=".pdf") returned 4 [0119.489] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0119.489] lstrlenW (lpString=".xls") returned 4 [0119.489] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0119.489] lstrlenW (lpString=".xlsx") returned 5 [0119.489] lstrcmpiW (lpString1=".xlsx", lpString2="E.DLL") returned -1 [0119.489] lstrlenW (lpString=".ppt") returned 4 [0119.489] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0119.489] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEXBE.DLL") returned 66 [0119.489] lstrlenW (lpString=".zip") returned 4 [0119.489] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0119.489] lstrlenW (lpString=".rar") returned 4 [0119.490] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0119.490] lstrlenW (lpString=".bz2") returned 4 [0119.490] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0119.490] lstrlenW (lpString=".7z") returned 3 [0119.490] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0119.490] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEXBE.DLL") returned 66 [0119.490] lstrlenW (lpString=".dbf") returned 4 [0119.490] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0119.490] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEXBE.DLL") returned 66 [0119.490] lstrlenW (lpString=".1cd") returned 4 [0119.490] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0119.490] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEXBE.DLL") returned 66 [0119.490] lstrlenW (lpString=".jpg") returned 4 [0119.490] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0119.490] lstrcmpiW (lpString1=".dll", lpString2=".waifu") returned -1 [0119.490] lstrlenW (lpString="CsiSoap.dll") returned 11 [0119.490] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\CsiSoap.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\csisoap.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0119.490] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x354f8c4 | out: lpFileSize=0x354f8c4*=1784192) returned 1 [0119.490] CloseHandle (hObject=0x208) returned 1 [0119.491] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\CsiSoap.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\csisoap.dll")) returned 0x20 [0119.491] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\CsiSoap.dll.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\csisoap.dll.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0119.491] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\CsiSoap.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\csisoap.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\CsiSoap.dll.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\csisoap.dll.id-9c354b42.[darknes@420blaze.it].waifu")) returned 1 [0119.491] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\CsiSoap.dll.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\csisoap.dll.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0119.491] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f614 | out: lpNewFilePointer=0x0) returned 1 [0119.491] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f5d4 | out: lpNewFilePointer=0x0) returned 1 [0119.491] ReadFile (in: hFile=0x208, lpBuffer=0x4120058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x354f5e0, lpOverlapped=0x0 | out: lpBuffer=0x4120058*, lpNumberOfBytesRead=0x354f5e0*=0x40000, lpOverlapped=0x0) returned 1 [0119.506] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x9132a, lpNewFilePointer=0x0, dwMoveMethod=0x354f5d4 | out: lpNewFilePointer=0x0) returned 1 [0119.506] ReadFile (in: hFile=0x208, lpBuffer=0x4160058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x354f5e0, lpOverlapped=0x0 | out: lpBuffer=0x4160058*, lpNumberOfBytesRead=0x354f5e0*=0x40000, lpOverlapped=0x0) returned 1 [0119.520] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x354f614 | out: lpNewFilePointer=0xffffffff) returned 1 [0119.520] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x173980, lpNewFilePointer=0x0, dwMoveMethod=0x354f5d4 | out: lpNewFilePointer=0x0) returned 1 [0119.520] ReadFile (in: hFile=0x208, lpBuffer=0x41a0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x354f5e0, lpOverlapped=0x0 | out: lpBuffer=0x41a0058*, lpNumberOfBytesRead=0x354f5e0*=0x40000, lpOverlapped=0x0) returned 1 [0119.583] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f870 | out: lpNewFilePointer=0x0) returned 1 [0119.583] WriteFile (in: hFile=0x208, lpBuffer=0x4120020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x354f658, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesWritten=0x354f658*=0xc0102, lpOverlapped=0x0) returned 1 [0119.595] SetEndOfFile (hFile=0x208) returned 1 [0119.596] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f624 | out: lpNewFilePointer=0x0) returned 1 [0119.596] WriteFile (in: hFile=0x208, lpBuffer=0x44c2078*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x354f630, lpOverlapped=0x0 | out: lpBuffer=0x44c2078*, lpNumberOfBytesWritten=0x354f630*=0x40000, lpOverlapped=0x0) returned 1 [0119.597] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x9132a, lpNewFilePointer=0x0, dwMoveMethod=0x354f624 | out: lpNewFilePointer=0x0) returned 1 [0119.597] WriteFile (in: hFile=0x208, lpBuffer=0x44c2078*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x354f630, lpOverlapped=0x0 | out: lpBuffer=0x44c2078*, lpNumberOfBytesWritten=0x354f630*=0x40000, lpOverlapped=0x0) returned 1 [0119.599] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x173980, lpNewFilePointer=0x0, dwMoveMethod=0x354f624 | out: lpNewFilePointer=0x0) returned 1 [0119.599] WriteFile (in: hFile=0x208, lpBuffer=0x44c2078*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x354f630, lpOverlapped=0x0 | out: lpBuffer=0x44c2078*, lpNumberOfBytesWritten=0x354f630*=0x40000, lpOverlapped=0x0) returned 1 [0119.600] CloseHandle (hObject=0x208) returned 1 [0119.600] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\CsiSoap.dll.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0119.600] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\CsiSoap.dll") returned 67 [0119.600] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\CsiSoap.dll") returned 67 [0119.606] lstrlenW (lpString=".doc") returned 4 [0119.606] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0119.606] lstrlenW (lpString=".docx") returned 5 [0119.606] lstrcmpiW (lpString1=".docx", lpString2="p.dll") returned -1 [0119.606] lstrlenW (lpString=".pdf") returned 4 [0119.606] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0119.606] lstrlenW (lpString=".xls") returned 4 [0119.606] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0119.606] lstrlenW (lpString=".xlsx") returned 5 [0119.606] lstrcmpiW (lpString1=".xlsx", lpString2="p.dll") returned -1 [0119.606] lstrlenW (lpString=".ppt") returned 4 [0119.606] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0119.606] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\CsiSoap.dll") returned 67 [0119.606] lstrlenW (lpString=".zip") returned 4 [0119.606] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0119.606] lstrlenW (lpString=".rar") returned 4 [0119.606] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0119.606] lstrlenW (lpString=".bz2") returned 4 [0119.606] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0119.606] lstrlenW (lpString=".7z") returned 3 [0119.606] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0119.606] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\CsiSoap.dll") returned 67 [0119.606] lstrlenW (lpString=".dbf") returned 4 [0119.606] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0119.606] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\CsiSoap.dll") returned 67 [0119.606] lstrlenW (lpString=".1cd") returned 4 [0119.606] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0119.606] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\CsiSoap.dll") returned 67 [0119.606] lstrlenW (lpString=".jpg") returned 4 [0119.606] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0119.606] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\CsiSoap.dll") returned 67 [0119.606] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\CsiSoap.dll") returned 67 [0119.606] lstrlenW (lpString=".doc") returned 4 [0119.606] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0119.607] lstrlenW (lpString=".docx") returned 5 [0119.607] lstrcmpiW (lpString1=".docx", lpString2="p.dll") returned -1 [0119.607] lstrlenW (lpString=".pdf") returned 4 [0119.607] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0119.607] lstrlenW (lpString=".xls") returned 4 [0119.607] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0119.607] lstrlenW (lpString=".xlsx") returned 5 [0119.607] lstrcmpiW (lpString1=".xlsx", lpString2="p.dll") returned -1 [0119.607] lstrlenW (lpString=".ppt") returned 4 [0119.607] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0119.607] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\CsiSoap.dll") returned 67 [0119.607] lstrlenW (lpString=".zip") returned 4 [0119.607] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0119.607] lstrlenW (lpString=".rar") returned 4 [0119.607] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0119.607] lstrlenW (lpString=".bz2") returned 4 [0119.607] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0119.607] lstrlenW (lpString=".7z") returned 3 [0119.607] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0119.607] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\CsiSoap.dll") returned 67 [0119.607] lstrlenW (lpString=".dbf") returned 4 [0119.607] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0119.607] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\CsiSoap.dll") returned 67 [0119.607] lstrlenW (lpString=".1cd") returned 4 [0119.607] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0119.607] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\CsiSoap.dll") returned 67 [0119.607] lstrlenW (lpString=".jpg") returned 4 [0119.607] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0119.607] lstrcmpiW (lpString1=".DLL", lpString2=".waifu") returned -1 [0119.607] lstrlenW (lpString="EXP_PDF.DLL") returned 11 [0119.607] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_PDF.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\exp_pdf.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0119.621] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x354f8c4 | out: lpFileSize=0x354f8c4*=138616) returned 1 [0119.621] CloseHandle (hObject=0x19c) returned 1 [0119.621] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_PDF.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\exp_pdf.dll")) returned 0x20 [0119.621] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_PDF.DLL.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\exp_pdf.dll.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0119.621] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_PDF.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\exp_pdf.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0119.621] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f870 | out: lpNewFilePointer=0x0) returned 1 [0119.621] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f870 | out: lpNewFilePointer=0x0) returned 1 [0119.621] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_PDF.DLL.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\exp_pdf.dll.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0119.622] GetLastError () returned 0x0 [0119.622] ReadFile (in: hFile=0x19c, lpBuffer=0x4120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x354f87c, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesRead=0x354f87c*=0x21d78, lpOverlapped=0x0) returned 1 [0119.664] WriteFile (in: hFile=0x1f4, lpBuffer=0x4120020*, nNumberOfBytesToWrite=0x21d80, lpNumberOfBytesWritten=0x354f644, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesWritten=0x354f644*=0x21d80, lpOverlapped=0x0) returned 1 [0119.666] ReadFile (in: hFile=0x19c, lpBuffer=0x4120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x354f87c, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesRead=0x354f87c*=0x0, lpOverlapped=0x0) returned 1 [0119.666] WriteFile (in: hFile=0x1f4, lpBuffer=0x4120020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x354f644, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesWritten=0x354f644*=0xea, lpOverlapped=0x0) returned 1 [0119.666] SetEndOfFile (hFile=0x1f4) returned 1 [0119.666] CloseHandle (hObject=0x1f4) returned 1 [0119.666] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f870 | out: lpNewFilePointer=0x0) returned 1 [0119.666] SetEndOfFile (hFile=0x19c) returned 1 [0119.667] CloseHandle (hObject=0x19c) returned 1 [0119.667] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_PDF.DLL.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0119.667] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_PDF.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\exp_pdf.dll")) returned 1 [0119.668] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_PDF.DLL") returned 67 [0119.668] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_PDF.DLL") returned 67 [0119.668] lstrlenW (lpString=".doc") returned 4 [0119.668] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0119.668] lstrlenW (lpString=".docx") returned 5 [0119.668] lstrcmpiW (lpString1=".docx", lpString2="F.DLL") returned -1 [0119.668] lstrlenW (lpString=".pdf") returned 4 [0119.668] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0119.668] lstrlenW (lpString=".xls") returned 4 [0119.668] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0119.668] lstrlenW (lpString=".xlsx") returned 5 [0119.668] lstrcmpiW (lpString1=".xlsx", lpString2="F.DLL") returned -1 [0119.668] lstrlenW (lpString=".ppt") returned 4 [0119.668] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0119.668] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_PDF.DLL") returned 67 [0119.668] lstrlenW (lpString=".zip") returned 4 [0119.668] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0119.668] lstrlenW (lpString=".rar") returned 4 [0119.668] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0119.668] lstrlenW (lpString=".bz2") returned 4 [0119.668] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0119.668] lstrlenW (lpString=".7z") returned 3 [0119.668] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0119.670] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_PDF.DLL") returned 67 [0119.670] lstrlenW (lpString=".dbf") returned 4 [0119.670] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0119.670] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_PDF.DLL") returned 67 [0119.670] lstrlenW (lpString=".1cd") returned 4 [0119.670] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0119.670] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_PDF.DLL") returned 67 [0119.670] lstrlenW (lpString=".jpg") returned 4 [0119.670] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0119.670] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_PDF.DLL") returned 67 [0119.671] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_PDF.DLL") returned 67 [0119.671] lstrlenW (lpString=".doc") returned 4 [0119.671] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0119.671] lstrlenW (lpString=".docx") returned 5 [0119.671] lstrcmpiW (lpString1=".docx", lpString2="F.DLL") returned -1 [0119.671] lstrlenW (lpString=".pdf") returned 4 [0119.671] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0119.671] lstrlenW (lpString=".xls") returned 4 [0119.671] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0119.671] lstrlenW (lpString=".xlsx") returned 5 [0119.671] lstrcmpiW (lpString1=".xlsx", lpString2="F.DLL") returned -1 [0119.671] lstrlenW (lpString=".ppt") returned 4 [0119.671] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0119.671] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_PDF.DLL") returned 67 [0119.671] lstrlenW (lpString=".zip") returned 4 [0119.671] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0119.671] lstrlenW (lpString=".rar") returned 4 [0119.671] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0119.671] lstrlenW (lpString=".bz2") returned 4 [0119.671] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0119.671] lstrlenW (lpString=".7z") returned 3 [0119.671] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0119.671] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_PDF.DLL") returned 67 [0119.671] lstrlenW (lpString=".dbf") returned 4 [0119.671] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0119.671] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_PDF.DLL") returned 67 [0119.671] lstrlenW (lpString=".1cd") returned 4 [0119.671] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0119.672] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_PDF.DLL") returned 67 [0119.672] lstrlenW (lpString=".jpg") returned 4 [0119.672] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0119.672] lstrcmpiW (lpString1=".EXE", lpString2=".waifu") returned -1 [0119.672] lstrlenW (lpString="FLTLDR.EXE") returned 10 [0119.672] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\FLTLDR.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\fltldr.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0119.679] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x354f8c4 | out: lpFileSize=0x354f8c4*=157024) returned 1 [0119.679] CloseHandle (hObject=0x1fc) returned 1 [0119.679] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\FLTLDR.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\fltldr.exe")) returned 0x20 [0119.680] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\FLTLDR.EXE.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\fltldr.exe.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0119.680] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\FLTLDR.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\fltldr.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0119.680] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f870 | out: lpNewFilePointer=0x0) returned 1 [0119.680] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f870 | out: lpNewFilePointer=0x0) returned 1 [0119.680] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\FLTLDR.EXE.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\fltldr.exe.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0119.689] GetLastError () returned 0x0 [0119.689] ReadFile (in: hFile=0x1fc, lpBuffer=0x4120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x354f87c, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesRead=0x354f87c*=0x26560, lpOverlapped=0x0) returned 1 [0119.791] WriteFile (in: hFile=0x228, lpBuffer=0x4120020*, nNumberOfBytesToWrite=0x26570, lpNumberOfBytesWritten=0x354f644, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesWritten=0x354f644*=0x26570, lpOverlapped=0x0) returned 1 [0119.793] ReadFile (in: hFile=0x1fc, lpBuffer=0x4120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x354f87c, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesRead=0x354f87c*=0x0, lpOverlapped=0x0) returned 1 [0119.793] WriteFile (in: hFile=0x228, lpBuffer=0x4120020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x354f644, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesWritten=0x354f644*=0xe8, lpOverlapped=0x0) returned 1 [0119.793] SetEndOfFile (hFile=0x228) returned 1 [0119.793] CloseHandle (hObject=0x228) returned 1 [0119.793] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f870 | out: lpNewFilePointer=0x0) returned 1 [0119.793] SetEndOfFile (hFile=0x1fc) returned 1 [0119.794] CloseHandle (hObject=0x1fc) returned 1 [0119.794] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\FLTLDR.EXE.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0119.794] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\FLTLDR.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\fltldr.exe")) returned 1 [0119.794] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\FLTLDR.EXE") returned 66 [0119.794] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\FLTLDR.EXE") returned 66 [0119.794] lstrlenW (lpString=".doc") returned 4 [0119.794] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0119.794] lstrlenW (lpString=".docx") returned 5 [0119.794] lstrcmpiW (lpString1=".docx", lpString2="R.EXE") returned -1 [0119.794] lstrlenW (lpString=".pdf") returned 4 [0119.794] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0119.794] lstrlenW (lpString=".xls") returned 4 [0119.794] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0119.794] lstrlenW (lpString=".xlsx") returned 5 [0119.794] lstrcmpiW (lpString1=".xlsx", lpString2="R.EXE") returned -1 [0119.794] lstrlenW (lpString=".ppt") returned 4 [0119.794] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0119.794] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\FLTLDR.EXE") returned 66 [0119.795] lstrlenW (lpString=".zip") returned 4 [0119.795] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0119.795] lstrlenW (lpString=".rar") returned 4 [0119.795] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0119.795] lstrlenW (lpString=".bz2") returned 4 [0119.795] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0119.795] lstrlenW (lpString=".7z") returned 3 [0119.795] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0119.795] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\FLTLDR.EXE") returned 66 [0119.795] lstrlenW (lpString=".dbf") returned 4 [0119.795] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0119.795] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\FLTLDR.EXE") returned 66 [0119.795] lstrlenW (lpString=".1cd") returned 4 [0119.795] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0119.795] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\FLTLDR.EXE") returned 66 [0119.795] lstrlenW (lpString=".jpg") returned 4 [0119.795] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0119.795] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\FLTLDR.EXE") returned 66 [0119.795] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\FLTLDR.EXE") returned 66 [0119.795] lstrlenW (lpString=".doc") returned 4 [0119.795] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0119.795] lstrlenW (lpString=".docx") returned 5 [0119.795] lstrcmpiW (lpString1=".docx", lpString2="R.EXE") returned -1 [0119.795] lstrlenW (lpString=".pdf") returned 4 [0119.795] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0119.795] lstrlenW (lpString=".xls") returned 4 [0119.795] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0119.795] lstrlenW (lpString=".xlsx") returned 5 [0119.795] lstrcmpiW (lpString1=".xlsx", lpString2="R.EXE") returned -1 [0119.795] lstrlenW (lpString=".ppt") returned 4 [0119.795] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0119.795] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\FLTLDR.EXE") returned 66 [0119.795] lstrlenW (lpString=".zip") returned 4 [0119.795] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0119.795] lstrlenW (lpString=".rar") returned 4 [0119.795] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0119.795] lstrlenW (lpString=".bz2") returned 4 [0119.795] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0119.795] lstrlenW (lpString=".7z") returned 3 [0119.795] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0119.795] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\FLTLDR.EXE") returned 66 [0119.796] lstrlenW (lpString=".dbf") returned 4 [0119.796] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0119.796] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\FLTLDR.EXE") returned 66 [0119.796] lstrlenW (lpString=".1cd") returned 4 [0119.796] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0119.796] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\FLTLDR.EXE") returned 66 [0119.796] lstrlenW (lpString=".jpg") returned 4 [0119.796] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0119.796] lstrcmpiW (lpString1=".EXE", lpString2=".waifu") returned -1 [0119.796] lstrlenW (lpString="LICLUA.EXE") returned 10 [0119.796] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\LICLUA.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\liclua.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0119.796] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x354f8c4 | out: lpFileSize=0x354f8c4*=204168) returned 1 [0119.796] CloseHandle (hObject=0x1fc) returned 1 [0119.796] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\LICLUA.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\liclua.exe")) returned 0x20 [0119.796] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\LICLUA.EXE.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\liclua.exe.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0119.796] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\LICLUA.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\liclua.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0119.796] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f870 | out: lpNewFilePointer=0x0) returned 1 [0119.797] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f870 | out: lpNewFilePointer=0x0) returned 1 [0119.797] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\LICLUA.EXE.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\liclua.exe.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0119.797] GetLastError () returned 0x0 [0119.797] ReadFile (in: hFile=0x1fc, lpBuffer=0x4120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x354f87c, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesRead=0x354f87c*=0x31d88, lpOverlapped=0x0) returned 1 [0119.943] WriteFile (in: hFile=0x228, lpBuffer=0x4120020*, nNumberOfBytesToWrite=0x31d90, lpNumberOfBytesWritten=0x354f644, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesWritten=0x354f644*=0x31d90, lpOverlapped=0x0) returned 1 [0119.946] ReadFile (in: hFile=0x1fc, lpBuffer=0x4120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x354f87c, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesRead=0x354f87c*=0x0, lpOverlapped=0x0) returned 1 [0119.946] WriteFile (in: hFile=0x228, lpBuffer=0x4120020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x354f644, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesWritten=0x354f644*=0xe8, lpOverlapped=0x0) returned 1 [0119.946] SetEndOfFile (hFile=0x228) returned 1 [0119.946] CloseHandle (hObject=0x228) returned 1 [0119.946] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f870 | out: lpNewFilePointer=0x0) returned 1 [0119.946] SetEndOfFile (hFile=0x1fc) returned 1 [0119.947] CloseHandle (hObject=0x1fc) returned 1 [0119.947] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\LICLUA.EXE.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0119.947] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\LICLUA.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\liclua.exe")) returned 1 [0119.948] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\LICLUA.EXE") returned 66 [0119.948] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\LICLUA.EXE") returned 66 [0119.948] lstrlenW (lpString=".doc") returned 4 [0119.948] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0119.948] lstrlenW (lpString=".docx") returned 5 [0119.948] lstrcmpiW (lpString1=".docx", lpString2="A.EXE") returned -1 [0119.948] lstrlenW (lpString=".pdf") returned 4 [0119.948] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0119.948] lstrlenW (lpString=".xls") returned 4 [0119.948] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0119.948] lstrlenW (lpString=".xlsx") returned 5 [0119.948] lstrcmpiW (lpString1=".xlsx", lpString2="A.EXE") returned -1 [0119.948] lstrlenW (lpString=".ppt") returned 4 [0119.948] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0119.948] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\LICLUA.EXE") returned 66 [0119.948] lstrlenW (lpString=".zip") returned 4 [0119.948] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0119.948] lstrlenW (lpString=".rar") returned 4 [0119.948] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0119.948] lstrlenW (lpString=".bz2") returned 4 [0119.948] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0119.948] lstrlenW (lpString=".7z") returned 3 [0119.948] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0119.948] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\LICLUA.EXE") returned 66 [0119.948] lstrlenW (lpString=".dbf") returned 4 [0119.948] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0119.948] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\LICLUA.EXE") returned 66 [0119.948] lstrlenW (lpString=".1cd") returned 4 [0119.948] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0119.948] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\LICLUA.EXE") returned 66 [0119.948] lstrlenW (lpString=".jpg") returned 4 [0119.948] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0119.948] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\LICLUA.EXE") returned 66 [0119.948] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\LICLUA.EXE") returned 66 [0119.948] lstrlenW (lpString=".doc") returned 4 [0119.948] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0119.948] lstrlenW (lpString=".docx") returned 5 [0119.948] lstrcmpiW (lpString1=".docx", lpString2="A.EXE") returned -1 [0119.948] lstrlenW (lpString=".pdf") returned 4 [0119.948] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0119.948] lstrlenW (lpString=".xls") returned 4 [0119.948] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0119.948] lstrlenW (lpString=".xlsx") returned 5 [0119.948] lstrcmpiW (lpString1=".xlsx", lpString2="A.EXE") returned -1 [0119.948] lstrlenW (lpString=".ppt") returned 4 [0119.948] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0119.948] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\LICLUA.EXE") returned 66 [0119.948] lstrlenW (lpString=".zip") returned 4 [0119.948] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0119.948] lstrlenW (lpString=".rar") returned 4 [0119.949] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0119.949] lstrlenW (lpString=".bz2") returned 4 [0119.949] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0119.949] lstrlenW (lpString=".7z") returned 3 [0119.949] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0119.949] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\LICLUA.EXE") returned 66 [0119.949] lstrlenW (lpString=".dbf") returned 4 [0119.949] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0119.949] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\LICLUA.EXE") returned 66 [0119.949] lstrlenW (lpString=".1cd") returned 4 [0119.949] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0119.949] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\LICLUA.EXE") returned 66 [0119.949] lstrlenW (lpString=".jpg") returned 4 [0119.949] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0119.949] lstrcmpiW (lpString1=".EXE", lpString2=".waifu") returned -1 [0119.949] lstrlenW (lpString="MSOICONS.EXE") returned 12 [0119.949] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOICONS.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoicons.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0119.950] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x354f8c4 | out: lpFileSize=0x354f8c4*=473952) returned 1 [0119.950] CloseHandle (hObject=0x1fc) returned 1 [0119.950] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOICONS.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoicons.exe")) returned 0x20 [0119.950] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOICONS.EXE.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoicons.exe.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0119.950] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOICONS.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoicons.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0119.950] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f870 | out: lpNewFilePointer=0x0) returned 1 [0119.950] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f870 | out: lpNewFilePointer=0x0) returned 1 [0119.950] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOICONS.EXE.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoicons.exe.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0119.951] GetLastError () returned 0x0 [0119.951] ReadFile (in: hFile=0x1fc, lpBuffer=0x4120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x354f87c, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesRead=0x354f87c*=0x73b60, lpOverlapped=0x0) returned 1 [0120.147] WriteFile (in: hFile=0x228, lpBuffer=0x4120020*, nNumberOfBytesToWrite=0x73b70, lpNumberOfBytesWritten=0x354f644, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesWritten=0x354f644*=0x73b70, lpOverlapped=0x0) returned 1 [0120.151] ReadFile (in: hFile=0x1fc, lpBuffer=0x4120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x354f87c, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesRead=0x354f87c*=0x0, lpOverlapped=0x0) returned 1 [0120.151] WriteFile (in: hFile=0x228, lpBuffer=0x4120020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x354f644, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesWritten=0x354f644*=0xec, lpOverlapped=0x0) returned 1 [0120.151] SetEndOfFile (hFile=0x228) returned 1 [0120.151] CloseHandle (hObject=0x228) returned 1 [0120.151] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f870 | out: lpNewFilePointer=0x0) returned 1 [0120.151] SetEndOfFile (hFile=0x1fc) returned 1 [0120.153] CloseHandle (hObject=0x1fc) returned 1 [0120.153] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOICONS.EXE.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0120.153] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOICONS.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoicons.exe")) returned 1 [0120.154] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOICONS.EXE") returned 68 [0120.154] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOICONS.EXE") returned 68 [0120.154] lstrlenW (lpString=".doc") returned 4 [0120.154] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0120.154] lstrlenW (lpString=".docx") returned 5 [0120.154] lstrcmpiW (lpString1=".docx", lpString2="S.EXE") returned -1 [0120.154] lstrlenW (lpString=".pdf") returned 4 [0120.154] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0120.154] lstrlenW (lpString=".xls") returned 4 [0120.154] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0120.154] lstrlenW (lpString=".xlsx") returned 5 [0120.154] lstrcmpiW (lpString1=".xlsx", lpString2="S.EXE") returned -1 [0120.154] lstrlenW (lpString=".ppt") returned 4 [0120.154] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0120.154] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOICONS.EXE") returned 68 [0120.154] lstrlenW (lpString=".zip") returned 4 [0120.154] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0120.154] lstrlenW (lpString=".rar") returned 4 [0120.154] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0120.154] lstrlenW (lpString=".bz2") returned 4 [0120.154] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0120.154] lstrlenW (lpString=".7z") returned 3 [0120.154] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0120.154] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOICONS.EXE") returned 68 [0120.154] lstrlenW (lpString=".dbf") returned 4 [0120.154] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0120.154] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOICONS.EXE") returned 68 [0120.154] lstrlenW (lpString=".1cd") returned 4 [0120.154] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0120.154] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOICONS.EXE") returned 68 [0120.154] lstrlenW (lpString=".jpg") returned 4 [0120.154] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0120.155] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOICONS.EXE") returned 68 [0120.155] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOICONS.EXE") returned 68 [0120.155] lstrlenW (lpString=".doc") returned 4 [0120.155] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0120.155] lstrlenW (lpString=".docx") returned 5 [0120.155] lstrcmpiW (lpString1=".docx", lpString2="S.EXE") returned -1 [0120.155] lstrlenW (lpString=".pdf") returned 4 [0120.155] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0120.155] lstrlenW (lpString=".xls") returned 4 [0120.155] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0120.155] lstrlenW (lpString=".xlsx") returned 5 [0120.155] lstrcmpiW (lpString1=".xlsx", lpString2="S.EXE") returned -1 [0120.155] lstrlenW (lpString=".ppt") returned 4 [0120.155] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0120.155] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOICONS.EXE") returned 68 [0120.155] lstrlenW (lpString=".zip") returned 4 [0120.155] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0120.155] lstrlenW (lpString=".rar") returned 4 [0120.155] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0120.155] lstrlenW (lpString=".bz2") returned 4 [0120.155] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0120.155] lstrlenW (lpString=".7z") returned 3 [0120.155] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0120.155] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOICONS.EXE") returned 68 [0120.155] lstrlenW (lpString=".dbf") returned 4 [0120.155] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0120.155] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOICONS.EXE") returned 68 [0120.155] lstrlenW (lpString=".1cd") returned 4 [0120.155] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0120.155] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOICONS.EXE") returned 68 [0120.155] lstrlenW (lpString=".jpg") returned 4 [0120.155] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0120.156] lstrcmpiW (lpString1=".DLL", lpString2=".waifu") returned -1 [0120.156] lstrlenW (lpString="MSOXEV.DLL") returned 10 [0120.156] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXEV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoxev.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0120.157] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x354f8c4 | out: lpFileSize=0x354f8c4*=56144) returned 1 [0120.157] CloseHandle (hObject=0x1fc) returned 1 [0120.157] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXEV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoxev.dll")) returned 0x20 [0120.157] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXEV.DLL.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoxev.dll.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0120.157] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXEV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoxev.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0120.157] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f870 | out: lpNewFilePointer=0x0) returned 1 [0120.157] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f870 | out: lpNewFilePointer=0x0) returned 1 [0120.157] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXEV.DLL.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoxev.dll.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0120.158] GetLastError () returned 0x0 [0120.158] ReadFile (in: hFile=0x1fc, lpBuffer=0x4120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x354f87c, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesRead=0x354f87c*=0xdb50, lpOverlapped=0x0) returned 1 [0120.247] WriteFile (in: hFile=0x228, lpBuffer=0x4120020*, nNumberOfBytesToWrite=0xdb60, lpNumberOfBytesWritten=0x354f644, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesWritten=0x354f644*=0xdb60, lpOverlapped=0x0) returned 1 [0120.249] ReadFile (in: hFile=0x1fc, lpBuffer=0x4120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x354f87c, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesRead=0x354f87c*=0x0, lpOverlapped=0x0) returned 1 [0120.249] WriteFile (in: hFile=0x228, lpBuffer=0x4120020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x354f644, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesWritten=0x354f644*=0xe8, lpOverlapped=0x0) returned 1 [0120.249] SetEndOfFile (hFile=0x228) returned 1 [0120.249] CloseHandle (hObject=0x228) returned 1 [0120.249] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f870 | out: lpNewFilePointer=0x0) returned 1 [0120.249] SetEndOfFile (hFile=0x1fc) returned 1 [0120.250] CloseHandle (hObject=0x1fc) returned 1 [0120.250] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXEV.DLL.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0120.250] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXEV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoxev.dll")) returned 1 [0120.251] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXEV.DLL") returned 66 [0120.251] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXEV.DLL") returned 66 [0120.251] lstrlenW (lpString=".doc") returned 4 [0120.251] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0120.251] lstrlenW (lpString=".docx") returned 5 [0120.251] lstrcmpiW (lpString1=".docx", lpString2="V.DLL") returned -1 [0120.251] lstrlenW (lpString=".pdf") returned 4 [0120.251] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0120.251] lstrlenW (lpString=".xls") returned 4 [0120.251] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0120.251] lstrlenW (lpString=".xlsx") returned 5 [0120.251] lstrcmpiW (lpString1=".xlsx", lpString2="V.DLL") returned -1 [0120.251] lstrlenW (lpString=".ppt") returned 4 [0120.251] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0120.251] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXEV.DLL") returned 66 [0120.251] lstrlenW (lpString=".zip") returned 4 [0120.251] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0120.251] lstrlenW (lpString=".rar") returned 4 [0120.251] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0120.251] lstrlenW (lpString=".bz2") returned 4 [0120.251] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0120.251] lstrlenW (lpString=".7z") returned 3 [0120.251] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0120.251] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXEV.DLL") returned 66 [0120.251] lstrlenW (lpString=".dbf") returned 4 [0120.251] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0120.251] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXEV.DLL") returned 66 [0120.251] lstrlenW (lpString=".1cd") returned 4 [0120.251] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0120.251] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXEV.DLL") returned 66 [0120.251] lstrlenW (lpString=".jpg") returned 4 [0120.251] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0120.252] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXEV.DLL") returned 66 [0120.252] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXEV.DLL") returned 66 [0120.252] lstrlenW (lpString=".doc") returned 4 [0120.252] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0120.252] lstrlenW (lpString=".docx") returned 5 [0120.252] lstrcmpiW (lpString1=".docx", lpString2="V.DLL") returned -1 [0120.252] lstrlenW (lpString=".pdf") returned 4 [0120.252] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0120.252] lstrlenW (lpString=".xls") returned 4 [0120.252] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0120.252] lstrlenW (lpString=".xlsx") returned 5 [0120.252] lstrcmpiW (lpString1=".xlsx", lpString2="V.DLL") returned -1 [0120.252] lstrlenW (lpString=".ppt") returned 4 [0120.252] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0120.252] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXEV.DLL") returned 66 [0120.252] lstrlenW (lpString=".zip") returned 4 [0120.252] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0120.252] lstrlenW (lpString=".rar") returned 4 [0120.252] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0120.252] lstrlenW (lpString=".bz2") returned 4 [0120.252] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0120.252] lstrlenW (lpString=".7z") returned 3 [0120.252] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0120.252] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXEV.DLL") returned 66 [0120.252] lstrlenW (lpString=".dbf") returned 4 [0120.252] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0120.252] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXEV.DLL") returned 66 [0120.252] lstrlenW (lpString=".1cd") returned 4 [0120.252] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0120.252] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXEV.DLL") returned 66 [0120.252] lstrlenW (lpString=".jpg") returned 4 [0120.252] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0120.252] lstrcmpiW (lpString1=".EXE", lpString2=".waifu") returned -1 [0120.252] lstrlenW (lpString="MSOXMLED.EXE") returned 12 [0120.252] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLED.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoxmled.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0120.277] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x354f8c4 | out: lpFileSize=0x354f8c4*=121168) returned 1 [0120.277] CloseHandle (hObject=0x1b0) returned 1 [0120.278] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLED.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoxmled.exe")) returned 0x20 [0120.278] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLED.EXE.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoxmled.exe.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0120.278] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLED.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoxmled.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0120.278] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f870 | out: lpNewFilePointer=0x0) returned 1 [0120.278] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f870 | out: lpNewFilePointer=0x0) returned 1 [0120.278] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLED.EXE.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoxmled.exe.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0120.278] GetLastError () returned 0x0 [0120.278] ReadFile (in: hFile=0x1b0, lpBuffer=0x4120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x354f87c, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesRead=0x354f87c*=0x1d950, lpOverlapped=0x0) returned 1 [0120.287] WriteFile (in: hFile=0x170, lpBuffer=0x4120020*, nNumberOfBytesToWrite=0x1d960, lpNumberOfBytesWritten=0x354f644, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesWritten=0x354f644*=0x1d960, lpOverlapped=0x0) returned 1 [0120.289] ReadFile (in: hFile=0x1b0, lpBuffer=0x4120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x354f87c, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesRead=0x354f87c*=0x0, lpOverlapped=0x0) returned 1 [0120.289] WriteFile (in: hFile=0x170, lpBuffer=0x4120020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x354f644, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesWritten=0x354f644*=0xec, lpOverlapped=0x0) returned 1 [0120.289] SetEndOfFile (hFile=0x170) returned 1 [0120.289] CloseHandle (hObject=0x170) returned 1 [0120.289] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f870 | out: lpNewFilePointer=0x0) returned 1 [0120.289] SetEndOfFile (hFile=0x1b0) returned 1 [0120.290] CloseHandle (hObject=0x1b0) returned 1 [0120.290] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLED.EXE.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0120.290] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLED.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoxmled.exe")) returned 1 [0120.290] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLED.EXE") returned 68 [0120.290] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLED.EXE") returned 68 [0120.290] lstrlenW (lpString=".doc") returned 4 [0120.290] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0120.290] lstrlenW (lpString=".docx") returned 5 [0120.290] lstrcmpiW (lpString1=".docx", lpString2="D.EXE") returned -1 [0120.290] lstrlenW (lpString=".pdf") returned 4 [0120.290] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0120.290] lstrlenW (lpString=".xls") returned 4 [0120.290] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0120.290] lstrlenW (lpString=".xlsx") returned 5 [0120.290] lstrcmpiW (lpString1=".xlsx", lpString2="D.EXE") returned -1 [0120.290] lstrlenW (lpString=".ppt") returned 4 [0120.290] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0120.291] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLED.EXE") returned 68 [0120.291] lstrlenW (lpString=".zip") returned 4 [0120.291] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0120.291] lstrlenW (lpString=".rar") returned 4 [0120.291] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0120.291] lstrlenW (lpString=".bz2") returned 4 [0120.291] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0120.291] lstrlenW (lpString=".7z") returned 3 [0120.291] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0120.291] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLED.EXE") returned 68 [0120.291] lstrlenW (lpString=".dbf") returned 4 [0120.291] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0120.291] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLED.EXE") returned 68 [0120.291] lstrlenW (lpString=".1cd") returned 4 [0120.291] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0120.291] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLED.EXE") returned 68 [0120.291] lstrlenW (lpString=".jpg") returned 4 [0120.291] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0120.291] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLED.EXE") returned 68 [0120.291] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLED.EXE") returned 68 [0120.291] lstrlenW (lpString=".doc") returned 4 [0120.291] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0120.291] lstrlenW (lpString=".docx") returned 5 [0120.291] lstrcmpiW (lpString1=".docx", lpString2="D.EXE") returned -1 [0120.291] lstrlenW (lpString=".pdf") returned 4 [0120.291] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0120.291] lstrlenW (lpString=".xls") returned 4 [0120.291] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0120.291] lstrlenW (lpString=".xlsx") returned 5 [0120.291] lstrcmpiW (lpString1=".xlsx", lpString2="D.EXE") returned -1 [0120.291] lstrlenW (lpString=".ppt") returned 4 [0120.291] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0120.291] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLED.EXE") returned 68 [0120.291] lstrlenW (lpString=".zip") returned 4 [0120.291] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0120.291] lstrlenW (lpString=".rar") returned 4 [0120.291] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0120.291] lstrlenW (lpString=".bz2") returned 4 [0120.291] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0120.291] lstrlenW (lpString=".7z") returned 3 [0120.291] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0120.291] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLED.EXE") returned 68 [0120.291] lstrlenW (lpString=".dbf") returned 4 [0120.292] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0120.292] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLED.EXE") returned 68 [0120.292] lstrlenW (lpString=".1cd") returned 4 [0120.292] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0120.292] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLED.EXE") returned 68 [0120.292] lstrlenW (lpString=".jpg") returned 4 [0120.292] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0120.292] lstrcmpiW (lpString1=".DLL", lpString2=".waifu") returned -1 [0120.292] lstrlenW (lpString="MSSOAP30.DLL") returned 12 [0120.292] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSSOAP30.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\mssoap30.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0120.293] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x354f8c4 | out: lpFileSize=0x354f8c4*=705392) returned 1 [0120.293] CloseHandle (hObject=0x1b0) returned 1 [0120.293] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSSOAP30.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\mssoap30.dll")) returned 0x20 [0120.293] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSSOAP30.DLL.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\mssoap30.dll.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0120.293] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSSOAP30.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\mssoap30.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0120.293] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f870 | out: lpNewFilePointer=0x0) returned 1 [0120.293] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f870 | out: lpNewFilePointer=0x0) returned 1 [0120.293] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSSOAP30.DLL.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\mssoap30.dll.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0120.294] GetLastError () returned 0x0 [0120.294] ReadFile (in: hFile=0x1b0, lpBuffer=0x4120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x354f87c, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesRead=0x354f87c*=0xac370, lpOverlapped=0x0) returned 1 [0120.384] WriteFile (in: hFile=0x170, lpBuffer=0x4120020*, nNumberOfBytesToWrite=0xac380, lpNumberOfBytesWritten=0x354f644, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesWritten=0x354f644*=0xac380, lpOverlapped=0x0) returned 1 [0120.390] ReadFile (in: hFile=0x1b0, lpBuffer=0x4120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x354f87c, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesRead=0x354f87c*=0x0, lpOverlapped=0x0) returned 1 [0120.390] WriteFile (in: hFile=0x170, lpBuffer=0x4120020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x354f644, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesWritten=0x354f644*=0xec, lpOverlapped=0x0) returned 1 [0120.390] SetEndOfFile (hFile=0x170) returned 1 [0120.390] CloseHandle (hObject=0x170) returned 1 [0120.391] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f870 | out: lpNewFilePointer=0x0) returned 1 [0120.391] SetEndOfFile (hFile=0x1b0) returned 1 [0120.392] CloseHandle (hObject=0x1b0) returned 1 [0120.392] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSSOAP30.DLL.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0120.393] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSSOAP30.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\mssoap30.dll")) returned 1 [0120.393] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSSOAP30.DLL") returned 68 [0120.393] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSSOAP30.DLL") returned 68 [0120.393] lstrlenW (lpString=".doc") returned 4 [0120.393] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0120.393] lstrlenW (lpString=".docx") returned 5 [0120.393] lstrcmpiW (lpString1=".docx", lpString2="0.DLL") returned -1 [0120.393] lstrlenW (lpString=".pdf") returned 4 [0120.393] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0120.393] lstrlenW (lpString=".xls") returned 4 [0120.393] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0120.393] lstrlenW (lpString=".xlsx") returned 5 [0120.393] lstrcmpiW (lpString1=".xlsx", lpString2="0.DLL") returned -1 [0120.393] lstrlenW (lpString=".ppt") returned 4 [0120.393] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0120.393] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSSOAP30.DLL") returned 68 [0120.393] lstrlenW (lpString=".zip") returned 4 [0120.393] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0120.393] lstrlenW (lpString=".rar") returned 4 [0120.393] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0120.393] lstrlenW (lpString=".bz2") returned 4 [0120.393] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0120.393] lstrlenW (lpString=".7z") returned 3 [0120.393] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0120.393] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSSOAP30.DLL") returned 68 [0120.393] lstrlenW (lpString=".dbf") returned 4 [0120.393] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0120.393] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSSOAP30.DLL") returned 68 [0120.393] lstrlenW (lpString=".1cd") returned 4 [0120.393] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0120.393] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSSOAP30.DLL") returned 68 [0120.393] lstrlenW (lpString=".jpg") returned 4 [0120.393] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0120.394] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSSOAP30.DLL") returned 68 [0120.394] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSSOAP30.DLL") returned 68 [0120.394] lstrlenW (lpString=".doc") returned 4 [0120.394] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0120.394] lstrlenW (lpString=".docx") returned 5 [0120.394] lstrcmpiW (lpString1=".docx", lpString2="0.DLL") returned -1 [0120.394] lstrlenW (lpString=".pdf") returned 4 [0120.394] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0120.394] lstrlenW (lpString=".xls") returned 4 [0120.394] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0120.394] lstrlenW (lpString=".xlsx") returned 5 [0120.394] lstrcmpiW (lpString1=".xlsx", lpString2="0.DLL") returned -1 [0120.394] lstrlenW (lpString=".ppt") returned 4 [0120.394] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0120.394] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSSOAP30.DLL") returned 68 [0120.394] lstrlenW (lpString=".zip") returned 4 [0120.394] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0120.394] lstrlenW (lpString=".rar") returned 4 [0120.394] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0120.394] lstrlenW (lpString=".bz2") returned 4 [0120.394] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0120.394] lstrlenW (lpString=".7z") returned 3 [0120.394] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0120.394] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSSOAP30.DLL") returned 68 [0120.394] lstrlenW (lpString=".dbf") returned 4 [0120.394] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0120.394] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSSOAP30.DLL") returned 68 [0120.394] lstrlenW (lpString=".1cd") returned 4 [0120.394] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0120.394] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSSOAP30.DLL") returned 68 [0120.394] lstrlenW (lpString=".jpg") returned 4 [0120.394] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0120.394] lstrcmpiW (lpString1=".CAB", lpString2=".waifu") returned -1 [0120.394] lstrlenW (lpString="MUAUTH.CAB") returned 10 [0120.394] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\muauth.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0120.415] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x354f8c4 | out: lpFileSize=0x354f8c4*=6747) returned 1 [0120.415] CloseHandle (hObject=0x1b0) returned 1 [0120.415] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\muauth.cab")) returned 0x20 [0120.415] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\muauth.cab.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0120.415] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\muauth.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0120.415] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f870 | out: lpNewFilePointer=0x0) returned 1 [0120.415] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f870 | out: lpNewFilePointer=0x0) returned 1 [0120.415] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\muauth.cab.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0120.416] GetLastError () returned 0x0 [0120.416] ReadFile (in: hFile=0x1b0, lpBuffer=0x4120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x354f87c, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesRead=0x354f87c*=0x1a5b, lpOverlapped=0x0) returned 1 [0120.471] WriteFile (in: hFile=0x170, lpBuffer=0x4120020*, nNumberOfBytesToWrite=0x1a60, lpNumberOfBytesWritten=0x354f644, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesWritten=0x354f644*=0x1a60, lpOverlapped=0x0) returned 1 [0120.471] ReadFile (in: hFile=0x1b0, lpBuffer=0x4120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x354f87c, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesRead=0x354f87c*=0x0, lpOverlapped=0x0) returned 1 [0120.471] WriteFile (in: hFile=0x170, lpBuffer=0x4120020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x354f644, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesWritten=0x354f644*=0xe8, lpOverlapped=0x0) returned 1 [0120.472] SetEndOfFile (hFile=0x170) returned 1 [0120.480] CloseHandle (hObject=0x170) returned 1 [0120.481] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f870 | out: lpNewFilePointer=0x0) returned 1 [0120.481] SetEndOfFile (hFile=0x1b0) returned 1 [0120.481] CloseHandle (hObject=0x1b0) returned 1 [0120.481] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0120.482] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\muauth.cab")) returned 1 [0120.484] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB") returned 66 [0120.484] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB") returned 66 [0120.484] lstrlenW (lpString=".doc") returned 4 [0120.484] lstrcmpiW (lpString1=".doc", lpString2=".CAB") returned 1 [0120.484] lstrlenW (lpString=".docx") returned 5 [0120.484] lstrcmpiW (lpString1=".docx", lpString2="H.CAB") returned -1 [0120.484] lstrlenW (lpString=".pdf") returned 4 [0120.484] lstrcmpiW (lpString1=".pdf", lpString2=".CAB") returned 1 [0120.484] lstrlenW (lpString=".xls") returned 4 [0120.484] lstrcmpiW (lpString1=".xls", lpString2=".CAB") returned 1 [0120.484] lstrlenW (lpString=".xlsx") returned 5 [0120.484] lstrcmpiW (lpString1=".xlsx", lpString2="H.CAB") returned -1 [0120.484] lstrlenW (lpString=".ppt") returned 4 [0120.484] lstrcmpiW (lpString1=".ppt", lpString2=".CAB") returned 1 [0120.484] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB") returned 66 [0120.484] lstrlenW (lpString=".zip") returned 4 [0120.484] lstrcmpiW (lpString1=".zip", lpString2=".CAB") returned 1 [0120.484] lstrlenW (lpString=".rar") returned 4 [0120.484] lstrcmpiW (lpString1=".rar", lpString2=".CAB") returned 1 [0120.484] lstrlenW (lpString=".bz2") returned 4 [0120.485] lstrcmpiW (lpString1=".bz2", lpString2=".CAB") returned -1 [0120.485] lstrlenW (lpString=".7z") returned 3 [0120.485] lstrcmpiW (lpString1=".7z", lpString2="CAB") returned -1 [0120.485] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB") returned 66 [0120.485] lstrlenW (lpString=".dbf") returned 4 [0120.485] lstrcmpiW (lpString1=".dbf", lpString2=".CAB") returned 1 [0120.485] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB") returned 66 [0120.485] lstrlenW (lpString=".1cd") returned 4 [0120.485] lstrcmpiW (lpString1=".1cd", lpString2=".CAB") returned -1 [0120.485] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB") returned 66 [0120.485] lstrlenW (lpString=".jpg") returned 4 [0120.485] lstrcmpiW (lpString1=".jpg", lpString2=".CAB") returned 1 [0120.485] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB") returned 66 [0120.485] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB") returned 66 [0120.485] lstrlenW (lpString=".doc") returned 4 [0120.485] lstrcmpiW (lpString1=".doc", lpString2=".CAB") returned 1 [0120.485] lstrlenW (lpString=".docx") returned 5 [0120.485] lstrcmpiW (lpString1=".docx", lpString2="H.CAB") returned -1 [0120.485] lstrlenW (lpString=".pdf") returned 4 [0120.485] lstrcmpiW (lpString1=".pdf", lpString2=".CAB") returned 1 [0120.485] lstrlenW (lpString=".xls") returned 4 [0120.485] lstrcmpiW (lpString1=".xls", lpString2=".CAB") returned 1 [0120.485] lstrlenW (lpString=".xlsx") returned 5 [0120.485] lstrcmpiW (lpString1=".xlsx", lpString2="H.CAB") returned -1 [0120.485] lstrlenW (lpString=".ppt") returned 4 [0120.485] lstrcmpiW (lpString1=".ppt", lpString2=".CAB") returned 1 [0120.485] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB") returned 66 [0120.485] lstrlenW (lpString=".zip") returned 4 [0120.485] lstrcmpiW (lpString1=".zip", lpString2=".CAB") returned 1 [0120.485] lstrlenW (lpString=".rar") returned 4 [0120.485] lstrcmpiW (lpString1=".rar", lpString2=".CAB") returned 1 [0120.485] lstrlenW (lpString=".bz2") returned 4 [0120.485] lstrcmpiW (lpString1=".bz2", lpString2=".CAB") returned -1 [0120.485] lstrlenW (lpString=".7z") returned 3 [0120.485] lstrcmpiW (lpString1=".7z", lpString2="CAB") returned -1 [0120.485] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB") returned 66 [0120.485] lstrlenW (lpString=".dbf") returned 4 [0120.485] lstrcmpiW (lpString1=".dbf", lpString2=".CAB") returned 1 [0120.485] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB") returned 66 [0120.485] lstrlenW (lpString=".1cd") returned 4 [0120.485] lstrcmpiW (lpString1=".1cd", lpString2=".CAB") returned -1 [0120.485] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB") returned 66 [0120.485] lstrlenW (lpString=".jpg") returned 4 [0120.485] lstrcmpiW (lpString1=".jpg", lpString2=".CAB") returned 1 [0120.485] lstrcmpiW (lpString1=".DLL", lpString2=".waifu") returned -1 [0120.485] lstrlenW (lpString="ODBCMON.DLL") returned 11 [0120.485] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ODBCMON.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\odbcmon.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0120.486] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x354f8c4 | out: lpFileSize=0x354f8c4*=30056) returned 1 [0120.486] CloseHandle (hObject=0x194) returned 1 [0120.486] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ODBCMON.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\odbcmon.dll")) returned 0x20 [0120.487] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ODBCMON.DLL.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\odbcmon.dll.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0120.487] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ODBCMON.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\odbcmon.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0120.487] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f870 | out: lpNewFilePointer=0x0) returned 1 [0120.487] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f870 | out: lpNewFilePointer=0x0) returned 1 [0120.487] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ODBCMON.DLL.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\odbcmon.dll.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0120.487] GetLastError () returned 0x0 [0120.487] ReadFile (in: hFile=0x194, lpBuffer=0x4120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x354f87c, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesRead=0x354f87c*=0x7568, lpOverlapped=0x0) returned 1 [0120.518] WriteFile (in: hFile=0x22c, lpBuffer=0x4120020*, nNumberOfBytesToWrite=0x7570, lpNumberOfBytesWritten=0x354f644, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesWritten=0x354f644*=0x7570, lpOverlapped=0x0) returned 1 [0120.518] ReadFile (in: hFile=0x194, lpBuffer=0x4120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x354f87c, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesRead=0x354f87c*=0x0, lpOverlapped=0x0) returned 1 [0120.518] WriteFile (in: hFile=0x22c, lpBuffer=0x4120020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x354f644, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesWritten=0x354f644*=0xea, lpOverlapped=0x0) returned 1 [0120.519] SetEndOfFile (hFile=0x22c) returned 1 [0120.519] CloseHandle (hObject=0x22c) returned 1 [0120.519] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f870 | out: lpNewFilePointer=0x0) returned 1 [0120.519] SetEndOfFile (hFile=0x194) returned 1 [0120.519] CloseHandle (hObject=0x194) returned 1 [0120.519] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ODBCMON.DLL.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0120.520] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ODBCMON.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\odbcmon.dll")) returned 1 [0120.520] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ODBCMON.DLL") returned 67 [0120.520] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ODBCMON.DLL") returned 67 [0120.520] lstrlenW (lpString=".doc") returned 4 [0120.520] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0120.520] lstrlenW (lpString=".docx") returned 5 [0120.520] lstrcmpiW (lpString1=".docx", lpString2="N.DLL") returned -1 [0120.520] lstrlenW (lpString=".pdf") returned 4 [0120.520] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0120.520] lstrlenW (lpString=".xls") returned 4 [0120.520] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0120.520] lstrlenW (lpString=".xlsx") returned 5 [0120.520] lstrcmpiW (lpString1=".xlsx", lpString2="N.DLL") returned -1 [0120.520] lstrlenW (lpString=".ppt") returned 4 [0120.520] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0120.520] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ODBCMON.DLL") returned 67 [0120.520] lstrlenW (lpString=".zip") returned 4 [0120.520] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0120.520] lstrlenW (lpString=".rar") returned 4 [0120.520] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0120.520] lstrlenW (lpString=".bz2") returned 4 [0120.520] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0120.520] lstrlenW (lpString=".7z") returned 3 [0120.520] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0120.520] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ODBCMON.DLL") returned 67 [0120.520] lstrlenW (lpString=".dbf") returned 4 [0120.520] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0120.520] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ODBCMON.DLL") returned 67 [0120.520] lstrlenW (lpString=".1cd") returned 4 [0120.520] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0120.520] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ODBCMON.DLL") returned 67 [0120.520] lstrlenW (lpString=".jpg") returned 4 [0120.520] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0120.520] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ODBCMON.DLL") returned 67 [0120.520] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ODBCMON.DLL") returned 67 [0120.520] lstrlenW (lpString=".doc") returned 4 [0120.520] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0120.521] lstrlenW (lpString=".docx") returned 5 [0120.521] lstrcmpiW (lpString1=".docx", lpString2="N.DLL") returned -1 [0120.521] lstrlenW (lpString=".pdf") returned 4 [0120.521] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0120.521] lstrlenW (lpString=".xls") returned 4 [0120.521] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0120.521] lstrlenW (lpString=".xlsx") returned 5 [0120.521] lstrcmpiW (lpString1=".xlsx", lpString2="N.DLL") returned -1 [0120.521] lstrlenW (lpString=".ppt") returned 4 [0120.521] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0120.521] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ODBCMON.DLL") returned 67 [0120.521] lstrlenW (lpString=".zip") returned 4 [0120.521] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0120.521] lstrlenW (lpString=".rar") returned 4 [0120.521] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0120.521] lstrlenW (lpString=".bz2") returned 4 [0120.521] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0120.521] lstrlenW (lpString=".7z") returned 3 [0120.521] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0120.521] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ODBCMON.DLL") returned 67 [0120.521] lstrlenW (lpString=".dbf") returned 4 [0120.521] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0120.521] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ODBCMON.DLL") returned 67 [0120.521] lstrlenW (lpString=".1cd") returned 4 [0120.521] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0120.521] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ODBCMON.DLL") returned 67 [0120.521] lstrlenW (lpString=".jpg") returned 4 [0120.521] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0120.521] lstrcmpiW (lpString1=".DLL", lpString2=".waifu") returned -1 [0120.521] lstrlenW (lpString="OSETUPUI.DLL") returned 12 [0120.521] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OSETUPUI.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\osetupui.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0120.524] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x354f8c4 | out: lpFileSize=0x354f8c4*=191872) returned 1 [0120.524] CloseHandle (hObject=0x1f8) returned 1 [0120.524] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OSETUPUI.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\osetupui.dll")) returned 0x20 [0120.524] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OSETUPUI.DLL.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\osetupui.dll.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0120.524] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OSETUPUI.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\osetupui.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0120.524] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f870 | out: lpNewFilePointer=0x0) returned 1 [0120.525] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f870 | out: lpNewFilePointer=0x0) returned 1 [0120.525] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OSETUPUI.DLL.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\osetupui.dll.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0120.525] GetLastError () returned 0x0 [0120.525] ReadFile (in: hFile=0x1f8, lpBuffer=0x4120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x354f87c, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesRead=0x354f87c*=0x2ed80, lpOverlapped=0x0) returned 1 [0120.612] WriteFile (in: hFile=0x1f4, lpBuffer=0x4120020*, nNumberOfBytesToWrite=0x2ed90, lpNumberOfBytesWritten=0x354f644, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesWritten=0x354f644*=0x2ed90, lpOverlapped=0x0) returned 1 [0120.613] ReadFile (in: hFile=0x1f8, lpBuffer=0x4120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x354f87c, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesRead=0x354f87c*=0x0, lpOverlapped=0x0) returned 1 [0120.613] WriteFile (in: hFile=0x1f4, lpBuffer=0x4120020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x354f644, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesWritten=0x354f644*=0xec, lpOverlapped=0x0) returned 1 [0120.613] SetEndOfFile (hFile=0x1f4) returned 1 [0120.614] CloseHandle (hObject=0x1f4) returned 1 [0120.614] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f870 | out: lpNewFilePointer=0x0) returned 1 [0120.614] SetEndOfFile (hFile=0x1f8) returned 1 [0120.614] CloseHandle (hObject=0x1f8) returned 1 [0120.615] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OSETUPUI.DLL.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0120.619] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OSETUPUI.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\osetupui.dll")) returned 1 [0120.620] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OSETUPUI.DLL") returned 105 [0120.631] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OSETUPUI.DLL") returned 105 [0120.631] lstrlenW (lpString=".doc") returned 4 [0120.631] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0120.631] lstrlenW (lpString=".docx") returned 5 [0120.631] lstrcmpiW (lpString1=".docx", lpString2="I.DLL") returned -1 [0120.631] lstrlenW (lpString=".pdf") returned 4 [0120.631] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0120.631] lstrlenW (lpString=".xls") returned 4 [0120.631] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0120.632] lstrlenW (lpString=".xlsx") returned 5 [0120.632] lstrcmpiW (lpString1=".xlsx", lpString2="I.DLL") returned -1 [0120.632] lstrlenW (lpString=".ppt") returned 4 [0120.632] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0120.632] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OSETUPUI.DLL") returned 105 [0120.632] lstrlenW (lpString=".zip") returned 4 [0120.632] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0120.632] lstrlenW (lpString=".rar") returned 4 [0120.632] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0120.632] lstrlenW (lpString=".bz2") returned 4 [0120.632] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0120.632] lstrlenW (lpString=".7z") returned 3 [0120.632] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0120.632] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OSETUPUI.DLL") returned 105 [0120.632] lstrlenW (lpString=".dbf") returned 4 [0120.632] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0120.632] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OSETUPUI.DLL") returned 105 [0120.632] lstrlenW (lpString=".1cd") returned 4 [0120.632] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0120.632] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OSETUPUI.DLL") returned 105 [0120.632] lstrlenW (lpString=".jpg") returned 4 [0120.632] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0120.632] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OSETUPUI.DLL") returned 105 [0120.632] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OSETUPUI.DLL") returned 105 [0120.632] lstrlenW (lpString=".doc") returned 4 [0120.632] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0120.632] lstrlenW (lpString=".docx") returned 5 [0120.632] lstrcmpiW (lpString1=".docx", lpString2="I.DLL") returned -1 [0120.632] lstrlenW (lpString=".pdf") returned 4 [0120.632] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0120.632] lstrlenW (lpString=".xls") returned 4 [0120.632] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0120.632] lstrlenW (lpString=".xlsx") returned 5 [0120.632] lstrcmpiW (lpString1=".xlsx", lpString2="I.DLL") returned -1 [0120.632] lstrlenW (lpString=".ppt") returned 4 [0120.632] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0120.632] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OSETUPUI.DLL") returned 105 [0120.632] lstrlenW (lpString=".zip") returned 4 [0120.632] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0120.632] lstrlenW (lpString=".rar") returned 4 [0120.632] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0120.632] lstrlenW (lpString=".bz2") returned 4 [0120.632] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0120.632] lstrlenW (lpString=".7z") returned 3 [0120.632] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0120.632] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OSETUPUI.DLL") returned 105 [0120.632] lstrlenW (lpString=".dbf") returned 4 [0120.632] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0120.632] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OSETUPUI.DLL") returned 105 [0120.632] lstrlenW (lpString=".1cd") returned 4 [0120.633] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0120.633] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OSETUPUI.DLL") returned 105 [0120.633] lstrlenW (lpString=".jpg") returned 4 [0120.633] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0120.633] lstrcmpiW (lpString1=".dll", lpString2=".waifu") returned -1 [0120.633] lstrlenW (lpString="OSetupPS.dll") returned 12 [0120.633] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSetupPS.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\osetupps.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0120.687] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x354f8c4 | out: lpFileSize=0x354f8c4*=47520) returned 1 [0120.688] CloseHandle (hObject=0x194) returned 1 [0120.688] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSetupPS.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\osetupps.dll")) returned 0x20 [0120.688] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSetupPS.dll.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\osetupps.dll.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0120.688] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSetupPS.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\osetupps.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0120.688] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f870 | out: lpNewFilePointer=0x0) returned 1 [0120.688] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f870 | out: lpNewFilePointer=0x0) returned 1 [0120.688] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSetupPS.dll.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\osetupps.dll.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0120.689] GetLastError () returned 0x0 [0120.689] ReadFile (in: hFile=0x194, lpBuffer=0x4120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x354f87c, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesRead=0x354f87c*=0xb9a0, lpOverlapped=0x0) returned 1 [0120.722] WriteFile (in: hFile=0x22c, lpBuffer=0x4120020*, nNumberOfBytesToWrite=0xb9b0, lpNumberOfBytesWritten=0x354f644, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesWritten=0x354f644*=0xb9b0, lpOverlapped=0x0) returned 1 [0120.723] ReadFile (in: hFile=0x194, lpBuffer=0x4120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x354f87c, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesRead=0x354f87c*=0x0, lpOverlapped=0x0) returned 1 [0120.723] WriteFile (in: hFile=0x22c, lpBuffer=0x4120020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x354f644, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesWritten=0x354f644*=0xec, lpOverlapped=0x0) returned 1 [0120.723] SetEndOfFile (hFile=0x22c) returned 1 [0120.723] CloseHandle (hObject=0x22c) returned 1 [0120.723] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f870 | out: lpNewFilePointer=0x0) returned 1 [0120.723] SetEndOfFile (hFile=0x194) returned 1 [0120.724] CloseHandle (hObject=0x194) returned 1 [0120.724] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSetupPS.dll.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0120.724] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSetupPS.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\osetupps.dll")) returned 1 [0120.835] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSetupPS.dll") returned 92 [0120.835] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSetupPS.dll") returned 92 [0120.835] lstrlenW (lpString=".doc") returned 4 [0120.835] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0120.835] lstrlenW (lpString=".docx") returned 5 [0120.835] lstrcmpiW (lpString1=".docx", lpString2="S.dll") returned -1 [0120.835] lstrlenW (lpString=".pdf") returned 4 [0120.835] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0120.835] lstrlenW (lpString=".xls") returned 4 [0120.835] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0120.835] lstrlenW (lpString=".xlsx") returned 5 [0120.835] lstrcmpiW (lpString1=".xlsx", lpString2="S.dll") returned -1 [0120.835] lstrlenW (lpString=".ppt") returned 4 [0120.835] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0120.835] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSetupPS.dll") returned 92 [0120.835] lstrlenW (lpString=".zip") returned 4 [0120.835] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0120.835] lstrlenW (lpString=".rar") returned 4 [0120.835] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0120.835] lstrlenW (lpString=".bz2") returned 4 [0120.835] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0120.835] lstrlenW (lpString=".7z") returned 3 [0120.835] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0120.835] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSetupPS.dll") returned 92 [0120.835] lstrlenW (lpString=".dbf") returned 4 [0120.835] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0120.835] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSetupPS.dll") returned 92 [0120.835] lstrlenW (lpString=".1cd") returned 4 [0120.835] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0120.835] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSetupPS.dll") returned 92 [0120.835] lstrlenW (lpString=".jpg") returned 4 [0120.835] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0120.835] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSetupPS.dll") returned 92 [0120.835] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSetupPS.dll") returned 92 [0120.835] lstrlenW (lpString=".doc") returned 4 [0120.835] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0120.835] lstrlenW (lpString=".docx") returned 5 [0120.835] lstrcmpiW (lpString1=".docx", lpString2="S.dll") returned -1 [0120.835] lstrlenW (lpString=".pdf") returned 4 [0120.835] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0120.835] lstrlenW (lpString=".xls") returned 4 [0120.835] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0120.835] lstrlenW (lpString=".xlsx") returned 5 [0120.835] lstrcmpiW (lpString1=".xlsx", lpString2="S.dll") returned -1 [0120.835] lstrlenW (lpString=".ppt") returned 4 [0120.835] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0120.835] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSetupPS.dll") returned 92 [0120.836] lstrlenW (lpString=".zip") returned 4 [0120.836] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0120.836] lstrlenW (lpString=".rar") returned 4 [0120.836] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0120.836] lstrlenW (lpString=".bz2") returned 4 [0120.836] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0120.836] lstrlenW (lpString=".7z") returned 3 [0120.836] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0120.836] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSetupPS.dll") returned 92 [0120.836] lstrlenW (lpString=".dbf") returned 4 [0120.836] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0120.836] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSetupPS.dll") returned 92 [0120.836] lstrlenW (lpString=".1cd") returned 4 [0120.836] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0120.836] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSetupPS.dll") returned 92 [0120.836] lstrlenW (lpString=".jpg") returned 4 [0120.836] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0120.836] lstrcmpiW (lpString1=".dll", lpString2=".waifu") returned -1 [0120.836] lstrlenW (lpString="pkeyconfig.companion.dll") returned 24 [0120.836] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig.companion.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\pkeyconfig.companion.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0120.836] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x354f8c4 | out: lpFileSize=0x354f8c4*=15736) returned 1 [0120.836] CloseHandle (hObject=0x16c) returned 1 [0120.836] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig.companion.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\pkeyconfig.companion.dll")) returned 0x20 [0120.836] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig.companion.dll.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\pkeyconfig.companion.dll.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0120.836] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig.companion.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\pkeyconfig.companion.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0120.837] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f870 | out: lpNewFilePointer=0x0) returned 1 [0120.837] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f870 | out: lpNewFilePointer=0x0) returned 1 [0120.837] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig.companion.dll.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\pkeyconfig.companion.dll.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0120.837] GetLastError () returned 0x0 [0120.837] ReadFile (in: hFile=0x16c, lpBuffer=0x4120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x354f87c, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesRead=0x354f87c*=0x3d78, lpOverlapped=0x0) returned 1 [0120.952] WriteFile (in: hFile=0x22c, lpBuffer=0x4120020*, nNumberOfBytesToWrite=0x3d80, lpNumberOfBytesWritten=0x354f644, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesWritten=0x354f644*=0x3d80, lpOverlapped=0x0) returned 1 [0120.953] ReadFile (in: hFile=0x16c, lpBuffer=0x4120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x354f87c, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesRead=0x354f87c*=0x0, lpOverlapped=0x0) returned 1 [0120.953] WriteFile (in: hFile=0x22c, lpBuffer=0x4120020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x354f644, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesWritten=0x354f644*=0x104, lpOverlapped=0x0) returned 1 [0120.953] SetEndOfFile (hFile=0x22c) returned 1 [0120.953] CloseHandle (hObject=0x22c) returned 1 [0120.953] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f870 | out: lpNewFilePointer=0x0) returned 1 [0120.953] SetEndOfFile (hFile=0x16c) returned 1 [0120.954] CloseHandle (hObject=0x16c) returned 1 [0120.954] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig.companion.dll.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0120.954] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig.companion.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\pkeyconfig.companion.dll")) returned 1 [0120.954] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig.companion.dll") returned 104 [0120.954] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig.companion.dll") returned 104 [0120.954] lstrlenW (lpString=".doc") returned 4 [0120.954] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0120.954] lstrlenW (lpString=".docx") returned 5 [0120.954] lstrcmpiW (lpString1=".docx", lpString2="n.dll") returned -1 [0120.954] lstrlenW (lpString=".pdf") returned 4 [0120.954] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0120.954] lstrlenW (lpString=".xls") returned 4 [0120.954] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0120.954] lstrlenW (lpString=".xlsx") returned 5 [0120.954] lstrcmpiW (lpString1=".xlsx", lpString2="n.dll") returned -1 [0120.954] lstrlenW (lpString=".ppt") returned 4 [0120.954] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0120.955] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig.companion.dll") returned 104 [0120.955] lstrlenW (lpString=".zip") returned 4 [0120.955] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0120.955] lstrlenW (lpString=".rar") returned 4 [0120.955] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0120.955] lstrlenW (lpString=".bz2") returned 4 [0120.955] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0120.955] lstrlenW (lpString=".7z") returned 3 [0120.955] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0120.955] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig.companion.dll") returned 104 [0120.955] lstrlenW (lpString=".dbf") returned 4 [0120.955] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0120.955] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig.companion.dll") returned 104 [0120.955] lstrlenW (lpString=".1cd") returned 4 [0120.955] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0120.955] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig.companion.dll") returned 104 [0120.955] lstrlenW (lpString=".jpg") returned 4 [0120.955] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0120.955] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig.companion.dll") returned 104 [0120.955] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig.companion.dll") returned 104 [0120.955] lstrlenW (lpString=".doc") returned 4 [0120.955] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0120.955] lstrlenW (lpString=".docx") returned 5 [0120.955] lstrcmpiW (lpString1=".docx", lpString2="n.dll") returned -1 [0120.955] lstrlenW (lpString=".pdf") returned 4 [0120.955] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0120.955] lstrlenW (lpString=".xls") returned 4 [0120.955] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0120.955] lstrlenW (lpString=".xlsx") returned 5 [0120.955] lstrcmpiW (lpString1=".xlsx", lpString2="n.dll") returned -1 [0120.955] lstrlenW (lpString=".ppt") returned 4 [0120.955] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0120.955] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig.companion.dll") returned 104 [0120.955] lstrlenW (lpString=".zip") returned 4 [0120.955] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0120.955] lstrlenW (lpString=".rar") returned 4 [0120.955] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0120.955] lstrlenW (lpString=".bz2") returned 4 [0120.955] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0120.955] lstrlenW (lpString=".7z") returned 3 [0120.955] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0120.955] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig.companion.dll") returned 104 [0120.955] lstrlenW (lpString=".dbf") returned 4 [0120.955] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0120.955] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig.companion.dll") returned 104 [0120.955] lstrlenW (lpString=".1cd") returned 4 [0120.955] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0120.955] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig.companion.dll") returned 104 [0120.955] lstrlenW (lpString=".jpg") returned 4 [0120.955] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0120.956] lstrcmpiW (lpString1=".DLL", lpString2=".waifu") returned -1 [0120.956] lstrlenW (lpString="OPHPROXY.DLL") returned 12 [0120.956] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPHPROXY.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\ophproxy.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0121.193] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x354f8c4 | out: lpFileSize=0x354f8c4*=19848) returned 1 [0121.193] CloseHandle (hObject=0x1d8) returned 1 [0121.193] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPHPROXY.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\ophproxy.dll")) returned 0x20 [0121.193] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPHPROXY.DLL.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\ophproxy.dll.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0121.193] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPHPROXY.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\ophproxy.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0121.193] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f870 | out: lpNewFilePointer=0x0) returned 1 [0121.193] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f870 | out: lpNewFilePointer=0x0) returned 1 [0121.193] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPHPROXY.DLL.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\ophproxy.dll.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x224 [0121.471] GetLastError () returned 0x0 [0121.471] ReadFile (in: hFile=0x1d8, lpBuffer=0x4120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x354f87c, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesRead=0x354f87c*=0x4d88, lpOverlapped=0x0) returned 1 [0121.575] WriteFile (in: hFile=0x224, lpBuffer=0x4120020*, nNumberOfBytesToWrite=0x4d90, lpNumberOfBytesWritten=0x354f644, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesWritten=0x354f644*=0x4d90, lpOverlapped=0x0) returned 1 [0121.576] ReadFile (in: hFile=0x1d8, lpBuffer=0x4120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x354f87c, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesRead=0x354f87c*=0x0, lpOverlapped=0x0) returned 1 [0121.576] WriteFile (in: hFile=0x224, lpBuffer=0x4120020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x354f644, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesWritten=0x354f644*=0xec, lpOverlapped=0x0) returned 1 [0121.576] SetEndOfFile (hFile=0x224) returned 1 [0121.576] CloseHandle (hObject=0x224) returned 1 [0121.576] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f870 | out: lpNewFilePointer=0x0) returned 1 [0121.576] SetEndOfFile (hFile=0x1d8) returned 1 [0121.577] CloseHandle (hObject=0x1d8) returned 1 [0121.577] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPHPROXY.DLL.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0121.577] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPHPROXY.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\ophproxy.dll")) returned 1 [0121.577] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPHPROXY.DLL") returned 68 [0121.577] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPHPROXY.DLL") returned 68 [0121.577] lstrlenW (lpString=".doc") returned 4 [0121.577] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0121.577] lstrlenW (lpString=".docx") returned 5 [0121.577] lstrcmpiW (lpString1=".docx", lpString2="Y.DLL") returned -1 [0121.577] lstrlenW (lpString=".pdf") returned 4 [0121.577] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0121.577] lstrlenW (lpString=".xls") returned 4 [0121.578] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0121.578] lstrlenW (lpString=".xlsx") returned 5 [0121.578] lstrcmpiW (lpString1=".xlsx", lpString2="Y.DLL") returned -1 [0121.578] lstrlenW (lpString=".ppt") returned 4 [0121.578] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0121.578] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPHPROXY.DLL") returned 68 [0121.578] lstrlenW (lpString=".zip") returned 4 [0121.578] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0121.578] lstrlenW (lpString=".rar") returned 4 [0121.578] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0121.578] lstrlenW (lpString=".bz2") returned 4 [0121.578] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0121.578] lstrlenW (lpString=".7z") returned 3 [0121.578] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0121.578] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPHPROXY.DLL") returned 68 [0121.578] lstrlenW (lpString=".dbf") returned 4 [0121.578] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0121.578] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPHPROXY.DLL") returned 68 [0121.578] lstrlenW (lpString=".1cd") returned 4 [0121.578] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0121.578] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPHPROXY.DLL") returned 68 [0121.578] lstrlenW (lpString=".jpg") returned 4 [0121.578] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0121.578] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPHPROXY.DLL") returned 68 [0121.578] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPHPROXY.DLL") returned 68 [0121.578] lstrlenW (lpString=".doc") returned 4 [0121.578] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0121.578] lstrlenW (lpString=".docx") returned 5 [0121.578] lstrcmpiW (lpString1=".docx", lpString2="Y.DLL") returned -1 [0121.578] lstrlenW (lpString=".pdf") returned 4 [0121.578] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0121.578] lstrlenW (lpString=".xls") returned 4 [0121.578] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0121.578] lstrlenW (lpString=".xlsx") returned 5 [0121.578] lstrcmpiW (lpString1=".xlsx", lpString2="Y.DLL") returned -1 [0121.578] lstrlenW (lpString=".ppt") returned 4 [0121.578] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0121.578] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPHPROXY.DLL") returned 68 [0121.578] lstrlenW (lpString=".zip") returned 4 [0121.578] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0121.578] lstrlenW (lpString=".rar") returned 4 [0121.578] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0121.578] lstrlenW (lpString=".bz2") returned 4 [0121.578] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0121.578] lstrlenW (lpString=".7z") returned 3 [0121.578] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0121.578] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPHPROXY.DLL") returned 68 [0121.578] lstrlenW (lpString=".dbf") returned 4 [0121.578] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0121.578] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPHPROXY.DLL") returned 68 [0121.579] lstrlenW (lpString=".1cd") returned 4 [0121.579] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0121.579] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OPHPROXY.DLL") returned 68 [0121.579] lstrlenW (lpString=".jpg") returned 4 [0121.579] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0121.579] lstrcmpiW (lpString1=".DLL", lpString2=".waifu") returned -1 [0121.579] lstrlenW (lpString="USP10.DLL") returned 9 [0121.579] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\USP10.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\usp10.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0121.580] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x354f8c4 | out: lpFileSize=0x354f8c4*=813824) returned 1 [0121.580] CloseHandle (hObject=0x1d8) returned 1 [0121.580] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\USP10.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\usp10.dll")) returned 0x20 [0121.580] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\USP10.DLL.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\usp10.dll.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0121.580] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\USP10.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\usp10.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0121.580] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f870 | out: lpNewFilePointer=0x0) returned 1 [0121.580] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f870 | out: lpNewFilePointer=0x0) returned 1 [0121.580] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\USP10.DLL.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\usp10.dll.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x224 [0121.580] GetLastError () returned 0x0 [0121.580] ReadFile (in: hFile=0x1d8, lpBuffer=0x4120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x354f87c, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesRead=0x354f87c*=0xc6b00, lpOverlapped=0x0) returned 1 [0121.866] WriteFile (in: hFile=0x224, lpBuffer=0x4120020*, nNumberOfBytesToWrite=0xc6b10, lpNumberOfBytesWritten=0x354f644, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesWritten=0x354f644*=0xc6b10, lpOverlapped=0x0) returned 1 [0121.872] ReadFile (in: hFile=0x1d8, lpBuffer=0x4120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x354f87c, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesRead=0x354f87c*=0x0, lpOverlapped=0x0) returned 1 [0121.900] WriteFile (in: hFile=0x224, lpBuffer=0x4120020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x354f644, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesWritten=0x354f644*=0xe6, lpOverlapped=0x0) returned 1 [0121.900] SetEndOfFile (hFile=0x224) returned 1 [0121.900] CloseHandle (hObject=0x224) returned 1 [0121.901] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f870 | out: lpNewFilePointer=0x0) returned 1 [0121.901] SetEndOfFile (hFile=0x1d8) returned 1 [0121.906] CloseHandle (hObject=0x1d8) returned 1 [0121.906] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\USP10.DLL.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0121.906] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\USP10.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\usp10.dll")) returned 1 [0121.907] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\USP10.DLL") returned 65 [0121.907] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\USP10.DLL") returned 65 [0121.907] lstrlenW (lpString=".doc") returned 4 [0121.907] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0121.907] lstrlenW (lpString=".docx") returned 5 [0121.907] lstrcmpiW (lpString1=".docx", lpString2="0.DLL") returned -1 [0121.907] lstrlenW (lpString=".pdf") returned 4 [0121.907] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0121.907] lstrlenW (lpString=".xls") returned 4 [0121.907] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0121.907] lstrlenW (lpString=".xlsx") returned 5 [0121.907] lstrcmpiW (lpString1=".xlsx", lpString2="0.DLL") returned -1 [0121.907] lstrlenW (lpString=".ppt") returned 4 [0121.907] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0121.907] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\USP10.DLL") returned 65 [0121.907] lstrlenW (lpString=".zip") returned 4 [0121.907] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0121.907] lstrlenW (lpString=".rar") returned 4 [0121.907] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0121.907] lstrlenW (lpString=".bz2") returned 4 [0121.907] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0121.907] lstrlenW (lpString=".7z") returned 3 [0121.907] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0121.907] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\USP10.DLL") returned 65 [0121.907] lstrlenW (lpString=".dbf") returned 4 [0121.907] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0121.907] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\USP10.DLL") returned 65 [0121.907] lstrlenW (lpString=".1cd") returned 4 [0121.907] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0121.907] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\USP10.DLL") returned 65 [0121.907] lstrlenW (lpString=".jpg") returned 4 [0121.907] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0121.907] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\USP10.DLL") returned 65 [0121.907] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\USP10.DLL") returned 65 [0121.907] lstrlenW (lpString=".doc") returned 4 [0121.907] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0121.907] lstrlenW (lpString=".docx") returned 5 [0121.907] lstrcmpiW (lpString1=".docx", lpString2="0.DLL") returned -1 [0121.907] lstrlenW (lpString=".pdf") returned 4 [0121.907] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0121.907] lstrlenW (lpString=".xls") returned 4 [0121.907] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0121.907] lstrlenW (lpString=".xlsx") returned 5 [0121.908] lstrcmpiW (lpString1=".xlsx", lpString2="0.DLL") returned -1 [0121.908] lstrlenW (lpString=".ppt") returned 4 [0121.908] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0121.908] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\USP10.DLL") returned 65 [0121.908] lstrlenW (lpString=".zip") returned 4 [0121.908] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0121.908] lstrlenW (lpString=".rar") returned 4 [0121.908] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0121.908] lstrlenW (lpString=".bz2") returned 4 [0121.908] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0121.908] lstrlenW (lpString=".7z") returned 3 [0121.908] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0121.908] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\USP10.DLL") returned 65 [0121.908] lstrlenW (lpString=".dbf") returned 4 [0121.908] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0121.908] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\USP10.DLL") returned 65 [0121.908] lstrlenW (lpString=".1cd") returned 4 [0121.908] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0121.908] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\USP10.DLL") returned 65 [0121.908] lstrlenW (lpString=".jpg") returned 4 [0121.908] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0121.908] lstrcmpiW (lpString1=".DLL", lpString2=".waifu") returned -1 [0121.908] lstrlenW (lpString="OSPPOBJS.DLL") returned 12 [0121.908] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPOBJS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppobjs.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0121.930] GetFileSizeEx (in: hFile=0x160, lpFileSize=0x354f8c4 | out: lpFileSize=0x354f8c4*=2173696) returned 1 [0121.930] CloseHandle (hObject=0x160) returned 1 [0121.930] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPOBJS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppobjs.dll")) returned 0x20 [0121.931] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPOBJS.DLL.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppobjs.dll.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0121.931] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPOBJS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppobjs.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPOBJS.DLL.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppobjs.dll.id-9c354b42.[darknes@420blaze.it].waifu")) returned 1 [0121.931] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPOBJS.DLL.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppobjs.dll.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0121.931] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f614 | out: lpNewFilePointer=0x0) returned 1 [0121.931] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f5d4 | out: lpNewFilePointer=0x0) returned 1 [0121.931] ReadFile (in: hFile=0x160, lpBuffer=0x4120058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x354f5e0, lpOverlapped=0x0 | out: lpBuffer=0x4120058*, lpNumberOfBytesRead=0x354f5e0*=0x40000, lpOverlapped=0x0) returned 1 [0122.003] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0xb0e55, lpNewFilePointer=0x0, dwMoveMethod=0x354f5d4 | out: lpNewFilePointer=0x0) returned 1 [0122.003] ReadFile (in: hFile=0x160, lpBuffer=0x4160058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x354f5e0, lpOverlapped=0x0 | out: lpBuffer=0x4160058*, lpNumberOfBytesRead=0x354f5e0*=0x40000, lpOverlapped=0x0) returned 1 [0122.207] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x354f614 | out: lpNewFilePointer=0xffffffff) returned 1 [0122.207] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x1d2b00, lpNewFilePointer=0x0, dwMoveMethod=0x354f5d4 | out: lpNewFilePointer=0x0) returned 1 [0122.207] ReadFile (in: hFile=0x160, lpBuffer=0x41a0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x354f5e0, lpOverlapped=0x0 | out: lpBuffer=0x41a0058*, lpNumberOfBytesRead=0x354f5e0*=0x40000, lpOverlapped=0x0) returned 1 [0122.284] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f870 | out: lpNewFilePointer=0x0) returned 1 [0122.284] WriteFile (in: hFile=0x160, lpBuffer=0x4120020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x354f658, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesWritten=0x354f658*=0xc0104, lpOverlapped=0x0) returned 1 [0122.290] SetEndOfFile (hFile=0x160) returned 1 [0122.292] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f624 | out: lpNewFilePointer=0x0) returned 1 [0122.292] WriteFile (in: hFile=0x160, lpBuffer=0x44b2070*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x354f630, lpOverlapped=0x0 | out: lpBuffer=0x44b2070*, lpNumberOfBytesWritten=0x354f630*=0x40000, lpOverlapped=0x0) returned 1 [0122.293] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0xb0e55, lpNewFilePointer=0x0, dwMoveMethod=0x354f624 | out: lpNewFilePointer=0x0) returned 1 [0122.293] WriteFile (in: hFile=0x160, lpBuffer=0x44b2070*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x354f630, lpOverlapped=0x0 | out: lpBuffer=0x44b2070*, lpNumberOfBytesWritten=0x354f630*=0x40000, lpOverlapped=0x0) returned 1 [0122.294] SetFilePointerEx (in: hFile=0x160, liDistanceToMove=0x1d2b00, lpNewFilePointer=0x0, dwMoveMethod=0x354f624 | out: lpNewFilePointer=0x0) returned 1 [0122.294] WriteFile (in: hFile=0x160, lpBuffer=0x44b2070*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x354f630, lpOverlapped=0x0 | out: lpBuffer=0x44b2070*, lpNumberOfBytesWritten=0x354f630*=0x40000, lpOverlapped=0x0) returned 1 [0122.295] CloseHandle (hObject=0x160) returned 1 [0122.295] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPOBJS.DLL.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0122.296] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPOBJS.DLL") returned 92 [0122.296] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPOBJS.DLL") returned 92 [0122.296] lstrlenW (lpString=".doc") returned 4 [0122.296] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0122.296] lstrlenW (lpString=".docx") returned 5 [0122.296] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0122.296] lstrlenW (lpString=".pdf") returned 4 [0122.296] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0122.296] lstrlenW (lpString=".xls") returned 4 [0122.296] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0122.296] lstrlenW (lpString=".xlsx") returned 5 [0122.296] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0122.296] lstrlenW (lpString=".ppt") returned 4 [0122.296] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0122.296] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPOBJS.DLL") returned 92 [0122.296] lstrlenW (lpString=".zip") returned 4 [0122.296] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0122.296] lstrlenW (lpString=".rar") returned 4 [0122.296] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0122.296] lstrlenW (lpString=".bz2") returned 4 [0122.296] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0122.296] lstrlenW (lpString=".7z") returned 3 [0122.296] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0122.296] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPOBJS.DLL") returned 92 [0122.296] lstrlenW (lpString=".dbf") returned 4 [0122.296] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0122.296] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPOBJS.DLL") returned 92 [0122.296] lstrlenW (lpString=".1cd") returned 4 [0122.296] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0122.296] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPOBJS.DLL") returned 92 [0122.296] lstrlenW (lpString=".jpg") returned 4 [0122.296] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0122.297] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPOBJS.DLL") returned 92 [0122.297] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPOBJS.DLL") returned 92 [0122.297] lstrlenW (lpString=".doc") returned 4 [0122.297] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0122.297] lstrlenW (lpString=".docx") returned 5 [0122.297] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0122.297] lstrlenW (lpString=".pdf") returned 4 [0122.297] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0122.297] lstrlenW (lpString=".xls") returned 4 [0122.297] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0122.297] lstrlenW (lpString=".xlsx") returned 5 [0122.297] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0122.297] lstrlenW (lpString=".ppt") returned 4 [0122.297] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0122.297] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPOBJS.DLL") returned 92 [0122.297] lstrlenW (lpString=".zip") returned 4 [0122.297] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0122.297] lstrlenW (lpString=".rar") returned 4 [0122.297] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0122.297] lstrlenW (lpString=".bz2") returned 4 [0122.297] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0122.297] lstrlenW (lpString=".7z") returned 3 [0122.297] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0122.297] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPOBJS.DLL") returned 92 [0122.297] lstrlenW (lpString=".dbf") returned 4 [0122.297] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0122.297] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPOBJS.DLL") returned 92 [0122.297] lstrlenW (lpString=".1cd") returned 4 [0122.297] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0122.297] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPOBJS.DLL") returned 92 [0122.297] lstrlenW (lpString=".jpg") returned 4 [0122.297] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0122.297] lstrcmpiW (lpString1=".LEX", lpString2=".waifu") returned -1 [0122.297] lstrlenW (lpString="MSWDS_EN.LEX") returned 12 [0122.298] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_EN.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_en.lex"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0122.363] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x354f8c4 | out: lpFileSize=0x354f8c4*=444027) returned 1 [0122.364] CloseHandle (hObject=0x208) returned 1 [0122.364] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_EN.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_en.lex")) returned 0x20 [0122.364] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_EN.LEX.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_en.lex.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0122.364] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_EN.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_en.lex"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0122.364] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f870 | out: lpNewFilePointer=0x0) returned 1 [0122.364] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f870 | out: lpNewFilePointer=0x0) returned 1 [0122.364] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_EN.LEX.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_en.lex.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0122.364] GetLastError () returned 0x0 [0122.364] ReadFile (in: hFile=0x208, lpBuffer=0x4120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x354f87c, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesRead=0x354f87c*=0x6c67b, lpOverlapped=0x0) returned 1 [0122.445] WriteFile (in: hFile=0x230, lpBuffer=0x4120020*, nNumberOfBytesToWrite=0x6c680, lpNumberOfBytesWritten=0x354f644, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesWritten=0x354f644*=0x6c680, lpOverlapped=0x0) returned 1 [0122.458] ReadFile (in: hFile=0x208, lpBuffer=0x4120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x354f87c, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesRead=0x354f87c*=0x0, lpOverlapped=0x0) returned 1 [0122.458] WriteFile (in: hFile=0x230, lpBuffer=0x4120020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x354f644, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesWritten=0x354f644*=0xec, lpOverlapped=0x0) returned 1 [0122.458] SetEndOfFile (hFile=0x230) returned 1 [0122.458] CloseHandle (hObject=0x230) returned 1 [0122.458] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f870 | out: lpNewFilePointer=0x0) returned 1 [0122.458] SetEndOfFile (hFile=0x208) returned 1 [0122.460] CloseHandle (hObject=0x208) returned 1 [0122.460] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_EN.LEX.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0122.460] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_EN.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_en.lex")) returned 1 [0122.468] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_EN.LEX") returned 65 [0122.468] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_EN.LEX") returned 65 [0122.469] lstrlenW (lpString=".doc") returned 4 [0122.469] lstrcmpiW (lpString1=".doc", lpString2=".LEX") returned -1 [0122.469] lstrlenW (lpString=".docx") returned 5 [0122.469] lstrcmpiW (lpString1=".docx", lpString2="N.LEX") returned -1 [0122.469] lstrlenW (lpString=".pdf") returned 4 [0122.469] lstrcmpiW (lpString1=".pdf", lpString2=".LEX") returned 1 [0122.469] lstrlenW (lpString=".xls") returned 4 [0122.469] lstrcmpiW (lpString1=".xls", lpString2=".LEX") returned 1 [0122.469] lstrlenW (lpString=".xlsx") returned 5 [0122.469] lstrcmpiW (lpString1=".xlsx", lpString2="N.LEX") returned -1 [0122.469] lstrlenW (lpString=".ppt") returned 4 [0122.469] lstrcmpiW (lpString1=".ppt", lpString2=".LEX") returned 1 [0122.469] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_EN.LEX") returned 65 [0122.469] lstrlenW (lpString=".zip") returned 4 [0122.469] lstrcmpiW (lpString1=".zip", lpString2=".LEX") returned 1 [0122.469] lstrlenW (lpString=".rar") returned 4 [0122.469] lstrcmpiW (lpString1=".rar", lpString2=".LEX") returned 1 [0122.469] lstrlenW (lpString=".bz2") returned 4 [0122.469] lstrcmpiW (lpString1=".bz2", lpString2=".LEX") returned -1 [0122.469] lstrlenW (lpString=".7z") returned 3 [0122.469] lstrcmpiW (lpString1=".7z", lpString2="LEX") returned -1 [0122.469] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_EN.LEX") returned 65 [0122.469] lstrlenW (lpString=".dbf") returned 4 [0122.469] lstrcmpiW (lpString1=".dbf", lpString2=".LEX") returned -1 [0122.469] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_EN.LEX") returned 65 [0122.469] lstrlenW (lpString=".1cd") returned 4 [0122.469] lstrcmpiW (lpString1=".1cd", lpString2=".LEX") returned -1 [0122.469] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_EN.LEX") returned 65 [0122.469] lstrlenW (lpString=".jpg") returned 4 [0122.469] lstrcmpiW (lpString1=".jpg", lpString2=".LEX") returned -1 [0122.469] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_EN.LEX") returned 65 [0122.469] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_EN.LEX") returned 65 [0122.469] lstrlenW (lpString=".doc") returned 4 [0122.469] lstrcmpiW (lpString1=".doc", lpString2=".LEX") returned -1 [0122.469] lstrlenW (lpString=".docx") returned 5 [0122.469] lstrcmpiW (lpString1=".docx", lpString2="N.LEX") returned -1 [0122.469] lstrlenW (lpString=".pdf") returned 4 [0122.469] lstrcmpiW (lpString1=".pdf", lpString2=".LEX") returned 1 [0122.469] lstrlenW (lpString=".xls") returned 4 [0122.469] lstrcmpiW (lpString1=".xls", lpString2=".LEX") returned 1 [0122.469] lstrlenW (lpString=".xlsx") returned 5 [0122.469] lstrcmpiW (lpString1=".xlsx", lpString2="N.LEX") returned -1 [0122.469] lstrlenW (lpString=".ppt") returned 4 [0122.469] lstrcmpiW (lpString1=".ppt", lpString2=".LEX") returned 1 [0122.469] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_EN.LEX") returned 65 [0122.469] lstrlenW (lpString=".zip") returned 4 [0122.469] lstrcmpiW (lpString1=".zip", lpString2=".LEX") returned 1 [0122.469] lstrlenW (lpString=".rar") returned 4 [0122.469] lstrcmpiW (lpString1=".rar", lpString2=".LEX") returned 1 [0122.469] lstrlenW (lpString=".bz2") returned 4 [0122.469] lstrcmpiW (lpString1=".bz2", lpString2=".LEX") returned -1 [0122.470] lstrlenW (lpString=".7z") returned 3 [0122.470] lstrcmpiW (lpString1=".7z", lpString2="LEX") returned -1 [0122.470] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_EN.LEX") returned 65 [0122.470] lstrlenW (lpString=".dbf") returned 4 [0122.470] lstrcmpiW (lpString1=".dbf", lpString2=".LEX") returned -1 [0122.470] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_EN.LEX") returned 65 [0122.470] lstrlenW (lpString=".1cd") returned 4 [0122.470] lstrcmpiW (lpString1=".1cd", lpString2=".LEX") returned -1 [0122.470] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_EN.LEX") returned 65 [0122.470] lstrlenW (lpString=".jpg") returned 4 [0122.470] lstrcmpiW (lpString1=".jpg", lpString2=".LEX") returned -1 [0122.470] lstrcmpiW (lpString1=".DLL", lpString2=".waifu") returned -1 [0122.470] lstrlenW (lpString="STINTL.DLL") returned 10 [0122.470] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\stintl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0122.470] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x354f8c4 | out: lpFileSize=0x354f8c4*=17280) returned 1 [0122.470] CloseHandle (hObject=0x1f0) returned 1 [0122.470] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\stintl.dll")) returned 0x20 [0122.470] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\stintl.dll.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0122.470] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\stintl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0122.471] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f870 | out: lpNewFilePointer=0x0) returned 1 [0122.471] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f870 | out: lpNewFilePointer=0x0) returned 1 [0122.471] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\stintl.dll.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0122.476] GetLastError () returned 0x0 [0122.476] ReadFile (in: hFile=0x1f0, lpBuffer=0x4120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x354f87c, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesRead=0x354f87c*=0x4380, lpOverlapped=0x0) returned 1 [0122.494] WriteFile (in: hFile=0x218, lpBuffer=0x4120020*, nNumberOfBytesToWrite=0x4390, lpNumberOfBytesWritten=0x354f644, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesWritten=0x354f644*=0x4390, lpOverlapped=0x0) returned 1 [0122.495] ReadFile (in: hFile=0x1f0, lpBuffer=0x4120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x354f87c, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesRead=0x354f87c*=0x0, lpOverlapped=0x0) returned 1 [0122.495] WriteFile (in: hFile=0x218, lpBuffer=0x4120020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x354f644, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesWritten=0x354f644*=0xe8, lpOverlapped=0x0) returned 1 [0122.495] SetEndOfFile (hFile=0x218) returned 1 [0122.495] CloseHandle (hObject=0x218) returned 1 [0122.495] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f870 | out: lpNewFilePointer=0x0) returned 1 [0122.495] SetEndOfFile (hFile=0x1f0) returned 1 [0122.496] CloseHandle (hObject=0x1f0) returned 1 [0122.496] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0122.496] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\stintl.dll")) returned 1 [0122.496] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL") returned 72 [0122.496] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL") returned 72 [0122.496] lstrlenW (lpString=".doc") returned 4 [0122.496] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0122.496] lstrlenW (lpString=".docx") returned 5 [0122.496] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0122.496] lstrlenW (lpString=".pdf") returned 4 [0122.496] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0122.496] lstrlenW (lpString=".xls") returned 4 [0122.496] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0122.496] lstrlenW (lpString=".xlsx") returned 5 [0122.496] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0122.497] lstrlenW (lpString=".ppt") returned 4 [0122.497] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0122.497] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL") returned 72 [0122.497] lstrlenW (lpString=".zip") returned 4 [0122.497] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0122.497] lstrlenW (lpString=".rar") returned 4 [0122.497] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0122.497] lstrlenW (lpString=".bz2") returned 4 [0122.497] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0122.497] lstrlenW (lpString=".7z") returned 3 [0122.497] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0122.497] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL") returned 72 [0122.497] lstrlenW (lpString=".dbf") returned 4 [0122.497] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0122.497] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL") returned 72 [0122.497] lstrlenW (lpString=".1cd") returned 4 [0122.497] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0122.497] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL") returned 72 [0122.497] lstrlenW (lpString=".jpg") returned 4 [0122.497] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0122.497] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL") returned 72 [0122.497] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL") returned 72 [0122.497] lstrlenW (lpString=".doc") returned 4 [0122.497] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0122.497] lstrlenW (lpString=".docx") returned 5 [0122.497] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0122.497] lstrlenW (lpString=".pdf") returned 4 [0122.497] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0122.497] lstrlenW (lpString=".xls") returned 4 [0122.497] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0122.497] lstrlenW (lpString=".xlsx") returned 5 [0122.497] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0122.497] lstrlenW (lpString=".ppt") returned 4 [0122.497] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0122.497] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL") returned 72 [0122.497] lstrlenW (lpString=".zip") returned 4 [0122.497] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0122.497] lstrlenW (lpString=".rar") returned 4 [0122.497] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0122.497] lstrlenW (lpString=".bz2") returned 4 [0122.497] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0122.497] lstrlenW (lpString=".7z") returned 3 [0122.497] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0122.497] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL") returned 72 [0122.497] lstrlenW (lpString=".dbf") returned 4 [0122.497] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0122.497] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL") returned 72 [0122.497] lstrlenW (lpString=".1cd") returned 4 [0122.497] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0122.498] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL") returned 72 [0122.498] lstrlenW (lpString=".jpg") returned 4 [0122.498] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0122.498] lstrcmpiW (lpString1=".IDX_DLL", lpString2=".waifu") returned -1 [0122.498] lstrlenW (lpString="STINTL.DLL.IDX_DLL") returned 18 [0122.498] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\stintl.dll.idx_dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0122.503] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x354f8c4 | out: lpFileSize=0x354f8c4*=13696) returned 1 [0122.503] CloseHandle (hObject=0x1f0) returned 1 [0122.503] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\stintl.dll.idx_dll")) returned 0x20 [0122.503] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\stintl.dll.idx_dll.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0122.503] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\stintl.dll.idx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0122.503] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f870 | out: lpNewFilePointer=0x0) returned 1 [0122.503] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f870 | out: lpNewFilePointer=0x0) returned 1 [0122.504] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\stintl.dll.idx_dll.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0122.504] GetLastError () returned 0x0 [0122.504] ReadFile (in: hFile=0x1f0, lpBuffer=0x4120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x354f87c, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesRead=0x354f87c*=0x3580, lpOverlapped=0x0) returned 1 [0122.532] WriteFile (in: hFile=0x218, lpBuffer=0x4120020*, nNumberOfBytesToWrite=0x3590, lpNumberOfBytesWritten=0x354f644, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesWritten=0x354f644*=0x3590, lpOverlapped=0x0) returned 1 [0122.534] ReadFile (in: hFile=0x1f0, lpBuffer=0x4120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x354f87c, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesRead=0x354f87c*=0x0, lpOverlapped=0x0) returned 1 [0122.534] WriteFile (in: hFile=0x218, lpBuffer=0x4120020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x354f644, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesWritten=0x354f644*=0xf8, lpOverlapped=0x0) returned 1 [0122.534] SetEndOfFile (hFile=0x218) returned 1 [0122.534] CloseHandle (hObject=0x218) returned 1 [0122.534] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f870 | out: lpNewFilePointer=0x0) returned 1 [0122.534] SetEndOfFile (hFile=0x1f0) returned 1 [0122.535] CloseHandle (hObject=0x1f0) returned 1 [0122.535] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0122.535] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\stintl.dll.idx_dll")) returned 1 [0122.538] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL") returned 80 [0122.538] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL") returned 80 [0122.538] lstrlenW (lpString=".doc") returned 4 [0122.538] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0122.538] lstrlenW (lpString=".docx") returned 5 [0122.538] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0122.538] lstrlenW (lpString=".pdf") returned 4 [0122.538] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0122.538] lstrlenW (lpString=".xls") returned 4 [0122.538] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0122.538] lstrlenW (lpString=".xlsx") returned 5 [0122.538] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0122.538] lstrlenW (lpString=".ppt") returned 4 [0122.538] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0122.538] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL") returned 80 [0122.538] lstrlenW (lpString=".zip") returned 4 [0122.538] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0122.538] lstrlenW (lpString=".rar") returned 4 [0122.538] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0122.538] lstrlenW (lpString=".bz2") returned 4 [0122.538] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0122.538] lstrlenW (lpString=".7z") returned 3 [0122.538] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0122.538] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL") returned 80 [0122.538] lstrlenW (lpString=".dbf") returned 4 [0122.538] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0122.538] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL") returned 80 [0122.538] lstrlenW (lpString=".1cd") returned 4 [0122.538] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0122.538] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL") returned 80 [0122.538] lstrlenW (lpString=".jpg") returned 4 [0122.538] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0122.538] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL") returned 80 [0122.538] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL") returned 80 [0122.538] lstrlenW (lpString=".doc") returned 4 [0122.538] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0122.538] lstrlenW (lpString=".docx") returned 5 [0122.538] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0122.538] lstrlenW (lpString=".pdf") returned 4 [0122.538] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0122.538] lstrlenW (lpString=".xls") returned 4 [0122.538] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0122.538] lstrlenW (lpString=".xlsx") returned 5 [0122.539] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0122.539] lstrlenW (lpString=".ppt") returned 4 [0122.539] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0122.539] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL") returned 80 [0122.539] lstrlenW (lpString=".zip") returned 4 [0122.539] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0122.539] lstrlenW (lpString=".rar") returned 4 [0122.539] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0122.539] lstrlenW (lpString=".bz2") returned 4 [0122.539] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0122.539] lstrlenW (lpString=".7z") returned 3 [0122.539] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0122.539] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL") returned 80 [0122.539] lstrlenW (lpString=".dbf") returned 4 [0122.539] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0122.539] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL") returned 80 [0122.539] lstrlenW (lpString=".1cd") returned 4 [0122.539] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0122.539] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\STINTL.DLL.IDX_DLL") returned 80 [0122.539] lstrlenW (lpString=".jpg") returned 4 [0122.539] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0122.549] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f870 | out: lpNewFilePointer=0x0) returned 1 [0122.549] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f870 | out: lpNewFilePointer=0x0) returned 1 [0122.549] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fbiblio.dll.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0122.550] GetLastError () returned 0x0 [0122.550] ReadFile (in: hFile=0x1ec, lpBuffer=0x4120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x354f87c, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesRead=0x354f87c*=0x1e380, lpOverlapped=0x0) returned 1 [0122.623] WriteFile (in: hFile=0x1b0, lpBuffer=0x4120020*, nNumberOfBytesToWrite=0x1e390, lpNumberOfBytesWritten=0x354f644, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesWritten=0x354f644*=0x1e390, lpOverlapped=0x0) returned 1 [0122.625] ReadFile (in: hFile=0x1ec, lpBuffer=0x4120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x354f87c, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesRead=0x354f87c*=0x0, lpOverlapped=0x0) returned 1 [0122.625] WriteFile (in: hFile=0x1b0, lpBuffer=0x4120020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x354f644, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesWritten=0x354f644*=0xea, lpOverlapped=0x0) returned 1 [0122.625] SetEndOfFile (hFile=0x1b0) returned 1 [0122.625] CloseHandle (hObject=0x1b0) returned 1 [0122.626] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f870 | out: lpNewFilePointer=0x0) returned 1 [0122.626] SetEndOfFile (hFile=0x1ec) returned 1 [0122.626] CloseHandle (hObject=0x1ec) returned 1 [0122.626] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0122.626] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fbiblio.dll")) returned 1 [0122.628] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL") returned 68 [0122.628] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL") returned 68 [0122.628] lstrlenW (lpString=".doc") returned 4 [0122.628] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0122.628] lstrlenW (lpString=".docx") returned 5 [0122.628] lstrcmpiW (lpString1=".docx", lpString2="O.DLL") returned -1 [0122.628] lstrlenW (lpString=".pdf") returned 4 [0122.628] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0122.628] lstrlenW (lpString=".xls") returned 4 [0122.628] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0122.629] lstrlenW (lpString=".xlsx") returned 5 [0122.629] lstrcmpiW (lpString1=".xlsx", lpString2="O.DLL") returned -1 [0122.629] lstrlenW (lpString=".ppt") returned 4 [0122.629] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0122.629] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL") returned 68 [0122.629] lstrlenW (lpString=".zip") returned 4 [0122.629] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0122.629] lstrlenW (lpString=".rar") returned 4 [0122.629] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0122.629] lstrlenW (lpString=".bz2") returned 4 [0122.629] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0122.629] lstrlenW (lpString=".7z") returned 3 [0122.629] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0122.629] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL") returned 68 [0122.629] lstrlenW (lpString=".dbf") returned 4 [0122.629] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0122.629] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL") returned 68 [0122.629] lstrlenW (lpString=".1cd") returned 4 [0122.629] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0122.629] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FBIBLIO.DLL") returned 68 [0122.629] lstrlenW (lpString=".jpg") returned 4 [0122.629] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0122.630] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f870 | out: lpNewFilePointer=0x0) returned 1 [0122.630] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f870 | out: lpNewFilePointer=0x0) returned 1 [0122.630] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPERSON.DLL.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fperson.dll.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0122.630] GetLastError () returned 0x0 [0122.630] ReadFile (in: hFile=0x1ec, lpBuffer=0x4120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x354f87c, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesRead=0x354f87c*=0x35380, lpOverlapped=0x0) returned 1 [0122.737] WriteFile (in: hFile=0x1b0, lpBuffer=0x4120020*, nNumberOfBytesToWrite=0x35390, lpNumberOfBytesWritten=0x354f644, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesWritten=0x354f644*=0x35390, lpOverlapped=0x0) returned 1 [0122.738] ReadFile (in: hFile=0x1ec, lpBuffer=0x4120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x354f87c, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesRead=0x354f87c*=0x0, lpOverlapped=0x0) returned 1 [0122.738] WriteFile (in: hFile=0x1b0, lpBuffer=0x4120020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x354f644, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesWritten=0x354f644*=0xea, lpOverlapped=0x0) returned 1 [0122.738] SetEndOfFile (hFile=0x1b0) returned 1 [0122.739] CloseHandle (hObject=0x1b0) returned 1 [0122.739] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f870 | out: lpNewFilePointer=0x0) returned 1 [0122.739] SetEndOfFile (hFile=0x1ec) returned 1 [0122.739] CloseHandle (hObject=0x1ec) returned 1 [0122.739] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPERSON.DLL.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0122.740] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPERSON.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fperson.dll")) returned 1 [0122.740] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPERSON.DLL") returned 68 [0122.740] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPERSON.DLL") returned 68 [0122.740] lstrlenW (lpString=".doc") returned 4 [0122.740] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0122.740] lstrlenW (lpString=".docx") returned 5 [0122.740] lstrcmpiW (lpString1=".docx", lpString2="N.DLL") returned -1 [0122.740] lstrlenW (lpString=".pdf") returned 4 [0122.740] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0122.740] lstrlenW (lpString=".xls") returned 4 [0122.740] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0122.740] lstrlenW (lpString=".xlsx") returned 5 [0122.740] lstrcmpiW (lpString1=".xlsx", lpString2="N.DLL") returned -1 [0122.740] lstrlenW (lpString=".ppt") returned 4 [0122.740] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0122.740] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPERSON.DLL") returned 68 [0122.740] lstrlenW (lpString=".zip") returned 4 [0122.740] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0122.740] lstrlenW (lpString=".rar") returned 4 [0122.740] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0122.740] lstrlenW (lpString=".bz2") returned 4 [0122.740] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0122.740] lstrlenW (lpString=".7z") returned 3 [0122.740] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0122.740] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPERSON.DLL") returned 68 [0122.740] lstrlenW (lpString=".dbf") returned 4 [0122.740] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0122.740] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPERSON.DLL") returned 68 [0122.740] lstrlenW (lpString=".1cd") returned 4 [0122.740] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0122.740] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FPERSON.DLL") returned 68 [0122.740] lstrlenW (lpString=".jpg") returned 4 [0122.740] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0122.742] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f870 | out: lpNewFilePointer=0x0) returned 1 [0122.742] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f870 | out: lpNewFilePointer=0x0) returned 1 [0122.742] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IETAG.DLL.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\ietag.dll.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0122.742] GetLastError () returned 0x0 [0122.742] ReadFile (in: hFile=0x1ec, lpBuffer=0x4120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x354f87c, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesRead=0x354f87c*=0x39580, lpOverlapped=0x0) returned 1 [0122.789] WriteFile (in: hFile=0x1b0, lpBuffer=0x4120020*, nNumberOfBytesToWrite=0x39590, lpNumberOfBytesWritten=0x354f644, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesWritten=0x354f644*=0x39590, lpOverlapped=0x0) returned 1 [0122.791] ReadFile (in: hFile=0x1ec, lpBuffer=0x4120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x354f87c, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesRead=0x354f87c*=0x0, lpOverlapped=0x0) returned 1 [0122.791] WriteFile (in: hFile=0x1b0, lpBuffer=0x4120020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x354f644, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesWritten=0x354f644*=0xe6, lpOverlapped=0x0) returned 1 [0122.792] SetEndOfFile (hFile=0x1b0) returned 1 [0122.792] CloseHandle (hObject=0x1b0) returned 1 [0122.792] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f870 | out: lpNewFilePointer=0x0) returned 1 [0122.792] SetEndOfFile (hFile=0x1ec) returned 1 [0122.793] CloseHandle (hObject=0x1ec) returned 1 [0122.793] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IETAG.DLL.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0122.793] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IETAG.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\ietag.dll")) returned 1 [0122.794] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IETAG.DLL") returned 66 [0122.794] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IETAG.DLL") returned 66 [0122.794] lstrlenW (lpString=".doc") returned 4 [0122.794] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0122.794] lstrlenW (lpString=".docx") returned 5 [0122.794] lstrcmpiW (lpString1=".docx", lpString2="G.DLL") returned -1 [0122.794] lstrlenW (lpString=".pdf") returned 4 [0122.794] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0122.794] lstrlenW (lpString=".xls") returned 4 [0122.794] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0122.794] lstrlenW (lpString=".xlsx") returned 5 [0122.794] lstrcmpiW (lpString1=".xlsx", lpString2="G.DLL") returned -1 [0122.794] lstrlenW (lpString=".ppt") returned 4 [0122.794] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0122.794] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IETAG.DLL") returned 66 [0122.794] lstrlenW (lpString=".zip") returned 4 [0122.794] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0122.794] lstrlenW (lpString=".rar") returned 4 [0122.794] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0122.794] lstrlenW (lpString=".bz2") returned 4 [0122.794] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0122.794] lstrlenW (lpString=".7z") returned 3 [0122.794] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0122.794] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IETAG.DLL") returned 66 [0122.794] lstrlenW (lpString=".dbf") returned 4 [0122.794] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0122.794] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IETAG.DLL") returned 66 [0122.795] lstrlenW (lpString=".1cd") returned 4 [0122.795] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0122.795] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IETAG.DLL") returned 66 [0122.795] lstrlenW (lpString=".jpg") returned 4 [0122.795] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0122.815] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f870 | out: lpNewFilePointer=0x0) returned 1 [0122.815] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f870 | out: lpNewFilePointer=0x0) returned 1 [0122.815] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.DLL.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.dll.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0122.815] GetLastError () returned 0x0 [0122.815] ReadFile (in: hFile=0x1ec, lpBuffer=0x4120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x354f87c, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesRead=0x354f87c*=0x1b180, lpOverlapped=0x0) returned 1 [0122.973] WriteFile (in: hFile=0x1b0, lpBuffer=0x4120020*, nNumberOfBytesToWrite=0x1b190, lpNumberOfBytesWritten=0x354f644, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesWritten=0x354f644*=0x1b190, lpOverlapped=0x0) returned 1 [0122.975] ReadFile (in: hFile=0x1ec, lpBuffer=0x4120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x354f87c, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesRead=0x354f87c*=0x0, lpOverlapped=0x0) returned 1 [0122.975] WriteFile (in: hFile=0x1b0, lpBuffer=0x4120020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x354f644, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesWritten=0x354f644*=0xea, lpOverlapped=0x0) returned 1 [0122.975] SetEndOfFile (hFile=0x1b0) returned 1 [0122.975] CloseHandle (hObject=0x1b0) returned 1 [0122.975] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f870 | out: lpNewFilePointer=0x0) returned 1 [0122.975] SetEndOfFile (hFile=0x1ec) returned 1 [0122.976] CloseHandle (hObject=0x1ec) returned 1 [0122.976] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.DLL.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0122.976] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.dll")) returned 1 [0122.976] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.DLL") returned 68 [0122.976] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.DLL") returned 68 [0122.976] lstrlenW (lpString=".doc") returned 4 [0122.976] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0122.976] lstrlenW (lpString=".docx") returned 5 [0122.976] lstrcmpiW (lpString1=".docx", lpString2="V.DLL") returned -1 [0122.976] lstrlenW (lpString=".pdf") returned 4 [0122.977] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0122.977] lstrlenW (lpString=".xls") returned 4 [0122.977] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0122.977] lstrlenW (lpString=".xlsx") returned 5 [0122.977] lstrcmpiW (lpString1=".xlsx", lpString2="V.DLL") returned -1 [0122.977] lstrlenW (lpString=".ppt") returned 4 [0122.977] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0122.977] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.DLL") returned 68 [0122.977] lstrlenW (lpString=".zip") returned 4 [0122.977] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0122.977] lstrlenW (lpString=".rar") returned 4 [0122.977] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0122.977] lstrlenW (lpString=".bz2") returned 4 [0122.977] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0122.977] lstrlenW (lpString=".7z") returned 3 [0122.977] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0122.977] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.DLL") returned 68 [0122.977] lstrlenW (lpString=".dbf") returned 4 [0122.977] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0122.977] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.DLL") returned 68 [0122.977] lstrlenW (lpString=".1cd") returned 4 [0122.977] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0122.977] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.DLL") returned 68 [0122.977] lstrlenW (lpString=".jpg") returned 4 [0122.977] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0122.981] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f870 | out: lpNewFilePointer=0x0) returned 1 [0122.981] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f870 | out: lpNewFilePointer=0x0) returned 1 [0122.982] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\RECOVR32.CNV.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\recovr32.cnv.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x240 [0122.995] GetLastError () returned 0x0 [0122.995] ReadFile (in: hFile=0x1b0, lpBuffer=0x4120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x354f87c, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesRead=0x354f87c*=0x8f68, lpOverlapped=0x0) returned 1 [0123.006] WriteFile (in: hFile=0x240, lpBuffer=0x4120020*, nNumberOfBytesToWrite=0x8f70, lpNumberOfBytesWritten=0x354f644, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesWritten=0x354f644*=0x8f70, lpOverlapped=0x0) returned 1 [0123.007] ReadFile (in: hFile=0x1b0, lpBuffer=0x4120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x354f87c, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesRead=0x354f87c*=0x0, lpOverlapped=0x0) returned 1 [0123.007] WriteFile (in: hFile=0x240, lpBuffer=0x4120020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x354f644, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesWritten=0x354f644*=0xec, lpOverlapped=0x0) returned 1 [0123.008] SetEndOfFile (hFile=0x240) returned 1 [0123.008] CloseHandle (hObject=0x240) returned 1 [0123.008] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f870 | out: lpNewFilePointer=0x0) returned 1 [0123.008] SetEndOfFile (hFile=0x1b0) returned 1 [0123.008] CloseHandle (hObject=0x1b0) returned 1 [0123.008] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\RECOVR32.CNV.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0123.009] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\RECOVR32.CNV" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\recovr32.cnv")) returned 1 [0123.010] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\RECOVR32.CNV") returned 68 [0123.010] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\RECOVR32.CNV") returned 68 [0123.010] lstrlenW (lpString=".doc") returned 4 [0123.010] lstrcmpiW (lpString1=".doc", lpString2=".CNV") returned 1 [0123.010] lstrlenW (lpString=".docx") returned 5 [0123.010] lstrcmpiW (lpString1=".docx", lpString2="2.CNV") returned -1 [0123.010] lstrlenW (lpString=".pdf") returned 4 [0123.010] lstrcmpiW (lpString1=".pdf", lpString2=".CNV") returned 1 [0123.010] lstrlenW (lpString=".xls") returned 4 [0123.010] lstrcmpiW (lpString1=".xls", lpString2=".CNV") returned 1 [0123.010] lstrlenW (lpString=".xlsx") returned 5 [0123.010] lstrcmpiW (lpString1=".xlsx", lpString2="2.CNV") returned -1 [0123.010] lstrlenW (lpString=".ppt") returned 4 [0123.010] lstrcmpiW (lpString1=".ppt", lpString2=".CNV") returned 1 [0123.010] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\RECOVR32.CNV") returned 68 [0123.010] lstrlenW (lpString=".zip") returned 4 [0123.010] lstrcmpiW (lpString1=".zip", lpString2=".CNV") returned 1 [0123.010] lstrlenW (lpString=".rar") returned 4 [0123.010] lstrcmpiW (lpString1=".rar", lpString2=".CNV") returned 1 [0123.010] lstrlenW (lpString=".bz2") returned 4 [0123.010] lstrcmpiW (lpString1=".bz2", lpString2=".CNV") returned -1 [0123.010] lstrlenW (lpString=".7z") returned 3 [0123.010] lstrcmpiW (lpString1=".7z", lpString2="CNV") returned -1 [0123.010] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\RECOVR32.CNV") returned 68 [0123.010] lstrlenW (lpString=".dbf") returned 4 [0123.010] lstrcmpiW (lpString1=".dbf", lpString2=".CNV") returned 1 [0123.010] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\RECOVR32.CNV") returned 68 [0123.010] lstrlenW (lpString=".1cd") returned 4 [0123.010] lstrcmpiW (lpString1=".1cd", lpString2=".CNV") returned -1 [0123.010] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\RECOVR32.CNV") returned 68 [0123.010] lstrlenW (lpString=".jpg") returned 4 [0123.010] lstrcmpiW (lpString1=".jpg", lpString2=".CNV") returned 1 [0123.018] SetFilePointerEx (in: hFile=0x238, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f870 | out: lpNewFilePointer=0x0) returned 1 [0123.018] SetFilePointerEx (in: hFile=0x238, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f870 | out: lpNewFilePointer=0x0) returned 1 [0123.018] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\Wks9Pxy.cnv.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wks9pxy.cnv.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0123.018] GetLastError () returned 0x0 [0123.018] ReadFile (in: hFile=0x238, lpBuffer=0x4120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x354f87c, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesRead=0x354f87c*=0xdfa0, lpOverlapped=0x0) returned 1 [0123.063] WriteFile (in: hFile=0x16c, lpBuffer=0x4120020*, nNumberOfBytesToWrite=0xdfb0, lpNumberOfBytesWritten=0x354f644, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesWritten=0x354f644*=0xdfb0, lpOverlapped=0x0) returned 1 [0123.064] ReadFile (in: hFile=0x238, lpBuffer=0x4120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x354f87c, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesRead=0x354f87c*=0x0, lpOverlapped=0x0) returned 1 [0123.064] WriteFile (in: hFile=0x16c, lpBuffer=0x4120020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x354f644, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesWritten=0x354f644*=0xea, lpOverlapped=0x0) returned 1 [0123.065] SetEndOfFile (hFile=0x16c) returned 1 [0123.065] CloseHandle (hObject=0x16c) returned 1 [0123.065] SetFilePointerEx (in: hFile=0x238, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f870 | out: lpNewFilePointer=0x0) returned 1 [0123.065] SetEndOfFile (hFile=0x238) returned 1 [0123.065] CloseHandle (hObject=0x238) returned 1 [0123.065] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\Wks9Pxy.cnv.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0123.066] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\Wks9Pxy.cnv" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wks9pxy.cnv")) returned 1 [0123.066] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\Wks9Pxy.cnv") returned 67 [0123.066] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\Wks9Pxy.cnv") returned 67 [0123.066] lstrlenW (lpString=".doc") returned 4 [0123.066] lstrcmpiW (lpString1=".doc", lpString2=".cnv") returned 1 [0123.066] lstrlenW (lpString=".docx") returned 5 [0123.066] lstrcmpiW (lpString1=".docx", lpString2="y.cnv") returned -1 [0123.066] lstrlenW (lpString=".pdf") returned 4 [0123.066] lstrcmpiW (lpString1=".pdf", lpString2=".cnv") returned 1 [0123.066] lstrlenW (lpString=".xls") returned 4 [0123.066] lstrcmpiW (lpString1=".xls", lpString2=".cnv") returned 1 [0123.066] lstrlenW (lpString=".xlsx") returned 5 [0123.066] lstrcmpiW (lpString1=".xlsx", lpString2="y.cnv") returned -1 [0123.066] lstrlenW (lpString=".ppt") returned 4 [0123.066] lstrcmpiW (lpString1=".ppt", lpString2=".cnv") returned 1 [0123.066] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\Wks9Pxy.cnv") returned 67 [0123.066] lstrlenW (lpString=".zip") returned 4 [0123.066] lstrcmpiW (lpString1=".zip", lpString2=".cnv") returned 1 [0123.066] lstrlenW (lpString=".rar") returned 4 [0123.066] lstrcmpiW (lpString1=".rar", lpString2=".cnv") returned 1 [0123.066] lstrlenW (lpString=".bz2") returned 4 [0123.066] lstrcmpiW (lpString1=".bz2", lpString2=".cnv") returned -1 [0123.066] lstrlenW (lpString=".7z") returned 3 [0123.066] lstrcmpiW (lpString1=".7z", lpString2="cnv") returned -1 [0123.066] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\Wks9Pxy.cnv") returned 67 [0123.066] lstrlenW (lpString=".dbf") returned 4 [0123.066] lstrcmpiW (lpString1=".dbf", lpString2=".cnv") returned 1 [0123.066] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\Wks9Pxy.cnv") returned 67 [0123.066] lstrlenW (lpString=".1cd") returned 4 [0123.066] lstrcmpiW (lpString1=".1cd", lpString2=".cnv") returned -1 [0123.066] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\Wks9Pxy.cnv") returned 67 [0123.066] lstrlenW (lpString=".jpg") returned 4 [0123.066] lstrcmpiW (lpString1=".jpg", lpString2=".cnv") returned 1 [0123.067] SetFilePointerEx (in: hFile=0x238, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f870 | out: lpNewFilePointer=0x0) returned 1 [0123.067] SetFilePointerEx (in: hFile=0x238, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f870 | out: lpNewFilePointer=0x0) returned 1 [0123.067] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.INF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\aftrnoon.inf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0123.067] GetLastError () returned 0x0 [0123.067] ReadFile (in: hFile=0x238, lpBuffer=0x4120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x354f87c, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesRead=0x354f87c*=0x22b, lpOverlapped=0x0) returned 1 [0123.068] WriteFile (in: hFile=0x16c, lpBuffer=0x4120020*, nNumberOfBytesToWrite=0x230, lpNumberOfBytesWritten=0x354f644, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesWritten=0x354f644*=0x230, lpOverlapped=0x0) returned 1 [0123.069] ReadFile (in: hFile=0x238, lpBuffer=0x4120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x354f87c, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesRead=0x354f87c*=0x0, lpOverlapped=0x0) returned 1 [0123.069] WriteFile (in: hFile=0x16c, lpBuffer=0x4120020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x354f644, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesWritten=0x354f644*=0xec, lpOverlapped=0x0) returned 1 [0123.069] SetEndOfFile (hFile=0x16c) returned 1 [0123.069] CloseHandle (hObject=0x16c) returned 1 [0123.069] SetFilePointerEx (in: hFile=0x238, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f870 | out: lpNewFilePointer=0x0) returned 1 [0123.069] SetEndOfFile (hFile=0x238) returned 1 [0123.069] CloseHandle (hObject=0x238) returned 1 [0123.069] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.INF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0123.070] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\aftrnoon.inf")) returned 1 [0123.070] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.INF") returned 77 [0123.070] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.INF") returned 77 [0123.070] lstrlenW (lpString=".doc") returned 4 [0123.070] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1 [0123.070] lstrlenW (lpString=".docx") returned 5 [0123.070] lstrcmpiW (lpString1=".docx", lpString2="N.INF") returned -1 [0123.070] lstrlenW (lpString=".pdf") returned 4 [0123.070] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1 [0123.070] lstrlenW (lpString=".xls") returned 4 [0123.070] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1 [0123.070] lstrlenW (lpString=".xlsx") returned 5 [0123.070] lstrcmpiW (lpString1=".xlsx", lpString2="N.INF") returned -1 [0123.070] lstrlenW (lpString=".ppt") returned 4 [0123.070] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1 [0123.070] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.INF") returned 77 [0123.070] lstrlenW (lpString=".zip") returned 4 [0123.070] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1 [0123.070] lstrlenW (lpString=".rar") returned 4 [0123.070] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1 [0123.070] lstrlenW (lpString=".bz2") returned 4 [0123.070] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1 [0123.070] lstrlenW (lpString=".7z") returned 3 [0123.070] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1 [0123.070] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.INF") returned 77 [0123.070] lstrlenW (lpString=".dbf") returned 4 [0123.070] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1 [0123.071] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.INF") returned 77 [0123.071] lstrlenW (lpString=".1cd") returned 4 [0123.071] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1 [0123.071] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.INF") returned 77 [0123.071] lstrlenW (lpString=".jpg") returned 4 [0123.071] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1 [0123.071] SetFilePointerEx (in: hFile=0x238, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f870 | out: lpNewFilePointer=0x0) returned 1 [0123.072] SetFilePointerEx (in: hFile=0x238, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f870 | out: lpNewFilePointer=0x0) returned 1 [0123.072] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\arctic.elm.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0123.073] GetLastError () returned 0x0 [0123.073] ReadFile (in: hFile=0x238, lpBuffer=0x4120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x354f87c, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesRead=0x354f87c*=0x10fc7, lpOverlapped=0x0) returned 1 [0123.151] WriteFile (in: hFile=0x16c, lpBuffer=0x4120020*, nNumberOfBytesToWrite=0x10fd0, lpNumberOfBytesWritten=0x354f644, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesWritten=0x354f644*=0x10fd0, lpOverlapped=0x0) returned 1 [0123.152] ReadFile (in: hFile=0x238, lpBuffer=0x4120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x354f87c, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesRead=0x354f87c*=0x0, lpOverlapped=0x0) returned 1 [0123.152] WriteFile (in: hFile=0x16c, lpBuffer=0x4120020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x354f644, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesWritten=0x354f644*=0xe8, lpOverlapped=0x0) returned 1 [0123.152] SetEndOfFile (hFile=0x16c) returned 1 [0123.152] CloseHandle (hObject=0x16c) returned 1 [0123.152] SetFilePointerEx (in: hFile=0x238, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f870 | out: lpNewFilePointer=0x0) returned 1 [0123.152] SetEndOfFile (hFile=0x238) returned 1 [0123.153] CloseHandle (hObject=0x238) returned 1 [0123.153] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0123.153] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\arctic.elm")) returned 1 [0123.153] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM") returned 73 [0123.154] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM") returned 73 [0123.154] lstrlenW (lpString=".doc") returned 4 [0123.154] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1 [0123.154] lstrlenW (lpString=".docx") returned 5 [0123.154] lstrcmpiW (lpString1=".docx", lpString2="C.ELM") returned -1 [0123.154] lstrlenW (lpString=".pdf") returned 4 [0123.154] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1 [0123.154] lstrlenW (lpString=".xls") returned 4 [0123.154] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1 [0123.154] lstrlenW (lpString=".xlsx") returned 5 [0123.154] lstrcmpiW (lpString1=".xlsx", lpString2="C.ELM") returned -1 [0123.154] lstrlenW (lpString=".ppt") returned 4 [0123.154] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1 [0123.154] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM") returned 73 [0123.154] lstrlenW (lpString=".zip") returned 4 [0123.154] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1 [0123.154] lstrlenW (lpString=".rar") returned 4 [0123.154] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1 [0123.154] lstrlenW (lpString=".bz2") returned 4 [0123.154] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1 [0123.154] lstrlenW (lpString=".7z") returned 3 [0123.154] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1 [0123.154] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM") returned 73 [0123.154] lstrlenW (lpString=".dbf") returned 4 [0123.154] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1 [0123.154] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM") returned 73 [0123.154] lstrlenW (lpString=".1cd") returned 4 [0123.154] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1 [0123.154] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM") returned 73 [0123.154] lstrlenW (lpString=".jpg") returned 4 [0123.154] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1 [0123.154] SetFilePointerEx (in: hFile=0x238, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f870 | out: lpNewFilePointer=0x0) returned 1 [0123.155] SetFilePointerEx (in: hFile=0x238, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f870 | out: lpNewFilePointer=0x0) returned 1 [0123.155] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\axis.elm.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0123.155] GetLastError () returned 0x0 [0123.155] ReadFile (in: hFile=0x238, lpBuffer=0x4120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x354f87c, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesRead=0x354f87c*=0x189be, lpOverlapped=0x0) returned 1 [0123.238] WriteFile (in: hFile=0x16c, lpBuffer=0x4120020*, nNumberOfBytesToWrite=0x189c0, lpNumberOfBytesWritten=0x354f644, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesWritten=0x354f644*=0x189c0, lpOverlapped=0x0) returned 1 [0123.240] ReadFile (in: hFile=0x238, lpBuffer=0x4120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x354f87c, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesRead=0x354f87c*=0x0, lpOverlapped=0x0) returned 1 [0123.240] WriteFile (in: hFile=0x16c, lpBuffer=0x4120020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x354f644, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesWritten=0x354f644*=0xe4, lpOverlapped=0x0) returned 1 [0123.240] SetEndOfFile (hFile=0x16c) returned 1 [0123.240] CloseHandle (hObject=0x16c) returned 1 [0123.240] SetFilePointerEx (in: hFile=0x238, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f870 | out: lpNewFilePointer=0x0) returned 1 [0123.240] SetEndOfFile (hFile=0x238) returned 1 [0123.241] CloseHandle (hObject=0x238) returned 1 [0123.241] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0123.241] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\axis.elm")) returned 1 [0123.242] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM") returned 69 [0123.242] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM") returned 69 [0123.242] lstrlenW (lpString=".doc") returned 4 [0123.242] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1 [0123.242] lstrlenW (lpString=".docx") returned 5 [0123.242] lstrcmpiW (lpString1=".docx", lpString2="S.ELM") returned -1 [0123.242] lstrlenW (lpString=".pdf") returned 4 [0123.242] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1 [0123.242] lstrlenW (lpString=".xls") returned 4 [0123.242] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1 [0123.242] lstrlenW (lpString=".xlsx") returned 5 [0123.242] lstrcmpiW (lpString1=".xlsx", lpString2="S.ELM") returned -1 [0123.242] lstrlenW (lpString=".ppt") returned 4 [0123.242] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1 [0123.242] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM") returned 69 [0123.242] lstrlenW (lpString=".zip") returned 4 [0123.242] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1 [0123.242] lstrlenW (lpString=".rar") returned 4 [0123.242] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1 [0123.242] lstrlenW (lpString=".bz2") returned 4 [0123.242] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1 [0123.242] lstrlenW (lpString=".7z") returned 3 [0123.242] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1 [0123.242] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM") returned 69 [0123.242] lstrlenW (lpString=".dbf") returned 4 [0123.242] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1 [0123.242] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM") returned 69 [0123.242] lstrlenW (lpString=".1cd") returned 4 [0123.242] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1 [0123.242] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM") returned 69 [0123.242] lstrlenW (lpString=".jpg") returned 4 [0123.242] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1 [0123.244] SetFilePointerEx (in: hFile=0x238, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f870 | out: lpNewFilePointer=0x0) returned 1 [0123.244] SetFilePointerEx (in: hFile=0x238, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f870 | out: lpNewFilePointer=0x0) returned 1 [0123.244] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\boldstri.inf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0123.244] GetLastError () returned 0x0 [0123.244] ReadFile (in: hFile=0x238, lpBuffer=0x4120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x354f87c, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesRead=0x354f87c*=0x254, lpOverlapped=0x0) returned 1 [0123.245] WriteFile (in: hFile=0x16c, lpBuffer=0x4120020*, nNumberOfBytesToWrite=0x260, lpNumberOfBytesWritten=0x354f644, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesWritten=0x354f644*=0x260, lpOverlapped=0x0) returned 1 [0123.245] ReadFile (in: hFile=0x238, lpBuffer=0x4120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x354f87c, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesRead=0x354f87c*=0x0, lpOverlapped=0x0) returned 1 [0123.245] WriteFile (in: hFile=0x16c, lpBuffer=0x4120020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x354f644, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesWritten=0x354f644*=0xec, lpOverlapped=0x0) returned 1 [0123.245] SetEndOfFile (hFile=0x16c) returned 1 [0123.246] CloseHandle (hObject=0x16c) returned 1 [0123.246] SetFilePointerEx (in: hFile=0x238, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f870 | out: lpNewFilePointer=0x0) returned 1 [0123.246] SetEndOfFile (hFile=0x238) returned 1 [0123.246] CloseHandle (hObject=0x238) returned 1 [0123.246] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0123.246] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\boldstri.inf")) returned 1 [0123.247] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF") returned 77 [0123.247] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF") returned 77 [0123.247] lstrlenW (lpString=".doc") returned 4 [0123.247] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1 [0123.247] lstrlenW (lpString=".docx") returned 5 [0123.247] lstrcmpiW (lpString1=".docx", lpString2="I.INF") returned -1 [0123.247] lstrlenW (lpString=".pdf") returned 4 [0123.247] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1 [0123.247] lstrlenW (lpString=".xls") returned 4 [0123.247] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1 [0123.247] lstrlenW (lpString=".xlsx") returned 5 [0123.247] lstrcmpiW (lpString1=".xlsx", lpString2="I.INF") returned -1 [0123.247] lstrlenW (lpString=".ppt") returned 4 [0123.247] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1 [0123.247] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF") returned 77 [0123.247] lstrlenW (lpString=".zip") returned 4 [0123.247] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1 [0123.247] lstrlenW (lpString=".rar") returned 4 [0123.247] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1 [0123.247] lstrlenW (lpString=".bz2") returned 4 [0123.247] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1 [0123.247] lstrlenW (lpString=".7z") returned 3 [0123.247] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1 [0123.247] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF") returned 77 [0123.247] lstrlenW (lpString=".dbf") returned 4 [0123.247] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1 [0123.247] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF") returned 77 [0123.247] lstrlenW (lpString=".1cd") returned 4 [0123.247] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1 [0123.247] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF") returned 77 [0123.247] lstrlenW (lpString=".jpg") returned 4 [0123.247] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1 [0123.248] SetFilePointerEx (in: hFile=0x238, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f870 | out: lpNewFilePointer=0x0) returned 1 [0123.248] SetFilePointerEx (in: hFile=0x238, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f870 | out: lpNewFilePointer=0x0) returned 1 [0123.248] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\breeze.elm.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0123.248] GetLastError () returned 0x0 [0123.248] ReadFile (in: hFile=0x238, lpBuffer=0x4120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x354f87c, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesRead=0x354f87c*=0x1a537, lpOverlapped=0x0) returned 1 [0123.270] WriteFile (in: hFile=0x16c, lpBuffer=0x4120020*, nNumberOfBytesToWrite=0x1a540, lpNumberOfBytesWritten=0x354f644, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesWritten=0x354f644*=0x1a540, lpOverlapped=0x0) returned 1 [0123.271] ReadFile (in: hFile=0x238, lpBuffer=0x4120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x354f87c, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesRead=0x354f87c*=0x0, lpOverlapped=0x0) returned 1 [0123.271] WriteFile (in: hFile=0x16c, lpBuffer=0x4120020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x354f644, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesWritten=0x354f644*=0xe8, lpOverlapped=0x0) returned 1 [0123.272] SetEndOfFile (hFile=0x16c) returned 1 [0123.272] CloseHandle (hObject=0x16c) returned 1 [0123.272] SetFilePointerEx (in: hFile=0x238, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f870 | out: lpNewFilePointer=0x0) returned 1 [0123.272] SetEndOfFile (hFile=0x238) returned 1 [0123.272] CloseHandle (hObject=0x238) returned 1 [0123.272] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0123.273] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\breeze.elm")) returned 1 [0123.273] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM") returned 73 [0123.273] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM") returned 73 [0123.273] lstrlenW (lpString=".doc") returned 4 [0123.273] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1 [0123.273] lstrlenW (lpString=".docx") returned 5 [0123.273] lstrcmpiW (lpString1=".docx", lpString2="E.ELM") returned -1 [0123.273] lstrlenW (lpString=".pdf") returned 4 [0123.273] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1 [0123.273] lstrlenW (lpString=".xls") returned 4 [0123.273] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1 [0123.273] lstrlenW (lpString=".xlsx") returned 5 [0123.273] lstrcmpiW (lpString1=".xlsx", lpString2="E.ELM") returned -1 [0123.273] lstrlenW (lpString=".ppt") returned 4 [0123.273] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1 [0123.273] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM") returned 73 [0123.273] lstrlenW (lpString=".zip") returned 4 [0123.273] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1 [0123.273] lstrlenW (lpString=".rar") returned 4 [0123.273] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1 [0123.273] lstrlenW (lpString=".bz2") returned 4 [0123.273] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1 [0123.273] lstrlenW (lpString=".7z") returned 3 [0123.273] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1 [0123.273] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM") returned 73 [0123.273] lstrlenW (lpString=".dbf") returned 4 [0123.273] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1 [0123.273] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM") returned 73 [0123.273] lstrlenW (lpString=".1cd") returned 4 [0123.273] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1 [0123.273] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM") returned 73 [0123.273] lstrlenW (lpString=".jpg") returned 4 [0123.274] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1 [0123.379] SetFilePointerEx (in: hFile=0x244, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f870 | out: lpNewFilePointer=0x0) returned 1 [0123.379] SetFilePointerEx (in: hFile=0x244, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f870 | out: lpNewFilePointer=0x0) returned 1 [0123.379] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\canyon.inf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x248 [0123.379] GetLastError () returned 0x0 [0123.379] ReadFile (in: hFile=0x244, lpBuffer=0x4120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x354f87c, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesRead=0x354f87c*=0x1d1, lpOverlapped=0x0) returned 1 [0123.380] WriteFile (in: hFile=0x248, lpBuffer=0x4120020*, nNumberOfBytesToWrite=0x1e0, lpNumberOfBytesWritten=0x354f644, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesWritten=0x354f644*=0x1e0, lpOverlapped=0x0) returned 1 [0123.380] ReadFile (in: hFile=0x244, lpBuffer=0x4120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x354f87c, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesRead=0x354f87c*=0x0, lpOverlapped=0x0) returned 1 [0123.380] WriteFile (in: hFile=0x248, lpBuffer=0x4120020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x354f644, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesWritten=0x354f644*=0xe8, lpOverlapped=0x0) returned 1 [0123.381] SetEndOfFile (hFile=0x248) returned 1 [0123.381] CloseHandle (hObject=0x248) returned 1 [0123.381] SetFilePointerEx (in: hFile=0x244, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f870 | out: lpNewFilePointer=0x0) returned 1 [0123.381] SetEndOfFile (hFile=0x244) returned 1 [0123.381] CloseHandle (hObject=0x244) returned 1 [0123.381] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0123.381] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\canyon.inf")) returned 1 [0123.382] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF") returned 73 [0123.382] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF") returned 73 [0123.382] lstrlenW (lpString=".doc") returned 4 [0123.382] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1 [0123.382] lstrlenW (lpString=".docx") returned 5 [0123.382] lstrcmpiW (lpString1=".docx", lpString2="N.INF") returned -1 [0123.382] lstrlenW (lpString=".pdf") returned 4 [0123.382] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1 [0123.382] lstrlenW (lpString=".xls") returned 4 [0123.382] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1 [0123.382] lstrlenW (lpString=".xlsx") returned 5 [0123.382] lstrcmpiW (lpString1=".xlsx", lpString2="N.INF") returned -1 [0123.382] lstrlenW (lpString=".ppt") returned 4 [0123.382] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1 [0123.382] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF") returned 73 [0123.382] lstrlenW (lpString=".zip") returned 4 [0123.382] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1 [0123.382] lstrlenW (lpString=".rar") returned 4 [0123.382] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1 [0123.382] lstrlenW (lpString=".bz2") returned 4 [0123.382] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1 [0123.382] lstrlenW (lpString=".7z") returned 3 [0123.382] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1 [0123.382] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF") returned 73 [0123.382] lstrlenW (lpString=".dbf") returned 4 [0123.382] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1 [0123.382] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF") returned 73 [0123.382] lstrlenW (lpString=".1cd") returned 4 [0123.382] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1 [0123.382] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF") returned 73 [0123.382] lstrlenW (lpString=".jpg") returned 4 [0123.382] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1 [0123.383] SetFilePointerEx (in: hFile=0x244, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f870 | out: lpNewFilePointer=0x0) returned 1 [0123.383] SetFilePointerEx (in: hFile=0x244, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f870 | out: lpNewFilePointer=0x0) returned 1 [0123.383] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\capsules.inf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x248 [0123.385] GetLastError () returned 0x0 [0123.385] ReadFile (in: hFile=0x244, lpBuffer=0x4120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x354f87c, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesRead=0x354f87c*=0x1f5, lpOverlapped=0x0) returned 1 [0123.386] WriteFile (in: hFile=0x248, lpBuffer=0x4120020*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x354f644, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesWritten=0x354f644*=0x200, lpOverlapped=0x0) returned 1 [0123.387] ReadFile (in: hFile=0x244, lpBuffer=0x4120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x354f87c, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesRead=0x354f87c*=0x0, lpOverlapped=0x0) returned 1 [0123.387] WriteFile (in: hFile=0x248, lpBuffer=0x4120020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x354f644, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesWritten=0x354f644*=0xec, lpOverlapped=0x0) returned 1 [0124.177] SetEndOfFile (hFile=0x248) returned 1 [0124.177] CloseHandle (hObject=0x248) returned 1 [0124.177] SetFilePointerEx (in: hFile=0x244, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f870 | out: lpNewFilePointer=0x0) returned 1 [0124.177] SetEndOfFile (hFile=0x244) returned 1 [0124.177] CloseHandle (hObject=0x244) returned 1 [0124.177] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0124.178] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\capsules.inf")) returned 1 [0124.181] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF") returned 77 [0124.181] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF") returned 77 [0124.181] lstrlenW (lpString=".doc") returned 4 [0124.181] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1 [0124.181] lstrlenW (lpString=".docx") returned 5 [0124.181] lstrcmpiW (lpString1=".docx", lpString2="S.INF") returned -1 [0124.181] lstrlenW (lpString=".pdf") returned 4 [0124.181] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1 [0124.181] lstrlenW (lpString=".xls") returned 4 [0124.181] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1 [0124.181] lstrlenW (lpString=".xlsx") returned 5 [0124.181] lstrcmpiW (lpString1=".xlsx", lpString2="S.INF") returned -1 [0124.181] lstrlenW (lpString=".ppt") returned 4 [0124.181] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1 [0124.181] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF") returned 77 [0124.181] lstrlenW (lpString=".zip") returned 4 [0124.181] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1 [0124.181] lstrlenW (lpString=".rar") returned 4 [0124.181] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1 [0124.181] lstrlenW (lpString=".bz2") returned 4 [0124.181] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1 [0124.181] lstrlenW (lpString=".7z") returned 3 [0124.182] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1 [0124.182] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF") returned 77 [0124.182] lstrlenW (lpString=".dbf") returned 4 [0124.182] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1 [0124.182] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF") returned 77 [0124.182] lstrlenW (lpString=".1cd") returned 4 [0124.182] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1 [0124.182] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF") returned 77 [0124.182] lstrlenW (lpString=".jpg") returned 4 [0124.182] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1 [0124.182] SetFilePointerEx (in: hFile=0x244, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f870 | out: lpNewFilePointer=0x0) returned 1 [0124.182] SetFilePointerEx (in: hFile=0x244, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f870 | out: lpNewFilePointer=0x0) returned 1 [0124.182] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\deepblue.elm.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x248 [0124.183] GetLastError () returned 0x0 [0124.183] ReadFile (in: hFile=0x244, lpBuffer=0x4120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x354f87c, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesRead=0x354f87c*=0x116dc, lpOverlapped=0x0) returned 1 [0124.393] WriteFile (in: hFile=0x248, lpBuffer=0x4120020*, nNumberOfBytesToWrite=0x116e0, lpNumberOfBytesWritten=0x354f644, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesWritten=0x354f644*=0x116e0, lpOverlapped=0x0) returned 1 [0124.394] ReadFile (in: hFile=0x244, lpBuffer=0x4120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x354f87c, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesRead=0x354f87c*=0x0, lpOverlapped=0x0) returned 1 [0124.394] WriteFile (in: hFile=0x248, lpBuffer=0x4120020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x354f644, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesWritten=0x354f644*=0xec, lpOverlapped=0x0) returned 1 [0124.394] SetEndOfFile (hFile=0x248) returned 1 [0124.394] CloseHandle (hObject=0x248) returned 1 [0124.394] SetFilePointerEx (in: hFile=0x244, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f870 | out: lpNewFilePointer=0x0) returned 1 [0124.394] SetEndOfFile (hFile=0x244) returned 1 [0124.395] CloseHandle (hObject=0x244) returned 1 [0124.395] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0124.395] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\deepblue.elm")) returned 1 [0124.396] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM") returned 77 [0124.396] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM") returned 77 [0124.396] lstrlenW (lpString=".doc") returned 4 [0124.396] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1 [0124.396] lstrlenW (lpString=".docx") returned 5 [0124.396] lstrcmpiW (lpString1=".docx", lpString2="E.ELM") returned -1 [0124.396] lstrlenW (lpString=".pdf") returned 4 [0124.396] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1 [0124.396] lstrlenW (lpString=".xls") returned 4 [0124.396] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1 [0124.396] lstrlenW (lpString=".xlsx") returned 5 [0124.396] lstrcmpiW (lpString1=".xlsx", lpString2="E.ELM") returned -1 [0124.396] lstrlenW (lpString=".ppt") returned 4 [0124.396] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1 [0124.396] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM") returned 77 [0124.396] lstrlenW (lpString=".zip") returned 4 [0124.396] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1 [0124.396] lstrlenW (lpString=".rar") returned 4 [0124.396] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1 [0124.396] lstrlenW (lpString=".bz2") returned 4 [0124.396] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1 [0124.396] lstrlenW (lpString=".7z") returned 3 [0124.396] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1 [0124.396] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM") returned 77 [0124.396] lstrlenW (lpString=".dbf") returned 4 [0124.396] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1 [0124.396] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM") returned 77 [0124.396] lstrlenW (lpString=".1cd") returned 4 [0124.396] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1 [0124.396] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM") returned 77 [0124.396] lstrlenW (lpString=".jpg") returned 4 [0124.396] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1 [0124.402] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f870 | out: lpNewFilePointer=0x0) returned 1 [0124.402] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f870 | out: lpNewFilePointer=0x0) returned 1 [0124.402] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.INF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\indust.inf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0124.402] GetLastError () returned 0x0 [0124.402] ReadFile (in: hFile=0x220, lpBuffer=0x4120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x354f87c, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesRead=0x354f87c*=0x225, lpOverlapped=0x0) returned 1 [0124.403] WriteFile (in: hFile=0x21c, lpBuffer=0x4120020*, nNumberOfBytesToWrite=0x230, lpNumberOfBytesWritten=0x354f644, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesWritten=0x354f644*=0x230, lpOverlapped=0x0) returned 1 [0124.404] ReadFile (in: hFile=0x220, lpBuffer=0x4120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x354f87c, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesRead=0x354f87c*=0x0, lpOverlapped=0x0) returned 1 [0124.404] WriteFile (in: hFile=0x21c, lpBuffer=0x4120020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x354f644, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesWritten=0x354f644*=0xe8, lpOverlapped=0x0) returned 1 [0124.404] SetEndOfFile (hFile=0x21c) returned 1 [0124.404] CloseHandle (hObject=0x21c) returned 1 [0124.404] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f870 | out: lpNewFilePointer=0x0) returned 1 [0124.404] SetEndOfFile (hFile=0x220) returned 1 [0124.405] CloseHandle (hObject=0x220) returned 1 [0124.405] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.INF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0124.405] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\indust.inf")) returned 1 [0124.405] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.INF") returned 73 [0124.405] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.INF") returned 73 [0124.405] lstrlenW (lpString=".doc") returned 4 [0124.405] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1 [0124.405] lstrlenW (lpString=".docx") returned 5 [0124.405] lstrcmpiW (lpString1=".docx", lpString2="T.INF") returned -1 [0124.405] lstrlenW (lpString=".pdf") returned 4 [0124.405] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1 [0124.405] lstrlenW (lpString=".xls") returned 4 [0124.405] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1 [0124.405] lstrlenW (lpString=".xlsx") returned 5 [0124.405] lstrcmpiW (lpString1=".xlsx", lpString2="T.INF") returned -1 [0124.406] lstrlenW (lpString=".ppt") returned 4 [0124.406] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1 [0124.406] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.INF") returned 73 [0124.406] lstrlenW (lpString=".zip") returned 4 [0124.406] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1 [0124.406] lstrlenW (lpString=".rar") returned 4 [0124.406] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1 [0124.406] lstrlenW (lpString=".bz2") returned 4 [0124.406] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1 [0124.406] lstrlenW (lpString=".7z") returned 3 [0124.406] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1 [0124.406] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.INF") returned 73 [0124.406] lstrlenW (lpString=".dbf") returned 4 [0124.406] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1 [0124.406] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.INF") returned 73 [0124.406] lstrlenW (lpString=".1cd") returned 4 [0124.406] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1 [0124.406] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.INF") returned 73 [0124.406] lstrlenW (lpString=".jpg") returned 4 [0124.406] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1 [0124.416] SetFilePointerEx (in: hFile=0x25c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f870 | out: lpNewFilePointer=0x0) returned 1 [0124.416] SetFilePointerEx (in: hFile=0x25c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f870 | out: lpNewFilePointer=0x0) returned 1 [0124.417] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.INF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\iris.inf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x23c [0124.417] GetLastError () returned 0x0 [0124.417] ReadFile (in: hFile=0x25c, lpBuffer=0x4120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x354f87c, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesRead=0x354f87c*=0x1ce, lpOverlapped=0x0) returned 1 [0124.418] WriteFile (in: hFile=0x23c, lpBuffer=0x4120020*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x354f644, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesWritten=0x354f644*=0x1d0, lpOverlapped=0x0) returned 1 [0124.419] ReadFile (in: hFile=0x25c, lpBuffer=0x4120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x354f87c, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesRead=0x354f87c*=0x0, lpOverlapped=0x0) returned 1 [0124.419] WriteFile (in: hFile=0x23c, lpBuffer=0x4120020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x354f644, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesWritten=0x354f644*=0xe4, lpOverlapped=0x0) returned 1 [0124.419] SetEndOfFile (hFile=0x23c) returned 1 [0124.419] CloseHandle (hObject=0x23c) returned 1 [0124.419] SetFilePointerEx (in: hFile=0x25c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f870 | out: lpNewFilePointer=0x0) returned 1 [0124.419] SetEndOfFile (hFile=0x25c) returned 1 [0124.419] CloseHandle (hObject=0x25c) returned 1 [0124.420] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.INF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0124.420] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\iris.inf")) returned 1 [0124.420] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.INF") returned 69 [0124.420] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.INF") returned 69 [0124.420] lstrlenW (lpString=".doc") returned 4 [0124.420] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1 [0124.420] lstrlenW (lpString=".docx") returned 5 [0124.420] lstrcmpiW (lpString1=".docx", lpString2="S.INF") returned -1 [0124.420] lstrlenW (lpString=".pdf") returned 4 [0124.420] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1 [0124.420] lstrlenW (lpString=".xls") returned 4 [0124.420] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1 [0124.420] lstrlenW (lpString=".xlsx") returned 5 [0124.420] lstrcmpiW (lpString1=".xlsx", lpString2="S.INF") returned -1 [0124.420] lstrlenW (lpString=".ppt") returned 4 [0124.420] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1 [0124.420] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.INF") returned 69 [0124.420] lstrlenW (lpString=".zip") returned 4 [0124.420] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1 [0124.420] lstrlenW (lpString=".rar") returned 4 [0124.420] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1 [0124.420] lstrlenW (lpString=".bz2") returned 4 [0124.420] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1 [0124.420] lstrlenW (lpString=".7z") returned 3 [0124.420] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1 [0124.420] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.INF") returned 69 [0124.420] lstrlenW (lpString=".dbf") returned 4 [0124.421] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1 [0124.421] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.INF") returned 69 [0124.421] lstrlenW (lpString=".1cd") returned 4 [0124.421] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1 [0124.421] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.INF") returned 69 [0124.421] lstrlenW (lpString=".jpg") returned 4 [0124.421] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1 [0124.427] SetFilePointerEx (in: hFile=0x25c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f870 | out: lpNewFilePointer=0x0) returned 1 [0124.428] SetFilePointerEx (in: hFile=0x25c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f870 | out: lpNewFilePointer=0x0) returned 1 [0124.428] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\journal.inf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x23c [0124.428] GetLastError () returned 0x0 [0124.428] ReadFile (in: hFile=0x25c, lpBuffer=0x4120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x354f87c, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesRead=0x354f87c*=0x1f3, lpOverlapped=0x0) returned 1 [0124.429] WriteFile (in: hFile=0x23c, lpBuffer=0x4120020*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x354f644, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesWritten=0x354f644*=0x200, lpOverlapped=0x0) returned 1 [0124.429] ReadFile (in: hFile=0x25c, lpBuffer=0x4120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x354f87c, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesRead=0x354f87c*=0x0, lpOverlapped=0x0) returned 1 [0124.430] WriteFile (in: hFile=0x23c, lpBuffer=0x4120020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x354f644, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesWritten=0x354f644*=0xea, lpOverlapped=0x0) returned 1 [0124.430] SetEndOfFile (hFile=0x23c) returned 1 [0124.430] CloseHandle (hObject=0x23c) returned 1 [0124.430] SetFilePointerEx (in: hFile=0x25c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f870 | out: lpNewFilePointer=0x0) returned 1 [0124.430] SetEndOfFile (hFile=0x25c) returned 1 [0124.432] CloseHandle (hObject=0x25c) returned 1 [0124.432] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0124.432] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\journal.inf")) returned 1 [0124.432] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF") returned 75 [0124.432] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF") returned 75 [0124.432] lstrlenW (lpString=".doc") returned 4 [0124.432] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1 [0124.432] lstrlenW (lpString=".docx") returned 5 [0124.432] lstrcmpiW (lpString1=".docx", lpString2="L.INF") returned -1 [0124.432] lstrlenW (lpString=".pdf") returned 4 [0124.432] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1 [0124.432] lstrlenW (lpString=".xls") returned 4 [0124.432] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1 [0124.432] lstrlenW (lpString=".xlsx") returned 5 [0124.432] lstrcmpiW (lpString1=".xlsx", lpString2="L.INF") returned -1 [0124.432] lstrlenW (lpString=".ppt") returned 4 [0124.432] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1 [0124.432] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF") returned 75 [0124.432] lstrlenW (lpString=".zip") returned 4 [0124.432] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1 [0124.432] lstrlenW (lpString=".rar") returned 4 [0124.432] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1 [0124.432] lstrlenW (lpString=".bz2") returned 4 [0124.432] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1 [0124.433] lstrlenW (lpString=".7z") returned 3 [0124.433] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1 [0124.433] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF") returned 75 [0124.433] lstrlenW (lpString=".dbf") returned 4 [0124.433] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1 [0124.433] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF") returned 75 [0124.433] lstrlenW (lpString=".1cd") returned 4 [0124.433] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1 [0124.433] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF") returned 75 [0124.433] lstrlenW (lpString=".jpg") returned 4 [0124.433] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1 [0124.434] SetFilePointerEx (in: hFile=0x25c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f870 | out: lpNewFilePointer=0x0) returned 1 [0124.434] SetFilePointerEx (in: hFile=0x25c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f870 | out: lpNewFilePointer=0x0) returned 1 [0124.434] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.INF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\layers.inf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x23c [0124.434] GetLastError () returned 0x0 [0124.434] ReadFile (in: hFile=0x25c, lpBuffer=0x4120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x354f87c, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesRead=0x354f87c*=0x215, lpOverlapped=0x0) returned 1 [0124.435] WriteFile (in: hFile=0x23c, lpBuffer=0x4120020*, nNumberOfBytesToWrite=0x220, lpNumberOfBytesWritten=0x354f644, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesWritten=0x354f644*=0x220, lpOverlapped=0x0) returned 1 [0124.436] ReadFile (in: hFile=0x25c, lpBuffer=0x4120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x354f87c, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesRead=0x354f87c*=0x0, lpOverlapped=0x0) returned 1 [0124.436] WriteFile (in: hFile=0x23c, lpBuffer=0x4120020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x354f644, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesWritten=0x354f644*=0xe8, lpOverlapped=0x0) returned 1 [0124.436] SetEndOfFile (hFile=0x23c) returned 1 [0124.436] CloseHandle (hObject=0x23c) returned 1 [0124.436] SetFilePointerEx (in: hFile=0x25c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f870 | out: lpNewFilePointer=0x0) returned 1 [0124.436] SetEndOfFile (hFile=0x25c) returned 1 [0124.437] CloseHandle (hObject=0x25c) returned 1 [0124.437] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.INF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0124.437] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\layers.inf")) returned 1 [0124.438] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.INF") returned 73 [0124.438] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.INF") returned 73 [0124.438] lstrlenW (lpString=".doc") returned 4 [0124.438] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1 [0124.438] lstrlenW (lpString=".docx") returned 5 [0124.438] lstrcmpiW (lpString1=".docx", lpString2="S.INF") returned -1 [0124.438] lstrlenW (lpString=".pdf") returned 4 [0124.438] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1 [0124.438] lstrlenW (lpString=".xls") returned 4 [0124.438] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1 [0124.438] lstrlenW (lpString=".xlsx") returned 5 [0124.438] lstrcmpiW (lpString1=".xlsx", lpString2="S.INF") returned -1 [0124.438] lstrlenW (lpString=".ppt") returned 4 [0124.438] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1 [0124.438] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.INF") returned 73 [0124.438] lstrlenW (lpString=".zip") returned 4 [0124.438] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1 [0124.438] lstrlenW (lpString=".rar") returned 4 [0124.438] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1 [0124.438] lstrlenW (lpString=".bz2") returned 4 [0124.438] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1 [0124.438] lstrlenW (lpString=".7z") returned 3 [0124.438] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1 [0124.438] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.INF") returned 73 [0124.438] lstrlenW (lpString=".dbf") returned 4 [0124.438] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1 [0124.438] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.INF") returned 73 [0124.438] lstrlenW (lpString=".1cd") returned 4 [0124.438] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1 [0124.438] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.INF") returned 73 [0124.438] lstrlenW (lpString=".jpg") returned 4 [0124.438] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1 [0124.439] SetFilePointerEx (in: hFile=0x25c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f870 | out: lpNewFilePointer=0x0) returned 1 [0124.439] SetFilePointerEx (in: hFile=0x25c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f870 | out: lpNewFilePointer=0x0) returned 1 [0124.439] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.ELM.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\level.elm.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x23c [0124.441] GetLastError () returned 0x0 [0124.441] ReadFile (in: hFile=0x25c, lpBuffer=0x4120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x354f87c, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesRead=0x354f87c*=0xe2ec, lpOverlapped=0x0) returned 1 [0124.456] WriteFile (in: hFile=0x23c, lpBuffer=0x4120020*, nNumberOfBytesToWrite=0xe2f0, lpNumberOfBytesWritten=0x354f644, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesWritten=0x354f644*=0xe2f0, lpOverlapped=0x0) returned 1 [0124.458] ReadFile (in: hFile=0x25c, lpBuffer=0x4120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x354f87c, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesRead=0x354f87c*=0x0, lpOverlapped=0x0) returned 1 [0124.458] WriteFile (in: hFile=0x23c, lpBuffer=0x4120020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x354f644, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesWritten=0x354f644*=0xe6, lpOverlapped=0x0) returned 1 [0124.458] SetEndOfFile (hFile=0x23c) returned 1 [0124.458] CloseHandle (hObject=0x23c) returned 1 [0124.458] SetFilePointerEx (in: hFile=0x25c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f870 | out: lpNewFilePointer=0x0) returned 1 [0124.458] SetEndOfFile (hFile=0x25c) returned 1 [0124.459] CloseHandle (hObject=0x25c) returned 1 [0124.459] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.ELM.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0124.459] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\level.elm")) returned 1 [0124.459] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.ELM") returned 71 [0124.459] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.ELM") returned 71 [0124.459] lstrlenW (lpString=".doc") returned 4 [0124.459] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1 [0124.459] lstrlenW (lpString=".docx") returned 5 [0124.459] lstrcmpiW (lpString1=".docx", lpString2="L.ELM") returned -1 [0124.459] lstrlenW (lpString=".pdf") returned 4 [0124.459] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1 [0124.459] lstrlenW (lpString=".xls") returned 4 [0124.459] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1 [0124.459] lstrlenW (lpString=".xlsx") returned 5 [0124.460] lstrcmpiW (lpString1=".xlsx", lpString2="L.ELM") returned -1 [0124.460] lstrlenW (lpString=".ppt") returned 4 [0124.460] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1 [0124.460] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.ELM") returned 71 [0124.460] lstrlenW (lpString=".zip") returned 4 [0124.460] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1 [0124.460] lstrlenW (lpString=".rar") returned 4 [0124.460] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1 [0124.460] lstrlenW (lpString=".bz2") returned 4 [0124.460] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1 [0124.460] lstrlenW (lpString=".7z") returned 3 [0124.460] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1 [0124.460] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.ELM") returned 71 [0124.460] lstrlenW (lpString=".dbf") returned 4 [0124.460] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1 [0124.460] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.ELM") returned 71 [0124.460] lstrlenW (lpString=".1cd") returned 4 [0124.460] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1 [0124.460] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.ELM") returned 71 [0124.460] lstrlenW (lpString=".jpg") returned 4 [0124.460] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1 [0124.460] GetFileSizeEx (in: hFile=0x25c, lpFileSize=0x354f8c4 | out: lpFileSize=0x354f8c4*=526) returned 1 [0124.460] CloseHandle (hObject=0x25c) returned 1 [0124.460] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\level.inf")) returned 0x20 [0124.460] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.INF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\level.inf.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0124.460] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\level.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x25c [0124.461] SetFilePointerEx (in: hFile=0x25c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f870 | out: lpNewFilePointer=0x0) returned 1 [0124.461] SetFilePointerEx (in: hFile=0x25c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f870 | out: lpNewFilePointer=0x0) returned 1 [0124.461] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.INF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\level.inf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x23c [0124.461] GetLastError () returned 0x0 [0124.461] ReadFile (in: hFile=0x25c, lpBuffer=0x4120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x354f87c, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesRead=0x354f87c*=0x20e, lpOverlapped=0x0) returned 1 [0124.462] WriteFile (in: hFile=0x23c, lpBuffer=0x4120020*, nNumberOfBytesToWrite=0x210, lpNumberOfBytesWritten=0x354f644, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesWritten=0x354f644*=0x210, lpOverlapped=0x0) returned 1 [0124.463] ReadFile (in: hFile=0x25c, lpBuffer=0x4120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x354f87c, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesRead=0x354f87c*=0x0, lpOverlapped=0x0) returned 1 [0124.463] WriteFile (in: hFile=0x23c, lpBuffer=0x4120020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x354f644, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesWritten=0x354f644*=0xe6, lpOverlapped=0x0) returned 1 [0124.463] SetEndOfFile (hFile=0x23c) returned 1 [0124.463] CloseHandle (hObject=0x23c) returned 1 [0124.463] SetFilePointerEx (in: hFile=0x25c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f870 | out: lpNewFilePointer=0x0) returned 1 [0124.464] SetEndOfFile (hFile=0x25c) returned 1 [0124.464] CloseHandle (hObject=0x25c) returned 1 [0124.464] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.INF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0124.464] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\level.inf")) returned 1 [0124.465] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.INF") returned 71 [0124.465] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.INF") returned 71 [0124.465] lstrlenW (lpString=".doc") returned 4 [0124.465] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1 [0124.465] lstrlenW (lpString=".docx") returned 5 [0124.465] lstrcmpiW (lpString1=".docx", lpString2="L.INF") returned -1 [0124.465] lstrlenW (lpString=".pdf") returned 4 [0124.465] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1 [0124.465] lstrlenW (lpString=".xls") returned 4 [0124.465] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1 [0124.465] lstrlenW (lpString=".xlsx") returned 5 [0124.465] lstrcmpiW (lpString1=".xlsx", lpString2="L.INF") returned -1 [0124.465] lstrlenW (lpString=".ppt") returned 4 [0124.465] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1 [0124.465] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.INF") returned 71 [0124.465] lstrlenW (lpString=".zip") returned 4 [0124.465] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1 [0124.465] lstrlenW (lpString=".rar") returned 4 [0124.465] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1 [0124.465] lstrlenW (lpString=".bz2") returned 4 [0124.465] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1 [0124.465] lstrlenW (lpString=".7z") returned 3 [0124.465] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1 [0124.465] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.INF") returned 71 [0124.465] lstrlenW (lpString=".dbf") returned 4 [0124.465] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1 [0124.465] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.INF") returned 71 [0124.465] lstrlenW (lpString=".1cd") returned 4 [0124.465] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1 [0124.465] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.INF") returned 71 [0124.465] lstrlenW (lpString=".jpg") returned 4 [0124.465] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1 [0124.466] SetFilePointerEx (in: hFile=0x25c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f870 | out: lpNewFilePointer=0x0) returned 1 [0124.466] SetFilePointerEx (in: hFile=0x25c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f870 | out: lpNewFilePointer=0x0) returned 1 [0124.466] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\network.elm.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x23c [0124.466] GetLastError () returned 0x0 [0124.466] ReadFile (in: hFile=0x25c, lpBuffer=0x4120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x354f87c, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesRead=0x354f87c*=0xc649, lpOverlapped=0x0) returned 1 [0124.492] WriteFile (in: hFile=0x23c, lpBuffer=0x4120020*, nNumberOfBytesToWrite=0xc650, lpNumberOfBytesWritten=0x354f644, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesWritten=0x354f644*=0xc650, lpOverlapped=0x0) returned 1 [0124.493] ReadFile (in: hFile=0x25c, lpBuffer=0x4120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x354f87c, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesRead=0x354f87c*=0x0, lpOverlapped=0x0) returned 1 [0124.493] WriteFile (in: hFile=0x23c, lpBuffer=0x4120020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x354f644, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesWritten=0x354f644*=0xea, lpOverlapped=0x0) returned 1 [0124.493] SetEndOfFile (hFile=0x23c) returned 1 [0124.493] CloseHandle (hObject=0x23c) returned 1 [0124.493] SetFilePointerEx (in: hFile=0x25c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f870 | out: lpNewFilePointer=0x0) returned 1 [0124.493] SetEndOfFile (hFile=0x25c) returned 1 [0124.494] CloseHandle (hObject=0x25c) returned 1 [0124.494] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0124.494] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\network.elm")) returned 1 [0124.494] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM") returned 75 [0124.494] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM") returned 75 [0124.494] lstrlenW (lpString=".doc") returned 4 [0124.494] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1 [0124.494] lstrlenW (lpString=".docx") returned 5 [0124.494] lstrcmpiW (lpString1=".docx", lpString2="K.ELM") returned -1 [0124.494] lstrlenW (lpString=".pdf") returned 4 [0124.494] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1 [0124.494] lstrlenW (lpString=".xls") returned 4 [0124.494] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1 [0124.494] lstrlenW (lpString=".xlsx") returned 5 [0124.494] lstrcmpiW (lpString1=".xlsx", lpString2="K.ELM") returned -1 [0124.494] lstrlenW (lpString=".ppt") returned 4 [0124.494] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1 [0124.494] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM") returned 75 [0124.494] lstrlenW (lpString=".zip") returned 4 [0124.494] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1 [0124.494] lstrlenW (lpString=".rar") returned 4 [0124.494] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1 [0124.494] lstrlenW (lpString=".bz2") returned 4 [0124.494] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1 [0124.495] lstrlenW (lpString=".7z") returned 3 [0124.495] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1 [0124.495] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM") returned 75 [0124.495] lstrlenW (lpString=".dbf") returned 4 [0124.495] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1 [0124.495] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM") returned 75 [0124.495] lstrlenW (lpString=".1cd") returned 4 [0124.495] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1 [0124.495] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM") returned 75 [0124.495] lstrlenW (lpString=".jpg") returned 4 [0124.495] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1 [0124.495] SetFilePointerEx (in: hFile=0x25c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f870 | out: lpNewFilePointer=0x0) returned 1 [0124.495] SetFilePointerEx (in: hFile=0x25c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f870 | out: lpNewFilePointer=0x0) returned 1 [0124.496] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.INF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\papyrus.inf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x23c [0124.496] GetLastError () returned 0x0 [0124.496] ReadFile (in: hFile=0x25c, lpBuffer=0x4120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x354f87c, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesRead=0x354f87c*=0x1f4, lpOverlapped=0x0) returned 1 [0124.497] WriteFile (in: hFile=0x23c, lpBuffer=0x4120020*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x354f644, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesWritten=0x354f644*=0x200, lpOverlapped=0x0) returned 1 [0124.497] ReadFile (in: hFile=0x25c, lpBuffer=0x4120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x354f87c, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesRead=0x354f87c*=0x0, lpOverlapped=0x0) returned 1 [0124.497] WriteFile (in: hFile=0x23c, lpBuffer=0x4120020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x354f644, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesWritten=0x354f644*=0xea, lpOverlapped=0x0) returned 1 [0124.497] SetEndOfFile (hFile=0x23c) returned 1 [0124.497] CloseHandle (hObject=0x23c) returned 1 [0124.497] SetFilePointerEx (in: hFile=0x25c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f870 | out: lpNewFilePointer=0x0) returned 1 [0124.497] SetEndOfFile (hFile=0x25c) returned 1 [0124.510] CloseHandle (hObject=0x25c) returned 1 [0124.510] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.INF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0124.520] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\papyrus.inf")) returned 1 [0124.521] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.INF") returned 75 [0124.521] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.INF") returned 75 [0124.521] lstrlenW (lpString=".doc") returned 4 [0124.521] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1 [0124.521] lstrlenW (lpString=".docx") returned 5 [0124.521] lstrcmpiW (lpString1=".docx", lpString2="S.INF") returned -1 [0124.521] lstrlenW (lpString=".pdf") returned 4 [0124.521] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1 [0124.521] lstrlenW (lpString=".xls") returned 4 [0124.521] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1 [0124.521] lstrlenW (lpString=".xlsx") returned 5 [0124.521] lstrcmpiW (lpString1=".xlsx", lpString2="S.INF") returned -1 [0124.521] lstrlenW (lpString=".ppt") returned 4 [0124.521] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1 [0124.521] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.INF") returned 75 [0124.521] lstrlenW (lpString=".zip") returned 4 [0124.521] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1 [0124.521] lstrlenW (lpString=".rar") returned 4 [0124.521] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1 [0124.521] lstrlenW (lpString=".bz2") returned 4 [0124.521] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1 [0124.521] lstrlenW (lpString=".7z") returned 3 [0124.521] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1 [0124.521] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.INF") returned 75 [0124.521] lstrlenW (lpString=".dbf") returned 4 [0124.521] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1 [0124.521] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.INF") returned 75 [0124.521] lstrlenW (lpString=".1cd") returned 4 [0124.521] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1 [0124.521] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.INF") returned 75 [0124.521] lstrlenW (lpString=".jpg") returned 4 [0124.521] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1 [0124.522] SetFilePointerEx (in: hFile=0x25c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f870 | out: lpNewFilePointer=0x0) returned 1 [0124.522] SetFilePointerEx (in: hFile=0x25c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f870 | out: lpNewFilePointer=0x0) returned 1 [0124.522] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.INF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\profile.inf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x250 [0124.522] GetLastError () returned 0x0 [0124.522] ReadFile (in: hFile=0x25c, lpBuffer=0x4120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x354f87c, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesRead=0x354f87c*=0x24b, lpOverlapped=0x0) returned 1 [0124.524] WriteFile (in: hFile=0x250, lpBuffer=0x4120020*, nNumberOfBytesToWrite=0x250, lpNumberOfBytesWritten=0x354f644, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesWritten=0x354f644*=0x250, lpOverlapped=0x0) returned 1 [0124.525] ReadFile (in: hFile=0x25c, lpBuffer=0x4120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x354f87c, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesRead=0x354f87c*=0x0, lpOverlapped=0x0) returned 1 [0124.525] WriteFile (in: hFile=0x250, lpBuffer=0x4120020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x354f644, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesWritten=0x354f644*=0xea, lpOverlapped=0x0) returned 1 [0124.525] SetEndOfFile (hFile=0x250) returned 1 [0124.525] CloseHandle (hObject=0x250) returned 1 [0124.525] SetFilePointerEx (in: hFile=0x25c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f870 | out: lpNewFilePointer=0x0) returned 1 [0124.525] SetEndOfFile (hFile=0x25c) returned 1 [0124.526] CloseHandle (hObject=0x25c) returned 1 [0124.526] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.INF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0124.526] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\profile.inf")) returned 1 [0124.526] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.INF") returned 75 [0124.526] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.INF") returned 75 [0124.526] lstrlenW (lpString=".doc") returned 4 [0124.526] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1 [0124.545] lstrlenW (lpString=".docx") returned 5 [0124.545] lstrcmpiW (lpString1=".docx", lpString2="E.INF") returned -1 [0124.545] lstrlenW (lpString=".pdf") returned 4 [0124.545] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1 [0124.545] lstrlenW (lpString=".xls") returned 4 [0124.545] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1 [0124.545] lstrlenW (lpString=".xlsx") returned 5 [0124.545] lstrcmpiW (lpString1=".xlsx", lpString2="E.INF") returned -1 [0124.545] lstrlenW (lpString=".ppt") returned 4 [0124.545] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1 [0124.545] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.INF") returned 75 [0124.545] lstrlenW (lpString=".zip") returned 4 [0124.545] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1 [0124.545] lstrlenW (lpString=".rar") returned 4 [0124.545] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1 [0124.545] lstrlenW (lpString=".bz2") returned 4 [0124.545] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1 [0124.546] lstrlenW (lpString=".7z") returned 3 [0124.546] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1 [0124.546] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.INF") returned 75 [0124.546] lstrlenW (lpString=".dbf") returned 4 [0124.546] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1 [0124.546] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.INF") returned 75 [0124.546] lstrlenW (lpString=".1cd") returned 4 [0124.546] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1 [0124.546] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.INF") returned 75 [0124.546] lstrlenW (lpString=".jpg") returned 4 [0124.546] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1 [0124.566] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f870 | out: lpNewFilePointer=0x0) returned 1 [0124.593] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f870 | out: lpNewFilePointer=0x0) returned 1 [0124.593] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.INF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\quad.inf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0124.609] GetLastError () returned 0x0 [0124.609] ReadFile (in: hFile=0x230, lpBuffer=0x4120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x354f87c, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesRead=0x354f87c*=0x258, lpOverlapped=0x0) returned 1 [0124.610] WriteFile (in: hFile=0x218, lpBuffer=0x4120020*, nNumberOfBytesToWrite=0x260, lpNumberOfBytesWritten=0x354f644, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesWritten=0x354f644*=0x260, lpOverlapped=0x0) returned 1 [0124.611] ReadFile (in: hFile=0x230, lpBuffer=0x4120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x354f87c, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesRead=0x354f87c*=0x0, lpOverlapped=0x0) returned 1 [0124.611] WriteFile (in: hFile=0x218, lpBuffer=0x4120020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x354f644, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesWritten=0x354f644*=0xe4, lpOverlapped=0x0) returned 1 [0124.611] SetEndOfFile (hFile=0x218) returned 1 [0124.611] CloseHandle (hObject=0x218) returned 1 [0124.611] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f870 | out: lpNewFilePointer=0x0) returned 1 [0124.611] SetEndOfFile (hFile=0x230) returned 1 [0124.618] CloseHandle (hObject=0x230) returned 1 [0124.618] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.INF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0124.619] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\quad.inf")) returned 1 [0124.619] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.INF") returned 69 [0124.619] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.INF") returned 69 [0124.619] lstrlenW (lpString=".doc") returned 4 [0124.619] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1 [0124.627] lstrlenW (lpString=".docx") returned 5 [0124.627] lstrcmpiW (lpString1=".docx", lpString2="D.INF") returned -1 [0124.627] lstrlenW (lpString=".pdf") returned 4 [0124.627] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1 [0124.627] lstrlenW (lpString=".xls") returned 4 [0124.627] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1 [0124.627] lstrlenW (lpString=".xlsx") returned 5 [0124.628] lstrcmpiW (lpString1=".xlsx", lpString2="D.INF") returned -1 [0124.628] lstrlenW (lpString=".ppt") returned 4 [0124.628] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1 [0124.628] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.INF") returned 69 [0124.628] lstrlenW (lpString=".zip") returned 4 [0124.628] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1 [0124.628] lstrlenW (lpString=".rar") returned 4 [0124.628] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1 [0124.628] lstrlenW (lpString=".bz2") returned 4 [0124.628] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1 [0124.628] lstrlenW (lpString=".7z") returned 3 [0124.628] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1 [0124.628] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.INF") returned 69 [0124.628] lstrlenW (lpString=".dbf") returned 4 [0124.628] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1 [0124.628] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.INF") returned 69 [0124.628] lstrlenW (lpString=".1cd") returned 4 [0124.628] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1 [0124.628] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.INF") returned 69 [0124.628] lstrlenW (lpString=".jpg") returned 4 [0124.628] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1 [0124.628] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f870 | out: lpNewFilePointer=0x0) returned 1 [0124.628] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f870 | out: lpNewFilePointer=0x0) returned 1 [0124.628] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\ripple.inf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0124.629] GetLastError () returned 0x0 [0124.629] ReadFile (in: hFile=0x1e0, lpBuffer=0x4120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x354f87c, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesRead=0x354f87c*=0x1e7, lpOverlapped=0x0) returned 1 [0124.629] WriteFile (in: hFile=0x180, lpBuffer=0x4120020*, nNumberOfBytesToWrite=0x1f0, lpNumberOfBytesWritten=0x354f644, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesWritten=0x354f644*=0x1f0, lpOverlapped=0x0) returned 1 [0124.630] ReadFile (in: hFile=0x1e0, lpBuffer=0x4120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x354f87c, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesRead=0x354f87c*=0x0, lpOverlapped=0x0) returned 1 [0124.630] WriteFile (in: hFile=0x180, lpBuffer=0x4120020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x354f644, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesWritten=0x354f644*=0xe8, lpOverlapped=0x0) returned 1 [0124.630] SetEndOfFile (hFile=0x180) returned 1 [0124.630] CloseHandle (hObject=0x180) returned 1 [0124.630] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f870 | out: lpNewFilePointer=0x0) returned 1 [0124.630] SetEndOfFile (hFile=0x1e0) returned 1 [0124.631] CloseHandle (hObject=0x1e0) returned 1 [0124.631] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0124.631] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\ripple.inf")) returned 1 [0124.631] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF") returned 73 [0124.631] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF") returned 73 [0124.631] lstrlenW (lpString=".doc") returned 4 [0124.632] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1 [0124.632] lstrlenW (lpString=".docx") returned 5 [0124.632] lstrcmpiW (lpString1=".docx", lpString2="E.INF") returned -1 [0124.632] lstrlenW (lpString=".pdf") returned 4 [0124.632] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1 [0124.632] lstrlenW (lpString=".xls") returned 4 [0124.632] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1 [0124.632] lstrlenW (lpString=".xlsx") returned 5 [0124.632] lstrcmpiW (lpString1=".xlsx", lpString2="E.INF") returned -1 [0124.632] lstrlenW (lpString=".ppt") returned 4 [0124.632] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1 [0124.632] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF") returned 73 [0124.632] lstrlenW (lpString=".zip") returned 4 [0124.632] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1 [0124.632] lstrlenW (lpString=".rar") returned 4 [0124.632] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1 [0124.632] lstrlenW (lpString=".bz2") returned 4 [0124.632] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1 [0124.632] lstrlenW (lpString=".7z") returned 3 [0124.632] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1 [0124.632] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF") returned 73 [0124.632] lstrlenW (lpString=".dbf") returned 4 [0124.632] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1 [0124.632] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF") returned 73 [0124.632] lstrlenW (lpString=".1cd") returned 4 [0124.632] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1 [0124.632] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF") returned 73 [0124.632] lstrlenW (lpString=".jpg") returned 4 [0124.632] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1 [0124.632] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f870 | out: lpNewFilePointer=0x0) returned 1 [0124.632] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f870 | out: lpNewFilePointer=0x0) returned 1 [0124.632] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\rmnsque.elm.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0124.633] GetLastError () returned 0x0 [0124.633] ReadFile (in: hFile=0x1e0, lpBuffer=0x4120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x354f87c, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesRead=0x354f87c*=0x11e37, lpOverlapped=0x0) returned 1 [0124.704] WriteFile (in: hFile=0x180, lpBuffer=0x4120020*, nNumberOfBytesToWrite=0x11e40, lpNumberOfBytesWritten=0x354f644, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesWritten=0x354f644*=0x11e40, lpOverlapped=0x0) returned 1 [0124.705] ReadFile (in: hFile=0x1e0, lpBuffer=0x4120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x354f87c, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesRead=0x354f87c*=0x0, lpOverlapped=0x0) returned 1 [0124.705] WriteFile (in: hFile=0x180, lpBuffer=0x4120020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x354f644, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesWritten=0x354f644*=0xea, lpOverlapped=0x0) returned 1 [0124.705] SetEndOfFile (hFile=0x180) returned 1 [0124.705] CloseHandle (hObject=0x180) returned 1 [0124.705] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f870 | out: lpNewFilePointer=0x0) returned 1 [0124.705] SetEndOfFile (hFile=0x1e0) returned 1 [0124.706] CloseHandle (hObject=0x1e0) returned 1 [0124.706] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0124.706] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\rmnsque.elm")) returned 1 [0124.926] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM") returned 75 [0124.926] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM") returned 75 [0124.926] lstrlenW (lpString=".doc") returned 4 [0124.926] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1 [0124.926] lstrlenW (lpString=".docx") returned 5 [0124.926] lstrcmpiW (lpString1=".docx", lpString2="E.ELM") returned -1 [0124.926] lstrlenW (lpString=".pdf") returned 4 [0124.926] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1 [0124.926] lstrlenW (lpString=".xls") returned 4 [0124.926] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1 [0124.926] lstrlenW (lpString=".xlsx") returned 5 [0124.926] lstrcmpiW (lpString1=".xlsx", lpString2="E.ELM") returned -1 [0124.926] lstrlenW (lpString=".ppt") returned 4 [0124.926] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1 [0124.926] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM") returned 75 [0124.926] lstrlenW (lpString=".zip") returned 4 [0124.926] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1 [0124.926] lstrlenW (lpString=".rar") returned 4 [0124.926] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1 [0124.926] lstrlenW (lpString=".bz2") returned 4 [0124.926] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1 [0124.926] lstrlenW (lpString=".7z") returned 3 [0124.926] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1 [0124.926] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM") returned 75 [0124.926] lstrlenW (lpString=".dbf") returned 4 [0124.926] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1 [0124.926] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM") returned 75 [0124.926] lstrlenW (lpString=".1cd") returned 4 [0124.926] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1 [0124.926] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM") returned 75 [0124.926] lstrlenW (lpString=".jpg") returned 4 [0124.926] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1 [0125.329] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f870 | out: lpNewFilePointer=0x0) returned 1 [0125.329] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f870 | out: lpNewFilePointer=0x0) returned 1 [0125.329] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.ELM.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\spring.elm.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x258 [0125.331] GetLastError () returned 0x0 [0125.331] ReadFile (in: hFile=0x254, lpBuffer=0x4120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x354f87c, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesRead=0x354f87c*=0x10af1, lpOverlapped=0x0) returned 1 [0125.333] WriteFile (in: hFile=0x258, lpBuffer=0x4120020*, nNumberOfBytesToWrite=0x10b00, lpNumberOfBytesWritten=0x354f644, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesWritten=0x354f644*=0x10b00, lpOverlapped=0x0) returned 1 [0125.334] ReadFile (in: hFile=0x254, lpBuffer=0x4120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x354f87c, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesRead=0x354f87c*=0x0, lpOverlapped=0x0) returned 1 [0125.334] WriteFile (in: hFile=0x258, lpBuffer=0x4120020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x354f644, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesWritten=0x354f644*=0xe8, lpOverlapped=0x0) returned 1 [0125.335] SetEndOfFile (hFile=0x258) returned 1 [0125.335] CloseHandle (hObject=0x258) returned 1 [0125.335] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f870 | out: lpNewFilePointer=0x0) returned 1 [0125.335] SetEndOfFile (hFile=0x254) returned 1 [0125.336] CloseHandle (hObject=0x254) returned 1 [0125.336] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.ELM.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0125.336] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\spring.elm")) returned 1 [0125.336] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.ELM") returned 73 [0125.336] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.ELM") returned 73 [0125.336] lstrlenW (lpString=".doc") returned 4 [0125.336] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1 [0125.336] lstrlenW (lpString=".docx") returned 5 [0125.336] lstrcmpiW (lpString1=".docx", lpString2="G.ELM") returned -1 [0125.336] lstrlenW (lpString=".pdf") returned 4 [0125.336] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1 [0125.337] lstrlenW (lpString=".xls") returned 4 [0125.337] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1 [0125.337] lstrlenW (lpString=".xlsx") returned 5 [0125.337] lstrcmpiW (lpString1=".xlsx", lpString2="G.ELM") returned -1 [0125.337] lstrlenW (lpString=".ppt") returned 4 [0125.337] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1 [0125.337] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.ELM") returned 73 [0125.337] lstrlenW (lpString=".zip") returned 4 [0125.337] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1 [0125.337] lstrlenW (lpString=".rar") returned 4 [0125.337] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1 [0125.337] lstrlenW (lpString=".bz2") returned 4 [0125.337] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1 [0125.337] lstrlenW (lpString=".7z") returned 3 [0125.337] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1 [0125.337] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.ELM") returned 73 [0125.337] lstrlenW (lpString=".dbf") returned 4 [0125.337] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1 [0125.337] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.ELM") returned 73 [0125.337] lstrlenW (lpString=".1cd") returned 4 [0125.337] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1 [0125.337] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.ELM") returned 73 [0125.337] lstrlenW (lpString=".jpg") returned 4 [0125.337] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1 [0125.338] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f870 | out: lpNewFilePointer=0x0) returned 1 [0125.338] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f870 | out: lpNewFilePointer=0x0) returned 1 [0125.338] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\strtedge.elm.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x258 [0125.338] GetLastError () returned 0x0 [0125.338] ReadFile (in: hFile=0x254, lpBuffer=0x4120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x354f87c, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesRead=0x354f87c*=0xe232, lpOverlapped=0x0) returned 1 [0125.394] WriteFile (in: hFile=0x258, lpBuffer=0x4120020*, nNumberOfBytesToWrite=0xe240, lpNumberOfBytesWritten=0x354f644, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesWritten=0x354f644*=0xe240, lpOverlapped=0x0) returned 1 [0125.395] ReadFile (in: hFile=0x254, lpBuffer=0x4120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x354f87c, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesRead=0x354f87c*=0x0, lpOverlapped=0x0) returned 1 [0125.395] WriteFile (in: hFile=0x258, lpBuffer=0x4120020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x354f644, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesWritten=0x354f644*=0xec, lpOverlapped=0x0) returned 1 [0125.396] SetEndOfFile (hFile=0x258) returned 1 [0125.396] CloseHandle (hObject=0x258) returned 1 [0125.396] SetFilePointerEx (in: hFile=0x254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f870 | out: lpNewFilePointer=0x0) returned 1 [0125.396] SetEndOfFile (hFile=0x254) returned 1 [0125.396] CloseHandle (hObject=0x254) returned 1 [0125.397] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0125.397] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\strtedge.elm")) returned 1 [0125.397] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM") returned 77 [0125.397] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM") returned 77 [0125.397] lstrlenW (lpString=".doc") returned 4 [0125.397] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1 [0125.397] lstrlenW (lpString=".docx") returned 5 [0125.397] lstrcmpiW (lpString1=".docx", lpString2="E.ELM") returned -1 [0125.397] lstrlenW (lpString=".pdf") returned 4 [0125.397] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1 [0125.397] lstrlenW (lpString=".xls") returned 4 [0125.397] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1 [0125.397] lstrlenW (lpString=".xlsx") returned 5 [0125.397] lstrcmpiW (lpString1=".xlsx", lpString2="E.ELM") returned -1 [0125.397] lstrlenW (lpString=".ppt") returned 4 [0125.397] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1 [0125.397] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM") returned 77 [0125.397] lstrlenW (lpString=".zip") returned 4 [0125.397] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1 [0125.397] lstrlenW (lpString=".rar") returned 4 [0125.397] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1 [0125.397] lstrlenW (lpString=".bz2") returned 4 [0125.397] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1 [0125.397] lstrlenW (lpString=".7z") returned 3 [0125.397] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1 [0125.397] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM") returned 77 [0125.397] lstrlenW (lpString=".dbf") returned 4 [0125.397] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1 [0125.397] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM") returned 77 [0125.398] lstrlenW (lpString=".1cd") returned 4 [0125.398] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1 [0125.398] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM") returned 77 [0125.398] lstrlenW (lpString=".jpg") returned 4 [0125.398] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1 [0125.527] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f870 | out: lpNewFilePointer=0x0) returned 1 [0125.527] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f870 | out: lpNewFilePointer=0x0) returned 1 [0125.527] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\water.elm.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0125.528] GetLastError () returned 0x0 [0125.528] ReadFile (in: hFile=0x208, lpBuffer=0x4120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x354f87c, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesRead=0x354f87c*=0x101cc, lpOverlapped=0x0) returned 1 [0125.548] WriteFile (in: hFile=0x16c, lpBuffer=0x4120020*, nNumberOfBytesToWrite=0x101d0, lpNumberOfBytesWritten=0x354f644, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesWritten=0x354f644*=0x101d0, lpOverlapped=0x0) returned 1 [0125.549] ReadFile (in: hFile=0x208, lpBuffer=0x4120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x354f87c, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesRead=0x354f87c*=0x0, lpOverlapped=0x0) returned 1 [0125.549] WriteFile (in: hFile=0x16c, lpBuffer=0x4120020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x354f644, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesWritten=0x354f644*=0xe6, lpOverlapped=0x0) returned 1 [0125.549] SetEndOfFile (hFile=0x16c) returned 1 [0125.549] CloseHandle (hObject=0x16c) returned 1 [0125.549] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f870 | out: lpNewFilePointer=0x0) returned 1 [0125.549] SetEndOfFile (hFile=0x208) returned 1 [0125.549] CloseHandle (hObject=0x208) returned 1 [0125.550] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0125.550] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\water.elm")) returned 1 [0125.550] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM") returned 71 [0125.550] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM") returned 71 [0125.550] lstrlenW (lpString=".doc") returned 4 [0125.550] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1 [0125.550] lstrlenW (lpString=".docx") returned 5 [0125.550] lstrcmpiW (lpString1=".docx", lpString2="R.ELM") returned -1 [0125.550] lstrlenW (lpString=".pdf") returned 4 [0125.550] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1 [0125.550] lstrlenW (lpString=".xls") returned 4 [0125.550] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1 [0125.550] lstrlenW (lpString=".xlsx") returned 5 [0125.550] lstrcmpiW (lpString1=".xlsx", lpString2="R.ELM") returned -1 [0125.550] lstrlenW (lpString=".ppt") returned 4 [0125.550] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1 [0125.550] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM") returned 71 [0125.550] lstrlenW (lpString=".zip") returned 4 [0125.550] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1 [0125.550] lstrlenW (lpString=".rar") returned 4 [0125.551] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1 [0125.551] lstrlenW (lpString=".bz2") returned 4 [0125.551] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1 [0125.551] lstrlenW (lpString=".7z") returned 3 [0125.551] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1 [0125.551] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM") returned 71 [0125.551] lstrlenW (lpString=".dbf") returned 4 [0125.551] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1 [0125.551] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM") returned 71 [0125.551] lstrlenW (lpString=".1cd") returned 4 [0125.551] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1 [0125.551] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM") returned 71 [0125.551] lstrlenW (lpString=".jpg") returned 4 [0125.551] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1 [0125.551] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f870 | out: lpNewFilePointer=0x0) returned 1 [0125.551] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f870 | out: lpNewFilePointer=0x0) returned 1 [0125.551] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\enfr\\msb1enfr.its.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0125.552] GetLastError () returned 0x0 [0125.552] ReadFile (in: hFile=0x208, lpBuffer=0x4120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x354f87c, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesRead=0x354f87c*=0xe64da, lpOverlapped=0x0) returned 1 [0125.773] WriteFile (in: hFile=0x16c, lpBuffer=0x4120020*, nNumberOfBytesToWrite=0xe64e0, lpNumberOfBytesWritten=0x354f644, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesWritten=0x354f644*=0xe64e0, lpOverlapped=0x0) returned 1 [0125.781] ReadFile (in: hFile=0x208, lpBuffer=0x4120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x354f87c, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesRead=0x354f87c*=0x0, lpOverlapped=0x0) returned 1 [0125.781] WriteFile (in: hFile=0x16c, lpBuffer=0x4120020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x354f644, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesWritten=0x354f644*=0xec, lpOverlapped=0x0) returned 1 [0125.782] SetEndOfFile (hFile=0x16c) returned 1 [0125.782] CloseHandle (hObject=0x16c) returned 1 [0125.782] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f870 | out: lpNewFilePointer=0x0) returned 1 [0125.782] SetEndOfFile (hFile=0x208) returned 1 [0125.785] CloseHandle (hObject=0x208) returned 1 [0125.785] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0125.785] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\enfr\\msb1enfr.its")) returned 1 [0125.786] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS") returned 73 [0125.786] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS") returned 73 [0125.786] lstrlenW (lpString=".doc") returned 4 [0125.786] lstrcmpiW (lpString1=".doc", lpString2=".ITS") returned -1 [0125.786] lstrlenW (lpString=".docx") returned 5 [0125.786] lstrcmpiW (lpString1=".docx", lpString2="R.ITS") returned -1 [0125.786] lstrlenW (lpString=".pdf") returned 4 [0125.786] lstrcmpiW (lpString1=".pdf", lpString2=".ITS") returned 1 [0125.786] lstrlenW (lpString=".xls") returned 4 [0125.786] lstrcmpiW (lpString1=".xls", lpString2=".ITS") returned 1 [0125.786] lstrlenW (lpString=".xlsx") returned 5 [0125.786] lstrcmpiW (lpString1=".xlsx", lpString2="R.ITS") returned -1 [0125.786] lstrlenW (lpString=".ppt") returned 4 [0125.786] lstrcmpiW (lpString1=".ppt", lpString2=".ITS") returned 1 [0125.786] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS") returned 73 [0125.786] lstrlenW (lpString=".zip") returned 4 [0125.786] lstrcmpiW (lpString1=".zip", lpString2=".ITS") returned 1 [0125.786] lstrlenW (lpString=".rar") returned 4 [0125.786] lstrcmpiW (lpString1=".rar", lpString2=".ITS") returned 1 [0125.786] lstrlenW (lpString=".bz2") returned 4 [0125.786] lstrcmpiW (lpString1=".bz2", lpString2=".ITS") returned -1 [0125.786] lstrlenW (lpString=".7z") returned 3 [0125.786] lstrcmpiW (lpString1=".7z", lpString2="ITS") returned -1 [0125.787] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS") returned 73 [0125.787] lstrlenW (lpString=".dbf") returned 4 [0125.787] lstrcmpiW (lpString1=".dbf", lpString2=".ITS") returned -1 [0125.787] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS") returned 73 [0125.787] lstrlenW (lpString=".1cd") returned 4 [0125.787] lstrcmpiW (lpString1=".1cd", lpString2=".ITS") returned -1 [0125.787] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS") returned 73 [0125.787] lstrlenW (lpString=".jpg") returned 4 [0125.787] lstrcmpiW (lpString1=".jpg", lpString2=".ITS") returned 1 [0125.788] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f870 | out: lpNewFilePointer=0x0) returned 1 [0125.788] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f870 | out: lpNewFilePointer=0x0) returned 1 [0125.788] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\esen\\wt61es.lex.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0125.789] GetLastError () returned 0x0 [0125.789] ReadFile (in: hFile=0x208, lpBuffer=0x4120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x354f87c, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesRead=0x354f87c*=0xa5c00, lpOverlapped=0x0) returned 1 [0126.005] WriteFile (in: hFile=0x16c, lpBuffer=0x4120020*, nNumberOfBytesToWrite=0xa5c10, lpNumberOfBytesWritten=0x354f644, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesWritten=0x354f644*=0xa5c10, lpOverlapped=0x0) returned 1 [0126.011] ReadFile (in: hFile=0x208, lpBuffer=0x4120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x354f87c, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesRead=0x354f87c*=0x0, lpOverlapped=0x0) returned 1 [0126.011] WriteFile (in: hFile=0x16c, lpBuffer=0x4120020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x354f644, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesWritten=0x354f644*=0xe8, lpOverlapped=0x0) returned 1 [0126.011] SetEndOfFile (hFile=0x16c) returned 1 [0126.011] CloseHandle (hObject=0x16c) returned 1 [0126.011] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f870 | out: lpNewFilePointer=0x0) returned 1 [0126.011] SetEndOfFile (hFile=0x208) returned 1 [0126.013] CloseHandle (hObject=0x208) returned 1 [0126.013] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0126.013] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\esen\\wt61es.lex")) returned 1 [0126.013] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX") returned 71 [0126.013] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX") returned 71 [0126.013] lstrlenW (lpString=".doc") returned 4 [0126.013] lstrcmpiW (lpString1=".doc", lpString2=".LEX") returned -1 [0126.013] lstrlenW (lpString=".docx") returned 5 [0126.013] lstrcmpiW (lpString1=".docx", lpString2="S.LEX") returned -1 [0126.013] lstrlenW (lpString=".pdf") returned 4 [0126.013] lstrcmpiW (lpString1=".pdf", lpString2=".LEX") returned 1 [0126.013] lstrlenW (lpString=".xls") returned 4 [0126.013] lstrcmpiW (lpString1=".xls", lpString2=".LEX") returned 1 [0126.013] lstrlenW (lpString=".xlsx") returned 5 [0126.013] lstrcmpiW (lpString1=".xlsx", lpString2="S.LEX") returned -1 [0126.014] lstrlenW (lpString=".ppt") returned 4 [0126.014] lstrcmpiW (lpString1=".ppt", lpString2=".LEX") returned 1 [0126.014] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX") returned 71 [0126.014] lstrlenW (lpString=".zip") returned 4 [0126.014] lstrcmpiW (lpString1=".zip", lpString2=".LEX") returned 1 [0126.014] lstrlenW (lpString=".rar") returned 4 [0126.014] lstrcmpiW (lpString1=".rar", lpString2=".LEX") returned 1 [0126.014] lstrlenW (lpString=".bz2") returned 4 [0126.014] lstrcmpiW (lpString1=".bz2", lpString2=".LEX") returned -1 [0126.014] lstrlenW (lpString=".7z") returned 3 [0126.014] lstrcmpiW (lpString1=".7z", lpString2="LEX") returned -1 [0126.014] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX") returned 71 [0126.014] lstrlenW (lpString=".dbf") returned 4 [0126.014] lstrcmpiW (lpString1=".dbf", lpString2=".LEX") returned -1 [0126.014] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX") returned 71 [0126.014] lstrlenW (lpString=".1cd") returned 4 [0126.014] lstrcmpiW (lpString1=".1cd", lpString2=".LEX") returned -1 [0126.014] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX") returned 71 [0126.014] lstrlenW (lpString=".jpg") returned 4 [0126.014] lstrcmpiW (lpString1=".jpg", lpString2=".LEX") returned -1 [0126.015] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f870 | out: lpNewFilePointer=0x0) returned 1 [0126.015] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f870 | out: lpNewFilePointer=0x0) returned 1 [0126.015] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.DLL.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\fren\\msb1fren.dll.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0126.015] GetLastError () returned 0x0 [0126.015] ReadFile (in: hFile=0x208, lpBuffer=0x4120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x354f87c, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesRead=0x354f87c*=0x38200, lpOverlapped=0x0) returned 1 [0126.057] WriteFile (in: hFile=0x16c, lpBuffer=0x4120020*, nNumberOfBytesToWrite=0x38210, lpNumberOfBytesWritten=0x354f644, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesWritten=0x354f644*=0x38210, lpOverlapped=0x0) returned 1 [0126.059] ReadFile (in: hFile=0x208, lpBuffer=0x4120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x354f87c, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesRead=0x354f87c*=0x0, lpOverlapped=0x0) returned 1 [0126.059] WriteFile (in: hFile=0x16c, lpBuffer=0x4120020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x354f644, lpOverlapped=0x0 | out: lpBuffer=0x4120020*, lpNumberOfBytesWritten=0x354f644*=0xec, lpOverlapped=0x0) returned 1 [0126.059] SetEndOfFile (hFile=0x16c) returned 1 [0126.059] CloseHandle (hObject=0x16c) returned 1 [0126.059] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f870 | out: lpNewFilePointer=0x0) returned 1 [0126.059] SetEndOfFile (hFile=0x208) returned 1 [0126.060] CloseHandle (hObject=0x208) returned 1 [0126.060] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.DLL.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0126.060] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\fren\\msb1fren.dll")) returned 1 [0126.060] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.DLL") returned 73 [0126.060] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.DLL") returned 73 [0126.061] lstrlenW (lpString=".doc") returned 4 [0126.061] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0126.061] lstrlenW (lpString=".docx") returned 5 [0126.061] lstrcmpiW (lpString1=".docx", lpString2="N.DLL") returned -1 [0126.061] lstrlenW (lpString=".pdf") returned 4 [0126.061] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0126.061] lstrlenW (lpString=".xls") returned 4 [0126.061] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0126.061] lstrlenW (lpString=".xlsx") returned 5 [0126.061] lstrcmpiW (lpString1=".xlsx", lpString2="N.DLL") returned -1 [0126.061] lstrlenW (lpString=".ppt") returned 4 [0126.061] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0126.061] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.DLL") returned 73 [0126.061] lstrlenW (lpString=".zip") returned 4 [0126.061] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0126.061] lstrlenW (lpString=".rar") returned 4 [0126.061] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0126.061] lstrlenW (lpString=".bz2") returned 4 [0126.061] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0126.061] lstrlenW (lpString=".7z") returned 3 [0126.061] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0126.061] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.DLL") returned 73 [0126.061] lstrlenW (lpString=".dbf") returned 4 [0126.061] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0126.061] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.DLL") returned 73 [0126.061] lstrlenW (lpString=".1cd") returned 4 [0126.061] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0126.061] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.DLL") returned 73 [0126.061] lstrlenW (lpString=".jpg") returned 4 [0126.061] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0126.061] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x354f8c4 | out: lpFileSize=0x354f8c4*=840364) returned 1 [0126.061] CloseHandle (hObject=0x208) returned 1 [0126.061] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\fren\\msb1fren.its")) returned 0x20 [0126.061] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\fren\\msb1fren.its.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0126.062] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\fren\\msb1fren.its"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0126.062] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f870 | out: lpNewFilePointer=0x0) returned 1 [0126.062] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x354f870 | out: lpNewFilePointer=0x0) returned 1 [0126.062] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\fren\\msb1fren.its.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0126.600] GetLastError () returned 0x0 [0126.600] ReadFile (hFile=0x208, lpBuffer=0x4120020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x354f87c, lpOverlapped=0x0) Thread: id = 32 os_tid = 0xbb0 [0102.642] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x757c0000 [0102.642] GetProcAddress (hModule=0x757c0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x757ed650 [0102.642] Wow64DisableWow64FsRedirection (in: OldValue=0x37cfe18 | out: OldValue=0x37cfe18*=0x0) returned 1 [0102.642] lstrlenW (lpString="kernel32.dll") returned 12 [0102.642] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0102.642] Sleep (dwMilliseconds=0x64) [0102.880] lstrcmpiW (lpString1=".xml", lpString2=".waifu") returned 1 [0102.880] lstrlenW (lpString="Setup.xml") returned 9 [0102.880] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0103.010] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x37cfddc | out: lpFileSize=0x37cfddc*=1608) returned 1 [0103.010] CloseHandle (hObject=0x18c) returned 1 [0103.010] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0103.010] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0103.010] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0103.010] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0103.010] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0103.010] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0103.010] GetLastError () returned 0x0 [0103.010] ReadFile (in: hFile=0x18c, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x648, lpOverlapped=0x0) returned 1 [0103.014] WriteFile (in: hFile=0x190, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0x650, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0x650, lpOverlapped=0x0) returned 1 [0103.015] ReadFile (in: hFile=0x18c, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x0, lpOverlapped=0x0) returned 1 [0103.015] WriteFile (in: hFile=0x190, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0xe6, lpOverlapped=0x0) returned 1 [0103.015] SetEndOfFile (hFile=0x190) returned 1 [0103.015] CloseHandle (hObject=0x190) returned 1 [0103.015] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0103.015] SetEndOfFile (hFile=0x18c) returned 1 [0103.016] CloseHandle (hObject=0x18c) returned 1 [0103.016] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x2020) returned 1 [0103.016] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0103.016] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0103.016] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0103.016] lstrlenW (lpString=".doc") returned 4 [0103.016] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0103.016] lstrlenW (lpString=".docx") returned 5 [0103.016] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0103.016] lstrlenW (lpString=".pdf") returned 4 [0103.016] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0103.016] lstrlenW (lpString=".xls") returned 4 [0103.016] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0103.016] lstrlenW (lpString=".xlsx") returned 5 [0103.016] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0103.016] lstrlenW (lpString=".ppt") returned 4 [0103.017] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0103.017] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0103.017] lstrlenW (lpString=".zip") returned 4 [0103.017] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0103.017] lstrlenW (lpString=".rar") returned 4 [0103.017] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0103.017] lstrlenW (lpString=".bz2") returned 4 [0103.017] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0103.017] lstrlenW (lpString=".7z") returned 3 [0103.017] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0103.017] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0103.017] lstrlenW (lpString=".dbf") returned 4 [0103.017] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0103.017] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0103.017] lstrlenW (lpString=".1cd") returned 4 [0103.017] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0103.017] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0103.017] lstrlenW (lpString=".jpg") returned 4 [0103.017] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0103.017] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0103.017] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0103.017] lstrlenW (lpString=".doc") returned 4 [0103.017] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0103.017] lstrlenW (lpString=".docx") returned 5 [0103.017] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0103.017] lstrlenW (lpString=".pdf") returned 4 [0103.017] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0103.017] lstrlenW (lpString=".xls") returned 4 [0103.017] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0103.017] lstrlenW (lpString=".xlsx") returned 5 [0103.017] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0103.017] lstrlenW (lpString=".ppt") returned 4 [0103.017] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0103.017] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0103.017] lstrlenW (lpString=".zip") returned 4 [0103.017] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0103.017] lstrlenW (lpString=".rar") returned 4 [0103.017] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0103.017] lstrlenW (lpString=".bz2") returned 4 [0103.017] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0103.017] lstrlenW (lpString=".7z") returned 3 [0103.017] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0103.017] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0103.017] lstrlenW (lpString=".dbf") returned 4 [0103.017] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0103.017] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0103.018] lstrlenW (lpString=".1cd") returned 4 [0103.018] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0103.018] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0103.018] lstrlenW (lpString=".jpg") returned 4 [0103.018] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0103.018] lstrcmpiW (lpString1=".xml", lpString2=".waifu") returned 1 [0103.018] lstrlenW (lpString="Setup.xml") returned 9 [0103.018] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0103.261] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x37cfddc | out: lpFileSize=0x37cfddc*=1852) returned 1 [0103.261] CloseHandle (hObject=0x174) returned 1 [0103.261] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0103.261] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0103.261] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0103.261] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0103.261] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0103.261] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0103.261] GetLastError () returned 0x0 [0103.261] ReadFile (in: hFile=0x174, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x73c, lpOverlapped=0x0) returned 1 [0103.262] WriteFile (in: hFile=0x184, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0x740, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0x740, lpOverlapped=0x0) returned 1 [0103.263] ReadFile (in: hFile=0x174, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x0, lpOverlapped=0x0) returned 1 [0103.263] WriteFile (in: hFile=0x184, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0xe6, lpOverlapped=0x0) returned 1 [0103.263] SetEndOfFile (hFile=0x184) returned 1 [0103.263] CloseHandle (hObject=0x184) returned 1 [0103.264] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0103.264] SetEndOfFile (hFile=0x174) returned 1 [0103.264] CloseHandle (hObject=0x174) returned 1 [0103.264] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x2020) returned 1 [0103.264] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0103.264] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0103.264] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0103.264] lstrlenW (lpString=".doc") returned 4 [0103.265] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0103.265] lstrlenW (lpString=".docx") returned 5 [0103.265] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0103.265] lstrlenW (lpString=".pdf") returned 4 [0103.265] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0103.265] lstrlenW (lpString=".xls") returned 4 [0103.265] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0103.265] lstrlenW (lpString=".xlsx") returned 5 [0103.265] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0103.265] lstrlenW (lpString=".ppt") returned 4 [0103.265] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0103.265] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0103.265] lstrlenW (lpString=".zip") returned 4 [0103.265] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0103.265] lstrlenW (lpString=".rar") returned 4 [0103.265] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0103.265] lstrlenW (lpString=".bz2") returned 4 [0103.265] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0103.265] lstrlenW (lpString=".7z") returned 3 [0103.265] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0103.265] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0103.265] lstrlenW (lpString=".dbf") returned 4 [0103.265] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0103.265] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0103.265] lstrlenW (lpString=".1cd") returned 4 [0103.265] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0103.265] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0103.265] lstrlenW (lpString=".jpg") returned 4 [0103.265] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0103.265] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0103.265] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0103.265] lstrlenW (lpString=".doc") returned 4 [0103.265] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0103.265] lstrlenW (lpString=".docx") returned 5 [0103.265] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0103.265] lstrlenW (lpString=".pdf") returned 4 [0103.265] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0103.265] lstrlenW (lpString=".xls") returned 4 [0103.265] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0103.265] lstrlenW (lpString=".xlsx") returned 5 [0103.265] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0103.265] lstrlenW (lpString=".ppt") returned 4 [0103.265] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0103.265] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0103.266] lstrlenW (lpString=".zip") returned 4 [0103.266] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0103.266] lstrlenW (lpString=".rar") returned 4 [0103.266] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0103.266] lstrlenW (lpString=".bz2") returned 4 [0103.266] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0103.266] lstrlenW (lpString=".7z") returned 3 [0103.266] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0103.266] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0103.266] lstrlenW (lpString=".dbf") returned 4 [0103.266] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0103.266] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0103.266] lstrlenW (lpString=".1cd") returned 4 [0103.266] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0103.266] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0103.266] lstrlenW (lpString=".jpg") returned 4 [0103.266] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0103.266] lstrcmpiW (lpString1=".xml", lpString2=".waifu") returned 1 [0103.266] lstrlenW (lpString="Setup.xml") returned 9 [0103.266] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0103.435] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x37cfddc | out: lpFileSize=0x37cfddc*=1872) returned 1 [0103.435] CloseHandle (hObject=0x178) returned 1 [0103.435] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0103.436] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0103.437] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0103.437] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0103.437] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0103.437] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0103.437] GetLastError () returned 0x0 [0103.437] ReadFile (in: hFile=0x178, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x750, lpOverlapped=0x0) returned 1 [0103.438] WriteFile (in: hFile=0x194, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0x760, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0x760, lpOverlapped=0x0) returned 1 [0103.439] ReadFile (in: hFile=0x178, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x0, lpOverlapped=0x0) returned 1 [0103.439] WriteFile (in: hFile=0x194, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0xe6, lpOverlapped=0x0) returned 1 [0103.439] SetEndOfFile (hFile=0x194) returned 1 [0103.439] CloseHandle (hObject=0x194) returned 1 [0103.439] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0103.439] SetEndOfFile (hFile=0x178) returned 1 [0103.440] CloseHandle (hObject=0x178) returned 1 [0103.440] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x2020) returned 1 [0103.441] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0103.441] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0103.441] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0103.441] lstrlenW (lpString=".doc") returned 4 [0103.441] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0103.441] lstrlenW (lpString=".docx") returned 5 [0103.441] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0103.441] lstrlenW (lpString=".pdf") returned 4 [0103.441] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0103.441] lstrlenW (lpString=".xls") returned 4 [0103.441] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0103.441] lstrlenW (lpString=".xlsx") returned 5 [0103.441] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0103.441] lstrlenW (lpString=".ppt") returned 4 [0103.441] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0103.441] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0103.441] lstrlenW (lpString=".zip") returned 4 [0103.441] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0103.441] lstrlenW (lpString=".rar") returned 4 [0103.441] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0103.441] lstrlenW (lpString=".bz2") returned 4 [0103.441] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0103.441] lstrlenW (lpString=".7z") returned 3 [0103.441] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0103.441] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0103.441] lstrlenW (lpString=".dbf") returned 4 [0103.441] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0103.441] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0103.441] lstrlenW (lpString=".1cd") returned 4 [0103.441] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0103.441] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0103.441] lstrlenW (lpString=".jpg") returned 4 [0103.441] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0103.441] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0103.441] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0103.441] lstrlenW (lpString=".doc") returned 4 [0103.441] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0103.442] lstrlenW (lpString=".docx") returned 5 [0103.442] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0103.442] lstrlenW (lpString=".pdf") returned 4 [0103.442] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0103.442] lstrlenW (lpString=".xls") returned 4 [0103.442] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0103.442] lstrlenW (lpString=".xlsx") returned 5 [0103.442] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0103.442] lstrlenW (lpString=".ppt") returned 4 [0103.442] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0103.442] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0103.442] lstrlenW (lpString=".zip") returned 4 [0103.442] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0103.442] lstrlenW (lpString=".rar") returned 4 [0103.442] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0103.442] lstrlenW (lpString=".bz2") returned 4 [0103.442] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0103.442] lstrlenW (lpString=".7z") returned 3 [0103.442] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0103.442] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0103.442] lstrlenW (lpString=".dbf") returned 4 [0103.442] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0103.442] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0103.442] lstrlenW (lpString=".1cd") returned 4 [0103.442] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0103.442] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0103.442] lstrlenW (lpString=".jpg") returned 4 [0103.442] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0103.442] lstrcmpiW (lpString1=".xml", lpString2=".waifu") returned 1 [0103.442] lstrlenW (lpString="Setup.xml") returned 9 [0103.442] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0103.442] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x37cfddc | out: lpFileSize=0x37cfddc*=1452) returned 1 [0103.442] CloseHandle (hObject=0x178) returned 1 [0103.442] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0103.443] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0103.443] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0103.443] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0103.443] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0103.443] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0103.443] GetLastError () returned 0x0 [0103.443] ReadFile (in: hFile=0x178, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x5ac, lpOverlapped=0x0) returned 1 [0103.444] WriteFile (in: hFile=0x194, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0x5b0, lpOverlapped=0x0) returned 1 [0103.445] ReadFile (in: hFile=0x178, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x0, lpOverlapped=0x0) returned 1 [0103.445] WriteFile (in: hFile=0x194, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0xe6, lpOverlapped=0x0) returned 1 [0103.445] SetEndOfFile (hFile=0x194) returned 1 [0103.445] CloseHandle (hObject=0x194) returned 1 [0103.445] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0103.445] SetEndOfFile (hFile=0x178) returned 1 [0103.446] CloseHandle (hObject=0x178) returned 1 [0103.446] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x2020) returned 1 [0103.446] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0103.446] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0103.446] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0103.446] lstrlenW (lpString=".doc") returned 4 [0103.446] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0103.446] lstrlenW (lpString=".docx") returned 5 [0103.446] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0103.446] lstrlenW (lpString=".pdf") returned 4 [0103.446] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0103.446] lstrlenW (lpString=".xls") returned 4 [0103.446] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0103.447] lstrlenW (lpString=".xlsx") returned 5 [0103.447] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0103.447] lstrlenW (lpString=".ppt") returned 4 [0103.447] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0103.447] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0103.447] lstrlenW (lpString=".zip") returned 4 [0103.447] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0103.447] lstrlenW (lpString=".rar") returned 4 [0103.447] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0103.447] lstrlenW (lpString=".bz2") returned 4 [0103.447] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0103.447] lstrlenW (lpString=".7z") returned 3 [0103.447] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0103.447] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0103.447] lstrlenW (lpString=".dbf") returned 4 [0103.447] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0103.447] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0103.447] lstrlenW (lpString=".1cd") returned 4 [0103.447] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0103.447] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0103.447] lstrlenW (lpString=".jpg") returned 4 [0103.447] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0103.447] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0103.447] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0103.447] lstrlenW (lpString=".doc") returned 4 [0103.447] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0103.447] lstrlenW (lpString=".docx") returned 5 [0103.447] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0103.447] lstrlenW (lpString=".pdf") returned 4 [0103.447] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0103.447] lstrlenW (lpString=".xls") returned 4 [0103.447] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0103.447] lstrlenW (lpString=".xlsx") returned 5 [0103.447] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0103.447] lstrlenW (lpString=".ppt") returned 4 [0103.447] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0103.447] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0103.447] lstrlenW (lpString=".zip") returned 4 [0103.447] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0103.447] lstrlenW (lpString=".rar") returned 4 [0103.447] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0103.447] lstrlenW (lpString=".bz2") returned 4 [0103.447] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0103.447] lstrlenW (lpString=".7z") returned 3 [0103.447] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0103.447] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0103.447] lstrlenW (lpString=".dbf") returned 4 [0103.447] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0103.447] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0103.447] lstrlenW (lpString=".1cd") returned 4 [0103.447] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0103.447] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0103.447] lstrlenW (lpString=".jpg") returned 4 [0103.448] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0103.448] lstrcmpiW (lpString1=".xml", lpString2=".waifu") returned 1 [0103.448] lstrlenW (lpString="branding.xml") returned 12 [0103.448] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0103.448] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x37cfddc | out: lpFileSize=0x37cfddc*=596341) returned 1 [0103.448] CloseHandle (hObject=0x178) returned 1 [0103.448] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml")) returned 0x2020 [0103.448] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0103.449] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0103.449] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0103.449] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0103.449] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0103.449] GetLastError () returned 0x0 [0103.449] ReadFile (in: hFile=0x178, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x91975, lpOverlapped=0x0) returned 1 [0103.458] WriteFile (in: hFile=0x194, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0x91980, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0x91980, lpOverlapped=0x0) returned 1 [0103.847] ReadFile (in: hFile=0x178, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x0, lpOverlapped=0x0) returned 1 [0103.847] WriteFile (in: hFile=0x194, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0xec, lpOverlapped=0x0) returned 1 [0103.848] SetEndOfFile (hFile=0x194) returned 1 [0103.848] CloseHandle (hObject=0x194) returned 1 [0103.852] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0103.852] SetEndOfFile (hFile=0x178) returned 1 [0103.977] CloseHandle (hObject=0x178) returned 1 [0103.977] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x2020) returned 1 [0103.977] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml")) returned 1 [0103.977] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0103.978] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0103.978] lstrlenW (lpString=".doc") returned 4 [0103.978] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0103.978] lstrlenW (lpString=".docx") returned 5 [0103.978] lstrcmpiW (lpString1=".docx", lpString2="g.xml") returned -1 [0103.978] lstrlenW (lpString=".pdf") returned 4 [0103.978] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0103.978] lstrlenW (lpString=".xls") returned 4 [0103.978] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0103.978] lstrlenW (lpString=".xlsx") returned 5 [0103.978] lstrcmpiW (lpString1=".xlsx", lpString2="g.xml") returned -1 [0103.978] lstrlenW (lpString=".ppt") returned 4 [0103.978] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0103.978] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0103.978] lstrlenW (lpString=".zip") returned 4 [0103.978] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0103.978] lstrlenW (lpString=".rar") returned 4 [0103.978] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0103.978] lstrlenW (lpString=".bz2") returned 4 [0103.978] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0103.978] lstrlenW (lpString=".7z") returned 3 [0103.978] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0103.978] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0103.978] lstrlenW (lpString=".dbf") returned 4 [0103.978] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0103.978] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0103.978] lstrlenW (lpString=".1cd") returned 4 [0103.978] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0103.978] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0103.978] lstrlenW (lpString=".jpg") returned 4 [0103.978] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0103.978] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0103.978] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0103.978] lstrlenW (lpString=".doc") returned 4 [0103.978] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0103.978] lstrlenW (lpString=".docx") returned 5 [0103.978] lstrcmpiW (lpString1=".docx", lpString2="g.xml") returned -1 [0103.978] lstrlenW (lpString=".pdf") returned 4 [0103.978] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0103.978] lstrlenW (lpString=".xls") returned 4 [0103.978] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0103.978] lstrlenW (lpString=".xlsx") returned 5 [0103.978] lstrcmpiW (lpString1=".xlsx", lpString2="g.xml") returned -1 [0103.978] lstrlenW (lpString=".ppt") returned 4 [0103.978] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0103.978] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0103.978] lstrlenW (lpString=".zip") returned 4 [0103.978] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0103.978] lstrlenW (lpString=".rar") returned 4 [0103.978] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0103.979] lstrlenW (lpString=".bz2") returned 4 [0103.979] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0103.979] lstrlenW (lpString=".7z") returned 3 [0103.979] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0103.979] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0103.979] lstrlenW (lpString=".dbf") returned 4 [0103.979] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0103.979] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0103.979] lstrlenW (lpString=".1cd") returned 4 [0103.979] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0103.979] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0103.979] lstrlenW (lpString=".jpg") returned 4 [0103.979] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0103.979] lstrcmpiW (lpString1=".xml", lpString2=".waifu") returned 1 [0103.979] lstrlenW (lpString="PrjProrWW.xml") returned 13 [0103.979] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0103.980] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x37cfddc | out: lpFileSize=0x37cfddc*=6421) returned 1 [0103.980] CloseHandle (hObject=0x178) returned 1 [0103.980] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml")) returned 0x2020 [0103.980] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0103.980] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0103.980] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0103.981] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0103.981] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0103.981] GetLastError () returned 0x0 [0103.981] ReadFile (in: hFile=0x178, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x1915, lpOverlapped=0x0) returned 1 [0104.008] WriteFile (in: hFile=0x1a8, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0x1920, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0x1920, lpOverlapped=0x0) returned 1 [0104.562] ReadFile (in: hFile=0x178, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x0, lpOverlapped=0x0) returned 1 [0104.562] WriteFile (in: hFile=0x1a8, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0xee, lpOverlapped=0x0) returned 1 [0104.562] SetEndOfFile (hFile=0x1a8) returned 1 [0104.562] CloseHandle (hObject=0x1a8) returned 1 [0104.563] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0104.563] SetEndOfFile (hFile=0x178) returned 1 [0104.563] CloseHandle (hObject=0x178) returned 1 [0104.563] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x2020) returned 1 [0104.564] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml")) returned 1 [0104.565] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0104.565] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0104.565] lstrlenW (lpString=".doc") returned 4 [0104.565] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0104.565] lstrlenW (lpString=".docx") returned 5 [0104.565] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0104.565] lstrlenW (lpString=".pdf") returned 4 [0104.565] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0104.565] lstrlenW (lpString=".xls") returned 4 [0104.565] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0104.565] lstrlenW (lpString=".xlsx") returned 5 [0104.565] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0104.565] lstrlenW (lpString=".ppt") returned 4 [0104.565] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0104.565] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0104.565] lstrlenW (lpString=".zip") returned 4 [0104.565] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0104.565] lstrlenW (lpString=".rar") returned 4 [0104.565] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0104.565] lstrlenW (lpString=".bz2") returned 4 [0104.565] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0104.565] lstrlenW (lpString=".7z") returned 3 [0104.565] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0104.565] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0104.565] lstrlenW (lpString=".dbf") returned 4 [0104.565] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0104.565] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0104.565] lstrlenW (lpString=".1cd") returned 4 [0104.565] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0104.565] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0104.565] lstrlenW (lpString=".jpg") returned 4 [0104.565] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0104.565] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0104.565] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0104.565] lstrlenW (lpString=".doc") returned 4 [0104.565] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0104.565] lstrlenW (lpString=".docx") returned 5 [0104.565] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0104.565] lstrlenW (lpString=".pdf") returned 4 [0104.565] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0104.565] lstrlenW (lpString=".xls") returned 4 [0104.565] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0104.565] lstrlenW (lpString=".xlsx") returned 5 [0104.565] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0104.565] lstrlenW (lpString=".ppt") returned 4 [0104.565] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0104.565] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0104.565] lstrlenW (lpString=".zip") returned 4 [0104.565] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0104.566] lstrlenW (lpString=".rar") returned 4 [0104.566] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0104.566] lstrlenW (lpString=".bz2") returned 4 [0104.566] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0104.566] lstrlenW (lpString=".7z") returned 3 [0104.566] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0104.566] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0104.566] lstrlenW (lpString=".dbf") returned 4 [0104.566] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0104.566] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0104.566] lstrlenW (lpString=".1cd") returned 4 [0104.566] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0104.566] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0104.566] lstrlenW (lpString=".jpg") returned 4 [0104.566] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0104.566] lstrcmpiW (lpString1=".xml", lpString2=".waifu") returned 1 [0104.566] lstrlenW (lpString="ipscsy.xml") returned 10 [0104.566] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscsy.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0104.897] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x37cfddc | out: lpFileSize=0x37cfddc*=2556) returned 1 [0104.898] CloseHandle (hObject=0x174) returned 1 [0104.898] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscsy.xml")) returned 0x20 [0104.898] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscsy.xml.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0104.898] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscsy.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0104.898] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml") returned 61 [0104.898] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml") returned 61 [0104.898] lstrlenW (lpString=".doc") returned 4 [0104.898] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0104.898] lstrlenW (lpString=".docx") returned 5 [0104.898] lstrcmpiW (lpString1=".docx", lpString2="y.xml") returned -1 [0104.898] lstrlenW (lpString=".pdf") returned 4 [0104.898] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0104.898] lstrlenW (lpString=".xls") returned 4 [0104.898] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0104.898] lstrlenW (lpString=".xlsx") returned 5 [0104.898] lstrcmpiW (lpString1=".xlsx", lpString2="y.xml") returned -1 [0104.898] lstrlenW (lpString=".ppt") returned 4 [0104.898] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0104.898] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml") returned 61 [0104.898] lstrlenW (lpString=".zip") returned 4 [0104.898] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0104.898] lstrlenW (lpString=".rar") returned 4 [0104.898] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0104.898] lstrlenW (lpString=".bz2") returned 4 [0104.898] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0104.898] lstrlenW (lpString=".7z") returned 3 [0104.898] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0104.898] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml") returned 61 [0104.898] lstrlenW (lpString=".dbf") returned 4 [0104.898] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0104.898] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml") returned 61 [0104.898] lstrlenW (lpString=".1cd") returned 4 [0104.898] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0104.898] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml") returned 61 [0104.898] lstrlenW (lpString=".jpg") returned 4 [0104.898] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0104.898] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml") returned 61 [0104.898] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml") returned 61 [0104.898] lstrlenW (lpString=".doc") returned 4 [0104.898] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0104.898] lstrlenW (lpString=".docx") returned 5 [0104.899] lstrcmpiW (lpString1=".docx", lpString2="y.xml") returned -1 [0104.899] lstrlenW (lpString=".pdf") returned 4 [0104.899] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0104.899] lstrlenW (lpString=".xls") returned 4 [0104.899] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0104.899] lstrlenW (lpString=".xlsx") returned 5 [0104.899] lstrcmpiW (lpString1=".xlsx", lpString2="y.xml") returned -1 [0104.899] lstrlenW (lpString=".ppt") returned 4 [0104.899] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0104.899] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml") returned 61 [0104.899] lstrlenW (lpString=".zip") returned 4 [0104.899] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0104.899] lstrlenW (lpString=".rar") returned 4 [0104.899] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0104.899] lstrlenW (lpString=".bz2") returned 4 [0104.899] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0104.899] lstrlenW (lpString=".7z") returned 3 [0104.899] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0104.899] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml") returned 61 [0104.899] lstrlenW (lpString=".dbf") returned 4 [0104.899] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0104.899] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml") returned 61 [0104.899] lstrlenW (lpString=".1cd") returned 4 [0104.899] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0104.899] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml") returned 61 [0104.899] lstrlenW (lpString=".jpg") returned 4 [0104.899] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0104.899] lstrcmpiW (lpString1=".HTM", lpString2=".waifu") returned -1 [0104.899] lstrlenW (lpString="README.HTM") returned 10 [0104.899] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\readme.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0105.086] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x37cfddc | out: lpFileSize=0x37cfddc*=1941) returned 1 [0105.086] CloseHandle (hObject=0x18c) returned 1 [0105.086] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\readme.htm")) returned 0x20 [0105.086] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\readme.htm.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0105.086] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\readme.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0105.086] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0105.087] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0105.087] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\readme.htm.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0105.087] GetLastError () returned 0x0 [0105.087] ReadFile (in: hFile=0x18c, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x795, lpOverlapped=0x0) returned 1 [0105.128] WriteFile (in: hFile=0x1a0, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0x7a0, lpOverlapped=0x0) returned 1 [0105.129] ReadFile (in: hFile=0x18c, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x0, lpOverlapped=0x0) returned 1 [0105.129] WriteFile (in: hFile=0x1a0, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0xe8, lpOverlapped=0x0) returned 1 [0105.129] SetEndOfFile (hFile=0x1a0) returned 1 [0105.129] CloseHandle (hObject=0x1a0) returned 1 [0105.130] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0105.130] SetEndOfFile (hFile=0x18c) returned 1 [0105.130] CloseHandle (hObject=0x18c) returned 1 [0105.130] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0105.130] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\readme.htm")) returned 1 [0105.131] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0105.131] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0105.131] lstrlenW (lpString=".doc") returned 4 [0105.131] lstrcmpiW (lpString1=".doc", lpString2=".HTM") returned -1 [0105.131] lstrlenW (lpString=".docx") returned 5 [0105.131] lstrcmpiW (lpString1=".docx", lpString2="E.HTM") returned -1 [0105.131] lstrlenW (lpString=".pdf") returned 4 [0105.131] lstrcmpiW (lpString1=".pdf", lpString2=".HTM") returned 1 [0105.131] lstrlenW (lpString=".xls") returned 4 [0105.131] lstrcmpiW (lpString1=".xls", lpString2=".HTM") returned 1 [0105.131] lstrlenW (lpString=".xlsx") returned 5 [0105.131] lstrcmpiW (lpString1=".xlsx", lpString2="E.HTM") returned -1 [0105.131] lstrlenW (lpString=".ppt") returned 4 [0105.131] lstrcmpiW (lpString1=".ppt", lpString2=".HTM") returned 1 [0105.131] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0105.131] lstrlenW (lpString=".zip") returned 4 [0105.131] lstrcmpiW (lpString1=".zip", lpString2=".HTM") returned 1 [0105.131] lstrlenW (lpString=".rar") returned 4 [0105.131] lstrcmpiW (lpString1=".rar", lpString2=".HTM") returned 1 [0105.131] lstrlenW (lpString=".bz2") returned 4 [0105.131] lstrcmpiW (lpString1=".bz2", lpString2=".HTM") returned -1 [0105.131] lstrlenW (lpString=".7z") returned 3 [0105.131] lstrcmpiW (lpString1=".7z", lpString2="HTM") returned -1 [0105.131] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0105.131] lstrlenW (lpString=".dbf") returned 4 [0105.131] lstrcmpiW (lpString1=".dbf", lpString2=".HTM") returned -1 [0105.131] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0105.131] lstrlenW (lpString=".1cd") returned 4 [0105.131] lstrcmpiW (lpString1=".1cd", lpString2=".HTM") returned -1 [0105.131] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0105.131] lstrlenW (lpString=".jpg") returned 4 [0105.131] lstrcmpiW (lpString1=".jpg", lpString2=".HTM") returned 1 [0105.131] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0105.132] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0105.132] lstrlenW (lpString=".doc") returned 4 [0105.132] lstrcmpiW (lpString1=".doc", lpString2=".HTM") returned -1 [0105.132] lstrlenW (lpString=".docx") returned 5 [0105.132] lstrcmpiW (lpString1=".docx", lpString2="E.HTM") returned -1 [0105.132] lstrlenW (lpString=".pdf") returned 4 [0105.132] lstrcmpiW (lpString1=".pdf", lpString2=".HTM") returned 1 [0105.132] lstrlenW (lpString=".xls") returned 4 [0105.132] lstrcmpiW (lpString1=".xls", lpString2=".HTM") returned 1 [0105.132] lstrlenW (lpString=".xlsx") returned 5 [0105.132] lstrcmpiW (lpString1=".xlsx", lpString2="E.HTM") returned -1 [0105.132] lstrlenW (lpString=".ppt") returned 4 [0105.132] lstrcmpiW (lpString1=".ppt", lpString2=".HTM") returned 1 [0105.132] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0105.132] lstrlenW (lpString=".zip") returned 4 [0105.132] lstrcmpiW (lpString1=".zip", lpString2=".HTM") returned 1 [0105.132] lstrlenW (lpString=".rar") returned 4 [0105.132] lstrcmpiW (lpString1=".rar", lpString2=".HTM") returned 1 [0105.132] lstrlenW (lpString=".bz2") returned 4 [0105.132] lstrcmpiW (lpString1=".bz2", lpString2=".HTM") returned -1 [0105.132] lstrlenW (lpString=".7z") returned 3 [0105.132] lstrcmpiW (lpString1=".7z", lpString2="HTM") returned -1 [0105.132] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0105.132] lstrlenW (lpString=".dbf") returned 4 [0105.132] lstrcmpiW (lpString1=".dbf", lpString2=".HTM") returned -1 [0105.132] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0105.132] lstrlenW (lpString=".1cd") returned 4 [0105.132] lstrcmpiW (lpString1=".1cd", lpString2=".HTM") returned -1 [0105.132] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0105.132] lstrlenW (lpString=".jpg") returned 4 [0105.132] lstrcmpiW (lpString1=".jpg", lpString2=".HTM") returned 1 [0105.132] lstrcmpiW (lpString1=".XML", lpString2=".waifu") returned 1 [0105.132] lstrlenW (lpString="ExcelMUI.XML") returned 12 [0105.132] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\excelmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0105.132] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x37cfddc | out: lpFileSize=0x37cfddc*=1565) returned 1 [0105.132] CloseHandle (hObject=0x18c) returned 1 [0105.133] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\excelmui.xml")) returned 0x20 [0105.133] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\excelmui.xml.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0105.133] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\excelmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0105.133] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0105.133] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0105.133] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\excelmui.xml.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0105.133] GetLastError () returned 0x0 [0105.133] ReadFile (in: hFile=0x18c, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x61d, lpOverlapped=0x0) returned 1 [0105.181] WriteFile (in: hFile=0x1a0, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0x620, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0x620, lpOverlapped=0x0) returned 1 [0105.181] ReadFile (in: hFile=0x18c, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x0, lpOverlapped=0x0) returned 1 [0105.181] WriteFile (in: hFile=0x1a0, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0xec, lpOverlapped=0x0) returned 1 [0105.181] SetEndOfFile (hFile=0x1a0) returned 1 [0105.182] CloseHandle (hObject=0x1a0) returned 1 [0105.182] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0105.182] SetEndOfFile (hFile=0x18c) returned 1 [0105.183] CloseHandle (hObject=0x18c) returned 1 [0105.183] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0105.183] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\excelmui.xml")) returned 1 [0105.183] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104 [0105.183] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104 [0105.183] lstrlenW (lpString=".doc") returned 4 [0105.183] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0105.183] lstrlenW (lpString=".docx") returned 5 [0105.183] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0105.183] lstrlenW (lpString=".pdf") returned 4 [0105.183] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0105.183] lstrlenW (lpString=".xls") returned 4 [0105.183] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0105.183] lstrlenW (lpString=".xlsx") returned 5 [0105.183] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0105.183] lstrlenW (lpString=".ppt") returned 4 [0105.183] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0105.183] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104 [0105.183] lstrlenW (lpString=".zip") returned 4 [0105.183] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0105.183] lstrlenW (lpString=".rar") returned 4 [0105.183] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0105.183] lstrlenW (lpString=".bz2") returned 4 [0105.183] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0105.183] lstrlenW (lpString=".7z") returned 3 [0105.184] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0105.184] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104 [0105.184] lstrlenW (lpString=".dbf") returned 4 [0105.184] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0105.184] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104 [0105.184] lstrlenW (lpString=".1cd") returned 4 [0105.184] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0105.184] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104 [0105.184] lstrlenW (lpString=".jpg") returned 4 [0105.184] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0105.184] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104 [0105.184] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104 [0105.184] lstrlenW (lpString=".doc") returned 4 [0105.184] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0105.184] lstrlenW (lpString=".docx") returned 5 [0105.184] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0105.184] lstrlenW (lpString=".pdf") returned 4 [0105.184] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0105.184] lstrlenW (lpString=".xls") returned 4 [0105.184] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0105.184] lstrlenW (lpString=".xlsx") returned 5 [0105.184] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0105.184] lstrlenW (lpString=".ppt") returned 4 [0105.184] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0105.184] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104 [0105.184] lstrlenW (lpString=".zip") returned 4 [0105.184] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0105.184] lstrlenW (lpString=".rar") returned 4 [0105.184] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0105.184] lstrlenW (lpString=".bz2") returned 4 [0105.184] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0105.184] lstrlenW (lpString=".7z") returned 3 [0105.184] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0105.184] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104 [0105.184] lstrlenW (lpString=".dbf") returned 4 [0105.184] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0105.184] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104 [0105.184] lstrlenW (lpString=".1cd") returned 4 [0105.184] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0105.184] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104 [0105.184] lstrlenW (lpString=".jpg") returned 4 [0105.184] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0105.184] lstrcmpiW (lpString1=".XML", lpString2=".waifu") returned 1 [0105.184] lstrlenW (lpString="SETUP.XML") returned 9 [0105.184] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0105.189] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x37cfddc | out: lpFileSize=0x37cfddc*=2296) returned 1 [0105.189] CloseHandle (hObject=0x18c) returned 1 [0105.189] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\setup.xml")) returned 0x20 [0105.189] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\setup.xml.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0105.189] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0105.189] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0105.189] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0105.189] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\setup.xml.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0105.191] GetLastError () returned 0x0 [0105.192] ReadFile (in: hFile=0x18c, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x8f8, lpOverlapped=0x0) returned 1 [0105.213] WriteFile (in: hFile=0x1a0, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0x900, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0x900, lpOverlapped=0x0) returned 1 [0105.213] ReadFile (in: hFile=0x18c, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x0, lpOverlapped=0x0) returned 1 [0105.213] WriteFile (in: hFile=0x1a0, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0xe6, lpOverlapped=0x0) returned 1 [0105.214] SetEndOfFile (hFile=0x1a0) returned 1 [0105.214] CloseHandle (hObject=0x1a0) returned 1 [0105.214] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0105.214] SetEndOfFile (hFile=0x18c) returned 1 [0105.215] CloseHandle (hObject=0x18c) returned 1 [0105.215] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0105.215] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\setup.xml")) returned 1 [0105.215] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101 [0105.215] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101 [0105.215] lstrlenW (lpString=".doc") returned 4 [0105.215] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0105.215] lstrlenW (lpString=".docx") returned 5 [0105.215] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0105.215] lstrlenW (lpString=".pdf") returned 4 [0105.215] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0105.215] lstrlenW (lpString=".xls") returned 4 [0105.215] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0105.215] lstrlenW (lpString=".xlsx") returned 5 [0105.215] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0105.215] lstrlenW (lpString=".ppt") returned 4 [0105.215] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0105.216] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101 [0105.216] lstrlenW (lpString=".zip") returned 4 [0105.216] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0105.216] lstrlenW (lpString=".rar") returned 4 [0105.216] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0105.216] lstrlenW (lpString=".bz2") returned 4 [0105.216] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0105.216] lstrlenW (lpString=".7z") returned 3 [0105.216] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0105.216] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101 [0105.216] lstrlenW (lpString=".dbf") returned 4 [0105.216] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0105.216] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101 [0105.216] lstrlenW (lpString=".1cd") returned 4 [0105.216] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0105.216] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101 [0105.216] lstrlenW (lpString=".jpg") returned 4 [0105.216] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0105.216] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101 [0105.216] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101 [0105.216] lstrlenW (lpString=".doc") returned 4 [0105.216] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0105.216] lstrlenW (lpString=".docx") returned 5 [0105.216] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0105.216] lstrlenW (lpString=".pdf") returned 4 [0105.216] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0105.216] lstrlenW (lpString=".xls") returned 4 [0105.216] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0105.216] lstrlenW (lpString=".xlsx") returned 5 [0105.216] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0105.216] lstrlenW (lpString=".ppt") returned 4 [0105.216] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0105.216] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101 [0105.216] lstrlenW (lpString=".zip") returned 4 [0105.216] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0105.216] lstrlenW (lpString=".rar") returned 4 [0105.216] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0105.216] lstrlenW (lpString=".bz2") returned 4 [0105.216] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0105.216] lstrlenW (lpString=".7z") returned 3 [0105.216] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0105.216] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101 [0105.216] lstrlenW (lpString=".dbf") returned 4 [0105.216] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0105.216] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101 [0105.216] lstrlenW (lpString=".1cd") returned 4 [0105.216] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0105.216] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101 [0105.216] lstrlenW (lpString=".jpg") returned 4 [0105.216] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0105.217] lstrcmpiW (lpString1=".XML", lpString2=".waifu") returned 1 [0105.217] lstrlenW (lpString="GrooveMUI.XML") returned 13 [0105.217] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\groovemui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0105.217] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x37cfddc | out: lpFileSize=0x37cfddc*=913) returned 1 [0105.217] CloseHandle (hObject=0x18c) returned 1 [0105.217] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\groovemui.xml")) returned 0x20 [0105.217] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\groovemui.xml.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0105.217] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\groovemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0105.217] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0105.217] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0105.217] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\groovemui.xml.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0105.221] GetLastError () returned 0x0 [0105.221] ReadFile (in: hFile=0x18c, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x391, lpOverlapped=0x0) returned 1 [0105.224] WriteFile (in: hFile=0x1a0, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0x3a0, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0x3a0, lpOverlapped=0x0) returned 1 [0105.224] ReadFile (in: hFile=0x18c, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x0, lpOverlapped=0x0) returned 1 [0105.224] WriteFile (in: hFile=0x1a0, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0xee, lpOverlapped=0x0) returned 1 [0105.224] SetEndOfFile (hFile=0x1a0) returned 1 [0105.225] CloseHandle (hObject=0x1a0) returned 1 [0105.225] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0105.225] SetEndOfFile (hFile=0x18c) returned 1 [0105.226] CloseHandle (hObject=0x18c) returned 1 [0105.226] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0105.226] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\groovemui.xml")) returned 1 [0105.226] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106 [0105.226] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106 [0105.226] lstrlenW (lpString=".doc") returned 4 [0105.226] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0105.226] lstrlenW (lpString=".docx") returned 5 [0105.226] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0105.226] lstrlenW (lpString=".pdf") returned 4 [0105.226] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0105.226] lstrlenW (lpString=".xls") returned 4 [0105.226] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0105.226] lstrlenW (lpString=".xlsx") returned 5 [0105.226] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0105.226] lstrlenW (lpString=".ppt") returned 4 [0105.226] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0105.226] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106 [0105.226] lstrlenW (lpString=".zip") returned 4 [0105.226] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0105.226] lstrlenW (lpString=".rar") returned 4 [0105.226] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0105.226] lstrlenW (lpString=".bz2") returned 4 [0105.227] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0105.227] lstrlenW (lpString=".7z") returned 3 [0105.227] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0105.227] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106 [0105.227] lstrlenW (lpString=".dbf") returned 4 [0105.227] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0105.227] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106 [0105.227] lstrlenW (lpString=".1cd") returned 4 [0105.227] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0105.227] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106 [0105.227] lstrlenW (lpString=".jpg") returned 4 [0105.227] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0105.227] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106 [0105.227] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106 [0105.227] lstrlenW (lpString=".doc") returned 4 [0105.227] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0105.227] lstrlenW (lpString=".docx") returned 5 [0105.227] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0105.227] lstrlenW (lpString=".pdf") returned 4 [0105.227] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0105.227] lstrlenW (lpString=".xls") returned 4 [0105.227] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0105.227] lstrlenW (lpString=".xlsx") returned 5 [0105.227] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0105.227] lstrlenW (lpString=".ppt") returned 4 [0105.227] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0105.227] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106 [0105.227] lstrlenW (lpString=".zip") returned 4 [0105.227] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0105.227] lstrlenW (lpString=".rar") returned 4 [0105.227] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0105.227] lstrlenW (lpString=".bz2") returned 4 [0105.227] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0105.227] lstrlenW (lpString=".7z") returned 3 [0105.227] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0105.227] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106 [0105.227] lstrlenW (lpString=".dbf") returned 4 [0105.227] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0105.227] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106 [0105.227] lstrlenW (lpString=".1cd") returned 4 [0105.227] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0105.227] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106 [0105.227] lstrlenW (lpString=".jpg") returned 4 [0105.227] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0105.227] lstrcmpiW (lpString1=".XML", lpString2=".waifu") returned 1 [0105.227] lstrlenW (lpString="SETUP.XML") returned 9 [0105.228] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0105.265] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x37cfddc | out: lpFileSize=0x37cfddc*=1452) returned 1 [0105.265] CloseHandle (hObject=0x1ac) returned 1 [0105.265] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\setup.xml")) returned 0x20 [0105.265] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\setup.xml.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0105.265] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0105.265] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0105.265] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0105.265] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\setup.xml.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0105.265] GetLastError () returned 0x0 [0105.265] ReadFile (in: hFile=0x1ac, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x5ac, lpOverlapped=0x0) returned 1 [0105.266] WriteFile (in: hFile=0x18c, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0x5b0, lpOverlapped=0x0) returned 1 [0105.267] ReadFile (in: hFile=0x1ac, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x0, lpOverlapped=0x0) returned 1 [0105.267] WriteFile (in: hFile=0x18c, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0xe6, lpOverlapped=0x0) returned 1 [0105.267] SetEndOfFile (hFile=0x18c) returned 1 [0105.267] CloseHandle (hObject=0x18c) returned 1 [0105.268] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0105.268] SetEndOfFile (hFile=0x1ac) returned 1 [0105.268] CloseHandle (hObject=0x1ac) returned 1 [0105.268] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0105.268] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\setup.xml")) returned 1 [0105.268] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102 [0105.268] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102 [0105.269] lstrlenW (lpString=".doc") returned 4 [0105.269] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0105.269] lstrlenW (lpString=".docx") returned 5 [0105.269] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0105.269] lstrlenW (lpString=".pdf") returned 4 [0105.269] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0105.269] lstrlenW (lpString=".xls") returned 4 [0105.269] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0105.269] lstrlenW (lpString=".xlsx") returned 5 [0105.269] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0105.269] lstrlenW (lpString=".ppt") returned 4 [0105.269] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0105.269] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102 [0105.269] lstrlenW (lpString=".zip") returned 4 [0105.269] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0105.269] lstrlenW (lpString=".rar") returned 4 [0105.269] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0105.269] lstrlenW (lpString=".bz2") returned 4 [0105.269] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0105.269] lstrlenW (lpString=".7z") returned 3 [0105.269] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0105.269] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102 [0105.269] lstrlenW (lpString=".dbf") returned 4 [0105.269] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0105.269] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102 [0105.269] lstrlenW (lpString=".1cd") returned 4 [0105.269] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0105.269] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102 [0105.269] lstrlenW (lpString=".jpg") returned 4 [0105.269] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0105.269] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102 [0105.269] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102 [0105.269] lstrlenW (lpString=".doc") returned 4 [0105.269] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0105.269] lstrlenW (lpString=".docx") returned 5 [0105.269] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0105.269] lstrlenW (lpString=".pdf") returned 4 [0105.269] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0105.269] lstrlenW (lpString=".xls") returned 4 [0105.269] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0105.269] lstrlenW (lpString=".xlsx") returned 5 [0105.269] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0105.269] lstrlenW (lpString=".ppt") returned 4 [0105.269] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0105.269] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102 [0105.269] lstrlenW (lpString=".zip") returned 4 [0105.269] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0105.269] lstrlenW (lpString=".rar") returned 4 [0105.269] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0105.269] lstrlenW (lpString=".bz2") returned 4 [0105.269] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0105.270] lstrlenW (lpString=".7z") returned 3 [0105.270] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0105.270] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102 [0105.270] lstrlenW (lpString=".dbf") returned 4 [0105.270] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0105.270] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102 [0105.270] lstrlenW (lpString=".1cd") returned 4 [0105.270] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0105.270] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102 [0105.270] lstrlenW (lpString=".jpg") returned 4 [0105.270] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0105.270] lstrcmpiW (lpString1=".XML", lpString2=".waifu") returned 1 [0105.270] lstrlenW (lpString="InfoPathMUI.XML") returned 15 [0105.270] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\infopathmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0105.270] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x37cfddc | out: lpFileSize=0x37cfddc*=1231) returned 1 [0105.270] CloseHandle (hObject=0x1ac) returned 1 [0105.270] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\infopathmui.xml")) returned 0x20 [0105.270] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\infopathmui.xml.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0105.270] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\infopathmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0105.270] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0105.270] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0105.270] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\infopathmui.xml.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0105.272] GetLastError () returned 0x0 [0105.272] ReadFile (in: hFile=0x1ac, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x4cf, lpOverlapped=0x0) returned 1 [0105.273] WriteFile (in: hFile=0x18c, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0x4d0, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0x4d0, lpOverlapped=0x0) returned 1 [0105.274] ReadFile (in: hFile=0x1ac, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x0, lpOverlapped=0x0) returned 1 [0105.274] WriteFile (in: hFile=0x18c, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0xf2, lpOverlapped=0x0) returned 1 [0105.274] SetEndOfFile (hFile=0x18c) returned 1 [0105.274] CloseHandle (hObject=0x18c) returned 1 [0105.274] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0105.274] SetEndOfFile (hFile=0x1ac) returned 1 [0105.275] CloseHandle (hObject=0x1ac) returned 1 [0105.275] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0105.275] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\infopathmui.xml")) returned 1 [0105.277] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110 [0105.277] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110 [0105.278] lstrlenW (lpString=".doc") returned 4 [0105.278] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0105.278] lstrlenW (lpString=".docx") returned 5 [0105.278] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0105.278] lstrlenW (lpString=".pdf") returned 4 [0105.278] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0105.278] lstrlenW (lpString=".xls") returned 4 [0105.278] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0105.278] lstrlenW (lpString=".xlsx") returned 5 [0105.278] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0105.278] lstrlenW (lpString=".ppt") returned 4 [0105.278] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0105.278] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110 [0105.278] lstrlenW (lpString=".zip") returned 4 [0105.278] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0105.278] lstrlenW (lpString=".rar") returned 4 [0105.278] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0105.278] lstrlenW (lpString=".bz2") returned 4 [0105.278] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0105.278] lstrlenW (lpString=".7z") returned 3 [0105.278] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0105.278] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110 [0105.278] lstrlenW (lpString=".dbf") returned 4 [0105.278] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0105.278] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110 [0105.278] lstrlenW (lpString=".1cd") returned 4 [0105.278] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0105.278] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110 [0105.278] lstrlenW (lpString=".jpg") returned 4 [0105.278] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0105.278] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110 [0105.278] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110 [0105.278] lstrlenW (lpString=".doc") returned 4 [0105.278] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0105.278] lstrlenW (lpString=".docx") returned 5 [0105.278] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0105.278] lstrlenW (lpString=".pdf") returned 4 [0105.278] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0105.278] lstrlenW (lpString=".xls") returned 4 [0105.278] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0105.278] lstrlenW (lpString=".xlsx") returned 5 [0105.278] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0105.278] lstrlenW (lpString=".ppt") returned 4 [0105.278] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0105.278] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110 [0105.278] lstrlenW (lpString=".zip") returned 4 [0105.278] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0105.278] lstrlenW (lpString=".rar") returned 4 [0105.279] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0105.279] lstrlenW (lpString=".bz2") returned 4 [0105.279] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0105.279] lstrlenW (lpString=".7z") returned 3 [0105.279] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0105.279] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110 [0105.279] lstrlenW (lpString=".dbf") returned 4 [0105.279] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0105.279] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110 [0105.279] lstrlenW (lpString=".1cd") returned 4 [0105.279] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0105.279] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110 [0105.279] lstrlenW (lpString=".jpg") returned 4 [0105.279] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0105.279] lstrcmpiW (lpString1=".XML", lpString2=".waifu") returned 1 [0105.279] lstrlenW (lpString="SETUP.XML") returned 9 [0105.279] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0105.279] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x37cfddc | out: lpFileSize=0x37cfddc*=1852) returned 1 [0105.279] CloseHandle (hObject=0x1ac) returned 1 [0105.279] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\setup.xml")) returned 0x20 [0105.279] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\setup.xml.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0105.279] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0105.279] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0105.279] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0105.280] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\setup.xml.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0105.280] GetLastError () returned 0x0 [0105.280] ReadFile (in: hFile=0x1ac, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x73c, lpOverlapped=0x0) returned 1 [0105.657] WriteFile (in: hFile=0x18c, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0x740, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0x740, lpOverlapped=0x0) returned 1 [0105.657] ReadFile (in: hFile=0x1ac, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x0, lpOverlapped=0x0) returned 1 [0105.657] WriteFile (in: hFile=0x18c, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0xe6, lpOverlapped=0x0) returned 1 [0105.657] SetEndOfFile (hFile=0x18c) returned 1 [0105.657] CloseHandle (hObject=0x18c) returned 1 [0105.658] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0105.658] SetEndOfFile (hFile=0x1ac) returned 1 [0105.704] CloseHandle (hObject=0x1ac) returned 1 [0105.704] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0105.705] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\setup.xml")) returned 1 [0105.705] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104 [0105.705] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104 [0105.705] lstrlenW (lpString=".doc") returned 4 [0105.705] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0105.705] lstrlenW (lpString=".docx") returned 5 [0105.705] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0105.705] lstrlenW (lpString=".pdf") returned 4 [0105.705] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0105.705] lstrlenW (lpString=".xls") returned 4 [0105.705] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0105.705] lstrlenW (lpString=".xlsx") returned 5 [0105.705] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0105.705] lstrlenW (lpString=".ppt") returned 4 [0105.705] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0105.705] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104 [0105.705] lstrlenW (lpString=".zip") returned 4 [0105.705] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0105.705] lstrlenW (lpString=".rar") returned 4 [0105.705] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0105.705] lstrlenW (lpString=".bz2") returned 4 [0105.705] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0105.705] lstrlenW (lpString=".7z") returned 3 [0105.705] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0105.705] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104 [0105.705] lstrlenW (lpString=".dbf") returned 4 [0105.705] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0105.705] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104 [0105.705] lstrlenW (lpString=".1cd") returned 4 [0105.705] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0105.705] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104 [0105.705] lstrlenW (lpString=".jpg") returned 4 [0105.705] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0105.705] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104 [0105.706] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104 [0105.706] lstrlenW (lpString=".doc") returned 4 [0105.706] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0105.706] lstrlenW (lpString=".docx") returned 5 [0105.706] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0105.706] lstrlenW (lpString=".pdf") returned 4 [0105.706] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0105.706] lstrlenW (lpString=".xls") returned 4 [0105.706] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0105.706] lstrlenW (lpString=".xlsx") returned 5 [0105.706] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0105.706] lstrlenW (lpString=".ppt") returned 4 [0105.706] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0105.706] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104 [0105.706] lstrlenW (lpString=".zip") returned 4 [0105.706] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0105.706] lstrlenW (lpString=".rar") returned 4 [0105.706] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0105.706] lstrlenW (lpString=".bz2") returned 4 [0105.706] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0105.706] lstrlenW (lpString=".7z") returned 3 [0105.706] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0105.706] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104 [0105.706] lstrlenW (lpString=".dbf") returned 4 [0105.706] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0105.706] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104 [0105.706] lstrlenW (lpString=".1cd") returned 4 [0105.706] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0105.706] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104 [0105.706] lstrlenW (lpString=".jpg") returned 4 [0105.706] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0105.706] lstrcmpiW (lpString1=".XML", lpString2=".waifu") returned 1 [0105.706] lstrlenW (lpString="BRANDING.XML") returned 12 [0105.706] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0105.711] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x37cfddc | out: lpFileSize=0x37cfddc*=596341) returned 1 [0105.712] CloseHandle (hObject=0x1ac) returned 1 [0105.712] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.xml")) returned 0x20 [0105.712] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.xml.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0105.712] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0105.712] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0105.712] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0105.712] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.xml.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0105.712] GetLastError () returned 0x0 [0105.712] ReadFile (in: hFile=0x1ac, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x91975, lpOverlapped=0x0) returned 1 [0105.733] WriteFile (in: hFile=0x18c, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0x91980, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0x91980, lpOverlapped=0x0) returned 1 [0105.738] ReadFile (in: hFile=0x1ac, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x0, lpOverlapped=0x0) returned 1 [0105.738] WriteFile (in: hFile=0x18c, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0xec, lpOverlapped=0x0) returned 1 [0105.738] SetEndOfFile (hFile=0x18c) returned 1 [0105.738] CloseHandle (hObject=0x18c) returned 1 [0105.742] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0105.742] SetEndOfFile (hFile=0x1ac) returned 1 [0105.743] CloseHandle (hObject=0x1ac) returned 1 [0105.743] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0105.744] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.xml")) returned 1 [0105.744] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0105.744] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0105.744] lstrlenW (lpString=".doc") returned 4 [0105.744] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0105.744] lstrlenW (lpString=".docx") returned 5 [0105.744] lstrcmpiW (lpString1=".docx", lpString2="G.XML") returned -1 [0105.744] lstrlenW (lpString=".pdf") returned 4 [0105.744] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0105.744] lstrlenW (lpString=".xls") returned 4 [0105.744] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0105.744] lstrlenW (lpString=".xlsx") returned 5 [0105.744] lstrcmpiW (lpString1=".xlsx", lpString2="G.XML") returned -1 [0105.744] lstrlenW (lpString=".ppt") returned 4 [0105.744] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0105.744] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0105.744] lstrlenW (lpString=".zip") returned 4 [0105.744] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0105.744] lstrlenW (lpString=".rar") returned 4 [0105.744] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0105.744] lstrlenW (lpString=".bz2") returned 4 [0105.744] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0105.744] lstrlenW (lpString=".7z") returned 3 [0105.744] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0105.744] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0105.744] lstrlenW (lpString=".dbf") returned 4 [0105.744] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0105.744] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0105.744] lstrlenW (lpString=".1cd") returned 4 [0105.744] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0105.744] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0105.744] lstrlenW (lpString=".jpg") returned 4 [0105.744] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0105.744] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0105.744] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0105.744] lstrlenW (lpString=".doc") returned 4 [0105.744] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0105.744] lstrlenW (lpString=".docx") returned 5 [0105.744] lstrcmpiW (lpString1=".docx", lpString2="G.XML") returned -1 [0105.744] lstrlenW (lpString=".pdf") returned 4 [0105.744] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0105.744] lstrlenW (lpString=".xls") returned 4 [0105.744] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0105.745] lstrlenW (lpString=".xlsx") returned 5 [0105.745] lstrcmpiW (lpString1=".xlsx", lpString2="G.XML") returned -1 [0105.745] lstrlenW (lpString=".ppt") returned 4 [0105.745] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0105.745] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0105.745] lstrlenW (lpString=".zip") returned 4 [0105.745] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0105.745] lstrlenW (lpString=".rar") returned 4 [0105.745] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0105.745] lstrlenW (lpString=".bz2") returned 4 [0105.745] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0105.745] lstrlenW (lpString=".7z") returned 3 [0105.745] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0105.745] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0105.745] lstrlenW (lpString=".dbf") returned 4 [0105.745] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0105.745] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0105.745] lstrlenW (lpString=".1cd") returned 4 [0105.745] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0105.745] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0105.745] lstrlenW (lpString=".jpg") returned 4 [0105.745] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0105.745] lstrcmpiW (lpString1=".CHM", lpString2=".waifu") returned -1 [0105.745] lstrlenW (lpString="OCT.CHM") returned 7 [0105.745] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\oct.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0105.745] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x37cfddc | out: lpFileSize=0x37cfddc*=71236) returned 1 [0105.745] CloseHandle (hObject=0x1ac) returned 1 [0105.745] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\oct.chm")) returned 0x20 [0105.745] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\oct.chm.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0105.745] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\oct.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0105.746] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0105.746] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0105.746] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\oct.chm.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0105.746] GetLastError () returned 0x0 [0105.746] ReadFile (in: hFile=0x1ac, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x11644, lpOverlapped=0x0) returned 1 [0105.748] WriteFile (in: hFile=0x18c, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0x11650, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0x11650, lpOverlapped=0x0) returned 1 [0105.748] ReadFile (in: hFile=0x1ac, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x0, lpOverlapped=0x0) returned 1 [0105.749] WriteFile (in: hFile=0x18c, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0xe2, lpOverlapped=0x0) returned 1 [0105.749] SetEndOfFile (hFile=0x18c) returned 1 [0105.749] CloseHandle (hObject=0x18c) returned 1 [0105.749] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0105.750] SetEndOfFile (hFile=0x1ac) returned 1 [0105.750] CloseHandle (hObject=0x1ac) returned 1 [0105.750] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0105.750] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\oct.chm")) returned 1 [0105.750] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0105.750] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0105.750] lstrlenW (lpString=".doc") returned 4 [0105.750] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0105.751] lstrlenW (lpString=".docx") returned 5 [0105.751] lstrcmpiW (lpString1=".docx", lpString2="T.CHM") returned -1 [0105.751] lstrlenW (lpString=".pdf") returned 4 [0105.751] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0105.751] lstrlenW (lpString=".xls") returned 4 [0105.751] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0105.751] lstrlenW (lpString=".xlsx") returned 5 [0105.751] lstrcmpiW (lpString1=".xlsx", lpString2="T.CHM") returned -1 [0105.751] lstrlenW (lpString=".ppt") returned 4 [0105.751] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0105.751] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0105.751] lstrlenW (lpString=".zip") returned 4 [0105.751] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0105.751] lstrlenW (lpString=".rar") returned 4 [0105.751] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0105.751] lstrlenW (lpString=".bz2") returned 4 [0105.751] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0105.751] lstrlenW (lpString=".7z") returned 3 [0105.751] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0105.751] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0105.751] lstrlenW (lpString=".dbf") returned 4 [0105.751] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0105.751] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0105.751] lstrlenW (lpString=".1cd") returned 4 [0105.751] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0105.751] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0105.751] lstrlenW (lpString=".jpg") returned 4 [0105.751] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0105.751] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0105.751] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0105.751] lstrlenW (lpString=".doc") returned 4 [0105.751] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0105.751] lstrlenW (lpString=".docx") returned 5 [0105.751] lstrcmpiW (lpString1=".docx", lpString2="T.CHM") returned -1 [0105.751] lstrlenW (lpString=".pdf") returned 4 [0105.751] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0105.751] lstrlenW (lpString=".xls") returned 4 [0105.751] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0105.751] lstrlenW (lpString=".xlsx") returned 5 [0105.751] lstrcmpiW (lpString1=".xlsx", lpString2="T.CHM") returned -1 [0105.751] lstrlenW (lpString=".ppt") returned 4 [0105.751] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0105.751] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0105.751] lstrlenW (lpString=".zip") returned 4 [0105.751] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0105.751] lstrlenW (lpString=".rar") returned 4 [0105.751] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0105.751] lstrlenW (lpString=".bz2") returned 4 [0105.751] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0105.751] lstrlenW (lpString=".7z") returned 3 [0105.751] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0105.751] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0105.751] lstrlenW (lpString=".dbf") returned 4 [0105.752] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0105.752] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0105.752] lstrlenW (lpString=".1cd") returned 4 [0105.752] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0105.752] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0105.752] lstrlenW (lpString=".jpg") returned 4 [0105.752] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0105.752] lstrcmpiW (lpString1=".XML", lpString2=".waifu") returned 1 [0105.752] lstrlenW (lpString="OfficeMUI.XML") returned 13 [0105.752] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0105.927] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x37cfddc | out: lpFileSize=0x37cfddc*=5557) returned 1 [0105.927] CloseHandle (hObject=0x194) returned 1 [0105.927] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemui.xml")) returned 0x20 [0105.927] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemui.xml.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0105.927] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0105.927] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0105.928] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0105.928] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemui.xml.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0105.928] GetLastError () returned 0x0 [0105.928] ReadFile (in: hFile=0x194, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x15b5, lpOverlapped=0x0) returned 1 [0105.931] WriteFile (in: hFile=0x1b0, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0x15c0, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0x15c0, lpOverlapped=0x0) returned 1 [0105.931] ReadFile (in: hFile=0x194, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x0, lpOverlapped=0x0) returned 1 [0105.931] WriteFile (in: hFile=0x1b0, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0xee, lpOverlapped=0x0) returned 1 [0105.931] SetEndOfFile (hFile=0x1b0) returned 1 [0105.931] CloseHandle (hObject=0x1b0) returned 1 [0105.932] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0105.932] SetEndOfFile (hFile=0x194) returned 1 [0105.933] CloseHandle (hObject=0x194) returned 1 [0105.933] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0105.933] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemui.xml")) returned 1 [0105.933] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0105.933] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0105.933] lstrlenW (lpString=".doc") returned 4 [0105.933] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0105.933] lstrlenW (lpString=".docx") returned 5 [0105.933] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0105.933] lstrlenW (lpString=".pdf") returned 4 [0105.933] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0105.933] lstrlenW (lpString=".xls") returned 4 [0105.933] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0105.933] lstrlenW (lpString=".xlsx") returned 5 [0105.933] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0105.933] lstrlenW (lpString=".ppt") returned 4 [0105.933] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0105.933] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0105.933] lstrlenW (lpString=".zip") returned 4 [0105.933] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0105.933] lstrlenW (lpString=".rar") returned 4 [0105.933] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0105.933] lstrlenW (lpString=".bz2") returned 4 [0105.933] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0105.933] lstrlenW (lpString=".7z") returned 3 [0105.933] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0105.933] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0105.933] lstrlenW (lpString=".dbf") returned 4 [0105.933] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0105.933] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0105.933] lstrlenW (lpString=".1cd") returned 4 [0105.933] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0105.934] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0105.934] lstrlenW (lpString=".jpg") returned 4 [0105.934] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0105.934] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0105.934] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0105.934] lstrlenW (lpString=".doc") returned 4 [0105.934] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0105.934] lstrlenW (lpString=".docx") returned 5 [0105.934] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0105.934] lstrlenW (lpString=".pdf") returned 4 [0105.934] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0105.934] lstrlenW (lpString=".xls") returned 4 [0105.934] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0105.934] lstrlenW (lpString=".xlsx") returned 5 [0105.934] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0105.934] lstrlenW (lpString=".ppt") returned 4 [0105.934] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0105.934] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0105.934] lstrlenW (lpString=".zip") returned 4 [0105.934] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0105.934] lstrlenW (lpString=".rar") returned 4 [0105.934] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0105.934] lstrlenW (lpString=".bz2") returned 4 [0105.934] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0105.934] lstrlenW (lpString=".7z") returned 3 [0105.934] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0105.934] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0105.934] lstrlenW (lpString=".dbf") returned 4 [0105.934] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0105.934] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0105.934] lstrlenW (lpString=".1cd") returned 4 [0105.934] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0105.934] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0105.934] lstrlenW (lpString=".jpg") returned 4 [0105.934] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0105.934] lstrcmpiW (lpString1=".XML", lpString2=".waifu") returned 1 [0105.934] lstrlenW (lpString="OfficeMUISet.XML") returned 16 [0105.934] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemuiset.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0105.935] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x37cfddc | out: lpFileSize=0x37cfddc*=819) returned 1 [0105.935] CloseHandle (hObject=0x194) returned 1 [0105.935] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemuiset.xml")) returned 0x20 [0105.935] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemuiset.xml.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0105.935] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemuiset.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0105.935] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0105.935] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0105.935] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemuiset.xml.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0105.935] GetLastError () returned 0x0 [0105.935] ReadFile (in: hFile=0x194, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x333, lpOverlapped=0x0) returned 1 [0105.936] WriteFile (in: hFile=0x1b0, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0x340, lpOverlapped=0x0) returned 1 [0105.937] ReadFile (in: hFile=0x194, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x0, lpOverlapped=0x0) returned 1 [0105.937] WriteFile (in: hFile=0x1b0, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0xf4, lpOverlapped=0x0) returned 1 [0105.937] SetEndOfFile (hFile=0x1b0) returned 1 [0105.937] CloseHandle (hObject=0x1b0) returned 1 [0105.937] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0105.937] SetEndOfFile (hFile=0x194) returned 1 [0105.938] CloseHandle (hObject=0x194) returned 1 [0105.938] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0105.938] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemuiset.xml")) returned 1 [0105.938] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0105.938] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0105.938] lstrlenW (lpString=".doc") returned 4 [0105.938] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0105.938] lstrlenW (lpString=".docx") returned 5 [0105.938] lstrcmpiW (lpString1=".docx", lpString2="t.XML") returned -1 [0105.938] lstrlenW (lpString=".pdf") returned 4 [0105.938] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0105.938] lstrlenW (lpString=".xls") returned 4 [0105.938] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0105.939] lstrlenW (lpString=".xlsx") returned 5 [0105.939] lstrcmpiW (lpString1=".xlsx", lpString2="t.XML") returned -1 [0105.939] lstrlenW (lpString=".ppt") returned 4 [0105.939] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0105.939] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0105.939] lstrlenW (lpString=".zip") returned 4 [0105.939] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0105.939] lstrlenW (lpString=".rar") returned 4 [0105.939] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0105.939] lstrlenW (lpString=".bz2") returned 4 [0105.939] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0105.939] lstrlenW (lpString=".7z") returned 3 [0105.939] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0105.939] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0105.939] lstrlenW (lpString=".dbf") returned 4 [0105.939] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0105.939] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0105.939] lstrlenW (lpString=".1cd") returned 4 [0105.939] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0105.939] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0105.939] lstrlenW (lpString=".jpg") returned 4 [0105.939] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0105.939] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0105.939] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0105.939] lstrlenW (lpString=".doc") returned 4 [0105.939] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0105.939] lstrlenW (lpString=".docx") returned 5 [0105.939] lstrcmpiW (lpString1=".docx", lpString2="t.XML") returned -1 [0105.939] lstrlenW (lpString=".pdf") returned 4 [0105.939] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0105.939] lstrlenW (lpString=".xls") returned 4 [0105.939] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0105.939] lstrlenW (lpString=".xlsx") returned 5 [0105.939] lstrcmpiW (lpString1=".xlsx", lpString2="t.XML") returned -1 [0105.939] lstrlenW (lpString=".ppt") returned 4 [0105.939] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0105.939] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0105.939] lstrlenW (lpString=".zip") returned 4 [0105.939] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0105.939] lstrlenW (lpString=".rar") returned 4 [0105.939] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0105.939] lstrlenW (lpString=".bz2") returned 4 [0105.939] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0105.939] lstrlenW (lpString=".7z") returned 3 [0105.939] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0105.939] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0105.939] lstrlenW (lpString=".dbf") returned 4 [0105.939] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0105.939] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0105.939] lstrlenW (lpString=".1cd") returned 4 [0105.939] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0105.939] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0105.940] lstrlenW (lpString=".jpg") returned 4 [0105.940] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0105.940] lstrcmpiW (lpString1=".CHM", lpString2=".waifu") returned -1 [0105.940] lstrlenW (lpString="PSCONFIG.CHM") returned 12 [0105.940] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\psconfig.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0105.940] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x37cfddc | out: lpFileSize=0x37cfddc*=37689) returned 1 [0105.940] CloseHandle (hObject=0x194) returned 1 [0105.940] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\psconfig.chm")) returned 0x20 [0105.940] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\psconfig.chm.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0105.940] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\psconfig.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0105.941] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0105.941] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0105.941] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\psconfig.chm.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0105.941] GetLastError () returned 0x0 [0105.941] ReadFile (in: hFile=0x194, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x9339, lpOverlapped=0x0) returned 1 [0105.942] WriteFile (in: hFile=0x1b0, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0x9340, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0x9340, lpOverlapped=0x0) returned 1 [0105.943] ReadFile (in: hFile=0x194, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x0, lpOverlapped=0x0) returned 1 [0105.943] WriteFile (in: hFile=0x1b0, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0xec, lpOverlapped=0x0) returned 1 [0105.943] SetEndOfFile (hFile=0x1b0) returned 1 [0105.943] CloseHandle (hObject=0x1b0) returned 1 [0105.944] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0105.944] SetEndOfFile (hFile=0x194) returned 1 [0105.945] CloseHandle (hObject=0x194) returned 1 [0105.945] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0105.945] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\psconfig.chm")) returned 1 [0105.945] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0105.945] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0105.945] lstrlenW (lpString=".doc") returned 4 [0105.945] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0105.945] lstrlenW (lpString=".docx") returned 5 [0105.945] lstrcmpiW (lpString1=".docx", lpString2="G.CHM") returned -1 [0105.945] lstrlenW (lpString=".pdf") returned 4 [0105.945] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0105.945] lstrlenW (lpString=".xls") returned 4 [0105.945] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0105.945] lstrlenW (lpString=".xlsx") returned 5 [0105.945] lstrcmpiW (lpString1=".xlsx", lpString2="G.CHM") returned -1 [0105.945] lstrlenW (lpString=".ppt") returned 4 [0105.945] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0105.945] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0105.945] lstrlenW (lpString=".zip") returned 4 [0105.945] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0105.945] lstrlenW (lpString=".rar") returned 4 [0105.945] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0105.946] lstrlenW (lpString=".bz2") returned 4 [0105.946] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0105.946] lstrlenW (lpString=".7z") returned 3 [0105.946] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0105.946] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0105.946] lstrlenW (lpString=".dbf") returned 4 [0105.946] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0105.946] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0105.946] lstrlenW (lpString=".1cd") returned 4 [0105.946] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0105.946] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0105.946] lstrlenW (lpString=".jpg") returned 4 [0105.946] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0105.946] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0105.946] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0105.946] lstrlenW (lpString=".doc") returned 4 [0105.946] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0105.946] lstrlenW (lpString=".docx") returned 5 [0105.946] lstrcmpiW (lpString1=".docx", lpString2="G.CHM") returned -1 [0105.946] lstrlenW (lpString=".pdf") returned 4 [0105.946] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0105.946] lstrlenW (lpString=".xls") returned 4 [0105.946] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0105.946] lstrlenW (lpString=".xlsx") returned 5 [0105.946] lstrcmpiW (lpString1=".xlsx", lpString2="G.CHM") returned -1 [0105.946] lstrlenW (lpString=".ppt") returned 4 [0105.946] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0105.946] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0105.946] lstrlenW (lpString=".zip") returned 4 [0105.946] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0105.946] lstrlenW (lpString=".rar") returned 4 [0105.946] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0105.946] lstrlenW (lpString=".bz2") returned 4 [0105.946] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0105.946] lstrlenW (lpString=".7z") returned 3 [0105.946] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0105.946] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0105.946] lstrlenW (lpString=".dbf") returned 4 [0105.946] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0105.946] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0105.946] lstrlenW (lpString=".1cd") returned 4 [0105.946] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0105.946] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0105.946] lstrlenW (lpString=".jpg") returned 4 [0105.946] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0105.946] lstrcmpiW (lpString1=".CHM", lpString2=".waifu") returned -1 [0105.947] lstrlenW (lpString="PSS10O.CHM") returned 10 [0105.947] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10o.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0105.947] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x37cfddc | out: lpFileSize=0x37cfddc*=26929) returned 1 [0105.947] CloseHandle (hObject=0x194) returned 1 [0105.947] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10o.chm")) returned 0x20 [0105.947] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10o.chm.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0105.947] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10o.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0105.947] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0105.947] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0105.947] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10o.chm.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0105.947] GetLastError () returned 0x0 [0105.947] ReadFile (in: hFile=0x194, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x6931, lpOverlapped=0x0) returned 1 [0105.949] WriteFile (in: hFile=0x1b0, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0x6940, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0x6940, lpOverlapped=0x0) returned 1 [0105.949] ReadFile (in: hFile=0x194, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x0, lpOverlapped=0x0) returned 1 [0105.949] WriteFile (in: hFile=0x1b0, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0xe8, lpOverlapped=0x0) returned 1 [0105.949] SetEndOfFile (hFile=0x1b0) returned 1 [0105.949] CloseHandle (hObject=0x1b0) returned 1 [0105.950] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0105.950] SetEndOfFile (hFile=0x194) returned 1 [0105.951] CloseHandle (hObject=0x194) returned 1 [0105.951] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0105.951] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10o.chm")) returned 1 [0105.951] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0105.951] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0105.951] lstrlenW (lpString=".doc") returned 4 [0105.951] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0105.951] lstrlenW (lpString=".docx") returned 5 [0105.951] lstrcmpiW (lpString1=".docx", lpString2="O.CHM") returned -1 [0105.951] lstrlenW (lpString=".pdf") returned 4 [0105.951] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0105.951] lstrlenW (lpString=".xls") returned 4 [0105.951] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0105.951] lstrlenW (lpString=".xlsx") returned 5 [0105.951] lstrcmpiW (lpString1=".xlsx", lpString2="O.CHM") returned -1 [0105.952] lstrlenW (lpString=".ppt") returned 4 [0105.952] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0105.952] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0105.952] lstrlenW (lpString=".zip") returned 4 [0105.952] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0105.952] lstrlenW (lpString=".rar") returned 4 [0105.952] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0105.952] lstrlenW (lpString=".bz2") returned 4 [0105.952] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0105.952] lstrlenW (lpString=".7z") returned 3 [0105.952] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0105.952] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0105.952] lstrlenW (lpString=".dbf") returned 4 [0105.952] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0105.952] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0105.952] lstrlenW (lpString=".1cd") returned 4 [0105.952] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0105.952] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0105.952] lstrlenW (lpString=".jpg") returned 4 [0105.952] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0105.952] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0105.952] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0105.952] lstrlenW (lpString=".doc") returned 4 [0105.952] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0105.952] lstrlenW (lpString=".docx") returned 5 [0105.952] lstrcmpiW (lpString1=".docx", lpString2="O.CHM") returned -1 [0105.952] lstrlenW (lpString=".pdf") returned 4 [0105.952] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0105.952] lstrlenW (lpString=".xls") returned 4 [0105.952] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0105.952] lstrlenW (lpString=".xlsx") returned 5 [0105.952] lstrcmpiW (lpString1=".xlsx", lpString2="O.CHM") returned -1 [0105.952] lstrlenW (lpString=".ppt") returned 4 [0105.952] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0105.952] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0105.952] lstrlenW (lpString=".zip") returned 4 [0105.952] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0105.952] lstrlenW (lpString=".rar") returned 4 [0105.952] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0105.952] lstrlenW (lpString=".bz2") returned 4 [0105.952] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0105.952] lstrlenW (lpString=".7z") returned 3 [0105.952] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0105.952] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0105.952] lstrlenW (lpString=".dbf") returned 4 [0105.952] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0105.952] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0105.952] lstrlenW (lpString=".1cd") returned 4 [0105.953] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0105.953] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0105.953] lstrlenW (lpString=".jpg") returned 4 [0105.953] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0105.953] lstrcmpiW (lpString1=".CHM", lpString2=".waifu") returned -1 [0105.953] lstrlenW (lpString="PSS10R.CHM") returned 10 [0105.953] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10r.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0105.953] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x37cfddc | out: lpFileSize=0x37cfddc*=27195) returned 1 [0105.953] CloseHandle (hObject=0x194) returned 1 [0105.953] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10r.chm")) returned 0x20 [0105.953] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10r.chm.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0105.953] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10r.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0105.954] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0105.954] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0105.954] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10r.chm.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0105.954] GetLastError () returned 0x0 [0105.954] ReadFile (in: hFile=0x194, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x6a3b, lpOverlapped=0x0) returned 1 [0105.955] WriteFile (in: hFile=0x1b0, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0x6a40, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0x6a40, lpOverlapped=0x0) returned 1 [0105.956] ReadFile (in: hFile=0x194, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x0, lpOverlapped=0x0) returned 1 [0105.956] WriteFile (in: hFile=0x1b0, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0xe8, lpOverlapped=0x0) returned 1 [0105.956] SetEndOfFile (hFile=0x1b0) returned 1 [0105.956] CloseHandle (hObject=0x1b0) returned 1 [0105.957] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0105.957] SetEndOfFile (hFile=0x194) returned 1 [0105.957] CloseHandle (hObject=0x194) returned 1 [0105.957] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0105.957] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10r.chm")) returned 1 [0105.958] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0105.958] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0105.958] lstrlenW (lpString=".doc") returned 4 [0105.958] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0105.958] lstrlenW (lpString=".docx") returned 5 [0105.958] lstrcmpiW (lpString1=".docx", lpString2="R.CHM") returned -1 [0105.958] lstrlenW (lpString=".pdf") returned 4 [0105.958] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0105.958] lstrlenW (lpString=".xls") returned 4 [0105.958] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0105.958] lstrlenW (lpString=".xlsx") returned 5 [0105.958] lstrcmpiW (lpString1=".xlsx", lpString2="R.CHM") returned -1 [0105.958] lstrlenW (lpString=".ppt") returned 4 [0105.958] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0105.958] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0105.958] lstrlenW (lpString=".zip") returned 4 [0105.958] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0105.958] lstrlenW (lpString=".rar") returned 4 [0105.958] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0105.958] lstrlenW (lpString=".bz2") returned 4 [0105.958] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0105.958] lstrlenW (lpString=".7z") returned 3 [0105.958] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0105.958] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0105.958] lstrlenW (lpString=".dbf") returned 4 [0105.958] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0105.958] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0105.958] lstrlenW (lpString=".1cd") returned 4 [0105.958] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0105.958] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0105.958] lstrlenW (lpString=".jpg") returned 4 [0105.958] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0105.958] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0105.958] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0105.958] lstrlenW (lpString=".doc") returned 4 [0105.958] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0105.958] lstrlenW (lpString=".docx") returned 5 [0105.958] lstrcmpiW (lpString1=".docx", lpString2="R.CHM") returned -1 [0105.959] lstrlenW (lpString=".pdf") returned 4 [0105.959] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0105.959] lstrlenW (lpString=".xls") returned 4 [0105.959] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0105.959] lstrlenW (lpString=".xlsx") returned 5 [0105.959] lstrcmpiW (lpString1=".xlsx", lpString2="R.CHM") returned -1 [0105.959] lstrlenW (lpString=".ppt") returned 4 [0105.959] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0105.959] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0105.959] lstrlenW (lpString=".zip") returned 4 [0105.959] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0105.959] lstrlenW (lpString=".rar") returned 4 [0105.959] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0105.959] lstrlenW (lpString=".bz2") returned 4 [0105.959] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0105.959] lstrlenW (lpString=".7z") returned 3 [0105.959] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0105.959] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0105.959] lstrlenW (lpString=".dbf") returned 4 [0105.959] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0105.959] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0105.959] lstrlenW (lpString=".1cd") returned 4 [0105.959] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0105.959] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0105.959] lstrlenW (lpString=".jpg") returned 4 [0105.959] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0105.959] lstrcmpiW (lpString1=".CHM", lpString2=".waifu") returned -1 [0105.959] lstrlenW (lpString="SETUP.CHM") returned 9 [0105.959] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0105.960] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x37cfddc | out: lpFileSize=0x37cfddc*=67190) returned 1 [0105.960] CloseHandle (hObject=0x194) returned 1 [0105.960] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.chm")) returned 0x20 [0105.960] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.chm.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0105.960] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0105.960] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0105.960] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0105.960] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.chm.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0105.960] GetLastError () returned 0x0 [0105.960] ReadFile (in: hFile=0x194, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x10676, lpOverlapped=0x0) returned 1 [0106.334] WriteFile (in: hFile=0x1b0, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0x10680, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0x10680, lpOverlapped=0x0) returned 1 [0106.350] ReadFile (in: hFile=0x194, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x0, lpOverlapped=0x0) returned 1 [0106.350] WriteFile (in: hFile=0x1b0, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0xe6, lpOverlapped=0x0) returned 1 [0106.350] SetEndOfFile (hFile=0x1b0) returned 1 [0106.350] CloseHandle (hObject=0x1b0) returned 1 [0106.351] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0106.351] SetEndOfFile (hFile=0x194) returned 1 [0106.496] CloseHandle (hObject=0x194) returned 1 [0106.497] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0106.516] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.chm")) returned 1 [0106.528] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0106.528] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0106.528] lstrlenW (lpString=".doc") returned 4 [0106.528] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0106.528] lstrlenW (lpString=".docx") returned 5 [0106.528] lstrcmpiW (lpString1=".docx", lpString2="P.CHM") returned -1 [0106.528] lstrlenW (lpString=".pdf") returned 4 [0106.528] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0106.528] lstrlenW (lpString=".xls") returned 4 [0106.528] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0106.528] lstrlenW (lpString=".xlsx") returned 5 [0106.528] lstrcmpiW (lpString1=".xlsx", lpString2="P.CHM") returned -1 [0106.528] lstrlenW (lpString=".ppt") returned 4 [0106.528] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0106.528] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0106.528] lstrlenW (lpString=".zip") returned 4 [0106.528] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0106.528] lstrlenW (lpString=".rar") returned 4 [0106.528] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0106.528] lstrlenW (lpString=".bz2") returned 4 [0106.528] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0106.528] lstrlenW (lpString=".7z") returned 3 [0106.528] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0106.528] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0106.528] lstrlenW (lpString=".dbf") returned 4 [0106.528] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0106.528] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0106.528] lstrlenW (lpString=".1cd") returned 4 [0106.528] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0106.529] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0106.529] lstrlenW (lpString=".jpg") returned 4 [0106.529] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0106.529] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0106.529] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0106.529] lstrlenW (lpString=".doc") returned 4 [0106.529] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0106.529] lstrlenW (lpString=".docx") returned 5 [0106.529] lstrcmpiW (lpString1=".docx", lpString2="P.CHM") returned -1 [0106.529] lstrlenW (lpString=".pdf") returned 4 [0106.529] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0106.529] lstrlenW (lpString=".xls") returned 4 [0106.529] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0106.529] lstrlenW (lpString=".xlsx") returned 5 [0106.529] lstrcmpiW (lpString1=".xlsx", lpString2="P.CHM") returned -1 [0106.529] lstrlenW (lpString=".ppt") returned 4 [0106.529] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0106.529] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0106.529] lstrlenW (lpString=".zip") returned 4 [0106.529] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0106.529] lstrlenW (lpString=".rar") returned 4 [0106.529] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0106.529] lstrlenW (lpString=".bz2") returned 4 [0106.529] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0106.529] lstrlenW (lpString=".7z") returned 3 [0106.529] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0106.529] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0106.529] lstrlenW (lpString=".dbf") returned 4 [0106.529] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0106.529] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0106.529] lstrlenW (lpString=".1cd") returned 4 [0106.529] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0106.529] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0106.529] lstrlenW (lpString=".jpg") returned 4 [0106.529] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0106.529] lstrcmpiW (lpString1=".XML", lpString2=".waifu") returned 1 [0106.529] lstrlenW (lpString="Proofing.XML") returned 12 [0106.529] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\proofing.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0107.666] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x37cfddc | out: lpFileSize=0x37cfddc*=811) returned 1 [0107.666] CloseHandle (hObject=0x1d8) returned 1 [0107.666] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\proofing.xml")) returned 0x20 [0107.666] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\proofing.xml.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0107.667] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\proofing.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0107.667] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0107.667] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0107.667] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\proofing.xml.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0107.667] GetLastError () returned 0x0 [0107.667] ReadFile (in: hFile=0x1d8, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x32b, lpOverlapped=0x0) returned 1 [0107.669] WriteFile (in: hFile=0x1b0, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0x330, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0x330, lpOverlapped=0x0) returned 1 [0107.670] ReadFile (in: hFile=0x1d8, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x0, lpOverlapped=0x0) returned 1 [0107.670] WriteFile (in: hFile=0x1b0, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0xec, lpOverlapped=0x0) returned 1 [0107.670] SetEndOfFile (hFile=0x1b0) returned 1 [0108.127] CloseHandle (hObject=0x1b0) returned 1 [0108.128] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0108.128] SetEndOfFile (hFile=0x1d8) returned 1 [0108.167] CloseHandle (hObject=0x1d8) returned 1 [0108.167] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0108.167] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\proofing.xml")) returned 1 [0108.167] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107 [0108.167] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107 [0108.167] lstrlenW (lpString=".doc") returned 4 [0108.167] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0108.167] lstrlenW (lpString=".docx") returned 5 [0108.167] lstrcmpiW (lpString1=".docx", lpString2="g.XML") returned -1 [0108.167] lstrlenW (lpString=".pdf") returned 4 [0108.167] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0108.167] lstrlenW (lpString=".xls") returned 4 [0108.167] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0108.167] lstrlenW (lpString=".xlsx") returned 5 [0108.167] lstrcmpiW (lpString1=".xlsx", lpString2="g.XML") returned -1 [0108.167] lstrlenW (lpString=".ppt") returned 4 [0108.167] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0108.167] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107 [0108.167] lstrlenW (lpString=".zip") returned 4 [0108.167] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0108.167] lstrlenW (lpString=".rar") returned 4 [0108.168] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0108.168] lstrlenW (lpString=".bz2") returned 4 [0108.168] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0108.168] lstrlenW (lpString=".7z") returned 3 [0108.168] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0108.168] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107 [0108.168] lstrlenW (lpString=".dbf") returned 4 [0108.168] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0108.168] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107 [0108.168] lstrlenW (lpString=".1cd") returned 4 [0108.168] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0108.168] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107 [0108.168] lstrlenW (lpString=".jpg") returned 4 [0108.168] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0108.168] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107 [0108.168] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107 [0108.168] lstrlenW (lpString=".doc") returned 4 [0108.168] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0108.168] lstrlenW (lpString=".docx") returned 5 [0108.168] lstrcmpiW (lpString1=".docx", lpString2="g.XML") returned -1 [0108.168] lstrlenW (lpString=".pdf") returned 4 [0108.168] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0108.168] lstrlenW (lpString=".xls") returned 4 [0108.168] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0108.168] lstrlenW (lpString=".xlsx") returned 5 [0108.168] lstrcmpiW (lpString1=".xlsx", lpString2="g.XML") returned -1 [0108.168] lstrlenW (lpString=".ppt") returned 4 [0108.168] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0108.168] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107 [0108.168] lstrlenW (lpString=".zip") returned 4 [0108.168] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0108.168] lstrlenW (lpString=".rar") returned 4 [0108.168] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0108.168] lstrlenW (lpString=".bz2") returned 4 [0108.168] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0108.168] lstrlenW (lpString=".7z") returned 3 [0108.168] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0108.168] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107 [0108.168] lstrlenW (lpString=".dbf") returned 4 [0108.168] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0108.168] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107 [0108.168] lstrlenW (lpString=".1cd") returned 4 [0108.168] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0108.168] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107 [0108.168] lstrlenW (lpString=".jpg") returned 4 [0108.168] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0108.169] lstrcmpiW (lpString1=".XML", lpString2=".waifu") returned 1 [0108.169] lstrlenW (lpString="TIME.XML") returned 8 [0108.169] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\time.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0108.279] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x37cfddc | out: lpFileSize=0x37cfddc*=8564) returned 1 [0108.279] CloseHandle (hObject=0x168) returned 1 [0108.280] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\time.xml")) returned 0x20 [0108.280] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\time.xml.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0108.280] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\time.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0108.280] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0108.280] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0108.280] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\time.xml.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0108.280] GetLastError () returned 0x0 [0108.280] ReadFile (in: hFile=0x168, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x2174, lpOverlapped=0x0) returned 1 [0108.422] WriteFile (in: hFile=0x1b8, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0x2180, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0x2180, lpOverlapped=0x0) returned 1 [0108.423] ReadFile (in: hFile=0x168, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x0, lpOverlapped=0x0) returned 1 [0108.423] WriteFile (in: hFile=0x1b8, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0xe4, lpOverlapped=0x0) returned 1 [0108.423] SetEndOfFile (hFile=0x1b8) returned 1 [0108.423] CloseHandle (hObject=0x1b8) returned 1 [0108.423] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0108.423] SetEndOfFile (hFile=0x168) returned 1 [0108.424] CloseHandle (hObject=0x168) returned 1 [0108.424] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0108.424] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\time.xml")) returned 1 [0108.424] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0108.424] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0108.424] lstrlenW (lpString=".doc") returned 4 [0108.424] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0108.424] lstrlenW (lpString=".docx") returned 5 [0108.424] lstrcmpiW (lpString1=".docx", lpString2="E.XML") returned -1 [0108.424] lstrlenW (lpString=".pdf") returned 4 [0108.424] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0108.424] lstrlenW (lpString=".xls") returned 4 [0108.424] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0108.424] lstrlenW (lpString=".xlsx") returned 5 [0108.424] lstrcmpiW (lpString1=".xlsx", lpString2="E.XML") returned -1 [0108.424] lstrlenW (lpString=".ppt") returned 4 [0108.424] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0108.424] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0108.424] lstrlenW (lpString=".zip") returned 4 [0108.424] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0108.424] lstrlenW (lpString=".rar") returned 4 [0108.424] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0108.424] lstrlenW (lpString=".bz2") returned 4 [0108.424] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0108.424] lstrlenW (lpString=".7z") returned 3 [0108.424] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0108.424] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0108.424] lstrlenW (lpString=".dbf") returned 4 [0108.425] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0108.425] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0108.425] lstrlenW (lpString=".1cd") returned 4 [0108.425] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0108.425] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0108.425] lstrlenW (lpString=".jpg") returned 4 [0108.425] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0108.425] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0108.425] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0108.425] lstrlenW (lpString=".doc") returned 4 [0108.425] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0108.425] lstrlenW (lpString=".docx") returned 5 [0108.425] lstrcmpiW (lpString1=".docx", lpString2="E.XML") returned -1 [0108.425] lstrlenW (lpString=".pdf") returned 4 [0108.425] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0108.425] lstrlenW (lpString=".xls") returned 4 [0108.425] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0108.425] lstrlenW (lpString=".xlsx") returned 5 [0108.425] lstrcmpiW (lpString1=".xlsx", lpString2="E.XML") returned -1 [0108.425] lstrlenW (lpString=".ppt") returned 4 [0108.425] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0108.425] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0108.425] lstrlenW (lpString=".zip") returned 4 [0108.425] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0108.425] lstrlenW (lpString=".rar") returned 4 [0108.425] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0108.425] lstrlenW (lpString=".bz2") returned 4 [0108.425] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0108.425] lstrlenW (lpString=".7z") returned 3 [0108.425] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0108.425] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0108.425] lstrlenW (lpString=".dbf") returned 4 [0108.425] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0108.425] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0108.425] lstrlenW (lpString=".1cd") returned 4 [0108.425] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0108.425] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0108.425] lstrlenW (lpString=".jpg") returned 4 [0108.425] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0108.425] lstrcmpiW (lpString1=".XSL", lpString2=".waifu") returned 1 [0108.425] lstrlenW (lpString="BASMLA.XSL") returned 10 [0108.425] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\basmla.xsl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0108.426] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x37cfddc | out: lpFileSize=0x37cfddc*=227311) returned 1 [0108.426] CloseHandle (hObject=0x168) returned 1 [0108.426] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\basmla.xsl")) returned 0x20 [0108.426] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\basmla.xsl.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0108.426] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\basmla.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0108.426] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0108.426] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0108.426] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\basmla.xsl.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0108.427] GetLastError () returned 0x0 [0108.427] ReadFile (in: hFile=0x168, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x377ef, lpOverlapped=0x0) returned 1 [0108.431] WriteFile (in: hFile=0x1b8, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0x377f0, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0x377f0, lpOverlapped=0x0) returned 1 [0108.432] ReadFile (in: hFile=0x168, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x0, lpOverlapped=0x0) returned 1 [0108.432] WriteFile (in: hFile=0x1b8, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0xe8, lpOverlapped=0x0) returned 1 [0108.432] SetEndOfFile (hFile=0x1b8) returned 1 [0108.433] CloseHandle (hObject=0x1b8) returned 1 [0108.433] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0108.433] SetEndOfFile (hFile=0x168) returned 1 [0108.434] CloseHandle (hObject=0x168) returned 1 [0108.434] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0108.434] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\basmla.xsl")) returned 1 [0108.435] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0108.435] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0108.435] lstrlenW (lpString=".doc") returned 4 [0108.435] lstrcmpiW (lpString1=".doc", lpString2=".XSL") returned -1 [0108.435] lstrlenW (lpString=".docx") returned 5 [0108.435] lstrcmpiW (lpString1=".docx", lpString2="A.XSL") returned -1 [0108.435] lstrlenW (lpString=".pdf") returned 4 [0108.435] lstrcmpiW (lpString1=".pdf", lpString2=".XSL") returned -1 [0108.435] lstrlenW (lpString=".xls") returned 4 [0108.435] lstrcmpiW (lpString1=".xls", lpString2=".XSL") returned -1 [0108.435] lstrlenW (lpString=".xlsx") returned 5 [0108.435] lstrcmpiW (lpString1=".xlsx", lpString2="A.XSL") returned -1 [0108.435] lstrlenW (lpString=".ppt") returned 4 [0108.435] lstrcmpiW (lpString1=".ppt", lpString2=".XSL") returned -1 [0108.435] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0108.435] lstrlenW (lpString=".zip") returned 4 [0108.435] lstrcmpiW (lpString1=".zip", lpString2=".XSL") returned 1 [0108.435] lstrlenW (lpString=".rar") returned 4 [0108.435] lstrcmpiW (lpString1=".rar", lpString2=".XSL") returned -1 [0108.435] lstrlenW (lpString=".bz2") returned 4 [0108.435] lstrcmpiW (lpString1=".bz2", lpString2=".XSL") returned -1 [0108.435] lstrlenW (lpString=".7z") returned 3 [0108.435] lstrcmpiW (lpString1=".7z", lpString2="XSL") returned -1 [0108.435] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0108.435] lstrlenW (lpString=".dbf") returned 4 [0108.435] lstrcmpiW (lpString1=".dbf", lpString2=".XSL") returned -1 [0108.435] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0108.435] lstrlenW (lpString=".1cd") returned 4 [0108.435] lstrcmpiW (lpString1=".1cd", lpString2=".XSL") returned -1 [0108.435] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0108.435] lstrlenW (lpString=".jpg") returned 4 [0108.435] lstrcmpiW (lpString1=".jpg", lpString2=".XSL") returned -1 [0108.435] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0108.435] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0108.435] lstrlenW (lpString=".doc") returned 4 [0108.435] lstrcmpiW (lpString1=".doc", lpString2=".XSL") returned -1 [0108.435] lstrlenW (lpString=".docx") returned 5 [0108.435] lstrcmpiW (lpString1=".docx", lpString2="A.XSL") returned -1 [0108.435] lstrlenW (lpString=".pdf") returned 4 [0108.435] lstrcmpiW (lpString1=".pdf", lpString2=".XSL") returned -1 [0108.435] lstrlenW (lpString=".xls") returned 4 [0108.435] lstrcmpiW (lpString1=".xls", lpString2=".XSL") returned -1 [0108.436] lstrlenW (lpString=".xlsx") returned 5 [0108.436] lstrcmpiW (lpString1=".xlsx", lpString2="A.XSL") returned -1 [0108.436] lstrlenW (lpString=".ppt") returned 4 [0108.436] lstrcmpiW (lpString1=".ppt", lpString2=".XSL") returned -1 [0108.436] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0108.436] lstrlenW (lpString=".zip") returned 4 [0108.436] lstrcmpiW (lpString1=".zip", lpString2=".XSL") returned 1 [0108.436] lstrlenW (lpString=".rar") returned 4 [0108.436] lstrcmpiW (lpString1=".rar", lpString2=".XSL") returned -1 [0108.436] lstrlenW (lpString=".bz2") returned 4 [0108.436] lstrcmpiW (lpString1=".bz2", lpString2=".XSL") returned -1 [0108.436] lstrlenW (lpString=".7z") returned 3 [0108.436] lstrcmpiW (lpString1=".7z", lpString2="XSL") returned -1 [0108.436] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0108.436] lstrlenW (lpString=".dbf") returned 4 [0108.436] lstrcmpiW (lpString1=".dbf", lpString2=".XSL") returned -1 [0108.436] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0108.436] lstrlenW (lpString=".1cd") returned 4 [0108.436] lstrcmpiW (lpString1=".1cd", lpString2=".XSL") returned -1 [0108.436] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0108.436] lstrlenW (lpString=".jpg") returned 4 [0108.436] lstrcmpiW (lpString1=".jpg", lpString2=".XSL") returned -1 [0108.436] lstrcmpiW (lpString1=".TXT", lpString2=".waifu") returned -1 [0108.436] lstrlenW (lpString="METCONV.TXT") returned 11 [0108.436] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0108.437] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x37cfddc | out: lpFileSize=0x37cfddc*=1183416) returned 1 [0108.437] CloseHandle (hObject=0x168) returned 1 [0108.437] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.txt")) returned 0x20 [0108.437] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.txt.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0108.437] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0108.437] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0108.437] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0108.437] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.txt.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0108.437] GetLastError () returned 0x0 [0108.437] ReadFile (in: hFile=0x168, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0xffff0, lpOverlapped=0x0) returned 1 [0110.462] WriteFile (in: hFile=0x1b8, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0xffff0, lpOverlapped=0x0) returned 1 [0110.515] ReadFile (in: hFile=0x168, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x20ec8, lpOverlapped=0x0) returned 1 [0110.519] WriteFile (in: hFile=0x1b8, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0x20ed0, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0x20ed0, lpOverlapped=0x0) returned 1 [0110.521] ReadFile (in: hFile=0x168, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x0, lpOverlapped=0x0) returned 1 [0110.522] WriteFile (in: hFile=0x1b8, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0xea, lpOverlapped=0x0) returned 1 [0110.522] SetEndOfFile (hFile=0x1b8) returned 1 [0110.522] CloseHandle (hObject=0x1b8) returned 1 [0110.522] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0110.522] SetEndOfFile (hFile=0x168) returned 1 [0110.523] CloseHandle (hObject=0x168) returned 1 [0110.523] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0110.523] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.txt")) returned 1 [0110.523] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68 [0110.523] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68 [0110.523] lstrlenW (lpString=".doc") returned 4 [0110.523] lstrcmpiW (lpString1=".doc", lpString2=".TXT") returned -1 [0110.523] lstrlenW (lpString=".docx") returned 5 [0110.523] lstrcmpiW (lpString1=".docx", lpString2="V.TXT") returned -1 [0110.523] lstrlenW (lpString=".pdf") returned 4 [0110.523] lstrcmpiW (lpString1=".pdf", lpString2=".TXT") returned -1 [0110.523] lstrlenW (lpString=".xls") returned 4 [0110.523] lstrcmpiW (lpString1=".xls", lpString2=".TXT") returned 1 [0110.523] lstrlenW (lpString=".xlsx") returned 5 [0110.523] lstrcmpiW (lpString1=".xlsx", lpString2="V.TXT") returned -1 [0110.523] lstrlenW (lpString=".ppt") returned 4 [0110.523] lstrcmpiW (lpString1=".ppt", lpString2=".TXT") returned -1 [0110.523] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68 [0110.523] lstrlenW (lpString=".zip") returned 4 [0110.523] lstrcmpiW (lpString1=".zip", lpString2=".TXT") returned 1 [0110.523] lstrlenW (lpString=".rar") returned 4 [0110.523] lstrcmpiW (lpString1=".rar", lpString2=".TXT") returned -1 [0110.524] lstrlenW (lpString=".bz2") returned 4 [0110.524] lstrcmpiW (lpString1=".bz2", lpString2=".TXT") returned -1 [0110.524] lstrlenW (lpString=".7z") returned 3 [0110.524] lstrcmpiW (lpString1=".7z", lpString2="TXT") returned -1 [0110.524] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68 [0110.524] lstrlenW (lpString=".dbf") returned 4 [0110.524] lstrcmpiW (lpString1=".dbf", lpString2=".TXT") returned -1 [0110.524] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68 [0110.524] lstrlenW (lpString=".1cd") returned 4 [0110.524] lstrcmpiW (lpString1=".1cd", lpString2=".TXT") returned -1 [0110.524] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68 [0110.524] lstrlenW (lpString=".jpg") returned 4 [0110.524] lstrcmpiW (lpString1=".jpg", lpString2=".TXT") returned -1 [0110.524] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68 [0110.524] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68 [0110.524] lstrlenW (lpString=".doc") returned 4 [0110.524] lstrcmpiW (lpString1=".doc", lpString2=".TXT") returned -1 [0110.524] lstrlenW (lpString=".docx") returned 5 [0110.524] lstrcmpiW (lpString1=".docx", lpString2="V.TXT") returned -1 [0110.524] lstrlenW (lpString=".pdf") returned 4 [0110.524] lstrcmpiW (lpString1=".pdf", lpString2=".TXT") returned -1 [0110.524] lstrlenW (lpString=".xls") returned 4 [0110.524] lstrcmpiW (lpString1=".xls", lpString2=".TXT") returned 1 [0110.524] lstrlenW (lpString=".xlsx") returned 5 [0110.524] lstrcmpiW (lpString1=".xlsx", lpString2="V.TXT") returned -1 [0110.524] lstrlenW (lpString=".ppt") returned 4 [0110.524] lstrcmpiW (lpString1=".ppt", lpString2=".TXT") returned -1 [0110.524] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68 [0110.524] lstrlenW (lpString=".zip") returned 4 [0110.524] lstrcmpiW (lpString1=".zip", lpString2=".TXT") returned 1 [0110.524] lstrlenW (lpString=".rar") returned 4 [0110.524] lstrcmpiW (lpString1=".rar", lpString2=".TXT") returned -1 [0110.524] lstrlenW (lpString=".bz2") returned 4 [0110.524] lstrcmpiW (lpString1=".bz2", lpString2=".TXT") returned -1 [0110.524] lstrlenW (lpString=".7z") returned 3 [0110.524] lstrcmpiW (lpString1=".7z", lpString2="TXT") returned -1 [0110.524] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68 [0110.524] lstrlenW (lpString=".dbf") returned 4 [0110.524] lstrcmpiW (lpString1=".dbf", lpString2=".TXT") returned -1 [0110.524] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68 [0110.524] lstrlenW (lpString=".1cd") returned 4 [0110.524] lstrcmpiW (lpString1=".1cd", lpString2=".TXT") returned -1 [0110.525] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68 [0110.525] lstrlenW (lpString=".jpg") returned 4 [0110.525] lstrcmpiW (lpString1=".jpg", lpString2=".TXT") returned -1 [0110.525] lstrcmpiW (lpString1=".emf", lpString2=".waifu") returned -1 [0110.525] lstrlenW (lpString="Graph.emf") returned 9 [0110.525] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\graph.emf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0111.264] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x37cfddc | out: lpFileSize=0x37cfddc*=116724) returned 1 [0111.264] CloseHandle (hObject=0x168) returned 1 [0111.264] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\graph.emf")) returned 0x20 [0111.264] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\graph.emf.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0111.264] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\graph.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0111.264] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 67 [0111.264] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 67 [0111.264] lstrlenW (lpString=".doc") returned 4 [0111.264] lstrcmpiW (lpString1=".doc", lpString2=".emf") returned -1 [0111.264] lstrlenW (lpString=".docx") returned 5 [0111.264] lstrcmpiW (lpString1=".docx", lpString2="h.emf") returned -1 [0111.264] lstrlenW (lpString=".pdf") returned 4 [0111.264] lstrcmpiW (lpString1=".pdf", lpString2=".emf") returned 1 [0111.264] lstrlenW (lpString=".xls") returned 4 [0111.264] lstrcmpiW (lpString1=".xls", lpString2=".emf") returned 1 [0111.264] lstrlenW (lpString=".xlsx") returned 5 [0111.264] lstrcmpiW (lpString1=".xlsx", lpString2="h.emf") returned -1 [0111.264] lstrlenW (lpString=".ppt") returned 4 [0111.264] lstrcmpiW (lpString1=".ppt", lpString2=".emf") returned 1 [0111.264] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 67 [0111.264] lstrlenW (lpString=".zip") returned 4 [0111.264] lstrcmpiW (lpString1=".zip", lpString2=".emf") returned 1 [0111.264] lstrlenW (lpString=".rar") returned 4 [0111.264] lstrcmpiW (lpString1=".rar", lpString2=".emf") returned 1 [0111.264] lstrlenW (lpString=".bz2") returned 4 [0111.264] lstrcmpiW (lpString1=".bz2", lpString2=".emf") returned -1 [0111.265] lstrlenW (lpString=".7z") returned 3 [0111.265] lstrcmpiW (lpString1=".7z", lpString2="emf") returned -1 [0111.265] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 67 [0111.265] lstrlenW (lpString=".dbf") returned 4 [0111.265] lstrcmpiW (lpString1=".dbf", lpString2=".emf") returned -1 [0111.265] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 67 [0111.265] lstrlenW (lpString=".1cd") returned 4 [0111.265] lstrcmpiW (lpString1=".1cd", lpString2=".emf") returned -1 [0111.265] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 67 [0111.265] lstrlenW (lpString=".jpg") returned 4 [0111.265] lstrcmpiW (lpString1=".jpg", lpString2=".emf") returned 1 [0111.265] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 67 [0111.265] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 67 [0111.265] lstrlenW (lpString=".doc") returned 4 [0111.265] lstrcmpiW (lpString1=".doc", lpString2=".emf") returned -1 [0111.265] lstrlenW (lpString=".docx") returned 5 [0111.265] lstrcmpiW (lpString1=".docx", lpString2="h.emf") returned -1 [0111.265] lstrlenW (lpString=".pdf") returned 4 [0111.265] lstrcmpiW (lpString1=".pdf", lpString2=".emf") returned 1 [0111.265] lstrlenW (lpString=".xls") returned 4 [0111.265] lstrcmpiW (lpString1=".xls", lpString2=".emf") returned 1 [0111.265] lstrlenW (lpString=".xlsx") returned 5 [0111.265] lstrcmpiW (lpString1=".xlsx", lpString2="h.emf") returned -1 [0111.265] lstrlenW (lpString=".ppt") returned 4 [0111.265] lstrcmpiW (lpString1=".ppt", lpString2=".emf") returned 1 [0111.265] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 67 [0111.265] lstrlenW (lpString=".zip") returned 4 [0111.265] lstrcmpiW (lpString1=".zip", lpString2=".emf") returned 1 [0111.265] lstrlenW (lpString=".rar") returned 4 [0111.265] lstrcmpiW (lpString1=".rar", lpString2=".emf") returned 1 [0111.265] lstrlenW (lpString=".bz2") returned 4 [0111.265] lstrcmpiW (lpString1=".bz2", lpString2=".emf") returned -1 [0111.265] lstrlenW (lpString=".7z") returned 3 [0111.265] lstrcmpiW (lpString1=".7z", lpString2="emf") returned -1 [0111.265] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 67 [0111.265] lstrlenW (lpString=".dbf") returned 4 [0111.265] lstrcmpiW (lpString1=".dbf", lpString2=".emf") returned -1 [0111.265] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 67 [0111.265] lstrlenW (lpString=".1cd") returned 4 [0111.265] lstrcmpiW (lpString1=".1cd", lpString2=".emf") returned -1 [0111.265] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 67 [0111.265] lstrlenW (lpString=".jpg") returned 4 [0111.265] lstrcmpiW (lpString1=".jpg", lpString2=".emf") returned 1 [0111.265] lstrcmpiW (lpString1=".htm", lpString2=".waifu") returned -1 [0111.265] lstrlenW (lpString="Green Bubbles.htm") returned 17 [0111.266] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\green bubbles.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0111.266] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x37cfddc | out: lpFileSize=0x37cfddc*=237) returned 1 [0111.266] CloseHandle (hObject=0x168) returned 1 [0111.266] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\green bubbles.htm")) returned 0x20 [0111.266] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\green bubbles.htm.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0111.266] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\green bubbles.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0111.266] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned 75 [0111.266] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned 75 [0111.266] lstrlenW (lpString=".doc") returned 4 [0111.266] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0111.266] lstrlenW (lpString=".docx") returned 5 [0111.266] lstrcmpiW (lpString1=".docx", lpString2="s.htm") returned -1 [0111.267] lstrlenW (lpString=".pdf") returned 4 [0111.267] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0111.267] lstrlenW (lpString=".xls") returned 4 [0111.267] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0111.267] lstrlenW (lpString=".xlsx") returned 5 [0111.267] lstrcmpiW (lpString1=".xlsx", lpString2="s.htm") returned -1 [0111.267] lstrlenW (lpString=".ppt") returned 4 [0111.267] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0111.267] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned 75 [0111.267] lstrlenW (lpString=".zip") returned 4 [0111.267] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0111.267] lstrlenW (lpString=".rar") returned 4 [0111.267] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0111.267] lstrlenW (lpString=".bz2") returned 4 [0111.267] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0111.267] lstrlenW (lpString=".7z") returned 3 [0111.267] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0111.267] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned 75 [0111.267] lstrlenW (lpString=".dbf") returned 4 [0111.267] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0111.267] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned 75 [0111.267] lstrlenW (lpString=".1cd") returned 4 [0111.267] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1 [0111.267] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned 75 [0111.267] lstrlenW (lpString=".jpg") returned 4 [0111.267] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1 [0111.267] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned 75 [0111.267] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned 75 [0111.267] lstrlenW (lpString=".doc") returned 4 [0111.267] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0111.267] lstrlenW (lpString=".docx") returned 5 [0111.267] lstrcmpiW (lpString1=".docx", lpString2="s.htm") returned -1 [0111.267] lstrlenW (lpString=".pdf") returned 4 [0111.267] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0111.267] lstrlenW (lpString=".xls") returned 4 [0111.267] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0111.267] lstrlenW (lpString=".xlsx") returned 5 [0111.267] lstrcmpiW (lpString1=".xlsx", lpString2="s.htm") returned -1 [0111.267] lstrlenW (lpString=".ppt") returned 4 [0111.267] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0111.267] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned 75 [0111.267] lstrlenW (lpString=".zip") returned 4 [0111.267] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0111.267] lstrlenW (lpString=".rar") returned 4 [0111.267] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0111.267] lstrlenW (lpString=".bz2") returned 4 [0111.267] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0111.267] lstrlenW (lpString=".7z") returned 3 [0111.267] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0111.267] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned 75 [0111.267] lstrlenW (lpString=".dbf") returned 4 [0111.268] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0111.268] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned 75 [0111.268] lstrlenW (lpString=".1cd") returned 4 [0111.268] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1 [0111.268] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned 75 [0111.268] lstrlenW (lpString=".jpg") returned 4 [0111.268] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1 [0111.268] lstrcmpiW (lpString1=".jpg", lpString2=".waifu") returned -1 [0111.268] lstrlenW (lpString="GreenBubbles.jpg") returned 16 [0111.268] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\greenbubbles.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0111.268] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x37cfddc | out: lpFileSize=0x37cfddc*=6406) returned 1 [0111.268] CloseHandle (hObject=0x168) returned 1 [0111.268] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\greenbubbles.jpg")) returned 0x20 [0111.268] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\greenbubbles.jpg.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0111.268] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\greenbubbles.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0111.268] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg") returned 74 [0111.268] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg") returned 74 [0111.268] lstrlenW (lpString=".doc") returned 4 [0111.268] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0111.268] lstrlenW (lpString=".docx") returned 5 [0111.268] lstrcmpiW (lpString1=".docx", lpString2="s.jpg") returned -1 [0111.268] lstrlenW (lpString=".pdf") returned 4 [0111.268] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0111.268] lstrlenW (lpString=".xls") returned 4 [0111.268] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0111.268] lstrlenW (lpString=".xlsx") returned 5 [0111.268] lstrcmpiW (lpString1=".xlsx", lpString2="s.jpg") returned -1 [0111.268] lstrlenW (lpString=".ppt") returned 4 [0111.268] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0111.269] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg") returned 74 [0111.269] lstrlenW (lpString=".zip") returned 4 [0111.269] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0111.269] lstrlenW (lpString=".rar") returned 4 [0111.269] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0111.269] lstrlenW (lpString=".bz2") returned 4 [0111.269] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0111.269] lstrlenW (lpString=".7z") returned 3 [0111.269] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0111.269] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg") returned 74 [0111.269] lstrlenW (lpString=".dbf") returned 4 [0111.269] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0111.269] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg") returned 74 [0111.269] lstrlenW (lpString=".1cd") returned 4 [0111.269] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0111.269] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg") returned 74 [0111.269] lstrlenW (lpString=".jpg") returned 4 [0111.269] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0111.269] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg") returned 74 [0111.269] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg") returned 74 [0111.269] lstrlenW (lpString=".doc") returned 4 [0111.269] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0111.269] lstrlenW (lpString=".docx") returned 5 [0111.269] lstrcmpiW (lpString1=".docx", lpString2="s.jpg") returned -1 [0111.269] lstrlenW (lpString=".pdf") returned 4 [0111.269] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0111.269] lstrlenW (lpString=".xls") returned 4 [0111.269] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0111.269] lstrlenW (lpString=".xlsx") returned 5 [0111.269] lstrcmpiW (lpString1=".xlsx", lpString2="s.jpg") returned -1 [0111.269] lstrlenW (lpString=".ppt") returned 4 [0111.269] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0111.269] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg") returned 74 [0111.269] lstrlenW (lpString=".zip") returned 4 [0111.269] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0111.269] lstrlenW (lpString=".rar") returned 4 [0111.269] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0111.269] lstrlenW (lpString=".bz2") returned 4 [0111.269] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0111.269] lstrlenW (lpString=".7z") returned 3 [0111.269] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0111.269] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg") returned 74 [0111.269] lstrlenW (lpString=".dbf") returned 4 [0111.269] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0111.269] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg") returned 74 [0111.269] lstrlenW (lpString=".1cd") returned 4 [0111.269] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0111.269] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg") returned 74 [0111.269] lstrlenW (lpString=".jpg") returned 4 [0111.269] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0111.270] lstrcmpiW (lpString1=".wmf", lpString2=".waifu") returned 1 [0111.270] lstrlenW (lpString="grid_(cm).wmf") returned 13 [0111.270] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\grid_(cm).wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0111.270] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x37cfddc | out: lpFileSize=0x37cfddc*=2920) returned 1 [0111.270] CloseHandle (hObject=0x168) returned 1 [0111.270] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\grid_(cm).wmf")) returned 0x20 [0111.270] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\grid_(cm).wmf.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0111.270] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\grid_(cm).wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0111.270] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf") returned 71 [0111.270] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf") returned 71 [0111.270] lstrlenW (lpString=".doc") returned 4 [0111.270] lstrcmpiW (lpString1=".doc", lpString2=".wmf") returned -1 [0111.270] lstrlenW (lpString=".docx") returned 5 [0111.270] lstrcmpiW (lpString1=".docx", lpString2=").wmf") returned 1 [0111.270] lstrlenW (lpString=".pdf") returned 4 [0111.270] lstrcmpiW (lpString1=".pdf", lpString2=".wmf") returned -1 [0111.270] lstrlenW (lpString=".xls") returned 4 [0111.270] lstrcmpiW (lpString1=".xls", lpString2=".wmf") returned 1 [0111.270] lstrlenW (lpString=".xlsx") returned 5 [0111.270] lstrcmpiW (lpString1=".xlsx", lpString2=").wmf") returned 1 [0111.270] lstrlenW (lpString=".ppt") returned 4 [0111.270] lstrcmpiW (lpString1=".ppt", lpString2=".wmf") returned -1 [0111.270] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf") returned 71 [0111.270] lstrlenW (lpString=".zip") returned 4 [0111.270] lstrcmpiW (lpString1=".zip", lpString2=".wmf") returned 1 [0111.270] lstrlenW (lpString=".rar") returned 4 [0111.270] lstrcmpiW (lpString1=".rar", lpString2=".wmf") returned -1 [0111.270] lstrlenW (lpString=".bz2") returned 4 [0111.270] lstrcmpiW (lpString1=".bz2", lpString2=".wmf") returned -1 [0111.270] lstrlenW (lpString=".7z") returned 3 [0111.270] lstrcmpiW (lpString1=".7z", lpString2="wmf") returned -1 [0111.271] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf") returned 71 [0111.271] lstrlenW (lpString=".dbf") returned 4 [0111.271] lstrcmpiW (lpString1=".dbf", lpString2=".wmf") returned -1 [0111.271] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf") returned 71 [0111.271] lstrlenW (lpString=".1cd") returned 4 [0111.271] lstrcmpiW (lpString1=".1cd", lpString2=".wmf") returned -1 [0111.271] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf") returned 71 [0111.271] lstrlenW (lpString=".jpg") returned 4 [0111.271] lstrcmpiW (lpString1=".jpg", lpString2=".wmf") returned -1 [0111.271] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf") returned 71 [0111.271] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf") returned 71 [0111.271] lstrlenW (lpString=".doc") returned 4 [0111.271] lstrcmpiW (lpString1=".doc", lpString2=".wmf") returned -1 [0111.271] lstrlenW (lpString=".docx") returned 5 [0111.271] lstrcmpiW (lpString1=".docx", lpString2=").wmf") returned 1 [0111.271] lstrlenW (lpString=".pdf") returned 4 [0111.271] lstrcmpiW (lpString1=".pdf", lpString2=".wmf") returned -1 [0111.271] lstrlenW (lpString=".xls") returned 4 [0111.271] lstrcmpiW (lpString1=".xls", lpString2=".wmf") returned 1 [0111.271] lstrlenW (lpString=".xlsx") returned 5 [0111.271] lstrcmpiW (lpString1=".xlsx", lpString2=").wmf") returned 1 [0111.271] lstrlenW (lpString=".ppt") returned 4 [0111.271] lstrcmpiW (lpString1=".ppt", lpString2=".wmf") returned -1 [0111.271] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf") returned 71 [0111.271] lstrlenW (lpString=".zip") returned 4 [0111.271] lstrcmpiW (lpString1=".zip", lpString2=".wmf") returned 1 [0111.271] lstrlenW (lpString=".rar") returned 4 [0111.271] lstrcmpiW (lpString1=".rar", lpString2=".wmf") returned -1 [0111.271] lstrlenW (lpString=".bz2") returned 4 [0111.271] lstrcmpiW (lpString1=".bz2", lpString2=".wmf") returned -1 [0111.271] lstrlenW (lpString=".7z") returned 3 [0111.271] lstrcmpiW (lpString1=".7z", lpString2="wmf") returned -1 [0111.271] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf") returned 71 [0111.271] lstrlenW (lpString=".dbf") returned 4 [0111.271] lstrcmpiW (lpString1=".dbf", lpString2=".wmf") returned -1 [0111.271] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf") returned 71 [0111.271] lstrlenW (lpString=".1cd") returned 4 [0111.271] lstrcmpiW (lpString1=".1cd", lpString2=".wmf") returned -1 [0111.271] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf") returned 71 [0111.271] lstrlenW (lpString=".jpg") returned 4 [0111.271] lstrcmpiW (lpString1=".jpg", lpString2=".wmf") returned -1 [0111.271] lstrcmpiW (lpString1=".wmf", lpString2=".waifu") returned 1 [0111.271] lstrlenW (lpString="grid_(inch).wmf") returned 15 [0111.271] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\grid_(inch).wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0111.272] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x37cfddc | out: lpFileSize=0x37cfddc*=7498) returned 1 [0111.272] CloseHandle (hObject=0x168) returned 1 [0111.272] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\grid_(inch).wmf")) returned 0x20 [0111.272] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\grid_(inch).wmf.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0111.272] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\grid_(inch).wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0111.272] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf") returned 73 [0111.272] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf") returned 73 [0111.272] lstrlenW (lpString=".doc") returned 4 [0111.272] lstrcmpiW (lpString1=".doc", lpString2=".wmf") returned -1 [0111.272] lstrlenW (lpString=".docx") returned 5 [0111.272] lstrcmpiW (lpString1=".docx", lpString2=").wmf") returned 1 [0111.272] lstrlenW (lpString=".pdf") returned 4 [0111.272] lstrcmpiW (lpString1=".pdf", lpString2=".wmf") returned -1 [0111.272] lstrlenW (lpString=".xls") returned 4 [0111.272] lstrcmpiW (lpString1=".xls", lpString2=".wmf") returned 1 [0111.272] lstrlenW (lpString=".xlsx") returned 5 [0111.272] lstrcmpiW (lpString1=".xlsx", lpString2=").wmf") returned 1 [0111.272] lstrlenW (lpString=".ppt") returned 4 [0111.272] lstrcmpiW (lpString1=".ppt", lpString2=".wmf") returned -1 [0111.272] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf") returned 73 [0111.272] lstrlenW (lpString=".zip") returned 4 [0111.272] lstrcmpiW (lpString1=".zip", lpString2=".wmf") returned 1 [0111.272] lstrlenW (lpString=".rar") returned 4 [0111.272] lstrcmpiW (lpString1=".rar", lpString2=".wmf") returned -1 [0111.272] lstrlenW (lpString=".bz2") returned 4 [0111.272] lstrcmpiW (lpString1=".bz2", lpString2=".wmf") returned -1 [0111.272] lstrlenW (lpString=".7z") returned 3 [0111.272] lstrcmpiW (lpString1=".7z", lpString2="wmf") returned -1 [0111.272] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf") returned 73 [0111.272] lstrlenW (lpString=".dbf") returned 4 [0111.272] lstrcmpiW (lpString1=".dbf", lpString2=".wmf") returned -1 [0111.272] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf") returned 73 [0111.272] lstrlenW (lpString=".1cd") returned 4 [0111.273] lstrcmpiW (lpString1=".1cd", lpString2=".wmf") returned -1 [0111.273] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf") returned 73 [0111.273] lstrlenW (lpString=".jpg") returned 4 [0111.273] lstrcmpiW (lpString1=".jpg", lpString2=".wmf") returned -1 [0111.273] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf") returned 73 [0111.273] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf") returned 73 [0111.273] lstrlenW (lpString=".doc") returned 4 [0111.273] lstrcmpiW (lpString1=".doc", lpString2=".wmf") returned -1 [0111.273] lstrlenW (lpString=".docx") returned 5 [0111.273] lstrcmpiW (lpString1=".docx", lpString2=").wmf") returned 1 [0111.273] lstrlenW (lpString=".pdf") returned 4 [0111.273] lstrcmpiW (lpString1=".pdf", lpString2=".wmf") returned -1 [0111.273] lstrlenW (lpString=".xls") returned 4 [0111.273] lstrcmpiW (lpString1=".xls", lpString2=".wmf") returned 1 [0111.273] lstrlenW (lpString=".xlsx") returned 5 [0111.273] lstrcmpiW (lpString1=".xlsx", lpString2=").wmf") returned 1 [0111.273] lstrlenW (lpString=".ppt") returned 4 [0111.273] lstrcmpiW (lpString1=".ppt", lpString2=".wmf") returned -1 [0111.273] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf") returned 73 [0111.273] lstrlenW (lpString=".zip") returned 4 [0111.273] lstrcmpiW (lpString1=".zip", lpString2=".wmf") returned 1 [0111.273] lstrlenW (lpString=".rar") returned 4 [0111.273] lstrcmpiW (lpString1=".rar", lpString2=".wmf") returned -1 [0111.273] lstrlenW (lpString=".bz2") returned 4 [0111.273] lstrcmpiW (lpString1=".bz2", lpString2=".wmf") returned -1 [0111.273] lstrlenW (lpString=".7z") returned 3 [0111.273] lstrcmpiW (lpString1=".7z", lpString2="wmf") returned -1 [0111.273] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf") returned 73 [0111.273] lstrlenW (lpString=".dbf") returned 4 [0111.273] lstrcmpiW (lpString1=".dbf", lpString2=".wmf") returned -1 [0111.273] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf") returned 73 [0111.273] lstrlenW (lpString=".1cd") returned 4 [0111.273] lstrcmpiW (lpString1=".1cd", lpString2=".wmf") returned -1 [0111.273] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf") returned 73 [0111.273] lstrlenW (lpString=".jpg") returned 4 [0111.273] lstrcmpiW (lpString1=".jpg", lpString2=".wmf") returned -1 [0111.273] lstrcmpiW (lpString1=".htm", lpString2=".waifu") returned -1 [0111.273] lstrlenW (lpString="Hand Prints.htm") returned 15 [0111.273] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\hand prints.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0111.274] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x37cfddc | out: lpFileSize=0x37cfddc*=235) returned 1 [0111.274] CloseHandle (hObject=0x168) returned 1 [0111.274] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\hand prints.htm")) returned 0x20 [0111.274] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\hand prints.htm.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0111.274] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\hand prints.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0111.274] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm") returned 73 [0111.274] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm") returned 73 [0111.274] lstrlenW (lpString=".doc") returned 4 [0111.274] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0111.274] lstrlenW (lpString=".docx") returned 5 [0111.274] lstrcmpiW (lpString1=".docx", lpString2="s.htm") returned -1 [0111.274] lstrlenW (lpString=".pdf") returned 4 [0111.274] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0111.275] lstrlenW (lpString=".xls") returned 4 [0111.275] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0111.275] lstrlenW (lpString=".xlsx") returned 5 [0111.275] lstrcmpiW (lpString1=".xlsx", lpString2="s.htm") returned -1 [0111.275] lstrlenW (lpString=".ppt") returned 4 [0111.275] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0111.275] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm") returned 73 [0111.275] lstrlenW (lpString=".zip") returned 4 [0111.275] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0111.275] lstrlenW (lpString=".rar") returned 4 [0111.275] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0111.275] lstrlenW (lpString=".bz2") returned 4 [0111.275] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0111.275] lstrlenW (lpString=".7z") returned 3 [0111.275] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0111.275] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm") returned 73 [0111.275] lstrlenW (lpString=".dbf") returned 4 [0111.275] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0111.292] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0111.292] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0111.292] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\preview.gif.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0111.293] GetLastError () returned 0x0 [0111.293] ReadFile (in: hFile=0x168, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x621, lpOverlapped=0x0) returned 1 [0111.294] WriteFile (in: hFile=0x194, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0x630, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0x630, lpOverlapped=0x0) returned 1 [0111.295] ReadFile (in: hFile=0x168, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x0, lpOverlapped=0x0) returned 1 [0111.295] WriteFile (in: hFile=0x194, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0xea, lpOverlapped=0x0) returned 1 [0111.295] SetEndOfFile (hFile=0x194) returned 1 [0111.295] CloseHandle (hObject=0x194) returned 1 [0111.295] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0111.295] SetEndOfFile (hFile=0x168) returned 1 [0111.296] CloseHandle (hObject=0x168) returned 1 [0111.296] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0111.297] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\preview.gif")) returned 1 [0111.297] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76 [0111.297] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76 [0111.297] lstrlenW (lpString=".doc") returned 4 [0111.297] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0111.297] lstrlenW (lpString=".docx") returned 5 [0111.297] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0111.297] lstrlenW (lpString=".pdf") returned 4 [0111.297] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0111.297] lstrlenW (lpString=".xls") returned 4 [0111.297] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0111.297] lstrlenW (lpString=".xlsx") returned 5 [0111.297] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0111.297] lstrlenW (lpString=".ppt") returned 4 [0111.297] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0111.297] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76 [0111.297] lstrlenW (lpString=".zip") returned 4 [0111.297] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0111.297] lstrlenW (lpString=".rar") returned 4 [0111.297] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0111.297] lstrlenW (lpString=".bz2") returned 4 [0111.297] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0111.297] lstrlenW (lpString=".7z") returned 3 [0111.297] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0111.297] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76 [0111.297] lstrlenW (lpString=".dbf") returned 4 [0111.297] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0111.297] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76 [0111.297] lstrlenW (lpString=".1cd") returned 4 [0111.297] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0111.297] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76 [0111.297] lstrlenW (lpString=".jpg") returned 4 [0111.297] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0111.297] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76 [0111.297] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76 [0111.297] lstrlenW (lpString=".doc") returned 4 [0111.297] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0111.297] lstrlenW (lpString=".docx") returned 5 [0111.297] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0111.297] lstrlenW (lpString=".pdf") returned 4 [0111.298] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0111.298] lstrlenW (lpString=".xls") returned 4 [0111.298] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0111.298] lstrlenW (lpString=".xlsx") returned 5 [0111.298] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0111.298] lstrlenW (lpString=".ppt") returned 4 [0111.298] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0111.298] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76 [0111.298] lstrlenW (lpString=".zip") returned 4 [0111.298] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0111.298] lstrlenW (lpString=".rar") returned 4 [0111.298] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0111.298] lstrlenW (lpString=".bz2") returned 4 [0111.298] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0111.298] lstrlenW (lpString=".7z") returned 3 [0111.298] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0111.298] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76 [0111.298] lstrlenW (lpString=".dbf") returned 4 [0111.298] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0111.298] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76 [0111.298] lstrlenW (lpString=".1cd") returned 4 [0111.298] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0111.298] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76 [0111.298] lstrlenW (lpString=".jpg") returned 4 [0111.298] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0111.298] lstrcmpiW (lpString1=".PNG", lpString2=".waifu") returned -1 [0111.298] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0111.298] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0111.299] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x37cfddc | out: lpFileSize=0x37cfddc*=25234) returned 1 [0111.299] CloseHandle (hObject=0x168) returned 1 [0111.299] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\thmbnail.png")) returned 0x20 [0111.299] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\thmbnail.png.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0111.299] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0111.299] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0111.299] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0111.299] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\thmbnail.png.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0111.299] GetLastError () returned 0x0 [0111.299] ReadFile (in: hFile=0x168, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x6292, lpOverlapped=0x0) returned 1 [0111.554] WriteFile (in: hFile=0x194, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0x62a0, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0x62a0, lpOverlapped=0x0) returned 1 [0111.555] ReadFile (in: hFile=0x168, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x0, lpOverlapped=0x0) returned 1 [0111.555] WriteFile (in: hFile=0x194, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0xec, lpOverlapped=0x0) returned 1 [0111.555] SetEndOfFile (hFile=0x194) returned 1 [0111.556] CloseHandle (hObject=0x194) returned 1 [0111.556] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0111.556] SetEndOfFile (hFile=0x168) returned 1 [0111.556] CloseHandle (hObject=0x168) returned 1 [0111.557] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0111.557] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\thmbnail.png")) returned 1 [0111.557] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77 [0111.557] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77 [0111.557] lstrlenW (lpString=".doc") returned 4 [0111.557] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0111.557] lstrlenW (lpString=".docx") returned 5 [0111.557] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0111.557] lstrlenW (lpString=".pdf") returned 4 [0111.557] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0111.557] lstrlenW (lpString=".xls") returned 4 [0111.557] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0111.557] lstrlenW (lpString=".xlsx") returned 5 [0111.557] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0111.557] lstrlenW (lpString=".ppt") returned 4 [0111.557] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0111.557] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77 [0111.557] lstrlenW (lpString=".zip") returned 4 [0111.557] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0111.557] lstrlenW (lpString=".rar") returned 4 [0111.557] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0111.557] lstrlenW (lpString=".bz2") returned 4 [0111.557] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0111.557] lstrlenW (lpString=".7z") returned 3 [0111.557] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0111.557] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77 [0111.557] lstrlenW (lpString=".dbf") returned 4 [0111.557] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0111.557] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77 [0111.557] lstrlenW (lpString=".1cd") returned 4 [0111.557] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0111.558] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77 [0111.558] lstrlenW (lpString=".jpg") returned 4 [0111.558] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0111.558] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77 [0111.558] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77 [0111.558] lstrlenW (lpString=".doc") returned 4 [0111.558] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0111.558] lstrlenW (lpString=".docx") returned 5 [0111.558] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0111.558] lstrlenW (lpString=".pdf") returned 4 [0111.558] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0111.558] lstrlenW (lpString=".xls") returned 4 [0111.558] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0111.558] lstrlenW (lpString=".xlsx") returned 5 [0111.558] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0111.558] lstrlenW (lpString=".ppt") returned 4 [0111.558] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0111.558] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77 [0111.558] lstrlenW (lpString=".zip") returned 4 [0111.558] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0111.558] lstrlenW (lpString=".rar") returned 4 [0111.558] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0111.558] lstrlenW (lpString=".bz2") returned 4 [0111.558] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0111.558] lstrlenW (lpString=".7z") returned 3 [0111.558] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0111.558] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77 [0111.558] lstrlenW (lpString=".dbf") returned 4 [0111.558] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0111.558] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77 [0111.558] lstrlenW (lpString=".1cd") returned 4 [0111.558] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0111.558] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77 [0111.558] lstrlenW (lpString=".jpg") returned 4 [0111.558] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0111.558] lstrcmpiW (lpString1=".PNG", lpString2=".waifu") returned -1 [0111.558] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0111.558] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0111.747] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x37cfddc | out: lpFileSize=0x37cfddc*=34916) returned 1 [0111.752] CloseHandle (hObject=0x180) returned 1 [0111.757] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\thmbnail.png")) returned 0x20 [0111.759] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\thmbnail.png.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0111.759] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0111.759] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0111.759] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0111.759] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\thmbnail.png.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0111.759] GetLastError () returned 0x0 [0111.759] ReadFile (in: hFile=0x180, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x8864, lpOverlapped=0x0) returned 1 [0111.761] WriteFile (in: hFile=0x1ec, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0x8870, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0x8870, lpOverlapped=0x0) returned 1 [0111.763] ReadFile (in: hFile=0x180, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x0, lpOverlapped=0x0) returned 1 [0111.763] WriteFile (in: hFile=0x1ec, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0xec, lpOverlapped=0x0) returned 1 [0111.763] SetEndOfFile (hFile=0x1ec) returned 1 [0111.763] CloseHandle (hObject=0x1ec) returned 1 [0111.763] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0111.763] SetEndOfFile (hFile=0x180) returned 1 [0111.764] CloseHandle (hObject=0x180) returned 1 [0111.764] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0111.764] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\thmbnail.png")) returned 1 [0111.764] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73 [0111.764] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73 [0111.764] lstrlenW (lpString=".doc") returned 4 [0111.764] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0111.764] lstrlenW (lpString=".docx") returned 5 [0111.764] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0111.764] lstrlenW (lpString=".pdf") returned 4 [0111.764] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0111.764] lstrlenW (lpString=".xls") returned 4 [0111.764] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0111.764] lstrlenW (lpString=".xlsx") returned 5 [0111.764] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0111.764] lstrlenW (lpString=".ppt") returned 4 [0111.764] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0111.765] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73 [0111.765] lstrlenW (lpString=".zip") returned 4 [0111.765] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0111.765] lstrlenW (lpString=".rar") returned 4 [0111.765] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0111.765] lstrlenW (lpString=".bz2") returned 4 [0111.765] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0111.765] lstrlenW (lpString=".7z") returned 3 [0111.765] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0111.765] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73 [0111.765] lstrlenW (lpString=".dbf") returned 4 [0111.765] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0111.765] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73 [0111.765] lstrlenW (lpString=".1cd") returned 4 [0111.765] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0111.765] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73 [0111.765] lstrlenW (lpString=".jpg") returned 4 [0111.765] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0111.765] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73 [0111.765] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73 [0111.765] lstrlenW (lpString=".doc") returned 4 [0111.765] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0111.765] lstrlenW (lpString=".docx") returned 5 [0111.765] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0111.765] lstrlenW (lpString=".pdf") returned 4 [0111.765] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0111.765] lstrlenW (lpString=".xls") returned 4 [0111.765] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0111.765] lstrlenW (lpString=".xlsx") returned 5 [0111.765] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0111.765] lstrlenW (lpString=".ppt") returned 4 [0111.765] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0111.765] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73 [0111.765] lstrlenW (lpString=".zip") returned 4 [0111.765] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0111.765] lstrlenW (lpString=".rar") returned 4 [0111.765] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0111.765] lstrlenW (lpString=".bz2") returned 4 [0111.765] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0111.765] lstrlenW (lpString=".7z") returned 3 [0111.765] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0111.765] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73 [0111.765] lstrlenW (lpString=".dbf") returned 4 [0111.765] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0111.765] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73 [0111.765] lstrlenW (lpString=".1cd") returned 4 [0111.765] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0111.765] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73 [0111.765] lstrlenW (lpString=".jpg") returned 4 [0111.765] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0111.766] lstrcmpiW (lpString1=".PNG", lpString2=".waifu") returned -1 [0111.766] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0111.766] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0111.767] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x37cfddc | out: lpFileSize=0x37cfddc*=27407) returned 1 [0111.767] CloseHandle (hObject=0x180) returned 1 [0111.767] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\thmbnail.png")) returned 0x20 [0111.767] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\thmbnail.png.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0111.767] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0111.767] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0111.767] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0111.767] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\thmbnail.png.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0111.768] GetLastError () returned 0x0 [0111.768] ReadFile (in: hFile=0x180, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x6b0f, lpOverlapped=0x0) returned 1 [0111.770] WriteFile (in: hFile=0x1ec, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0x6b10, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0x6b10, lpOverlapped=0x0) returned 1 [0111.771] ReadFile (in: hFile=0x180, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x0, lpOverlapped=0x0) returned 1 [0111.771] WriteFile (in: hFile=0x1ec, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0xec, lpOverlapped=0x0) returned 1 [0111.771] SetEndOfFile (hFile=0x1ec) returned 1 [0111.771] CloseHandle (hObject=0x1ec) returned 1 [0111.771] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0111.771] SetEndOfFile (hFile=0x180) returned 1 [0111.772] CloseHandle (hObject=0x180) returned 1 [0111.772] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0111.772] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\thmbnail.png")) returned 1 [0111.772] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77 [0111.772] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77 [0111.772] lstrlenW (lpString=".doc") returned 4 [0111.772] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0111.772] lstrlenW (lpString=".docx") returned 5 [0111.772] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0111.772] lstrlenW (lpString=".pdf") returned 4 [0111.772] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0111.772] lstrlenW (lpString=".xls") returned 4 [0111.772] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0111.772] lstrlenW (lpString=".xlsx") returned 5 [0111.772] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0111.772] lstrlenW (lpString=".ppt") returned 4 [0111.772] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0111.772] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77 [0111.772] lstrlenW (lpString=".zip") returned 4 [0111.772] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0111.773] lstrlenW (lpString=".rar") returned 4 [0111.773] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0111.773] lstrlenW (lpString=".bz2") returned 4 [0111.773] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0111.773] lstrlenW (lpString=".7z") returned 3 [0111.773] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0111.773] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77 [0111.773] lstrlenW (lpString=".dbf") returned 4 [0111.773] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0111.773] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77 [0111.773] lstrlenW (lpString=".1cd") returned 4 [0111.773] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0111.773] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77 [0111.773] lstrlenW (lpString=".jpg") returned 4 [0111.773] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0111.773] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77 [0111.773] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77 [0111.773] lstrlenW (lpString=".doc") returned 4 [0111.773] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0111.773] lstrlenW (lpString=".docx") returned 5 [0111.773] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0111.773] lstrlenW (lpString=".pdf") returned 4 [0111.773] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0111.773] lstrlenW (lpString=".xls") returned 4 [0111.773] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0111.773] lstrlenW (lpString=".xlsx") returned 5 [0111.773] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0111.773] lstrlenW (lpString=".ppt") returned 4 [0111.773] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0111.773] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77 [0111.773] lstrlenW (lpString=".zip") returned 4 [0111.773] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0111.773] lstrlenW (lpString=".rar") returned 4 [0111.773] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0111.773] lstrlenW (lpString=".bz2") returned 4 [0111.773] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0111.773] lstrlenW (lpString=".7z") returned 3 [0111.773] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0111.773] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77 [0111.773] lstrlenW (lpString=".dbf") returned 4 [0111.773] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0111.773] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77 [0111.773] lstrlenW (lpString=".1cd") returned 4 [0111.773] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0111.773] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77 [0111.773] lstrlenW (lpString=".jpg") returned 4 [0111.773] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0111.774] lstrcmpiW (lpString1=".GIF", lpString2=".waifu") returned -1 [0111.774] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0111.774] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0111.774] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x37cfddc | out: lpFileSize=0x37cfddc*=3479) returned 1 [0111.774] CloseHandle (hObject=0x180) returned 1 [0111.774] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\preview.gif")) returned 0x20 [0111.774] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\preview.gif.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0111.774] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0111.774] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0111.774] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0111.774] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\preview.gif.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0111.776] GetLastError () returned 0x0 [0111.776] ReadFile (in: hFile=0x180, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0xd97, lpOverlapped=0x0) returned 1 [0111.779] WriteFile (in: hFile=0x1f0, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0xda0, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0xda0, lpOverlapped=0x0) returned 1 [0111.779] ReadFile (in: hFile=0x180, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x0, lpOverlapped=0x0) returned 1 [0111.779] WriteFile (in: hFile=0x1f0, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0xea, lpOverlapped=0x0) returned 1 [0111.780] SetEndOfFile (hFile=0x1f0) returned 1 [0111.780] CloseHandle (hObject=0x1f0) returned 1 [0111.780] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0111.780] SetEndOfFile (hFile=0x180) returned 1 [0111.780] CloseHandle (hObject=0x180) returned 1 [0111.780] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0111.781] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\preview.gif")) returned 1 [0111.781] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76 [0111.781] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76 [0111.781] lstrlenW (lpString=".doc") returned 4 [0111.781] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0111.781] lstrlenW (lpString=".docx") returned 5 [0111.781] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0111.781] lstrlenW (lpString=".pdf") returned 4 [0111.781] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0111.781] lstrlenW (lpString=".xls") returned 4 [0111.781] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0111.781] lstrlenW (lpString=".xlsx") returned 5 [0111.781] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0111.781] lstrlenW (lpString=".ppt") returned 4 [0111.781] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0111.781] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76 [0111.781] lstrlenW (lpString=".zip") returned 4 [0111.781] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0111.781] lstrlenW (lpString=".rar") returned 4 [0111.781] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0111.781] lstrlenW (lpString=".bz2") returned 4 [0111.781] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0111.781] lstrlenW (lpString=".7z") returned 3 [0111.781] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0111.781] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76 [0111.781] lstrlenW (lpString=".dbf") returned 4 [0111.781] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0111.781] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76 [0111.781] lstrlenW (lpString=".1cd") returned 4 [0111.781] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0111.781] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76 [0111.781] lstrlenW (lpString=".jpg") returned 4 [0111.781] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0111.781] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76 [0111.781] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76 [0111.782] lstrlenW (lpString=".doc") returned 4 [0111.782] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0111.782] lstrlenW (lpString=".docx") returned 5 [0111.782] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0111.782] lstrlenW (lpString=".pdf") returned 4 [0111.782] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0111.782] lstrlenW (lpString=".xls") returned 4 [0111.782] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0111.782] lstrlenW (lpString=".xlsx") returned 5 [0111.782] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0111.782] lstrlenW (lpString=".ppt") returned 4 [0111.782] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0111.782] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76 [0111.782] lstrlenW (lpString=".zip") returned 4 [0111.782] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0111.782] lstrlenW (lpString=".rar") returned 4 [0111.782] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0111.782] lstrlenW (lpString=".bz2") returned 4 [0111.782] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0111.782] lstrlenW (lpString=".7z") returned 3 [0111.782] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0111.782] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76 [0111.782] lstrlenW (lpString=".dbf") returned 4 [0111.782] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0111.782] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76 [0111.782] lstrlenW (lpString=".1cd") returned 4 [0111.782] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0111.782] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76 [0111.782] lstrlenW (lpString=".jpg") returned 4 [0111.782] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0111.782] lstrcmpiW (lpString1=".PNG", lpString2=".waifu") returned -1 [0111.782] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0111.782] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0111.783] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x37cfddc | out: lpFileSize=0x37cfddc*=31837) returned 1 [0111.783] CloseHandle (hObject=0x180) returned 1 [0111.783] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\thmbnail.png")) returned 0x20 [0111.783] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\thmbnail.png.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0111.783] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0111.783] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0111.783] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0111.783] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\thmbnail.png.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0111.783] GetLastError () returned 0x0 [0111.783] ReadFile (in: hFile=0x180, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x7c5d, lpOverlapped=0x0) returned 1 [0111.789] WriteFile (in: hFile=0x1f0, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0x7c60, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0x7c60, lpOverlapped=0x0) returned 1 [0111.790] ReadFile (in: hFile=0x180, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x0, lpOverlapped=0x0) returned 1 [0111.790] WriteFile (in: hFile=0x1f0, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0xec, lpOverlapped=0x0) returned 1 [0111.790] SetEndOfFile (hFile=0x1f0) returned 1 [0111.790] CloseHandle (hObject=0x1f0) returned 1 [0111.790] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0111.791] SetEndOfFile (hFile=0x180) returned 1 [0111.793] CloseHandle (hObject=0x180) returned 1 [0111.793] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0111.793] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\thmbnail.png")) returned 1 [0111.794] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77 [0111.794] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77 [0111.794] lstrlenW (lpString=".doc") returned 4 [0111.794] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0111.794] lstrlenW (lpString=".docx") returned 5 [0111.794] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0111.794] lstrlenW (lpString=".pdf") returned 4 [0111.794] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0111.794] lstrlenW (lpString=".xls") returned 4 [0111.794] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0111.794] lstrlenW (lpString=".xlsx") returned 5 [0111.794] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0111.794] lstrlenW (lpString=".ppt") returned 4 [0111.794] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0111.794] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77 [0111.794] lstrlenW (lpString=".zip") returned 4 [0111.794] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0111.794] lstrlenW (lpString=".rar") returned 4 [0111.794] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0111.794] lstrlenW (lpString=".bz2") returned 4 [0111.794] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0111.794] lstrlenW (lpString=".7z") returned 3 [0111.794] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0111.794] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77 [0111.794] lstrlenW (lpString=".dbf") returned 4 [0111.794] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0111.794] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77 [0111.794] lstrlenW (lpString=".1cd") returned 4 [0111.794] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0111.794] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77 [0111.794] lstrlenW (lpString=".jpg") returned 4 [0111.794] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0111.794] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77 [0111.794] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77 [0111.794] lstrlenW (lpString=".doc") returned 4 [0111.794] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0111.794] lstrlenW (lpString=".docx") returned 5 [0111.794] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0111.794] lstrlenW (lpString=".pdf") returned 4 [0111.794] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0111.794] lstrlenW (lpString=".xls") returned 4 [0111.794] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0111.794] lstrlenW (lpString=".xlsx") returned 5 [0111.794] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0111.794] lstrlenW (lpString=".ppt") returned 4 [0111.795] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0111.795] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77 [0111.795] lstrlenW (lpString=".zip") returned 4 [0111.795] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0111.795] lstrlenW (lpString=".rar") returned 4 [0111.795] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0111.795] lstrlenW (lpString=".bz2") returned 4 [0111.795] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0111.795] lstrlenW (lpString=".7z") returned 3 [0111.795] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0111.795] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77 [0111.795] lstrlenW (lpString=".dbf") returned 4 [0111.795] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0111.795] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77 [0111.795] lstrlenW (lpString=".1cd") returned 4 [0111.795] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0111.795] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77 [0111.795] lstrlenW (lpString=".jpg") returned 4 [0111.795] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0111.795] lstrcmpiW (lpString1=".PNG", lpString2=".waifu") returned -1 [0111.795] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0111.795] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0111.822] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x37cfddc | out: lpFileSize=0x37cfddc*=43276) returned 1 [0111.822] CloseHandle (hObject=0x1f0) returned 1 [0111.823] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\thmbnail.png")) returned 0x20 [0111.823] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\thmbnail.png.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0111.823] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0111.823] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0111.823] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0111.823] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\thmbnail.png.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0111.823] GetLastError () returned 0x0 [0111.823] ReadFile (in: hFile=0x1f0, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0xa90c, lpOverlapped=0x0) returned 1 [0111.825] WriteFile (in: hFile=0x1f4, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0xa910, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0xa910, lpOverlapped=0x0) returned 1 [0111.826] ReadFile (in: hFile=0x1f0, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x0, lpOverlapped=0x0) returned 1 [0111.826] WriteFile (in: hFile=0x1f4, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0xec, lpOverlapped=0x0) returned 1 [0111.826] SetEndOfFile (hFile=0x1f4) returned 1 [0111.826] CloseHandle (hObject=0x1f4) returned 1 [0111.826] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0111.826] SetEndOfFile (hFile=0x1f0) returned 1 [0111.993] CloseHandle (hObject=0x1f0) returned 1 [0111.994] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0111.994] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\thmbnail.png")) returned 1 [0111.994] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75 [0111.994] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75 [0111.994] lstrlenW (lpString=".doc") returned 4 [0111.994] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0111.994] lstrlenW (lpString=".docx") returned 5 [0111.994] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0111.994] lstrlenW (lpString=".pdf") returned 4 [0111.994] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0111.994] lstrlenW (lpString=".xls") returned 4 [0111.994] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0111.994] lstrlenW (lpString=".xlsx") returned 5 [0111.994] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0111.994] lstrlenW (lpString=".ppt") returned 4 [0111.994] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0111.995] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75 [0111.995] lstrlenW (lpString=".zip") returned 4 [0111.995] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0111.995] lstrlenW (lpString=".rar") returned 4 [0111.995] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0111.995] lstrlenW (lpString=".bz2") returned 4 [0111.995] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0111.995] lstrlenW (lpString=".7z") returned 3 [0111.995] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0111.995] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75 [0111.995] lstrlenW (lpString=".dbf") returned 4 [0111.995] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0111.995] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75 [0111.995] lstrlenW (lpString=".1cd") returned 4 [0111.995] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0111.995] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75 [0111.995] lstrlenW (lpString=".jpg") returned 4 [0111.995] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0111.995] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75 [0111.995] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75 [0111.995] lstrlenW (lpString=".doc") returned 4 [0111.995] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0111.995] lstrlenW (lpString=".docx") returned 5 [0111.995] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0111.995] lstrlenW (lpString=".pdf") returned 4 [0111.995] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0111.995] lstrlenW (lpString=".xls") returned 4 [0111.995] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0111.995] lstrlenW (lpString=".xlsx") returned 5 [0111.995] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0111.995] lstrlenW (lpString=".ppt") returned 4 [0111.995] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0111.995] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75 [0111.995] lstrlenW (lpString=".zip") returned 4 [0111.995] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0111.995] lstrlenW (lpString=".rar") returned 4 [0111.995] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0111.995] lstrlenW (lpString=".bz2") returned 4 [0111.995] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0111.995] lstrlenW (lpString=".7z") returned 3 [0111.995] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0111.995] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75 [0111.995] lstrlenW (lpString=".dbf") returned 4 [0111.995] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0111.995] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75 [0111.995] lstrlenW (lpString=".1cd") returned 4 [0111.995] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0111.995] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75 [0111.995] lstrlenW (lpString=".jpg") returned 4 [0111.995] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0111.996] lstrcmpiW (lpString1=".GIF", lpString2=".waifu") returned -1 [0111.996] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0111.996] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0111.996] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x37cfddc | out: lpFileSize=0x37cfddc*=1363) returned 1 [0111.996] CloseHandle (hObject=0x1f0) returned 1 [0111.996] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\preview.gif")) returned 0x20 [0111.996] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\preview.gif.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0111.996] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0111.996] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0111.996] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0111.996] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\preview.gif.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0112.314] GetLastError () returned 0x0 [0112.314] ReadFile (in: hFile=0x1f0, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x553, lpOverlapped=0x0) returned 1 [0112.441] WriteFile (in: hFile=0x204, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0x560, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0x560, lpOverlapped=0x0) returned 1 [0112.442] ReadFile (in: hFile=0x1f0, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x0, lpOverlapped=0x0) returned 1 [0112.442] WriteFile (in: hFile=0x204, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0xea, lpOverlapped=0x0) returned 1 [0112.442] SetEndOfFile (hFile=0x204) returned 1 [0112.442] CloseHandle (hObject=0x204) returned 1 [0112.442] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0112.442] SetEndOfFile (hFile=0x1f0) returned 1 [0112.443] CloseHandle (hObject=0x1f0) returned 1 [0112.443] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0112.443] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\preview.gif")) returned 1 [0112.443] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75 [0112.443] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75 [0112.443] lstrlenW (lpString=".doc") returned 4 [0112.443] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0112.443] lstrlenW (lpString=".docx") returned 5 [0112.443] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0112.443] lstrlenW (lpString=".pdf") returned 4 [0112.443] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0112.443] lstrlenW (lpString=".xls") returned 4 [0112.443] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0112.443] lstrlenW (lpString=".xlsx") returned 5 [0112.443] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0112.443] lstrlenW (lpString=".ppt") returned 4 [0112.443] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0112.443] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75 [0112.443] lstrlenW (lpString=".zip") returned 4 [0112.443] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0112.443] lstrlenW (lpString=".rar") returned 4 [0112.443] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0112.443] lstrlenW (lpString=".bz2") returned 4 [0112.444] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0112.444] lstrlenW (lpString=".7z") returned 3 [0112.444] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0112.444] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75 [0112.444] lstrlenW (lpString=".dbf") returned 4 [0112.444] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0112.444] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75 [0112.444] lstrlenW (lpString=".1cd") returned 4 [0112.444] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0112.444] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75 [0112.444] lstrlenW (lpString=".jpg") returned 4 [0112.444] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0112.444] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75 [0112.444] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75 [0112.444] lstrlenW (lpString=".doc") returned 4 [0112.444] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0112.444] lstrlenW (lpString=".docx") returned 5 [0112.444] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0112.444] lstrlenW (lpString=".pdf") returned 4 [0112.444] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0112.444] lstrlenW (lpString=".xls") returned 4 [0112.444] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0112.444] lstrlenW (lpString=".xlsx") returned 5 [0112.444] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0112.444] lstrlenW (lpString=".ppt") returned 4 [0112.444] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0112.444] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75 [0112.444] lstrlenW (lpString=".zip") returned 4 [0112.444] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0112.444] lstrlenW (lpString=".rar") returned 4 [0112.444] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0112.444] lstrlenW (lpString=".bz2") returned 4 [0112.444] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0112.444] lstrlenW (lpString=".7z") returned 3 [0112.444] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0112.444] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75 [0112.444] lstrlenW (lpString=".dbf") returned 4 [0112.444] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0112.444] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75 [0112.444] lstrlenW (lpString=".1cd") returned 4 [0112.444] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0112.444] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75 [0112.444] lstrlenW (lpString=".jpg") returned 4 [0112.444] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0112.444] lstrcmpiW (lpString1=".GIF", lpString2=".waifu") returned -1 [0112.445] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0112.445] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0112.445] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x37cfddc | out: lpFileSize=0x37cfddc*=1287) returned 1 [0112.445] CloseHandle (hObject=0x1f0) returned 1 [0112.445] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\preview.gif")) returned 0x20 [0112.445] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\preview.gif.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0112.445] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0112.445] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0112.445] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0112.445] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\preview.gif.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0112.715] GetLastError () returned 0x0 [0112.715] ReadFile (in: hFile=0x1f0, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x507, lpOverlapped=0x0) returned 1 [0112.916] WriteFile (in: hFile=0x1e0, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0x510, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0x510, lpOverlapped=0x0) returned 1 [0112.917] ReadFile (in: hFile=0x1f0, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x0, lpOverlapped=0x0) returned 1 [0112.917] WriteFile (in: hFile=0x1e0, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0xea, lpOverlapped=0x0) returned 1 [0112.917] SetEndOfFile (hFile=0x1e0) returned 1 [0112.917] CloseHandle (hObject=0x1e0) returned 1 [0112.917] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0112.917] SetEndOfFile (hFile=0x1f0) returned 1 [0112.918] CloseHandle (hObject=0x1f0) returned 1 [0112.918] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0112.918] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\preview.gif")) returned 1 [0112.918] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned 76 [0112.918] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned 76 [0112.919] lstrlenW (lpString=".doc") returned 4 [0112.919] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0112.919] lstrlenW (lpString=".docx") returned 5 [0112.919] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0112.919] lstrlenW (lpString=".pdf") returned 4 [0112.919] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0112.919] lstrlenW (lpString=".xls") returned 4 [0112.919] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0112.919] lstrlenW (lpString=".xlsx") returned 5 [0112.919] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0112.919] lstrlenW (lpString=".ppt") returned 4 [0112.919] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0112.919] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned 76 [0112.919] lstrlenW (lpString=".zip") returned 4 [0112.919] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0112.919] lstrlenW (lpString=".rar") returned 4 [0112.919] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0112.919] lstrlenW (lpString=".bz2") returned 4 [0112.919] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0112.919] lstrlenW (lpString=".7z") returned 3 [0112.919] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0112.919] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned 76 [0112.919] lstrlenW (lpString=".dbf") returned 4 [0112.919] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0112.919] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned 76 [0112.919] lstrlenW (lpString=".1cd") returned 4 [0112.919] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0112.919] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned 76 [0112.919] lstrlenW (lpString=".jpg") returned 4 [0112.919] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0112.919] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned 76 [0112.919] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned 76 [0112.919] lstrlenW (lpString=".doc") returned 4 [0112.919] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0112.919] lstrlenW (lpString=".docx") returned 5 [0112.920] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0112.920] lstrlenW (lpString=".pdf") returned 4 [0112.920] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0112.920] lstrlenW (lpString=".xls") returned 4 [0112.920] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0112.920] lstrlenW (lpString=".xlsx") returned 5 [0112.920] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0112.920] lstrlenW (lpString=".ppt") returned 4 [0112.920] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0112.920] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned 76 [0112.920] lstrlenW (lpString=".zip") returned 4 [0112.920] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0112.920] lstrlenW (lpString=".rar") returned 4 [0112.920] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0112.920] lstrlenW (lpString=".bz2") returned 4 [0112.920] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0112.920] lstrlenW (lpString=".7z") returned 3 [0112.920] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0112.920] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned 76 [0112.920] lstrlenW (lpString=".dbf") returned 4 [0112.920] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0112.920] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned 76 [0112.920] lstrlenW (lpString=".1cd") returned 4 [0112.920] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0112.920] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned 76 [0112.920] lstrlenW (lpString=".jpg") returned 4 [0112.920] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0112.920] lstrcmpiW (lpString1=".PNG", lpString2=".waifu") returned -1 [0112.920] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0112.920] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0113.116] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x37cfddc | out: lpFileSize=0x37cfddc*=25106) returned 1 [0113.116] CloseHandle (hObject=0x194) returned 1 [0113.116] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\thmbnail.png")) returned 0x20 [0113.116] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\thmbnail.png.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0113.117] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0113.117] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0113.117] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0113.117] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\thmbnail.png.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0113.117] GetLastError () returned 0x0 [0113.117] ReadFile (in: hFile=0x194, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x6212, lpOverlapped=0x0) returned 1 [0113.181] WriteFile (in: hFile=0x1d8, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0x6220, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0x6220, lpOverlapped=0x0) returned 1 [0113.182] ReadFile (in: hFile=0x194, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x0, lpOverlapped=0x0) returned 1 [0113.182] WriteFile (in: hFile=0x1d8, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0xec, lpOverlapped=0x0) returned 1 [0113.182] SetEndOfFile (hFile=0x1d8) returned 1 [0113.182] CloseHandle (hObject=0x1d8) returned 1 [0113.182] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0113.182] SetEndOfFile (hFile=0x194) returned 1 [0113.183] CloseHandle (hObject=0x194) returned 1 [0113.183] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0113.183] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\thmbnail.png")) returned 1 [0113.183] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 73 [0113.183] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 73 [0113.183] lstrlenW (lpString=".doc") returned 4 [0113.183] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0113.183] lstrlenW (lpString=".docx") returned 5 [0113.183] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0113.183] lstrlenW (lpString=".pdf") returned 4 [0113.183] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0113.183] lstrlenW (lpString=".xls") returned 4 [0113.183] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0113.183] lstrlenW (lpString=".xlsx") returned 5 [0113.183] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0113.183] lstrlenW (lpString=".ppt") returned 4 [0113.183] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0113.183] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 73 [0113.183] lstrlenW (lpString=".zip") returned 4 [0113.183] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0113.183] lstrlenW (lpString=".rar") returned 4 [0113.183] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0113.183] lstrlenW (lpString=".bz2") returned 4 [0113.183] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0113.184] lstrlenW (lpString=".7z") returned 3 [0113.184] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0113.184] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 73 [0113.184] lstrlenW (lpString=".dbf") returned 4 [0113.184] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0113.184] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 73 [0113.184] lstrlenW (lpString=".1cd") returned 4 [0113.184] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0113.184] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 73 [0113.184] lstrlenW (lpString=".jpg") returned 4 [0113.184] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0113.184] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 73 [0113.184] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 73 [0113.184] lstrlenW (lpString=".doc") returned 4 [0113.184] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0113.184] lstrlenW (lpString=".docx") returned 5 [0113.184] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0113.184] lstrlenW (lpString=".pdf") returned 4 [0113.184] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0113.184] lstrlenW (lpString=".xls") returned 4 [0113.184] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0113.184] lstrlenW (lpString=".xlsx") returned 5 [0113.184] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0113.184] lstrlenW (lpString=".ppt") returned 4 [0113.184] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0113.184] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 73 [0113.184] lstrlenW (lpString=".zip") returned 4 [0113.184] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0113.184] lstrlenW (lpString=".rar") returned 4 [0113.184] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0113.184] lstrlenW (lpString=".bz2") returned 4 [0113.184] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0113.184] lstrlenW (lpString=".7z") returned 3 [0113.184] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0113.184] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 73 [0113.184] lstrlenW (lpString=".dbf") returned 4 [0113.184] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0113.184] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 73 [0113.184] lstrlenW (lpString=".1cd") returned 4 [0113.184] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0113.184] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 73 [0113.184] lstrlenW (lpString=".jpg") returned 4 [0113.184] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0113.184] lstrcmpiW (lpString1=".PNG", lpString2=".waifu") returned -1 [0113.184] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0113.184] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0113.886] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x37cfddc | out: lpFileSize=0x37cfddc*=60724) returned 1 [0113.886] CloseHandle (hObject=0x1b0) returned 1 [0113.886] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\thmbnail.png")) returned 0x20 [0113.886] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\thmbnail.png.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0113.886] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0113.886] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0113.886] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0113.886] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\thmbnail.png.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0113.887] GetLastError () returned 0x0 [0113.887] ReadFile (in: hFile=0x1b0, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0xed34, lpOverlapped=0x0) returned 1 [0113.888] WriteFile (in: hFile=0x1f4, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0xed40, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0xed40, lpOverlapped=0x0) returned 1 [0113.889] ReadFile (in: hFile=0x1b0, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x0, lpOverlapped=0x0) returned 1 [0113.889] WriteFile (in: hFile=0x1f4, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0xec, lpOverlapped=0x0) returned 1 [0113.889] SetEndOfFile (hFile=0x1f4) returned 1 [0113.889] CloseHandle (hObject=0x1f4) returned 1 [0113.890] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0113.890] SetEndOfFile (hFile=0x1b0) returned 1 [0113.890] CloseHandle (hObject=0x1b0) returned 1 [0113.890] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0113.891] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\thmbnail.png")) returned 1 [0113.891] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 77 [0113.891] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 77 [0113.891] lstrlenW (lpString=".doc") returned 4 [0113.891] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0113.891] lstrlenW (lpString=".docx") returned 5 [0113.891] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0113.891] lstrlenW (lpString=".pdf") returned 4 [0113.891] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0113.891] lstrlenW (lpString=".xls") returned 4 [0113.891] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0113.891] lstrlenW (lpString=".xlsx") returned 5 [0113.891] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0113.891] lstrlenW (lpString=".ppt") returned 4 [0113.891] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0113.891] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 77 [0113.891] lstrlenW (lpString=".zip") returned 4 [0113.891] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0113.891] lstrlenW (lpString=".rar") returned 4 [0113.891] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0113.891] lstrlenW (lpString=".bz2") returned 4 [0113.891] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0113.891] lstrlenW (lpString=".7z") returned 3 [0113.891] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0113.891] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 77 [0113.891] lstrlenW (lpString=".dbf") returned 4 [0113.891] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0113.891] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 77 [0113.891] lstrlenW (lpString=".1cd") returned 4 [0113.891] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0113.891] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 77 [0113.891] lstrlenW (lpString=".jpg") returned 4 [0113.891] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0113.891] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 77 [0113.892] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 77 [0113.892] lstrlenW (lpString=".doc") returned 4 [0113.892] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0113.892] lstrlenW (lpString=".docx") returned 5 [0113.892] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0113.892] lstrlenW (lpString=".pdf") returned 4 [0113.892] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0113.892] lstrlenW (lpString=".xls") returned 4 [0113.892] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0113.892] lstrlenW (lpString=".xlsx") returned 5 [0113.892] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0113.892] lstrlenW (lpString=".ppt") returned 4 [0113.892] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0113.892] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 77 [0113.892] lstrlenW (lpString=".zip") returned 4 [0113.892] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0113.892] lstrlenW (lpString=".rar") returned 4 [0113.892] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0113.892] lstrlenW (lpString=".bz2") returned 4 [0113.892] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0113.892] lstrlenW (lpString=".7z") returned 3 [0113.892] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0113.892] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 77 [0113.892] lstrlenW (lpString=".dbf") returned 4 [0113.892] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0113.892] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 77 [0113.892] lstrlenW (lpString=".1cd") returned 4 [0113.892] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0113.892] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 77 [0113.892] lstrlenW (lpString=".jpg") returned 4 [0113.892] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0113.892] lstrcmpiW (lpString1=".GIF", lpString2=".waifu") returned -1 [0113.892] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0113.892] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0113.893] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x37cfddc | out: lpFileSize=0x37cfddc*=1232) returned 1 [0113.893] CloseHandle (hObject=0x1b0) returned 1 [0113.893] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\preview.gif")) returned 0x20 [0113.893] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\preview.gif.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0113.893] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0113.893] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0113.893] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0113.893] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\preview.gif.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0113.894] GetLastError () returned 0x0 [0113.894] ReadFile (in: hFile=0x1b0, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x4d0, lpOverlapped=0x0) returned 1 [0113.895] WriteFile (in: hFile=0x1f4, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0x4e0, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0x4e0, lpOverlapped=0x0) returned 1 [0113.896] ReadFile (in: hFile=0x1b0, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x0, lpOverlapped=0x0) returned 1 [0113.896] WriteFile (in: hFile=0x1f4, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0xea, lpOverlapped=0x0) returned 1 [0113.896] SetEndOfFile (hFile=0x1f4) returned 1 [0113.896] CloseHandle (hObject=0x1f4) returned 1 [0113.896] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0113.896] SetEndOfFile (hFile=0x1b0) returned 1 [0113.897] CloseHandle (hObject=0x1b0) returned 1 [0113.897] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0113.897] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\preview.gif")) returned 1 [0113.897] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75 [0113.897] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75 [0113.897] lstrlenW (lpString=".doc") returned 4 [0113.897] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0113.897] lstrlenW (lpString=".docx") returned 5 [0113.897] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0113.898] lstrlenW (lpString=".pdf") returned 4 [0113.898] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0113.898] lstrlenW (lpString=".xls") returned 4 [0113.898] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0113.898] lstrlenW (lpString=".xlsx") returned 5 [0113.898] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0113.898] lstrlenW (lpString=".ppt") returned 4 [0113.898] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0113.898] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75 [0113.898] lstrlenW (lpString=".zip") returned 4 [0113.898] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0113.898] lstrlenW (lpString=".rar") returned 4 [0113.898] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0113.898] lstrlenW (lpString=".bz2") returned 4 [0113.898] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0113.898] lstrlenW (lpString=".7z") returned 3 [0113.898] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0113.898] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75 [0113.898] lstrlenW (lpString=".dbf") returned 4 [0113.899] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0113.899] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75 [0113.899] lstrlenW (lpString=".1cd") returned 4 [0113.899] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0113.899] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75 [0113.899] lstrlenW (lpString=".jpg") returned 4 [0113.899] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0113.899] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75 [0113.899] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75 [0113.899] lstrlenW (lpString=".doc") returned 4 [0113.899] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0113.899] lstrlenW (lpString=".docx") returned 5 [0113.899] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0113.899] lstrlenW (lpString=".pdf") returned 4 [0113.899] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0113.899] lstrlenW (lpString=".xls") returned 4 [0113.899] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0113.899] lstrlenW (lpString=".xlsx") returned 5 [0113.899] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0113.899] lstrlenW (lpString=".ppt") returned 4 [0113.899] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0113.899] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75 [0113.899] lstrlenW (lpString=".zip") returned 4 [0113.899] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0113.900] lstrlenW (lpString=".rar") returned 4 [0113.900] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0113.900] lstrlenW (lpString=".bz2") returned 4 [0113.900] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0113.900] lstrlenW (lpString=".7z") returned 3 [0113.900] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0113.900] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75 [0113.900] lstrlenW (lpString=".dbf") returned 4 [0113.900] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0113.900] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75 [0113.900] lstrlenW (lpString=".1cd") returned 4 [0113.900] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0113.900] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75 [0113.900] lstrlenW (lpString=".jpg") returned 4 [0113.900] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0113.900] lstrcmpiW (lpString1=".PNG", lpString2=".waifu") returned -1 [0113.900] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0113.900] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0113.900] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x37cfddc | out: lpFileSize=0x37cfddc*=18413) returned 1 [0113.900] CloseHandle (hObject=0x1c0) returned 1 [0113.900] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\thmbnail.png")) returned 0x20 [0113.900] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\thmbnail.png.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0113.901] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0113.901] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0113.901] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0113.901] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\thmbnail.png.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0113.901] GetLastError () returned 0x0 [0113.901] ReadFile (in: hFile=0x1c0, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x47ed, lpOverlapped=0x0) returned 1 [0113.903] WriteFile (in: hFile=0x1ec, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0x47f0, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0x47f0, lpOverlapped=0x0) returned 1 [0113.903] ReadFile (in: hFile=0x1c0, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x0, lpOverlapped=0x0) returned 1 [0113.903] WriteFile (in: hFile=0x1ec, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0xec, lpOverlapped=0x0) returned 1 [0113.903] SetEndOfFile (hFile=0x1ec) returned 1 [0113.904] CloseHandle (hObject=0x1ec) returned 1 [0113.904] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0113.904] SetEndOfFile (hFile=0x1c0) returned 1 [0113.904] CloseHandle (hObject=0x1c0) returned 1 [0113.904] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0113.905] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\thmbnail.png")) returned 1 [0113.905] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned 76 [0113.905] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned 76 [0113.905] lstrlenW (lpString=".doc") returned 4 [0113.905] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0113.905] lstrlenW (lpString=".docx") returned 5 [0113.905] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0113.905] lstrlenW (lpString=".pdf") returned 4 [0113.905] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0113.905] lstrlenW (lpString=".xls") returned 4 [0113.905] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0113.905] lstrlenW (lpString=".xlsx") returned 5 [0113.905] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0113.905] lstrlenW (lpString=".ppt") returned 4 [0113.905] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0113.905] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned 76 [0113.905] lstrlenW (lpString=".zip") returned 4 [0113.905] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0113.905] lstrlenW (lpString=".rar") returned 4 [0113.905] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0113.905] lstrlenW (lpString=".bz2") returned 4 [0113.905] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0113.905] lstrlenW (lpString=".7z") returned 3 [0113.905] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0113.905] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned 76 [0113.905] lstrlenW (lpString=".dbf") returned 4 [0113.905] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0113.905] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned 76 [0113.905] lstrlenW (lpString=".1cd") returned 4 [0113.905] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0113.905] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned 76 [0113.905] lstrlenW (lpString=".jpg") returned 4 [0113.905] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0113.905] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned 76 [0113.905] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned 76 [0113.905] lstrlenW (lpString=".doc") returned 4 [0113.905] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0113.905] lstrlenW (lpString=".docx") returned 5 [0113.905] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0113.905] lstrlenW (lpString=".pdf") returned 4 [0113.905] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0113.905] lstrlenW (lpString=".xls") returned 4 [0113.906] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0113.906] lstrlenW (lpString=".xlsx") returned 5 [0113.906] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0113.906] lstrlenW (lpString=".ppt") returned 4 [0113.906] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0113.906] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned 76 [0113.906] lstrlenW (lpString=".zip") returned 4 [0113.906] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0113.906] lstrlenW (lpString=".rar") returned 4 [0113.906] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0113.906] lstrlenW (lpString=".bz2") returned 4 [0113.906] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0113.906] lstrlenW (lpString=".7z") returned 3 [0113.906] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0113.906] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned 76 [0113.906] lstrlenW (lpString=".dbf") returned 4 [0113.906] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0113.906] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned 76 [0113.906] lstrlenW (lpString=".1cd") returned 4 [0113.906] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0113.906] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned 76 [0113.906] lstrlenW (lpString=".jpg") returned 4 [0113.906] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0113.906] lstrcmpiW (lpString1=".GIF", lpString2=".waifu") returned -1 [0113.906] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0113.906] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0113.906] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x37cfddc | out: lpFileSize=0x37cfddc*=1659) returned 1 [0113.906] CloseHandle (hObject=0x1c0) returned 1 [0113.906] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\preview.gif")) returned 0x20 [0113.907] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\preview.gif.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0113.907] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0113.907] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0113.907] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0113.907] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\preview.gif.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0113.908] GetLastError () returned 0x0 [0113.908] ReadFile (in: hFile=0x1c0, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x67b, lpOverlapped=0x0) returned 1 [0113.909] WriteFile (in: hFile=0x1ec, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0x680, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0x680, lpOverlapped=0x0) returned 1 [0113.909] ReadFile (in: hFile=0x1c0, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x0, lpOverlapped=0x0) returned 1 [0113.909] WriteFile (in: hFile=0x1ec, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0xea, lpOverlapped=0x0) returned 1 [0113.909] SetEndOfFile (hFile=0x1ec) returned 1 [0113.910] CloseHandle (hObject=0x1ec) returned 1 [0113.910] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0113.910] SetEndOfFile (hFile=0x1c0) returned 1 [0113.910] CloseHandle (hObject=0x1c0) returned 1 [0113.910] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0113.910] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\preview.gif")) returned 1 [0113.911] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74 [0113.911] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74 [0113.911] lstrlenW (lpString=".doc") returned 4 [0113.911] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0113.911] lstrlenW (lpString=".docx") returned 5 [0113.911] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0113.911] lstrlenW (lpString=".pdf") returned 4 [0113.911] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0113.911] lstrlenW (lpString=".xls") returned 4 [0113.911] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0113.911] lstrlenW (lpString=".xlsx") returned 5 [0113.911] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0113.911] lstrlenW (lpString=".ppt") returned 4 [0113.911] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0113.911] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74 [0113.911] lstrlenW (lpString=".zip") returned 4 [0113.911] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0113.911] lstrlenW (lpString=".rar") returned 4 [0113.911] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0113.911] lstrlenW (lpString=".bz2") returned 4 [0113.911] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0113.911] lstrlenW (lpString=".7z") returned 3 [0113.911] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0113.911] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74 [0113.911] lstrlenW (lpString=".dbf") returned 4 [0113.911] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0113.911] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74 [0113.911] lstrlenW (lpString=".1cd") returned 4 [0113.911] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0113.911] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74 [0113.911] lstrlenW (lpString=".jpg") returned 4 [0113.911] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0113.911] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74 [0113.911] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74 [0113.911] lstrlenW (lpString=".doc") returned 4 [0113.911] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0113.911] lstrlenW (lpString=".docx") returned 5 [0113.911] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0113.911] lstrlenW (lpString=".pdf") returned 4 [0113.911] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0113.911] lstrlenW (lpString=".xls") returned 4 [0113.911] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0113.911] lstrlenW (lpString=".xlsx") returned 5 [0113.912] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0113.912] lstrlenW (lpString=".ppt") returned 4 [0113.912] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0113.912] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74 [0113.912] lstrlenW (lpString=".zip") returned 4 [0113.912] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0113.912] lstrlenW (lpString=".rar") returned 4 [0113.912] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0113.912] lstrlenW (lpString=".bz2") returned 4 [0113.912] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0113.912] lstrlenW (lpString=".7z") returned 3 [0113.912] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0113.912] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74 [0113.912] lstrlenW (lpString=".dbf") returned 4 [0113.912] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0113.912] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74 [0113.912] lstrlenW (lpString=".1cd") returned 4 [0113.912] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0113.912] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74 [0113.912] lstrlenW (lpString=".jpg") returned 4 [0113.912] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0113.912] lstrcmpiW (lpString1=".PNG", lpString2=".waifu") returned -1 [0113.912] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0113.912] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0113.913] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x37cfddc | out: lpFileSize=0x37cfddc*=44850) returned 1 [0113.913] CloseHandle (hObject=0x1c0) returned 1 [0113.913] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\thmbnail.png")) returned 0x20 [0113.913] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\thmbnail.png.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0113.913] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0113.913] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0113.913] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0113.913] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\thmbnail.png.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0113.914] GetLastError () returned 0x0 [0113.914] ReadFile (in: hFile=0x1c0, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0xaf32, lpOverlapped=0x0) returned 1 [0113.915] WriteFile (in: hFile=0x1ec, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0xaf40, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0xaf40, lpOverlapped=0x0) returned 1 [0113.917] ReadFile (in: hFile=0x1c0, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x0, lpOverlapped=0x0) returned 1 [0113.917] WriteFile (in: hFile=0x1ec, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0xec, lpOverlapped=0x0) returned 1 [0113.918] SetEndOfFile (hFile=0x1ec) returned 1 [0113.918] CloseHandle (hObject=0x1ec) returned 1 [0113.918] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0113.918] SetEndOfFile (hFile=0x1c0) returned 1 [0113.918] CloseHandle (hObject=0x1c0) returned 1 [0113.918] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0113.919] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\thmbnail.png")) returned 1 [0113.919] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned 75 [0113.919] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned 75 [0113.919] lstrlenW (lpString=".doc") returned 4 [0113.919] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0113.919] lstrlenW (lpString=".docx") returned 5 [0113.919] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0113.919] lstrlenW (lpString=".pdf") returned 4 [0113.919] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0113.919] lstrlenW (lpString=".xls") returned 4 [0113.919] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0113.919] lstrlenW (lpString=".xlsx") returned 5 [0113.919] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0113.919] lstrlenW (lpString=".ppt") returned 4 [0113.919] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0113.919] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned 75 [0113.919] lstrlenW (lpString=".zip") returned 4 [0113.919] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0113.919] lstrlenW (lpString=".rar") returned 4 [0113.919] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0113.919] lstrlenW (lpString=".bz2") returned 4 [0113.919] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0113.919] lstrlenW (lpString=".7z") returned 3 [0113.919] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0113.919] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned 75 [0113.919] lstrlenW (lpString=".dbf") returned 4 [0113.919] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0113.919] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned 75 [0113.919] lstrlenW (lpString=".1cd") returned 4 [0113.919] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0113.919] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned 75 [0113.919] lstrlenW (lpString=".jpg") returned 4 [0113.919] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0113.919] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned 75 [0113.919] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned 75 [0113.920] lstrlenW (lpString=".doc") returned 4 [0113.920] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0113.920] lstrlenW (lpString=".docx") returned 5 [0113.920] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0113.920] lstrlenW (lpString=".pdf") returned 4 [0113.920] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0113.920] lstrlenW (lpString=".xls") returned 4 [0113.920] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0113.920] lstrlenW (lpString=".xlsx") returned 5 [0113.920] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0113.920] lstrlenW (lpString=".ppt") returned 4 [0113.920] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0113.920] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned 75 [0113.920] lstrlenW (lpString=".zip") returned 4 [0113.920] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0113.920] lstrlenW (lpString=".rar") returned 4 [0113.920] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0113.920] lstrlenW (lpString=".bz2") returned 4 [0113.920] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0113.920] lstrlenW (lpString=".7z") returned 3 [0113.920] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0113.920] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned 75 [0113.920] lstrlenW (lpString=".dbf") returned 4 [0113.920] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0113.920] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned 75 [0113.920] lstrlenW (lpString=".1cd") returned 4 [0113.920] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0113.920] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned 75 [0113.920] lstrlenW (lpString=".jpg") returned 4 [0113.920] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0113.920] lstrcmpiW (lpString1=".GIF", lpString2=".waifu") returned -1 [0113.920] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0113.920] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0113.921] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x37cfddc | out: lpFileSize=0x37cfddc*=1379) returned 1 [0113.921] CloseHandle (hObject=0x1c0) returned 1 [0113.921] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\preview.gif")) returned 0x20 [0113.921] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\preview.gif.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0113.921] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0113.921] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0113.921] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0113.921] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\preview.gif.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0114.315] GetLastError () returned 0x0 [0114.315] ReadFile (in: hFile=0x1c0, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x563, lpOverlapped=0x0) returned 1 [0114.316] WriteFile (in: hFile=0x1f0, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0x570, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0x570, lpOverlapped=0x0) returned 1 [0114.317] ReadFile (in: hFile=0x1c0, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x0, lpOverlapped=0x0) returned 1 [0114.317] WriteFile (in: hFile=0x1f0, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0xea, lpOverlapped=0x0) returned 1 [0114.317] SetEndOfFile (hFile=0x1f0) returned 1 [0114.317] CloseHandle (hObject=0x1f0) returned 1 [0114.318] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0114.318] SetEndOfFile (hFile=0x1c0) returned 1 [0114.318] CloseHandle (hObject=0x1c0) returned 1 [0114.318] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0114.318] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\preview.gif")) returned 1 [0114.319] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73 [0114.319] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73 [0114.319] lstrlenW (lpString=".doc") returned 4 [0114.319] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0114.319] lstrlenW (lpString=".docx") returned 5 [0114.319] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0114.319] lstrlenW (lpString=".pdf") returned 4 [0114.319] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0114.319] lstrlenW (lpString=".xls") returned 4 [0114.319] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0114.319] lstrlenW (lpString=".xlsx") returned 5 [0114.319] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0114.319] lstrlenW (lpString=".ppt") returned 4 [0114.319] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0114.319] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73 [0114.319] lstrlenW (lpString=".zip") returned 4 [0114.319] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0114.319] lstrlenW (lpString=".rar") returned 4 [0114.319] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0114.319] lstrlenW (lpString=".bz2") returned 4 [0114.319] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0114.319] lstrlenW (lpString=".7z") returned 3 [0114.319] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0114.319] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73 [0114.319] lstrlenW (lpString=".dbf") returned 4 [0114.319] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0114.319] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73 [0114.319] lstrlenW (lpString=".1cd") returned 4 [0114.319] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0114.319] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73 [0114.319] lstrlenW (lpString=".jpg") returned 4 [0114.319] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0114.319] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73 [0114.319] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73 [0114.319] lstrlenW (lpString=".doc") returned 4 [0114.319] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0114.319] lstrlenW (lpString=".docx") returned 5 [0114.319] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0114.319] lstrlenW (lpString=".pdf") returned 4 [0114.319] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0114.319] lstrlenW (lpString=".xls") returned 4 [0114.319] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0114.319] lstrlenW (lpString=".xlsx") returned 5 [0114.319] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0114.320] lstrlenW (lpString=".ppt") returned 4 [0114.320] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0114.320] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73 [0114.320] lstrlenW (lpString=".zip") returned 4 [0114.320] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0114.320] lstrlenW (lpString=".rar") returned 4 [0114.320] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0114.320] lstrlenW (lpString=".bz2") returned 4 [0114.320] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0114.320] lstrlenW (lpString=".7z") returned 3 [0114.320] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0114.320] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73 [0114.320] lstrlenW (lpString=".dbf") returned 4 [0114.320] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0114.320] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73 [0114.320] lstrlenW (lpString=".1cd") returned 4 [0114.320] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0114.320] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73 [0114.320] lstrlenW (lpString=".jpg") returned 4 [0114.320] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0114.320] lstrcmpiW (lpString1=".GIF", lpString2=".waifu") returned -1 [0114.320] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0114.320] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0114.321] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x37cfddc | out: lpFileSize=0x37cfddc*=2574) returned 1 [0114.321] CloseHandle (hObject=0x1c0) returned 1 [0114.321] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\preview.gif")) returned 0x20 [0114.322] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\preview.gif.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0114.323] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0114.323] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0114.323] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0114.323] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\preview.gif.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0114.412] GetLastError () returned 0x0 [0114.412] ReadFile (in: hFile=0x1c0, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0xa0e, lpOverlapped=0x0) returned 1 [0114.413] WriteFile (in: hFile=0x1fc, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0xa10, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0xa10, lpOverlapped=0x0) returned 1 [0114.414] ReadFile (in: hFile=0x1c0, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x0, lpOverlapped=0x0) returned 1 [0114.414] WriteFile (in: hFile=0x1fc, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0xea, lpOverlapped=0x0) returned 1 [0114.414] SetEndOfFile (hFile=0x1fc) returned 1 [0114.414] CloseHandle (hObject=0x1fc) returned 1 [0114.414] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0114.414] SetEndOfFile (hFile=0x1c0) returned 1 [0114.414] CloseHandle (hObject=0x1c0) returned 1 [0114.415] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0114.415] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\preview.gif")) returned 1 [0114.415] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75 [0114.415] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75 [0114.415] lstrlenW (lpString=".doc") returned 4 [0114.415] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0114.415] lstrlenW (lpString=".docx") returned 5 [0114.415] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0114.415] lstrlenW (lpString=".pdf") returned 4 [0114.415] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0114.415] lstrlenW (lpString=".xls") returned 4 [0114.415] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0114.415] lstrlenW (lpString=".xlsx") returned 5 [0114.415] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0114.415] lstrlenW (lpString=".ppt") returned 4 [0114.415] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0114.415] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75 [0114.415] lstrlenW (lpString=".zip") returned 4 [0114.415] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0114.415] lstrlenW (lpString=".rar") returned 4 [0114.415] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0114.415] lstrlenW (lpString=".bz2") returned 4 [0114.415] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0114.415] lstrlenW (lpString=".7z") returned 3 [0114.415] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0114.415] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75 [0114.415] lstrlenW (lpString=".dbf") returned 4 [0114.416] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0114.416] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75 [0114.416] lstrlenW (lpString=".1cd") returned 4 [0114.416] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0114.416] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75 [0114.416] lstrlenW (lpString=".jpg") returned 4 [0114.416] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0114.416] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75 [0114.416] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75 [0114.416] lstrlenW (lpString=".doc") returned 4 [0114.416] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0114.416] lstrlenW (lpString=".docx") returned 5 [0114.416] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0114.416] lstrlenW (lpString=".pdf") returned 4 [0114.416] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0114.416] lstrlenW (lpString=".xls") returned 4 [0114.416] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0114.416] lstrlenW (lpString=".xlsx") returned 5 [0114.416] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0114.416] lstrlenW (lpString=".ppt") returned 4 [0114.416] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0114.416] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75 [0114.416] lstrlenW (lpString=".zip") returned 4 [0114.416] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0114.416] lstrlenW (lpString=".rar") returned 4 [0114.416] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0114.416] lstrlenW (lpString=".bz2") returned 4 [0114.416] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0114.416] lstrlenW (lpString=".7z") returned 3 [0114.416] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0114.416] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75 [0114.416] lstrlenW (lpString=".dbf") returned 4 [0114.416] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0114.416] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75 [0114.416] lstrlenW (lpString=".1cd") returned 4 [0114.416] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0114.416] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75 [0114.416] lstrlenW (lpString=".jpg") returned 4 [0114.416] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0114.417] lstrcmpiW (lpString1=".GIF", lpString2=".waifu") returned -1 [0114.417] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0114.417] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0114.417] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x37cfddc | out: lpFileSize=0x37cfddc*=1439) returned 1 [0114.417] CloseHandle (hObject=0x1c0) returned 1 [0114.417] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\preview.gif")) returned 0x20 [0114.417] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\preview.gif.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0114.417] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0114.417] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0114.417] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0114.417] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\preview.gif.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0114.419] GetLastError () returned 0x0 [0114.419] ReadFile (in: hFile=0x1c0, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x59f, lpOverlapped=0x0) returned 1 [0114.419] WriteFile (in: hFile=0x1fc, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0x5a0, lpOverlapped=0x0) returned 1 [0114.420] ReadFile (in: hFile=0x1c0, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x0, lpOverlapped=0x0) returned 1 [0114.420] WriteFile (in: hFile=0x1fc, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0xea, lpOverlapped=0x0) returned 1 [0114.420] SetEndOfFile (hFile=0x1fc) returned 1 [0114.421] CloseHandle (hObject=0x1fc) returned 1 [0114.421] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0114.421] SetEndOfFile (hFile=0x1c0) returned 1 [0114.421] CloseHandle (hObject=0x1c0) returned 1 [0114.422] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0114.422] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\preview.gif")) returned 1 [0114.422] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72 [0114.422] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72 [0114.422] lstrlenW (lpString=".doc") returned 4 [0114.422] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0114.422] lstrlenW (lpString=".docx") returned 5 [0114.422] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0114.422] lstrlenW (lpString=".pdf") returned 4 [0114.422] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0114.422] lstrlenW (lpString=".xls") returned 4 [0114.422] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0114.422] lstrlenW (lpString=".xlsx") returned 5 [0114.422] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0114.422] lstrlenW (lpString=".ppt") returned 4 [0114.422] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0114.422] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72 [0114.422] lstrlenW (lpString=".zip") returned 4 [0114.423] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0114.423] lstrlenW (lpString=".rar") returned 4 [0114.423] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0114.423] lstrlenW (lpString=".bz2") returned 4 [0114.423] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0114.423] lstrlenW (lpString=".7z") returned 3 [0114.423] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0114.423] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72 [0114.423] lstrlenW (lpString=".dbf") returned 4 [0114.423] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0114.423] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72 [0114.423] lstrlenW (lpString=".1cd") returned 4 [0114.423] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0114.423] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72 [0114.423] lstrlenW (lpString=".jpg") returned 4 [0114.423] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0114.423] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72 [0114.423] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72 [0114.423] lstrlenW (lpString=".doc") returned 4 [0114.423] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0114.423] lstrlenW (lpString=".docx") returned 5 [0114.423] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0114.423] lstrlenW (lpString=".pdf") returned 4 [0114.423] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0114.423] lstrlenW (lpString=".xls") returned 4 [0114.423] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0114.423] lstrlenW (lpString=".xlsx") returned 5 [0114.423] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0114.423] lstrlenW (lpString=".ppt") returned 4 [0114.423] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0114.423] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72 [0114.423] lstrlenW (lpString=".zip") returned 4 [0114.423] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0114.423] lstrlenW (lpString=".rar") returned 4 [0114.423] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0114.423] lstrlenW (lpString=".bz2") returned 4 [0114.423] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0114.423] lstrlenW (lpString=".7z") returned 3 [0114.423] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0114.423] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72 [0114.424] lstrlenW (lpString=".dbf") returned 4 [0114.424] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0114.424] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72 [0114.424] lstrlenW (lpString=".1cd") returned 4 [0114.424] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0114.424] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72 [0114.424] lstrlenW (lpString=".jpg") returned 4 [0114.424] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0114.424] lstrcmpiW (lpString1=".PNG", lpString2=".waifu") returned -1 [0114.424] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0114.424] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0114.424] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x37cfddc | out: lpFileSize=0x37cfddc*=37112) returned 1 [0114.424] CloseHandle (hObject=0x1c0) returned 1 [0114.424] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\thmbnail.png")) returned 0x20 [0114.424] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\thmbnail.png.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0114.424] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0114.425] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0114.425] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0114.425] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\thmbnail.png.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0114.425] GetLastError () returned 0x0 [0114.425] ReadFile (in: hFile=0x1c0, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x90f8, lpOverlapped=0x0) returned 1 [0114.427] WriteFile (in: hFile=0x1fc, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0x9100, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0x9100, lpOverlapped=0x0) returned 1 [0114.428] ReadFile (in: hFile=0x1c0, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x0, lpOverlapped=0x0) returned 1 [0114.428] WriteFile (in: hFile=0x1fc, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0xec, lpOverlapped=0x0) returned 1 [0114.428] SetEndOfFile (hFile=0x1fc) returned 1 [0114.428] CloseHandle (hObject=0x1fc) returned 1 [0114.430] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0114.430] SetEndOfFile (hFile=0x1c0) returned 1 [0114.432] CloseHandle (hObject=0x1c0) returned 1 [0114.433] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0114.435] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\thmbnail.png")) returned 1 [0114.435] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG") returned 73 [0114.435] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG") returned 73 [0114.435] lstrlenW (lpString=".doc") returned 4 [0114.435] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0114.435] lstrlenW (lpString=".docx") returned 5 [0114.435] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0114.435] lstrlenW (lpString=".pdf") returned 4 [0114.435] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0114.435] lstrlenW (lpString=".xls") returned 4 [0114.435] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0114.435] lstrlenW (lpString=".xlsx") returned 5 [0114.436] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0114.436] lstrlenW (lpString=".ppt") returned 4 [0114.436] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0114.436] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG") returned 73 [0114.436] lstrlenW (lpString=".zip") returned 4 [0114.436] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0114.436] lstrlenW (lpString=".rar") returned 4 [0114.436] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0114.436] lstrlenW (lpString=".bz2") returned 4 [0114.436] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0114.436] lstrlenW (lpString=".7z") returned 3 [0114.436] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0114.436] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG") returned 73 [0114.436] lstrlenW (lpString=".dbf") returned 4 [0114.436] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0114.436] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG") returned 73 [0114.436] lstrlenW (lpString=".1cd") returned 4 [0114.436] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0114.436] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG") returned 73 [0114.436] lstrlenW (lpString=".jpg") returned 4 [0114.436] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0114.436] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG") returned 73 [0114.436] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG") returned 73 [0114.436] lstrlenW (lpString=".doc") returned 4 [0114.436] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0114.436] lstrlenW (lpString=".docx") returned 5 [0114.436] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0114.436] lstrlenW (lpString=".pdf") returned 4 [0114.436] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0114.436] lstrlenW (lpString=".xls") returned 4 [0114.436] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0114.436] lstrlenW (lpString=".xlsx") returned 5 [0114.436] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0114.436] lstrlenW (lpString=".ppt") returned 4 [0114.436] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0114.436] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG") returned 73 [0114.436] lstrlenW (lpString=".zip") returned 4 [0114.436] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0114.436] lstrlenW (lpString=".rar") returned 4 [0114.436] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0114.436] lstrlenW (lpString=".bz2") returned 4 [0114.436] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0114.436] lstrlenW (lpString=".7z") returned 3 [0114.437] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0114.437] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG") returned 73 [0114.437] lstrlenW (lpString=".dbf") returned 4 [0114.437] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0114.437] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG") returned 73 [0114.437] lstrlenW (lpString=".1cd") returned 4 [0114.437] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0114.437] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG") returned 73 [0114.437] lstrlenW (lpString=".jpg") returned 4 [0114.437] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0114.437] lstrcmpiW (lpString1=".GIF", lpString2=".waifu") returned -1 [0114.437] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0114.437] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0114.438] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x37cfddc | out: lpFileSize=0x37cfddc*=1666) returned 1 [0114.438] CloseHandle (hObject=0x1c0) returned 1 [0114.438] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\preview.gif")) returned 0x20 [0114.438] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\preview.gif.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0114.438] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0114.438] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0114.438] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0114.438] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\preview.gif.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0114.528] GetLastError () returned 0x0 [0114.528] ReadFile (in: hFile=0x1c0, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x682, lpOverlapped=0x0) returned 1 [0114.529] WriteFile (in: hFile=0x1f0, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0x690, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0x690, lpOverlapped=0x0) returned 1 [0114.530] ReadFile (in: hFile=0x1c0, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x0, lpOverlapped=0x0) returned 1 [0114.530] WriteFile (in: hFile=0x1f0, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0xea, lpOverlapped=0x0) returned 1 [0114.530] SetEndOfFile (hFile=0x1f0) returned 1 [0114.531] CloseHandle (hObject=0x1f0) returned 1 [0114.531] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0114.531] SetEndOfFile (hFile=0x1c0) returned 1 [0114.531] CloseHandle (hObject=0x1c0) returned 1 [0114.532] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0114.532] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\preview.gif")) returned 1 [0114.532] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned 74 [0114.532] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned 74 [0114.532] lstrlenW (lpString=".doc") returned 4 [0114.532] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0114.532] lstrlenW (lpString=".docx") returned 5 [0114.532] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0114.532] lstrlenW (lpString=".pdf") returned 4 [0114.532] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0114.532] lstrlenW (lpString=".xls") returned 4 [0114.532] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0114.532] lstrlenW (lpString=".xlsx") returned 5 [0114.532] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0114.532] lstrlenW (lpString=".ppt") returned 4 [0114.532] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0114.532] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned 74 [0114.532] lstrlenW (lpString=".zip") returned 4 [0114.533] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0114.533] lstrlenW (lpString=".rar") returned 4 [0114.533] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0114.533] lstrlenW (lpString=".bz2") returned 4 [0114.533] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0114.533] lstrlenW (lpString=".7z") returned 3 [0114.533] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0114.533] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned 74 [0114.533] lstrlenW (lpString=".dbf") returned 4 [0114.533] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0114.533] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned 74 [0114.533] lstrlenW (lpString=".1cd") returned 4 [0114.533] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0114.533] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned 74 [0114.533] lstrlenW (lpString=".jpg") returned 4 [0114.533] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0114.533] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned 74 [0114.533] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned 74 [0114.533] lstrlenW (lpString=".doc") returned 4 [0114.533] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0114.533] lstrlenW (lpString=".docx") returned 5 [0114.533] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0114.533] lstrlenW (lpString=".pdf") returned 4 [0114.533] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0114.533] lstrlenW (lpString=".xls") returned 4 [0114.533] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0114.533] lstrlenW (lpString=".xlsx") returned 5 [0114.533] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0114.533] lstrlenW (lpString=".ppt") returned 4 [0114.533] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0114.533] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned 74 [0114.533] lstrlenW (lpString=".zip") returned 4 [0114.533] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0114.533] lstrlenW (lpString=".rar") returned 4 [0114.533] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0114.533] lstrlenW (lpString=".bz2") returned 4 [0114.533] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0114.534] lstrlenW (lpString=".7z") returned 3 [0114.534] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0114.534] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned 74 [0114.534] lstrlenW (lpString=".dbf") returned 4 [0114.534] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0114.534] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned 74 [0114.534] lstrlenW (lpString=".1cd") returned 4 [0114.534] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0114.534] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned 74 [0114.534] lstrlenW (lpString=".jpg") returned 4 [0114.534] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0114.534] lstrcmpiW (lpString1=".GIF", lpString2=".waifu") returned -1 [0114.534] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0114.534] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0114.534] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x37cfddc | out: lpFileSize=0x37cfddc*=3611) returned 1 [0114.534] CloseHandle (hObject=0x1c0) returned 1 [0114.534] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\preview.gif")) returned 0x20 [0114.535] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\preview.gif.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0114.535] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0114.535] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0114.535] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0114.535] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\preview.gif.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0114.537] GetLastError () returned 0x0 [0114.537] ReadFile (in: hFile=0x1c0, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0xe1b, lpOverlapped=0x0) returned 1 [0114.538] WriteFile (in: hFile=0x1f0, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0xe20, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0xe20, lpOverlapped=0x0) returned 1 [0114.539] ReadFile (in: hFile=0x1c0, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x0, lpOverlapped=0x0) returned 1 [0114.539] WriteFile (in: hFile=0x1f0, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0xea, lpOverlapped=0x0) returned 1 [0114.539] SetEndOfFile (hFile=0x1f0) returned 1 [0114.539] CloseHandle (hObject=0x1f0) returned 1 [0114.539] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0114.539] SetEndOfFile (hFile=0x1c0) returned 1 [0114.541] CloseHandle (hObject=0x1c0) returned 1 [0114.541] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0114.542] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\preview.gif")) returned 1 [0114.542] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF") returned 73 [0114.542] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF") returned 73 [0114.542] lstrlenW (lpString=".doc") returned 4 [0114.542] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0114.542] lstrlenW (lpString=".docx") returned 5 [0114.542] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0114.542] lstrlenW (lpString=".pdf") returned 4 [0114.542] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0114.542] lstrlenW (lpString=".xls") returned 4 [0114.542] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0114.542] lstrlenW (lpString=".xlsx") returned 5 [0114.542] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0114.542] lstrlenW (lpString=".ppt") returned 4 [0114.542] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0114.542] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF") returned 73 [0114.542] lstrlenW (lpString=".zip") returned 4 [0114.543] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0114.543] lstrlenW (lpString=".rar") returned 4 [0114.543] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0114.543] lstrlenW (lpString=".bz2") returned 4 [0114.543] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0114.543] lstrlenW (lpString=".7z") returned 3 [0114.543] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0114.543] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF") returned 73 [0114.543] lstrlenW (lpString=".dbf") returned 4 [0114.543] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0114.543] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF") returned 73 [0114.543] lstrlenW (lpString=".1cd") returned 4 [0114.543] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0114.543] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF") returned 73 [0114.543] lstrlenW (lpString=".jpg") returned 4 [0114.543] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0114.543] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF") returned 73 [0114.543] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF") returned 73 [0114.543] lstrlenW (lpString=".doc") returned 4 [0114.543] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0114.543] lstrlenW (lpString=".docx") returned 5 [0114.543] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0114.543] lstrlenW (lpString=".pdf") returned 4 [0114.543] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0114.543] lstrlenW (lpString=".xls") returned 4 [0114.543] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0114.543] lstrlenW (lpString=".xlsx") returned 5 [0114.543] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0114.543] lstrlenW (lpString=".ppt") returned 4 [0114.543] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0114.543] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF") returned 73 [0114.546] lstrlenW (lpString=".zip") returned 4 [0114.546] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0114.546] lstrlenW (lpString=".rar") returned 4 [0114.546] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0114.546] lstrlenW (lpString=".bz2") returned 4 [0114.546] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0114.546] lstrlenW (lpString=".7z") returned 3 [0114.546] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0114.546] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF") returned 73 [0114.546] lstrlenW (lpString=".dbf") returned 4 [0114.546] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0114.546] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF") returned 73 [0114.546] lstrlenW (lpString=".1cd") returned 4 [0114.546] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0114.546] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF") returned 73 [0114.546] lstrlenW (lpString=".jpg") returned 4 [0114.546] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0114.546] lstrcmpiW (lpString1=".PNG", lpString2=".waifu") returned -1 [0114.546] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0114.546] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0114.547] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x37cfddc | out: lpFileSize=0x37cfddc*=34163) returned 1 [0114.547] CloseHandle (hObject=0x1c0) returned 1 [0114.547] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\thmbnail.png")) returned 0x20 [0114.547] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\thmbnail.png.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0114.547] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0114.547] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0114.547] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0114.547] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\thmbnail.png.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0114.548] GetLastError () returned 0x0 [0114.548] ReadFile (in: hFile=0x1c0, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x8573, lpOverlapped=0x0) returned 1 [0114.550] WriteFile (in: hFile=0x1f0, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0x8580, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0x8580, lpOverlapped=0x0) returned 1 [0114.551] ReadFile (in: hFile=0x1c0, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x0, lpOverlapped=0x0) returned 1 [0114.551] WriteFile (in: hFile=0x1f0, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0xec, lpOverlapped=0x0) returned 1 [0114.551] SetEndOfFile (hFile=0x1f0) returned 1 [0114.551] CloseHandle (hObject=0x1f0) returned 1 [0114.551] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0114.551] SetEndOfFile (hFile=0x1c0) returned 1 [0114.552] CloseHandle (hObject=0x1c0) returned 1 [0114.552] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0114.552] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\thmbnail.png")) returned 1 [0114.553] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG") returned 74 [0114.553] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG") returned 74 [0114.553] lstrlenW (lpString=".doc") returned 4 [0114.553] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0114.553] lstrlenW (lpString=".docx") returned 5 [0114.553] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0114.553] lstrlenW (lpString=".pdf") returned 4 [0114.553] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0114.553] lstrlenW (lpString=".xls") returned 4 [0114.553] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0114.553] lstrlenW (lpString=".xlsx") returned 5 [0114.553] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0114.553] lstrlenW (lpString=".ppt") returned 4 [0114.553] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0114.553] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG") returned 74 [0114.553] lstrlenW (lpString=".zip") returned 4 [0114.553] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0114.553] lstrlenW (lpString=".rar") returned 4 [0114.553] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0114.553] lstrlenW (lpString=".bz2") returned 4 [0114.553] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0114.553] lstrlenW (lpString=".7z") returned 3 [0114.553] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0114.553] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG") returned 74 [0114.553] lstrlenW (lpString=".dbf") returned 4 [0114.553] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0114.553] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG") returned 74 [0114.553] lstrlenW (lpString=".1cd") returned 4 [0114.553] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0114.553] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG") returned 74 [0114.553] lstrlenW (lpString=".jpg") returned 4 [0114.553] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0114.599] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG") returned 74 [0114.599] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG") returned 74 [0114.599] lstrlenW (lpString=".doc") returned 4 [0114.599] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0114.599] lstrlenW (lpString=".docx") returned 5 [0114.599] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0114.599] lstrlenW (lpString=".pdf") returned 4 [0114.599] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0114.599] lstrlenW (lpString=".xls") returned 4 [0114.599] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0114.599] lstrlenW (lpString=".xlsx") returned 5 [0114.599] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0114.599] lstrlenW (lpString=".ppt") returned 4 [0114.599] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0114.599] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG") returned 74 [0114.599] lstrlenW (lpString=".zip") returned 4 [0114.599] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0114.599] lstrlenW (lpString=".rar") returned 4 [0114.599] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0114.599] lstrlenW (lpString=".bz2") returned 4 [0114.599] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0114.599] lstrlenW (lpString=".7z") returned 3 [0114.599] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0114.599] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG") returned 74 [0114.599] lstrlenW (lpString=".dbf") returned 4 [0114.599] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0114.599] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG") returned 74 [0114.599] lstrlenW (lpString=".1cd") returned 4 [0114.600] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0114.600] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG") returned 74 [0114.600] lstrlenW (lpString=".jpg") returned 4 [0114.600] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0114.600] lstrcmpiW (lpString1=".GIF", lpString2=".waifu") returned -1 [0114.600] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0114.600] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0114.601] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x37cfddc | out: lpFileSize=0x37cfddc*=937) returned 1 [0114.601] CloseHandle (hObject=0x1c0) returned 1 [0114.601] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\preview.gif")) returned 0x20 [0114.601] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\preview.gif.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0114.601] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0114.601] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0114.601] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0114.601] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\preview.gif.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0114.603] GetLastError () returned 0x0 [0114.603] ReadFile (in: hFile=0x1c0, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x3a9, lpOverlapped=0x0) returned 1 [0114.604] WriteFile (in: hFile=0x1f0, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0x3b0, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0x3b0, lpOverlapped=0x0) returned 1 [0114.605] ReadFile (in: hFile=0x1c0, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x0, lpOverlapped=0x0) returned 1 [0114.605] WriteFile (in: hFile=0x1f0, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0xea, lpOverlapped=0x0) returned 1 [0114.605] SetEndOfFile (hFile=0x1f0) returned 1 [0114.605] CloseHandle (hObject=0x1f0) returned 1 [0114.605] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0114.605] SetEndOfFile (hFile=0x1c0) returned 1 [0114.606] CloseHandle (hObject=0x1c0) returned 1 [0114.606] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0114.606] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\preview.gif")) returned 1 [0114.607] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF") returned 71 [0114.607] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF") returned 71 [0114.607] lstrlenW (lpString=".doc") returned 4 [0114.607] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0114.607] lstrlenW (lpString=".docx") returned 5 [0114.607] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0114.607] lstrlenW (lpString=".pdf") returned 4 [0114.607] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0114.607] lstrlenW (lpString=".xls") returned 4 [0114.607] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0114.607] lstrlenW (lpString=".xlsx") returned 5 [0114.607] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0114.607] lstrlenW (lpString=".ppt") returned 4 [0114.607] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0114.607] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF") returned 71 [0114.607] lstrlenW (lpString=".zip") returned 4 [0114.607] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0114.607] lstrlenW (lpString=".rar") returned 4 [0114.607] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0114.607] lstrlenW (lpString=".bz2") returned 4 [0114.607] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0114.607] lstrlenW (lpString=".7z") returned 3 [0114.607] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0114.607] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF") returned 71 [0114.607] lstrlenW (lpString=".dbf") returned 4 [0114.607] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0114.607] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF") returned 71 [0114.607] lstrlenW (lpString=".1cd") returned 4 [0114.607] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0114.607] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF") returned 71 [0114.607] lstrlenW (lpString=".jpg") returned 4 [0114.607] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0114.607] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF") returned 71 [0114.607] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF") returned 71 [0114.607] lstrlenW (lpString=".doc") returned 4 [0114.608] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0114.608] lstrlenW (lpString=".docx") returned 5 [0114.608] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0114.608] lstrlenW (lpString=".pdf") returned 4 [0114.608] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0114.608] lstrlenW (lpString=".xls") returned 4 [0114.608] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0114.608] lstrlenW (lpString=".xlsx") returned 5 [0114.608] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0114.608] lstrlenW (lpString=".ppt") returned 4 [0114.608] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0114.608] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF") returned 71 [0114.608] lstrlenW (lpString=".zip") returned 4 [0114.608] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0114.608] lstrlenW (lpString=".rar") returned 4 [0114.608] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0114.608] lstrlenW (lpString=".bz2") returned 4 [0114.608] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0114.608] lstrlenW (lpString=".7z") returned 3 [0114.608] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0114.608] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF") returned 71 [0114.608] lstrlenW (lpString=".dbf") returned 4 [0114.608] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0114.608] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF") returned 71 [0114.608] lstrlenW (lpString=".1cd") returned 4 [0114.608] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0114.608] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF") returned 71 [0114.608] lstrlenW (lpString=".jpg") returned 4 [0114.608] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0114.608] lstrcmpiW (lpString1=".PNG", lpString2=".waifu") returned -1 [0114.608] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0114.609] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0114.609] GetFileSizeEx (in: hFile=0x1c0, lpFileSize=0x37cfddc | out: lpFileSize=0x37cfddc*=29305) returned 1 [0114.609] CloseHandle (hObject=0x1c0) returned 1 [0114.609] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\thmbnail.png")) returned 0x20 [0114.609] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\thmbnail.png.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0114.609] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0114.609] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0114.609] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0114.609] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\thmbnail.png.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0114.610] GetLastError () returned 0x0 [0114.610] ReadFile (in: hFile=0x1c0, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x7279, lpOverlapped=0x0) returned 1 [0114.874] WriteFile (in: hFile=0x1f0, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0x7280, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0x7280, lpOverlapped=0x0) returned 1 [0114.875] ReadFile (in: hFile=0x1c0, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x0, lpOverlapped=0x0) returned 1 [0114.875] WriteFile (in: hFile=0x1f0, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0xec, lpOverlapped=0x0) returned 1 [0114.875] SetEndOfFile (hFile=0x1f0) returned 1 [0114.875] CloseHandle (hObject=0x1f0) returned 1 [0114.875] SetFilePointerEx (in: hFile=0x1c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0114.875] SetEndOfFile (hFile=0x1c0) returned 1 [0114.876] CloseHandle (hObject=0x1c0) returned 1 [0114.876] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0114.876] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\thmbnail.png")) returned 1 [0114.876] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG") returned 72 [0114.876] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG") returned 72 [0114.876] lstrlenW (lpString=".doc") returned 4 [0114.876] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0114.876] lstrlenW (lpString=".docx") returned 5 [0114.876] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0114.876] lstrlenW (lpString=".pdf") returned 4 [0114.876] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0114.876] lstrlenW (lpString=".xls") returned 4 [0114.876] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0114.876] lstrlenW (lpString=".xlsx") returned 5 [0114.876] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0114.876] lstrlenW (lpString=".ppt") returned 4 [0114.876] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0114.876] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG") returned 72 [0114.876] lstrlenW (lpString=".zip") returned 4 [0114.876] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0114.876] lstrlenW (lpString=".rar") returned 4 [0114.876] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0114.876] lstrlenW (lpString=".bz2") returned 4 [0114.877] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0114.877] lstrlenW (lpString=".7z") returned 3 [0114.877] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0114.877] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG") returned 72 [0114.877] lstrlenW (lpString=".dbf") returned 4 [0114.877] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0114.877] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG") returned 72 [0114.877] lstrlenW (lpString=".1cd") returned 4 [0114.877] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0114.877] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG") returned 72 [0114.877] lstrlenW (lpString=".jpg") returned 4 [0114.877] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0114.877] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG") returned 72 [0114.877] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG") returned 72 [0114.877] lstrlenW (lpString=".doc") returned 4 [0114.877] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0114.877] lstrlenW (lpString=".docx") returned 5 [0114.877] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0114.877] lstrlenW (lpString=".pdf") returned 4 [0114.877] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0114.877] lstrlenW (lpString=".xls") returned 4 [0114.877] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0114.877] lstrlenW (lpString=".xlsx") returned 5 [0114.877] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0114.877] lstrlenW (lpString=".ppt") returned 4 [0114.877] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0114.877] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG") returned 72 [0114.877] lstrlenW (lpString=".zip") returned 4 [0114.877] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0114.877] lstrlenW (lpString=".rar") returned 4 [0114.877] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0114.877] lstrlenW (lpString=".bz2") returned 4 [0114.877] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0114.877] lstrlenW (lpString=".7z") returned 3 [0114.877] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0114.877] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG") returned 72 [0114.877] lstrlenW (lpString=".dbf") returned 4 [0114.877] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0114.877] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG") returned 72 [0114.877] lstrlenW (lpString=".1cd") returned 4 [0114.877] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0114.877] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG") returned 72 [0114.877] lstrlenW (lpString=".jpg") returned 4 [0114.877] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0114.878] lstrcmpiW (lpString1=".PNG", lpString2=".waifu") returned -1 [0114.878] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0114.878] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0115.177] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x37cfddc | out: lpFileSize=0x37cfddc*=21812) returned 1 [0115.177] CloseHandle (hObject=0x20c) returned 1 [0115.177] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\thmbnail.png")) returned 0x20 [0115.177] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\thmbnail.png.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0115.177] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0115.177] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0115.177] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0115.177] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\thmbnail.png.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0115.178] GetLastError () returned 0x0 [0115.178] ReadFile (in: hFile=0x20c, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x5534, lpOverlapped=0x0) returned 1 [0115.180] WriteFile (in: hFile=0x1f0, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0x5540, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0x5540, lpOverlapped=0x0) returned 1 [0115.181] ReadFile (in: hFile=0x20c, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x0, lpOverlapped=0x0) returned 1 [0115.181] WriteFile (in: hFile=0x1f0, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0xec, lpOverlapped=0x0) returned 1 [0115.181] SetEndOfFile (hFile=0x1f0) returned 1 [0115.181] CloseHandle (hObject=0x1f0) returned 1 [0115.182] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0115.182] SetEndOfFile (hFile=0x20c) returned 1 [0115.182] CloseHandle (hObject=0x20c) returned 1 [0115.182] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0115.183] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\thmbnail.png")) returned 1 [0115.183] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG") returned 75 [0115.183] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG") returned 75 [0115.183] lstrlenW (lpString=".doc") returned 4 [0115.183] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0115.183] lstrlenW (lpString=".docx") returned 5 [0115.183] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0115.183] lstrlenW (lpString=".pdf") returned 4 [0115.183] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0115.183] lstrlenW (lpString=".xls") returned 4 [0115.183] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0115.183] lstrlenW (lpString=".xlsx") returned 5 [0115.183] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0115.183] lstrlenW (lpString=".ppt") returned 4 [0115.183] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0115.183] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG") returned 75 [0115.183] lstrlenW (lpString=".zip") returned 4 [0115.183] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0115.183] lstrlenW (lpString=".rar") returned 4 [0115.183] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0115.183] lstrlenW (lpString=".bz2") returned 4 [0115.183] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0115.183] lstrlenW (lpString=".7z") returned 3 [0115.183] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0115.184] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG") returned 75 [0115.184] lstrlenW (lpString=".dbf") returned 4 [0115.184] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0115.184] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG") returned 75 [0115.184] lstrlenW (lpString=".1cd") returned 4 [0115.184] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0115.184] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG") returned 75 [0115.184] lstrlenW (lpString=".jpg") returned 4 [0115.184] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0115.184] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG") returned 75 [0115.184] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG") returned 75 [0115.184] lstrlenW (lpString=".doc") returned 4 [0115.184] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0115.184] lstrlenW (lpString=".docx") returned 5 [0115.184] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0115.184] lstrlenW (lpString=".pdf") returned 4 [0115.184] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0115.184] lstrlenW (lpString=".xls") returned 4 [0115.184] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0115.184] lstrlenW (lpString=".xlsx") returned 5 [0115.184] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0115.184] lstrlenW (lpString=".ppt") returned 4 [0115.184] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0115.184] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG") returned 75 [0115.184] lstrlenW (lpString=".zip") returned 4 [0115.184] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0115.184] lstrlenW (lpString=".rar") returned 4 [0115.184] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0115.184] lstrlenW (lpString=".bz2") returned 4 [0115.184] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0115.184] lstrlenW (lpString=".7z") returned 3 [0115.184] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0115.184] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG") returned 75 [0115.184] lstrlenW (lpString=".dbf") returned 4 [0115.184] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0115.184] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG") returned 75 [0115.184] lstrlenW (lpString=".1cd") returned 4 [0115.184] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0115.184] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG") returned 75 [0115.184] lstrlenW (lpString=".jpg") returned 4 [0115.185] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0115.185] lstrcmpiW (lpString1=".PNG", lpString2=".waifu") returned -1 [0115.185] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0115.185] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0115.406] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x37cfddc | out: lpFileSize=0x37cfddc*=42453) returned 1 [0115.406] CloseHandle (hObject=0x1f0) returned 1 [0115.406] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\thmbnail.png")) returned 0x20 [0115.407] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\thmbnail.png.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0115.407] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0115.407] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0115.407] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0115.407] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\thmbnail.png.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0115.407] GetLastError () returned 0x0 [0115.407] ReadFile (in: hFile=0x1f0, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0xa5d5, lpOverlapped=0x0) returned 1 [0115.409] WriteFile (in: hFile=0x1c0, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0xa5e0, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0xa5e0, lpOverlapped=0x0) returned 1 [0115.410] ReadFile (in: hFile=0x1f0, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x0, lpOverlapped=0x0) returned 1 [0115.410] WriteFile (in: hFile=0x1c0, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0xec, lpOverlapped=0x0) returned 1 [0115.410] SetEndOfFile (hFile=0x1c0) returned 1 [0115.410] CloseHandle (hObject=0x1c0) returned 1 [0115.411] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0115.411] SetEndOfFile (hFile=0x1f0) returned 1 [0115.411] CloseHandle (hObject=0x1f0) returned 1 [0115.411] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0115.412] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\thmbnail.png")) returned 1 [0115.412] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG") returned 74 [0115.412] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG") returned 74 [0115.412] lstrlenW (lpString=".doc") returned 4 [0115.412] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0115.412] lstrlenW (lpString=".docx") returned 5 [0115.412] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0115.412] lstrlenW (lpString=".pdf") returned 4 [0115.412] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0115.412] lstrlenW (lpString=".xls") returned 4 [0115.412] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0115.412] lstrlenW (lpString=".xlsx") returned 5 [0115.412] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0115.412] lstrlenW (lpString=".ppt") returned 4 [0115.412] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0115.412] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG") returned 74 [0115.412] lstrlenW (lpString=".zip") returned 4 [0115.412] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0115.412] lstrlenW (lpString=".rar") returned 4 [0115.412] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0115.412] lstrlenW (lpString=".bz2") returned 4 [0115.412] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0115.412] lstrlenW (lpString=".7z") returned 3 [0115.412] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0115.412] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG") returned 74 [0115.412] lstrlenW (lpString=".dbf") returned 4 [0115.412] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0115.412] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG") returned 74 [0115.412] lstrlenW (lpString=".1cd") returned 4 [0115.412] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0115.412] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG") returned 74 [0115.412] lstrlenW (lpString=".jpg") returned 4 [0115.412] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0115.412] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG") returned 74 [0115.413] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG") returned 74 [0115.413] lstrlenW (lpString=".doc") returned 4 [0115.413] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0115.413] lstrlenW (lpString=".docx") returned 5 [0115.413] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0115.413] lstrlenW (lpString=".pdf") returned 4 [0115.413] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0115.413] lstrlenW (lpString=".xls") returned 4 [0115.413] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0115.413] lstrlenW (lpString=".xlsx") returned 5 [0115.413] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0115.413] lstrlenW (lpString=".ppt") returned 4 [0115.413] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0115.413] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG") returned 74 [0115.413] lstrlenW (lpString=".zip") returned 4 [0115.413] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0115.413] lstrlenW (lpString=".rar") returned 4 [0115.413] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0115.413] lstrlenW (lpString=".bz2") returned 4 [0115.413] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0115.413] lstrlenW (lpString=".7z") returned 3 [0115.413] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0115.413] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG") returned 74 [0115.413] lstrlenW (lpString=".dbf") returned 4 [0115.413] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0115.413] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG") returned 74 [0115.413] lstrlenW (lpString=".1cd") returned 4 [0115.413] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0115.413] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG") returned 74 [0115.413] lstrlenW (lpString=".jpg") returned 4 [0115.413] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0115.413] lstrcmpiW (lpString1=".png", lpString2=".waifu") returned -1 [0115.413] lstrlenW (lpString="16to9Squareframe_VideoInset.png") returned 31 [0115.413] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_videoinset.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0115.753] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x37cfddc | out: lpFileSize=0x37cfddc*=3316) returned 1 [0115.753] CloseHandle (hObject=0x1fc) returned 1 [0115.753] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_videoinset.png")) returned 0x20 [0115.753] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_videoinset.png.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0115.753] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_videoinset.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0115.753] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png") returned 75 [0115.753] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png") returned 75 [0115.753] lstrlenW (lpString=".doc") returned 4 [0115.753] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0115.753] lstrlenW (lpString=".docx") returned 5 [0115.753] lstrcmpiW (lpString1=".docx", lpString2="t.png") returned -1 [0115.753] lstrlenW (lpString=".pdf") returned 4 [0115.753] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0115.753] lstrlenW (lpString=".xls") returned 4 [0115.753] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0115.753] lstrlenW (lpString=".xlsx") returned 5 [0115.754] lstrcmpiW (lpString1=".xlsx", lpString2="t.png") returned -1 [0115.754] lstrlenW (lpString=".ppt") returned 4 [0115.754] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0115.754] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png") returned 75 [0115.754] lstrlenW (lpString=".zip") returned 4 [0115.754] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0115.754] lstrlenW (lpString=".rar") returned 4 [0115.754] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0115.754] lstrlenW (lpString=".bz2") returned 4 [0115.754] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0115.754] lstrlenW (lpString=".7z") returned 3 [0115.754] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0115.754] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png") returned 75 [0115.754] lstrlenW (lpString=".dbf") returned 4 [0115.754] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0115.754] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png") returned 75 [0115.754] lstrlenW (lpString=".1cd") returned 4 [0115.754] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0115.754] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png") returned 75 [0115.754] lstrlenW (lpString=".jpg") returned 4 [0115.754] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0115.754] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png") returned 75 [0115.754] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png") returned 75 [0115.754] lstrlenW (lpString=".doc") returned 4 [0115.754] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0115.754] lstrlenW (lpString=".docx") returned 5 [0115.754] lstrcmpiW (lpString1=".docx", lpString2="t.png") returned -1 [0115.754] lstrlenW (lpString=".pdf") returned 4 [0115.754] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0115.754] lstrlenW (lpString=".xls") returned 4 [0115.754] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0115.754] lstrlenW (lpString=".xlsx") returned 5 [0115.754] lstrcmpiW (lpString1=".xlsx", lpString2="t.png") returned -1 [0115.754] lstrlenW (lpString=".ppt") returned 4 [0115.754] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0115.754] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png") returned 75 [0115.755] lstrlenW (lpString=".zip") returned 4 [0115.755] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0115.755] lstrlenW (lpString=".rar") returned 4 [0115.755] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0115.755] lstrlenW (lpString=".bz2") returned 4 [0115.755] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0115.755] lstrlenW (lpString=".7z") returned 3 [0115.755] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0115.755] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png") returned 75 [0115.755] lstrlenW (lpString=".dbf") returned 4 [0115.755] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0115.755] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png") returned 75 [0115.755] lstrlenW (lpString=".1cd") returned 4 [0115.755] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0115.755] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png") returned 75 [0115.755] lstrlenW (lpString=".jpg") returned 4 [0115.755] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0115.755] lstrcmpiW (lpString1=".wmv", lpString2=".waifu") returned 1 [0115.755] lstrlenW (lpString="BabyBoyNotesBackground.wmv") returned 26 [0115.755] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboynotesbackground.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0116.116] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x37cfddc | out: lpFileSize=0x37cfddc*=157292) returned 1 [0116.116] CloseHandle (hObject=0x218) returned 1 [0116.116] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboynotesbackground.wmv")) returned 0x20 [0116.116] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground.wmv.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboynotesbackground.wmv.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0116.116] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboynotesbackground.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0116.116] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground.wmv") returned 78 [0116.116] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground.wmv") returned 78 [0116.116] lstrlenW (lpString=".doc") returned 4 [0116.116] lstrcmpiW (lpString1=".doc", lpString2=".wmv") returned -1 [0116.116] lstrlenW (lpString=".docx") returned 5 [0116.116] lstrcmpiW (lpString1=".docx", lpString2="d.wmv") returned -1 [0116.116] lstrlenW (lpString=".pdf") returned 4 [0116.116] lstrcmpiW (lpString1=".pdf", lpString2=".wmv") returned -1 [0116.116] lstrlenW (lpString=".xls") returned 4 [0116.116] lstrcmpiW (lpString1=".xls", lpString2=".wmv") returned 1 [0116.116] lstrlenW (lpString=".xlsx") returned 5 [0116.116] lstrcmpiW (lpString1=".xlsx", lpString2="d.wmv") returned -1 [0116.116] lstrlenW (lpString=".ppt") returned 4 [0116.116] lstrcmpiW (lpString1=".ppt", lpString2=".wmv") returned -1 [0116.116] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground.wmv") returned 78 [0116.116] lstrlenW (lpString=".zip") returned 4 [0116.116] lstrcmpiW (lpString1=".zip", lpString2=".wmv") returned 1 [0116.116] lstrlenW (lpString=".rar") returned 4 [0116.116] lstrcmpiW (lpString1=".rar", lpString2=".wmv") returned -1 [0116.116] lstrlenW (lpString=".bz2") returned 4 [0116.116] lstrcmpiW (lpString1=".bz2", lpString2=".wmv") returned -1 [0116.116] lstrlenW (lpString=".7z") returned 3 [0116.116] lstrcmpiW (lpString1=".7z", lpString2="wmv") returned -1 [0116.116] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground.wmv") returned 78 [0116.116] lstrlenW (lpString=".dbf") returned 4 [0116.116] lstrcmpiW (lpString1=".dbf", lpString2=".wmv") returned -1 [0116.116] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground.wmv") returned 78 [0116.116] lstrlenW (lpString=".1cd") returned 4 [0116.116] lstrcmpiW (lpString1=".1cd", lpString2=".wmv") returned -1 [0116.116] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground.wmv") returned 78 [0116.116] lstrlenW (lpString=".jpg") returned 4 [0116.116] lstrcmpiW (lpString1=".jpg", lpString2=".wmv") returned -1 [0116.117] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground.wmv") returned 78 [0116.117] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground.wmv") returned 78 [0116.117] lstrlenW (lpString=".doc") returned 4 [0116.117] lstrcmpiW (lpString1=".doc", lpString2=".wmv") returned -1 [0116.117] lstrlenW (lpString=".docx") returned 5 [0116.117] lstrcmpiW (lpString1=".docx", lpString2="d.wmv") returned -1 [0116.117] lstrlenW (lpString=".pdf") returned 4 [0116.117] lstrcmpiW (lpString1=".pdf", lpString2=".wmv") returned -1 [0116.117] lstrlenW (lpString=".xls") returned 4 [0116.117] lstrcmpiW (lpString1=".xls", lpString2=".wmv") returned 1 [0116.117] lstrlenW (lpString=".xlsx") returned 5 [0116.117] lstrcmpiW (lpString1=".xlsx", lpString2="d.wmv") returned -1 [0116.117] lstrlenW (lpString=".ppt") returned 4 [0116.117] lstrcmpiW (lpString1=".ppt", lpString2=".wmv") returned -1 [0116.117] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground.wmv") returned 78 [0116.117] lstrlenW (lpString=".zip") returned 4 [0116.117] lstrcmpiW (lpString1=".zip", lpString2=".wmv") returned 1 [0116.117] lstrlenW (lpString=".rar") returned 4 [0116.117] lstrcmpiW (lpString1=".rar", lpString2=".wmv") returned -1 [0116.117] lstrlenW (lpString=".bz2") returned 4 [0116.117] lstrcmpiW (lpString1=".bz2", lpString2=".wmv") returned -1 [0116.117] lstrlenW (lpString=".7z") returned 3 [0116.117] lstrcmpiW (lpString1=".7z", lpString2="wmv") returned -1 [0116.117] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground.wmv") returned 78 [0116.117] lstrlenW (lpString=".dbf") returned 4 [0116.117] lstrcmpiW (lpString1=".dbf", lpString2=".wmv") returned -1 [0116.117] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground.wmv") returned 78 [0116.117] lstrlenW (lpString=".1cd") returned 4 [0116.117] lstrcmpiW (lpString1=".1cd", lpString2=".wmv") returned -1 [0116.117] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground.wmv") returned 78 [0116.117] lstrlenW (lpString=".jpg") returned 4 [0116.117] lstrcmpiW (lpString1=".jpg", lpString2=".wmv") returned -1 [0116.117] lstrcmpiW (lpString1=".wmv", lpString2=".waifu") returned 1 [0116.117] lstrlenW (lpString="BabyBoyScenesBackground.wmv") returned 27 [0116.117] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboyscenesbackground.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0116.118] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x37cfddc | out: lpFileSize=0x37cfddc*=149292) returned 1 [0116.118] CloseHandle (hObject=0x218) returned 1 [0116.118] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboyscenesbackground.wmv")) returned 0x20 [0116.119] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground.wmv.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboyscenesbackground.wmv.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0116.119] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboyscenesbackground.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0116.119] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground.wmv") returned 79 [0116.119] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground.wmv") returned 79 [0116.119] lstrlenW (lpString=".doc") returned 4 [0116.119] lstrcmpiW (lpString1=".doc", lpString2=".wmv") returned -1 [0116.119] lstrlenW (lpString=".docx") returned 5 [0116.119] lstrcmpiW (lpString1=".docx", lpString2="d.wmv") returned -1 [0116.119] lstrlenW (lpString=".pdf") returned 4 [0116.119] lstrcmpiW (lpString1=".pdf", lpString2=".wmv") returned -1 [0116.119] lstrlenW (lpString=".xls") returned 4 [0116.119] lstrcmpiW (lpString1=".xls", lpString2=".wmv") returned 1 [0116.119] lstrlenW (lpString=".xlsx") returned 5 [0116.119] lstrcmpiW (lpString1=".xlsx", lpString2="d.wmv") returned -1 [0116.119] lstrlenW (lpString=".ppt") returned 4 [0116.119] lstrcmpiW (lpString1=".ppt", lpString2=".wmv") returned -1 [0116.119] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground.wmv") returned 79 [0116.119] lstrlenW (lpString=".zip") returned 4 [0116.119] lstrcmpiW (lpString1=".zip", lpString2=".wmv") returned 1 [0116.119] lstrlenW (lpString=".rar") returned 4 [0116.119] lstrcmpiW (lpString1=".rar", lpString2=".wmv") returned -1 [0116.119] lstrlenW (lpString=".bz2") returned 4 [0116.119] lstrcmpiW (lpString1=".bz2", lpString2=".wmv") returned -1 [0116.119] lstrlenW (lpString=".7z") returned 3 [0116.119] lstrcmpiW (lpString1=".7z", lpString2="wmv") returned -1 [0116.119] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground.wmv") returned 79 [0116.119] lstrlenW (lpString=".dbf") returned 4 [0116.119] lstrcmpiW (lpString1=".dbf", lpString2=".wmv") returned -1 [0116.119] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground.wmv") returned 79 [0116.119] lstrlenW (lpString=".1cd") returned 4 [0116.119] lstrcmpiW (lpString1=".1cd", lpString2=".wmv") returned -1 [0116.119] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground.wmv") returned 79 [0116.120] lstrlenW (lpString=".jpg") returned 4 [0116.120] lstrcmpiW (lpString1=".jpg", lpString2=".wmv") returned -1 [0116.120] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground.wmv") returned 79 [0116.120] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground.wmv") returned 79 [0116.120] lstrlenW (lpString=".doc") returned 4 [0116.120] lstrcmpiW (lpString1=".doc", lpString2=".wmv") returned -1 [0116.120] lstrlenW (lpString=".docx") returned 5 [0116.120] lstrcmpiW (lpString1=".docx", lpString2="d.wmv") returned -1 [0116.120] lstrlenW (lpString=".pdf") returned 4 [0116.120] lstrcmpiW (lpString1=".pdf", lpString2=".wmv") returned -1 [0116.120] lstrlenW (lpString=".xls") returned 4 [0116.120] lstrcmpiW (lpString1=".xls", lpString2=".wmv") returned 1 [0116.120] lstrlenW (lpString=".xlsx") returned 5 [0116.120] lstrcmpiW (lpString1=".xlsx", lpString2="d.wmv") returned -1 [0116.120] lstrlenW (lpString=".ppt") returned 4 [0116.120] lstrcmpiW (lpString1=".ppt", lpString2=".wmv") returned -1 [0116.120] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground.wmv") returned 79 [0116.120] lstrlenW (lpString=".zip") returned 4 [0116.120] lstrcmpiW (lpString1=".zip", lpString2=".wmv") returned 1 [0116.120] lstrlenW (lpString=".rar") returned 4 [0116.120] lstrcmpiW (lpString1=".rar", lpString2=".wmv") returned -1 [0116.120] lstrlenW (lpString=".bz2") returned 4 [0116.120] lstrcmpiW (lpString1=".bz2", lpString2=".wmv") returned -1 [0116.120] lstrlenW (lpString=".7z") returned 3 [0116.120] lstrcmpiW (lpString1=".7z", lpString2="wmv") returned -1 [0116.120] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground.wmv") returned 79 [0116.120] lstrlenW (lpString=".dbf") returned 4 [0116.120] lstrcmpiW (lpString1=".dbf", lpString2=".wmv") returned -1 [0116.120] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground.wmv") returned 79 [0116.120] lstrlenW (lpString=".1cd") returned 4 [0116.120] lstrcmpiW (lpString1=".1cd", lpString2=".wmv") returned -1 [0116.120] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground.wmv") returned 79 [0116.120] lstrlenW (lpString=".jpg") returned 4 [0116.120] lstrcmpiW (lpString1=".jpg", lpString2=".wmv") returned -1 [0116.121] lstrcmpiW (lpString1=".wmv", lpString2=".waifu") returned 1 [0116.121] lstrlenW (lpString="BabyBoyScenesBackground_PAL.wmv") returned 31 [0116.121] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboyscenesbackground_pal.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0116.121] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x37cfddc | out: lpFileSize=0x37cfddc*=125292) returned 1 [0116.121] CloseHandle (hObject=0x218) returned 1 [0116.121] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboyscenesbackground_pal.wmv")) returned 0x20 [0116.121] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground_PAL.wmv.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboyscenesbackground_pal.wmv.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0116.121] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboyscenesbackground_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0116.121] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground_PAL.wmv") returned 83 [0116.121] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground_PAL.wmv") returned 83 [0116.121] lstrlenW (lpString=".doc") returned 4 [0116.121] lstrcmpiW (lpString1=".doc", lpString2=".wmv") returned -1 [0116.121] lstrlenW (lpString=".docx") returned 5 [0116.121] lstrcmpiW (lpString1=".docx", lpString2="L.wmv") returned -1 [0116.121] lstrlenW (lpString=".pdf") returned 4 [0116.122] lstrcmpiW (lpString1=".pdf", lpString2=".wmv") returned -1 [0116.122] lstrlenW (lpString=".xls") returned 4 [0116.122] lstrcmpiW (lpString1=".xls", lpString2=".wmv") returned 1 [0116.122] lstrlenW (lpString=".xlsx") returned 5 [0116.122] lstrcmpiW (lpString1=".xlsx", lpString2="L.wmv") returned -1 [0116.122] lstrlenW (lpString=".ppt") returned 4 [0116.122] lstrcmpiW (lpString1=".ppt", lpString2=".wmv") returned -1 [0116.122] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground_PAL.wmv") returned 83 [0116.122] lstrlenW (lpString=".zip") returned 4 [0116.122] lstrcmpiW (lpString1=".zip", lpString2=".wmv") returned 1 [0116.122] lstrlenW (lpString=".rar") returned 4 [0116.122] lstrcmpiW (lpString1=".rar", lpString2=".wmv") returned -1 [0116.122] lstrlenW (lpString=".bz2") returned 4 [0116.122] lstrcmpiW (lpString1=".bz2", lpString2=".wmv") returned -1 [0116.122] lstrlenW (lpString=".7z") returned 3 [0116.122] lstrcmpiW (lpString1=".7z", lpString2="wmv") returned -1 [0116.122] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground_PAL.wmv") returned 83 [0116.122] lstrlenW (lpString=".dbf") returned 4 [0116.122] lstrcmpiW (lpString1=".dbf", lpString2=".wmv") returned -1 [0116.122] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground_PAL.wmv") returned 83 [0116.122] lstrlenW (lpString=".1cd") returned 4 [0116.122] lstrcmpiW (lpString1=".1cd", lpString2=".wmv") returned -1 [0116.122] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground_PAL.wmv") returned 83 [0116.122] lstrlenW (lpString=".jpg") returned 4 [0116.122] lstrcmpiW (lpString1=".jpg", lpString2=".wmv") returned -1 [0116.122] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground_PAL.wmv") returned 83 [0116.122] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground_PAL.wmv") returned 83 [0116.122] lstrlenW (lpString=".doc") returned 4 [0116.122] lstrcmpiW (lpString1=".doc", lpString2=".wmv") returned -1 [0116.122] lstrlenW (lpString=".docx") returned 5 [0116.122] lstrcmpiW (lpString1=".docx", lpString2="L.wmv") returned -1 [0116.122] lstrlenW (lpString=".pdf") returned 4 [0116.122] lstrcmpiW (lpString1=".pdf", lpString2=".wmv") returned -1 [0116.122] lstrlenW (lpString=".xls") returned 4 [0116.122] lstrcmpiW (lpString1=".xls", lpString2=".wmv") returned 1 [0116.122] lstrlenW (lpString=".xlsx") returned 5 [0116.122] lstrcmpiW (lpString1=".xlsx", lpString2="L.wmv") returned -1 [0116.123] lstrlenW (lpString=".ppt") returned 4 [0116.123] lstrcmpiW (lpString1=".ppt", lpString2=".wmv") returned -1 [0116.123] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground_PAL.wmv") returned 83 [0116.123] lstrlenW (lpString=".zip") returned 4 [0116.123] lstrcmpiW (lpString1=".zip", lpString2=".wmv") returned 1 [0116.123] lstrlenW (lpString=".rar") returned 4 [0116.123] lstrcmpiW (lpString1=".rar", lpString2=".wmv") returned -1 [0116.123] lstrlenW (lpString=".bz2") returned 4 [0116.123] lstrcmpiW (lpString1=".bz2", lpString2=".wmv") returned -1 [0116.123] lstrlenW (lpString=".7z") returned 3 [0116.123] lstrcmpiW (lpString1=".7z", lpString2="wmv") returned -1 [0116.123] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground_PAL.wmv") returned 83 [0116.123] lstrlenW (lpString=".dbf") returned 4 [0116.123] lstrcmpiW (lpString1=".dbf", lpString2=".wmv") returned -1 [0116.123] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground_PAL.wmv") returned 83 [0116.123] lstrlenW (lpString=".1cd") returned 4 [0116.123] lstrcmpiW (lpString1=".1cd", lpString2=".wmv") returned -1 [0116.123] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground_PAL.wmv") returned 83 [0116.123] lstrlenW (lpString=".jpg") returned 4 [0116.123] lstrcmpiW (lpString1=".jpg", lpString2=".wmv") returned -1 [0116.123] lstrcmpiW (lpString1=".PNG", lpString2=".waifu") returned -1 [0116.123] lstrlenW (lpString="LightBlueRectangle.PNG") returned 22 [0116.123] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\LightBlueRectangle.PNG" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\lightbluerectangle.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0116.124] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x37cfddc | out: lpFileSize=0x37cfddc*=220) returned 1 [0116.124] CloseHandle (hObject=0x218) returned 1 [0116.124] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\LightBlueRectangle.PNG" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\lightbluerectangle.png")) returned 0x20 [0116.124] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\LightBlueRectangle.PNG.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\lightbluerectangle.png.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0116.124] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\LightBlueRectangle.PNG" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\lightbluerectangle.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0116.124] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\LightBlueRectangle.PNG") returned 74 [0116.124] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\LightBlueRectangle.PNG") returned 74 [0116.124] lstrlenW (lpString=".doc") returned 4 [0116.124] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0116.124] lstrlenW (lpString=".docx") returned 5 [0116.124] lstrcmpiW (lpString1=".docx", lpString2="e.PNG") returned -1 [0116.124] lstrlenW (lpString=".pdf") returned 4 [0116.124] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0116.124] lstrlenW (lpString=".xls") returned 4 [0116.124] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0116.124] lstrlenW (lpString=".xlsx") returned 5 [0116.124] lstrcmpiW (lpString1=".xlsx", lpString2="e.PNG") returned -1 [0116.124] lstrlenW (lpString=".ppt") returned 4 [0116.124] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0116.124] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\LightBlueRectangle.PNG") returned 74 [0116.124] lstrlenW (lpString=".zip") returned 4 [0116.124] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0116.124] lstrlenW (lpString=".rar") returned 4 [0116.124] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0116.124] lstrlenW (lpString=".bz2") returned 4 [0116.124] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0116.125] lstrlenW (lpString=".7z") returned 3 [0116.125] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0116.125] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\LightBlueRectangle.PNG") returned 74 [0116.125] lstrlenW (lpString=".dbf") returned 4 [0116.125] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0116.125] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\LightBlueRectangle.PNG") returned 74 [0116.125] lstrlenW (lpString=".1cd") returned 4 [0116.125] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0116.125] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\LightBlueRectangle.PNG") returned 74 [0116.125] lstrlenW (lpString=".jpg") returned 4 [0116.125] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0116.125] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\LightBlueRectangle.PNG") returned 74 [0116.125] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\LightBlueRectangle.PNG") returned 74 [0116.125] lstrlenW (lpString=".doc") returned 4 [0116.125] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0116.125] lstrlenW (lpString=".docx") returned 5 [0116.125] lstrcmpiW (lpString1=".docx", lpString2="e.PNG") returned -1 [0116.125] lstrlenW (lpString=".pdf") returned 4 [0116.125] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0116.125] lstrlenW (lpString=".xls") returned 4 [0116.125] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0116.125] lstrlenW (lpString=".xlsx") returned 5 [0116.125] lstrcmpiW (lpString1=".xlsx", lpString2="e.PNG") returned -1 [0116.125] lstrlenW (lpString=".ppt") returned 4 [0116.125] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0116.125] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\LightBlueRectangle.PNG") returned 74 [0116.125] lstrlenW (lpString=".zip") returned 4 [0116.125] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0116.125] lstrlenW (lpString=".rar") returned 4 [0116.125] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0116.125] lstrlenW (lpString=".bz2") returned 4 [0116.125] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0116.125] lstrlenW (lpString=".7z") returned 3 [0116.125] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0116.125] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\LightBlueRectangle.PNG") returned 74 [0116.125] lstrlenW (lpString=".dbf") returned 4 [0116.125] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0116.126] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\LightBlueRectangle.PNG") returned 74 [0116.126] lstrlenW (lpString=".1cd") returned 4 [0116.126] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0116.126] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\LightBlueRectangle.PNG") returned 74 [0116.126] lstrlenW (lpString=".jpg") returned 4 [0116.126] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0116.818] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x37cfddc | out: lpFileSize=0x37cfddc*=30948) returned 1 [0116.818] CloseHandle (hObject=0x1ec) returned 1 [0116.818] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\informix.xsl")) returned 0x20 [0116.818] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\informix.xsl.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0116.819] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\informix.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0116.819] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0116.819] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0116.819] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\informix.xsl.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0116.819] GetLastError () returned 0x0 [0116.819] ReadFile (in: hFile=0x1ec, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x78e4, lpOverlapped=0x0) returned 1 [0116.830] WriteFile (in: hFile=0x1f8, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0x78f0, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0x78f0, lpOverlapped=0x0) returned 1 [0116.831] ReadFile (in: hFile=0x1ec, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x0, lpOverlapped=0x0) returned 1 [0116.831] WriteFile (in: hFile=0x1f8, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0xec, lpOverlapped=0x0) returned 1 [0116.831] SetEndOfFile (hFile=0x1f8) returned 1 [0116.831] CloseHandle (hObject=0x1f8) returned 1 [0116.832] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0116.832] SetEndOfFile (hFile=0x1ec) returned 1 [0116.832] CloseHandle (hObject=0x1ec) returned 1 [0116.832] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0116.833] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\informix.xsl")) returned 1 [0116.833] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl") returned 80 [0116.833] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl") returned 80 [0116.833] lstrlenW (lpString=".doc") returned 4 [0116.833] lstrcmpiW (lpString1=".doc", lpString2=".xsl") returned -1 [0116.833] lstrlenW (lpString=".docx") returned 5 [0116.833] lstrcmpiW (lpString1=".docx", lpString2="x.xsl") returned -1 [0116.833] lstrlenW (lpString=".pdf") returned 4 [0116.833] lstrcmpiW (lpString1=".pdf", lpString2=".xsl") returned -1 [0116.833] lstrlenW (lpString=".xls") returned 4 [0116.833] lstrcmpiW (lpString1=".xls", lpString2=".xsl") returned -1 [0116.833] lstrlenW (lpString=".xlsx") returned 5 [0116.833] lstrcmpiW (lpString1=".xlsx", lpString2="x.xsl") returned -1 [0116.833] lstrlenW (lpString=".ppt") returned 4 [0116.833] lstrcmpiW (lpString1=".ppt", lpString2=".xsl") returned -1 [0116.833] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl") returned 80 [0116.833] lstrlenW (lpString=".zip") returned 4 [0116.833] lstrcmpiW (lpString1=".zip", lpString2=".xsl") returned 1 [0116.833] lstrlenW (lpString=".rar") returned 4 [0116.833] lstrcmpiW (lpString1=".rar", lpString2=".xsl") returned -1 [0116.834] lstrlenW (lpString=".bz2") returned 4 [0116.834] lstrcmpiW (lpString1=".bz2", lpString2=".xsl") returned -1 [0116.834] lstrlenW (lpString=".7z") returned 3 [0116.834] lstrcmpiW (lpString1=".7z", lpString2="xsl") returned -1 [0116.834] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl") returned 80 [0116.834] lstrlenW (lpString=".dbf") returned 4 [0116.834] lstrcmpiW (lpString1=".dbf", lpString2=".xsl") returned -1 [0116.834] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl") returned 80 [0116.834] lstrlenW (lpString=".1cd") returned 4 [0116.834] lstrcmpiW (lpString1=".1cd", lpString2=".xsl") returned -1 [0116.834] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl") returned 80 [0116.834] lstrlenW (lpString=".jpg") returned 4 [0116.834] lstrcmpiW (lpString1=".jpg", lpString2=".xsl") returned -1 [0117.558] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x37cfddc | out: lpFileSize=0x37cfddc*=34076) returned 1 [0117.558] CloseHandle (hObject=0x1e0) returned 1 [0117.558] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql2000.xsl")) returned 0x20 [0117.558] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql2000.xsl.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0117.558] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql2000.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0117.559] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0117.559] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0117.559] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql2000.xsl.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0117.560] GetLastError () returned 0x0 [0117.560] ReadFile (in: hFile=0x1e0, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x851c, lpOverlapped=0x0) returned 1 [0117.574] WriteFile (in: hFile=0x20c, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0x8520, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0x8520, lpOverlapped=0x0) returned 1 [0117.575] ReadFile (in: hFile=0x1e0, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x0, lpOverlapped=0x0) returned 1 [0117.575] WriteFile (in: hFile=0x20c, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0xea, lpOverlapped=0x0) returned 1 [0117.576] SetEndOfFile (hFile=0x20c) returned 1 [0117.576] CloseHandle (hObject=0x20c) returned 1 [0117.576] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0117.576] SetEndOfFile (hFile=0x1e0) returned 1 [0117.577] CloseHandle (hObject=0x1e0) returned 1 [0117.577] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0117.578] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql2000.xsl")) returned 1 [0117.578] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl") returned 79 [0117.578] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl") returned 79 [0117.578] lstrlenW (lpString=".doc") returned 4 [0117.578] lstrcmpiW (lpString1=".doc", lpString2=".xsl") returned -1 [0117.578] lstrlenW (lpString=".docx") returned 5 [0117.578] lstrcmpiW (lpString1=".docx", lpString2="0.xsl") returned -1 [0117.578] lstrlenW (lpString=".pdf") returned 4 [0117.578] lstrcmpiW (lpString1=".pdf", lpString2=".xsl") returned -1 [0117.578] lstrlenW (lpString=".xls") returned 4 [0117.578] lstrcmpiW (lpString1=".xls", lpString2=".xsl") returned -1 [0117.578] lstrlenW (lpString=".xlsx") returned 5 [0117.578] lstrcmpiW (lpString1=".xlsx", lpString2="0.xsl") returned -1 [0117.578] lstrlenW (lpString=".ppt") returned 4 [0117.578] lstrcmpiW (lpString1=".ppt", lpString2=".xsl") returned -1 [0117.578] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl") returned 79 [0117.578] lstrlenW (lpString=".zip") returned 4 [0117.578] lstrcmpiW (lpString1=".zip", lpString2=".xsl") returned 1 [0117.578] lstrlenW (lpString=".rar") returned 4 [0117.578] lstrcmpiW (lpString1=".rar", lpString2=".xsl") returned -1 [0117.578] lstrlenW (lpString=".bz2") returned 4 [0117.578] lstrcmpiW (lpString1=".bz2", lpString2=".xsl") returned -1 [0117.578] lstrlenW (lpString=".7z") returned 3 [0117.578] lstrcmpiW (lpString1=".7z", lpString2="xsl") returned -1 [0117.579] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl") returned 79 [0117.579] lstrlenW (lpString=".dbf") returned 4 [0117.579] lstrcmpiW (lpString1=".dbf", lpString2=".xsl") returned -1 [0117.579] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl") returned 79 [0117.579] lstrlenW (lpString=".1cd") returned 4 [0117.579] lstrcmpiW (lpString1=".1cd", lpString2=".xsl") returned -1 [0117.579] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl") returned 79 [0117.579] lstrlenW (lpString=".jpg") returned 4 [0117.579] lstrcmpiW (lpString1=".jpg", lpString2=".xsl") returned -1 [0117.580] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0117.580] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0117.581] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00011_.gif.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0117.581] GetLastError () returned 0x0 [0117.581] ReadFile (in: hFile=0x1e0, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x1c30, lpOverlapped=0x0) returned 1 [0117.588] WriteFile (in: hFile=0x20c, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0x1c40, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0x1c40, lpOverlapped=0x0) returned 1 [0117.592] ReadFile (in: hFile=0x1e0, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x0, lpOverlapped=0x0) returned 1 [0117.592] WriteFile (in: hFile=0x20c, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0xec, lpOverlapped=0x0) returned 1 [0117.592] SetEndOfFile (hFile=0x20c) returned 1 [0117.592] CloseHandle (hObject=0x20c) returned 1 [0117.592] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0117.592] SetEndOfFile (hFile=0x1e0) returned 1 [0117.593] CloseHandle (hObject=0x1e0) returned 1 [0117.593] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0117.593] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00011_.gif")) returned 1 [0117.594] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 63 [0117.594] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 63 [0117.594] lstrlenW (lpString=".doc") returned 4 [0117.594] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0117.594] lstrlenW (lpString=".docx") returned 5 [0117.594] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0117.594] lstrlenW (lpString=".pdf") returned 4 [0117.594] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0117.594] lstrlenW (lpString=".xls") returned 4 [0117.594] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0117.594] lstrlenW (lpString=".xlsx") returned 5 [0117.594] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0117.594] lstrlenW (lpString=".ppt") returned 4 [0117.594] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0117.594] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 63 [0117.594] lstrlenW (lpString=".zip") returned 4 [0117.594] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0117.594] lstrlenW (lpString=".rar") returned 4 [0117.594] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0117.594] lstrlenW (lpString=".bz2") returned 4 [0117.594] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0117.594] lstrlenW (lpString=".7z") returned 3 [0117.594] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0117.594] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 63 [0117.594] lstrlenW (lpString=".dbf") returned 4 [0117.594] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0117.594] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 63 [0117.594] lstrlenW (lpString=".1cd") returned 4 [0117.594] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0117.594] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 63 [0117.594] lstrlenW (lpString=".jpg") returned 4 [0117.594] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0117.703] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0117.703] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0117.703] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00021_.gif.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0117.703] GetLastError () returned 0x0 [0117.703] ReadFile (in: hFile=0x1f8, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x3a19, lpOverlapped=0x0) returned 1 [0117.754] WriteFile (in: hFile=0x180, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0x3a20, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0x3a20, lpOverlapped=0x0) returned 1 [0117.755] ReadFile (in: hFile=0x1f8, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x0, lpOverlapped=0x0) returned 1 [0117.755] WriteFile (in: hFile=0x180, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0xec, lpOverlapped=0x0) returned 1 [0117.755] SetEndOfFile (hFile=0x180) returned 1 [0117.755] CloseHandle (hObject=0x180) returned 1 [0117.755] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0117.755] SetEndOfFile (hFile=0x1f8) returned 1 [0117.756] CloseHandle (hObject=0x1f8) returned 1 [0117.756] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0117.756] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00021_.gif")) returned 1 [0117.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 63 [0117.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 63 [0117.756] lstrlenW (lpString=".doc") returned 4 [0117.756] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0117.756] lstrlenW (lpString=".docx") returned 5 [0117.756] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0117.756] lstrlenW (lpString=".pdf") returned 4 [0117.757] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0117.757] lstrlenW (lpString=".xls") returned 4 [0117.757] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0117.757] lstrlenW (lpString=".xlsx") returned 5 [0117.757] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0117.757] lstrlenW (lpString=".ppt") returned 4 [0117.757] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0117.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 63 [0117.757] lstrlenW (lpString=".zip") returned 4 [0117.757] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0117.757] lstrlenW (lpString=".rar") returned 4 [0117.757] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0117.757] lstrlenW (lpString=".bz2") returned 4 [0117.757] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0117.757] lstrlenW (lpString=".7z") returned 3 [0117.757] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0117.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 63 [0117.757] lstrlenW (lpString=".dbf") returned 4 [0117.757] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0117.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 63 [0117.757] lstrlenW (lpString=".1cd") returned 4 [0117.757] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0117.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 63 [0117.757] lstrlenW (lpString=".jpg") returned 4 [0117.757] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0117.757] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x37cfddc | out: lpFileSize=0x37cfddc*=5030) returned 1 [0117.757] CloseHandle (hObject=0x1f8) returned 1 [0117.758] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00158_.gif")) returned 0x20 [0117.758] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00158_.gif.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0117.758] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00158_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0117.758] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0117.758] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0117.758] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00158_.gif.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0117.758] GetLastError () returned 0x0 [0117.758] ReadFile (in: hFile=0x1f8, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x13a6, lpOverlapped=0x0) returned 1 [0117.783] WriteFile (in: hFile=0x180, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0x13b0, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0x13b0, lpOverlapped=0x0) returned 1 [0117.784] ReadFile (in: hFile=0x1f8, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x0, lpOverlapped=0x0) returned 1 [0117.784] WriteFile (in: hFile=0x180, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0xec, lpOverlapped=0x0) returned 1 [0117.784] SetEndOfFile (hFile=0x180) returned 1 [0117.788] CloseHandle (hObject=0x180) returned 1 [0117.789] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0117.789] SetEndOfFile (hFile=0x1f8) returned 1 [0117.789] CloseHandle (hObject=0x1f8) returned 1 [0117.789] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0117.789] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00158_.gif")) returned 1 [0117.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 63 [0117.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 63 [0117.790] lstrlenW (lpString=".doc") returned 4 [0117.790] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0117.790] lstrlenW (lpString=".docx") returned 5 [0117.790] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0117.790] lstrlenW (lpString=".pdf") returned 4 [0117.790] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0117.790] lstrlenW (lpString=".xls") returned 4 [0117.790] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0117.790] lstrlenW (lpString=".xlsx") returned 5 [0117.790] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0117.790] lstrlenW (lpString=".ppt") returned 4 [0117.790] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0117.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 63 [0117.790] lstrlenW (lpString=".zip") returned 4 [0117.790] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0117.790] lstrlenW (lpString=".rar") returned 4 [0117.790] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0117.790] lstrlenW (lpString=".bz2") returned 4 [0117.790] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0117.790] lstrlenW (lpString=".7z") returned 3 [0117.790] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0117.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 63 [0117.790] lstrlenW (lpString=".dbf") returned 4 [0117.790] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0117.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 63 [0117.790] lstrlenW (lpString=".1cd") returned 4 [0117.790] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0117.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 63 [0117.790] lstrlenW (lpString=".jpg") returned 4 [0117.790] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0117.791] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x37cfddc | out: lpFileSize=0x37cfddc*=13254) returned 1 [0117.791] CloseHandle (hObject=0x1f8) returned 1 [0117.791] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00164_.gif")) returned 0x20 [0117.791] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00164_.gif.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0117.791] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00164_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0117.791] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0117.791] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0117.791] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00164_.gif.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0117.791] GetLastError () returned 0x0 [0117.791] ReadFile (in: hFile=0x1f8, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x33c6, lpOverlapped=0x0) returned 1 [0117.807] WriteFile (in: hFile=0x180, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0x33d0, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0x33d0, lpOverlapped=0x0) returned 1 [0117.807] ReadFile (in: hFile=0x1f8, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x0, lpOverlapped=0x0) returned 1 [0117.808] WriteFile (in: hFile=0x180, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0xec, lpOverlapped=0x0) returned 1 [0117.808] SetEndOfFile (hFile=0x180) returned 1 [0117.808] CloseHandle (hObject=0x180) returned 1 [0117.808] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0117.808] SetEndOfFile (hFile=0x1f8) returned 1 [0117.808] CloseHandle (hObject=0x1f8) returned 1 [0117.808] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0117.809] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00164_.gif")) returned 1 [0117.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 63 [0117.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 63 [0117.809] lstrlenW (lpString=".doc") returned 4 [0117.809] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0117.809] lstrlenW (lpString=".docx") returned 5 [0117.809] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0117.809] lstrlenW (lpString=".pdf") returned 4 [0117.809] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0117.809] lstrlenW (lpString=".xls") returned 4 [0117.809] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0117.809] lstrlenW (lpString=".xlsx") returned 5 [0117.809] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0117.809] lstrlenW (lpString=".ppt") returned 4 [0117.809] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0117.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 63 [0117.809] lstrlenW (lpString=".zip") returned 4 [0117.809] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0117.809] lstrlenW (lpString=".rar") returned 4 [0117.809] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0117.809] lstrlenW (lpString=".bz2") returned 4 [0117.809] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0117.809] lstrlenW (lpString=".7z") returned 3 [0117.809] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0117.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 63 [0117.809] lstrlenW (lpString=".dbf") returned 4 [0117.809] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0117.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 63 [0117.809] lstrlenW (lpString=".1cd") returned 4 [0117.809] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0117.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 63 [0117.809] lstrlenW (lpString=".jpg") returned 4 [0117.809] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0117.810] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x37cfddc | out: lpFileSize=0x37cfddc*=9248) returned 1 [0117.810] CloseHandle (hObject=0x1f8) returned 1 [0117.810] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00170_.gif")) returned 0x20 [0117.810] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00170_.gif.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0117.810] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00170_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0117.810] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0117.810] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0117.810] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00170_.gif.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0117.810] GetLastError () returned 0x0 [0117.810] ReadFile (in: hFile=0x1f8, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x2420, lpOverlapped=0x0) returned 1 [0117.843] WriteFile (in: hFile=0x180, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0x2430, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0x2430, lpOverlapped=0x0) returned 1 [0117.844] ReadFile (in: hFile=0x1f8, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x0, lpOverlapped=0x0) returned 1 [0117.844] WriteFile (in: hFile=0x180, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0xec, lpOverlapped=0x0) returned 1 [0117.844] SetEndOfFile (hFile=0x180) returned 1 [0117.844] CloseHandle (hObject=0x180) returned 1 [0117.844] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0117.844] SetEndOfFile (hFile=0x1f8) returned 1 [0117.845] CloseHandle (hObject=0x1f8) returned 1 [0117.845] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0117.845] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00170_.gif")) returned 1 [0117.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 63 [0117.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 63 [0117.846] lstrlenW (lpString=".doc") returned 4 [0117.846] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0117.846] lstrlenW (lpString=".docx") returned 5 [0117.846] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0117.846] lstrlenW (lpString=".pdf") returned 4 [0117.846] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0117.846] lstrlenW (lpString=".xls") returned 4 [0117.846] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0117.846] lstrlenW (lpString=".xlsx") returned 5 [0117.846] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0117.846] lstrlenW (lpString=".ppt") returned 4 [0117.846] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0117.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 63 [0117.846] lstrlenW (lpString=".zip") returned 4 [0117.846] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0117.846] lstrlenW (lpString=".rar") returned 4 [0117.846] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0117.846] lstrlenW (lpString=".bz2") returned 4 [0117.846] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0117.846] lstrlenW (lpString=".7z") returned 3 [0117.846] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0117.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 63 [0117.846] lstrlenW (lpString=".dbf") returned 4 [0117.846] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0117.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 63 [0117.846] lstrlenW (lpString=".1cd") returned 4 [0117.846] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0117.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 63 [0117.846] lstrlenW (lpString=".jpg") returned 4 [0117.846] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0117.846] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x37cfddc | out: lpFileSize=0x37cfddc*=3378) returned 1 [0117.847] CloseHandle (hObject=0x1f8) returned 1 [0117.847] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00175_.gif")) returned 0x20 [0117.847] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00175_.gif.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0117.847] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00175_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0117.847] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0117.847] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0117.847] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00175_.gif.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0117.848] GetLastError () returned 0x0 [0117.848] ReadFile (in: hFile=0x1f8, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0xd32, lpOverlapped=0x0) returned 1 [0117.867] WriteFile (in: hFile=0x180, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0xd40, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0xd40, lpOverlapped=0x0) returned 1 [0117.867] ReadFile (in: hFile=0x1f8, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x0, lpOverlapped=0x0) returned 1 [0117.867] WriteFile (in: hFile=0x180, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0xec, lpOverlapped=0x0) returned 1 [0117.867] SetEndOfFile (hFile=0x180) returned 1 [0117.868] CloseHandle (hObject=0x180) returned 1 [0117.868] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0117.868] SetEndOfFile (hFile=0x1f8) returned 1 [0117.868] CloseHandle (hObject=0x1f8) returned 1 [0117.868] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0117.869] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00175_.gif")) returned 1 [0117.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 63 [0117.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 63 [0117.869] lstrlenW (lpString=".doc") returned 4 [0117.869] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0117.869] lstrlenW (lpString=".docx") returned 5 [0117.869] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0117.869] lstrlenW (lpString=".pdf") returned 4 [0117.869] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0117.869] lstrlenW (lpString=".xls") returned 4 [0117.869] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0117.869] lstrlenW (lpString=".xlsx") returned 5 [0117.869] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0117.869] lstrlenW (lpString=".ppt") returned 4 [0117.869] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0117.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 63 [0117.869] lstrlenW (lpString=".zip") returned 4 [0117.869] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0117.869] lstrlenW (lpString=".rar") returned 4 [0117.869] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0117.869] lstrlenW (lpString=".bz2") returned 4 [0117.869] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0117.869] lstrlenW (lpString=".7z") returned 3 [0117.869] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0117.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 63 [0117.869] lstrlenW (lpString=".dbf") returned 4 [0117.869] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0117.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 63 [0117.869] lstrlenW (lpString=".1cd") returned 4 [0117.869] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0117.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 63 [0117.869] lstrlenW (lpString=".jpg") returned 4 [0117.869] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0117.875] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0117.875] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0117.875] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00790_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0117.875] GetLastError () returned 0x0 [0117.875] ReadFile (in: hFile=0x1f8, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x1634, lpOverlapped=0x0) returned 1 [0117.938] WriteFile (in: hFile=0x180, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0x1640, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0x1640, lpOverlapped=0x0) returned 1 [0117.938] ReadFile (in: hFile=0x1f8, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x0, lpOverlapped=0x0) returned 1 [0117.939] WriteFile (in: hFile=0x180, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0xec, lpOverlapped=0x0) returned 1 [0117.939] SetEndOfFile (hFile=0x180) returned 1 [0117.955] CloseHandle (hObject=0x180) returned 1 [0117.955] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0117.956] SetEndOfFile (hFile=0x1f8) returned 1 [0117.956] CloseHandle (hObject=0x1f8) returned 1 [0117.956] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0117.956] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00790_.wmf")) returned 1 [0117.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 63 [0117.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 63 [0117.957] lstrlenW (lpString=".doc") returned 4 [0117.957] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0117.957] lstrlenW (lpString=".docx") returned 5 [0117.957] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0117.957] lstrlenW (lpString=".pdf") returned 4 [0117.957] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0117.957] lstrlenW (lpString=".xls") returned 4 [0117.957] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0117.957] lstrlenW (lpString=".xlsx") returned 5 [0117.957] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0117.957] lstrlenW (lpString=".ppt") returned 4 [0117.957] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0117.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 63 [0117.957] lstrlenW (lpString=".zip") returned 4 [0117.957] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0117.957] lstrlenW (lpString=".rar") returned 4 [0117.957] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0117.957] lstrlenW (lpString=".bz2") returned 4 [0117.957] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0117.957] lstrlenW (lpString=".7z") returned 3 [0117.957] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0117.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 63 [0117.958] lstrlenW (lpString=".dbf") returned 4 [0117.958] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0117.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 63 [0117.958] lstrlenW (lpString=".1cd") returned 4 [0117.958] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0117.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 63 [0117.958] lstrlenW (lpString=".jpg") returned 4 [0117.958] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0117.958] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x37cfddc | out: lpFileSize=0x37cfddc*=7072) returned 1 [0117.958] CloseHandle (hObject=0x1f8) returned 1 [0117.958] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00965_.wmf")) returned 0x20 [0117.958] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00965_.wmf.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0117.958] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00965_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0117.958] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0117.958] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0117.958] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00965_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0117.959] GetLastError () returned 0x0 [0117.959] ReadFile (in: hFile=0x1f8, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x1ba0, lpOverlapped=0x0) returned 1 [0118.055] WriteFile (in: hFile=0x180, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0x1bb0, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0x1bb0, lpOverlapped=0x0) returned 1 [0118.057] ReadFile (in: hFile=0x1f8, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x0, lpOverlapped=0x0) returned 1 [0118.057] WriteFile (in: hFile=0x180, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0xec, lpOverlapped=0x0) returned 1 [0118.057] SetEndOfFile (hFile=0x180) returned 1 [0118.057] CloseHandle (hObject=0x180) returned 1 [0118.058] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0118.058] SetEndOfFile (hFile=0x1f8) returned 1 [0118.058] CloseHandle (hObject=0x1f8) returned 1 [0118.058] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0118.059] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00965_.wmf")) returned 1 [0118.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 63 [0118.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 63 [0118.059] lstrlenW (lpString=".doc") returned 4 [0118.059] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0118.059] lstrlenW (lpString=".docx") returned 5 [0118.059] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0118.059] lstrlenW (lpString=".pdf") returned 4 [0118.059] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0118.059] lstrlenW (lpString=".xls") returned 4 [0118.059] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0118.059] lstrlenW (lpString=".xlsx") returned 5 [0118.059] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0118.059] lstrlenW (lpString=".ppt") returned 4 [0118.059] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0118.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 63 [0118.059] lstrlenW (lpString=".zip") returned 4 [0118.059] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0118.059] lstrlenW (lpString=".rar") returned 4 [0118.059] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0118.059] lstrlenW (lpString=".bz2") returned 4 [0118.059] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0118.059] lstrlenW (lpString=".7z") returned 3 [0118.060] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0118.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 63 [0118.060] lstrlenW (lpString=".dbf") returned 4 [0118.060] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0118.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 63 [0118.060] lstrlenW (lpString=".1cd") returned 4 [0118.060] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0118.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 63 [0118.060] lstrlenW (lpString=".jpg") returned 4 [0118.060] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0118.060] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x37cfddc | out: lpFileSize=0x37cfddc*=1596) returned 1 [0118.060] CloseHandle (hObject=0x1f8) returned 1 [0118.060] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01044_.wmf")) returned 0x20 [0118.060] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01044_.wmf.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0118.060] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01044_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0118.061] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0118.061] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0118.061] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01044_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0118.061] GetLastError () returned 0x0 [0118.061] ReadFile (in: hFile=0x1f8, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x63c, lpOverlapped=0x0) returned 1 [0118.150] WriteFile (in: hFile=0x180, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0x640, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0x640, lpOverlapped=0x0) returned 1 [0118.151] ReadFile (in: hFile=0x1f8, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x0, lpOverlapped=0x0) returned 1 [0118.151] WriteFile (in: hFile=0x180, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0xec, lpOverlapped=0x0) returned 1 [0118.151] SetEndOfFile (hFile=0x180) returned 1 [0118.151] CloseHandle (hObject=0x180) returned 1 [0118.151] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0118.151] SetEndOfFile (hFile=0x1f8) returned 1 [0118.152] CloseHandle (hObject=0x1f8) returned 1 [0118.152] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0118.152] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01044_.wmf")) returned 1 [0118.152] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 63 [0118.152] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 63 [0118.152] lstrlenW (lpString=".doc") returned 4 [0118.152] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0118.152] lstrlenW (lpString=".docx") returned 5 [0118.152] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0118.152] lstrlenW (lpString=".pdf") returned 4 [0118.152] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0118.152] lstrlenW (lpString=".xls") returned 4 [0118.152] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0118.152] lstrlenW (lpString=".xlsx") returned 5 [0118.152] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0118.152] lstrlenW (lpString=".ppt") returned 4 [0118.152] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0118.152] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 63 [0118.152] lstrlenW (lpString=".zip") returned 4 [0118.152] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0118.153] lstrlenW (lpString=".rar") returned 4 [0118.153] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0118.153] lstrlenW (lpString=".bz2") returned 4 [0118.153] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0118.153] lstrlenW (lpString=".7z") returned 3 [0118.153] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0118.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 63 [0118.153] lstrlenW (lpString=".dbf") returned 4 [0118.153] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0118.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 63 [0118.153] lstrlenW (lpString=".1cd") returned 4 [0118.153] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0118.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 63 [0118.153] lstrlenW (lpString=".jpg") returned 4 [0118.153] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0118.154] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x37cfddc | out: lpFileSize=0x37cfddc*=7968) returned 1 [0118.154] CloseHandle (hObject=0x1f8) returned 1 [0118.154] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01060_.wmf")) returned 0x20 [0118.154] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01060_.wmf.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0118.154] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01060_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0118.154] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0118.154] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0118.154] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01060_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0118.154] GetLastError () returned 0x0 [0118.154] ReadFile (in: hFile=0x1f8, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x1f20, lpOverlapped=0x0) returned 1 [0118.361] WriteFile (in: hFile=0x180, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0x1f30, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0x1f30, lpOverlapped=0x0) returned 1 [0118.687] ReadFile (in: hFile=0x1f8, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x0, lpOverlapped=0x0) returned 1 [0118.687] WriteFile (in: hFile=0x180, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0xec, lpOverlapped=0x0) returned 1 [0118.687] SetEndOfFile (hFile=0x180) returned 1 [0118.687] CloseHandle (hObject=0x180) returned 1 [0118.687] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0118.687] SetEndOfFile (hFile=0x1f8) returned 1 [0118.787] CloseHandle (hObject=0x1f8) returned 1 [0118.959] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0118.965] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01060_.wmf")) returned 1 [0118.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 63 [0118.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 63 [0118.965] lstrlenW (lpString=".doc") returned 4 [0118.965] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0118.965] lstrlenW (lpString=".docx") returned 5 [0118.965] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0118.965] lstrlenW (lpString=".pdf") returned 4 [0118.965] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0118.965] lstrlenW (lpString=".xls") returned 4 [0118.965] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0118.965] lstrlenW (lpString=".xlsx") returned 5 [0118.965] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0118.965] lstrlenW (lpString=".ppt") returned 4 [0118.965] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0118.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 63 [0118.965] lstrlenW (lpString=".zip") returned 4 [0118.966] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0118.966] lstrlenW (lpString=".rar") returned 4 [0118.966] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0118.966] lstrlenW (lpString=".bz2") returned 4 [0118.966] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0118.966] lstrlenW (lpString=".7z") returned 3 [0118.966] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0118.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 63 [0118.966] lstrlenW (lpString=".dbf") returned 4 [0118.966] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0118.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 63 [0118.966] lstrlenW (lpString=".1cd") returned 4 [0118.966] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0118.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 63 [0118.966] lstrlenW (lpString=".jpg") returned 4 [0118.966] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0118.966] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x37cfddc | out: lpFileSize=0x37cfddc*=5836) returned 1 [0118.966] CloseHandle (hObject=0x194) returned 1 [0118.966] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01216_.wmf")) returned 0x20 [0118.967] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01216_.wmf.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0118.967] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01216_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0118.967] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0118.967] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0118.967] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01216_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0118.967] GetLastError () returned 0x0 [0118.967] ReadFile (in: hFile=0x194, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x16cc, lpOverlapped=0x0) returned 1 [0119.017] WriteFile (in: hFile=0x170, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0x16d0, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0x16d0, lpOverlapped=0x0) returned 1 [0119.017] ReadFile (in: hFile=0x194, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x0, lpOverlapped=0x0) returned 1 [0119.017] WriteFile (in: hFile=0x170, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0xec, lpOverlapped=0x0) returned 1 [0119.017] SetEndOfFile (hFile=0x170) returned 1 [0119.018] CloseHandle (hObject=0x170) returned 1 [0119.018] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0119.018] SetEndOfFile (hFile=0x194) returned 1 [0119.018] CloseHandle (hObject=0x194) returned 1 [0119.018] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0119.019] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01216_.wmf")) returned 1 [0119.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 63 [0119.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 63 [0119.019] lstrlenW (lpString=".doc") returned 4 [0119.019] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0119.019] lstrlenW (lpString=".docx") returned 5 [0119.019] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0119.019] lstrlenW (lpString=".pdf") returned 4 [0119.019] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0119.019] lstrlenW (lpString=".xls") returned 4 [0119.019] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0119.019] lstrlenW (lpString=".xlsx") returned 5 [0119.019] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0119.019] lstrlenW (lpString=".ppt") returned 4 [0119.019] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0119.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 63 [0119.019] lstrlenW (lpString=".zip") returned 4 [0119.019] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0119.019] lstrlenW (lpString=".rar") returned 4 [0119.019] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0119.019] lstrlenW (lpString=".bz2") returned 4 [0119.019] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0119.019] lstrlenW (lpString=".7z") returned 3 [0119.019] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0119.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 63 [0119.019] lstrlenW (lpString=".dbf") returned 4 [0119.019] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0119.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 63 [0119.019] lstrlenW (lpString=".1cd") returned 4 [0119.019] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0119.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 63 [0119.019] lstrlenW (lpString=".jpg") returned 4 [0119.019] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0119.020] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x37cfddc | out: lpFileSize=0x37cfddc*=7540) returned 1 [0119.020] CloseHandle (hObject=0x194) returned 1 [0119.020] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02122_.wmf")) returned 0x20 [0119.021] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02122_.wmf.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0119.021] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02122_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0119.021] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0119.021] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0119.021] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02122_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0119.021] GetLastError () returned 0x0 [0119.021] ReadFile (in: hFile=0x194, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x1d74, lpOverlapped=0x0) returned 1 [0119.149] WriteFile (in: hFile=0x170, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0x1d80, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0x1d80, lpOverlapped=0x0) returned 1 [0119.150] ReadFile (in: hFile=0x194, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x0, lpOverlapped=0x0) returned 1 [0119.150] WriteFile (in: hFile=0x170, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0xec, lpOverlapped=0x0) returned 1 [0119.150] SetEndOfFile (hFile=0x170) returned 1 [0119.170] CloseHandle (hObject=0x170) returned 1 [0119.171] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0119.171] SetEndOfFile (hFile=0x194) returned 1 [0119.172] CloseHandle (hObject=0x194) returned 1 [0119.172] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0119.172] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02122_.wmf")) returned 1 [0119.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 63 [0119.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 63 [0119.172] lstrlenW (lpString=".doc") returned 4 [0119.173] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0119.173] lstrlenW (lpString=".docx") returned 5 [0119.173] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0119.173] lstrlenW (lpString=".pdf") returned 4 [0119.173] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0119.173] lstrlenW (lpString=".xls") returned 4 [0119.173] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0119.173] lstrlenW (lpString=".xlsx") returned 5 [0119.173] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0119.173] lstrlenW (lpString=".ppt") returned 4 [0119.173] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0119.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 63 [0119.173] lstrlenW (lpString=".zip") returned 4 [0119.173] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0119.173] lstrlenW (lpString=".rar") returned 4 [0119.173] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0119.173] lstrlenW (lpString=".bz2") returned 4 [0119.173] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0119.173] lstrlenW (lpString=".7z") returned 3 [0119.173] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0119.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 63 [0119.173] lstrlenW (lpString=".dbf") returned 4 [0119.173] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0119.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 63 [0119.173] lstrlenW (lpString=".1cd") returned 4 [0119.173] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0119.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 63 [0119.173] lstrlenW (lpString=".jpg") returned 4 [0119.173] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0119.173] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x37cfddc | out: lpFileSize=0x37cfddc*=3144) returned 1 [0119.173] CloseHandle (hObject=0x194) returned 1 [0119.174] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04196_.wmf")) returned 0x20 [0119.174] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04196_.wmf.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0119.174] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04196_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0119.174] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0119.174] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0119.174] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04196_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0119.174] GetLastError () returned 0x0 [0119.174] ReadFile (in: hFile=0x194, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0xc48, lpOverlapped=0x0) returned 1 [0119.341] WriteFile (in: hFile=0x170, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0xc50, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0xc50, lpOverlapped=0x0) returned 1 [0119.342] ReadFile (in: hFile=0x194, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x0, lpOverlapped=0x0) returned 1 [0119.342] WriteFile (in: hFile=0x170, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0xec, lpOverlapped=0x0) returned 1 [0119.342] SetEndOfFile (hFile=0x170) returned 1 [0119.468] CloseHandle (hObject=0x170) returned 1 [0119.468] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0119.468] SetEndOfFile (hFile=0x194) returned 1 [0119.468] CloseHandle (hObject=0x194) returned 1 [0119.468] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0119.469] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04196_.wmf")) returned 1 [0119.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 63 [0119.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 63 [0119.505] lstrlenW (lpString=".doc") returned 4 [0119.505] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0119.505] lstrlenW (lpString=".docx") returned 5 [0119.505] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0119.505] lstrlenW (lpString=".pdf") returned 4 [0119.505] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0119.505] lstrlenW (lpString=".xls") returned 4 [0119.505] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0119.505] lstrlenW (lpString=".xlsx") returned 5 [0119.505] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0119.505] lstrlenW (lpString=".ppt") returned 4 [0119.505] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0119.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 63 [0119.505] lstrlenW (lpString=".zip") returned 4 [0119.505] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0119.505] lstrlenW (lpString=".rar") returned 4 [0119.505] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0119.505] lstrlenW (lpString=".bz2") returned 4 [0119.505] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0119.505] lstrlenW (lpString=".7z") returned 3 [0119.507] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0119.507] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 63 [0119.507] lstrlenW (lpString=".dbf") returned 4 [0119.507] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0119.507] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 63 [0119.507] lstrlenW (lpString=".1cd") returned 4 [0119.507] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0119.507] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 63 [0119.507] lstrlenW (lpString=".jpg") returned 4 [0119.507] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0119.521] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0119.521] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0119.522] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04326_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0119.522] GetLastError () returned 0x0 [0119.522] ReadFile (in: hFile=0x1e0, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0xd14, lpOverlapped=0x0) returned 1 [0119.619] WriteFile (in: hFile=0x1b0, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0xd20, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0xd20, lpOverlapped=0x0) returned 1 [0119.620] ReadFile (in: hFile=0x1e0, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x0, lpOverlapped=0x0) returned 1 [0119.620] WriteFile (in: hFile=0x1b0, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0xec, lpOverlapped=0x0) returned 1 [0119.620] SetEndOfFile (hFile=0x1b0) returned 1 [0119.674] CloseHandle (hObject=0x1b0) returned 1 [0119.674] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0119.674] SetEndOfFile (hFile=0x1e0) returned 1 [0119.675] CloseHandle (hObject=0x1e0) returned 1 [0119.675] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0119.675] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04326_.wmf")) returned 1 [0119.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 63 [0119.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 63 [0119.675] lstrlenW (lpString=".doc") returned 4 [0119.675] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0119.675] lstrlenW (lpString=".docx") returned 5 [0119.676] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0119.676] lstrlenW (lpString=".pdf") returned 4 [0119.676] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0119.676] lstrlenW (lpString=".xls") returned 4 [0119.676] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0119.676] lstrlenW (lpString=".xlsx") returned 5 [0119.676] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0119.676] lstrlenW (lpString=".ppt") returned 4 [0119.676] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0119.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 63 [0119.676] lstrlenW (lpString=".zip") returned 4 [0119.676] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0119.676] lstrlenW (lpString=".rar") returned 4 [0119.676] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0119.676] lstrlenW (lpString=".bz2") returned 4 [0119.676] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0119.676] lstrlenW (lpString=".7z") returned 3 [0119.676] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0119.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 63 [0119.676] lstrlenW (lpString=".dbf") returned 4 [0119.676] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0119.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 63 [0119.676] lstrlenW (lpString=".1cd") returned 4 [0119.676] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0119.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 63 [0119.676] lstrlenW (lpString=".jpg") returned 4 [0119.676] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0119.676] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x37cfddc | out: lpFileSize=0x37cfddc*=28948) returned 1 [0119.676] CloseHandle (hObject=0x1e0) returned 1 [0119.676] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00146_.wmf")) returned 0x20 [0119.677] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00146_.wmf.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0119.677] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00146_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0119.677] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0119.677] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0119.677] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00146_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0119.677] GetLastError () returned 0x0 [0119.677] ReadFile (in: hFile=0x1e0, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x7114, lpOverlapped=0x0) returned 1 [0119.710] WriteFile (in: hFile=0x1b0, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0x7120, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0x7120, lpOverlapped=0x0) returned 1 [0119.711] ReadFile (in: hFile=0x1e0, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x0, lpOverlapped=0x0) returned 1 [0119.711] WriteFile (in: hFile=0x1b0, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0xec, lpOverlapped=0x0) returned 1 [0119.711] SetEndOfFile (hFile=0x1b0) returned 1 [0119.715] CloseHandle (hObject=0x1b0) returned 1 [0119.715] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0119.715] SetEndOfFile (hFile=0x1e0) returned 1 [0119.716] CloseHandle (hObject=0x1e0) returned 1 [0119.716] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0119.716] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00146_.wmf")) returned 1 [0119.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 63 [0119.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 63 [0119.716] lstrlenW (lpString=".doc") returned 4 [0119.716] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0119.716] lstrlenW (lpString=".docx") returned 5 [0119.716] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0119.716] lstrlenW (lpString=".pdf") returned 4 [0119.716] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0119.716] lstrlenW (lpString=".xls") returned 4 [0119.716] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0119.716] lstrlenW (lpString=".xlsx") returned 5 [0119.716] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0119.716] lstrlenW (lpString=".ppt") returned 4 [0119.716] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0119.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 63 [0119.716] lstrlenW (lpString=".zip") returned 4 [0119.716] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0119.716] lstrlenW (lpString=".rar") returned 4 [0119.716] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0119.716] lstrlenW (lpString=".bz2") returned 4 [0119.716] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0119.716] lstrlenW (lpString=".7z") returned 3 [0119.717] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0119.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 63 [0119.717] lstrlenW (lpString=".dbf") returned 4 [0119.717] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0119.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 63 [0119.717] lstrlenW (lpString=".1cd") returned 4 [0119.717] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0119.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 63 [0119.717] lstrlenW (lpString=".jpg") returned 4 [0119.717] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0119.717] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x37cfddc | out: lpFileSize=0x37cfddc*=16180) returned 1 [0119.717] CloseHandle (hObject=0x1e0) returned 1 [0119.717] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00173_.wmf")) returned 0x20 [0119.717] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00173_.wmf.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0119.717] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00173_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0119.717] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0119.717] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0119.717] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00173_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0119.718] GetLastError () returned 0x0 [0119.718] ReadFile (in: hFile=0x1e0, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x3f34, lpOverlapped=0x0) returned 1 [0119.738] WriteFile (in: hFile=0x1b0, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0x3f40, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0x3f40, lpOverlapped=0x0) returned 1 [0119.739] ReadFile (in: hFile=0x1e0, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x0, lpOverlapped=0x0) returned 1 [0119.739] WriteFile (in: hFile=0x1b0, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0xec, lpOverlapped=0x0) returned 1 [0119.739] SetEndOfFile (hFile=0x1b0) returned 1 [0119.739] CloseHandle (hObject=0x1b0) returned 1 [0119.739] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0119.739] SetEndOfFile (hFile=0x1e0) returned 1 [0119.740] CloseHandle (hObject=0x1e0) returned 1 [0119.740] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0119.740] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00173_.wmf")) returned 1 [0119.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 63 [0119.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 63 [0119.740] lstrlenW (lpString=".doc") returned 4 [0119.740] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0119.740] lstrlenW (lpString=".docx") returned 5 [0119.740] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0119.740] lstrlenW (lpString=".pdf") returned 4 [0119.740] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0119.740] lstrlenW (lpString=".xls") returned 4 [0119.740] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0119.740] lstrlenW (lpString=".xlsx") returned 5 [0119.740] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0119.740] lstrlenW (lpString=".ppt") returned 4 [0119.740] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0119.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 63 [0119.740] lstrlenW (lpString=".zip") returned 4 [0119.740] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0119.740] lstrlenW (lpString=".rar") returned 4 [0119.740] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0119.740] lstrlenW (lpString=".bz2") returned 4 [0119.740] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0119.740] lstrlenW (lpString=".7z") returned 3 [0119.740] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0119.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 63 [0119.741] lstrlenW (lpString=".dbf") returned 4 [0119.741] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0119.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 63 [0119.741] lstrlenW (lpString=".1cd") returned 4 [0119.741] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0119.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 63 [0119.741] lstrlenW (lpString=".jpg") returned 4 [0119.741] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0119.741] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x37cfddc | out: lpFileSize=0x37cfddc*=16676) returned 1 [0119.741] CloseHandle (hObject=0x1e0) returned 1 [0119.741] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06200_.wmf")) returned 0x20 [0119.742] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06200_.wmf.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0119.742] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06200_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0119.742] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0119.742] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0119.742] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06200_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0119.742] GetLastError () returned 0x0 [0119.742] ReadFile (in: hFile=0x1e0, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x4124, lpOverlapped=0x0) returned 1 [0119.804] WriteFile (in: hFile=0x1b0, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0x4130, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0x4130, lpOverlapped=0x0) returned 1 [0119.805] ReadFile (in: hFile=0x1e0, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x0, lpOverlapped=0x0) returned 1 [0119.805] WriteFile (in: hFile=0x1b0, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0xec, lpOverlapped=0x0) returned 1 [0119.805] SetEndOfFile (hFile=0x1b0) returned 1 [0119.805] CloseHandle (hObject=0x1b0) returned 1 [0119.805] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0119.805] SetEndOfFile (hFile=0x1e0) returned 1 [0119.806] CloseHandle (hObject=0x1e0) returned 1 [0119.806] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0119.806] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06200_.wmf")) returned 1 [0119.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 63 [0119.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 63 [0119.806] lstrlenW (lpString=".doc") returned 4 [0119.806] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0119.806] lstrlenW (lpString=".docx") returned 5 [0119.806] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0119.807] lstrlenW (lpString=".pdf") returned 4 [0119.807] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0119.807] lstrlenW (lpString=".xls") returned 4 [0119.807] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0119.807] lstrlenW (lpString=".xlsx") returned 5 [0119.807] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0119.807] lstrlenW (lpString=".ppt") returned 4 [0119.807] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0119.807] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 63 [0119.807] lstrlenW (lpString=".zip") returned 4 [0119.807] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0119.807] lstrlenW (lpString=".rar") returned 4 [0119.807] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0119.807] lstrlenW (lpString=".bz2") returned 4 [0119.807] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0119.807] lstrlenW (lpString=".7z") returned 3 [0119.807] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0119.807] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 63 [0119.807] lstrlenW (lpString=".dbf") returned 4 [0119.807] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0119.807] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 63 [0119.807] lstrlenW (lpString=".1cd") returned 4 [0119.807] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0119.807] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 63 [0119.807] lstrlenW (lpString=".jpg") returned 4 [0119.807] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0119.808] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x37cfddc | out: lpFileSize=0x37cfddc*=4066) returned 1 [0119.808] CloseHandle (hObject=0x1e0) returned 1 [0119.808] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07831_.wmf")) returned 0x20 [0119.808] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07831_.wmf.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0119.808] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07831_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0119.808] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0119.808] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0119.808] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07831_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0119.808] GetLastError () returned 0x0 [0119.808] ReadFile (in: hFile=0x1e0, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0xfe2, lpOverlapped=0x0) returned 1 [0119.815] WriteFile (in: hFile=0x1b0, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0xff0, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0xff0, lpOverlapped=0x0) returned 1 [0119.816] ReadFile (in: hFile=0x1e0, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x0, lpOverlapped=0x0) returned 1 [0119.816] WriteFile (in: hFile=0x1b0, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0xec, lpOverlapped=0x0) returned 1 [0119.816] SetEndOfFile (hFile=0x1b0) returned 1 [0119.816] CloseHandle (hObject=0x1b0) returned 1 [0119.816] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0119.816] SetEndOfFile (hFile=0x1e0) returned 1 [0119.817] CloseHandle (hObject=0x1e0) returned 1 [0119.817] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0119.817] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07831_.wmf")) returned 1 [0119.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 63 [0119.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 63 [0119.817] lstrlenW (lpString=".doc") returned 4 [0119.817] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0119.817] lstrlenW (lpString=".docx") returned 5 [0119.817] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0119.817] lstrlenW (lpString=".pdf") returned 4 [0119.817] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0119.817] lstrlenW (lpString=".xls") returned 4 [0119.817] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0119.817] lstrlenW (lpString=".xlsx") returned 5 [0119.817] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0119.817] lstrlenW (lpString=".ppt") returned 4 [0119.817] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0119.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 63 [0119.817] lstrlenW (lpString=".zip") returned 4 [0119.817] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0119.817] lstrlenW (lpString=".rar") returned 4 [0119.817] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0119.817] lstrlenW (lpString=".bz2") returned 4 [0119.818] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0119.818] lstrlenW (lpString=".7z") returned 3 [0119.818] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0119.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 63 [0119.818] lstrlenW (lpString=".dbf") returned 4 [0119.818] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0119.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 63 [0119.818] lstrlenW (lpString=".1cd") returned 4 [0119.818] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0119.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 63 [0119.818] lstrlenW (lpString=".jpg") returned 4 [0119.818] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0119.818] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x37cfddc | out: lpFileSize=0x37cfddc*=24778) returned 1 [0119.818] CloseHandle (hObject=0x1e0) returned 1 [0119.818] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08773_.wmf")) returned 0x20 [0119.818] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08773_.wmf.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0119.818] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08773_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0119.818] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0119.818] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0119.819] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08773_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0119.819] GetLastError () returned 0x0 [0119.819] ReadFile (in: hFile=0x1e0, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x60ca, lpOverlapped=0x0) returned 1 [0119.853] WriteFile (in: hFile=0x1b0, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0x60d0, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0x60d0, lpOverlapped=0x0) returned 1 [0119.853] ReadFile (in: hFile=0x1e0, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x0, lpOverlapped=0x0) returned 1 [0119.853] WriteFile (in: hFile=0x1b0, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0xec, lpOverlapped=0x0) returned 1 [0119.853] SetEndOfFile (hFile=0x1b0) returned 1 [0119.853] CloseHandle (hObject=0x1b0) returned 1 [0119.854] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0119.854] SetEndOfFile (hFile=0x1e0) returned 1 [0119.854] CloseHandle (hObject=0x1e0) returned 1 [0119.854] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0119.855] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08773_.wmf")) returned 1 [0119.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 63 [0119.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 63 [0119.855] lstrlenW (lpString=".doc") returned 4 [0119.855] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0119.855] lstrlenW (lpString=".docx") returned 5 [0119.855] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0119.855] lstrlenW (lpString=".pdf") returned 4 [0119.855] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0119.855] lstrlenW (lpString=".xls") returned 4 [0119.855] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0119.855] lstrlenW (lpString=".xlsx") returned 5 [0119.855] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0119.855] lstrlenW (lpString=".ppt") returned 4 [0119.855] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0119.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 63 [0119.855] lstrlenW (lpString=".zip") returned 4 [0119.855] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0119.855] lstrlenW (lpString=".rar") returned 4 [0119.855] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0119.855] lstrlenW (lpString=".bz2") returned 4 [0119.855] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0119.855] lstrlenW (lpString=".7z") returned 3 [0119.855] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0119.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 63 [0119.855] lstrlenW (lpString=".dbf") returned 4 [0119.855] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0119.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 63 [0119.855] lstrlenW (lpString=".1cd") returned 4 [0119.856] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0119.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 63 [0119.856] lstrlenW (lpString=".jpg") returned 4 [0119.856] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0119.856] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x37cfddc | out: lpFileSize=0x37cfddc*=47786) returned 1 [0119.856] CloseHandle (hObject=0x1e0) returned 1 [0119.856] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09031_.wmf")) returned 0x20 [0119.856] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09031_.wmf.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0119.856] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09031_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0119.856] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0119.856] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0119.856] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09031_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0119.857] GetLastError () returned 0x0 [0119.857] ReadFile (in: hFile=0x1e0, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0xbaaa, lpOverlapped=0x0) returned 1 [0119.870] WriteFile (in: hFile=0x1b0, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0xbab0, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0xbab0, lpOverlapped=0x0) returned 1 [0119.871] ReadFile (in: hFile=0x1e0, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x0, lpOverlapped=0x0) returned 1 [0119.871] WriteFile (in: hFile=0x1b0, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0xec, lpOverlapped=0x0) returned 1 [0119.871] SetEndOfFile (hFile=0x1b0) returned 1 [0119.871] CloseHandle (hObject=0x1b0) returned 1 [0119.871] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0119.871] SetEndOfFile (hFile=0x1e0) returned 1 [0119.872] CloseHandle (hObject=0x1e0) returned 1 [0119.872] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0119.872] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09031_.wmf")) returned 1 [0119.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 63 [0119.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 63 [0119.873] lstrlenW (lpString=".doc") returned 4 [0119.873] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0119.873] lstrlenW (lpString=".docx") returned 5 [0119.873] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0119.873] lstrlenW (lpString=".pdf") returned 4 [0119.873] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0119.873] lstrlenW (lpString=".xls") returned 4 [0119.873] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0119.873] lstrlenW (lpString=".xlsx") returned 5 [0119.873] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0119.873] lstrlenW (lpString=".ppt") returned 4 [0119.873] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0119.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 63 [0119.873] lstrlenW (lpString=".zip") returned 4 [0119.873] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0119.873] lstrlenW (lpString=".rar") returned 4 [0119.873] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0119.873] lstrlenW (lpString=".bz2") returned 4 [0119.873] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0119.873] lstrlenW (lpString=".7z") returned 3 [0119.873] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0119.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 63 [0119.873] lstrlenW (lpString=".dbf") returned 4 [0119.873] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0119.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 63 [0119.873] lstrlenW (lpString=".1cd") returned 4 [0119.873] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0119.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 63 [0119.873] lstrlenW (lpString=".jpg") returned 4 [0119.873] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0119.874] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x37cfddc | out: lpFileSize=0x37cfddc*=20554) returned 1 [0119.874] CloseHandle (hObject=0x1e0) returned 1 [0119.874] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09662_.wmf")) returned 0x20 [0119.874] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09662_.wmf.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0119.874] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09662_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0119.874] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0119.874] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0119.874] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09662_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0119.875] GetLastError () returned 0x0 [0119.875] ReadFile (in: hFile=0x1e0, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x504a, lpOverlapped=0x0) returned 1 [0119.888] WriteFile (in: hFile=0x1b0, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0x5050, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0x5050, lpOverlapped=0x0) returned 1 [0119.889] ReadFile (in: hFile=0x1e0, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x0, lpOverlapped=0x0) returned 1 [0119.889] WriteFile (in: hFile=0x1b0, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0xec, lpOverlapped=0x0) returned 1 [0119.890] SetEndOfFile (hFile=0x1b0) returned 1 [0119.890] CloseHandle (hObject=0x1b0) returned 1 [0119.890] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0119.890] SetEndOfFile (hFile=0x1e0) returned 1 [0119.890] CloseHandle (hObject=0x1e0) returned 1 [0119.891] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0119.891] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09662_.wmf")) returned 1 [0119.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 63 [0119.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 63 [0119.891] lstrlenW (lpString=".doc") returned 4 [0119.891] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0119.891] lstrlenW (lpString=".docx") returned 5 [0119.891] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0119.891] lstrlenW (lpString=".pdf") returned 4 [0119.891] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0119.891] lstrlenW (lpString=".xls") returned 4 [0119.891] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0119.891] lstrlenW (lpString=".xlsx") returned 5 [0119.891] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0119.891] lstrlenW (lpString=".ppt") returned 4 [0119.891] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0119.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 63 [0119.891] lstrlenW (lpString=".zip") returned 4 [0119.891] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0119.891] lstrlenW (lpString=".rar") returned 4 [0119.891] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0119.891] lstrlenW (lpString=".bz2") returned 4 [0119.891] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0119.891] lstrlenW (lpString=".7z") returned 3 [0119.891] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0119.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 63 [0119.891] lstrlenW (lpString=".dbf") returned 4 [0119.891] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0119.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 63 [0119.891] lstrlenW (lpString=".1cd") returned 4 [0119.891] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0119.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 63 [0119.892] lstrlenW (lpString=".jpg") returned 4 [0119.892] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0119.892] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x37cfddc | out: lpFileSize=0x37cfddc*=13515) returned 1 [0119.892] CloseHandle (hObject=0x1e0) returned 1 [0119.892] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10890_.gif")) returned 0x20 [0119.892] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10890_.gif.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0119.892] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10890_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0119.892] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0119.892] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0119.892] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10890_.gif.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0119.892] GetLastError () returned 0x0 [0119.892] ReadFile (in: hFile=0x1e0, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x34cb, lpOverlapped=0x0) returned 1 [0119.898] WriteFile (in: hFile=0x1b0, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0x34d0, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0x34d0, lpOverlapped=0x0) returned 1 [0119.898] ReadFile (in: hFile=0x1e0, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x0, lpOverlapped=0x0) returned 1 [0119.898] WriteFile (in: hFile=0x1b0, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0xec, lpOverlapped=0x0) returned 1 [0119.898] SetEndOfFile (hFile=0x1b0) returned 1 [0119.898] CloseHandle (hObject=0x1b0) returned 1 [0119.898] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0119.899] SetEndOfFile (hFile=0x1e0) returned 1 [0119.899] CloseHandle (hObject=0x1e0) returned 1 [0119.899] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0119.899] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10890_.gif")) returned 1 [0119.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 63 [0119.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 63 [0119.900] lstrlenW (lpString=".doc") returned 4 [0119.900] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0119.900] lstrlenW (lpString=".docx") returned 5 [0119.900] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0119.900] lstrlenW (lpString=".pdf") returned 4 [0119.900] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0119.900] lstrlenW (lpString=".xls") returned 4 [0119.900] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0119.900] lstrlenW (lpString=".xlsx") returned 5 [0119.900] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0119.900] lstrlenW (lpString=".ppt") returned 4 [0119.900] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0119.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 63 [0119.900] lstrlenW (lpString=".zip") returned 4 [0119.900] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0119.900] lstrlenW (lpString=".rar") returned 4 [0119.900] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0119.900] lstrlenW (lpString=".bz2") returned 4 [0119.900] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0119.900] lstrlenW (lpString=".7z") returned 3 [0119.900] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0119.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 63 [0119.900] lstrlenW (lpString=".dbf") returned 4 [0119.900] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0119.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 63 [0119.900] lstrlenW (lpString=".1cd") returned 4 [0119.900] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0119.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 63 [0119.900] lstrlenW (lpString=".jpg") returned 4 [0119.900] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0119.901] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x37cfddc | out: lpFileSize=0x37cfddc*=20454) returned 1 [0119.901] CloseHandle (hObject=0x1e0) returned 1 [0119.901] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19563_.gif")) returned 0x20 [0119.901] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19563_.gif.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0119.901] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19563_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0119.901] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0119.901] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0119.901] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19563_.gif.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0119.901] GetLastError () returned 0x0 [0119.902] ReadFile (in: hFile=0x1e0, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x4fe6, lpOverlapped=0x0) returned 1 [0119.971] WriteFile (in: hFile=0x1b0, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0x4ff0, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0x4ff0, lpOverlapped=0x0) returned 1 [0119.972] ReadFile (in: hFile=0x1e0, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x0, lpOverlapped=0x0) returned 1 [0119.972] WriteFile (in: hFile=0x1b0, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0xec, lpOverlapped=0x0) returned 1 [0119.972] SetEndOfFile (hFile=0x1b0) returned 1 [0120.065] CloseHandle (hObject=0x1b0) returned 1 [0120.066] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0120.066] SetEndOfFile (hFile=0x1e0) returned 1 [0120.066] CloseHandle (hObject=0x1e0) returned 1 [0120.066] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0120.067] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19563_.gif")) returned 1 [0120.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 63 [0120.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 63 [0120.069] lstrlenW (lpString=".doc") returned 4 [0120.069] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0120.069] lstrlenW (lpString=".docx") returned 5 [0120.069] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0120.069] lstrlenW (lpString=".pdf") returned 4 [0120.069] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0120.069] lstrlenW (lpString=".xls") returned 4 [0120.069] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0120.069] lstrlenW (lpString=".xlsx") returned 5 [0120.069] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0120.069] lstrlenW (lpString=".ppt") returned 4 [0120.069] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0120.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 63 [0120.069] lstrlenW (lpString=".zip") returned 4 [0120.069] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0120.069] lstrlenW (lpString=".rar") returned 4 [0120.069] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0120.069] lstrlenW (lpString=".bz2") returned 4 [0120.069] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0120.069] lstrlenW (lpString=".7z") returned 3 [0120.069] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0120.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 63 [0120.069] lstrlenW (lpString=".dbf") returned 4 [0120.069] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0120.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 63 [0120.069] lstrlenW (lpString=".1cd") returned 4 [0120.069] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0120.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 63 [0120.070] lstrlenW (lpString=".jpg") returned 4 [0120.070] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0120.070] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0120.070] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0120.070] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19695_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x224 [0120.070] GetLastError () returned 0x0 [0120.070] ReadFile (in: hFile=0x220, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x32b6, lpOverlapped=0x0) returned 1 [0120.071] WriteFile (in: hFile=0x224, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0x32c0, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0x32c0, lpOverlapped=0x0) returned 1 [0120.072] ReadFile (in: hFile=0x220, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x0, lpOverlapped=0x0) returned 1 [0120.072] WriteFile (in: hFile=0x224, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0xec, lpOverlapped=0x0) returned 1 [0120.072] SetEndOfFile (hFile=0x224) returned 1 [0120.072] CloseHandle (hObject=0x224) returned 1 [0120.072] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0120.072] SetEndOfFile (hFile=0x220) returned 1 [0120.073] CloseHandle (hObject=0x220) returned 1 [0120.073] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0120.073] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19695_.wmf")) returned 1 [0120.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 63 [0120.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 63 [0120.073] lstrlenW (lpString=".doc") returned 4 [0120.073] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0120.073] lstrlenW (lpString=".docx") returned 5 [0120.073] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0120.074] lstrlenW (lpString=".pdf") returned 4 [0120.074] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0120.074] lstrlenW (lpString=".xls") returned 4 [0120.074] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0120.074] lstrlenW (lpString=".xlsx") returned 5 [0120.074] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0120.074] lstrlenW (lpString=".ppt") returned 4 [0120.074] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0120.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 63 [0120.074] lstrlenW (lpString=".zip") returned 4 [0120.074] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0120.074] lstrlenW (lpString=".rar") returned 4 [0120.074] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0120.074] lstrlenW (lpString=".bz2") returned 4 [0120.074] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0120.074] lstrlenW (lpString=".7z") returned 3 [0120.074] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0120.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 63 [0120.074] lstrlenW (lpString=".dbf") returned 4 [0120.074] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0120.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 63 [0120.074] lstrlenW (lpString=".1cd") returned 4 [0120.074] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0120.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 63 [0120.074] lstrlenW (lpString=".jpg") returned 4 [0120.074] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0120.074] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x37cfddc | out: lpFileSize=0x37cfddc*=9710) returned 1 [0120.074] CloseHandle (hObject=0x220) returned 1 [0120.074] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19827_.wmf")) returned 0x20 [0120.074] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19827_.wmf.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0120.074] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19827_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0120.075] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0120.075] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0120.075] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19827_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x224 [0120.075] GetLastError () returned 0x0 [0120.075] ReadFile (in: hFile=0x220, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x25ee, lpOverlapped=0x0) returned 1 [0120.231] WriteFile (in: hFile=0x224, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0x25f0, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0x25f0, lpOverlapped=0x0) returned 1 [0120.232] ReadFile (in: hFile=0x220, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x0, lpOverlapped=0x0) returned 1 [0120.232] WriteFile (in: hFile=0x224, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0xec, lpOverlapped=0x0) returned 1 [0120.232] SetEndOfFile (hFile=0x224) returned 1 [0120.232] CloseHandle (hObject=0x224) returned 1 [0120.232] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0120.232] SetEndOfFile (hFile=0x220) returned 1 [0120.233] CloseHandle (hObject=0x220) returned 1 [0120.233] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0120.233] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19827_.wmf")) returned 1 [0120.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 63 [0120.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 63 [0120.234] lstrlenW (lpString=".doc") returned 4 [0120.234] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0120.234] lstrlenW (lpString=".docx") returned 5 [0120.234] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0120.234] lstrlenW (lpString=".pdf") returned 4 [0120.234] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0120.234] lstrlenW (lpString=".xls") returned 4 [0120.234] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0120.234] lstrlenW (lpString=".xlsx") returned 5 [0120.234] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0120.234] lstrlenW (lpString=".ppt") returned 4 [0120.234] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0120.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 63 [0120.234] lstrlenW (lpString=".zip") returned 4 [0120.234] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0120.234] lstrlenW (lpString=".rar") returned 4 [0120.234] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0120.234] lstrlenW (lpString=".bz2") returned 4 [0120.234] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0120.234] lstrlenW (lpString=".7z") returned 3 [0120.234] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0120.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 63 [0120.234] lstrlenW (lpString=".dbf") returned 4 [0120.234] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0120.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 63 [0120.234] lstrlenW (lpString=".1cd") returned 4 [0120.234] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0120.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 63 [0120.234] lstrlenW (lpString=".jpg") returned 4 [0120.234] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0120.235] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x37cfddc | out: lpFileSize=0x37cfddc*=11058) returned 1 [0120.235] CloseHandle (hObject=0x220) returned 1 [0120.235] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd20013_.wmf")) returned 0x20 [0120.235] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd20013_.wmf.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0120.235] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd20013_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0120.235] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0120.235] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0120.235] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd20013_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x224 [0120.235] GetLastError () returned 0x0 [0120.235] ReadFile (in: hFile=0x220, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x2b32, lpOverlapped=0x0) returned 1 [0120.258] WriteFile (in: hFile=0x224, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0x2b40, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0x2b40, lpOverlapped=0x0) returned 1 [0120.259] ReadFile (in: hFile=0x220, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x0, lpOverlapped=0x0) returned 1 [0120.259] WriteFile (in: hFile=0x224, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0xec, lpOverlapped=0x0) returned 1 [0120.259] SetEndOfFile (hFile=0x224) returned 1 [0120.442] CloseHandle (hObject=0x224) returned 1 [0120.442] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0120.442] SetEndOfFile (hFile=0x220) returned 1 [0120.443] CloseHandle (hObject=0x220) returned 1 [0120.443] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0120.443] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd20013_.wmf")) returned 1 [0120.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 63 [0120.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 63 [0120.443] lstrlenW (lpString=".doc") returned 4 [0120.443] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0120.443] lstrlenW (lpString=".docx") returned 5 [0120.443] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0120.443] lstrlenW (lpString=".pdf") returned 4 [0120.443] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0120.443] lstrlenW (lpString=".xls") returned 4 [0120.443] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0120.443] lstrlenW (lpString=".xlsx") returned 5 [0120.443] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0120.444] lstrlenW (lpString=".ppt") returned 4 [0120.444] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0120.444] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 63 [0120.444] lstrlenW (lpString=".zip") returned 4 [0120.444] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0120.444] lstrlenW (lpString=".rar") returned 4 [0120.444] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0120.444] lstrlenW (lpString=".bz2") returned 4 [0120.444] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0120.444] lstrlenW (lpString=".7z") returned 3 [0120.444] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0120.444] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 63 [0120.444] lstrlenW (lpString=".dbf") returned 4 [0120.444] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0120.444] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 63 [0120.444] lstrlenW (lpString=".1cd") returned 4 [0120.444] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0120.444] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 63 [0120.444] lstrlenW (lpString=".jpg") returned 4 [0120.444] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0120.463] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x37cfddc | out: lpFileSize=0x37cfddc*=9818) returned 1 [0120.463] CloseHandle (hObject=0x1ec) returned 1 [0120.463] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00012_.wmf")) returned 0x20 [0120.464] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00012_.wmf.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0120.464] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00012_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0120.464] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0120.464] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0120.464] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00012_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0120.464] GetLastError () returned 0x0 [0120.464] ReadFile (in: hFile=0x1ec, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x265a, lpOverlapped=0x0) returned 1 [0120.559] WriteFile (in: hFile=0x220, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0x2660, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0x2660, lpOverlapped=0x0) returned 1 [0120.559] ReadFile (in: hFile=0x1ec, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x0, lpOverlapped=0x0) returned 1 [0120.559] WriteFile (in: hFile=0x220, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0xec, lpOverlapped=0x0) returned 1 [0120.559] SetEndOfFile (hFile=0x220) returned 1 [0120.560] CloseHandle (hObject=0x220) returned 1 [0120.560] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0120.560] SetEndOfFile (hFile=0x1ec) returned 1 [0120.561] CloseHandle (hObject=0x1ec) returned 1 [0120.561] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0120.561] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00012_.wmf")) returned 1 [0120.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 63 [0120.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 63 [0120.562] lstrlenW (lpString=".doc") returned 4 [0120.562] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0120.562] lstrlenW (lpString=".docx") returned 5 [0120.562] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0120.562] lstrlenW (lpString=".pdf") returned 4 [0120.562] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0120.562] lstrlenW (lpString=".xls") returned 4 [0120.562] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0120.562] lstrlenW (lpString=".xlsx") returned 5 [0120.562] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0120.562] lstrlenW (lpString=".ppt") returned 4 [0120.562] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0120.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 63 [0120.562] lstrlenW (lpString=".zip") returned 4 [0120.562] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0120.562] lstrlenW (lpString=".rar") returned 4 [0120.562] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0120.562] lstrlenW (lpString=".bz2") returned 4 [0120.562] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0120.562] lstrlenW (lpString=".7z") returned 3 [0120.562] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0120.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 63 [0120.562] lstrlenW (lpString=".dbf") returned 4 [0120.562] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0120.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 63 [0120.562] lstrlenW (lpString=".1cd") returned 4 [0120.562] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0120.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 63 [0120.562] lstrlenW (lpString=".jpg") returned 4 [0120.562] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0120.562] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x37cfddc | out: lpFileSize=0x37cfddc*=1464) returned 1 [0120.562] CloseHandle (hObject=0x1ec) returned 1 [0120.563] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00130_.wmf")) returned 0x20 [0120.563] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00130_.wmf.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0120.563] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00130_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0120.563] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0120.563] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0120.563] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00130_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0120.563] GetLastError () returned 0x0 [0120.563] ReadFile (in: hFile=0x1ec, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x5b8, lpOverlapped=0x0) returned 1 [0120.581] WriteFile (in: hFile=0x220, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0x5c0, lpOverlapped=0x0) returned 1 [0120.582] ReadFile (in: hFile=0x1ec, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x0, lpOverlapped=0x0) returned 1 [0120.582] WriteFile (in: hFile=0x220, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0xec, lpOverlapped=0x0) returned 1 [0120.582] SetEndOfFile (hFile=0x220) returned 1 [0120.589] CloseHandle (hObject=0x220) returned 1 [0120.589] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0120.589] SetEndOfFile (hFile=0x1ec) returned 1 [0120.590] CloseHandle (hObject=0x1ec) returned 1 [0120.590] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0120.590] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00130_.wmf")) returned 1 [0120.590] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 63 [0120.590] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 63 [0120.590] lstrlenW (lpString=".doc") returned 4 [0120.590] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0120.590] lstrlenW (lpString=".docx") returned 5 [0120.590] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0120.590] lstrlenW (lpString=".pdf") returned 4 [0120.590] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0120.590] lstrlenW (lpString=".xls") returned 4 [0120.590] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0120.590] lstrlenW (lpString=".xlsx") returned 5 [0120.590] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0120.591] lstrlenW (lpString=".ppt") returned 4 [0120.591] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0120.591] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 63 [0120.591] lstrlenW (lpString=".zip") returned 4 [0120.591] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0120.591] lstrlenW (lpString=".rar") returned 4 [0120.591] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0120.591] lstrlenW (lpString=".bz2") returned 4 [0120.591] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0120.591] lstrlenW (lpString=".7z") returned 3 [0120.591] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0120.591] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 63 [0120.591] lstrlenW (lpString=".dbf") returned 4 [0120.591] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0120.591] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 63 [0120.591] lstrlenW (lpString=".1cd") returned 4 [0120.591] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0120.591] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 63 [0120.591] lstrlenW (lpString=".jpg") returned 4 [0120.591] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0120.591] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x37cfddc | out: lpFileSize=0x37cfddc*=9304) returned 1 [0120.591] CloseHandle (hObject=0x1ec) returned 1 [0120.591] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00234_.wmf")) returned 0x20 [0120.591] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00234_.wmf.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0120.591] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00234_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0120.591] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0120.592] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0120.592] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00234_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0120.592] GetLastError () returned 0x0 [0120.592] ReadFile (in: hFile=0x1ec, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x2458, lpOverlapped=0x0) returned 1 [0120.633] WriteFile (in: hFile=0x220, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0x2460, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0x2460, lpOverlapped=0x0) returned 1 [0120.634] ReadFile (in: hFile=0x1ec, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x0, lpOverlapped=0x0) returned 1 [0120.634] WriteFile (in: hFile=0x220, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0xec, lpOverlapped=0x0) returned 1 [0120.634] SetEndOfFile (hFile=0x220) returned 1 [0120.634] CloseHandle (hObject=0x220) returned 1 [0120.634] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0120.634] SetEndOfFile (hFile=0x1ec) returned 1 [0120.635] CloseHandle (hObject=0x1ec) returned 1 [0120.635] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0120.635] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00234_.wmf")) returned 1 [0120.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 63 [0120.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 63 [0120.635] lstrlenW (lpString=".doc") returned 4 [0120.635] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0120.635] lstrlenW (lpString=".docx") returned 5 [0120.635] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0120.635] lstrlenW (lpString=".pdf") returned 4 [0120.635] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0120.635] lstrlenW (lpString=".xls") returned 4 [0120.635] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0120.635] lstrlenW (lpString=".xlsx") returned 5 [0120.635] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0120.635] lstrlenW (lpString=".ppt") returned 4 [0120.636] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0120.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 63 [0120.636] lstrlenW (lpString=".zip") returned 4 [0120.636] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0120.636] lstrlenW (lpString=".rar") returned 4 [0120.636] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0120.636] lstrlenW (lpString=".bz2") returned 4 [0120.636] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0120.636] lstrlenW (lpString=".7z") returned 3 [0120.636] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0120.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 63 [0120.636] lstrlenW (lpString=".dbf") returned 4 [0120.636] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0120.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 63 [0120.636] lstrlenW (lpString=".1cd") returned 4 [0120.636] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0120.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 63 [0120.636] lstrlenW (lpString=".jpg") returned 4 [0120.636] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0120.636] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x37cfddc | out: lpFileSize=0x37cfddc*=12482) returned 1 [0120.636] CloseHandle (hObject=0x1ec) returned 1 [0120.636] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00261_.wmf")) returned 0x20 [0120.636] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00261_.wmf.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0120.636] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00261_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0120.636] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0120.636] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0120.637] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00261_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0120.637] GetLastError () returned 0x0 [0120.637] ReadFile (in: hFile=0x1ec, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x30c2, lpOverlapped=0x0) returned 1 [0120.690] WriteFile (in: hFile=0x220, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0x30d0, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0x30d0, lpOverlapped=0x0) returned 1 [0120.691] ReadFile (in: hFile=0x1ec, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x0, lpOverlapped=0x0) returned 1 [0120.691] WriteFile (in: hFile=0x220, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0xec, lpOverlapped=0x0) returned 1 [0120.691] SetEndOfFile (hFile=0x220) returned 1 [0120.691] CloseHandle (hObject=0x220) returned 1 [0120.691] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0120.691] SetEndOfFile (hFile=0x1ec) returned 1 [0120.692] CloseHandle (hObject=0x1ec) returned 1 [0120.692] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0120.692] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00261_.wmf")) returned 1 [0120.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 63 [0120.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 63 [0120.692] lstrlenW (lpString=".doc") returned 4 [0120.692] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0120.692] lstrlenW (lpString=".docx") returned 5 [0120.692] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0120.692] lstrlenW (lpString=".pdf") returned 4 [0120.692] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0120.692] lstrlenW (lpString=".xls") returned 4 [0120.692] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0120.692] lstrlenW (lpString=".xlsx") returned 5 [0120.692] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0120.692] lstrlenW (lpString=".ppt") returned 4 [0120.692] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0120.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 63 [0120.693] lstrlenW (lpString=".zip") returned 4 [0120.693] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0120.693] lstrlenW (lpString=".rar") returned 4 [0120.693] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0120.693] lstrlenW (lpString=".bz2") returned 4 [0120.693] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0120.693] lstrlenW (lpString=".7z") returned 3 [0120.693] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0120.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 63 [0120.693] lstrlenW (lpString=".dbf") returned 4 [0120.693] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0120.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 63 [0120.693] lstrlenW (lpString=".1cd") returned 4 [0120.693] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0120.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 63 [0120.693] lstrlenW (lpString=".jpg") returned 4 [0120.693] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0120.693] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x37cfddc | out: lpFileSize=0x37cfddc*=3780) returned 1 [0120.693] CloseHandle (hObject=0x1ec) returned 1 [0120.693] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00273_.wmf")) returned 0x20 [0120.693] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00273_.wmf.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0120.693] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00273_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0120.693] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0120.693] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0120.693] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00273_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0120.694] GetLastError () returned 0x0 [0120.694] ReadFile (in: hFile=0x1ec, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0xec4, lpOverlapped=0x0) returned 1 [0120.699] WriteFile (in: hFile=0x220, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0xed0, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0xed0, lpOverlapped=0x0) returned 1 [0120.700] ReadFile (in: hFile=0x1ec, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x0, lpOverlapped=0x0) returned 1 [0120.700] WriteFile (in: hFile=0x220, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0xec, lpOverlapped=0x0) returned 1 [0120.700] SetEndOfFile (hFile=0x220) returned 1 [0120.700] CloseHandle (hObject=0x220) returned 1 [0120.700] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0120.700] SetEndOfFile (hFile=0x1ec) returned 1 [0120.701] CloseHandle (hObject=0x1ec) returned 1 [0120.701] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0120.701] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00273_.wmf")) returned 1 [0120.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 63 [0120.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 63 [0120.701] lstrlenW (lpString=".doc") returned 4 [0120.701] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0120.701] lstrlenW (lpString=".docx") returned 5 [0120.701] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0120.701] lstrlenW (lpString=".pdf") returned 4 [0120.701] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0120.701] lstrlenW (lpString=".xls") returned 4 [0120.701] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0120.701] lstrlenW (lpString=".xlsx") returned 5 [0120.701] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0120.701] lstrlenW (lpString=".ppt") returned 4 [0120.701] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0120.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 63 [0120.701] lstrlenW (lpString=".zip") returned 4 [0120.701] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0120.701] lstrlenW (lpString=".rar") returned 4 [0120.701] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0120.701] lstrlenW (lpString=".bz2") returned 4 [0120.701] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0120.701] lstrlenW (lpString=".7z") returned 3 [0120.701] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0120.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 63 [0120.701] lstrlenW (lpString=".dbf") returned 4 [0120.701] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0120.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 63 [0120.702] lstrlenW (lpString=".1cd") returned 4 [0120.702] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0120.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 63 [0120.702] lstrlenW (lpString=".jpg") returned 4 [0120.702] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0120.702] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x37cfddc | out: lpFileSize=0x37cfddc*=4164) returned 1 [0120.702] CloseHandle (hObject=0x1ec) returned 1 [0120.702] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00274_.wmf")) returned 0x20 [0120.702] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00274_.wmf.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0120.702] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00274_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0120.702] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0120.702] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0120.702] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00274_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0120.703] GetLastError () returned 0x0 [0120.703] ReadFile (in: hFile=0x1ec, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x1044, lpOverlapped=0x0) returned 1 [0120.752] WriteFile (in: hFile=0x220, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0x1050, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0x1050, lpOverlapped=0x0) returned 1 [0120.752] ReadFile (in: hFile=0x1ec, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x0, lpOverlapped=0x0) returned 1 [0120.752] WriteFile (in: hFile=0x220, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0xec, lpOverlapped=0x0) returned 1 [0120.752] SetEndOfFile (hFile=0x220) returned 1 [0120.753] CloseHandle (hObject=0x220) returned 1 [0120.753] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0120.753] SetEndOfFile (hFile=0x1ec) returned 1 [0120.753] CloseHandle (hObject=0x1ec) returned 1 [0120.753] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0120.753] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00274_.wmf")) returned 1 [0120.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 63 [0120.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 63 [0120.754] lstrlenW (lpString=".doc") returned 4 [0120.754] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0120.754] lstrlenW (lpString=".docx") returned 5 [0120.754] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0120.754] lstrlenW (lpString=".pdf") returned 4 [0120.754] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0120.754] lstrlenW (lpString=".xls") returned 4 [0120.754] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0120.754] lstrlenW (lpString=".xlsx") returned 5 [0120.754] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0120.754] lstrlenW (lpString=".ppt") returned 4 [0120.754] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0120.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 63 [0120.754] lstrlenW (lpString=".zip") returned 4 [0120.754] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0120.754] lstrlenW (lpString=".rar") returned 4 [0120.754] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0120.754] lstrlenW (lpString=".bz2") returned 4 [0120.754] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0120.754] lstrlenW (lpString=".7z") returned 3 [0120.754] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0120.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 63 [0120.754] lstrlenW (lpString=".dbf") returned 4 [0120.754] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0120.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 63 [0120.754] lstrlenW (lpString=".1cd") returned 4 [0120.754] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0120.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 63 [0120.754] lstrlenW (lpString=".jpg") returned 4 [0120.754] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0120.755] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x37cfddc | out: lpFileSize=0x37cfddc*=4408) returned 1 [0120.755] CloseHandle (hObject=0x1ec) returned 1 [0120.755] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00921_.wmf")) returned 0x20 [0120.755] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00921_.wmf.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0120.755] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00921_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0120.755] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0120.755] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0120.755] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00921_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0120.755] GetLastError () returned 0x0 [0120.755] ReadFile (in: hFile=0x1ec, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x1138, lpOverlapped=0x0) returned 1 [0120.765] WriteFile (in: hFile=0x220, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0x1140, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0x1140, lpOverlapped=0x0) returned 1 [0120.766] ReadFile (in: hFile=0x1ec, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x0, lpOverlapped=0x0) returned 1 [0120.766] WriteFile (in: hFile=0x220, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0xec, lpOverlapped=0x0) returned 1 [0120.766] SetEndOfFile (hFile=0x220) returned 1 [0120.766] CloseHandle (hObject=0x220) returned 1 [0120.766] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0120.766] SetEndOfFile (hFile=0x1ec) returned 1 [0120.767] CloseHandle (hObject=0x1ec) returned 1 [0120.767] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0120.767] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00921_.wmf")) returned 1 [0120.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 63 [0120.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 63 [0120.767] lstrlenW (lpString=".doc") returned 4 [0120.768] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0120.768] lstrlenW (lpString=".docx") returned 5 [0120.768] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0120.768] lstrlenW (lpString=".pdf") returned 4 [0120.768] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0120.768] lstrlenW (lpString=".xls") returned 4 [0120.768] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0120.768] lstrlenW (lpString=".xlsx") returned 5 [0120.768] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0120.768] lstrlenW (lpString=".ppt") returned 4 [0120.768] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0120.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 63 [0120.768] lstrlenW (lpString=".zip") returned 4 [0120.768] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0120.768] lstrlenW (lpString=".rar") returned 4 [0120.768] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0120.768] lstrlenW (lpString=".bz2") returned 4 [0120.768] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0120.768] lstrlenW (lpString=".7z") returned 3 [0120.768] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0120.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 63 [0120.768] lstrlenW (lpString=".dbf") returned 4 [0120.768] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0120.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 63 [0120.768] lstrlenW (lpString=".1cd") returned 4 [0120.768] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0120.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 63 [0120.768] lstrlenW (lpString=".jpg") returned 4 [0120.768] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0120.768] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x37cfddc | out: lpFileSize=0x37cfddc*=3768) returned 1 [0120.768] CloseHandle (hObject=0x1ec) returned 1 [0120.769] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00985_.wmf")) returned 0x20 [0120.769] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00985_.wmf.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0120.769] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00985_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0120.769] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0120.769] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0120.769] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00985_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0120.769] GetLastError () returned 0x0 [0120.769] ReadFile (in: hFile=0x1ec, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0xeb8, lpOverlapped=0x0) returned 1 [0120.795] WriteFile (in: hFile=0x220, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0xec0, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0xec0, lpOverlapped=0x0) returned 1 [0120.796] ReadFile (in: hFile=0x1ec, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x0, lpOverlapped=0x0) returned 1 [0120.796] WriteFile (in: hFile=0x220, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0xec, lpOverlapped=0x0) returned 1 [0120.796] SetEndOfFile (hFile=0x220) returned 1 [0120.796] CloseHandle (hObject=0x220) returned 1 [0120.796] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0120.796] SetEndOfFile (hFile=0x1ec) returned 1 [0120.797] CloseHandle (hObject=0x1ec) returned 1 [0120.797] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0120.797] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00985_.wmf")) returned 1 [0120.797] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 63 [0120.797] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 63 [0120.797] lstrlenW (lpString=".doc") returned 4 [0120.797] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0120.798] lstrlenW (lpString=".docx") returned 5 [0120.798] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0120.798] lstrlenW (lpString=".pdf") returned 4 [0120.798] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0120.798] lstrlenW (lpString=".xls") returned 4 [0120.798] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0120.798] lstrlenW (lpString=".xlsx") returned 5 [0120.798] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0120.798] lstrlenW (lpString=".ppt") returned 4 [0120.798] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0120.798] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 63 [0120.798] lstrlenW (lpString=".zip") returned 4 [0120.798] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0120.798] lstrlenW (lpString=".rar") returned 4 [0120.798] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0120.798] lstrlenW (lpString=".bz2") returned 4 [0120.798] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0120.798] lstrlenW (lpString=".7z") returned 3 [0120.798] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0120.798] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 63 [0120.798] lstrlenW (lpString=".dbf") returned 4 [0120.798] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0120.798] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 63 [0120.798] lstrlenW (lpString=".1cd") returned 4 [0120.798] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0120.798] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 63 [0120.798] lstrlenW (lpString=".jpg") returned 4 [0120.798] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0120.798] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x37cfddc | out: lpFileSize=0x37cfddc*=3350) returned 1 [0120.798] CloseHandle (hObject=0x1ec) returned 1 [0120.798] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boat.wmf")) returned 0x20 [0120.798] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boat.wmf.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0120.798] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boat.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0120.799] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0120.799] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0120.799] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boat.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0120.799] GetLastError () returned 0x0 [0120.799] ReadFile (in: hFile=0x1ec, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0xd16, lpOverlapped=0x0) returned 1 [0120.807] WriteFile (in: hFile=0x220, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0xd20, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0xd20, lpOverlapped=0x0) returned 1 [0120.808] ReadFile (in: hFile=0x1ec, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x0, lpOverlapped=0x0) returned 1 [0120.808] WriteFile (in: hFile=0x220, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0xe4, lpOverlapped=0x0) returned 1 [0120.808] SetEndOfFile (hFile=0x220) returned 1 [0120.808] CloseHandle (hObject=0x220) returned 1 [0120.808] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0120.808] SetEndOfFile (hFile=0x1ec) returned 1 [0120.809] CloseHandle (hObject=0x1ec) returned 1 [0120.809] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0120.809] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boat.wmf")) returned 1 [0120.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF") returned 59 [0120.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF") returned 59 [0120.809] lstrlenW (lpString=".doc") returned 4 [0120.809] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0120.809] lstrlenW (lpString=".docx") returned 5 [0120.809] lstrcmpiW (lpString1=".docx", lpString2="T.WMF") returned -1 [0120.809] lstrlenW (lpString=".pdf") returned 4 [0120.809] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0120.809] lstrlenW (lpString=".xls") returned 4 [0120.809] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0120.809] lstrlenW (lpString=".xlsx") returned 5 [0120.809] lstrcmpiW (lpString1=".xlsx", lpString2="T.WMF") returned -1 [0120.809] lstrlenW (lpString=".ppt") returned 4 [0120.809] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0120.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF") returned 59 [0120.809] lstrlenW (lpString=".zip") returned 4 [0120.809] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0120.809] lstrlenW (lpString=".rar") returned 4 [0120.809] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0120.809] lstrlenW (lpString=".bz2") returned 4 [0120.809] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0120.809] lstrlenW (lpString=".7z") returned 3 [0120.809] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0120.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF") returned 59 [0120.809] lstrlenW (lpString=".dbf") returned 4 [0120.809] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0120.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF") returned 59 [0120.809] lstrlenW (lpString=".1cd") returned 4 [0120.809] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0120.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF") returned 59 [0120.809] lstrlenW (lpString=".jpg") returned 4 [0120.810] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0120.810] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x37cfddc | out: lpFileSize=0x37cfddc*=1330) returned 1 [0120.810] CloseHandle (hObject=0x1ec) returned 1 [0120.810] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00076_.wmf")) returned 0x20 [0120.810] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00076_.wmf.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0120.810] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00076_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0120.810] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0120.810] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0120.810] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00076_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0120.810] GetLastError () returned 0x0 [0120.810] ReadFile (in: hFile=0x1ec, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x532, lpOverlapped=0x0) returned 1 [0120.858] WriteFile (in: hFile=0x220, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0x540, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0x540, lpOverlapped=0x0) returned 1 [0120.859] ReadFile (in: hFile=0x1ec, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x0, lpOverlapped=0x0) returned 1 [0120.859] WriteFile (in: hFile=0x220, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0xec, lpOverlapped=0x0) returned 1 [0120.859] SetEndOfFile (hFile=0x220) returned 1 [0120.859] CloseHandle (hObject=0x220) returned 1 [0120.859] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0120.859] SetEndOfFile (hFile=0x1ec) returned 1 [0120.860] CloseHandle (hObject=0x1ec) returned 1 [0120.860] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0120.860] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00076_.wmf")) returned 1 [0120.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 63 [0120.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 63 [0120.860] lstrlenW (lpString=".doc") returned 4 [0120.860] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0120.860] lstrlenW (lpString=".docx") returned 5 [0120.860] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0120.860] lstrlenW (lpString=".pdf") returned 4 [0120.860] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0120.860] lstrlenW (lpString=".xls") returned 4 [0120.860] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0120.860] lstrlenW (lpString=".xlsx") returned 5 [0120.860] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0120.860] lstrlenW (lpString=".ppt") returned 4 [0120.860] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0120.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 63 [0120.860] lstrlenW (lpString=".zip") returned 4 [0120.860] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0120.860] lstrlenW (lpString=".rar") returned 4 [0120.860] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0120.860] lstrlenW (lpString=".bz2") returned 4 [0120.860] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0120.860] lstrlenW (lpString=".7z") returned 3 [0120.861] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0120.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 63 [0120.861] lstrlenW (lpString=".dbf") returned 4 [0120.861] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0120.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 63 [0120.861] lstrlenW (lpString=".1cd") returned 4 [0120.861] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0120.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 63 [0120.861] lstrlenW (lpString=".jpg") returned 4 [0120.861] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0120.861] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x37cfddc | out: lpFileSize=0x37cfddc*=1044) returned 1 [0120.861] CloseHandle (hObject=0x1ec) returned 1 [0120.861] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00135_.wmf")) returned 0x20 [0120.861] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00135_.wmf.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0120.861] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00135_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0120.861] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0120.861] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0120.861] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00135_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0120.862] GetLastError () returned 0x0 [0120.862] ReadFile (in: hFile=0x1ec, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x414, lpOverlapped=0x0) returned 1 [0120.882] WriteFile (in: hFile=0x220, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0x420, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0x420, lpOverlapped=0x0) returned 1 [0120.883] ReadFile (in: hFile=0x1ec, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x0, lpOverlapped=0x0) returned 1 [0120.883] WriteFile (in: hFile=0x220, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0xec, lpOverlapped=0x0) returned 1 [0120.883] SetEndOfFile (hFile=0x220) returned 1 [0120.883] CloseHandle (hObject=0x220) returned 1 [0120.883] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0120.883] SetEndOfFile (hFile=0x1ec) returned 1 [0120.883] CloseHandle (hObject=0x1ec) returned 1 [0120.883] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0120.884] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00135_.wmf")) returned 1 [0120.884] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 63 [0120.884] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 63 [0120.884] lstrlenW (lpString=".doc") returned 4 [0120.884] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0120.884] lstrlenW (lpString=".docx") returned 5 [0120.885] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0120.885] lstrlenW (lpString=".pdf") returned 4 [0120.885] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0120.885] lstrlenW (lpString=".xls") returned 4 [0120.885] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0120.885] lstrlenW (lpString=".xlsx") returned 5 [0120.885] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0120.885] lstrlenW (lpString=".ppt") returned 4 [0120.885] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0120.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 63 [0120.885] lstrlenW (lpString=".zip") returned 4 [0120.885] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0120.885] lstrlenW (lpString=".rar") returned 4 [0120.885] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0120.885] lstrlenW (lpString=".bz2") returned 4 [0120.885] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0120.885] lstrlenW (lpString=".7z") returned 3 [0120.885] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0120.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 63 [0120.885] lstrlenW (lpString=".dbf") returned 4 [0120.885] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0120.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 63 [0120.885] lstrlenW (lpString=".1cd") returned 4 [0120.885] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0120.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 63 [0120.885] lstrlenW (lpString=".jpg") returned 4 [0120.885] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0120.885] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x37cfddc | out: lpFileSize=0x37cfddc*=8366) returned 1 [0120.885] CloseHandle (hObject=0x1ec) returned 1 [0120.885] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00174_.wmf")) returned 0x20 [0120.885] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00174_.wmf.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0120.885] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00174_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0120.885] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0120.886] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0120.886] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00174_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0120.886] GetLastError () returned 0x0 [0120.886] ReadFile (in: hFile=0x1ec, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x20ae, lpOverlapped=0x0) returned 1 [0120.922] WriteFile (in: hFile=0x220, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0x20b0, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0x20b0, lpOverlapped=0x0) returned 1 [0120.923] ReadFile (in: hFile=0x1ec, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x0, lpOverlapped=0x0) returned 1 [0120.923] WriteFile (in: hFile=0x220, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0xec, lpOverlapped=0x0) returned 1 [0120.923] SetEndOfFile (hFile=0x220) returned 1 [0120.923] CloseHandle (hObject=0x220) returned 1 [0120.923] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0120.923] SetEndOfFile (hFile=0x1ec) returned 1 [0120.924] CloseHandle (hObject=0x1ec) returned 1 [0120.924] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0120.924] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00174_.wmf")) returned 1 [0120.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 63 [0120.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 63 [0120.924] lstrlenW (lpString=".doc") returned 4 [0120.924] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0120.924] lstrlenW (lpString=".docx") returned 5 [0120.924] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0120.924] lstrlenW (lpString=".pdf") returned 4 [0120.924] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0120.924] lstrlenW (lpString=".xls") returned 4 [0120.924] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0120.924] lstrlenW (lpString=".xlsx") returned 5 [0120.924] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0120.924] lstrlenW (lpString=".ppt") returned 4 [0120.924] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0120.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 63 [0120.924] lstrlenW (lpString=".zip") returned 4 [0120.924] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0120.924] lstrlenW (lpString=".rar") returned 4 [0120.924] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0120.924] lstrlenW (lpString=".bz2") returned 4 [0120.924] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0120.924] lstrlenW (lpString=".7z") returned 3 [0120.924] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0120.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 63 [0120.924] lstrlenW (lpString=".dbf") returned 4 [0120.924] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0120.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 63 [0120.925] lstrlenW (lpString=".1cd") returned 4 [0120.925] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0120.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 63 [0120.925] lstrlenW (lpString=".jpg") returned 4 [0120.925] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0120.925] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x37cfddc | out: lpFileSize=0x37cfddc*=2052) returned 1 [0120.925] CloseHandle (hObject=0x1ec) returned 1 [0120.925] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00439_.wmf")) returned 0x20 [0120.925] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00439_.wmf.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0120.925] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00439_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0120.925] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0120.925] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0120.926] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00439_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0120.926] GetLastError () returned 0x0 [0120.926] ReadFile (in: hFile=0x1ec, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x804, lpOverlapped=0x0) returned 1 [0121.039] WriteFile (in: hFile=0x220, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0x810, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0x810, lpOverlapped=0x0) returned 1 [0121.039] ReadFile (in: hFile=0x1ec, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x0, lpOverlapped=0x0) returned 1 [0121.039] WriteFile (in: hFile=0x220, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0xec, lpOverlapped=0x0) returned 1 [0121.040] SetEndOfFile (hFile=0x220) returned 1 [0121.040] CloseHandle (hObject=0x220) returned 1 [0121.040] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0121.040] SetEndOfFile (hFile=0x1ec) returned 1 [0121.040] CloseHandle (hObject=0x1ec) returned 1 [0121.040] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0121.040] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00439_.wmf")) returned 1 [0121.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 63 [0121.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 63 [0121.041] lstrlenW (lpString=".doc") returned 4 [0121.041] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0121.041] lstrlenW (lpString=".docx") returned 5 [0121.041] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0121.041] lstrlenW (lpString=".pdf") returned 4 [0121.041] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0121.041] lstrlenW (lpString=".xls") returned 4 [0121.041] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0121.041] lstrlenW (lpString=".xlsx") returned 5 [0121.041] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0121.041] lstrlenW (lpString=".ppt") returned 4 [0121.041] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0121.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 63 [0121.041] lstrlenW (lpString=".zip") returned 4 [0121.041] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0121.041] lstrlenW (lpString=".rar") returned 4 [0121.041] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0121.041] lstrlenW (lpString=".bz2") returned 4 [0121.041] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0121.041] lstrlenW (lpString=".7z") returned 3 [0121.041] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0121.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 63 [0121.041] lstrlenW (lpString=".dbf") returned 4 [0121.041] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0121.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 63 [0121.041] lstrlenW (lpString=".1cd") returned 4 [0121.041] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0121.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 63 [0121.041] lstrlenW (lpString=".jpg") returned 4 [0121.041] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0121.041] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x37cfddc | out: lpFileSize=0x37cfddc*=2732) returned 1 [0121.041] CloseHandle (hObject=0x1ec) returned 1 [0121.041] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01080_.wmf")) returned 0x20 [0121.041] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01080_.wmf.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0121.042] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01080_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0121.042] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0121.042] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0121.042] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01080_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0121.042] GetLastError () returned 0x0 [0121.042] ReadFile (in: hFile=0x1ec, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0xaac, lpOverlapped=0x0) returned 1 [0121.044] WriteFile (in: hFile=0x220, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0xab0, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0xab0, lpOverlapped=0x0) returned 1 [0121.046] ReadFile (in: hFile=0x1ec, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x0, lpOverlapped=0x0) returned 1 [0121.046] WriteFile (in: hFile=0x220, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0xec, lpOverlapped=0x0) returned 1 [0121.046] SetEndOfFile (hFile=0x220) returned 1 [0121.046] CloseHandle (hObject=0x220) returned 1 [0121.046] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0121.046] SetEndOfFile (hFile=0x1ec) returned 1 [0121.046] CloseHandle (hObject=0x1ec) returned 1 [0121.046] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0121.047] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01080_.wmf")) returned 1 [0121.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 63 [0121.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 63 [0121.047] lstrlenW (lpString=".doc") returned 4 [0121.047] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0121.047] lstrlenW (lpString=".docx") returned 5 [0121.047] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0121.047] lstrlenW (lpString=".pdf") returned 4 [0121.047] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0121.047] lstrlenW (lpString=".xls") returned 4 [0121.047] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0121.047] lstrlenW (lpString=".xlsx") returned 5 [0121.047] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0121.047] lstrlenW (lpString=".ppt") returned 4 [0121.047] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0121.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 63 [0121.047] lstrlenW (lpString=".zip") returned 4 [0121.047] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0121.047] lstrlenW (lpString=".rar") returned 4 [0121.047] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0121.047] lstrlenW (lpString=".bz2") returned 4 [0121.047] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0121.047] lstrlenW (lpString=".7z") returned 3 [0121.047] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0121.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 63 [0121.047] lstrlenW (lpString=".dbf") returned 4 [0121.047] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0121.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 63 [0121.047] lstrlenW (lpString=".1cd") returned 4 [0121.047] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0121.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 63 [0121.047] lstrlenW (lpString=".jpg") returned 4 [0121.047] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0121.057] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0121.057] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0121.057] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01603_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0121.057] GetLastError () returned 0x0 [0121.058] ReadFile (in: hFile=0x1a0, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x1c08, lpOverlapped=0x0) returned 1 [0121.143] WriteFile (in: hFile=0x1c0, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0x1c10, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0x1c10, lpOverlapped=0x0) returned 1 [0121.144] ReadFile (in: hFile=0x1a0, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x0, lpOverlapped=0x0) returned 1 [0121.144] WriteFile (in: hFile=0x1c0, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0xec, lpOverlapped=0x0) returned 1 [0121.144] SetEndOfFile (hFile=0x1c0) returned 1 [0121.144] CloseHandle (hObject=0x1c0) returned 1 [0121.144] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0121.144] SetEndOfFile (hFile=0x1a0) returned 1 [0121.144] CloseHandle (hObject=0x1a0) returned 1 [0121.145] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0121.145] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01603_.wmf")) returned 1 [0121.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 63 [0121.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 63 [0121.145] lstrlenW (lpString=".doc") returned 4 [0121.145] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0121.145] lstrlenW (lpString=".docx") returned 5 [0121.145] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0121.145] lstrlenW (lpString=".pdf") returned 4 [0121.145] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0121.145] lstrlenW (lpString=".xls") returned 4 [0121.145] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0121.145] lstrlenW (lpString=".xlsx") returned 5 [0121.145] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0121.145] lstrlenW (lpString=".ppt") returned 4 [0121.145] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0121.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 63 [0121.145] lstrlenW (lpString=".zip") returned 4 [0121.145] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0121.145] lstrlenW (lpString=".rar") returned 4 [0121.145] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0121.145] lstrlenW (lpString=".bz2") returned 4 [0121.145] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0121.145] lstrlenW (lpString=".7z") returned 3 [0121.145] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0121.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 63 [0121.145] lstrlenW (lpString=".dbf") returned 4 [0121.145] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0121.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 63 [0121.146] lstrlenW (lpString=".1cd") returned 4 [0121.146] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0121.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 63 [0121.146] lstrlenW (lpString=".jpg") returned 4 [0121.146] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0121.146] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x37cfddc | out: lpFileSize=0x37cfddc*=3948) returned 1 [0121.146] CloseHandle (hObject=0x1a0) returned 1 [0121.146] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01637_.wmf")) returned 0x20 [0121.146] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01637_.wmf.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0121.146] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01637_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0121.146] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0121.146] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0121.146] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01637_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0121.147] GetLastError () returned 0x0 [0121.147] ReadFile (in: hFile=0x1a0, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0xf6c, lpOverlapped=0x0) returned 1 [0121.170] WriteFile (in: hFile=0x1c0, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0xf70, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0xf70, lpOverlapped=0x0) returned 1 [0121.171] ReadFile (in: hFile=0x1a0, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x0, lpOverlapped=0x0) returned 1 [0121.171] WriteFile (in: hFile=0x1c0, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0xec, lpOverlapped=0x0) returned 1 [0121.171] SetEndOfFile (hFile=0x1c0) returned 1 [0121.171] CloseHandle (hObject=0x1c0) returned 1 [0121.171] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0121.171] SetEndOfFile (hFile=0x1a0) returned 1 [0121.172] CloseHandle (hObject=0x1a0) returned 1 [0121.172] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0121.172] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01637_.wmf")) returned 1 [0121.254] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 63 [0121.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 63 [0121.255] lstrlenW (lpString=".doc") returned 4 [0121.255] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0121.255] lstrlenW (lpString=".docx") returned 5 [0121.255] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0121.255] lstrlenW (lpString=".pdf") returned 4 [0121.255] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0121.255] lstrlenW (lpString=".xls") returned 4 [0121.255] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0121.255] lstrlenW (lpString=".xlsx") returned 5 [0121.255] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0121.255] lstrlenW (lpString=".ppt") returned 4 [0121.255] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0121.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 63 [0121.255] lstrlenW (lpString=".zip") returned 4 [0121.255] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0121.255] lstrlenW (lpString=".rar") returned 4 [0121.255] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0121.255] lstrlenW (lpString=".bz2") returned 4 [0121.255] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0121.255] lstrlenW (lpString=".7z") returned 3 [0121.255] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0121.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 63 [0121.255] lstrlenW (lpString=".dbf") returned 4 [0121.255] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0121.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 63 [0121.255] lstrlenW (lpString=".1cd") returned 4 [0121.255] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0121.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 63 [0121.255] lstrlenW (lpString=".jpg") returned 4 [0121.256] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0121.259] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0121.259] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0121.259] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\clip.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0121.259] GetLastError () returned 0x0 [0121.260] ReadFile (in: hFile=0x228, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x8d6, lpOverlapped=0x0) returned 1 [0121.271] WriteFile (in: hFile=0x21c, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0x8e0, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0x8e0, lpOverlapped=0x0) returned 1 [0121.272] ReadFile (in: hFile=0x228, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x0, lpOverlapped=0x0) returned 1 [0121.272] WriteFile (in: hFile=0x21c, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0xe4, lpOverlapped=0x0) returned 1 [0121.272] SetEndOfFile (hFile=0x21c) returned 1 [0121.273] CloseHandle (hObject=0x21c) returned 1 [0121.273] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0121.273] SetEndOfFile (hFile=0x228) returned 1 [0121.274] CloseHandle (hObject=0x228) returned 1 [0121.274] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0121.274] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\clip.wmf")) returned 1 [0121.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF") returned 59 [0121.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF") returned 59 [0121.275] lstrlenW (lpString=".doc") returned 4 [0121.275] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0121.275] lstrlenW (lpString=".docx") returned 5 [0121.275] lstrcmpiW (lpString1=".docx", lpString2="P.WMF") returned -1 [0121.275] lstrlenW (lpString=".pdf") returned 4 [0121.275] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0121.275] lstrlenW (lpString=".xls") returned 4 [0121.275] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0121.275] lstrlenW (lpString=".xlsx") returned 5 [0121.275] lstrcmpiW (lpString1=".xlsx", lpString2="P.WMF") returned -1 [0121.275] lstrlenW (lpString=".ppt") returned 4 [0121.275] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0121.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF") returned 59 [0121.275] lstrlenW (lpString=".zip") returned 4 [0121.275] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0121.275] lstrlenW (lpString=".rar") returned 4 [0121.275] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0121.275] lstrlenW (lpString=".bz2") returned 4 [0121.275] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0121.275] lstrlenW (lpString=".7z") returned 3 [0121.275] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0121.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF") returned 59 [0121.275] lstrlenW (lpString=".dbf") returned 4 [0121.275] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0121.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF") returned 59 [0121.276] lstrlenW (lpString=".1cd") returned 4 [0121.276] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0121.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF") returned 59 [0121.276] lstrlenW (lpString=".jpg") returned 4 [0121.276] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0121.279] GetFileSizeEx (in: hFile=0x228, lpFileSize=0x37cfddc | out: lpFileSize=0x37cfddc*=49546) returned 1 [0121.279] CloseHandle (hObject=0x228) returned 1 [0121.279] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\craninst.wmf")) returned 0x20 [0121.279] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\craninst.wmf.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0121.279] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\craninst.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0121.280] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0121.280] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0121.280] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\craninst.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0121.280] GetLastError () returned 0x0 [0121.280] ReadFile (in: hFile=0x228, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0xc18a, lpOverlapped=0x0) returned 1 [0121.401] WriteFile (in: hFile=0x21c, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0xc190, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0xc190, lpOverlapped=0x0) returned 1 [0121.402] ReadFile (in: hFile=0x228, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x0, lpOverlapped=0x0) returned 1 [0121.402] WriteFile (in: hFile=0x21c, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0xec, lpOverlapped=0x0) returned 1 [0121.402] SetEndOfFile (hFile=0x21c) returned 1 [0121.402] CloseHandle (hObject=0x21c) returned 1 [0121.402] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0121.402] SetEndOfFile (hFile=0x228) returned 1 [0121.402] CloseHandle (hObject=0x228) returned 1 [0121.402] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0121.403] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\craninst.wmf")) returned 1 [0121.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 63 [0121.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 63 [0121.403] lstrlenW (lpString=".doc") returned 4 [0121.403] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0121.403] lstrlenW (lpString=".docx") returned 5 [0121.403] lstrcmpiW (lpString1=".docx", lpString2="T.WMF") returned -1 [0121.407] lstrlenW (lpString=".pdf") returned 4 [0121.407] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0121.407] lstrlenW (lpString=".xls") returned 4 [0121.407] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0121.407] lstrlenW (lpString=".xlsx") returned 5 [0121.407] lstrcmpiW (lpString1=".xlsx", lpString2="T.WMF") returned -1 [0121.407] lstrlenW (lpString=".ppt") returned 4 [0121.407] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0121.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 63 [0121.407] lstrlenW (lpString=".zip") returned 4 [0121.407] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0121.407] lstrlenW (lpString=".rar") returned 4 [0121.407] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0121.407] lstrlenW (lpString=".bz2") returned 4 [0121.407] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0121.407] lstrlenW (lpString=".7z") returned 3 [0121.407] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0121.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 63 [0121.407] lstrlenW (lpString=".dbf") returned 4 [0121.407] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0121.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 63 [0121.408] lstrlenW (lpString=".1cd") returned 4 [0121.408] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0121.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 63 [0121.408] lstrlenW (lpString=".jpg") returned 4 [0121.408] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0121.408] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0121.408] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0121.408] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00255_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00255_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0121.409] GetLastError () returned 0x0 [0121.409] ReadFile (in: hFile=0x228, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0xa82, lpOverlapped=0x0) returned 1 [0121.417] WriteFile (in: hFile=0x21c, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0xa90, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0xa90, lpOverlapped=0x0) returned 1 [0121.418] ReadFile (in: hFile=0x228, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x0, lpOverlapped=0x0) returned 1 [0121.418] WriteFile (in: hFile=0x21c, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0xec, lpOverlapped=0x0) returned 1 [0121.418] SetEndOfFile (hFile=0x21c) returned 1 [0121.418] CloseHandle (hObject=0x21c) returned 1 [0121.418] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0121.418] SetEndOfFile (hFile=0x228) returned 1 [0121.419] CloseHandle (hObject=0x228) returned 1 [0121.419] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00255_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0121.419] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00255_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00255_.wmf")) returned 1 [0121.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 63 [0121.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 63 [0121.419] lstrlenW (lpString=".doc") returned 4 [0121.419] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0121.419] lstrlenW (lpString=".docx") returned 5 [0121.419] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0121.419] lstrlenW (lpString=".pdf") returned 4 [0121.419] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0121.419] lstrlenW (lpString=".xls") returned 4 [0121.419] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0121.419] lstrlenW (lpString=".xlsx") returned 5 [0121.420] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0121.420] lstrlenW (lpString=".ppt") returned 4 [0121.420] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0121.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 63 [0121.420] lstrlenW (lpString=".zip") returned 4 [0121.420] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0121.420] lstrlenW (lpString=".rar") returned 4 [0121.420] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0121.420] lstrlenW (lpString=".bz2") returned 4 [0121.420] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0121.420] lstrlenW (lpString=".7z") returned 3 [0121.420] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0121.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 63 [0121.420] lstrlenW (lpString=".dbf") returned 4 [0121.420] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0121.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 63 [0121.420] lstrlenW (lpString=".1cd") returned 4 [0121.420] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0121.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 63 [0121.420] lstrlenW (lpString=".jpg") returned 4 [0121.420] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0121.420] GetFileSizeEx (in: hFile=0x228, lpFileSize=0x37cfddc | out: lpFileSize=0x37cfddc*=2832) returned 1 [0121.420] CloseHandle (hObject=0x228) returned 1 [0121.420] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00256_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00256_.wmf")) returned 0x20 [0121.420] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00256_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00256_.wmf.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0121.420] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00256_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00256_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0121.421] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0121.421] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0121.421] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00256_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00256_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0121.422] GetLastError () returned 0x0 [0121.422] ReadFile (in: hFile=0x228, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0xb10, lpOverlapped=0x0) returned 1 [0121.441] WriteFile (in: hFile=0x21c, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0xb20, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0xb20, lpOverlapped=0x0) returned 1 [0121.442] ReadFile (in: hFile=0x228, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x0, lpOverlapped=0x0) returned 1 [0121.442] WriteFile (in: hFile=0x21c, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0xec, lpOverlapped=0x0) returned 1 [0121.442] SetEndOfFile (hFile=0x21c) returned 1 [0121.442] CloseHandle (hObject=0x21c) returned 1 [0121.442] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0121.442] SetEndOfFile (hFile=0x228) returned 1 [0121.443] CloseHandle (hObject=0x228) returned 1 [0121.443] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00256_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0121.443] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00256_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00256_.wmf")) returned 1 [0121.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00256_.WMF") returned 63 [0121.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00256_.WMF") returned 63 [0121.443] lstrlenW (lpString=".doc") returned 4 [0121.443] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0121.443] lstrlenW (lpString=".docx") returned 5 [0121.443] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0121.443] lstrlenW (lpString=".pdf") returned 4 [0121.443] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0121.443] lstrlenW (lpString=".xls") returned 4 [0121.443] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0121.443] lstrlenW (lpString=".xlsx") returned 5 [0121.443] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0121.443] lstrlenW (lpString=".ppt") returned 4 [0121.443] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0121.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00256_.WMF") returned 63 [0121.443] lstrlenW (lpString=".zip") returned 4 [0121.443] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0121.443] lstrlenW (lpString=".rar") returned 4 [0121.443] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0121.443] lstrlenW (lpString=".bz2") returned 4 [0121.443] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0121.443] lstrlenW (lpString=".7z") returned 3 [0121.443] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0121.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00256_.WMF") returned 63 [0121.443] lstrlenW (lpString=".dbf") returned 4 [0121.443] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0121.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00256_.WMF") returned 63 [0121.443] lstrlenW (lpString=".1cd") returned 4 [0121.443] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0121.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00256_.WMF") returned 63 [0121.443] lstrlenW (lpString=".jpg") returned 4 [0121.443] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0121.444] GetFileSizeEx (in: hFile=0x228, lpFileSize=0x37cfddc | out: lpFileSize=0x37cfddc*=40030) returned 1 [0121.444] CloseHandle (hObject=0x228) returned 1 [0121.444] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00297_.wmf")) returned 0x20 [0121.444] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00297_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00297_.wmf.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0121.444] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00297_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0121.444] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0121.444] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0121.444] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00297_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00297_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0121.444] GetLastError () returned 0x0 [0121.444] ReadFile (in: hFile=0x228, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x9c5e, lpOverlapped=0x0) returned 1 [0121.453] WriteFile (in: hFile=0x21c, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0x9c60, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0x9c60, lpOverlapped=0x0) returned 1 [0121.454] ReadFile (in: hFile=0x228, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x0, lpOverlapped=0x0) returned 1 [0121.454] WriteFile (in: hFile=0x21c, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0xec, lpOverlapped=0x0) returned 1 [0121.454] SetEndOfFile (hFile=0x21c) returned 1 [0121.454] CloseHandle (hObject=0x21c) returned 1 [0121.454] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0121.454] SetEndOfFile (hFile=0x228) returned 1 [0121.455] CloseHandle (hObject=0x228) returned 1 [0121.455] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00297_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0121.455] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00297_.wmf")) returned 1 [0121.455] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00297_.WMF") returned 63 [0121.455] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00297_.WMF") returned 63 [0121.455] lstrlenW (lpString=".doc") returned 4 [0121.455] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0121.455] lstrlenW (lpString=".docx") returned 5 [0121.455] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0121.455] lstrlenW (lpString=".pdf") returned 4 [0121.455] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0121.455] lstrlenW (lpString=".xls") returned 4 [0121.455] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0121.455] lstrlenW (lpString=".xlsx") returned 5 [0121.455] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0121.456] lstrlenW (lpString=".ppt") returned 4 [0121.456] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0121.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00297_.WMF") returned 63 [0121.456] lstrlenW (lpString=".zip") returned 4 [0121.456] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0121.456] lstrlenW (lpString=".rar") returned 4 [0121.456] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0121.456] lstrlenW (lpString=".bz2") returned 4 [0121.456] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0121.456] lstrlenW (lpString=".7z") returned 3 [0121.456] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0121.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00297_.WMF") returned 63 [0121.456] lstrlenW (lpString=".dbf") returned 4 [0121.456] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0121.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00297_.WMF") returned 63 [0121.456] lstrlenW (lpString=".1cd") returned 4 [0121.456] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0121.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00297_.WMF") returned 63 [0121.456] lstrlenW (lpString=".jpg") returned 4 [0121.456] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0121.456] GetFileSizeEx (in: hFile=0x228, lpFileSize=0x37cfddc | out: lpFileSize=0x37cfddc*=17584) returned 1 [0121.456] CloseHandle (hObject=0x228) returned 1 [0121.456] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00405_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00405_.wmf")) returned 0x20 [0121.456] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00405_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00405_.wmf.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0121.456] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00405_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00405_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0121.456] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0121.456] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0121.456] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00405_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00405_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0121.457] GetLastError () returned 0x0 [0121.457] ReadFile (in: hFile=0x228, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x44b0, lpOverlapped=0x0) returned 1 [0121.506] WriteFile (in: hFile=0x21c, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0x44c0, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0x44c0, lpOverlapped=0x0) returned 1 [0121.507] ReadFile (in: hFile=0x228, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x0, lpOverlapped=0x0) returned 1 [0121.507] WriteFile (in: hFile=0x21c, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0xec, lpOverlapped=0x0) returned 1 [0121.507] SetEndOfFile (hFile=0x21c) returned 1 [0121.507] CloseHandle (hObject=0x21c) returned 1 [0121.507] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0121.507] SetEndOfFile (hFile=0x228) returned 1 [0121.508] CloseHandle (hObject=0x228) returned 1 [0121.508] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00405_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0121.508] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00405_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00405_.wmf")) returned 1 [0121.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00405_.WMF") returned 63 [0121.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00405_.WMF") returned 63 [0121.508] lstrlenW (lpString=".doc") returned 4 [0121.508] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0121.508] lstrlenW (lpString=".docx") returned 5 [0121.508] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0121.508] lstrlenW (lpString=".pdf") returned 4 [0121.508] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0121.508] lstrlenW (lpString=".xls") returned 4 [0121.508] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0121.508] lstrlenW (lpString=".xlsx") returned 5 [0121.508] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0121.508] lstrlenW (lpString=".ppt") returned 4 [0121.508] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0121.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00405_.WMF") returned 63 [0121.508] lstrlenW (lpString=".zip") returned 4 [0121.509] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0121.509] lstrlenW (lpString=".rar") returned 4 [0121.509] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0121.509] lstrlenW (lpString=".bz2") returned 4 [0121.509] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0121.509] lstrlenW (lpString=".7z") returned 3 [0121.509] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0121.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00405_.WMF") returned 63 [0121.509] lstrlenW (lpString=".dbf") returned 4 [0121.509] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0121.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00405_.WMF") returned 63 [0121.509] lstrlenW (lpString=".1cd") returned 4 [0121.509] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0121.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00405_.WMF") returned 63 [0121.509] lstrlenW (lpString=".jpg") returned 4 [0121.509] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0121.509] GetFileSizeEx (in: hFile=0x228, lpFileSize=0x37cfddc | out: lpFileSize=0x37cfddc*=42992) returned 1 [0121.509] CloseHandle (hObject=0x228) returned 1 [0121.510] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00413_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00413_.wmf")) returned 0x20 [0121.510] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00413_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00413_.wmf.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0121.510] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00413_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00413_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0121.510] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0121.510] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0121.510] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00413_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00413_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0121.510] GetLastError () returned 0x0 [0121.510] ReadFile (in: hFile=0x228, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0xa7f0, lpOverlapped=0x0) returned 1 [0121.521] WriteFile (in: hFile=0x21c, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0xa800, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0xa800, lpOverlapped=0x0) returned 1 [0121.522] ReadFile (in: hFile=0x228, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x0, lpOverlapped=0x0) returned 1 [0121.522] WriteFile (in: hFile=0x21c, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0xec, lpOverlapped=0x0) returned 1 [0121.522] SetEndOfFile (hFile=0x21c) returned 1 [0121.522] CloseHandle (hObject=0x21c) returned 1 [0121.522] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0121.522] SetEndOfFile (hFile=0x228) returned 1 [0121.523] CloseHandle (hObject=0x228) returned 1 [0121.523] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00413_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0121.523] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00413_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00413_.wmf")) returned 1 [0121.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00413_.WMF") returned 63 [0121.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00413_.WMF") returned 63 [0121.523] lstrlenW (lpString=".doc") returned 4 [0121.523] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0121.523] lstrlenW (lpString=".docx") returned 5 [0121.523] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0121.523] lstrlenW (lpString=".pdf") returned 4 [0121.523] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0121.523] lstrlenW (lpString=".xls") returned 4 [0121.523] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0121.523] lstrlenW (lpString=".xlsx") returned 5 [0121.523] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0121.524] lstrlenW (lpString=".ppt") returned 4 [0121.524] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0121.524] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00413_.WMF") returned 63 [0121.524] lstrlenW (lpString=".zip") returned 4 [0121.524] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0121.524] lstrlenW (lpString=".rar") returned 4 [0121.524] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0121.524] lstrlenW (lpString=".bz2") returned 4 [0121.524] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0121.524] lstrlenW (lpString=".7z") returned 3 [0121.524] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0121.524] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00413_.WMF") returned 63 [0121.524] lstrlenW (lpString=".dbf") returned 4 [0121.524] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0121.524] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00413_.WMF") returned 63 [0121.524] lstrlenW (lpString=".1cd") returned 4 [0121.524] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0121.524] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00413_.WMF") returned 63 [0121.524] lstrlenW (lpString=".jpg") returned 4 [0121.524] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0121.524] GetFileSizeEx (in: hFile=0x228, lpFileSize=0x37cfddc | out: lpFileSize=0x37cfddc*=1932) returned 1 [0121.524] CloseHandle (hObject=0x228) returned 1 [0121.524] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00437_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00437_.wmf")) returned 0x20 [0121.524] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00437_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00437_.wmf.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0121.524] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00437_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00437_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0121.525] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0121.525] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0121.525] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00437_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00437_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0121.525] GetLastError () returned 0x0 [0121.525] ReadFile (in: hFile=0x228, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x78c, lpOverlapped=0x0) returned 1 [0121.536] WriteFile (in: hFile=0x21c, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0x790, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0x790, lpOverlapped=0x0) returned 1 [0121.537] ReadFile (in: hFile=0x228, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x0, lpOverlapped=0x0) returned 1 [0121.537] WriteFile (in: hFile=0x21c, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0xec, lpOverlapped=0x0) returned 1 [0121.537] SetEndOfFile (hFile=0x21c) returned 1 [0121.538] CloseHandle (hObject=0x21c) returned 1 [0121.538] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0121.538] SetEndOfFile (hFile=0x228) returned 1 [0121.539] CloseHandle (hObject=0x228) returned 1 [0121.539] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00437_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0121.539] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00437_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00437_.wmf")) returned 1 [0121.546] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00437_.WMF") returned 63 [0121.546] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00437_.WMF") returned 63 [0121.546] lstrlenW (lpString=".doc") returned 4 [0121.546] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0121.546] lstrlenW (lpString=".docx") returned 5 [0121.546] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0121.546] lstrlenW (lpString=".pdf") returned 4 [0121.546] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0121.546] lstrlenW (lpString=".xls") returned 4 [0121.546] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0121.546] lstrlenW (lpString=".xlsx") returned 5 [0121.546] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0121.546] lstrlenW (lpString=".ppt") returned 4 [0121.546] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0121.546] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00437_.WMF") returned 63 [0121.546] lstrlenW (lpString=".zip") returned 4 [0121.546] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0121.547] lstrlenW (lpString=".rar") returned 4 [0121.547] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0121.547] lstrlenW (lpString=".bz2") returned 4 [0121.547] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0121.547] lstrlenW (lpString=".7z") returned 3 [0121.547] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0121.547] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00437_.WMF") returned 63 [0121.547] lstrlenW (lpString=".dbf") returned 4 [0121.547] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0121.547] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00437_.WMF") returned 63 [0121.547] lstrlenW (lpString=".1cd") returned 4 [0121.547] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0121.547] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00437_.WMF") returned 63 [0121.547] lstrlenW (lpString=".jpg") returned 4 [0121.547] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0121.547] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0121.547] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0121.547] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00687_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00687_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0121.548] GetLastError () returned 0x0 [0121.548] ReadFile (in: hFile=0x1a0, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x5130, lpOverlapped=0x0) returned 1 [0121.558] WriteFile (in: hFile=0x1f4, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0x5140, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0x5140, lpOverlapped=0x0) returned 1 [0121.558] ReadFile (in: hFile=0x1a0, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x0, lpOverlapped=0x0) returned 1 [0121.559] WriteFile (in: hFile=0x1f4, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0xec, lpOverlapped=0x0) returned 1 [0121.559] SetEndOfFile (hFile=0x1f4) returned 1 [0121.559] CloseHandle (hObject=0x1f4) returned 1 [0121.559] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0121.559] SetEndOfFile (hFile=0x1a0) returned 1 [0121.559] CloseHandle (hObject=0x1a0) returned 1 [0121.559] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00687_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0121.560] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00687_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00687_.wmf")) returned 1 [0121.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00687_.WMF") returned 63 [0121.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00687_.WMF") returned 63 [0121.560] lstrlenW (lpString=".doc") returned 4 [0121.560] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0121.560] lstrlenW (lpString=".docx") returned 5 [0121.560] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0121.560] lstrlenW (lpString=".pdf") returned 4 [0121.560] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0121.560] lstrlenW (lpString=".xls") returned 4 [0121.560] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0121.560] lstrlenW (lpString=".xlsx") returned 5 [0121.560] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0121.560] lstrlenW (lpString=".ppt") returned 4 [0121.560] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0121.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00687_.WMF") returned 63 [0121.560] lstrlenW (lpString=".zip") returned 4 [0121.560] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0121.560] lstrlenW (lpString=".rar") returned 4 [0121.560] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0121.560] lstrlenW (lpString=".bz2") returned 4 [0121.560] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0121.560] lstrlenW (lpString=".7z") returned 3 [0121.560] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0121.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00687_.WMF") returned 63 [0121.560] lstrlenW (lpString=".dbf") returned 4 [0121.560] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0121.561] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00687_.WMF") returned 63 [0121.561] lstrlenW (lpString=".1cd") returned 4 [0121.561] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0121.561] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00687_.WMF") returned 63 [0121.561] lstrlenW (lpString=".jpg") returned 4 [0121.561] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0121.561] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x37cfddc | out: lpFileSize=0x37cfddc*=2226) returned 1 [0121.561] CloseHandle (hObject=0x1a0) returned 1 [0121.561] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01015_.wmf")) returned 0x20 [0121.561] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01015_.wmf.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0121.561] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01015_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0121.561] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0121.562] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0121.562] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01015_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0121.562] GetLastError () returned 0x0 [0121.562] ReadFile (in: hFile=0x1a0, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x8b2, lpOverlapped=0x0) returned 1 [0121.633] WriteFile (in: hFile=0x1f4, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0x8c0, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0x8c0, lpOverlapped=0x0) returned 1 [0121.634] ReadFile (in: hFile=0x1a0, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x0, lpOverlapped=0x0) returned 1 [0121.634] WriteFile (in: hFile=0x1f4, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0xec, lpOverlapped=0x0) returned 1 [0121.635] SetEndOfFile (hFile=0x1f4) returned 1 [0121.669] CloseHandle (hObject=0x1f4) returned 1 [0121.670] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0121.670] SetEndOfFile (hFile=0x1a0) returned 1 [0121.670] CloseHandle (hObject=0x1a0) returned 1 [0121.670] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0121.670] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01015_.wmf")) returned 1 [0121.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF") returned 63 [0121.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF") returned 63 [0121.670] lstrlenW (lpString=".doc") returned 4 [0121.670] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0121.670] lstrlenW (lpString=".docx") returned 5 [0121.670] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0121.670] lstrlenW (lpString=".pdf") returned 4 [0121.670] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0121.671] lstrlenW (lpString=".xls") returned 4 [0121.671] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0121.671] lstrlenW (lpString=".xlsx") returned 5 [0121.671] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0121.671] lstrlenW (lpString=".ppt") returned 4 [0121.671] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0121.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF") returned 63 [0121.671] lstrlenW (lpString=".zip") returned 4 [0121.671] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0121.671] lstrlenW (lpString=".rar") returned 4 [0121.671] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0121.671] lstrlenW (lpString=".bz2") returned 4 [0121.671] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0121.671] lstrlenW (lpString=".7z") returned 3 [0121.671] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0121.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF") returned 63 [0121.671] lstrlenW (lpString=".dbf") returned 4 [0121.671] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0121.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF") returned 63 [0121.671] lstrlenW (lpString=".1cd") returned 4 [0121.671] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0121.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF") returned 63 [0121.671] lstrlenW (lpString=".jpg") returned 4 [0121.671] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0121.671] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x37cfddc | out: lpFileSize=0x37cfddc*=2140) returned 1 [0121.671] CloseHandle (hObject=0x1a0) returned 1 [0121.671] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01143_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01143_.wmf")) returned 0x20 [0121.671] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01143_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01143_.wmf.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0121.671] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01143_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01143_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0121.671] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0121.671] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0121.671] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01143_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01143_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0121.672] GetLastError () returned 0x0 [0121.672] ReadFile (in: hFile=0x1a0, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x85c, lpOverlapped=0x0) returned 1 [0121.687] WriteFile (in: hFile=0x1f4, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0x860, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0x860, lpOverlapped=0x0) returned 1 [0121.687] ReadFile (in: hFile=0x1a0, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x0, lpOverlapped=0x0) returned 1 [0121.687] WriteFile (in: hFile=0x1f4, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0xec, lpOverlapped=0x0) returned 1 [0121.687] SetEndOfFile (hFile=0x1f4) returned 1 [0121.687] CloseHandle (hObject=0x1f4) returned 1 [0121.687] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0121.687] SetEndOfFile (hFile=0x1a0) returned 1 [0121.688] CloseHandle (hObject=0x1a0) returned 1 [0121.688] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01143_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0121.688] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01143_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01143_.wmf")) returned 1 [0121.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01143_.WMF") returned 63 [0121.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01143_.WMF") returned 63 [0121.688] lstrlenW (lpString=".doc") returned 4 [0121.688] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0121.688] lstrlenW (lpString=".docx") returned 5 [0121.688] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0121.688] lstrlenW (lpString=".pdf") returned 4 [0121.688] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0121.688] lstrlenW (lpString=".xls") returned 4 [0121.688] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0121.688] lstrlenW (lpString=".xlsx") returned 5 [0121.688] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0121.688] lstrlenW (lpString=".ppt") returned 4 [0121.688] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0121.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01143_.WMF") returned 63 [0121.689] lstrlenW (lpString=".zip") returned 4 [0121.689] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0121.689] lstrlenW (lpString=".rar") returned 4 [0121.689] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0121.689] lstrlenW (lpString=".bz2") returned 4 [0121.689] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0121.689] lstrlenW (lpString=".7z") returned 3 [0121.689] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0121.689] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01143_.WMF") returned 63 [0121.689] lstrlenW (lpString=".dbf") returned 4 [0121.689] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0121.689] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01143_.WMF") returned 63 [0121.689] lstrlenW (lpString=".1cd") returned 4 [0121.689] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0121.689] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01143_.WMF") returned 63 [0121.689] lstrlenW (lpString=".jpg") returned 4 [0121.689] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0121.689] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0121.689] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0121.689] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01146_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01146_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0121.689] GetLastError () returned 0x0 [0121.689] ReadFile (in: hFile=0x1a0, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0xaec, lpOverlapped=0x0) returned 1 [0121.700] WriteFile (in: hFile=0x1f4, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0xaf0, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0xaf0, lpOverlapped=0x0) returned 1 [0121.701] ReadFile (in: hFile=0x1a0, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x0, lpOverlapped=0x0) returned 1 [0121.701] WriteFile (in: hFile=0x1f4, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0xec, lpOverlapped=0x0) returned 1 [0121.701] SetEndOfFile (hFile=0x1f4) returned 1 [0121.701] CloseHandle (hObject=0x1f4) returned 1 [0121.701] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0121.701] SetEndOfFile (hFile=0x1a0) returned 1 [0121.702] CloseHandle (hObject=0x1a0) returned 1 [0121.702] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01146_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0121.702] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01146_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01146_.wmf")) returned 1 [0121.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01146_.WMF") returned 63 [0121.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01146_.WMF") returned 63 [0121.702] lstrlenW (lpString=".doc") returned 4 [0121.702] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0121.702] lstrlenW (lpString=".docx") returned 5 [0121.702] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0121.702] lstrlenW (lpString=".pdf") returned 4 [0121.702] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0121.702] lstrlenW (lpString=".xls") returned 4 [0121.702] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0121.702] lstrlenW (lpString=".xlsx") returned 5 [0121.702] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0121.702] lstrlenW (lpString=".ppt") returned 4 [0121.702] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0121.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01146_.WMF") returned 63 [0121.702] lstrlenW (lpString=".zip") returned 4 [0121.702] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0121.702] lstrlenW (lpString=".rar") returned 4 [0121.702] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0121.702] lstrlenW (lpString=".bz2") returned 4 [0121.702] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0121.702] lstrlenW (lpString=".7z") returned 3 [0121.702] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0121.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01146_.WMF") returned 63 [0121.702] lstrlenW (lpString=".dbf") returned 4 [0121.702] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0121.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01146_.WMF") returned 63 [0121.702] lstrlenW (lpString=".1cd") returned 4 [0121.702] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0121.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01146_.WMF") returned 63 [0121.702] lstrlenW (lpString=".jpg") returned 4 [0121.702] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0121.703] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0121.703] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0121.703] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01152_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01152_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0121.703] GetLastError () returned 0x0 [0121.703] ReadFile (in: hFile=0x1a0, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0xb90, lpOverlapped=0x0) returned 1 [0121.716] WriteFile (in: hFile=0x1f4, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0xba0, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0xba0, lpOverlapped=0x0) returned 1 [0121.716] ReadFile (in: hFile=0x1a0, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x0, lpOverlapped=0x0) returned 1 [0121.716] WriteFile (in: hFile=0x1f4, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0xec, lpOverlapped=0x0) returned 1 [0121.716] SetEndOfFile (hFile=0x1f4) returned 1 [0121.716] CloseHandle (hObject=0x1f4) returned 1 [0121.716] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0121.716] SetEndOfFile (hFile=0x1a0) returned 1 [0121.717] CloseHandle (hObject=0x1a0) returned 1 [0121.717] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01152_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0121.717] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01152_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01152_.wmf")) returned 1 [0121.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01152_.WMF") returned 63 [0121.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01152_.WMF") returned 63 [0121.717] lstrlenW (lpString=".doc") returned 4 [0121.717] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0121.717] lstrlenW (lpString=".docx") returned 5 [0121.717] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0121.717] lstrlenW (lpString=".pdf") returned 4 [0121.717] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0121.718] lstrlenW (lpString=".xls") returned 4 [0121.718] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0121.718] lstrlenW (lpString=".xlsx") returned 5 [0121.718] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0121.718] lstrlenW (lpString=".ppt") returned 4 [0121.718] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0121.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01152_.WMF") returned 63 [0121.718] lstrlenW (lpString=".zip") returned 4 [0121.718] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0121.718] lstrlenW (lpString=".rar") returned 4 [0121.718] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0121.718] lstrlenW (lpString=".bz2") returned 4 [0121.718] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0121.718] lstrlenW (lpString=".7z") returned 3 [0121.718] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0121.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01152_.WMF") returned 63 [0121.718] lstrlenW (lpString=".dbf") returned 4 [0121.718] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0121.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01152_.WMF") returned 63 [0121.718] lstrlenW (lpString=".1cd") returned 4 [0121.718] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0121.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01152_.WMF") returned 63 [0121.718] lstrlenW (lpString=".jpg") returned 4 [0121.718] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0121.718] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0121.719] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0121.719] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01157_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01157_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0121.720] GetLastError () returned 0x0 [0121.720] ReadFile (in: hFile=0x1a0, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0xe04, lpOverlapped=0x0) returned 1 [0121.733] WriteFile (in: hFile=0x1f4, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0xe10, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0xe10, lpOverlapped=0x0) returned 1 [0121.734] ReadFile (in: hFile=0x1a0, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x0, lpOverlapped=0x0) returned 1 [0121.734] WriteFile (in: hFile=0x1f4, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0xec, lpOverlapped=0x0) returned 1 [0121.734] SetEndOfFile (hFile=0x1f4) returned 1 [0121.734] CloseHandle (hObject=0x1f4) returned 1 [0121.734] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0121.734] SetEndOfFile (hFile=0x1a0) returned 1 [0121.734] CloseHandle (hObject=0x1a0) returned 1 [0121.734] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01157_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0121.735] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01157_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01157_.wmf")) returned 1 [0121.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 63 [0121.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 63 [0121.735] lstrlenW (lpString=".doc") returned 4 [0121.735] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0121.735] lstrlenW (lpString=".docx") returned 5 [0121.735] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0121.735] lstrlenW (lpString=".pdf") returned 4 [0121.735] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0121.735] lstrlenW (lpString=".xls") returned 4 [0121.735] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0121.735] lstrlenW (lpString=".xlsx") returned 5 [0121.735] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0121.735] lstrlenW (lpString=".ppt") returned 4 [0121.735] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0121.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 63 [0121.735] lstrlenW (lpString=".zip") returned 4 [0121.735] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0121.735] lstrlenW (lpString=".rar") returned 4 [0121.735] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0121.735] lstrlenW (lpString=".bz2") returned 4 [0121.735] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0121.735] lstrlenW (lpString=".7z") returned 3 [0121.735] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0121.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 63 [0121.735] lstrlenW (lpString=".dbf") returned 4 [0121.735] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0121.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 63 [0121.735] lstrlenW (lpString=".1cd") returned 4 [0121.735] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0121.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 63 [0121.735] lstrlenW (lpString=".jpg") returned 4 [0121.735] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0121.736] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0121.736] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0121.736] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01163_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01163_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0121.736] GetLastError () returned 0x0 [0121.736] ReadFile (in: hFile=0x1a0, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x8fc, lpOverlapped=0x0) returned 1 [0121.909] WriteFile (in: hFile=0x1f4, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0x900, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0x900, lpOverlapped=0x0) returned 1 [0121.909] ReadFile (in: hFile=0x1a0, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x0, lpOverlapped=0x0) returned 1 [0121.909] WriteFile (in: hFile=0x1f4, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0xec, lpOverlapped=0x0) returned 1 [0121.909] SetEndOfFile (hFile=0x1f4) returned 1 [0121.953] CloseHandle (hObject=0x1f4) returned 1 [0121.953] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0121.953] SetEndOfFile (hFile=0x1a0) returned 1 [0121.954] CloseHandle (hObject=0x1a0) returned 1 [0121.954] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01163_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0121.954] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01163_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01163_.wmf")) returned 1 [0121.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 63 [0121.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 63 [0121.963] lstrlenW (lpString=".doc") returned 4 [0121.963] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0121.963] lstrlenW (lpString=".docx") returned 5 [0121.963] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0121.963] lstrlenW (lpString=".pdf") returned 4 [0121.963] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0121.963] lstrlenW (lpString=".xls") returned 4 [0121.963] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0121.963] lstrlenW (lpString=".xlsx") returned 5 [0121.963] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0121.964] lstrlenW (lpString=".ppt") returned 4 [0121.964] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0121.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 63 [0121.964] lstrlenW (lpString=".zip") returned 4 [0121.964] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0121.964] lstrlenW (lpString=".rar") returned 4 [0121.964] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0121.964] lstrlenW (lpString=".bz2") returned 4 [0121.964] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0121.964] lstrlenW (lpString=".7z") returned 3 [0121.964] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0121.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 63 [0121.964] lstrlenW (lpString=".dbf") returned 4 [0121.964] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0121.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 63 [0121.964] lstrlenW (lpString=".1cd") returned 4 [0121.964] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0121.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 63 [0121.964] lstrlenW (lpString=".jpg") returned 4 [0121.964] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0121.970] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0121.970] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0121.970] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01172_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x224 [0121.970] GetLastError () returned 0x0 [0121.970] ReadFile (in: hFile=0x1d8, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x8b8, lpOverlapped=0x0) returned 1 [0122.016] WriteFile (in: hFile=0x224, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0x8c0, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0x8c0, lpOverlapped=0x0) returned 1 [0122.017] ReadFile (in: hFile=0x1d8, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x0, lpOverlapped=0x0) returned 1 [0122.017] WriteFile (in: hFile=0x224, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0xec, lpOverlapped=0x0) returned 1 [0122.017] SetEndOfFile (hFile=0x224) returned 1 [0122.017] CloseHandle (hObject=0x224) returned 1 [0122.017] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0122.017] SetEndOfFile (hFile=0x1d8) returned 1 [0122.018] CloseHandle (hObject=0x1d8) returned 1 [0122.018] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0122.018] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01172_.wmf")) returned 1 [0122.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 63 [0122.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 63 [0122.018] lstrlenW (lpString=".doc") returned 4 [0122.018] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0122.018] lstrlenW (lpString=".docx") returned 5 [0122.018] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0122.018] lstrlenW (lpString=".pdf") returned 4 [0122.018] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0122.018] lstrlenW (lpString=".xls") returned 4 [0122.018] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0122.018] lstrlenW (lpString=".xlsx") returned 5 [0122.018] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0122.018] lstrlenW (lpString=".ppt") returned 4 [0122.018] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0122.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 63 [0122.019] lstrlenW (lpString=".zip") returned 4 [0122.019] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0122.019] lstrlenW (lpString=".rar") returned 4 [0122.019] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0122.019] lstrlenW (lpString=".bz2") returned 4 [0122.019] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0122.019] lstrlenW (lpString=".7z") returned 3 [0122.019] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0122.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 63 [0122.019] lstrlenW (lpString=".dbf") returned 4 [0122.019] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0122.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 63 [0122.019] lstrlenW (lpString=".1cd") returned 4 [0122.019] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0122.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 63 [0122.019] lstrlenW (lpString=".jpg") returned 4 [0122.019] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0122.019] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0122.019] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0122.019] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01179_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01179_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x224 [0122.019] GetLastError () returned 0x0 [0122.019] ReadFile (in: hFile=0x1d8, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x7e8, lpOverlapped=0x0) returned 1 [0122.208] WriteFile (in: hFile=0x224, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0x7f0, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0x7f0, lpOverlapped=0x0) returned 1 [0122.209] ReadFile (in: hFile=0x1d8, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x0, lpOverlapped=0x0) returned 1 [0122.209] WriteFile (in: hFile=0x224, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0xec, lpOverlapped=0x0) returned 1 [0122.209] SetEndOfFile (hFile=0x224) returned 1 [0122.249] CloseHandle (hObject=0x224) returned 1 [0122.249] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0122.249] SetEndOfFile (hFile=0x1d8) returned 1 [0122.250] CloseHandle (hObject=0x1d8) returned 1 [0122.250] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01179_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0122.250] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01179_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01179_.wmf")) returned 1 [0122.256] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 63 [0122.256] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 63 [0122.256] lstrlenW (lpString=".doc") returned 4 [0122.256] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0122.256] lstrlenW (lpString=".docx") returned 5 [0122.256] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0122.256] lstrlenW (lpString=".pdf") returned 4 [0122.256] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0122.256] lstrlenW (lpString=".xls") returned 4 [0122.256] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0122.256] lstrlenW (lpString=".xlsx") returned 5 [0122.256] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0122.256] lstrlenW (lpString=".ppt") returned 4 [0122.256] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0122.256] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 63 [0122.256] lstrlenW (lpString=".zip") returned 4 [0122.256] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0122.256] lstrlenW (lpString=".rar") returned 4 [0122.256] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0122.256] lstrlenW (lpString=".bz2") returned 4 [0122.256] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0122.256] lstrlenW (lpString=".7z") returned 3 [0122.256] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0122.256] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 63 [0122.256] lstrlenW (lpString=".dbf") returned 4 [0122.256] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0122.256] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 63 [0122.256] lstrlenW (lpString=".1cd") returned 4 [0122.256] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0122.256] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 63 [0122.257] lstrlenW (lpString=".jpg") returned 4 [0122.257] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0122.261] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0122.261] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0122.261] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01585_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0122.261] GetLastError () returned 0x0 [0122.261] ReadFile (in: hFile=0x168, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x9dc, lpOverlapped=0x0) returned 1 [0122.298] WriteFile (in: hFile=0x194, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0x9e0, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0x9e0, lpOverlapped=0x0) returned 1 [0122.300] ReadFile (in: hFile=0x168, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x0, lpOverlapped=0x0) returned 1 [0122.300] WriteFile (in: hFile=0x194, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0xec, lpOverlapped=0x0) returned 1 [0122.300] SetEndOfFile (hFile=0x194) returned 1 [0122.300] CloseHandle (hObject=0x194) returned 1 [0122.300] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0122.300] SetEndOfFile (hFile=0x168) returned 1 [0122.301] CloseHandle (hObject=0x168) returned 1 [0122.301] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0122.301] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01585_.wmf")) returned 1 [0122.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 63 [0122.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 63 [0122.301] lstrlenW (lpString=".doc") returned 4 [0122.301] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0122.301] lstrlenW (lpString=".docx") returned 5 [0122.301] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0122.301] lstrlenW (lpString=".pdf") returned 4 [0122.301] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0122.301] lstrlenW (lpString=".xls") returned 4 [0122.301] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0122.301] lstrlenW (lpString=".xlsx") returned 5 [0122.301] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0122.301] lstrlenW (lpString=".ppt") returned 4 [0122.302] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0122.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 63 [0122.302] lstrlenW (lpString=".zip") returned 4 [0122.302] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0122.302] lstrlenW (lpString=".rar") returned 4 [0122.302] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0122.302] lstrlenW (lpString=".bz2") returned 4 [0122.302] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0122.302] lstrlenW (lpString=".7z") returned 3 [0122.302] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0122.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 63 [0122.302] lstrlenW (lpString=".dbf") returned 4 [0122.302] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0122.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 63 [0122.302] lstrlenW (lpString=".1cd") returned 4 [0122.302] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0122.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 63 [0122.302] lstrlenW (lpString=".jpg") returned 4 [0122.302] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0122.303] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0122.303] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0122.303] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01629_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0122.303] GetLastError () returned 0x0 [0122.303] ReadFile (in: hFile=0x168, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x244, lpOverlapped=0x0) returned 1 [0122.304] WriteFile (in: hFile=0x194, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0x250, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0x250, lpOverlapped=0x0) returned 1 [0122.304] ReadFile (in: hFile=0x168, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x0, lpOverlapped=0x0) returned 1 [0122.304] WriteFile (in: hFile=0x194, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0xec, lpOverlapped=0x0) returned 1 [0122.305] SetEndOfFile (hFile=0x194) returned 1 [0122.305] CloseHandle (hObject=0x194) returned 1 [0122.305] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0122.305] SetEndOfFile (hFile=0x168) returned 1 [0122.305] CloseHandle (hObject=0x168) returned 1 [0122.305] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0122.320] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01629_.wmf")) returned 1 [0122.320] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 63 [0122.320] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 63 [0122.320] lstrlenW (lpString=".doc") returned 4 [0122.320] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0122.320] lstrlenW (lpString=".docx") returned 5 [0122.320] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0122.320] lstrlenW (lpString=".pdf") returned 4 [0122.320] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0122.320] lstrlenW (lpString=".xls") returned 4 [0122.321] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0122.321] lstrlenW (lpString=".xlsx") returned 5 [0122.321] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0122.321] lstrlenW (lpString=".ppt") returned 4 [0122.321] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0122.321] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 63 [0122.321] lstrlenW (lpString=".zip") returned 4 [0122.321] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0122.321] lstrlenW (lpString=".rar") returned 4 [0122.321] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0122.321] lstrlenW (lpString=".bz2") returned 4 [0122.321] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0122.321] lstrlenW (lpString=".7z") returned 3 [0122.321] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0122.321] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 63 [0122.321] lstrlenW (lpString=".dbf") returned 4 [0122.321] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0122.321] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 63 [0122.321] lstrlenW (lpString=".1cd") returned 4 [0122.321] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0122.321] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 63 [0122.321] lstrlenW (lpString=".jpg") returned 4 [0122.321] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0122.336] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0122.336] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0122.337] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01772_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0122.337] GetLastError () returned 0x0 [0122.337] ReadFile (in: hFile=0x1f0, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x8fc, lpOverlapped=0x0) returned 1 [0122.433] WriteFile (in: hFile=0x218, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0x900, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0x900, lpOverlapped=0x0) returned 1 [0122.433] ReadFile (in: hFile=0x1f0, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x0, lpOverlapped=0x0) returned 1 [0122.433] WriteFile (in: hFile=0x218, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0xec, lpOverlapped=0x0) returned 1 [0122.433] SetEndOfFile (hFile=0x218) returned 1 [0122.433] CloseHandle (hObject=0x218) returned 1 [0122.433] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0122.434] SetEndOfFile (hFile=0x1f0) returned 1 [0122.434] CloseHandle (hObject=0x1f0) returned 1 [0122.434] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0122.434] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01772_.wmf")) returned 1 [0122.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 63 [0122.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 63 [0122.435] lstrlenW (lpString=".doc") returned 4 [0122.435] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0122.435] lstrlenW (lpString=".docx") returned 5 [0122.435] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0122.435] lstrlenW (lpString=".pdf") returned 4 [0122.435] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0122.435] lstrlenW (lpString=".xls") returned 4 [0122.435] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0122.435] lstrlenW (lpString=".xlsx") returned 5 [0122.435] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0122.435] lstrlenW (lpString=".ppt") returned 4 [0122.435] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0122.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 63 [0122.435] lstrlenW (lpString=".zip") returned 4 [0122.435] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0122.435] lstrlenW (lpString=".rar") returned 4 [0122.435] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0122.435] lstrlenW (lpString=".bz2") returned 4 [0122.435] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0122.435] lstrlenW (lpString=".7z") returned 3 [0122.435] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0122.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 63 [0122.435] lstrlenW (lpString=".dbf") returned 4 [0122.435] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0122.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 63 [0122.435] lstrlenW (lpString=".1cd") returned 4 [0122.435] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0122.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 63 [0122.435] lstrlenW (lpString=".jpg") returned 4 [0122.435] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0122.467] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0122.467] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0122.467] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00006_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0122.468] GetLastError () returned 0x0 [0122.468] ReadFile (in: hFile=0x220, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x3670, lpOverlapped=0x0) returned 1 [0122.499] WriteFile (in: hFile=0x1a0, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0x3680, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0x3680, lpOverlapped=0x0) returned 1 [0122.499] ReadFile (in: hFile=0x220, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x0, lpOverlapped=0x0) returned 1 [0122.499] WriteFile (in: hFile=0x1a0, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0xec, lpOverlapped=0x0) returned 1 [0122.499] SetEndOfFile (hFile=0x1a0) returned 1 [0122.499] CloseHandle (hObject=0x1a0) returned 1 [0122.499] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0122.499] SetEndOfFile (hFile=0x220) returned 1 [0122.500] CloseHandle (hObject=0x220) returned 1 [0122.500] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0122.500] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00006_.wmf")) returned 1 [0122.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF") returned 63 [0122.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF") returned 63 [0122.501] lstrlenW (lpString=".doc") returned 4 [0122.501] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0122.501] lstrlenW (lpString=".docx") returned 5 [0122.501] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0122.501] lstrlenW (lpString=".pdf") returned 4 [0122.501] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0122.501] lstrlenW (lpString=".xls") returned 4 [0122.501] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0122.501] lstrlenW (lpString=".xlsx") returned 5 [0122.501] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0122.501] lstrlenW (lpString=".ppt") returned 4 [0122.501] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0122.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF") returned 63 [0122.501] lstrlenW (lpString=".zip") returned 4 [0122.501] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0122.501] lstrlenW (lpString=".rar") returned 4 [0122.501] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0122.501] lstrlenW (lpString=".bz2") returned 4 [0122.501] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0122.501] lstrlenW (lpString=".7z") returned 3 [0122.501] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0122.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF") returned 63 [0122.501] lstrlenW (lpString=".dbf") returned 4 [0122.501] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0122.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF") returned 63 [0122.501] lstrlenW (lpString=".1cd") returned 4 [0122.501] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0122.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF") returned 63 [0122.501] lstrlenW (lpString=".jpg") returned 4 [0122.501] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0122.502] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0122.502] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0122.502] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00320_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00320_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0122.502] GetLastError () returned 0x0 [0122.502] ReadFile (in: hFile=0x220, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x2e0, lpOverlapped=0x0) returned 1 [0122.647] WriteFile (in: hFile=0x1a0, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0x2f0, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0x2f0, lpOverlapped=0x0) returned 1 [0122.648] ReadFile (in: hFile=0x220, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x0, lpOverlapped=0x0) returned 1 [0122.648] WriteFile (in: hFile=0x1a0, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0xec, lpOverlapped=0x0) returned 1 [0122.648] SetEndOfFile (hFile=0x1a0) returned 1 [0122.649] CloseHandle (hObject=0x1a0) returned 1 [0122.649] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0122.649] SetEndOfFile (hFile=0x220) returned 1 [0122.649] CloseHandle (hObject=0x220) returned 1 [0122.649] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00320_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0122.649] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00320_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00320_.wmf")) returned 1 [0122.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 63 [0122.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 63 [0122.650] lstrlenW (lpString=".doc") returned 4 [0122.650] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0122.650] lstrlenW (lpString=".docx") returned 5 [0122.650] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0122.650] lstrlenW (lpString=".pdf") returned 4 [0122.650] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0122.650] lstrlenW (lpString=".xls") returned 4 [0122.650] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0122.650] lstrlenW (lpString=".xlsx") returned 5 [0122.650] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0122.650] lstrlenW (lpString=".ppt") returned 4 [0122.650] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0122.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 63 [0122.650] lstrlenW (lpString=".zip") returned 4 [0122.650] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0122.650] lstrlenW (lpString=".rar") returned 4 [0122.650] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0122.650] lstrlenW (lpString=".bz2") returned 4 [0122.650] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0122.650] lstrlenW (lpString=".7z") returned 3 [0122.650] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0122.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 63 [0122.650] lstrlenW (lpString=".dbf") returned 4 [0122.650] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0122.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 63 [0122.650] lstrlenW (lpString=".1cd") returned 4 [0122.650] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0122.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 63 [0122.650] lstrlenW (lpString=".jpg") returned 4 [0122.650] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0122.657] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0122.657] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0122.657] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00297_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00297_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0122.657] GetLastError () returned 0x0 [0122.657] ReadFile (in: hFile=0x220, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x4712, lpOverlapped=0x0) returned 1 [0122.705] WriteFile (in: hFile=0x1a0, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0x4720, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0x4720, lpOverlapped=0x0) returned 1 [0122.706] ReadFile (in: hFile=0x220, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x0, lpOverlapped=0x0) returned 1 [0122.706] WriteFile (in: hFile=0x1a0, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0xec, lpOverlapped=0x0) returned 1 [0122.706] SetEndOfFile (hFile=0x1a0) returned 1 [0122.706] CloseHandle (hObject=0x1a0) returned 1 [0122.706] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0122.706] SetEndOfFile (hFile=0x220) returned 1 [0122.708] CloseHandle (hObject=0x220) returned 1 [0122.708] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00297_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0122.708] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00297_.wmf")) returned 1 [0122.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 63 [0122.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 63 [0122.709] lstrlenW (lpString=".doc") returned 4 [0122.709] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0122.709] lstrlenW (lpString=".docx") returned 5 [0122.709] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0122.709] lstrlenW (lpString=".pdf") returned 4 [0122.709] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0122.709] lstrlenW (lpString=".xls") returned 4 [0122.709] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0122.709] lstrlenW (lpString=".xlsx") returned 5 [0122.709] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0122.709] lstrlenW (lpString=".ppt") returned 4 [0122.709] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0122.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 63 [0122.709] lstrlenW (lpString=".zip") returned 4 [0122.709] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0122.709] lstrlenW (lpString=".rar") returned 4 [0122.709] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0122.709] lstrlenW (lpString=".bz2") returned 4 [0122.709] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0122.709] lstrlenW (lpString=".7z") returned 3 [0122.709] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0122.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 63 [0122.709] lstrlenW (lpString=".dbf") returned 4 [0122.709] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0122.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 63 [0122.709] lstrlenW (lpString=".1cd") returned 4 [0122.709] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0122.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 63 [0122.709] lstrlenW (lpString=".jpg") returned 4 [0122.709] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0122.710] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x37cfddc | out: lpFileSize=0x37cfddc*=8424) returned 1 [0122.710] CloseHandle (hObject=0x220) returned 1 [0122.710] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00382_.wmf")) returned 0x20 [0122.710] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00382_.wmf.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0122.710] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00382_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0122.710] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0122.710] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0122.710] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00382_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0122.711] GetLastError () returned 0x0 [0122.711] ReadFile (in: hFile=0x220, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x20e8, lpOverlapped=0x0) returned 1 [0122.719] WriteFile (in: hFile=0x1a0, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0x20f0, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0x20f0, lpOverlapped=0x0) returned 1 [0122.719] ReadFile (in: hFile=0x220, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x0, lpOverlapped=0x0) returned 1 [0122.720] WriteFile (in: hFile=0x1a0, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0xec, lpOverlapped=0x0) returned 1 [0122.720] SetEndOfFile (hFile=0x1a0) returned 1 [0122.720] CloseHandle (hObject=0x1a0) returned 1 [0122.720] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0122.720] SetEndOfFile (hFile=0x220) returned 1 [0122.720] CloseHandle (hObject=0x220) returned 1 [0122.720] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0122.721] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00382_.wmf")) returned 1 [0122.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF") returned 63 [0122.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF") returned 63 [0122.721] lstrlenW (lpString=".doc") returned 4 [0122.721] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0122.721] lstrlenW (lpString=".docx") returned 5 [0122.721] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0122.721] lstrlenW (lpString=".pdf") returned 4 [0122.721] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0122.721] lstrlenW (lpString=".xls") returned 4 [0122.721] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0122.721] lstrlenW (lpString=".xlsx") returned 5 [0122.721] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0122.721] lstrlenW (lpString=".ppt") returned 4 [0122.721] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0122.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF") returned 63 [0122.721] lstrlenW (lpString=".zip") returned 4 [0122.721] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0122.721] lstrlenW (lpString=".rar") returned 4 [0122.721] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0122.721] lstrlenW (lpString=".bz2") returned 4 [0122.721] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0122.721] lstrlenW (lpString=".7z") returned 3 [0122.721] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0122.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF") returned 63 [0122.721] lstrlenW (lpString=".dbf") returned 4 [0122.721] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0122.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF") returned 63 [0122.721] lstrlenW (lpString=".1cd") returned 4 [0122.721] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0122.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF") returned 63 [0122.721] lstrlenW (lpString=".jpg") returned 4 [0122.721] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0122.722] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0122.722] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0122.722] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00397_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0122.722] GetLastError () returned 0x0 [0122.722] ReadFile (in: hFile=0x220, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x2a40, lpOverlapped=0x0) returned 1 [0122.749] WriteFile (in: hFile=0x1a0, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0x2a50, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0x2a50, lpOverlapped=0x0) returned 1 [0122.749] ReadFile (in: hFile=0x220, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x0, lpOverlapped=0x0) returned 1 [0122.749] WriteFile (in: hFile=0x1a0, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0xec, lpOverlapped=0x0) returned 1 [0122.750] SetEndOfFile (hFile=0x1a0) returned 1 [0122.750] CloseHandle (hObject=0x1a0) returned 1 [0122.750] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0122.750] SetEndOfFile (hFile=0x220) returned 1 [0122.750] CloseHandle (hObject=0x220) returned 1 [0122.750] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0122.750] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00397_.wmf")) returned 1 [0122.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF") returned 63 [0122.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF") returned 63 [0122.751] lstrlenW (lpString=".doc") returned 4 [0122.751] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0122.751] lstrlenW (lpString=".docx") returned 5 [0122.751] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0122.751] lstrlenW (lpString=".pdf") returned 4 [0122.751] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0122.751] lstrlenW (lpString=".xls") returned 4 [0122.751] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0122.751] lstrlenW (lpString=".xlsx") returned 5 [0122.751] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0122.751] lstrlenW (lpString=".ppt") returned 4 [0122.751] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0122.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF") returned 63 [0122.751] lstrlenW (lpString=".zip") returned 4 [0122.751] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0122.751] lstrlenW (lpString=".rar") returned 4 [0122.751] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0122.751] lstrlenW (lpString=".bz2") returned 4 [0122.751] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0122.751] lstrlenW (lpString=".7z") returned 3 [0122.751] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0122.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF") returned 63 [0122.751] lstrlenW (lpString=".dbf") returned 4 [0122.751] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0122.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF") returned 63 [0122.751] lstrlenW (lpString=".1cd") returned 4 [0122.751] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0122.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF") returned 63 [0122.751] lstrlenW (lpString=".jpg") returned 4 [0122.751] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0122.752] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x37cfddc | out: lpFileSize=0x37cfddc*=11002) returned 1 [0122.753] CloseHandle (hObject=0x220) returned 1 [0122.753] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00414_.wmf")) returned 0x20 [0122.753] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00414_.wmf.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0122.753] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00414_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0122.753] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0122.753] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0122.753] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00414_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0122.753] GetLastError () returned 0x0 [0122.753] ReadFile (in: hFile=0x220, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x2afa, lpOverlapped=0x0) returned 1 [0122.768] WriteFile (in: hFile=0x1a0, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0x2b00, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0x2b00, lpOverlapped=0x0) returned 1 [0122.769] ReadFile (in: hFile=0x220, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x0, lpOverlapped=0x0) returned 1 [0122.769] WriteFile (in: hFile=0x1a0, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0xec, lpOverlapped=0x0) returned 1 [0122.769] SetEndOfFile (hFile=0x1a0) returned 1 [0122.769] CloseHandle (hObject=0x1a0) returned 1 [0122.770] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0122.770] SetEndOfFile (hFile=0x220) returned 1 [0122.771] CloseHandle (hObject=0x220) returned 1 [0122.771] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0122.771] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00414_.wmf")) returned 1 [0122.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF") returned 63 [0122.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF") returned 63 [0122.771] lstrlenW (lpString=".doc") returned 4 [0122.771] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0122.772] lstrlenW (lpString=".docx") returned 5 [0122.772] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0122.772] lstrlenW (lpString=".pdf") returned 4 [0122.772] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0122.772] lstrlenW (lpString=".xls") returned 4 [0122.772] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0122.772] lstrlenW (lpString=".xlsx") returned 5 [0122.772] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0122.772] lstrlenW (lpString=".ppt") returned 4 [0122.772] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0122.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF") returned 63 [0122.772] lstrlenW (lpString=".zip") returned 4 [0122.772] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0122.772] lstrlenW (lpString=".rar") returned 4 [0122.772] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0122.772] lstrlenW (lpString=".bz2") returned 4 [0122.772] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0122.772] lstrlenW (lpString=".7z") returned 3 [0122.772] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0122.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF") returned 63 [0122.772] lstrlenW (lpString=".dbf") returned 4 [0122.772] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0122.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF") returned 63 [0122.772] lstrlenW (lpString=".1cd") returned 4 [0122.772] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0122.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF") returned 63 [0122.772] lstrlenW (lpString=".jpg") returned 4 [0122.772] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0122.773] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0122.773] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0122.774] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00428_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00428_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0122.774] GetLastError () returned 0x0 [0122.774] ReadFile (in: hFile=0x220, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x12bc, lpOverlapped=0x0) returned 1 [0122.839] WriteFile (in: hFile=0x1a0, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0x12c0, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0x12c0, lpOverlapped=0x0) returned 1 [0122.840] ReadFile (in: hFile=0x220, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x0, lpOverlapped=0x0) returned 1 [0122.840] WriteFile (in: hFile=0x1a0, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0xec, lpOverlapped=0x0) returned 1 [0122.840] SetEndOfFile (hFile=0x1a0) returned 1 [0122.840] CloseHandle (hObject=0x1a0) returned 1 [0122.840] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0122.840] SetEndOfFile (hFile=0x220) returned 1 [0122.899] CloseHandle (hObject=0x220) returned 1 [0122.899] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00428_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0122.899] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00428_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00428_.wmf")) returned 1 [0122.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 63 [0122.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 63 [0122.899] lstrlenW (lpString=".doc") returned 4 [0122.899] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0122.899] lstrlenW (lpString=".docx") returned 5 [0122.899] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0122.899] lstrlenW (lpString=".pdf") returned 4 [0122.899] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0122.899] lstrlenW (lpString=".xls") returned 4 [0122.899] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0122.899] lstrlenW (lpString=".xlsx") returned 5 [0122.899] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0122.899] lstrlenW (lpString=".ppt") returned 4 [0122.899] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0122.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 63 [0122.899] lstrlenW (lpString=".zip") returned 4 [0122.899] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0122.899] lstrlenW (lpString=".rar") returned 4 [0122.900] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0122.900] lstrlenW (lpString=".bz2") returned 4 [0122.900] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0122.900] lstrlenW (lpString=".7z") returned 3 [0122.900] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0122.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 63 [0122.900] lstrlenW (lpString=".dbf") returned 4 [0122.900] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0122.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 63 [0122.900] lstrlenW (lpString=".1cd") returned 4 [0122.900] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0122.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 63 [0122.900] lstrlenW (lpString=".jpg") returned 4 [0122.900] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0122.900] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0122.900] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0122.900] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00438_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00438_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0122.900] GetLastError () returned 0x0 [0122.901] ReadFile (in: hFile=0x220, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x13ea, lpOverlapped=0x0) returned 1 [0122.947] WriteFile (in: hFile=0x1e0, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0x13f0, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0x13f0, lpOverlapped=0x0) returned 1 [0122.947] ReadFile (in: hFile=0x220, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x0, lpOverlapped=0x0) returned 1 [0122.947] WriteFile (in: hFile=0x1e0, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0xec, lpOverlapped=0x0) returned 1 [0122.947] SetEndOfFile (hFile=0x1e0) returned 1 [0122.948] CloseHandle (hObject=0x1e0) returned 1 [0122.948] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0122.948] SetEndOfFile (hFile=0x220) returned 1 [0122.948] CloseHandle (hObject=0x220) returned 1 [0122.948] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00438_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0122.949] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00438_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00438_.wmf")) returned 1 [0122.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 63 [0122.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 63 [0122.949] lstrlenW (lpString=".doc") returned 4 [0122.949] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0122.949] lstrlenW (lpString=".docx") returned 5 [0122.949] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0122.949] lstrlenW (lpString=".pdf") returned 4 [0122.949] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0122.949] lstrlenW (lpString=".xls") returned 4 [0122.949] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0122.949] lstrlenW (lpString=".xlsx") returned 5 [0122.949] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0122.949] lstrlenW (lpString=".ppt") returned 4 [0122.949] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0122.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 63 [0122.949] lstrlenW (lpString=".zip") returned 4 [0122.950] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0122.950] lstrlenW (lpString=".rar") returned 4 [0122.950] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0122.950] lstrlenW (lpString=".bz2") returned 4 [0122.950] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0122.950] lstrlenW (lpString=".7z") returned 3 [0122.950] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0122.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 63 [0122.950] lstrlenW (lpString=".dbf") returned 4 [0122.950] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0122.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 63 [0122.950] lstrlenW (lpString=".1cd") returned 4 [0122.950] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0122.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 63 [0122.950] lstrlenW (lpString=".jpg") returned 4 [0122.950] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0122.951] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0122.951] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0122.951] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00544_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00544_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0122.951] GetLastError () returned 0x0 [0122.951] ReadFile (in: hFile=0x220, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x148c, lpOverlapped=0x0) returned 1 [0123.028] WriteFile (in: hFile=0x1e0, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0x1490, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0x1490, lpOverlapped=0x0) returned 1 [0123.029] ReadFile (in: hFile=0x220, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x0, lpOverlapped=0x0) returned 1 [0123.029] WriteFile (in: hFile=0x1e0, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0xec, lpOverlapped=0x0) returned 1 [0123.029] SetEndOfFile (hFile=0x1e0) returned 1 [0123.030] CloseHandle (hObject=0x1e0) returned 1 [0123.031] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0123.031] SetEndOfFile (hFile=0x220) returned 1 [0123.031] CloseHandle (hObject=0x220) returned 1 [0123.031] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00544_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0123.031] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00544_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00544_.wmf")) returned 1 [0123.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 63 [0123.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 63 [0123.032] lstrlenW (lpString=".doc") returned 4 [0123.032] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0123.032] lstrlenW (lpString=".docx") returned 5 [0123.032] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0123.032] lstrlenW (lpString=".pdf") returned 4 [0123.032] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0123.032] lstrlenW (lpString=".xls") returned 4 [0123.032] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0123.032] lstrlenW (lpString=".xlsx") returned 5 [0123.032] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0123.032] lstrlenW (lpString=".ppt") returned 4 [0123.032] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0123.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 63 [0123.032] lstrlenW (lpString=".zip") returned 4 [0123.032] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0123.032] lstrlenW (lpString=".rar") returned 4 [0123.032] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0123.032] lstrlenW (lpString=".bz2") returned 4 [0123.032] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0123.032] lstrlenW (lpString=".7z") returned 3 [0123.032] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0123.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 63 [0123.032] lstrlenW (lpString=".dbf") returned 4 [0123.032] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0123.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 63 [0123.032] lstrlenW (lpString=".1cd") returned 4 [0123.032] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0123.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 63 [0123.032] lstrlenW (lpString=".jpg") returned 4 [0123.032] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0123.032] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0123.033] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0123.033] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00799_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00799_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0123.037] GetLastError () returned 0x0 [0123.047] ReadFile (in: hFile=0x220, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x3690, lpOverlapped=0x0) returned 1 [0123.062] WriteFile (in: hFile=0x1e0, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0x36a0, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0x36a0, lpOverlapped=0x0) returned 1 [0123.062] ReadFile (in: hFile=0x220, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x0, lpOverlapped=0x0) returned 1 [0123.173] WriteFile (in: hFile=0x1e0, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0xec, lpOverlapped=0x0) returned 1 [0123.173] SetEndOfFile (hFile=0x1e0) returned 1 [0123.173] CloseHandle (hObject=0x1e0) returned 1 [0123.173] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0123.173] SetEndOfFile (hFile=0x220) returned 1 [0123.174] CloseHandle (hObject=0x220) returned 1 [0123.174] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00799_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0123.174] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00799_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00799_.wmf")) returned 1 [0123.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 63 [0123.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 63 [0123.174] lstrlenW (lpString=".doc") returned 4 [0123.174] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0123.174] lstrlenW (lpString=".docx") returned 5 [0123.174] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0123.174] lstrlenW (lpString=".pdf") returned 4 [0123.174] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0123.174] lstrlenW (lpString=".xls") returned 4 [0123.174] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0123.175] lstrlenW (lpString=".xlsx") returned 5 [0123.175] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0123.175] lstrlenW (lpString=".ppt") returned 4 [0123.175] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0123.175] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 63 [0123.175] lstrlenW (lpString=".zip") returned 4 [0123.175] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0123.175] lstrlenW (lpString=".rar") returned 4 [0123.175] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0123.175] lstrlenW (lpString=".bz2") returned 4 [0123.175] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0123.175] lstrlenW (lpString=".7z") returned 3 [0123.175] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0123.175] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 63 [0123.175] lstrlenW (lpString=".dbf") returned 4 [0123.175] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0123.175] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 63 [0123.175] lstrlenW (lpString=".1cd") returned 4 [0123.175] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0123.175] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 63 [0123.175] lstrlenW (lpString=".jpg") returned 4 [0123.175] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0123.175] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0123.175] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0123.175] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01196_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01196_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0123.176] GetLastError () returned 0x0 [0123.176] ReadFile (in: hFile=0x220, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x91c, lpOverlapped=0x0) returned 1 [0123.249] WriteFile (in: hFile=0x1e0, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0x920, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0x920, lpOverlapped=0x0) returned 1 [0123.250] ReadFile (in: hFile=0x220, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x0, lpOverlapped=0x0) returned 1 [0123.250] WriteFile (in: hFile=0x1e0, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0xec, lpOverlapped=0x0) returned 1 [0123.250] SetEndOfFile (hFile=0x1e0) returned 1 [0123.260] CloseHandle (hObject=0x1e0) returned 1 [0123.260] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0123.260] SetEndOfFile (hFile=0x220) returned 1 [0123.260] CloseHandle (hObject=0x220) returned 1 [0123.260] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01196_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0123.260] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01196_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01196_.wmf")) returned 1 [0123.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 63 [0123.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 63 [0123.281] lstrlenW (lpString=".doc") returned 4 [0123.281] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0123.281] lstrlenW (lpString=".docx") returned 5 [0123.281] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0123.281] lstrlenW (lpString=".pdf") returned 4 [0123.281] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0123.281] lstrlenW (lpString=".xls") returned 4 [0123.281] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0123.281] lstrlenW (lpString=".xlsx") returned 5 [0123.281] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0123.281] lstrlenW (lpString=".ppt") returned 4 [0123.281] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0123.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 63 [0123.281] lstrlenW (lpString=".zip") returned 4 [0123.281] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0123.281] lstrlenW (lpString=".rar") returned 4 [0123.281] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0123.281] lstrlenW (lpString=".bz2") returned 4 [0123.281] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0123.281] lstrlenW (lpString=".7z") returned 3 [0123.281] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0123.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 63 [0123.281] lstrlenW (lpString=".dbf") returned 4 [0123.281] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0123.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 63 [0123.281] lstrlenW (lpString=".1cd") returned 4 [0123.281] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0123.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 63 [0123.281] lstrlenW (lpString=".jpg") returned 4 [0123.281] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0123.282] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0123.282] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0123.282] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01660_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01660_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0123.283] GetLastError () returned 0x0 [0123.283] ReadFile (in: hFile=0x208, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x329e, lpOverlapped=0x0) returned 1 [0123.311] WriteFile (in: hFile=0x230, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0x32a0, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0x32a0, lpOverlapped=0x0) returned 1 [0123.312] ReadFile (in: hFile=0x208, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x0, lpOverlapped=0x0) returned 1 [0123.312] WriteFile (in: hFile=0x230, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0xec, lpOverlapped=0x0) returned 1 [0123.312] SetEndOfFile (hFile=0x230) returned 1 [0123.312] CloseHandle (hObject=0x230) returned 1 [0123.312] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0123.312] SetEndOfFile (hFile=0x208) returned 1 [0123.313] CloseHandle (hObject=0x208) returned 1 [0123.313] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01660_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0123.313] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01660_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01660_.wmf")) returned 1 [0123.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01660_.WMF") returned 63 [0123.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01660_.WMF") returned 63 [0123.313] lstrlenW (lpString=".doc") returned 4 [0123.313] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0123.313] lstrlenW (lpString=".docx") returned 5 [0123.313] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0123.313] lstrlenW (lpString=".pdf") returned 4 [0123.313] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0123.313] lstrlenW (lpString=".xls") returned 4 [0123.313] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0123.313] lstrlenW (lpString=".xlsx") returned 5 [0123.314] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0123.314] lstrlenW (lpString=".ppt") returned 4 [0123.314] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0123.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01660_.WMF") returned 63 [0123.314] lstrlenW (lpString=".zip") returned 4 [0123.314] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0123.314] lstrlenW (lpString=".rar") returned 4 [0123.314] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0123.314] lstrlenW (lpString=".bz2") returned 4 [0123.314] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0123.314] lstrlenW (lpString=".7z") returned 3 [0123.314] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0123.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01660_.WMF") returned 63 [0123.314] lstrlenW (lpString=".dbf") returned 4 [0123.314] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0123.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01660_.WMF") returned 63 [0123.314] lstrlenW (lpString=".1cd") returned 4 [0123.314] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0123.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01660_.WMF") returned 63 [0123.314] lstrlenW (lpString=".jpg") returned 4 [0123.314] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0123.314] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x37cfddc | out: lpFileSize=0x37cfddc*=2188) returned 1 [0123.314] CloseHandle (hObject=0x208) returned 1 [0123.314] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02071_.wmf")) returned 0x20 [0123.314] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02071_.wmf.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0123.314] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02071_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0123.315] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0123.315] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0123.315] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02071_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0123.315] GetLastError () returned 0x0 [0123.315] ReadFile (in: hFile=0x208, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x88c, lpOverlapped=0x0) returned 1 [0123.322] WriteFile (in: hFile=0x230, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0x890, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0x890, lpOverlapped=0x0) returned 1 [0123.322] ReadFile (in: hFile=0x208, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x0, lpOverlapped=0x0) returned 1 [0123.322] WriteFile (in: hFile=0x230, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0xec, lpOverlapped=0x0) returned 1 [0123.322] SetEndOfFile (hFile=0x230) returned 1 [0123.322] CloseHandle (hObject=0x230) returned 1 [0123.323] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0123.323] SetEndOfFile (hFile=0x208) returned 1 [0123.323] CloseHandle (hObject=0x208) returned 1 [0123.323] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0123.323] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02071_.wmf")) returned 1 [0123.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF") returned 63 [0123.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF") returned 63 [0123.323] lstrlenW (lpString=".doc") returned 4 [0123.323] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0123.324] lstrlenW (lpString=".docx") returned 5 [0123.324] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0123.324] lstrlenW (lpString=".pdf") returned 4 [0123.324] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0123.324] lstrlenW (lpString=".xls") returned 4 [0123.324] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0123.324] lstrlenW (lpString=".xlsx") returned 5 [0123.324] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0123.324] lstrlenW (lpString=".ppt") returned 4 [0123.324] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0123.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF") returned 63 [0123.324] lstrlenW (lpString=".zip") returned 4 [0123.324] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0123.324] lstrlenW (lpString=".rar") returned 4 [0123.324] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0123.324] lstrlenW (lpString=".bz2") returned 4 [0123.324] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0123.324] lstrlenW (lpString=".7z") returned 3 [0123.324] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0123.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF") returned 63 [0123.324] lstrlenW (lpString=".dbf") returned 4 [0123.324] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0123.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF") returned 63 [0123.324] lstrlenW (lpString=".1cd") returned 4 [0123.324] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0123.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF") returned 63 [0123.324] lstrlenW (lpString=".jpg") returned 4 [0123.324] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0123.324] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0123.324] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0123.324] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02088_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02088_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0123.325] GetLastError () returned 0x0 [0123.325] ReadFile (in: hFile=0x208, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0xe70, lpOverlapped=0x0) returned 1 [0123.347] WriteFile (in: hFile=0x230, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0xe80, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0xe80, lpOverlapped=0x0) returned 1 [0123.348] ReadFile (in: hFile=0x208, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x0, lpOverlapped=0x0) returned 1 [0123.348] WriteFile (in: hFile=0x230, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0xec, lpOverlapped=0x0) returned 1 [0123.348] SetEndOfFile (hFile=0x230) returned 1 [0123.348] CloseHandle (hObject=0x230) returned 1 [0123.348] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0123.348] SetEndOfFile (hFile=0x208) returned 1 [0123.349] CloseHandle (hObject=0x208) returned 1 [0123.349] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02088_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0123.349] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02088_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02088_.wmf")) returned 1 [0123.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02088_.WMF") returned 63 [0123.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02088_.WMF") returned 63 [0123.349] lstrlenW (lpString=".doc") returned 4 [0123.349] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0123.349] lstrlenW (lpString=".docx") returned 5 [0123.349] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0123.349] lstrlenW (lpString=".pdf") returned 4 [0123.349] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0123.349] lstrlenW (lpString=".xls") returned 4 [0123.349] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0123.349] lstrlenW (lpString=".xlsx") returned 5 [0123.349] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0123.349] lstrlenW (lpString=".ppt") returned 4 [0123.349] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0123.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02088_.WMF") returned 63 [0123.349] lstrlenW (lpString=".zip") returned 4 [0123.350] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0123.350] lstrlenW (lpString=".rar") returned 4 [0123.350] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0123.350] lstrlenW (lpString=".bz2") returned 4 [0123.350] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0123.350] lstrlenW (lpString=".7z") returned 3 [0123.350] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0123.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02088_.WMF") returned 63 [0123.350] lstrlenW (lpString=".dbf") returned 4 [0123.350] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0123.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02088_.WMF") returned 63 [0123.350] lstrlenW (lpString=".1cd") returned 4 [0123.350] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0123.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02088_.WMF") returned 63 [0123.350] lstrlenW (lpString=".jpg") returned 4 [0123.350] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0123.350] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0123.350] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0123.350] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02116_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02116_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0123.351] GetLastError () returned 0x0 [0123.351] ReadFile (in: hFile=0x208, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0xf94, lpOverlapped=0x0) returned 1 [0123.434] WriteFile (in: hFile=0x230, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0xfa0, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0xfa0, lpOverlapped=0x0) returned 1 [0124.043] ReadFile (in: hFile=0x208, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x0, lpOverlapped=0x0) returned 1 [0124.043] WriteFile (in: hFile=0x230, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0xec, lpOverlapped=0x0) returned 1 [0124.043] SetEndOfFile (hFile=0x230) returned 1 [0124.043] CloseHandle (hObject=0x230) returned 1 [0124.043] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0124.043] SetEndOfFile (hFile=0x208) returned 1 [0124.044] CloseHandle (hObject=0x208) returned 1 [0124.044] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02116_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0124.044] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02116_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02116_.wmf")) returned 1 [0124.044] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02116_.WMF") returned 63 [0124.044] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02116_.WMF") returned 63 [0124.044] lstrlenW (lpString=".doc") returned 4 [0124.044] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0124.044] lstrlenW (lpString=".docx") returned 5 [0124.044] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0124.044] lstrlenW (lpString=".pdf") returned 4 [0124.044] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0124.044] lstrlenW (lpString=".xls") returned 4 [0124.044] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0124.044] lstrlenW (lpString=".xlsx") returned 5 [0124.044] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0124.044] lstrlenW (lpString=".ppt") returned 4 [0124.044] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0124.044] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02116_.WMF") returned 63 [0124.044] lstrlenW (lpString=".zip") returned 4 [0124.044] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0124.044] lstrlenW (lpString=".rar") returned 4 [0124.045] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0124.045] lstrlenW (lpString=".bz2") returned 4 [0124.045] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0124.045] lstrlenW (lpString=".7z") returned 3 [0124.045] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0124.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02116_.WMF") returned 63 [0124.045] lstrlenW (lpString=".dbf") returned 4 [0124.045] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0124.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02116_.WMF") returned 63 [0124.045] lstrlenW (lpString=".1cd") returned 4 [0124.045] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0124.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02116_.WMF") returned 63 [0124.045] lstrlenW (lpString=".jpg") returned 4 [0124.045] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0124.050] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0124.050] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0124.050] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FLAP.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\flap.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0124.051] GetLastError () returned 0x0 [0124.051] ReadFile (in: hFile=0x208, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x816, lpOverlapped=0x0) returned 1 [0124.073] WriteFile (in: hFile=0x230, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0x820, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0x820, lpOverlapped=0x0) returned 1 [0124.073] ReadFile (in: hFile=0x208, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x0, lpOverlapped=0x0) returned 1 [0124.073] WriteFile (in: hFile=0x230, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0xe4, lpOverlapped=0x0) returned 1 [0124.073] SetEndOfFile (hFile=0x230) returned 1 [0124.354] CloseHandle (hObject=0x230) returned 1 [0124.354] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0124.354] SetEndOfFile (hFile=0x208) returned 1 [0124.359] CloseHandle (hObject=0x208) returned 1 [0124.360] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FLAP.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0124.365] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FLAP.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\flap.wmf")) returned 1 [0124.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FLAP.WMF") returned 59 [0124.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FLAP.WMF") returned 59 [0124.365] lstrlenW (lpString=".doc") returned 4 [0124.365] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0124.365] lstrlenW (lpString=".docx") returned 5 [0124.365] lstrcmpiW (lpString1=".docx", lpString2="P.WMF") returned -1 [0124.365] lstrlenW (lpString=".pdf") returned 4 [0124.365] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0124.365] lstrlenW (lpString=".xls") returned 4 [0124.365] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0124.365] lstrlenW (lpString=".xlsx") returned 5 [0124.365] lstrcmpiW (lpString1=".xlsx", lpString2="P.WMF") returned -1 [0124.365] lstrlenW (lpString=".ppt") returned 4 [0124.365] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0124.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FLAP.WMF") returned 59 [0124.365] lstrlenW (lpString=".zip") returned 4 [0124.365] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0124.365] lstrlenW (lpString=".rar") returned 4 [0124.365] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0124.365] lstrlenW (lpString=".bz2") returned 4 [0124.365] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0124.365] lstrlenW (lpString=".7z") returned 3 [0124.365] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0124.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FLAP.WMF") returned 59 [0124.365] lstrlenW (lpString=".dbf") returned 4 [0124.365] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0124.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FLAP.WMF") returned 59 [0124.365] lstrlenW (lpString=".1cd") returned 4 [0124.365] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0124.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FLAP.WMF") returned 59 [0124.365] lstrlenW (lpString=".jpg") returned 4 [0124.366] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0124.366] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0124.366] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0124.366] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00241_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00241_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x238 [0124.366] GetLastError () returned 0x0 [0124.366] ReadFile (in: hFile=0x208, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x7a8, lpOverlapped=0x0) returned 1 [0124.499] WriteFile (in: hFile=0x238, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0x7b0, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0x7b0, lpOverlapped=0x0) returned 1 [0124.550] ReadFile (in: hFile=0x208, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x0, lpOverlapped=0x0) returned 1 [0124.550] WriteFile (in: hFile=0x238, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0xec, lpOverlapped=0x0) returned 1 [0124.551] SetEndOfFile (hFile=0x238) returned 1 [0124.551] CloseHandle (hObject=0x238) returned 1 [0124.551] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0124.551] SetEndOfFile (hFile=0x208) returned 1 [0124.551] CloseHandle (hObject=0x208) returned 1 [0124.551] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00241_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0124.552] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00241_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00241_.wmf")) returned 1 [0124.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 63 [0124.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 63 [0124.552] lstrlenW (lpString=".doc") returned 4 [0124.552] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0124.552] lstrlenW (lpString=".docx") returned 5 [0124.552] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0124.552] lstrlenW (lpString=".pdf") returned 4 [0124.552] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0124.552] lstrlenW (lpString=".xls") returned 4 [0124.552] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0124.552] lstrlenW (lpString=".xlsx") returned 5 [0124.552] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0124.552] lstrlenW (lpString=".ppt") returned 4 [0124.552] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0124.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 63 [0124.552] lstrlenW (lpString=".zip") returned 4 [0124.552] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0124.552] lstrlenW (lpString=".rar") returned 4 [0124.552] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0124.552] lstrlenW (lpString=".bz2") returned 4 [0124.552] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0124.552] lstrlenW (lpString=".7z") returned 3 [0124.552] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0124.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 63 [0124.552] lstrlenW (lpString=".dbf") returned 4 [0124.552] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0124.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 63 [0124.552] lstrlenW (lpString=".1cd") returned 4 [0124.552] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0124.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 63 [0124.552] lstrlenW (lpString=".jpg") returned 4 [0124.553] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0124.553] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0124.553] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0124.553] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00334_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00334_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x238 [0124.553] GetLastError () returned 0x0 [0124.553] ReadFile (in: hFile=0x208, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x5f8, lpOverlapped=0x0) returned 1 [0124.637] WriteFile (in: hFile=0x238, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0x600, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0x600, lpOverlapped=0x0) returned 1 [0124.638] ReadFile (in: hFile=0x208, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x0, lpOverlapped=0x0) returned 1 [0124.638] WriteFile (in: hFile=0x238, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0xec, lpOverlapped=0x0) returned 1 [0124.638] SetEndOfFile (hFile=0x238) returned 1 [0124.638] CloseHandle (hObject=0x238) returned 1 [0124.638] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0124.638] SetEndOfFile (hFile=0x208) returned 1 [0124.638] CloseHandle (hObject=0x208) returned 1 [0124.639] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00334_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0124.639] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00334_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00334_.wmf")) returned 1 [0124.639] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 63 [0124.639] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 63 [0124.639] lstrlenW (lpString=".doc") returned 4 [0124.639] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0124.639] lstrlenW (lpString=".docx") returned 5 [0124.639] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0124.639] lstrlenW (lpString=".pdf") returned 4 [0124.639] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0124.639] lstrlenW (lpString=".xls") returned 4 [0124.639] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0124.639] lstrlenW (lpString=".xlsx") returned 5 [0124.639] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0124.639] lstrlenW (lpString=".ppt") returned 4 [0124.639] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0124.639] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 63 [0124.639] lstrlenW (lpString=".zip") returned 4 [0124.639] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0124.639] lstrlenW (lpString=".rar") returned 4 [0124.639] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0124.639] lstrlenW (lpString=".bz2") returned 4 [0124.639] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0124.639] lstrlenW (lpString=".7z") returned 3 [0124.639] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0124.639] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 63 [0124.639] lstrlenW (lpString=".dbf") returned 4 [0124.639] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0124.639] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 63 [0124.640] lstrlenW (lpString=".1cd") returned 4 [0124.640] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0124.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 63 [0124.640] lstrlenW (lpString=".jpg") returned 4 [0124.640] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0124.640] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0124.640] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0124.640] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00524_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00524_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x238 [0124.640] GetLastError () returned 0x0 [0124.640] ReadFile (in: hFile=0x208, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x3960, lpOverlapped=0x0) returned 1 [0124.798] WriteFile (in: hFile=0x238, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0x3970, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0x3970, lpOverlapped=0x0) returned 1 [0124.799] ReadFile (in: hFile=0x208, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x0, lpOverlapped=0x0) returned 1 [0124.799] WriteFile (in: hFile=0x238, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0xec, lpOverlapped=0x0) returned 1 [0124.799] SetEndOfFile (hFile=0x238) returned 1 [0124.799] CloseHandle (hObject=0x238) returned 1 [0124.799] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0124.799] SetEndOfFile (hFile=0x208) returned 1 [0124.800] CloseHandle (hObject=0x208) returned 1 [0124.800] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00524_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0124.800] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00524_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00524_.wmf")) returned 1 [0124.800] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00524_.WMF") returned 63 [0124.800] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00524_.WMF") returned 63 [0124.800] lstrlenW (lpString=".doc") returned 4 [0124.800] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0124.800] lstrlenW (lpString=".docx") returned 5 [0124.800] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0124.800] lstrlenW (lpString=".pdf") returned 4 [0124.800] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0124.802] lstrlenW (lpString=".xls") returned 4 [0124.802] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0124.806] lstrlenW (lpString=".xlsx") returned 5 [0124.806] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0124.806] lstrlenW (lpString=".ppt") returned 4 [0124.807] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0124.807] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00524_.WMF") returned 63 [0124.807] lstrlenW (lpString=".zip") returned 4 [0124.807] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0124.807] lstrlenW (lpString=".rar") returned 4 [0124.807] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0124.807] lstrlenW (lpString=".bz2") returned 4 [0124.807] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0124.807] lstrlenW (lpString=".7z") returned 3 [0124.807] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0124.807] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00524_.WMF") returned 63 [0124.807] lstrlenW (lpString=".dbf") returned 4 [0124.807] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0124.807] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00524_.WMF") returned 63 [0124.807] lstrlenW (lpString=".1cd") returned 4 [0124.807] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0124.807] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00524_.WMF") returned 63 [0124.807] lstrlenW (lpString=".jpg") returned 4 [0124.807] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0124.832] SetFilePointerEx (in: hFile=0x238, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0124.832] SetFilePointerEx (in: hFile=0x238, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0124.832] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00612_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00612_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0124.832] GetLastError () returned 0x0 [0124.832] ReadFile (in: hFile=0x238, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x3158, lpOverlapped=0x0) returned 1 [0124.850] WriteFile (in: hFile=0x16c, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0x3160, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0x3160, lpOverlapped=0x0) returned 1 [0124.851] ReadFile (in: hFile=0x238, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x0, lpOverlapped=0x0) returned 1 [0124.851] WriteFile (in: hFile=0x16c, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0xec, lpOverlapped=0x0) returned 1 [0124.851] SetEndOfFile (hFile=0x16c) returned 1 [0124.851] CloseHandle (hObject=0x16c) returned 1 [0124.851] SetFilePointerEx (in: hFile=0x238, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0124.851] SetEndOfFile (hFile=0x238) returned 1 [0124.852] CloseHandle (hObject=0x238) returned 1 [0124.852] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00612_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0124.852] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00612_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00612_.wmf")) returned 1 [0124.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00612_.WMF") returned 63 [0124.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00612_.WMF") returned 63 [0124.853] lstrlenW (lpString=".doc") returned 4 [0124.853] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0124.853] lstrlenW (lpString=".docx") returned 5 [0124.853] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0124.853] lstrlenW (lpString=".pdf") returned 4 [0124.853] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0124.853] lstrlenW (lpString=".xls") returned 4 [0124.853] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0124.853] lstrlenW (lpString=".xlsx") returned 5 [0124.853] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0124.853] lstrlenW (lpString=".ppt") returned 4 [0124.853] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0124.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00612_.WMF") returned 63 [0124.853] lstrlenW (lpString=".zip") returned 4 [0124.853] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0124.853] lstrlenW (lpString=".rar") returned 4 [0124.853] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0124.856] lstrlenW (lpString=".bz2") returned 4 [0124.884] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0124.884] lstrlenW (lpString=".7z") returned 3 [0124.884] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0124.884] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00612_.WMF") returned 63 [0124.884] lstrlenW (lpString=".dbf") returned 4 [0124.884] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0124.884] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00612_.WMF") returned 63 [0124.884] lstrlenW (lpString=".1cd") returned 4 [0124.884] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0124.884] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00612_.WMF") returned 63 [0124.884] lstrlenW (lpString=".jpg") returned 4 [0124.884] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0124.884] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0124.884] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0124.884] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00669_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00669_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x238 [0124.885] GetLastError () returned 0x0 [0124.885] ReadFile (in: hFile=0x208, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x2ce2, lpOverlapped=0x0) returned 1 [0124.949] WriteFile (in: hFile=0x238, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0x2cf0, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0x2cf0, lpOverlapped=0x0) returned 1 [0124.950] ReadFile (in: hFile=0x208, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x0, lpOverlapped=0x0) returned 1 [0124.950] WriteFile (in: hFile=0x238, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0xec, lpOverlapped=0x0) returned 1 [0124.950] SetEndOfFile (hFile=0x238) returned 1 [0124.950] CloseHandle (hObject=0x238) returned 1 [0124.950] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0124.950] SetEndOfFile (hFile=0x208) returned 1 [0124.951] CloseHandle (hObject=0x208) returned 1 [0124.951] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00669_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0124.951] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00669_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00669_.wmf")) returned 1 [0124.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00669_.WMF") returned 63 [0124.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00669_.WMF") returned 63 [0124.951] lstrlenW (lpString=".doc") returned 4 [0124.951] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0124.951] lstrlenW (lpString=".docx") returned 5 [0124.951] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0124.951] lstrlenW (lpString=".pdf") returned 4 [0124.951] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0124.951] lstrlenW (lpString=".xls") returned 4 [0124.951] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0124.951] lstrlenW (lpString=".xlsx") returned 5 [0124.951] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0124.951] lstrlenW (lpString=".ppt") returned 4 [0124.951] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0124.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00669_.WMF") returned 63 [0124.951] lstrlenW (lpString=".zip") returned 4 [0124.951] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0124.951] lstrlenW (lpString=".rar") returned 4 [0124.952] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0124.952] lstrlenW (lpString=".bz2") returned 4 [0124.952] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0124.952] lstrlenW (lpString=".7z") returned 3 [0124.952] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0124.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00669_.WMF") returned 63 [0124.952] lstrlenW (lpString=".dbf") returned 4 [0124.952] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0124.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00669_.WMF") returned 63 [0124.952] lstrlenW (lpString=".1cd") returned 4 [0124.952] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0124.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00669_.WMF") returned 63 [0124.952] lstrlenW (lpString=".jpg") returned 4 [0124.952] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0124.952] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0124.952] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0124.952] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00688_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00688_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x238 [0124.953] GetLastError () returned 0x0 [0124.953] ReadFile (in: hFile=0x208, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x1bac, lpOverlapped=0x0) returned 1 [0124.959] WriteFile (in: hFile=0x238, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0x1bb0, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0x1bb0, lpOverlapped=0x0) returned 1 [0124.959] ReadFile (in: hFile=0x208, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x0, lpOverlapped=0x0) returned 1 [0124.959] WriteFile (in: hFile=0x238, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0xec, lpOverlapped=0x0) returned 1 [0124.959] SetEndOfFile (hFile=0x238) returned 1 [0124.959] CloseHandle (hObject=0x238) returned 1 [0124.960] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0124.960] SetEndOfFile (hFile=0x208) returned 1 [0124.960] CloseHandle (hObject=0x208) returned 1 [0124.960] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00688_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0124.960] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00688_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00688_.wmf")) returned 1 [0124.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 63 [0124.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 63 [0124.961] lstrlenW (lpString=".doc") returned 4 [0124.961] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0124.961] lstrlenW (lpString=".docx") returned 5 [0124.961] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0124.961] lstrlenW (lpString=".pdf") returned 4 [0124.961] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0124.961] lstrlenW (lpString=".xls") returned 4 [0124.961] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0124.961] lstrlenW (lpString=".xlsx") returned 5 [0124.961] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0124.961] lstrlenW (lpString=".ppt") returned 4 [0124.961] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0124.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 63 [0124.961] lstrlenW (lpString=".zip") returned 4 [0124.961] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0124.961] lstrlenW (lpString=".rar") returned 4 [0124.961] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0124.961] lstrlenW (lpString=".bz2") returned 4 [0124.961] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0124.961] lstrlenW (lpString=".7z") returned 3 [0124.961] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0124.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 63 [0124.961] lstrlenW (lpString=".dbf") returned 4 [0124.961] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0124.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 63 [0124.961] lstrlenW (lpString=".1cd") returned 4 [0124.961] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0124.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 63 [0124.961] lstrlenW (lpString=".jpg") returned 4 [0124.961] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0124.963] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0124.963] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0124.963] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01013_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01013_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x238 [0124.964] GetLastError () returned 0x0 [0124.964] ReadFile (in: hFile=0x208, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0xb20, lpOverlapped=0x0) returned 1 [0124.985] WriteFile (in: hFile=0x238, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0xb30, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0xb30, lpOverlapped=0x0) returned 1 [0124.985] ReadFile (in: hFile=0x208, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x0, lpOverlapped=0x0) returned 1 [0124.985] WriteFile (in: hFile=0x238, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0xec, lpOverlapped=0x0) returned 1 [0124.985] SetEndOfFile (hFile=0x238) returned 1 [0124.985] CloseHandle (hObject=0x238) returned 1 [0124.985] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0124.986] SetEndOfFile (hFile=0x208) returned 1 [0124.986] CloseHandle (hObject=0x208) returned 1 [0124.986] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01013_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0124.986] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01013_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01013_.wmf")) returned 1 [0124.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 63 [0124.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 63 [0124.987] lstrlenW (lpString=".doc") returned 4 [0124.987] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0124.987] lstrlenW (lpString=".docx") returned 5 [0124.987] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0124.987] lstrlenW (lpString=".pdf") returned 4 [0124.987] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0124.987] lstrlenW (lpString=".xls") returned 4 [0124.987] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0124.987] lstrlenW (lpString=".xlsx") returned 5 [0124.987] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0124.987] lstrlenW (lpString=".ppt") returned 4 [0124.987] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0124.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 63 [0124.987] lstrlenW (lpString=".zip") returned 4 [0124.987] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0124.987] lstrlenW (lpString=".rar") returned 4 [0124.987] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0124.987] lstrlenW (lpString=".bz2") returned 4 [0124.987] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0124.987] lstrlenW (lpString=".7z") returned 3 [0124.987] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0124.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 63 [0124.987] lstrlenW (lpString=".dbf") returned 4 [0124.987] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0124.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 63 [0124.987] lstrlenW (lpString=".1cd") returned 4 [0124.987] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0124.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 63 [0124.987] lstrlenW (lpString=".jpg") returned 4 [0124.987] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0124.988] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0124.988] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0124.988] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01065_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01065_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x238 [0124.988] GetLastError () returned 0x0 [0124.988] ReadFile (in: hFile=0x208, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x4f4, lpOverlapped=0x0) returned 1 [0124.995] WriteFile (in: hFile=0x238, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0x500, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0x500, lpOverlapped=0x0) returned 1 [0124.995] ReadFile (in: hFile=0x208, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x0, lpOverlapped=0x0) returned 1 [0124.995] WriteFile (in: hFile=0x238, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0xec, lpOverlapped=0x0) returned 1 [0124.995] SetEndOfFile (hFile=0x238) returned 1 [0124.995] CloseHandle (hObject=0x238) returned 1 [0124.996] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0124.996] SetEndOfFile (hFile=0x208) returned 1 [0124.996] CloseHandle (hObject=0x208) returned 1 [0124.996] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01065_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0124.996] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01065_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01065_.wmf")) returned 1 [0124.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01065_.WMF") returned 63 [0124.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01065_.WMF") returned 63 [0124.997] lstrlenW (lpString=".doc") returned 4 [0124.997] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0124.997] lstrlenW (lpString=".docx") returned 5 [0124.997] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0124.997] lstrlenW (lpString=".pdf") returned 4 [0124.997] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0124.997] lstrlenW (lpString=".xls") returned 4 [0124.997] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0124.997] lstrlenW (lpString=".xlsx") returned 5 [0124.997] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0124.997] lstrlenW (lpString=".ppt") returned 4 [0124.997] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0124.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01065_.WMF") returned 63 [0124.997] lstrlenW (lpString=".zip") returned 4 [0124.997] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0124.997] lstrlenW (lpString=".rar") returned 4 [0124.997] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0124.997] lstrlenW (lpString=".bz2") returned 4 [0124.997] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0124.997] lstrlenW (lpString=".7z") returned 3 [0124.997] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0124.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01065_.WMF") returned 63 [0124.997] lstrlenW (lpString=".dbf") returned 4 [0124.997] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0124.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01065_.WMF") returned 63 [0124.997] lstrlenW (lpString=".1cd") returned 4 [0124.997] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0124.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01065_.WMF") returned 63 [0124.997] lstrlenW (lpString=".jpg") returned 4 [0124.997] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0125.017] SetFilePointerEx (in: hFile=0x238, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0125.017] SetFilePointerEx (in: hFile=0x238, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0125.017] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01242_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01242_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x240 [0125.017] GetLastError () returned 0x0 [0125.017] ReadFile (in: hFile=0x238, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x1cac, lpOverlapped=0x0) returned 1 [0125.022] WriteFile (in: hFile=0x240, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0x1cb0, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0x1cb0, lpOverlapped=0x0) returned 1 [0125.023] ReadFile (in: hFile=0x238, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x0, lpOverlapped=0x0) returned 1 [0125.023] WriteFile (in: hFile=0x240, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0xec, lpOverlapped=0x0) returned 1 [0125.023] SetEndOfFile (hFile=0x240) returned 1 [0125.023] CloseHandle (hObject=0x240) returned 1 [0125.023] SetFilePointerEx (in: hFile=0x238, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0125.023] SetEndOfFile (hFile=0x238) returned 1 [0125.024] CloseHandle (hObject=0x238) returned 1 [0125.024] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01242_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0125.024] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01242_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01242_.wmf")) returned 1 [0125.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 63 [0125.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 63 [0125.024] lstrlenW (lpString=".doc") returned 4 [0125.024] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0125.024] lstrlenW (lpString=".docx") returned 5 [0125.024] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0125.024] lstrlenW (lpString=".pdf") returned 4 [0125.024] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0125.024] lstrlenW (lpString=".xls") returned 4 [0125.024] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0125.024] lstrlenW (lpString=".xlsx") returned 5 [0125.025] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0125.025] lstrlenW (lpString=".ppt") returned 4 [0125.025] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0125.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 63 [0125.025] lstrlenW (lpString=".zip") returned 4 [0125.025] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0125.025] lstrlenW (lpString=".rar") returned 4 [0125.025] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0125.025] lstrlenW (lpString=".bz2") returned 4 [0125.025] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0125.025] lstrlenW (lpString=".7z") returned 3 [0125.025] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0125.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 63 [0125.025] lstrlenW (lpString=".dbf") returned 4 [0125.025] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0125.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 63 [0125.025] lstrlenW (lpString=".1cd") returned 4 [0125.025] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0125.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 63 [0125.025] lstrlenW (lpString=".jpg") returned 4 [0125.025] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0125.025] SetFilePointerEx (in: hFile=0x238, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0125.025] SetFilePointerEx (in: hFile=0x238, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0125.025] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01618_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01618_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x240 [0125.026] GetLastError () returned 0x0 [0125.026] ReadFile (in: hFile=0x238, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x1c80, lpOverlapped=0x0) returned 1 [0125.071] WriteFile (in: hFile=0x240, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0x1c90, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0x1c90, lpOverlapped=0x0) returned 1 [0125.072] ReadFile (in: hFile=0x238, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x0, lpOverlapped=0x0) returned 1 [0125.072] WriteFile (in: hFile=0x240, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0xec, lpOverlapped=0x0) returned 1 [0125.072] SetEndOfFile (hFile=0x240) returned 1 [0125.072] CloseHandle (hObject=0x240) returned 1 [0125.072] SetFilePointerEx (in: hFile=0x238, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0125.072] SetEndOfFile (hFile=0x238) returned 1 [0125.073] CloseHandle (hObject=0x238) returned 1 [0125.073] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01618_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0125.073] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01618_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01618_.wmf")) returned 1 [0125.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 63 [0125.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 63 [0125.074] lstrlenW (lpString=".doc") returned 4 [0125.074] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0125.074] lstrlenW (lpString=".docx") returned 5 [0125.074] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0125.074] lstrlenW (lpString=".pdf") returned 4 [0125.074] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0125.074] lstrlenW (lpString=".xls") returned 4 [0125.074] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0125.074] lstrlenW (lpString=".xlsx") returned 5 [0125.074] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0125.074] lstrlenW (lpString=".ppt") returned 4 [0125.074] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0125.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 63 [0125.074] lstrlenW (lpString=".zip") returned 4 [0125.074] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0125.074] lstrlenW (lpString=".rar") returned 4 [0125.074] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0125.074] lstrlenW (lpString=".bz2") returned 4 [0125.074] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0125.074] lstrlenW (lpString=".7z") returned 3 [0125.074] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0125.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 63 [0125.074] lstrlenW (lpString=".dbf") returned 4 [0125.074] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0125.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 63 [0125.074] lstrlenW (lpString=".1cd") returned 4 [0125.074] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0125.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 63 [0125.074] lstrlenW (lpString=".jpg") returned 4 [0125.074] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0125.075] SetFilePointerEx (in: hFile=0x238, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0125.075] SetFilePointerEx (in: hFile=0x238, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0125.075] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02166_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02166_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x240 [0125.075] GetLastError () returned 0x0 [0125.075] ReadFile (in: hFile=0x238, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x52c, lpOverlapped=0x0) returned 1 [0125.133] WriteFile (in: hFile=0x240, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0x530, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0x530, lpOverlapped=0x0) returned 1 [0125.134] ReadFile (in: hFile=0x238, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x0, lpOverlapped=0x0) returned 1 [0125.134] WriteFile (in: hFile=0x240, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0xec, lpOverlapped=0x0) returned 1 [0125.134] SetEndOfFile (hFile=0x240) returned 1 [0125.134] CloseHandle (hObject=0x240) returned 1 [0125.134] SetFilePointerEx (in: hFile=0x238, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0125.134] SetEndOfFile (hFile=0x238) returned 1 [0125.135] CloseHandle (hObject=0x238) returned 1 [0125.135] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02166_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0125.135] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02166_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02166_.wmf")) returned 1 [0125.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 63 [0125.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 63 [0125.136] lstrlenW (lpString=".doc") returned 4 [0125.136] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0125.136] lstrlenW (lpString=".docx") returned 5 [0125.136] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0125.136] lstrlenW (lpString=".pdf") returned 4 [0125.136] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0125.136] lstrlenW (lpString=".xls") returned 4 [0125.136] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0125.136] lstrlenW (lpString=".xlsx") returned 5 [0125.136] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0125.136] lstrlenW (lpString=".ppt") returned 4 [0125.136] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0125.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 63 [0125.136] lstrlenW (lpString=".zip") returned 4 [0125.136] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0125.136] lstrlenW (lpString=".rar") returned 4 [0125.136] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0125.136] lstrlenW (lpString=".bz2") returned 4 [0125.136] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0125.136] lstrlenW (lpString=".7z") returned 3 [0125.136] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0125.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 63 [0125.137] lstrlenW (lpString=".dbf") returned 4 [0125.137] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0125.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 63 [0125.137] lstrlenW (lpString=".1cd") returned 4 [0125.137] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0125.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 63 [0125.137] lstrlenW (lpString=".jpg") returned 4 [0125.137] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0125.143] SetFilePointerEx (in: hFile=0x238, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0125.143] SetFilePointerEx (in: hFile=0x238, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0125.143] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02298_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02298_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x240 [0125.144] GetLastError () returned 0x0 [0125.144] ReadFile (in: hFile=0x238, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x15b0, lpOverlapped=0x0) returned 1 [0125.147] WriteFile (in: hFile=0x240, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0x15c0, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0x15c0, lpOverlapped=0x0) returned 1 [0125.147] ReadFile (in: hFile=0x238, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x0, lpOverlapped=0x0) returned 1 [0125.147] WriteFile (in: hFile=0x240, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0xec, lpOverlapped=0x0) returned 1 [0125.147] SetEndOfFile (hFile=0x240) returned 1 [0125.148] CloseHandle (hObject=0x240) returned 1 [0125.148] SetFilePointerEx (in: hFile=0x238, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0125.148] SetEndOfFile (hFile=0x238) returned 1 [0125.148] CloseHandle (hObject=0x238) returned 1 [0125.148] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02298_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0125.148] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02298_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02298_.wmf")) returned 1 [0125.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 63 [0125.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 63 [0125.149] lstrlenW (lpString=".doc") returned 4 [0125.149] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0125.149] lstrlenW (lpString=".docx") returned 5 [0125.149] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0125.149] lstrlenW (lpString=".pdf") returned 4 [0125.149] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0125.149] lstrlenW (lpString=".xls") returned 4 [0125.149] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0125.149] lstrlenW (lpString=".xlsx") returned 5 [0125.149] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0125.149] lstrlenW (lpString=".ppt") returned 4 [0125.149] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0125.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 63 [0125.149] lstrlenW (lpString=".zip") returned 4 [0125.149] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0125.149] lstrlenW (lpString=".rar") returned 4 [0125.149] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0125.149] lstrlenW (lpString=".bz2") returned 4 [0125.149] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0125.149] lstrlenW (lpString=".7z") returned 3 [0125.149] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0125.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 63 [0125.149] lstrlenW (lpString=".dbf") returned 4 [0125.149] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0125.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 63 [0125.149] lstrlenW (lpString=".1cd") returned 4 [0125.149] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0125.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 63 [0125.149] lstrlenW (lpString=".jpg") returned 4 [0125.149] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0125.150] SetFilePointerEx (in: hFile=0x238, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0125.150] SetFilePointerEx (in: hFile=0x238, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0125.150] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02313_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02313_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x240 [0125.150] GetLastError () returned 0x0 [0125.150] ReadFile (in: hFile=0x238, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0xc0a, lpOverlapped=0x0) returned 1 [0125.152] WriteFile (in: hFile=0x240, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0xc10, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0xc10, lpOverlapped=0x0) returned 1 [0125.153] ReadFile (in: hFile=0x238, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x0, lpOverlapped=0x0) returned 1 [0125.153] WriteFile (in: hFile=0x240, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0xec, lpOverlapped=0x0) returned 1 [0125.153] SetEndOfFile (hFile=0x240) returned 1 [0125.153] CloseHandle (hObject=0x240) returned 1 [0125.153] SetFilePointerEx (in: hFile=0x238, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0125.154] SetEndOfFile (hFile=0x238) returned 1 [0125.154] CloseHandle (hObject=0x238) returned 1 [0125.154] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02313_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0125.154] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02313_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02313_.wmf")) returned 1 [0125.155] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 63 [0125.155] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 63 [0125.155] lstrlenW (lpString=".doc") returned 4 [0125.155] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0125.155] lstrlenW (lpString=".docx") returned 5 [0125.155] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0125.155] lstrlenW (lpString=".pdf") returned 4 [0125.155] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0125.155] lstrlenW (lpString=".xls") returned 4 [0125.155] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0125.155] lstrlenW (lpString=".xlsx") returned 5 [0125.155] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0125.155] lstrlenW (lpString=".ppt") returned 4 [0125.155] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0125.155] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 63 [0125.155] lstrlenW (lpString=".zip") returned 4 [0125.155] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0125.155] lstrlenW (lpString=".rar") returned 4 [0125.155] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0125.155] lstrlenW (lpString=".bz2") returned 4 [0125.155] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0125.155] lstrlenW (lpString=".7z") returned 3 [0125.155] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0125.155] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 63 [0125.155] lstrlenW (lpString=".dbf") returned 4 [0125.155] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0125.155] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 63 [0125.155] lstrlenW (lpString=".1cd") returned 4 [0125.155] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0125.155] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 63 [0125.155] lstrlenW (lpString=".jpg") returned 4 [0125.155] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0125.157] SetFilePointerEx (in: hFile=0x238, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0125.157] SetFilePointerEx (in: hFile=0x238, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0125.157] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00005_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00005_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x240 [0125.157] GetLastError () returned 0x0 [0125.157] ReadFile (in: hFile=0x238, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x5b04, lpOverlapped=0x0) returned 1 [0125.328] WriteFile (in: hFile=0x240, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0x5b10, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0x5b10, lpOverlapped=0x0) returned 1 [0125.328] ReadFile (in: hFile=0x238, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x0, lpOverlapped=0x0) returned 1 [0125.329] WriteFile (in: hFile=0x240, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0xec, lpOverlapped=0x0) returned 1 [0125.329] SetEndOfFile (hFile=0x240) returned 1 [0125.410] CloseHandle (hObject=0x240) returned 1 [0125.410] SetFilePointerEx (in: hFile=0x238, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0125.410] SetEndOfFile (hFile=0x238) returned 1 [0125.411] CloseHandle (hObject=0x238) returned 1 [0125.411] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00005_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0125.411] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00005_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00005_.wmf")) returned 1 [0125.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00005_.WMF") returned 63 [0125.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00005_.WMF") returned 63 [0125.411] lstrlenW (lpString=".doc") returned 4 [0125.411] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0125.411] lstrlenW (lpString=".docx") returned 5 [0125.411] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0125.411] lstrlenW (lpString=".pdf") returned 4 [0125.411] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0125.411] lstrlenW (lpString=".xls") returned 4 [0125.411] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0125.411] lstrlenW (lpString=".xlsx") returned 5 [0125.411] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0125.411] lstrlenW (lpString=".ppt") returned 4 [0125.411] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0125.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00005_.WMF") returned 63 [0125.411] lstrlenW (lpString=".zip") returned 4 [0125.411] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0125.411] lstrlenW (lpString=".rar") returned 4 [0125.412] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0125.412] lstrlenW (lpString=".bz2") returned 4 [0125.412] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0125.412] lstrlenW (lpString=".7z") returned 3 [0125.412] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0125.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00005_.WMF") returned 63 [0125.412] lstrlenW (lpString=".dbf") returned 4 [0125.412] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0125.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00005_.WMF") returned 63 [0125.412] lstrlenW (lpString=".1cd") returned 4 [0125.412] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0125.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00005_.WMF") returned 63 [0125.412] lstrlenW (lpString=".jpg") returned 4 [0125.412] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0125.435] SetFilePointerEx (in: hFile=0x238, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0125.435] SetFilePointerEx (in: hFile=0x238, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0125.435] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00046_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00046_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x240 [0125.435] GetLastError () returned 0x0 [0125.435] ReadFile (in: hFile=0x238, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x486, lpOverlapped=0x0) returned 1 [0125.809] WriteFile (in: hFile=0x240, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0x490, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0x490, lpOverlapped=0x0) returned 1 [0125.811] ReadFile (in: hFile=0x238, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x0, lpOverlapped=0x0) returned 1 [0125.811] WriteFile (in: hFile=0x240, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0xec, lpOverlapped=0x0) returned 1 [0125.811] SetEndOfFile (hFile=0x240) returned 1 [0126.022] CloseHandle (hObject=0x240) returned 1 [0126.022] SetFilePointerEx (in: hFile=0x238, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0126.023] SetEndOfFile (hFile=0x238) returned 1 [0126.023] CloseHandle (hObject=0x238) returned 1 [0126.023] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00046_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0126.024] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00046_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00046_.wmf")) returned 1 [0126.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 63 [0126.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 63 [0126.024] lstrlenW (lpString=".doc") returned 4 [0126.024] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0126.024] lstrlenW (lpString=".docx") returned 5 [0126.024] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0126.024] lstrlenW (lpString=".pdf") returned 4 [0126.024] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0126.024] lstrlenW (lpString=".xls") returned 4 [0126.024] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0126.024] lstrlenW (lpString=".xlsx") returned 5 [0126.024] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0126.024] lstrlenW (lpString=".ppt") returned 4 [0126.024] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0126.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 63 [0126.024] lstrlenW (lpString=".zip") returned 4 [0126.024] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0126.024] lstrlenW (lpString=".rar") returned 4 [0126.024] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0126.024] lstrlenW (lpString=".bz2") returned 4 [0126.024] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0126.024] lstrlenW (lpString=".7z") returned 3 [0126.024] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0126.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 63 [0126.025] lstrlenW (lpString=".dbf") returned 4 [0126.025] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0126.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 63 [0126.025] lstrlenW (lpString=".1cd") returned 4 [0126.025] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0126.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 63 [0126.025] lstrlenW (lpString=".jpg") returned 4 [0126.025] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0126.025] SetFilePointerEx (in: hFile=0x238, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0126.025] SetFilePointerEx (in: hFile=0x238, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0126.025] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00346_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00346_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x240 [0126.026] GetLastError () returned 0x0 [0126.026] ReadFile (in: hFile=0x238, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x2b8, lpOverlapped=0x0) returned 1 [0126.026] WriteFile (in: hFile=0x240, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0x2c0, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0x2c0, lpOverlapped=0x0) returned 1 [0126.027] ReadFile (in: hFile=0x238, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x0, lpOverlapped=0x0) returned 1 [0126.027] WriteFile (in: hFile=0x240, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0xec, lpOverlapped=0x0) returned 1 [0126.027] SetEndOfFile (hFile=0x240) returned 1 [0126.027] CloseHandle (hObject=0x240) returned 1 [0126.027] SetFilePointerEx (in: hFile=0x238, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0126.027] SetEndOfFile (hFile=0x238) returned 1 [0126.028] CloseHandle (hObject=0x238) returned 1 [0126.028] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00346_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0126.028] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00346_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00346_.wmf")) returned 1 [0126.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00346_.WMF") returned 63 [0126.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00346_.WMF") returned 63 [0126.029] lstrlenW (lpString=".doc") returned 4 [0126.040] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0126.040] lstrlenW (lpString=".docx") returned 5 [0126.040] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0126.040] lstrlenW (lpString=".pdf") returned 4 [0126.040] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0126.040] lstrlenW (lpString=".xls") returned 4 [0126.040] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0126.040] lstrlenW (lpString=".xlsx") returned 5 [0126.040] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0126.040] lstrlenW (lpString=".ppt") returned 4 [0126.040] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0126.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00346_.WMF") returned 63 [0126.040] lstrlenW (lpString=".zip") returned 4 [0126.040] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0126.040] lstrlenW (lpString=".rar") returned 4 [0126.040] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0126.040] lstrlenW (lpString=".bz2") returned 4 [0126.040] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0126.040] lstrlenW (lpString=".7z") returned 3 [0126.040] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0126.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00346_.WMF") returned 63 [0126.040] lstrlenW (lpString=".dbf") returned 4 [0126.040] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0126.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00346_.WMF") returned 63 [0126.041] lstrlenW (lpString=".1cd") returned 4 [0126.041] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0126.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00346_.WMF") returned 63 [0126.041] lstrlenW (lpString=".jpg") returned 4 [0126.041] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0126.041] SetFilePointerEx (in: hFile=0x238, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0126.041] SetFilePointerEx (in: hFile=0x238, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0126.041] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00557_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00557_.wmf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x240 [0126.042] GetLastError () returned 0x0 [0126.042] ReadFile (in: hFile=0x238, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x23d4, lpOverlapped=0x0) returned 1 [0126.187] WriteFile (in: hFile=0x240, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0x23e0, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0x23e0, lpOverlapped=0x0) returned 1 [0126.188] ReadFile (in: hFile=0x238, lpBuffer=0x4230020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x37cfd94, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesRead=0x37cfd94*=0x0, lpOverlapped=0x0) returned 1 [0126.188] WriteFile (in: hFile=0x240, lpBuffer=0x4230020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x37cfb5c, lpOverlapped=0x0 | out: lpBuffer=0x4230020*, lpNumberOfBytesWritten=0x37cfb5c*=0xec, lpOverlapped=0x0) returned 1 [0126.188] SetEndOfFile (hFile=0x240) returned 1 [0126.617] CloseHandle (hObject=0x240) returned 1 [0126.617] SetFilePointerEx (in: hFile=0x238, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37cfd88 | out: lpNewFilePointer=0x0) returned 1 [0126.617] SetEndOfFile (hFile=0x238) returned 1 [0126.618] CloseHandle (hObject=0x238) returned 1 [0126.618] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00557_.WMF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0126.618] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00557_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00557_.wmf")) Thread: id = 33 os_tid = 0xbb4 [0102.643] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x757c0000 [0102.643] GetProcAddress (hModule=0x757c0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x757ed650 [0102.643] Wow64DisableWow64FsRedirection (in: OldValue=0x391fc68 | out: OldValue=0x391fc68*=0x0) returned 1 [0102.643] lstrlenW (lpString="kernel32.dll") returned 12 [0102.643] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0102.643] Sleep (dwMilliseconds=0x64) [0102.881] lstrcmpiW (lpString1=".ttf", lpString2=".waifu") returned -1 [0102.881] lstrlenW (lpString="wgl4_boot.ttf") returned 13 [0102.881] CreateFileW (lpFileName="C:\\Boot\\Fonts\\wgl4_boot.ttf" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0103.056] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x391fc2c | out: lpFileSize=0x391fc2c*=47452) returned 1 [0103.057] CloseHandle (hObject=0x190) returned 1 [0103.057] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\wgl4_boot.ttf" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf")) returned 0x20 [0103.057] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\wgl4_boot.ttf.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0103.057] CreateFileW (lpFileName="C:\\Boot\\Fonts\\wgl4_boot.ttf" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0103.057] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0103.057] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0103.057] lstrlenW (lpString=".doc") returned 4 [0103.057] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0103.057] lstrlenW (lpString=".docx") returned 5 [0103.057] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0103.057] lstrlenW (lpString=".pdf") returned 4 [0103.057] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0103.057] lstrlenW (lpString=".xls") returned 4 [0103.057] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0103.057] lstrlenW (lpString=".xlsx") returned 5 [0103.057] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0103.057] lstrlenW (lpString=".ppt") returned 4 [0103.057] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0103.057] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0103.057] lstrlenW (lpString=".zip") returned 4 [0103.057] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0103.057] lstrlenW (lpString=".rar") returned 4 [0103.057] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0103.057] lstrlenW (lpString=".bz2") returned 4 [0103.057] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0103.057] lstrlenW (lpString=".7z") returned 3 [0103.057] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0103.057] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0103.057] lstrlenW (lpString=".dbf") returned 4 [0103.057] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0103.057] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0103.057] lstrlenW (lpString=".1cd") returned 4 [0103.057] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0103.057] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0103.057] lstrlenW (lpString=".jpg") returned 4 [0103.057] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0103.057] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0103.057] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0103.057] lstrlenW (lpString=".doc") returned 4 [0103.058] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0103.058] lstrlenW (lpString=".docx") returned 5 [0103.058] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0103.058] lstrlenW (lpString=".pdf") returned 4 [0103.058] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0103.058] lstrlenW (lpString=".xls") returned 4 [0103.058] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0103.058] lstrlenW (lpString=".xlsx") returned 5 [0103.058] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0103.058] lstrlenW (lpString=".ppt") returned 4 [0103.058] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0103.058] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0103.058] lstrlenW (lpString=".zip") returned 4 [0103.058] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0103.058] lstrlenW (lpString=".rar") returned 4 [0103.058] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0103.058] lstrlenW (lpString=".bz2") returned 4 [0103.058] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0103.058] lstrlenW (lpString=".7z") returned 3 [0103.058] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0103.058] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0103.058] lstrlenW (lpString=".dbf") returned 4 [0103.058] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0103.058] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0103.058] lstrlenW (lpString=".1cd") returned 4 [0103.058] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0103.058] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0103.058] lstrlenW (lpString=".jpg") returned 4 [0103.058] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0103.058] lstrcmpiW (lpString1=".msi", lpString2=".waifu") returned -1 [0103.058] lstrlenW (lpString="ExcelMUI.msi") returned 12 [0103.058] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0103.058] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x391fc2c | out: lpFileSize=0x391fc2c*=2506240) returned 1 [0103.058] CloseHandle (hObject=0x190) returned 1 [0103.058] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.msi")) returned 0x2020 [0103.059] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.msi.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0103.059] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.msi.id-9c354b42.[darknes@420blaze.it].waifu")) returned 1 [0103.059] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.msi.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0103.059] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391f97c | out: lpNewFilePointer=0x0) returned 1 [0103.059] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391f93c | out: lpNewFilePointer=0x0) returned 1 [0103.059] ReadFile (in: hFile=0x190, lpBuffer=0x4340058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x391f948, lpOverlapped=0x0 | out: lpBuffer=0x4340058*, lpNumberOfBytesRead=0x391f948*=0x40000, lpOverlapped=0x0) returned 1 [0103.063] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0xcbf55, lpNewFilePointer=0x0, dwMoveMethod=0x391f93c | out: lpNewFilePointer=0x0) returned 1 [0103.063] ReadFile (in: hFile=0x190, lpBuffer=0x4380058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x391f948, lpOverlapped=0x0 | out: lpBuffer=0x4380058*, lpNumberOfBytesRead=0x391f948*=0x40000, lpOverlapped=0x0) returned 1 [0103.067] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x391f97c | out: lpNewFilePointer=0xffffffff) returned 1 [0103.067] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x223e00, lpNewFilePointer=0x0, dwMoveMethod=0x391f93c | out: lpNewFilePointer=0x0) returned 1 [0103.067] ReadFile (in: hFile=0x190, lpBuffer=0x43c0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x391f948, lpOverlapped=0x0 | out: lpBuffer=0x43c0058*, lpNumberOfBytesRead=0x391f948*=0x40000, lpOverlapped=0x0) returned 1 [0103.080] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fbd8 | out: lpNewFilePointer=0x0) returned 1 [0103.081] WriteFile (in: hFile=0x190, lpBuffer=0x4340020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x391f9c0, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesWritten=0x391f9c0*=0xc0104, lpOverlapped=0x0) returned 1 [0103.092] SetEndOfFile (hFile=0x190) returned 1 [0103.094] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391f98c | out: lpNewFilePointer=0x0) returned 1 [0103.094] WriteFile (in: hFile=0x190, lpBuffer=0x44e40a8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x391f998, lpOverlapped=0x0 | out: lpBuffer=0x44e40a8*, lpNumberOfBytesWritten=0x391f998*=0x40000, lpOverlapped=0x0) returned 1 [0103.095] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0xcbf55, lpNewFilePointer=0x0, dwMoveMethod=0x391f98c | out: lpNewFilePointer=0x0) returned 1 [0103.095] WriteFile (in: hFile=0x190, lpBuffer=0x44e40a8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x391f998, lpOverlapped=0x0 | out: lpBuffer=0x44e40a8*, lpNumberOfBytesWritten=0x391f998*=0x40000, lpOverlapped=0x0) returned 1 [0103.097] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x223e00, lpNewFilePointer=0x0, dwMoveMethod=0x391f98c | out: lpNewFilePointer=0x0) returned 1 [0103.097] WriteFile (in: hFile=0x190, lpBuffer=0x44e40a8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x391f998, lpOverlapped=0x0 | out: lpBuffer=0x44e40a8*, lpNumberOfBytesWritten=0x391f998*=0x40000, lpOverlapped=0x0) returned 1 [0103.099] CloseHandle (hObject=0x190) returned 1 [0103.655] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x2020) returned 1 [0103.655] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0103.655] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0103.655] lstrlenW (lpString=".doc") returned 4 [0103.655] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0103.655] lstrlenW (lpString=".docx") returned 5 [0103.655] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0103.655] lstrlenW (lpString=".pdf") returned 4 [0103.655] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0103.655] lstrlenW (lpString=".xls") returned 4 [0103.655] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0103.655] lstrlenW (lpString=".xlsx") returned 5 [0103.655] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0103.655] lstrlenW (lpString=".ppt") returned 4 [0103.655] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0103.655] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0103.655] lstrlenW (lpString=".zip") returned 4 [0103.655] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0103.655] lstrlenW (lpString=".rar") returned 4 [0103.655] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0103.655] lstrlenW (lpString=".bz2") returned 4 [0103.655] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0103.655] lstrlenW (lpString=".7z") returned 3 [0103.655] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0103.655] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0103.655] lstrlenW (lpString=".dbf") returned 4 [0103.655] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0103.655] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0103.655] lstrlenW (lpString=".1cd") returned 4 [0103.656] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0103.656] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0103.656] lstrlenW (lpString=".jpg") returned 4 [0103.656] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0103.656] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0103.656] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0103.656] lstrlenW (lpString=".doc") returned 4 [0103.656] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0103.656] lstrlenW (lpString=".docx") returned 5 [0103.656] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0103.656] lstrlenW (lpString=".pdf") returned 4 [0103.656] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0103.656] lstrlenW (lpString=".xls") returned 4 [0103.656] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0103.656] lstrlenW (lpString=".xlsx") returned 5 [0103.656] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0103.656] lstrlenW (lpString=".ppt") returned 4 [0103.656] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0103.656] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0103.656] lstrlenW (lpString=".zip") returned 4 [0103.656] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0103.656] lstrlenW (lpString=".rar") returned 4 [0103.656] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0103.656] lstrlenW (lpString=".bz2") returned 4 [0103.656] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0103.656] lstrlenW (lpString=".7z") returned 3 [0103.656] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0103.656] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0103.656] lstrlenW (lpString=".dbf") returned 4 [0103.656] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0103.656] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0103.656] lstrlenW (lpString=".1cd") returned 4 [0103.656] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0103.656] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0103.656] lstrlenW (lpString=".jpg") returned 4 [0103.656] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0103.656] lstrcmpiW (lpString1=".msi", lpString2=".waifu") returned -1 [0103.656] lstrlenW (lpString="PublisherMUI.msi") returned 16 [0103.657] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0103.657] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x391fc2c | out: lpFileSize=0x391fc2c*=2513920) returned 1 [0103.657] CloseHandle (hObject=0x190) returned 1 [0103.657] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.msi")) returned 0x2020 [0103.657] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.msi.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0103.657] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.msi.id-9c354b42.[darknes@420blaze.it].waifu")) returned 1 [0103.657] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.msi.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0103.657] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391f97c | out: lpNewFilePointer=0x0) returned 1 [0103.657] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391f93c | out: lpNewFilePointer=0x0) returned 1 [0103.657] ReadFile (in: hFile=0x190, lpBuffer=0x4340058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x391f948, lpOverlapped=0x0 | out: lpBuffer=0x4340058*, lpNumberOfBytesRead=0x391f948*=0x40000, lpOverlapped=0x0) returned 1 [0103.660] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0xcc955, lpNewFilePointer=0x0, dwMoveMethod=0x391f93c | out: lpNewFilePointer=0x0) returned 1 [0103.660] ReadFile (in: hFile=0x190, lpBuffer=0x4380058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x391f948, lpOverlapped=0x0 | out: lpBuffer=0x4380058*, lpNumberOfBytesRead=0x391f948*=0x40000, lpOverlapped=0x0) returned 1 [0103.664] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x391f97c | out: lpNewFilePointer=0xffffffff) returned 1 [0103.664] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x225c00, lpNewFilePointer=0x0, dwMoveMethod=0x391f93c | out: lpNewFilePointer=0x0) returned 1 [0103.664] ReadFile (in: hFile=0x190, lpBuffer=0x43c0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x391f948, lpOverlapped=0x0 | out: lpBuffer=0x43c0058*, lpNumberOfBytesRead=0x391f948*=0x40000, lpOverlapped=0x0) returned 1 [0103.676] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fbd8 | out: lpNewFilePointer=0x0) returned 1 [0103.676] WriteFile (in: hFile=0x190, lpBuffer=0x4340020*, nNumberOfBytesToWrite=0xc010c, lpNumberOfBytesWritten=0x391f9c0, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesWritten=0x391f9c0*=0xc010c, lpOverlapped=0x0) returned 1 [0104.211] SetEndOfFile (hFile=0x190) returned 1 [0104.215] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391f98c | out: lpNewFilePointer=0x0) returned 1 [0104.215] WriteFile (in: hFile=0x190, lpBuffer=0x4472060*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x391f998, lpOverlapped=0x0 | out: lpBuffer=0x4472060*, lpNumberOfBytesWritten=0x391f998*=0x40000, lpOverlapped=0x0) returned 1 [0104.216] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0xcc955, lpNewFilePointer=0x0, dwMoveMethod=0x391f98c | out: lpNewFilePointer=0x0) returned 1 [0104.216] WriteFile (in: hFile=0x190, lpBuffer=0x4472060*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x391f998, lpOverlapped=0x0 | out: lpBuffer=0x4472060*, lpNumberOfBytesWritten=0x391f998*=0x40000, lpOverlapped=0x0) returned 1 [0104.223] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x225c00, lpNewFilePointer=0x0, dwMoveMethod=0x391f98c | out: lpNewFilePointer=0x0) returned 1 [0104.223] WriteFile (in: hFile=0x190, lpBuffer=0x4472060*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x391f998, lpOverlapped=0x0 | out: lpBuffer=0x4472060*, lpNumberOfBytesWritten=0x391f998*=0x40000, lpOverlapped=0x0) returned 1 [0104.241] CloseHandle (hObject=0x190) returned 1 [0104.515] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x2020) returned 1 [0104.515] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0104.515] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0104.515] lstrlenW (lpString=".doc") returned 4 [0104.515] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0104.515] lstrlenW (lpString=".docx") returned 5 [0104.515] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0104.516] lstrlenW (lpString=".pdf") returned 4 [0104.516] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0104.516] lstrlenW (lpString=".xls") returned 4 [0104.516] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0104.516] lstrlenW (lpString=".xlsx") returned 5 [0104.516] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0104.516] lstrlenW (lpString=".ppt") returned 4 [0104.516] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0104.516] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0104.516] lstrlenW (lpString=".zip") returned 4 [0104.516] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0104.516] lstrlenW (lpString=".rar") returned 4 [0104.516] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0104.516] lstrlenW (lpString=".bz2") returned 4 [0104.516] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0104.516] lstrlenW (lpString=".7z") returned 3 [0104.516] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0104.516] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0104.516] lstrlenW (lpString=".dbf") returned 4 [0104.516] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0104.516] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0104.516] lstrlenW (lpString=".1cd") returned 4 [0104.516] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0104.516] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0104.516] lstrlenW (lpString=".jpg") returned 4 [0104.516] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0104.516] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0104.516] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0104.516] lstrlenW (lpString=".doc") returned 4 [0104.516] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0104.516] lstrlenW (lpString=".docx") returned 5 [0104.516] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0104.516] lstrlenW (lpString=".pdf") returned 4 [0104.516] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0104.516] lstrlenW (lpString=".xls") returned 4 [0104.516] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0104.516] lstrlenW (lpString=".xlsx") returned 5 [0104.516] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0104.516] lstrlenW (lpString=".ppt") returned 4 [0104.517] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0104.517] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0104.517] lstrlenW (lpString=".zip") returned 4 [0104.517] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0104.517] lstrlenW (lpString=".rar") returned 4 [0104.517] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0104.517] lstrlenW (lpString=".bz2") returned 4 [0104.517] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0104.517] lstrlenW (lpString=".7z") returned 3 [0104.517] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0104.517] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0104.517] lstrlenW (lpString=".dbf") returned 4 [0104.517] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0104.517] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0104.517] lstrlenW (lpString=".1cd") returned 4 [0104.517] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0104.517] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0104.517] lstrlenW (lpString=".jpg") returned 4 [0104.517] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0104.517] lstrcmpiW (lpString1=".cab", lpString2=".waifu") returned -1 [0104.517] lstrlenW (lpString="OutlkLR.cab") returned 11 [0104.517] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlklr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0104.517] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x391fc2c | out: lpFileSize=0x391fc2c*=14819276) returned 1 [0104.517] CloseHandle (hObject=0x190) returned 1 [0104.517] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlklr.cab")) returned 0x2020 [0104.517] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlklr.cab.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0104.517] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlklr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlklr.cab.id-9c354b42.[darknes@420blaze.it].waifu")) returned 1 [0104.518] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlklr.cab.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0104.518] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391f97c | out: lpNewFilePointer=0x0) returned 1 [0104.518] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391f93c | out: lpNewFilePointer=0x0) returned 1 [0104.518] ReadFile (in: hFile=0x190, lpBuffer=0x4340058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x391f948, lpOverlapped=0x0 | out: lpBuffer=0x4340058*, lpNumberOfBytesRead=0x391f948*=0x40000, lpOverlapped=0x0) returned 1 [0104.677] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x4b5fee, lpNewFilePointer=0x0, dwMoveMethod=0x391f93c | out: lpNewFilePointer=0x0) returned 1 [0104.677] ReadFile (in: hFile=0x190, lpBuffer=0x4380058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x391f948, lpOverlapped=0x0 | out: lpBuffer=0x4380058*, lpNumberOfBytesRead=0x391f948*=0x40000, lpOverlapped=0x0) returned 1 [0104.679] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x391f97c | out: lpNewFilePointer=0xffffffff) returned 1 [0104.679] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0xde1fcc, lpNewFilePointer=0x0, dwMoveMethod=0x391f93c | out: lpNewFilePointer=0x0) returned 1 [0104.679] ReadFile (in: hFile=0x190, lpBuffer=0x43c0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x391f948, lpOverlapped=0x0 | out: lpBuffer=0x43c0058*, lpNumberOfBytesRead=0x391f948*=0x40000, lpOverlapped=0x0) returned 1 [0104.692] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fbd8 | out: lpNewFilePointer=0x0) returned 1 [0104.692] WriteFile (in: hFile=0x190, lpBuffer=0x4340020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x391f9c0, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesWritten=0x391f9c0*=0xc0102, lpOverlapped=0x0) returned 1 [0104.698] SetEndOfFile (hFile=0x190) returned 1 [0104.698] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391f98c | out: lpNewFilePointer=0x0) returned 1 [0104.698] WriteFile (in: hFile=0x190, lpBuffer=0x45250c0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x391f998, lpOverlapped=0x0 | out: lpBuffer=0x45250c0*, lpNumberOfBytesWritten=0x391f998*=0x40000, lpOverlapped=0x0) returned 1 [0104.699] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x4b5fee, lpNewFilePointer=0x0, dwMoveMethod=0x391f98c | out: lpNewFilePointer=0x0) returned 1 [0104.699] WriteFile (in: hFile=0x190, lpBuffer=0x45250c0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x391f998, lpOverlapped=0x0 | out: lpBuffer=0x45250c0*, lpNumberOfBytesWritten=0x391f998*=0x40000, lpOverlapped=0x0) returned 1 [0104.699] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0xde1fcc, lpNewFilePointer=0x0, dwMoveMethod=0x391f98c | out: lpNewFilePointer=0x0) returned 1 [0104.699] WriteFile (in: hFile=0x190, lpBuffer=0x45250c0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x391f998, lpOverlapped=0x0 | out: lpBuffer=0x45250c0*, lpNumberOfBytesWritten=0x391f998*=0x40000, lpOverlapped=0x0) returned 1 [0104.702] CloseHandle (hObject=0x190) returned 1 [0105.787] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x2020) returned 1 [0105.787] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0105.787] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0105.787] lstrlenW (lpString=".doc") returned 4 [0105.787] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0105.787] lstrlenW (lpString=".docx") returned 5 [0105.787] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0105.787] lstrlenW (lpString=".pdf") returned 4 [0105.787] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0105.787] lstrlenW (lpString=".xls") returned 4 [0105.787] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0105.787] lstrlenW (lpString=".xlsx") returned 5 [0105.787] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0105.787] lstrlenW (lpString=".ppt") returned 4 [0105.787] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0105.787] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0105.787] lstrlenW (lpString=".zip") returned 4 [0105.787] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0105.787] lstrlenW (lpString=".rar") returned 4 [0105.787] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0105.787] lstrlenW (lpString=".bz2") returned 4 [0105.787] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0105.787] lstrlenW (lpString=".7z") returned 3 [0105.787] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0105.787] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0105.787] lstrlenW (lpString=".dbf") returned 4 [0105.787] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0105.787] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0105.787] lstrlenW (lpString=".1cd") returned 4 [0105.787] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0105.787] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0105.787] lstrlenW (lpString=".jpg") returned 4 [0105.787] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0105.787] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0105.787] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0105.787] lstrlenW (lpString=".doc") returned 4 [0105.787] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0105.787] lstrlenW (lpString=".docx") returned 5 [0105.788] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0105.788] lstrlenW (lpString=".pdf") returned 4 [0105.788] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0105.788] lstrlenW (lpString=".xls") returned 4 [0105.788] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0105.788] lstrlenW (lpString=".xlsx") returned 5 [0105.788] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0105.788] lstrlenW (lpString=".ppt") returned 4 [0105.788] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0105.788] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0105.788] lstrlenW (lpString=".zip") returned 4 [0105.788] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0105.788] lstrlenW (lpString=".rar") returned 4 [0105.788] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0105.788] lstrlenW (lpString=".bz2") returned 4 [0105.788] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0105.788] lstrlenW (lpString=".7z") returned 3 [0105.788] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0105.788] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0105.788] lstrlenW (lpString=".dbf") returned 4 [0105.788] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0105.788] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0105.788] lstrlenW (lpString=".1cd") returned 4 [0105.788] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0105.788] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0105.788] lstrlenW (lpString=".jpg") returned 4 [0105.788] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0105.788] lstrcmpiW (lpString1=".msi", lpString2=".waifu") returned -1 [0105.788] lstrlenW (lpString="Proof.msi") returned 9 [0105.788] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0105.788] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x391fc2c | out: lpFileSize=0x391fc2c*=875520) returned 1 [0105.788] CloseHandle (hObject=0x190) returned 1 [0105.788] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.msi")) returned 0x2020 [0105.789] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.msi.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0105.789] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0105.789] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fbd8 | out: lpNewFilePointer=0x0) returned 1 [0105.789] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fbd8 | out: lpNewFilePointer=0x0) returned 1 [0105.789] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.msi.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0105.789] GetLastError () returned 0x0 [0105.789] ReadFile (in: hFile=0x190, lpBuffer=0x4340020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fbe4, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesRead=0x391fbe4*=0xd5c00, lpOverlapped=0x0) returned 1 [0105.803] WriteFile (in: hFile=0x1ac, lpBuffer=0x4340020*, nNumberOfBytesToWrite=0xd5c10, lpNumberOfBytesWritten=0x391f9ac, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesWritten=0x391f9ac*=0xd5c10, lpOverlapped=0x0) returned 1 [0105.810] ReadFile (in: hFile=0x190, lpBuffer=0x4340020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fbe4, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesRead=0x391fbe4*=0x0, lpOverlapped=0x0) returned 1 [0105.810] WriteFile (in: hFile=0x1ac, lpBuffer=0x4340020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x391f9ac, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesWritten=0x391f9ac*=0xe6, lpOverlapped=0x0) returned 1 [0105.810] SetEndOfFile (hFile=0x1ac) returned 1 [0105.810] CloseHandle (hObject=0x1ac) returned 1 [0105.816] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fbd8 | out: lpNewFilePointer=0x0) returned 1 [0105.816] SetEndOfFile (hFile=0x190) returned 1 [0105.818] CloseHandle (hObject=0x190) returned 1 [0105.818] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x2020) returned 1 [0105.819] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.msi")) returned 1 [0105.819] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0105.819] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0105.819] lstrlenW (lpString=".doc") returned 4 [0105.819] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0105.819] lstrlenW (lpString=".docx") returned 5 [0105.819] lstrcmpiW (lpString1=".docx", lpString2="f.msi") returned -1 [0105.819] lstrlenW (lpString=".pdf") returned 4 [0105.819] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0105.819] lstrlenW (lpString=".xls") returned 4 [0105.819] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0105.819] lstrlenW (lpString=".xlsx") returned 5 [0105.819] lstrcmpiW (lpString1=".xlsx", lpString2="f.msi") returned -1 [0105.819] lstrlenW (lpString=".ppt") returned 4 [0105.819] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0105.819] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0105.819] lstrlenW (lpString=".zip") returned 4 [0105.819] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0105.819] lstrlenW (lpString=".rar") returned 4 [0105.819] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0105.819] lstrlenW (lpString=".bz2") returned 4 [0105.819] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0105.819] lstrlenW (lpString=".7z") returned 3 [0105.819] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0105.819] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0105.819] lstrlenW (lpString=".dbf") returned 4 [0105.819] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0105.819] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0105.819] lstrlenW (lpString=".1cd") returned 4 [0105.819] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0105.819] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0105.819] lstrlenW (lpString=".jpg") returned 4 [0105.819] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0105.819] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0105.820] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0105.820] lstrlenW (lpString=".doc") returned 4 [0105.820] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0105.820] lstrlenW (lpString=".docx") returned 5 [0105.820] lstrcmpiW (lpString1=".docx", lpString2="f.msi") returned -1 [0105.820] lstrlenW (lpString=".pdf") returned 4 [0105.820] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0105.820] lstrlenW (lpString=".xls") returned 4 [0105.820] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0105.820] lstrlenW (lpString=".xlsx") returned 5 [0105.820] lstrcmpiW (lpString1=".xlsx", lpString2="f.msi") returned -1 [0105.820] lstrlenW (lpString=".ppt") returned 4 [0105.820] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0105.820] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0105.820] lstrlenW (lpString=".zip") returned 4 [0105.820] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0105.820] lstrlenW (lpString=".rar") returned 4 [0105.820] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0105.820] lstrlenW (lpString=".bz2") returned 4 [0105.820] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0105.820] lstrlenW (lpString=".7z") returned 3 [0105.820] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0105.820] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0105.820] lstrlenW (lpString=".dbf") returned 4 [0105.820] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0105.820] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0105.820] lstrlenW (lpString=".1cd") returned 4 [0105.820] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0105.820] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0105.820] lstrlenW (lpString=".jpg") returned 4 [0105.820] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0105.820] lstrcmpiW (lpString1=".cab", lpString2=".waifu") returned -1 [0105.820] lstrlenW (lpString="Proof.cab") returned 9 [0105.820] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0106.136] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x391fc2c | out: lpFileSize=0x391fc2c*=13642474) returned 1 [0106.137] CloseHandle (hObject=0x1ac) returned 1 [0106.137] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.cab")) returned 0x2020 [0106.137] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.cab.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0106.137] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.cab.id-9c354b42.[darknes@420blaze.it].waifu")) returned 1 [0106.139] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.cab.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0106.139] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391f97c | out: lpNewFilePointer=0x0) returned 1 [0106.140] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391f93c | out: lpNewFilePointer=0x0) returned 1 [0106.140] ReadFile (in: hFile=0x1ac, lpBuffer=0x4340058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x391f948, lpOverlapped=0x0 | out: lpBuffer=0x4340058*, lpNumberOfBytesRead=0x391f948*=0x40000, lpOverlapped=0x0) returned 1 [0106.148] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x4563a3, lpNewFilePointer=0x0, dwMoveMethod=0x391f93c | out: lpNewFilePointer=0x0) returned 1 [0106.148] ReadFile (in: hFile=0x1ac, lpBuffer=0x4380058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x391f948, lpOverlapped=0x0 | out: lpBuffer=0x4380058*, lpNumberOfBytesRead=0x391f948*=0x40000, lpOverlapped=0x0) returned 1 [0106.151] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x391f97c | out: lpNewFilePointer=0xffffffff) returned 1 [0106.151] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0xcc2aea, lpNewFilePointer=0x0, dwMoveMethod=0x391f93c | out: lpNewFilePointer=0x0) returned 1 [0106.151] ReadFile (in: hFile=0x1ac, lpBuffer=0x43c0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x391f948, lpOverlapped=0x0 | out: lpBuffer=0x43c0058*, lpNumberOfBytesRead=0x391f948*=0x40000, lpOverlapped=0x0) returned 1 [0106.164] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fbd8 | out: lpNewFilePointer=0x0) returned 1 [0106.165] WriteFile (in: hFile=0x1ac, lpBuffer=0x4340020*, nNumberOfBytesToWrite=0xc00fe, lpNumberOfBytesWritten=0x391f9c0, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesWritten=0x391f9c0*=0xc00fe, lpOverlapped=0x0) returned 1 [0106.170] SetEndOfFile (hFile=0x1ac) returned 1 [0106.172] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391f98c | out: lpNewFilePointer=0x0) returned 1 [0106.172] WriteFile (in: hFile=0x1ac, lpBuffer=0x45640c0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x391f998, lpOverlapped=0x0 | out: lpBuffer=0x45640c0*, lpNumberOfBytesWritten=0x391f998*=0x40000, lpOverlapped=0x0) returned 1 [0106.173] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x4563a3, lpNewFilePointer=0x0, dwMoveMethod=0x391f98c | out: lpNewFilePointer=0x0) returned 1 [0106.173] WriteFile (in: hFile=0x1ac, lpBuffer=0x45640c0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x391f998, lpOverlapped=0x0 | out: lpBuffer=0x45640c0*, lpNumberOfBytesWritten=0x391f998*=0x40000, lpOverlapped=0x0) returned 1 [0106.173] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0xcc2aea, lpNewFilePointer=0x0, dwMoveMethod=0x391f98c | out: lpNewFilePointer=0x0) returned 1 [0106.173] WriteFile (in: hFile=0x1ac, lpBuffer=0x45640c0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x391f998, lpOverlapped=0x0 | out: lpBuffer=0x45640c0*, lpNumberOfBytesWritten=0x391f998*=0x40000, lpOverlapped=0x0) returned 1 [0106.174] CloseHandle (hObject=0x1ac) returned 1 [0106.754] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x2020) returned 1 [0107.792] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0107.793] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0107.793] lstrlenW (lpString=".doc") returned 4 [0107.793] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0107.793] lstrlenW (lpString=".docx") returned 5 [0107.793] lstrcmpiW (lpString1=".docx", lpString2="f.cab") returned -1 [0107.793] lstrlenW (lpString=".pdf") returned 4 [0107.793] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0107.793] lstrlenW (lpString=".xls") returned 4 [0107.793] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0107.793] lstrlenW (lpString=".xlsx") returned 5 [0107.793] lstrcmpiW (lpString1=".xlsx", lpString2="f.cab") returned -1 [0107.793] lstrlenW (lpString=".ppt") returned 4 [0107.793] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0107.793] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0107.793] lstrlenW (lpString=".zip") returned 4 [0107.793] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0107.793] lstrlenW (lpString=".rar") returned 4 [0107.793] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0107.793] lstrlenW (lpString=".bz2") returned 4 [0107.793] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0107.793] lstrlenW (lpString=".7z") returned 3 [0107.793] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0107.793] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0107.793] lstrlenW (lpString=".dbf") returned 4 [0107.793] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0107.793] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0107.793] lstrlenW (lpString=".1cd") returned 4 [0107.793] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0107.793] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0107.793] lstrlenW (lpString=".jpg") returned 4 [0107.793] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0107.793] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0107.793] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0107.793] lstrlenW (lpString=".doc") returned 4 [0107.793] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0107.793] lstrlenW (lpString=".docx") returned 5 [0107.793] lstrcmpiW (lpString1=".docx", lpString2="f.cab") returned -1 [0107.793] lstrlenW (lpString=".pdf") returned 4 [0107.793] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0107.793] lstrlenW (lpString=".xls") returned 4 [0107.793] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0107.793] lstrlenW (lpString=".xlsx") returned 5 [0107.794] lstrcmpiW (lpString1=".xlsx", lpString2="f.cab") returned -1 [0107.794] lstrlenW (lpString=".ppt") returned 4 [0107.794] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0107.794] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0107.794] lstrlenW (lpString=".zip") returned 4 [0107.794] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0107.794] lstrlenW (lpString=".rar") returned 4 [0107.794] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0107.794] lstrlenW (lpString=".bz2") returned 4 [0107.794] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0107.794] lstrlenW (lpString=".7z") returned 3 [0107.794] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0107.794] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0107.794] lstrlenW (lpString=".dbf") returned 4 [0107.794] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0107.794] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0107.794] lstrlenW (lpString=".1cd") returned 4 [0107.794] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0107.794] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0107.794] lstrlenW (lpString=".jpg") returned 4 [0107.794] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0107.794] lstrcmpiW (lpString1=".cab", lpString2=".waifu") returned -1 [0107.794] lstrlenW (lpString="InfLR.cab") returned 9 [0107.794] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\inflr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0107.794] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x391fc2c | out: lpFileSize=0x391fc2c*=18874884) returned 1 [0107.794] CloseHandle (hObject=0x1a4) returned 1 [0107.794] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\inflr.cab")) returned 0x2020 [0107.794] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\inflr.cab.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0107.794] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\inflr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\inflr.cab.id-9c354b42.[darknes@420blaze.it].waifu")) returned 1 [0107.795] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\inflr.cab.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0107.795] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391f97c | out: lpNewFilePointer=0x0) returned 1 [0107.795] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391f93c | out: lpNewFilePointer=0x0) returned 1 [0107.795] ReadFile (in: hFile=0x1a4, lpBuffer=0x4340058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x391f948, lpOverlapped=0x0 | out: lpBuffer=0x4340058*, lpNumberOfBytesRead=0x391f948*=0x40000, lpOverlapped=0x0) returned 1 [0107.798] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x6000ac, lpNewFilePointer=0x0, dwMoveMethod=0x391f93c | out: lpNewFilePointer=0x0) returned 1 [0107.798] ReadFile (in: hFile=0x1a4, lpBuffer=0x4380058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x391f948, lpOverlapped=0x0 | out: lpBuffer=0x4380058*, lpNumberOfBytesRead=0x391f948*=0x40000, lpOverlapped=0x0) returned 1 [0107.801] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x391f97c | out: lpNewFilePointer=0xffffffff) returned 1 [0107.801] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x11c0204, lpNewFilePointer=0x0, dwMoveMethod=0x391f93c | out: lpNewFilePointer=0x0) returned 1 [0107.801] ReadFile (in: hFile=0x1a4, lpBuffer=0x43c0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x391f948, lpOverlapped=0x0 | out: lpBuffer=0x43c0058*, lpNumberOfBytesRead=0x391f948*=0x40000, lpOverlapped=0x0) returned 1 [0107.856] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fbd8 | out: lpNewFilePointer=0x0) returned 1 [0107.856] WriteFile (in: hFile=0x1a4, lpBuffer=0x4340020*, nNumberOfBytesToWrite=0xc00fe, lpNumberOfBytesWritten=0x391f9c0, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesWritten=0x391f9c0*=0xc00fe, lpOverlapped=0x0) returned 1 [0107.864] SetEndOfFile (hFile=0x1a4) returned 1 [0107.866] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391f98c | out: lpNewFilePointer=0x0) returned 1 [0107.866] WriteFile (in: hFile=0x1a4, lpBuffer=0x45540b8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x391f998, lpOverlapped=0x0 | out: lpBuffer=0x45540b8*, lpNumberOfBytesWritten=0x391f998*=0x40000, lpOverlapped=0x0) returned 1 [0107.867] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x6000ac, lpNewFilePointer=0x0, dwMoveMethod=0x391f98c | out: lpNewFilePointer=0x0) returned 1 [0107.867] WriteFile (in: hFile=0x1a4, lpBuffer=0x45540b8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x391f998, lpOverlapped=0x0 | out: lpBuffer=0x45540b8*, lpNumberOfBytesWritten=0x391f998*=0x40000, lpOverlapped=0x0) returned 1 [0107.868] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x11c0204, lpNewFilePointer=0x0, dwMoveMethod=0x391f98c | out: lpNewFilePointer=0x0) returned 1 [0107.868] WriteFile (in: hFile=0x1a4, lpBuffer=0x45540b8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x391f998, lpOverlapped=0x0 | out: lpBuffer=0x45540b8*, lpNumberOfBytesWritten=0x391f998*=0x40000, lpOverlapped=0x0) returned 1 [0107.869] CloseHandle (hObject=0x1a4) returned 1 [0110.763] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x2020) returned 1 [0110.763] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72 [0110.763] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72 [0110.764] lstrlenW (lpString=".doc") returned 4 [0110.764] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0110.764] lstrlenW (lpString=".docx") returned 5 [0110.764] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0110.764] lstrlenW (lpString=".pdf") returned 4 [0110.764] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0110.764] lstrlenW (lpString=".xls") returned 4 [0110.764] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0110.764] lstrlenW (lpString=".xlsx") returned 5 [0110.764] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0110.764] lstrlenW (lpString=".ppt") returned 4 [0110.764] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0110.764] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72 [0110.764] lstrlenW (lpString=".zip") returned 4 [0110.764] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0110.764] lstrlenW (lpString=".rar") returned 4 [0110.764] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0110.764] lstrlenW (lpString=".bz2") returned 4 [0110.764] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0110.764] lstrlenW (lpString=".7z") returned 3 [0110.764] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0110.764] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72 [0110.764] lstrlenW (lpString=".dbf") returned 4 [0110.765] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0110.765] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72 [0110.765] lstrlenW (lpString=".1cd") returned 4 [0110.765] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0110.765] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72 [0110.765] lstrlenW (lpString=".jpg") returned 4 [0110.765] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0110.765] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72 [0110.765] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72 [0110.765] lstrlenW (lpString=".doc") returned 4 [0110.765] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0110.765] lstrlenW (lpString=".docx") returned 5 [0110.765] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0110.765] lstrlenW (lpString=".pdf") returned 4 [0110.765] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0110.765] lstrlenW (lpString=".xls") returned 4 [0110.765] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0110.765] lstrlenW (lpString=".xlsx") returned 5 [0110.765] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0110.765] lstrlenW (lpString=".ppt") returned 4 [0110.765] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0110.766] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72 [0110.766] lstrlenW (lpString=".zip") returned 4 [0110.766] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0110.766] lstrlenW (lpString=".rar") returned 4 [0110.766] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0110.766] lstrlenW (lpString=".bz2") returned 4 [0110.766] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0110.766] lstrlenW (lpString=".7z") returned 3 [0110.766] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0110.766] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72 [0110.766] lstrlenW (lpString=".dbf") returned 4 [0110.766] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0110.766] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72 [0110.766] lstrlenW (lpString=".1cd") returned 4 [0110.766] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0110.766] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72 [0110.766] lstrlenW (lpString=".jpg") returned 4 [0110.766] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0110.766] lstrcmpiW (lpString1=".msi", lpString2=".waifu") returned -1 [0110.766] lstrlenW (lpString="ProjectMUI.msi") returned 14 [0110.767] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0111.345] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x391fc2c | out: lpFileSize=0x391fc2c*=2511872) returned 1 [0111.345] CloseHandle (hObject=0x1b0) returned 1 [0111.345] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.msi")) returned 0x2020 [0111.345] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.msi.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0111.345] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.msi.id-9c354b42.[darknes@420blaze.it].waifu")) returned 1 [0111.345] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.msi.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0111.345] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391f97c | out: lpNewFilePointer=0x0) returned 1 [0111.345] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391f93c | out: lpNewFilePointer=0x0) returned 1 [0111.345] ReadFile (in: hFile=0x1b0, lpBuffer=0x4340058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x391f948, lpOverlapped=0x0 | out: lpBuffer=0x4340058*, lpNumberOfBytesRead=0x391f948*=0x40000, lpOverlapped=0x0) returned 1 [0111.349] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xcc6aa, lpNewFilePointer=0x0, dwMoveMethod=0x391f93c | out: lpNewFilePointer=0x0) returned 1 [0111.349] ReadFile (in: hFile=0x1b0, lpBuffer=0x4380058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x391f948, lpOverlapped=0x0 | out: lpBuffer=0x4380058*, lpNumberOfBytesRead=0x391f948*=0x40000, lpOverlapped=0x0) returned 1 [0111.353] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x391f97c | out: lpNewFilePointer=0xffffffff) returned 1 [0111.353] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x225400, lpNewFilePointer=0x0, dwMoveMethod=0x391f93c | out: lpNewFilePointer=0x0) returned 1 [0111.353] ReadFile (in: hFile=0x1b0, lpBuffer=0x43c0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x391f948, lpOverlapped=0x0 | out: lpBuffer=0x43c0058*, lpNumberOfBytesRead=0x391f948*=0x40000, lpOverlapped=0x0) returned 1 [0111.367] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fbd8 | out: lpNewFilePointer=0x0) returned 1 [0111.367] WriteFile (in: hFile=0x1b0, lpBuffer=0x4340020*, nNumberOfBytesToWrite=0xc0108, lpNumberOfBytesWritten=0x391f9c0, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesWritten=0x391f9c0*=0xc0108, lpOverlapped=0x0) returned 1 [0111.378] SetEndOfFile (hFile=0x1b0) returned 1 [0111.379] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391f98c | out: lpNewFilePointer=0x0) returned 1 [0111.379] WriteFile (in: hFile=0x1b0, lpBuffer=0x44b2070*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x391f998, lpOverlapped=0x0 | out: lpBuffer=0x44b2070*, lpNumberOfBytesWritten=0x391f998*=0x40000, lpOverlapped=0x0) returned 1 [0111.380] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xcc6aa, lpNewFilePointer=0x0, dwMoveMethod=0x391f98c | out: lpNewFilePointer=0x0) returned 1 [0111.380] WriteFile (in: hFile=0x1b0, lpBuffer=0x44b2070*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x391f998, lpOverlapped=0x0 | out: lpBuffer=0x44b2070*, lpNumberOfBytesWritten=0x391f998*=0x40000, lpOverlapped=0x0) returned 1 [0111.382] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x225400, lpNewFilePointer=0x0, dwMoveMethod=0x391f98c | out: lpNewFilePointer=0x0) returned 1 [0111.382] WriteFile (in: hFile=0x1b0, lpBuffer=0x44b2070*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x391f998, lpOverlapped=0x0 | out: lpBuffer=0x44b2070*, lpNumberOfBytesWritten=0x391f998*=0x40000, lpOverlapped=0x0) returned 1 [0111.384] CloseHandle (hObject=0x1b0) returned 1 [0111.384] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x2020) returned 1 [0111.384] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77 [0111.384] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77 [0111.384] lstrlenW (lpString=".doc") returned 4 [0111.384] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0111.385] lstrlenW (lpString=".docx") returned 5 [0111.385] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0111.385] lstrlenW (lpString=".pdf") returned 4 [0111.385] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0111.385] lstrlenW (lpString=".xls") returned 4 [0111.385] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0111.385] lstrlenW (lpString=".xlsx") returned 5 [0111.385] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0111.385] lstrlenW (lpString=".ppt") returned 4 [0111.385] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0111.385] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77 [0111.385] lstrlenW (lpString=".zip") returned 4 [0111.385] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0111.385] lstrlenW (lpString=".rar") returned 4 [0111.385] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0111.385] lstrlenW (lpString=".bz2") returned 4 [0111.385] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0111.385] lstrlenW (lpString=".7z") returned 3 [0111.385] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0111.385] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77 [0111.385] lstrlenW (lpString=".dbf") returned 4 [0111.385] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0111.385] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77 [0111.385] lstrlenW (lpString=".1cd") returned 4 [0111.385] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0111.385] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77 [0111.385] lstrlenW (lpString=".jpg") returned 4 [0111.385] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0111.385] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77 [0111.385] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77 [0111.385] lstrlenW (lpString=".doc") returned 4 [0111.385] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0111.385] lstrlenW (lpString=".docx") returned 5 [0111.385] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0111.385] lstrlenW (lpString=".pdf") returned 4 [0111.385] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0111.385] lstrlenW (lpString=".xls") returned 4 [0111.385] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0111.385] lstrlenW (lpString=".xlsx") returned 5 [0111.385] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0111.385] lstrlenW (lpString=".ppt") returned 4 [0111.385] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0111.385] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77 [0111.385] lstrlenW (lpString=".zip") returned 4 [0111.385] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0111.385] lstrlenW (lpString=".rar") returned 4 [0111.385] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0111.385] lstrlenW (lpString=".bz2") returned 4 [0111.385] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0111.385] lstrlenW (lpString=".7z") returned 3 [0111.386] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0111.386] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77 [0111.386] lstrlenW (lpString=".dbf") returned 4 [0111.386] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0111.386] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77 [0111.386] lstrlenW (lpString=".1cd") returned 4 [0111.386] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0111.386] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77 [0111.386] lstrlenW (lpString=".jpg") returned 4 [0111.386] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0111.386] lstrcmpiW (lpString1=".dll", lpString2=".waifu") returned -1 [0111.386] lstrlenW (lpString="dwintl20.dll") returned 12 [0111.386] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\1033\\dwintl20.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0111.387] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x391fc2c | out: lpFileSize=0x391fc2c*=107912) returned 1 [0111.387] CloseHandle (hObject=0x1b0) returned 1 [0111.387] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\1033\\dwintl20.dll")) returned 0x2020 [0111.388] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\1033\\dwintl20.dll.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0111.388] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\1033\\dwintl20.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0111.388] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fbd8 | out: lpNewFilePointer=0x0) returned 1 [0111.388] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fbd8 | out: lpNewFilePointer=0x0) returned 1 [0111.388] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\1033\\dwintl20.dll.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0111.389] GetLastError () returned 0x0 [0111.389] ReadFile (in: hFile=0x1b0, lpBuffer=0x4340020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fbe4, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesRead=0x391fbe4*=0x1a588, lpOverlapped=0x0) returned 1 [0111.391] WriteFile (in: hFile=0x1e0, lpBuffer=0x4340020*, nNumberOfBytesToWrite=0x1a590, lpNumberOfBytesWritten=0x391f9ac, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesWritten=0x391f9ac*=0x1a590, lpOverlapped=0x0) returned 1 [0111.392] ReadFile (in: hFile=0x1b0, lpBuffer=0x4340020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fbe4, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesRead=0x391fbe4*=0x0, lpOverlapped=0x0) returned 1 [0111.392] WriteFile (in: hFile=0x1e0, lpBuffer=0x4340020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x391f9ac, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesWritten=0x391f9ac*=0xec, lpOverlapped=0x0) returned 1 [0111.392] SetEndOfFile (hFile=0x1e0) returned 1 [0111.392] CloseHandle (hObject=0x1e0) returned 1 [0111.392] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fbd8 | out: lpNewFilePointer=0x0) returned 1 [0111.393] SetEndOfFile (hFile=0x1b0) returned 1 [0111.393] CloseHandle (hObject=0x1b0) returned 1 [0111.393] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x2020) returned 1 [0111.393] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\1033\\dwintl20.dll")) returned 1 [0111.394] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80 [0111.394] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80 [0111.394] lstrlenW (lpString=".doc") returned 4 [0111.394] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0111.394] lstrlenW (lpString=".docx") returned 5 [0111.394] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0111.394] lstrlenW (lpString=".pdf") returned 4 [0111.394] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0111.394] lstrlenW (lpString=".xls") returned 4 [0111.394] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0111.394] lstrlenW (lpString=".xlsx") returned 5 [0111.394] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0111.394] lstrlenW (lpString=".ppt") returned 4 [0111.394] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0111.394] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80 [0111.394] lstrlenW (lpString=".zip") returned 4 [0111.394] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0111.394] lstrlenW (lpString=".rar") returned 4 [0111.394] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0111.394] lstrlenW (lpString=".bz2") returned 4 [0111.394] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0111.394] lstrlenW (lpString=".7z") returned 3 [0111.394] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0111.394] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80 [0111.394] lstrlenW (lpString=".dbf") returned 4 [0111.394] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0111.394] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80 [0111.394] lstrlenW (lpString=".1cd") returned 4 [0111.394] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0111.394] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80 [0111.394] lstrlenW (lpString=".jpg") returned 4 [0111.394] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0111.394] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80 [0111.394] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80 [0111.394] lstrlenW (lpString=".doc") returned 4 [0111.394] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0111.394] lstrlenW (lpString=".docx") returned 5 [0111.394] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0111.394] lstrlenW (lpString=".pdf") returned 4 [0111.394] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0111.395] lstrlenW (lpString=".xls") returned 4 [0111.395] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0111.395] lstrlenW (lpString=".xlsx") returned 5 [0111.395] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0111.395] lstrlenW (lpString=".ppt") returned 4 [0111.395] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0111.395] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80 [0111.395] lstrlenW (lpString=".zip") returned 4 [0111.395] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0111.395] lstrlenW (lpString=".rar") returned 4 [0111.395] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0111.395] lstrlenW (lpString=".bz2") returned 4 [0111.395] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0111.395] lstrlenW (lpString=".7z") returned 3 [0111.395] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0111.395] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80 [0111.395] lstrlenW (lpString=".dbf") returned 4 [0111.395] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0111.395] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80 [0111.395] lstrlenW (lpString=".1cd") returned 4 [0111.395] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0111.395] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80 [0111.395] lstrlenW (lpString=".jpg") returned 4 [0111.395] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0111.395] lstrcmpiW (lpString1=".EXE", lpString2=".waifu") returned -1 [0111.395] lstrlenW (lpString="DW20.EXE") returned 8 [0111.395] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dw20.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0111.397] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x391fc2c | out: lpFileSize=0x391fc2c*=838536) returned 1 [0111.397] CloseHandle (hObject=0x1b0) returned 1 [0111.397] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dw20.exe")) returned 0x2020 [0111.397] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dw20.exe.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0111.397] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dw20.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0111.397] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fbd8 | out: lpNewFilePointer=0x0) returned 1 [0111.397] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fbd8 | out: lpNewFilePointer=0x0) returned 1 [0111.397] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dw20.exe.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0111.397] GetLastError () returned 0x0 [0111.397] ReadFile (in: hFile=0x1b0, lpBuffer=0x4340020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fbe4, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesRead=0x391fbe4*=0xccb88, lpOverlapped=0x0) returned 1 [0111.411] WriteFile (in: hFile=0x1e0, lpBuffer=0x4340020*, nNumberOfBytesToWrite=0xccb90, lpNumberOfBytesWritten=0x391f9ac, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesWritten=0x391f9ac*=0xccb90, lpOverlapped=0x0) returned 1 [0111.419] ReadFile (in: hFile=0x1b0, lpBuffer=0x4340020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fbe4, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesRead=0x391fbe4*=0x0, lpOverlapped=0x0) returned 1 [0111.419] WriteFile (in: hFile=0x1e0, lpBuffer=0x4340020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x391f9ac, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesWritten=0x391f9ac*=0xe4, lpOverlapped=0x0) returned 1 [0111.419] SetEndOfFile (hFile=0x1e0) returned 1 [0111.419] CloseHandle (hObject=0x1e0) returned 1 [0111.419] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fbd8 | out: lpNewFilePointer=0x0) returned 1 [0111.419] SetEndOfFile (hFile=0x1b0) returned 1 [0111.422] CloseHandle (hObject=0x1b0) returned 1 [0111.422] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x2020) returned 1 [0111.422] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dw20.exe")) returned 1 [0111.422] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71 [0111.422] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71 [0111.422] lstrlenW (lpString=".doc") returned 4 [0111.422] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0111.422] lstrlenW (lpString=".docx") returned 5 [0111.422] lstrcmpiW (lpString1=".docx", lpString2="0.EXE") returned -1 [0111.422] lstrlenW (lpString=".pdf") returned 4 [0111.422] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0111.422] lstrlenW (lpString=".xls") returned 4 [0111.422] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0111.422] lstrlenW (lpString=".xlsx") returned 5 [0111.422] lstrcmpiW (lpString1=".xlsx", lpString2="0.EXE") returned -1 [0111.422] lstrlenW (lpString=".ppt") returned 4 [0111.422] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0111.422] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71 [0111.422] lstrlenW (lpString=".zip") returned 4 [0111.422] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0111.422] lstrlenW (lpString=".rar") returned 4 [0111.422] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0111.423] lstrlenW (lpString=".bz2") returned 4 [0111.423] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0111.423] lstrlenW (lpString=".7z") returned 3 [0111.423] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0111.423] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71 [0111.423] lstrlenW (lpString=".dbf") returned 4 [0111.423] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0111.423] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71 [0111.423] lstrlenW (lpString=".1cd") returned 4 [0111.423] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0111.423] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71 [0111.423] lstrlenW (lpString=".jpg") returned 4 [0111.423] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0111.423] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71 [0111.423] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71 [0111.423] lstrlenW (lpString=".doc") returned 4 [0111.423] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0111.423] lstrlenW (lpString=".docx") returned 5 [0111.423] lstrcmpiW (lpString1=".docx", lpString2="0.EXE") returned -1 [0111.423] lstrlenW (lpString=".pdf") returned 4 [0111.423] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0111.423] lstrlenW (lpString=".xls") returned 4 [0111.423] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0111.423] lstrlenW (lpString=".xlsx") returned 5 [0111.423] lstrcmpiW (lpString1=".xlsx", lpString2="0.EXE") returned -1 [0111.423] lstrlenW (lpString=".ppt") returned 4 [0111.423] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0111.423] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71 [0111.423] lstrlenW (lpString=".zip") returned 4 [0111.423] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0111.423] lstrlenW (lpString=".rar") returned 4 [0111.423] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0111.423] lstrlenW (lpString=".bz2") returned 4 [0111.423] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0111.423] lstrlenW (lpString=".7z") returned 3 [0111.423] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0111.423] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71 [0111.423] lstrlenW (lpString=".dbf") returned 4 [0111.423] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0111.423] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71 [0111.423] lstrlenW (lpString=".1cd") returned 4 [0111.423] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0111.423] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71 [0111.423] lstrlenW (lpString=".jpg") returned 4 [0111.423] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0111.423] lstrcmpiW (lpString1=".dll", lpString2=".waifu") returned -1 [0111.424] lstrlenW (lpString="dwdcw20.dll") returned 11 [0111.424] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwdcw20.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0111.424] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x391fc2c | out: lpFileSize=0x391fc2c*=526176) returned 1 [0111.424] CloseHandle (hObject=0x1b0) returned 1 [0111.424] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwdcw20.dll")) returned 0x2020 [0111.424] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwdcw20.dll.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0111.424] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwdcw20.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0111.424] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fbd8 | out: lpNewFilePointer=0x0) returned 1 [0111.424] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fbd8 | out: lpNewFilePointer=0x0) returned 1 [0111.424] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwdcw20.dll.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0111.425] GetLastError () returned 0x0 [0111.425] ReadFile (in: hFile=0x1b0, lpBuffer=0x4340020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fbe4, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesRead=0x391fbe4*=0x80760, lpOverlapped=0x0) returned 1 [0111.597] WriteFile (in: hFile=0x1e0, lpBuffer=0x4340020*, nNumberOfBytesToWrite=0x80770, lpNumberOfBytesWritten=0x391f9ac, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesWritten=0x391f9ac*=0x80770, lpOverlapped=0x0) returned 1 [0111.602] ReadFile (in: hFile=0x1b0, lpBuffer=0x4340020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fbe4, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesRead=0x391fbe4*=0x0, lpOverlapped=0x0) returned 1 [0111.602] WriteFile (in: hFile=0x1e0, lpBuffer=0x4340020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x391f9ac, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesWritten=0x391f9ac*=0xea, lpOverlapped=0x0) returned 1 [0111.602] SetEndOfFile (hFile=0x1e0) returned 1 [0111.878] CloseHandle (hObject=0x1e0) returned 1 [0111.879] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fbd8 | out: lpNewFilePointer=0x0) returned 1 [0111.879] SetEndOfFile (hFile=0x1b0) returned 1 [0112.105] CloseHandle (hObject=0x1b0) returned 1 [0112.105] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x2020) returned 1 [0112.105] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwdcw20.dll")) returned 1 [0112.105] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74 [0112.105] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74 [0112.105] lstrlenW (lpString=".doc") returned 4 [0112.105] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0112.105] lstrlenW (lpString=".docx") returned 5 [0112.105] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0112.105] lstrlenW (lpString=".pdf") returned 4 [0112.105] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0112.105] lstrlenW (lpString=".xls") returned 4 [0112.105] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0112.105] lstrlenW (lpString=".xlsx") returned 5 [0112.106] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0112.106] lstrlenW (lpString=".ppt") returned 4 [0112.106] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0112.106] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74 [0112.106] lstrlenW (lpString=".zip") returned 4 [0112.106] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0112.106] lstrlenW (lpString=".rar") returned 4 [0112.106] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0112.106] lstrlenW (lpString=".bz2") returned 4 [0112.106] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0112.106] lstrlenW (lpString=".7z") returned 3 [0112.106] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0112.106] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74 [0112.106] lstrlenW (lpString=".dbf") returned 4 [0112.106] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0112.106] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74 [0112.106] lstrlenW (lpString=".1cd") returned 4 [0112.106] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0112.106] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74 [0112.106] lstrlenW (lpString=".jpg") returned 4 [0112.106] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0112.106] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74 [0112.106] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74 [0112.106] lstrlenW (lpString=".doc") returned 4 [0112.106] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0112.106] lstrlenW (lpString=".docx") returned 5 [0112.106] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0112.106] lstrlenW (lpString=".pdf") returned 4 [0112.106] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0112.106] lstrlenW (lpString=".xls") returned 4 [0112.106] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0112.106] lstrlenW (lpString=".xlsx") returned 5 [0112.106] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0112.106] lstrlenW (lpString=".ppt") returned 4 [0112.106] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0112.107] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74 [0112.107] lstrlenW (lpString=".zip") returned 4 [0112.107] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0112.107] lstrlenW (lpString=".rar") returned 4 [0112.107] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0112.107] lstrlenW (lpString=".bz2") returned 4 [0112.107] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0112.107] lstrlenW (lpString=".7z") returned 3 [0112.107] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0112.107] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74 [0112.107] lstrlenW (lpString=".dbf") returned 4 [0112.107] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0112.107] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74 [0112.107] lstrlenW (lpString=".1cd") returned 4 [0112.107] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0112.107] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74 [0112.107] lstrlenW (lpString=".jpg") returned 4 [0112.107] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0112.107] lstrcmpiW (lpString1=".dll", lpString2=".waifu") returned -1 [0112.107] lstrlenW (lpString="osetupui.dll") returned 12 [0112.107] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\osetupui.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0112.108] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x391fc2c | out: lpFileSize=0x391fc2c*=191872) returned 1 [0112.108] CloseHandle (hObject=0x1b0) returned 1 [0112.108] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\osetupui.dll")) returned 0x2020 [0112.108] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\osetupui.dll.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0112.108] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\osetupui.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0112.108] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fbd8 | out: lpNewFilePointer=0x0) returned 1 [0112.108] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fbd8 | out: lpNewFilePointer=0x0) returned 1 [0112.108] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\osetupui.dll.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0112.108] GetLastError () returned 0x0 [0112.108] ReadFile (in: hFile=0x1b0, lpBuffer=0x4340020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fbe4, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesRead=0x391fbe4*=0x2ed80, lpOverlapped=0x0) returned 1 [0112.114] WriteFile (in: hFile=0x1f4, lpBuffer=0x4340020*, nNumberOfBytesToWrite=0x2ed90, lpNumberOfBytesWritten=0x391f9ac, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesWritten=0x391f9ac*=0x2ed90, lpOverlapped=0x0) returned 1 [0112.116] ReadFile (in: hFile=0x1b0, lpBuffer=0x4340020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fbe4, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesRead=0x391fbe4*=0x0, lpOverlapped=0x0) returned 1 [0112.116] WriteFile (in: hFile=0x1f4, lpBuffer=0x4340020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x391f9ac, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesWritten=0x391f9ac*=0xec, lpOverlapped=0x0) returned 1 [0112.117] SetEndOfFile (hFile=0x1f4) returned 1 [0112.117] CloseHandle (hObject=0x1f4) returned 1 [0112.117] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fbd8 | out: lpNewFilePointer=0x0) returned 1 [0112.117] SetEndOfFile (hFile=0x1b0) returned 1 [0112.118] CloseHandle (hObject=0x1b0) returned 1 [0112.118] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x2020) returned 1 [0112.118] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\osetupui.dll")) returned 1 [0112.118] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75 [0112.118] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75 [0112.119] lstrlenW (lpString=".doc") returned 4 [0112.119] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0112.119] lstrlenW (lpString=".docx") returned 5 [0112.119] lstrcmpiW (lpString1=".docx", lpString2="i.dll") returned -1 [0112.119] lstrlenW (lpString=".pdf") returned 4 [0112.119] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0112.119] lstrlenW (lpString=".xls") returned 4 [0112.119] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0112.119] lstrlenW (lpString=".xlsx") returned 5 [0112.119] lstrcmpiW (lpString1=".xlsx", lpString2="i.dll") returned -1 [0112.119] lstrlenW (lpString=".ppt") returned 4 [0112.119] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0112.119] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75 [0112.119] lstrlenW (lpString=".zip") returned 4 [0112.119] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0112.119] lstrlenW (lpString=".rar") returned 4 [0112.119] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0112.119] lstrlenW (lpString=".bz2") returned 4 [0112.119] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0112.119] lstrlenW (lpString=".7z") returned 3 [0112.119] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0112.119] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75 [0112.119] lstrlenW (lpString=".dbf") returned 4 [0112.119] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0112.119] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75 [0112.119] lstrlenW (lpString=".1cd") returned 4 [0112.119] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0112.119] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75 [0112.119] lstrlenW (lpString=".jpg") returned 4 [0112.119] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0112.119] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75 [0112.119] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75 [0112.119] lstrlenW (lpString=".doc") returned 4 [0112.119] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0112.119] lstrlenW (lpString=".docx") returned 5 [0112.119] lstrcmpiW (lpString1=".docx", lpString2="i.dll") returned -1 [0112.119] lstrlenW (lpString=".pdf") returned 4 [0112.119] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0112.120] lstrlenW (lpString=".xls") returned 4 [0112.120] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0112.120] lstrlenW (lpString=".xlsx") returned 5 [0112.120] lstrcmpiW (lpString1=".xlsx", lpString2="i.dll") returned -1 [0112.120] lstrlenW (lpString=".ppt") returned 4 [0112.120] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0112.120] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75 [0112.120] lstrlenW (lpString=".zip") returned 4 [0112.120] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0112.120] lstrlenW (lpString=".rar") returned 4 [0112.120] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0112.120] lstrlenW (lpString=".bz2") returned 4 [0112.120] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0112.120] lstrlenW (lpString=".7z") returned 3 [0112.120] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0112.120] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75 [0112.120] lstrlenW (lpString=".dbf") returned 4 [0112.120] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0112.120] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75 [0112.120] lstrlenW (lpString=".1cd") returned 4 [0112.120] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0112.120] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75 [0112.120] lstrlenW (lpString=".jpg") returned 4 [0112.120] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0112.120] lstrcmpiW (lpString1=".MST", lpString2=".waifu") returned -1 [0112.120] lstrlenW (lpString="ShellUI.MST") returned 11 [0112.120] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\shellui.mst"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0112.121] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x391fc2c | out: lpFileSize=0x391fc2c*=3584) returned 1 [0112.121] CloseHandle (hObject=0x1b0) returned 1 [0112.121] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\shellui.mst")) returned 0x2020 [0112.121] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\shellui.mst.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0112.121] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\shellui.mst"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0112.121] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fbd8 | out: lpNewFilePointer=0x0) returned 1 [0112.121] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fbd8 | out: lpNewFilePointer=0x0) returned 1 [0112.121] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\shellui.mst.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0112.122] GetLastError () returned 0x0 [0112.122] ReadFile (in: hFile=0x1b0, lpBuffer=0x4340020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fbe4, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesRead=0x391fbe4*=0xe00, lpOverlapped=0x0) returned 1 [0112.123] WriteFile (in: hFile=0x1f4, lpBuffer=0x4340020*, nNumberOfBytesToWrite=0xe10, lpNumberOfBytesWritten=0x391f9ac, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesWritten=0x391f9ac*=0xe10, lpOverlapped=0x0) returned 1 [0112.125] ReadFile (in: hFile=0x1b0, lpBuffer=0x4340020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fbe4, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesRead=0x391fbe4*=0x0, lpOverlapped=0x0) returned 1 [0112.125] WriteFile (in: hFile=0x1f4, lpBuffer=0x4340020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x391f9ac, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesWritten=0x391f9ac*=0xea, lpOverlapped=0x0) returned 1 [0112.126] SetEndOfFile (hFile=0x1f4) returned 1 [0112.126] CloseHandle (hObject=0x1f4) returned 1 [0112.126] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fbd8 | out: lpNewFilePointer=0x0) returned 1 [0112.126] SetEndOfFile (hFile=0x1b0) returned 1 [0112.126] CloseHandle (hObject=0x1b0) returned 1 [0112.126] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x2020) returned 1 [0112.127] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\shellui.mst")) returned 1 [0112.127] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74 [0112.127] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74 [0112.127] lstrlenW (lpString=".doc") returned 4 [0112.127] lstrcmpiW (lpString1=".doc", lpString2=".MST") returned -1 [0112.127] lstrlenW (lpString=".docx") returned 5 [0112.127] lstrcmpiW (lpString1=".docx", lpString2="I.MST") returned -1 [0112.127] lstrlenW (lpString=".pdf") returned 4 [0112.127] lstrcmpiW (lpString1=".pdf", lpString2=".MST") returned 1 [0112.127] lstrlenW (lpString=".xls") returned 4 [0112.127] lstrcmpiW (lpString1=".xls", lpString2=".MST") returned 1 [0112.127] lstrlenW (lpString=".xlsx") returned 5 [0112.127] lstrcmpiW (lpString1=".xlsx", lpString2="I.MST") returned -1 [0112.127] lstrlenW (lpString=".ppt") returned 4 [0112.127] lstrcmpiW (lpString1=".ppt", lpString2=".MST") returned 1 [0112.127] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74 [0112.127] lstrlenW (lpString=".zip") returned 4 [0112.127] lstrcmpiW (lpString1=".zip", lpString2=".MST") returned 1 [0112.127] lstrlenW (lpString=".rar") returned 4 [0112.127] lstrcmpiW (lpString1=".rar", lpString2=".MST") returned 1 [0112.127] lstrlenW (lpString=".bz2") returned 4 [0112.127] lstrcmpiW (lpString1=".bz2", lpString2=".MST") returned -1 [0112.127] lstrlenW (lpString=".7z") returned 3 [0112.127] lstrcmpiW (lpString1=".7z", lpString2="MST") returned -1 [0112.127] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74 [0112.127] lstrlenW (lpString=".dbf") returned 4 [0112.127] lstrcmpiW (lpString1=".dbf", lpString2=".MST") returned -1 [0112.127] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74 [0112.127] lstrlenW (lpString=".1cd") returned 4 [0112.127] lstrcmpiW (lpString1=".1cd", lpString2=".MST") returned -1 [0112.127] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74 [0112.128] lstrlenW (lpString=".jpg") returned 4 [0112.128] lstrcmpiW (lpString1=".jpg", lpString2=".MST") returned -1 [0112.128] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74 [0112.128] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74 [0112.128] lstrlenW (lpString=".doc") returned 4 [0112.128] lstrcmpiW (lpString1=".doc", lpString2=".MST") returned -1 [0112.128] lstrlenW (lpString=".docx") returned 5 [0112.128] lstrcmpiW (lpString1=".docx", lpString2="I.MST") returned -1 [0112.128] lstrlenW (lpString=".pdf") returned 4 [0112.128] lstrcmpiW (lpString1=".pdf", lpString2=".MST") returned 1 [0112.128] lstrlenW (lpString=".xls") returned 4 [0112.128] lstrcmpiW (lpString1=".xls", lpString2=".MST") returned 1 [0112.128] lstrlenW (lpString=".xlsx") returned 5 [0112.128] lstrcmpiW (lpString1=".xlsx", lpString2="I.MST") returned -1 [0112.128] lstrlenW (lpString=".ppt") returned 4 [0112.128] lstrcmpiW (lpString1=".ppt", lpString2=".MST") returned 1 [0112.128] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74 [0112.128] lstrlenW (lpString=".zip") returned 4 [0112.128] lstrcmpiW (lpString1=".zip", lpString2=".MST") returned 1 [0112.128] lstrlenW (lpString=".rar") returned 4 [0112.128] lstrcmpiW (lpString1=".rar", lpString2=".MST") returned 1 [0112.128] lstrlenW (lpString=".bz2") returned 4 [0112.128] lstrcmpiW (lpString1=".bz2", lpString2=".MST") returned -1 [0112.128] lstrlenW (lpString=".7z") returned 3 [0112.128] lstrcmpiW (lpString1=".7z", lpString2="MST") returned -1 [0112.128] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74 [0112.128] lstrlenW (lpString=".dbf") returned 4 [0112.128] lstrcmpiW (lpString1=".dbf", lpString2=".MST") returned -1 [0112.128] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74 [0112.128] lstrlenW (lpString=".1cd") returned 4 [0112.128] lstrcmpiW (lpString1=".1cd", lpString2=".MST") returned -1 [0112.128] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74 [0112.128] lstrlenW (lpString=".jpg") returned 4 [0112.128] lstrcmpiW (lpString1=".jpg", lpString2=".MST") returned -1 [0112.128] lstrcmpiW (lpString1=".msi", lpString2=".waifu") returned -1 [0112.128] lstrlenW (lpString="AccessMUI.msi") returned 13 [0112.128] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0112.130] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x391fc2c | out: lpFileSize=0x391fc2c*=2517504) returned 1 [0112.130] CloseHandle (hObject=0x1b0) returned 1 [0112.130] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.msi")) returned 0x2020 [0112.130] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.msi.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0112.130] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.msi.id-9c354b42.[darknes@420blaze.it].waifu")) returned 1 [0112.130] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.msi.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0112.130] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391f97c | out: lpNewFilePointer=0x0) returned 1 [0112.130] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391f93c | out: lpNewFilePointer=0x0) returned 1 [0112.130] ReadFile (in: hFile=0x1b0, lpBuffer=0x4340058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x391f948, lpOverlapped=0x0 | out: lpBuffer=0x4340058*, lpNumberOfBytesRead=0x391f948*=0x40000, lpOverlapped=0x0) returned 1 [0112.135] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xcce00, lpNewFilePointer=0x0, dwMoveMethod=0x391f93c | out: lpNewFilePointer=0x0) returned 1 [0112.135] ReadFile (in: hFile=0x1b0, lpBuffer=0x4380058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x391f948, lpOverlapped=0x0 | out: lpBuffer=0x4380058*, lpNumberOfBytesRead=0x391f948*=0x40000, lpOverlapped=0x0) returned 1 [0112.144] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x391f97c | out: lpNewFilePointer=0xffffffff) returned 1 [0112.144] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x226a00, lpNewFilePointer=0x0, dwMoveMethod=0x391f93c | out: lpNewFilePointer=0x0) returned 1 [0112.144] ReadFile (in: hFile=0x1b0, lpBuffer=0x43c0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x391f948, lpOverlapped=0x0 | out: lpBuffer=0x43c0058*, lpNumberOfBytesRead=0x391f948*=0x40000, lpOverlapped=0x0) returned 1 [0112.309] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fbd8 | out: lpNewFilePointer=0x0) returned 1 [0112.309] WriteFile (in: hFile=0x1b0, lpBuffer=0x4340020*, nNumberOfBytesToWrite=0xc0106, lpNumberOfBytesWritten=0x391f9c0, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesWritten=0x391f9c0*=0xc0106, lpOverlapped=0x0) returned 1 [0112.371] SetEndOfFile (hFile=0x1b0) returned 1 [0112.373] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391f98c | out: lpNewFilePointer=0x0) returned 1 [0112.373] WriteFile (in: hFile=0x1b0, lpBuffer=0x45940d8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x391f998, lpOverlapped=0x0 | out: lpBuffer=0x45940d8*, lpNumberOfBytesWritten=0x391f998*=0x40000, lpOverlapped=0x0) returned 1 [0112.374] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xcce00, lpNewFilePointer=0x0, dwMoveMethod=0x391f98c | out: lpNewFilePointer=0x0) returned 1 [0112.374] WriteFile (in: hFile=0x1b0, lpBuffer=0x45940d8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x391f998, lpOverlapped=0x0 | out: lpBuffer=0x45940d8*, lpNumberOfBytesWritten=0x391f998*=0x40000, lpOverlapped=0x0) returned 1 [0112.376] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x226a00, lpNewFilePointer=0x0, dwMoveMethod=0x391f98c | out: lpNewFilePointer=0x0) returned 1 [0112.376] WriteFile (in: hFile=0x1b0, lpBuffer=0x45940d8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x391f998, lpOverlapped=0x0 | out: lpBuffer=0x45940d8*, lpNumberOfBytesWritten=0x391f998*=0x40000, lpOverlapped=0x0) returned 1 [0112.378] CloseHandle (hObject=0x1b0) returned 1 [0112.379] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x2020) returned 1 [0112.379] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89 [0112.379] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89 [0112.379] lstrlenW (lpString=".doc") returned 4 [0112.379] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0112.379] lstrlenW (lpString=".docx") returned 5 [0112.379] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0112.379] lstrlenW (lpString=".pdf") returned 4 [0112.379] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0112.379] lstrlenW (lpString=".xls") returned 4 [0112.379] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0112.379] lstrlenW (lpString=".xlsx") returned 5 [0112.379] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0112.379] lstrlenW (lpString=".ppt") returned 4 [0112.379] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0112.379] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89 [0112.379] lstrlenW (lpString=".zip") returned 4 [0112.379] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0112.379] lstrlenW (lpString=".rar") returned 4 [0112.379] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0112.379] lstrlenW (lpString=".bz2") returned 4 [0112.379] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0112.379] lstrlenW (lpString=".7z") returned 3 [0112.379] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0112.379] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89 [0112.379] lstrlenW (lpString=".dbf") returned 4 [0112.379] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0112.379] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89 [0112.379] lstrlenW (lpString=".1cd") returned 4 [0112.379] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0112.379] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89 [0112.379] lstrlenW (lpString=".jpg") returned 4 [0112.379] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0112.379] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89 [0112.379] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89 [0112.379] lstrlenW (lpString=".doc") returned 4 [0112.379] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0112.380] lstrlenW (lpString=".docx") returned 5 [0112.380] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0112.380] lstrlenW (lpString=".pdf") returned 4 [0112.380] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0112.380] lstrlenW (lpString=".xls") returned 4 [0112.380] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0112.380] lstrlenW (lpString=".xlsx") returned 5 [0112.380] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0112.380] lstrlenW (lpString=".ppt") returned 4 [0112.380] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0112.380] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89 [0112.380] lstrlenW (lpString=".zip") returned 4 [0112.380] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0112.380] lstrlenW (lpString=".rar") returned 4 [0112.380] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0112.380] lstrlenW (lpString=".bz2") returned 4 [0112.380] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0112.380] lstrlenW (lpString=".7z") returned 3 [0112.380] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0112.380] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89 [0112.380] lstrlenW (lpString=".dbf") returned 4 [0112.380] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0112.380] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89 [0112.380] lstrlenW (lpString=".1cd") returned 4 [0112.380] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0112.380] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89 [0112.380] lstrlenW (lpString=".jpg") returned 4 [0112.380] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0112.380] lstrcmpiW (lpString1=".exe", lpString2=".waifu") returned -1 [0112.380] lstrlenW (lpString="ose.exe") returned 7 [0112.380] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\ose.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0112.381] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x391fc2c | out: lpFileSize=0x391fc2c*=174440) returned 1 [0112.381] CloseHandle (hObject=0x1b0) returned 1 [0112.381] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\ose.exe")) returned 0x2020 [0112.381] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\ose.exe.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0112.381] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\ose.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0112.381] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fbd8 | out: lpNewFilePointer=0x0) returned 1 [0112.381] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fbd8 | out: lpNewFilePointer=0x0) returned 1 [0112.381] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\ose.exe.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0112.381] GetLastError () returned 0x0 [0112.381] ReadFile (in: hFile=0x1b0, lpBuffer=0x4340020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fbe4, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesRead=0x391fbe4*=0x2a968, lpOverlapped=0x0) returned 1 [0112.419] WriteFile (in: hFile=0x1ec, lpBuffer=0x4340020*, nNumberOfBytesToWrite=0x2a970, lpNumberOfBytesWritten=0x391f9ac, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesWritten=0x391f9ac*=0x2a970, lpOverlapped=0x0) returned 1 [0112.421] ReadFile (in: hFile=0x1b0, lpBuffer=0x4340020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fbe4, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesRead=0x391fbe4*=0x0, lpOverlapped=0x0) returned 1 [0112.421] WriteFile (in: hFile=0x1ec, lpBuffer=0x4340020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x391f9ac, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesWritten=0x391f9ac*=0xe2, lpOverlapped=0x0) returned 1 [0112.421] SetEndOfFile (hFile=0x1ec) returned 1 [0112.421] CloseHandle (hObject=0x1ec) returned 1 [0112.421] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fbd8 | out: lpNewFilePointer=0x0) returned 1 [0112.421] SetEndOfFile (hFile=0x1b0) returned 1 [0112.422] CloseHandle (hObject=0x1b0) returned 1 [0112.422] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x2020) returned 1 [0112.423] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\ose.exe")) returned 1 [0112.423] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0112.423] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0112.423] lstrlenW (lpString=".doc") returned 4 [0112.423] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0112.423] lstrlenW (lpString=".docx") returned 5 [0112.423] lstrcmpiW (lpString1=".docx", lpString2="e.exe") returned -1 [0112.423] lstrlenW (lpString=".pdf") returned 4 [0112.423] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0112.423] lstrlenW (lpString=".xls") returned 4 [0112.423] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0112.423] lstrlenW (lpString=".xlsx") returned 5 [0112.423] lstrcmpiW (lpString1=".xlsx", lpString2="e.exe") returned -1 [0112.423] lstrlenW (lpString=".ppt") returned 4 [0112.423] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0112.423] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0112.423] lstrlenW (lpString=".zip") returned 4 [0112.423] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0112.423] lstrlenW (lpString=".rar") returned 4 [0112.423] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0112.423] lstrlenW (lpString=".bz2") returned 4 [0112.423] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0112.423] lstrlenW (lpString=".7z") returned 3 [0112.423] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0112.423] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0112.423] lstrlenW (lpString=".dbf") returned 4 [0112.423] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0112.424] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0112.424] lstrlenW (lpString=".1cd") returned 4 [0112.424] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0112.424] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0112.424] lstrlenW (lpString=".jpg") returned 4 [0112.424] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0112.424] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0112.424] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0112.424] lstrlenW (lpString=".doc") returned 4 [0112.424] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0112.424] lstrlenW (lpString=".docx") returned 5 [0112.424] lstrcmpiW (lpString1=".docx", lpString2="e.exe") returned -1 [0112.424] lstrlenW (lpString=".pdf") returned 4 [0112.424] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0112.424] lstrlenW (lpString=".xls") returned 4 [0112.424] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0112.424] lstrlenW (lpString=".xlsx") returned 5 [0112.424] lstrcmpiW (lpString1=".xlsx", lpString2="e.exe") returned -1 [0112.424] lstrlenW (lpString=".ppt") returned 4 [0112.424] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0112.424] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0112.424] lstrlenW (lpString=".zip") returned 4 [0112.424] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0112.424] lstrlenW (lpString=".rar") returned 4 [0112.424] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0112.424] lstrlenW (lpString=".bz2") returned 4 [0112.424] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0112.424] lstrlenW (lpString=".7z") returned 3 [0112.424] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0112.424] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0112.424] lstrlenW (lpString=".dbf") returned 4 [0112.424] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0112.424] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0112.424] lstrlenW (lpString=".1cd") returned 4 [0112.424] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0112.425] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0112.425] lstrlenW (lpString=".jpg") returned 4 [0112.425] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0112.425] lstrcmpiW (lpString1=".dll", lpString2=".waifu") returned -1 [0112.425] lstrlenW (lpString="PidGenX.dll") returned 11 [0112.425] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pidgenx.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0112.425] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x391fc2c | out: lpFileSize=0x391fc2c*=1463568) returned 1 [0112.425] CloseHandle (hObject=0x1b0) returned 1 [0112.425] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pidgenx.dll")) returned 0x2020 [0112.425] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pidgenx.dll.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0112.425] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pidgenx.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0112.425] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fbd8 | out: lpNewFilePointer=0x0) returned 1 [0112.426] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fbd8 | out: lpNewFilePointer=0x0) returned 1 [0112.426] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pidgenx.dll.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0112.426] GetLastError () returned 0x0 [0112.426] ReadFile (in: hFile=0x1b0, lpBuffer=0x4340020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fbe4, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesRead=0x391fbe4*=0xffff0, lpOverlapped=0x0) returned 1 [0112.691] WriteFile (in: hFile=0x1ec, lpBuffer=0x4340020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x391f9ac, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesWritten=0x391f9ac*=0xffff0, lpOverlapped=0x0) returned 1 [0112.702] ReadFile (in: hFile=0x1b0, lpBuffer=0x4340020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fbe4, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesRead=0x391fbe4*=0x65520, lpOverlapped=0x0) returned 1 [0112.711] WriteFile (in: hFile=0x1ec, lpBuffer=0x4340020*, nNumberOfBytesToWrite=0x65530, lpNumberOfBytesWritten=0x391f9ac, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesWritten=0x391f9ac*=0x65530, lpOverlapped=0x0) returned 1 [0113.131] ReadFile (in: hFile=0x1b0, lpBuffer=0x4340020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fbe4, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesRead=0x391fbe4*=0x0, lpOverlapped=0x0) returned 1 [0113.131] WriteFile (in: hFile=0x1ec, lpBuffer=0x4340020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x391f9ac, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesWritten=0x391f9ac*=0xea, lpOverlapped=0x0) returned 1 [0113.131] SetEndOfFile (hFile=0x1ec) returned 1 [0113.131] CloseHandle (hObject=0x1ec) returned 1 [0113.131] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fbd8 | out: lpNewFilePointer=0x0) returned 1 [0113.131] SetEndOfFile (hFile=0x1b0) returned 1 [0113.132] CloseHandle (hObject=0x1b0) returned 1 [0113.132] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x2020) returned 1 [0113.132] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pidgenx.dll")) returned 1 [0113.883] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0113.883] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0113.883] lstrlenW (lpString=".doc") returned 4 [0113.883] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0113.883] lstrlenW (lpString=".docx") returned 5 [0113.883] lstrcmpiW (lpString1=".docx", lpString2="X.dll") returned -1 [0113.883] lstrlenW (lpString=".pdf") returned 4 [0113.883] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0113.883] lstrlenW (lpString=".xls") returned 4 [0113.883] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0113.883] lstrlenW (lpString=".xlsx") returned 5 [0113.883] lstrcmpiW (lpString1=".xlsx", lpString2="X.dll") returned -1 [0113.883] lstrlenW (lpString=".ppt") returned 4 [0113.883] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0113.883] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0113.883] lstrlenW (lpString=".zip") returned 4 [0113.883] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0113.883] lstrlenW (lpString=".rar") returned 4 [0113.883] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0113.883] lstrlenW (lpString=".bz2") returned 4 [0113.883] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0113.883] lstrlenW (lpString=".7z") returned 3 [0113.883] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0113.883] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0113.883] lstrlenW (lpString=".dbf") returned 4 [0113.883] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0113.883] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0113.883] lstrlenW (lpString=".1cd") returned 4 [0113.883] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0113.883] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0113.883] lstrlenW (lpString=".jpg") returned 4 [0113.883] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0113.883] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0113.883] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0113.883] lstrlenW (lpString=".doc") returned 4 [0113.883] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0113.883] lstrlenW (lpString=".docx") returned 5 [0113.883] lstrcmpiW (lpString1=".docx", lpString2="X.dll") returned -1 [0113.883] lstrlenW (lpString=".pdf") returned 4 [0113.883] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0113.884] lstrlenW (lpString=".xls") returned 4 [0113.884] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0113.884] lstrlenW (lpString=".xlsx") returned 5 [0113.884] lstrcmpiW (lpString1=".xlsx", lpString2="X.dll") returned -1 [0113.884] lstrlenW (lpString=".ppt") returned 4 [0113.884] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0113.884] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0113.884] lstrlenW (lpString=".zip") returned 4 [0113.884] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0113.884] lstrlenW (lpString=".rar") returned 4 [0113.884] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0113.884] lstrlenW (lpString=".bz2") returned 4 [0113.884] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0113.884] lstrlenW (lpString=".7z") returned 3 [0113.884] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0113.884] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0113.884] lstrlenW (lpString=".dbf") returned 4 [0113.884] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0113.884] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0113.884] lstrlenW (lpString=".1cd") returned 4 [0113.884] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0113.884] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0113.884] lstrlenW (lpString=".jpg") returned 4 [0113.884] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0113.884] lstrcmpiW (lpString1=".dll", lpString2=".waifu") returned -1 [0113.884] lstrlenW (lpString="osetup.dll") returned 10 [0113.884] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\osetup.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0114.088] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x391fc2c | out: lpFileSize=0x391fc2c*=7378792) returned 1 [0114.088] CloseHandle (hObject=0x180) returned 1 [0114.088] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\osetup.dll")) returned 0x2020 [0114.088] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\osetup.dll.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0114.088] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\osetup.dll"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\osetup.dll.id-9c354b42.[darknes@420blaze.it].waifu")) returned 1 [0114.089] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\osetup.dll.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0114.089] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391f97c | out: lpNewFilePointer=0x0) returned 1 [0114.089] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391f93c | out: lpNewFilePointer=0x0) returned 1 [0114.089] ReadFile (in: hFile=0x180, lpBuffer=0x4340058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x391f948, lpOverlapped=0x0 | out: lpBuffer=0x4340058*, lpNumberOfBytesRead=0x391f948*=0x40000, lpOverlapped=0x0) returned 1 [0114.115] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x2587cd, lpNewFilePointer=0x0, dwMoveMethod=0x391f93c | out: lpNewFilePointer=0x0) returned 1 [0114.115] ReadFile (in: hFile=0x180, lpBuffer=0x4380058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x391f948, lpOverlapped=0x0 | out: lpBuffer=0x4380058*, lpNumberOfBytesRead=0x391f948*=0x40000, lpOverlapped=0x0) returned 1 [0114.117] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x391f97c | out: lpNewFilePointer=0xffffffff) returned 1 [0114.117] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x6c9768, lpNewFilePointer=0x0, dwMoveMethod=0x391f93c | out: lpNewFilePointer=0x0) returned 1 [0114.117] ReadFile (in: hFile=0x180, lpBuffer=0x43c0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x391f948, lpOverlapped=0x0 | out: lpBuffer=0x43c0058*, lpNumberOfBytesRead=0x391f948*=0x40000, lpOverlapped=0x0) returned 1 [0114.300] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fbd8 | out: lpNewFilePointer=0x0) returned 1 [0114.300] WriteFile (in: hFile=0x180, lpBuffer=0x4340020*, nNumberOfBytesToWrite=0xc0100, lpNumberOfBytesWritten=0x391f9c0, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesWritten=0x391f9c0*=0xc0100, lpOverlapped=0x0) returned 1 [0114.306] SetEndOfFile (hFile=0x180) returned 1 [0114.306] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391f98c | out: lpNewFilePointer=0x0) returned 1 [0114.306] WriteFile (in: hFile=0x180, lpBuffer=0x44c2078*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x391f998, lpOverlapped=0x0 | out: lpBuffer=0x44c2078*, lpNumberOfBytesWritten=0x391f998*=0x40000, lpOverlapped=0x0) returned 1 [0114.307] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x2587cd, lpNewFilePointer=0x0, dwMoveMethod=0x391f98c | out: lpNewFilePointer=0x0) returned 1 [0114.307] WriteFile (in: hFile=0x180, lpBuffer=0x44c2078*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x391f998, lpOverlapped=0x0 | out: lpBuffer=0x44c2078*, lpNumberOfBytesWritten=0x391f998*=0x40000, lpOverlapped=0x0) returned 1 [0114.308] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x6c9768, lpNewFilePointer=0x0, dwMoveMethod=0x391f98c | out: lpNewFilePointer=0x0) returned 1 [0114.308] WriteFile (in: hFile=0x180, lpBuffer=0x44c2078*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x391f998, lpOverlapped=0x0 | out: lpBuffer=0x44c2078*, lpNumberOfBytesWritten=0x391f998*=0x40000, lpOverlapped=0x0) returned 1 [0114.309] CloseHandle (hObject=0x180) returned 1 [0114.310] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x2020) returned 1 [0114.310] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0114.310] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0114.310] lstrlenW (lpString=".doc") returned 4 [0114.310] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0114.310] lstrlenW (lpString=".docx") returned 5 [0114.310] lstrcmpiW (lpString1=".docx", lpString2="p.dll") returned -1 [0114.310] lstrlenW (lpString=".pdf") returned 4 [0114.310] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0114.310] lstrlenW (lpString=".xls") returned 4 [0114.310] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0114.310] lstrlenW (lpString=".xlsx") returned 5 [0114.310] lstrcmpiW (lpString1=".xlsx", lpString2="p.dll") returned -1 [0114.310] lstrlenW (lpString=".ppt") returned 4 [0114.310] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0114.310] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0114.310] lstrlenW (lpString=".zip") returned 4 [0114.310] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0114.310] lstrlenW (lpString=".rar") returned 4 [0114.310] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0114.310] lstrlenW (lpString=".bz2") returned 4 [0114.310] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0114.310] lstrlenW (lpString=".7z") returned 3 [0114.310] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0114.310] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0114.310] lstrlenW (lpString=".dbf") returned 4 [0114.310] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0114.310] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0114.310] lstrlenW (lpString=".1cd") returned 4 [0114.310] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0114.310] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0114.310] lstrlenW (lpString=".jpg") returned 4 [0114.310] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0114.311] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0114.311] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0114.311] lstrlenW (lpString=".doc") returned 4 [0114.311] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0114.311] lstrlenW (lpString=".docx") returned 5 [0114.311] lstrcmpiW (lpString1=".docx", lpString2="p.dll") returned -1 [0114.311] lstrlenW (lpString=".pdf") returned 4 [0114.311] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0114.311] lstrlenW (lpString=".xls") returned 4 [0114.311] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0114.311] lstrlenW (lpString=".xlsx") returned 5 [0114.311] lstrcmpiW (lpString1=".xlsx", lpString2="p.dll") returned -1 [0114.311] lstrlenW (lpString=".ppt") returned 4 [0114.311] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0114.311] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0114.311] lstrlenW (lpString=".zip") returned 4 [0114.311] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0114.311] lstrlenW (lpString=".rar") returned 4 [0114.311] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0114.311] lstrlenW (lpString=".bz2") returned 4 [0114.311] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0114.311] lstrlenW (lpString=".7z") returned 3 [0114.311] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0114.311] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0114.311] lstrlenW (lpString=".dbf") returned 4 [0114.311] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0114.311] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0114.311] lstrlenW (lpString=".1cd") returned 4 [0114.311] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0114.311] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0114.311] lstrlenW (lpString=".jpg") returned 4 [0114.311] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0114.311] lstrcmpiW (lpString1=".dll", lpString2=".waifu") returned -1 [0114.311] lstrlenW (lpString="PidGenX.dll") returned 11 [0114.311] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pidgenx.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0114.921] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x391fc2c | out: lpFileSize=0x391fc2c*=1463568) returned 1 [0114.921] CloseHandle (hObject=0x20c) returned 1 [0114.921] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pidgenx.dll")) returned 0x2020 [0114.921] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pidgenx.dll.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0114.921] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pidgenx.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0114.921] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fbd8 | out: lpNewFilePointer=0x0) returned 1 [0114.921] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fbd8 | out: lpNewFilePointer=0x0) returned 1 [0114.921] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pidgenx.dll.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0114.922] GetLastError () returned 0x0 [0114.922] ReadFile (in: hFile=0x20c, lpBuffer=0x4340020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fbe4, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesRead=0x391fbe4*=0xffff0, lpOverlapped=0x0) returned 1 [0114.941] WriteFile (in: hFile=0x1f0, lpBuffer=0x4340020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x391f9ac, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesWritten=0x391f9ac*=0xffff0, lpOverlapped=0x0) returned 1 [0114.948] ReadFile (in: hFile=0x20c, lpBuffer=0x4340020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fbe4, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesRead=0x391fbe4*=0x65520, lpOverlapped=0x0) returned 1 [0114.955] WriteFile (in: hFile=0x1f0, lpBuffer=0x4340020*, nNumberOfBytesToWrite=0x65530, lpNumberOfBytesWritten=0x391f9ac, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesWritten=0x391f9ac*=0x65530, lpOverlapped=0x0) returned 1 [0115.083] ReadFile (in: hFile=0x20c, lpBuffer=0x4340020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fbe4, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesRead=0x391fbe4*=0x0, lpOverlapped=0x0) returned 1 [0115.083] WriteFile (in: hFile=0x1f0, lpBuffer=0x4340020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x391f9ac, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesWritten=0x391f9ac*=0xea, lpOverlapped=0x0) returned 1 [0115.083] SetEndOfFile (hFile=0x1f0) returned 1 [0115.083] CloseHandle (hObject=0x1f0) returned 1 [0115.084] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fbd8 | out: lpNewFilePointer=0x0) returned 1 [0115.084] SetEndOfFile (hFile=0x20c) returned 1 [0115.085] CloseHandle (hObject=0x20c) returned 1 [0115.086] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x2020) returned 1 [0115.086] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pidgenx.dll")) returned 1 [0115.086] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0115.086] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0115.086] lstrlenW (lpString=".doc") returned 4 [0115.086] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0115.086] lstrlenW (lpString=".docx") returned 5 [0115.086] lstrcmpiW (lpString1=".docx", lpString2="X.dll") returned -1 [0115.086] lstrlenW (lpString=".pdf") returned 4 [0115.086] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0115.086] lstrlenW (lpString=".xls") returned 4 [0115.086] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0115.086] lstrlenW (lpString=".xlsx") returned 5 [0115.086] lstrcmpiW (lpString1=".xlsx", lpString2="X.dll") returned -1 [0115.086] lstrlenW (lpString=".ppt") returned 4 [0115.086] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0115.086] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0115.086] lstrlenW (lpString=".zip") returned 4 [0115.087] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0115.087] lstrlenW (lpString=".rar") returned 4 [0115.087] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0115.087] lstrlenW (lpString=".bz2") returned 4 [0115.087] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0115.087] lstrlenW (lpString=".7z") returned 3 [0115.087] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0115.087] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0115.087] lstrlenW (lpString=".dbf") returned 4 [0115.087] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0115.087] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0115.087] lstrlenW (lpString=".1cd") returned 4 [0115.087] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0115.087] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0115.087] lstrlenW (lpString=".jpg") returned 4 [0115.087] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0115.087] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0115.087] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0115.087] lstrlenW (lpString=".doc") returned 4 [0115.087] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0115.087] lstrlenW (lpString=".docx") returned 5 [0115.087] lstrcmpiW (lpString1=".docx", lpString2="X.dll") returned -1 [0115.087] lstrlenW (lpString=".pdf") returned 4 [0115.087] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0115.087] lstrlenW (lpString=".xls") returned 4 [0115.087] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0115.087] lstrlenW (lpString=".xlsx") returned 5 [0115.087] lstrcmpiW (lpString1=".xlsx", lpString2="X.dll") returned -1 [0115.087] lstrlenW (lpString=".ppt") returned 4 [0115.087] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0115.087] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0115.087] lstrlenW (lpString=".zip") returned 4 [0115.087] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0115.087] lstrlenW (lpString=".rar") returned 4 [0115.087] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0115.087] lstrlenW (lpString=".bz2") returned 4 [0115.087] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0115.087] lstrlenW (lpString=".7z") returned 3 [0115.087] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0115.087] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0115.087] lstrlenW (lpString=".dbf") returned 4 [0115.087] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0115.087] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0115.087] lstrlenW (lpString=".1cd") returned 4 [0115.087] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0115.088] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0115.088] lstrlenW (lpString=".jpg") returned 4 [0115.088] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0115.088] lstrcmpiW (lpString1=".DLL", lpString2=".waifu") returned -1 [0115.088] lstrlenW (lpString="EEINTL.DLL") returned 10 [0115.088] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\1033\\eeintl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0115.088] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x391fc2c | out: lpFileSize=0x391fc2c*=64096) returned 1 [0115.088] CloseHandle (hObject=0x20c) returned 1 [0115.088] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\1033\\eeintl.dll")) returned 0x20 [0115.088] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\1033\\eeintl.dll.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0115.088] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\1033\\eeintl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0115.089] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fbd8 | out: lpNewFilePointer=0x0) returned 1 [0115.089] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fbd8 | out: lpNewFilePointer=0x0) returned 1 [0115.089] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\1033\\eeintl.dll.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0115.127] GetLastError () returned 0x0 [0115.127] ReadFile (in: hFile=0x20c, lpBuffer=0x4340020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fbe4, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesRead=0x391fbe4*=0xfa60, lpOverlapped=0x0) returned 1 [0115.128] WriteFile (in: hFile=0x1f0, lpBuffer=0x4340020*, nNumberOfBytesToWrite=0xfa70, lpNumberOfBytesWritten=0x391f9ac, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesWritten=0x391f9ac*=0xfa70, lpOverlapped=0x0) returned 1 [0115.129] ReadFile (in: hFile=0x20c, lpBuffer=0x4340020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fbe4, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesRead=0x391fbe4*=0x0, lpOverlapped=0x0) returned 1 [0115.129] WriteFile (in: hFile=0x1f0, lpBuffer=0x4340020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x391f9ac, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesWritten=0x391f9ac*=0xe8, lpOverlapped=0x0) returned 1 [0115.129] SetEndOfFile (hFile=0x1f0) returned 1 [0115.130] CloseHandle (hObject=0x1f0) returned 1 [0115.130] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fbd8 | out: lpNewFilePointer=0x0) returned 1 [0115.130] SetEndOfFile (hFile=0x20c) returned 1 [0115.130] CloseHandle (hObject=0x20c) returned 1 [0115.130] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0115.131] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\1033\\eeintl.dll")) returned 1 [0115.131] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL") returned 71 [0115.131] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL") returned 71 [0115.131] lstrlenW (lpString=".doc") returned 4 [0115.131] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0115.131] lstrlenW (lpString=".docx") returned 5 [0115.131] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0115.131] lstrlenW (lpString=".pdf") returned 4 [0115.131] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0115.131] lstrlenW (lpString=".xls") returned 4 [0115.131] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0115.131] lstrlenW (lpString=".xlsx") returned 5 [0115.131] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0115.131] lstrlenW (lpString=".ppt") returned 4 [0115.131] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0115.131] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL") returned 71 [0115.131] lstrlenW (lpString=".zip") returned 4 [0115.131] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0115.131] lstrlenW (lpString=".rar") returned 4 [0115.131] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0115.131] lstrlenW (lpString=".bz2") returned 4 [0115.131] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0115.131] lstrlenW (lpString=".7z") returned 3 [0115.131] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0115.131] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL") returned 71 [0115.131] lstrlenW (lpString=".dbf") returned 4 [0115.131] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0115.131] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL") returned 71 [0115.131] lstrlenW (lpString=".1cd") returned 4 [0115.131] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0115.131] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL") returned 71 [0115.131] lstrlenW (lpString=".jpg") returned 4 [0115.131] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0115.131] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL") returned 71 [0115.131] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL") returned 71 [0115.131] lstrlenW (lpString=".doc") returned 4 [0115.131] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0115.131] lstrlenW (lpString=".docx") returned 5 [0115.131] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0115.132] lstrlenW (lpString=".pdf") returned 4 [0115.132] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0115.132] lstrlenW (lpString=".xls") returned 4 [0115.132] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0115.132] lstrlenW (lpString=".xlsx") returned 5 [0115.132] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0115.132] lstrlenW (lpString=".ppt") returned 4 [0115.132] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0115.132] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL") returned 71 [0115.132] lstrlenW (lpString=".zip") returned 4 [0115.132] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0115.132] lstrlenW (lpString=".rar") returned 4 [0115.132] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0115.132] lstrlenW (lpString=".bz2") returned 4 [0115.132] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0115.132] lstrlenW (lpString=".7z") returned 3 [0115.132] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0115.132] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL") returned 71 [0115.132] lstrlenW (lpString=".dbf") returned 4 [0115.132] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0115.132] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL") returned 71 [0115.132] lstrlenW (lpString=".1cd") returned 4 [0115.132] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0115.132] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL") returned 71 [0115.132] lstrlenW (lpString=".jpg") returned 4 [0115.132] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0115.132] lstrcmpiW (lpString1=".CNT", lpString2=".waifu") returned -1 [0115.132] lstrlenW (lpString="EQNEDT32.CNT") returned 12 [0115.132] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.cnt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0115.133] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x391fc2c | out: lpFileSize=0x391fc2c*=2557) returned 1 [0115.133] CloseHandle (hObject=0x20c) returned 1 [0115.133] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.cnt")) returned 0x20 [0115.133] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.cnt.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0115.133] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.cnt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0115.133] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fbd8 | out: lpNewFilePointer=0x0) returned 1 [0115.133] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fbd8 | out: lpNewFilePointer=0x0) returned 1 [0115.133] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.cnt.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0115.134] GetLastError () returned 0x0 [0115.134] ReadFile (in: hFile=0x20c, lpBuffer=0x4340020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fbe4, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesRead=0x391fbe4*=0x9fd, lpOverlapped=0x0) returned 1 [0115.135] WriteFile (in: hFile=0x1f0, lpBuffer=0x4340020*, nNumberOfBytesToWrite=0xa00, lpNumberOfBytesWritten=0x391f9ac, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesWritten=0x391f9ac*=0xa00, lpOverlapped=0x0) returned 1 [0115.135] ReadFile (in: hFile=0x20c, lpBuffer=0x4340020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fbe4, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesRead=0x391fbe4*=0x0, lpOverlapped=0x0) returned 1 [0115.135] WriteFile (in: hFile=0x1f0, lpBuffer=0x4340020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x391f9ac, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesWritten=0x391f9ac*=0xec, lpOverlapped=0x0) returned 1 [0115.135] SetEndOfFile (hFile=0x1f0) returned 1 [0115.135] CloseHandle (hObject=0x1f0) returned 1 [0115.135] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fbd8 | out: lpNewFilePointer=0x0) returned 1 [0115.136] SetEndOfFile (hFile=0x20c) returned 1 [0115.136] CloseHandle (hObject=0x20c) returned 1 [0115.136] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0115.139] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.cnt")) returned 1 [0115.139] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT") returned 68 [0115.139] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT") returned 68 [0115.139] lstrlenW (lpString=".doc") returned 4 [0115.139] lstrcmpiW (lpString1=".doc", lpString2=".CNT") returned 1 [0115.139] lstrlenW (lpString=".docx") returned 5 [0115.139] lstrcmpiW (lpString1=".docx", lpString2="2.CNT") returned -1 [0115.139] lstrlenW (lpString=".pdf") returned 4 [0115.139] lstrcmpiW (lpString1=".pdf", lpString2=".CNT") returned 1 [0115.139] lstrlenW (lpString=".xls") returned 4 [0115.139] lstrcmpiW (lpString1=".xls", lpString2=".CNT") returned 1 [0115.139] lstrlenW (lpString=".xlsx") returned 5 [0115.139] lstrcmpiW (lpString1=".xlsx", lpString2="2.CNT") returned -1 [0115.139] lstrlenW (lpString=".ppt") returned 4 [0115.139] lstrcmpiW (lpString1=".ppt", lpString2=".CNT") returned 1 [0115.139] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT") returned 68 [0115.139] lstrlenW (lpString=".zip") returned 4 [0115.139] lstrcmpiW (lpString1=".zip", lpString2=".CNT") returned 1 [0115.139] lstrlenW (lpString=".rar") returned 4 [0115.139] lstrcmpiW (lpString1=".rar", lpString2=".CNT") returned 1 [0115.139] lstrlenW (lpString=".bz2") returned 4 [0115.139] lstrcmpiW (lpString1=".bz2", lpString2=".CNT") returned -1 [0115.139] lstrlenW (lpString=".7z") returned 3 [0115.139] lstrcmpiW (lpString1=".7z", lpString2="CNT") returned -1 [0115.139] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT") returned 68 [0115.139] lstrlenW (lpString=".dbf") returned 4 [0115.139] lstrcmpiW (lpString1=".dbf", lpString2=".CNT") returned 1 [0115.139] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT") returned 68 [0115.140] lstrlenW (lpString=".1cd") returned 4 [0115.140] lstrcmpiW (lpString1=".1cd", lpString2=".CNT") returned -1 [0115.140] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT") returned 68 [0115.140] lstrlenW (lpString=".jpg") returned 4 [0115.140] lstrcmpiW (lpString1=".jpg", lpString2=".CNT") returned 1 [0115.140] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT") returned 68 [0115.140] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT") returned 68 [0115.140] lstrlenW (lpString=".doc") returned 4 [0115.140] lstrcmpiW (lpString1=".doc", lpString2=".CNT") returned 1 [0115.140] lstrlenW (lpString=".docx") returned 5 [0115.140] lstrcmpiW (lpString1=".docx", lpString2="2.CNT") returned -1 [0115.140] lstrlenW (lpString=".pdf") returned 4 [0115.140] lstrcmpiW (lpString1=".pdf", lpString2=".CNT") returned 1 [0115.140] lstrlenW (lpString=".xls") returned 4 [0115.140] lstrcmpiW (lpString1=".xls", lpString2=".CNT") returned 1 [0115.140] lstrlenW (lpString=".xlsx") returned 5 [0115.140] lstrcmpiW (lpString1=".xlsx", lpString2="2.CNT") returned -1 [0115.140] lstrlenW (lpString=".ppt") returned 4 [0115.140] lstrcmpiW (lpString1=".ppt", lpString2=".CNT") returned 1 [0115.140] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT") returned 68 [0115.140] lstrlenW (lpString=".zip") returned 4 [0115.140] lstrcmpiW (lpString1=".zip", lpString2=".CNT") returned 1 [0115.140] lstrlenW (lpString=".rar") returned 4 [0115.140] lstrcmpiW (lpString1=".rar", lpString2=".CNT") returned 1 [0115.140] lstrlenW (lpString=".bz2") returned 4 [0115.140] lstrcmpiW (lpString1=".bz2", lpString2=".CNT") returned -1 [0115.140] lstrlenW (lpString=".7z") returned 3 [0115.140] lstrcmpiW (lpString1=".7z", lpString2="CNT") returned -1 [0115.140] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT") returned 68 [0115.140] lstrlenW (lpString=".dbf") returned 4 [0115.140] lstrcmpiW (lpString1=".dbf", lpString2=".CNT") returned 1 [0115.140] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT") returned 68 [0115.140] lstrlenW (lpString=".1cd") returned 4 [0115.140] lstrcmpiW (lpString1=".1cd", lpString2=".CNT") returned -1 [0115.140] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT") returned 68 [0115.140] lstrlenW (lpString=".jpg") returned 4 [0115.140] lstrcmpiW (lpString1=".jpg", lpString2=".CNT") returned 1 [0115.140] lstrcmpiW (lpString1=".EXE", lpString2=".waifu") returned -1 [0115.140] lstrlenW (lpString="EQNEDT32.EXE") returned 12 [0115.140] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0115.141] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x391fc2c | out: lpFileSize=0x391fc2c*=543304) returned 1 [0115.141] CloseHandle (hObject=0x20c) returned 1 [0115.141] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe")) returned 0x20 [0115.141] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0115.141] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0115.141] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fbd8 | out: lpNewFilePointer=0x0) returned 1 [0115.141] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fbd8 | out: lpNewFilePointer=0x0) returned 1 [0115.141] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0115.142] GetLastError () returned 0x0 [0115.142] ReadFile (in: hFile=0x20c, lpBuffer=0x4340020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fbe4, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesRead=0x391fbe4*=0x84a48, lpOverlapped=0x0) returned 1 [0115.152] WriteFile (in: hFile=0x1f0, lpBuffer=0x4340020*, nNumberOfBytesToWrite=0x84a50, lpNumberOfBytesWritten=0x391f9ac, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesWritten=0x391f9ac*=0x84a50, lpOverlapped=0x0) returned 1 [0115.156] ReadFile (in: hFile=0x20c, lpBuffer=0x4340020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fbe4, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesRead=0x391fbe4*=0x0, lpOverlapped=0x0) returned 1 [0115.157] WriteFile (in: hFile=0x1f0, lpBuffer=0x4340020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x391f9ac, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesWritten=0x391f9ac*=0xec, lpOverlapped=0x0) returned 1 [0115.157] SetEndOfFile (hFile=0x1f0) returned 1 [0115.157] CloseHandle (hObject=0x1f0) returned 1 [0115.157] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fbd8 | out: lpNewFilePointer=0x0) returned 1 [0115.157] SetEndOfFile (hFile=0x20c) returned 1 [0115.159] CloseHandle (hObject=0x20c) returned 1 [0115.159] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0115.159] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe")) returned 1 [0115.159] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE") returned 68 [0115.159] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE") returned 68 [0115.159] lstrlenW (lpString=".doc") returned 4 [0115.159] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0115.159] lstrlenW (lpString=".docx") returned 5 [0115.159] lstrcmpiW (lpString1=".docx", lpString2="2.EXE") returned -1 [0115.159] lstrlenW (lpString=".pdf") returned 4 [0115.159] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0115.159] lstrlenW (lpString=".xls") returned 4 [0115.159] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0115.159] lstrlenW (lpString=".xlsx") returned 5 [0115.159] lstrcmpiW (lpString1=".xlsx", lpString2="2.EXE") returned -1 [0115.159] lstrlenW (lpString=".ppt") returned 4 [0115.159] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0115.159] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE") returned 68 [0115.159] lstrlenW (lpString=".zip") returned 4 [0115.159] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0115.159] lstrlenW (lpString=".rar") returned 4 [0115.159] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0115.160] lstrlenW (lpString=".bz2") returned 4 [0115.160] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0115.160] lstrlenW (lpString=".7z") returned 3 [0115.160] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0115.160] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE") returned 68 [0115.160] lstrlenW (lpString=".dbf") returned 4 [0115.160] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0115.160] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE") returned 68 [0115.160] lstrlenW (lpString=".1cd") returned 4 [0115.160] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0115.160] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE") returned 68 [0115.160] lstrlenW (lpString=".jpg") returned 4 [0115.160] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0115.160] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE") returned 68 [0115.160] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE") returned 68 [0115.160] lstrlenW (lpString=".doc") returned 4 [0115.160] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0115.160] lstrlenW (lpString=".docx") returned 5 [0115.160] lstrcmpiW (lpString1=".docx", lpString2="2.EXE") returned -1 [0115.160] lstrlenW (lpString=".pdf") returned 4 [0115.160] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0115.160] lstrlenW (lpString=".xls") returned 4 [0115.160] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0115.160] lstrlenW (lpString=".xlsx") returned 5 [0115.160] lstrcmpiW (lpString1=".xlsx", lpString2="2.EXE") returned -1 [0115.160] lstrlenW (lpString=".ppt") returned 4 [0115.160] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0115.160] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE") returned 68 [0115.160] lstrlenW (lpString=".zip") returned 4 [0115.160] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0115.160] lstrlenW (lpString=".rar") returned 4 [0115.160] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0115.160] lstrlenW (lpString=".bz2") returned 4 [0115.160] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0115.160] lstrlenW (lpString=".7z") returned 3 [0115.160] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0115.160] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE") returned 68 [0115.160] lstrlenW (lpString=".dbf") returned 4 [0115.160] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0115.160] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE") returned 68 [0115.160] lstrlenW (lpString=".1cd") returned 4 [0115.160] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0115.160] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE") returned 68 [0115.160] lstrlenW (lpString=".jpg") returned 4 [0115.160] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0115.161] lstrcmpiW (lpString1=".manifest", lpString2=".waifu") returned -1 [0115.161] lstrlenW (lpString="eqnedt32.exe.manifest") returned 21 [0115.161] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe.manifest"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0115.368] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x391fc2c | out: lpFileSize=0x391fc2c*=566) returned 1 [0115.368] CloseHandle (hObject=0x1f0) returned 1 [0115.368] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe.manifest")) returned 0x20 [0115.368] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe.manifest.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0115.368] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe.manifest"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0115.368] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fbd8 | out: lpNewFilePointer=0x0) returned 1 [0115.368] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fbd8 | out: lpNewFilePointer=0x0) returned 1 [0115.368] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe.manifest.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0115.368] GetLastError () returned 0x0 [0115.368] ReadFile (in: hFile=0x1f0, lpBuffer=0x4340020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fbe4, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesRead=0x391fbe4*=0x236, lpOverlapped=0x0) returned 1 [0115.369] WriteFile (in: hFile=0x1c0, lpBuffer=0x4340020*, nNumberOfBytesToWrite=0x240, lpNumberOfBytesWritten=0x391f9ac, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesWritten=0x391f9ac*=0x240, lpOverlapped=0x0) returned 1 [0115.370] ReadFile (in: hFile=0x1f0, lpBuffer=0x4340020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fbe4, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesRead=0x391fbe4*=0x0, lpOverlapped=0x0) returned 1 [0115.370] WriteFile (in: hFile=0x1c0, lpBuffer=0x4340020*, nNumberOfBytesToWrite=0xfe, lpNumberOfBytesWritten=0x391f9ac, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesWritten=0x391f9ac*=0xfe, lpOverlapped=0x0) returned 1 [0115.371] SetEndOfFile (hFile=0x1c0) returned 1 [0115.371] CloseHandle (hObject=0x1c0) returned 1 [0115.371] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fbd8 | out: lpNewFilePointer=0x0) returned 1 [0115.371] SetEndOfFile (hFile=0x1f0) returned 1 [0115.371] CloseHandle (hObject=0x1f0) returned 1 [0115.371] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0115.372] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe.manifest")) returned 1 [0115.372] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest") returned 77 [0115.372] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest") returned 77 [0115.372] lstrlenW (lpString=".doc") returned 4 [0115.372] lstrcmpiW (lpString1=".doc", lpString2="fest") returned -1 [0115.372] lstrlenW (lpString=".docx") returned 5 [0115.372] lstrcmpiW (lpString1=".docx", lpString2="ifest") returned -1 [0115.372] lstrlenW (lpString=".pdf") returned 4 [0115.372] lstrcmpiW (lpString1=".pdf", lpString2="fest") returned -1 [0115.372] lstrlenW (lpString=".xls") returned 4 [0115.372] lstrcmpiW (lpString1=".xls", lpString2="fest") returned -1 [0115.372] lstrlenW (lpString=".xlsx") returned 5 [0115.372] lstrcmpiW (lpString1=".xlsx", lpString2="ifest") returned -1 [0115.372] lstrlenW (lpString=".ppt") returned 4 [0115.372] lstrcmpiW (lpString1=".ppt", lpString2="fest") returned -1 [0115.372] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest") returned 77 [0115.372] lstrlenW (lpString=".zip") returned 4 [0115.372] lstrcmpiW (lpString1=".zip", lpString2="fest") returned -1 [0115.372] lstrlenW (lpString=".rar") returned 4 [0115.372] lstrcmpiW (lpString1=".rar", lpString2="fest") returned -1 [0115.372] lstrlenW (lpString=".bz2") returned 4 [0115.372] lstrcmpiW (lpString1=".bz2", lpString2="fest") returned -1 [0115.372] lstrlenW (lpString=".7z") returned 3 [0115.372] lstrcmpiW (lpString1=".7z", lpString2="est") returned -1 [0115.372] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest") returned 77 [0115.372] lstrlenW (lpString=".dbf") returned 4 [0115.372] lstrcmpiW (lpString1=".dbf", lpString2="fest") returned -1 [0115.372] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest") returned 77 [0115.372] lstrlenW (lpString=".1cd") returned 4 [0115.372] lstrcmpiW (lpString1=".1cd", lpString2="fest") returned -1 [0115.372] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest") returned 77 [0115.372] lstrlenW (lpString=".jpg") returned 4 [0115.372] lstrcmpiW (lpString1=".jpg", lpString2="fest") returned -1 [0115.373] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest") returned 77 [0115.373] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest") returned 77 [0115.373] lstrlenW (lpString=".doc") returned 4 [0115.373] lstrcmpiW (lpString1=".doc", lpString2="fest") returned -1 [0115.373] lstrlenW (lpString=".docx") returned 5 [0115.373] lstrcmpiW (lpString1=".docx", lpString2="ifest") returned -1 [0115.373] lstrlenW (lpString=".pdf") returned 4 [0115.373] lstrcmpiW (lpString1=".pdf", lpString2="fest") returned -1 [0115.373] lstrlenW (lpString=".xls") returned 4 [0115.373] lstrcmpiW (lpString1=".xls", lpString2="fest") returned -1 [0115.373] lstrlenW (lpString=".xlsx") returned 5 [0115.373] lstrcmpiW (lpString1=".xlsx", lpString2="ifest") returned -1 [0115.373] lstrlenW (lpString=".ppt") returned 4 [0115.373] lstrcmpiW (lpString1=".ppt", lpString2="fest") returned -1 [0115.373] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest") returned 77 [0115.373] lstrlenW (lpString=".zip") returned 4 [0115.373] lstrcmpiW (lpString1=".zip", lpString2="fest") returned -1 [0115.373] lstrlenW (lpString=".rar") returned 4 [0115.373] lstrcmpiW (lpString1=".rar", lpString2="fest") returned -1 [0115.373] lstrlenW (lpString=".bz2") returned 4 [0115.373] lstrcmpiW (lpString1=".bz2", lpString2="fest") returned -1 [0115.373] lstrlenW (lpString=".7z") returned 3 [0115.373] lstrcmpiW (lpString1=".7z", lpString2="est") returned -1 [0115.373] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest") returned 77 [0115.373] lstrlenW (lpString=".dbf") returned 4 [0115.373] lstrcmpiW (lpString1=".dbf", lpString2="fest") returned -1 [0115.373] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest") returned 77 [0115.373] lstrlenW (lpString=".1cd") returned 4 [0115.373] lstrcmpiW (lpString1=".1cd", lpString2="fest") returned -1 [0115.373] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest") returned 77 [0115.373] lstrlenW (lpString=".jpg") returned 4 [0115.373] lstrcmpiW (lpString1=".jpg", lpString2="fest") returned -1 [0115.373] lstrcmpiW (lpString1=".HLP", lpString2=".waifu") returned -1 [0115.373] lstrlenW (lpString="EQNEDT32.HLP") returned 12 [0115.373] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.hlp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0115.374] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x391fc2c | out: lpFileSize=0x391fc2c*=176311) returned 1 [0115.374] CloseHandle (hObject=0x1f0) returned 1 [0115.374] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.hlp")) returned 0x20 [0115.374] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.hlp.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0115.374] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.hlp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0115.374] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fbd8 | out: lpNewFilePointer=0x0) returned 1 [0115.374] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fbd8 | out: lpNewFilePointer=0x0) returned 1 [0115.374] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.hlp.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0115.374] GetLastError () returned 0x0 [0115.374] ReadFile (in: hFile=0x1f0, lpBuffer=0x4340020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fbe4, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesRead=0x391fbe4*=0x2b0b7, lpOverlapped=0x0) returned 1 [0115.377] WriteFile (in: hFile=0x1c0, lpBuffer=0x4340020*, nNumberOfBytesToWrite=0x2b0c0, lpNumberOfBytesWritten=0x391f9ac, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesWritten=0x391f9ac*=0x2b0c0, lpOverlapped=0x0) returned 1 [0115.379] ReadFile (in: hFile=0x1f0, lpBuffer=0x4340020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fbe4, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesRead=0x391fbe4*=0x0, lpOverlapped=0x0) returned 1 [0115.379] WriteFile (in: hFile=0x1c0, lpBuffer=0x4340020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x391f9ac, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesWritten=0x391f9ac*=0xec, lpOverlapped=0x0) returned 1 [0115.379] SetEndOfFile (hFile=0x1c0) returned 1 [0115.379] CloseHandle (hObject=0x1c0) returned 1 [0115.379] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fbd8 | out: lpNewFilePointer=0x0) returned 1 [0115.379] SetEndOfFile (hFile=0x1f0) returned 1 [0115.380] CloseHandle (hObject=0x1f0) returned 1 [0115.380] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0115.380] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.hlp")) returned 1 [0115.381] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP") returned 68 [0115.381] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP") returned 68 [0115.381] lstrlenW (lpString=".doc") returned 4 [0115.381] lstrcmpiW (lpString1=".doc", lpString2=".HLP") returned -1 [0115.381] lstrlenW (lpString=".docx") returned 5 [0115.381] lstrcmpiW (lpString1=".docx", lpString2="2.HLP") returned -1 [0115.381] lstrlenW (lpString=".pdf") returned 4 [0115.381] lstrcmpiW (lpString1=".pdf", lpString2=".HLP") returned 1 [0115.381] lstrlenW (lpString=".xls") returned 4 [0115.381] lstrcmpiW (lpString1=".xls", lpString2=".HLP") returned 1 [0115.381] lstrlenW (lpString=".xlsx") returned 5 [0115.381] lstrcmpiW (lpString1=".xlsx", lpString2="2.HLP") returned -1 [0115.381] lstrlenW (lpString=".ppt") returned 4 [0115.381] lstrcmpiW (lpString1=".ppt", lpString2=".HLP") returned 1 [0115.381] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP") returned 68 [0115.381] lstrlenW (lpString=".zip") returned 4 [0115.381] lstrcmpiW (lpString1=".zip", lpString2=".HLP") returned 1 [0115.381] lstrlenW (lpString=".rar") returned 4 [0115.381] lstrcmpiW (lpString1=".rar", lpString2=".HLP") returned 1 [0115.381] lstrlenW (lpString=".bz2") returned 4 [0115.381] lstrcmpiW (lpString1=".bz2", lpString2=".HLP") returned -1 [0115.381] lstrlenW (lpString=".7z") returned 3 [0115.381] lstrcmpiW (lpString1=".7z", lpString2="HLP") returned -1 [0115.381] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP") returned 68 [0115.381] lstrlenW (lpString=".dbf") returned 4 [0115.381] lstrcmpiW (lpString1=".dbf", lpString2=".HLP") returned -1 [0115.381] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP") returned 68 [0115.381] lstrlenW (lpString=".1cd") returned 4 [0115.381] lstrcmpiW (lpString1=".1cd", lpString2=".HLP") returned -1 [0115.381] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP") returned 68 [0115.381] lstrlenW (lpString=".jpg") returned 4 [0115.381] lstrcmpiW (lpString1=".jpg", lpString2=".HLP") returned 1 [0115.381] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP") returned 68 [0115.381] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP") returned 68 [0115.381] lstrlenW (lpString=".doc") returned 4 [0115.381] lstrcmpiW (lpString1=".doc", lpString2=".HLP") returned -1 [0115.381] lstrlenW (lpString=".docx") returned 5 [0115.381] lstrcmpiW (lpString1=".docx", lpString2="2.HLP") returned -1 [0115.381] lstrlenW (lpString=".pdf") returned 4 [0115.381] lstrcmpiW (lpString1=".pdf", lpString2=".HLP") returned 1 [0115.381] lstrlenW (lpString=".xls") returned 4 [0115.381] lstrcmpiW (lpString1=".xls", lpString2=".HLP") returned 1 [0115.381] lstrlenW (lpString=".xlsx") returned 5 [0115.381] lstrcmpiW (lpString1=".xlsx", lpString2="2.HLP") returned -1 [0115.381] lstrlenW (lpString=".ppt") returned 4 [0115.381] lstrcmpiW (lpString1=".ppt", lpString2=".HLP") returned 1 [0115.381] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP") returned 68 [0115.382] lstrlenW (lpString=".zip") returned 4 [0115.382] lstrcmpiW (lpString1=".zip", lpString2=".HLP") returned 1 [0115.382] lstrlenW (lpString=".rar") returned 4 [0115.382] lstrcmpiW (lpString1=".rar", lpString2=".HLP") returned 1 [0115.382] lstrlenW (lpString=".bz2") returned 4 [0115.382] lstrcmpiW (lpString1=".bz2", lpString2=".HLP") returned -1 [0115.382] lstrlenW (lpString=".7z") returned 3 [0115.382] lstrcmpiW (lpString1=".7z", lpString2="HLP") returned -1 [0115.382] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP") returned 68 [0115.382] lstrlenW (lpString=".dbf") returned 4 [0115.382] lstrcmpiW (lpString1=".dbf", lpString2=".HLP") returned -1 [0115.382] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP") returned 68 [0115.382] lstrlenW (lpString=".1cd") returned 4 [0115.382] lstrcmpiW (lpString1=".1cd", lpString2=".HLP") returned -1 [0115.382] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP") returned 68 [0115.382] lstrlenW (lpString=".jpg") returned 4 [0115.382] lstrcmpiW (lpString1=".jpg", lpString2=".HLP") returned 1 [0115.382] lstrcmpiW (lpString1=".TTF", lpString2=".waifu") returned -1 [0115.382] lstrlenW (lpString="MTEXTRA.TTF") returned 11 [0115.382] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\mtextra.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0115.382] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x391fc2c | out: lpFileSize=0x391fc2c*=7656) returned 1 [0115.382] CloseHandle (hObject=0x1f0) returned 1 [0115.382] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\mtextra.ttf")) returned 0x20 [0115.383] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\mtextra.ttf.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0115.383] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\mtextra.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0115.383] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fbd8 | out: lpNewFilePointer=0x0) returned 1 [0115.383] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fbd8 | out: lpNewFilePointer=0x0) returned 1 [0115.383] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\mtextra.ttf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0115.383] GetLastError () returned 0x0 [0115.383] ReadFile (in: hFile=0x1f0, lpBuffer=0x4340020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fbe4, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesRead=0x391fbe4*=0x1de8, lpOverlapped=0x0) returned 1 [0115.384] WriteFile (in: hFile=0x1c0, lpBuffer=0x4340020*, nNumberOfBytesToWrite=0x1df0, lpNumberOfBytesWritten=0x391f9ac, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesWritten=0x391f9ac*=0x1df0, lpOverlapped=0x0) returned 1 [0115.385] ReadFile (in: hFile=0x1f0, lpBuffer=0x4340020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fbe4, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesRead=0x391fbe4*=0x0, lpOverlapped=0x0) returned 1 [0115.385] WriteFile (in: hFile=0x1c0, lpBuffer=0x4340020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x391f9ac, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesWritten=0x391f9ac*=0xea, lpOverlapped=0x0) returned 1 [0115.385] SetEndOfFile (hFile=0x1c0) returned 1 [0115.385] CloseHandle (hObject=0x1c0) returned 1 [0115.385] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fbd8 | out: lpNewFilePointer=0x0) returned 1 [0115.386] SetEndOfFile (hFile=0x1f0) returned 1 [0115.386] CloseHandle (hObject=0x1f0) returned 1 [0115.386] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0115.386] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\mtextra.ttf")) returned 1 [0115.387] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF") returned 67 [0115.387] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF") returned 67 [0115.387] lstrlenW (lpString=".doc") returned 4 [0115.387] lstrcmpiW (lpString1=".doc", lpString2=".TTF") returned -1 [0115.387] lstrlenW (lpString=".docx") returned 5 [0115.387] lstrcmpiW (lpString1=".docx", lpString2="A.TTF") returned -1 [0115.387] lstrlenW (lpString=".pdf") returned 4 [0115.387] lstrcmpiW (lpString1=".pdf", lpString2=".TTF") returned -1 [0115.387] lstrlenW (lpString=".xls") returned 4 [0115.387] lstrcmpiW (lpString1=".xls", lpString2=".TTF") returned 1 [0115.387] lstrlenW (lpString=".xlsx") returned 5 [0115.387] lstrcmpiW (lpString1=".xlsx", lpString2="A.TTF") returned -1 [0115.387] lstrlenW (lpString=".ppt") returned 4 [0115.387] lstrcmpiW (lpString1=".ppt", lpString2=".TTF") returned -1 [0115.387] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF") returned 67 [0115.387] lstrlenW (lpString=".zip") returned 4 [0115.387] lstrcmpiW (lpString1=".zip", lpString2=".TTF") returned 1 [0115.387] lstrlenW (lpString=".rar") returned 4 [0115.387] lstrcmpiW (lpString1=".rar", lpString2=".TTF") returned -1 [0115.387] lstrlenW (lpString=".bz2") returned 4 [0115.387] lstrcmpiW (lpString1=".bz2", lpString2=".TTF") returned -1 [0115.387] lstrlenW (lpString=".7z") returned 3 [0115.387] lstrcmpiW (lpString1=".7z", lpString2="TTF") returned -1 [0115.387] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF") returned 67 [0115.387] lstrlenW (lpString=".dbf") returned 4 [0115.387] lstrcmpiW (lpString1=".dbf", lpString2=".TTF") returned -1 [0115.387] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF") returned 67 [0115.387] lstrlenW (lpString=".1cd") returned 4 [0115.387] lstrcmpiW (lpString1=".1cd", lpString2=".TTF") returned -1 [0115.387] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF") returned 67 [0115.387] lstrlenW (lpString=".jpg") returned 4 [0115.387] lstrcmpiW (lpString1=".jpg", lpString2=".TTF") returned -1 [0115.387] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF") returned 67 [0115.387] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF") returned 67 [0115.387] lstrlenW (lpString=".doc") returned 4 [0115.387] lstrcmpiW (lpString1=".doc", lpString2=".TTF") returned -1 [0115.387] lstrlenW (lpString=".docx") returned 5 [0115.387] lstrcmpiW (lpString1=".docx", lpString2="A.TTF") returned -1 [0115.387] lstrlenW (lpString=".pdf") returned 4 [0115.387] lstrcmpiW (lpString1=".pdf", lpString2=".TTF") returned -1 [0115.387] lstrlenW (lpString=".xls") returned 4 [0115.387] lstrcmpiW (lpString1=".xls", lpString2=".TTF") returned 1 [0115.387] lstrlenW (lpString=".xlsx") returned 5 [0115.387] lstrcmpiW (lpString1=".xlsx", lpString2="A.TTF") returned -1 [0115.387] lstrlenW (lpString=".ppt") returned 4 [0115.387] lstrcmpiW (lpString1=".ppt", lpString2=".TTF") returned -1 [0115.388] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF") returned 67 [0115.388] lstrlenW (lpString=".zip") returned 4 [0115.388] lstrcmpiW (lpString1=".zip", lpString2=".TTF") returned 1 [0115.388] lstrlenW (lpString=".rar") returned 4 [0115.388] lstrcmpiW (lpString1=".rar", lpString2=".TTF") returned -1 [0115.388] lstrlenW (lpString=".bz2") returned 4 [0115.388] lstrcmpiW (lpString1=".bz2", lpString2=".TTF") returned -1 [0115.388] lstrlenW (lpString=".7z") returned 3 [0115.388] lstrcmpiW (lpString1=".7z", lpString2="TTF") returned -1 [0115.388] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF") returned 67 [0115.388] lstrlenW (lpString=".dbf") returned 4 [0115.388] lstrcmpiW (lpString1=".dbf", lpString2=".TTF") returned -1 [0115.388] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF") returned 67 [0115.388] lstrlenW (lpString=".1cd") returned 4 [0115.388] lstrcmpiW (lpString1=".1cd", lpString2=".TTF") returned -1 [0115.388] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF") returned 67 [0115.388] lstrlenW (lpString=".jpg") returned 4 [0115.388] lstrcmpiW (lpString1=".jpg", lpString2=".TTF") returned -1 [0115.388] lstrcmpiW (lpString1=".DLL", lpString2=".waifu") returned -1 [0115.388] lstrlenW (lpString="MSOEURO.DLL") returned 11 [0115.388] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\euro\\msoeuro.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0115.389] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x391fc2c | out: lpFileSize=0x391fc2c*=31104) returned 1 [0115.389] CloseHandle (hObject=0x1f0) returned 1 [0115.389] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\euro\\msoeuro.dll")) returned 0x20 [0115.389] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\euro\\msoeuro.dll.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0115.389] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\euro\\msoeuro.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0115.389] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fbd8 | out: lpNewFilePointer=0x0) returned 1 [0115.389] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fbd8 | out: lpNewFilePointer=0x0) returned 1 [0115.389] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\euro\\msoeuro.dll.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0115.389] GetLastError () returned 0x0 [0115.389] ReadFile (in: hFile=0x1f0, lpBuffer=0x4340020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fbe4, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesRead=0x391fbe4*=0x7980, lpOverlapped=0x0) returned 1 [0115.391] WriteFile (in: hFile=0x1c0, lpBuffer=0x4340020*, nNumberOfBytesToWrite=0x7990, lpNumberOfBytesWritten=0x391f9ac, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesWritten=0x391f9ac*=0x7990, lpOverlapped=0x0) returned 1 [0115.392] ReadFile (in: hFile=0x1f0, lpBuffer=0x4340020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fbe4, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesRead=0x391fbe4*=0x0, lpOverlapped=0x0) returned 1 [0115.392] WriteFile (in: hFile=0x1c0, lpBuffer=0x4340020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x391f9ac, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesWritten=0x391f9ac*=0xea, lpOverlapped=0x0) returned 1 [0115.392] SetEndOfFile (hFile=0x1c0) returned 1 [0115.392] CloseHandle (hObject=0x1c0) returned 1 [0115.392] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fbd8 | out: lpNewFilePointer=0x0) returned 1 [0115.392] SetEndOfFile (hFile=0x1f0) returned 1 [0115.393] CloseHandle (hObject=0x1f0) returned 1 [0115.393] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0115.393] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\euro\\msoeuro.dll")) returned 1 [0115.393] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL") returned 63 [0115.393] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL") returned 63 [0115.393] lstrlenW (lpString=".doc") returned 4 [0115.393] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0115.393] lstrlenW (lpString=".docx") returned 5 [0115.393] lstrcmpiW (lpString1=".docx", lpString2="O.DLL") returned -1 [0115.393] lstrlenW (lpString=".pdf") returned 4 [0115.393] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0115.393] lstrlenW (lpString=".xls") returned 4 [0115.393] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0115.393] lstrlenW (lpString=".xlsx") returned 5 [0115.393] lstrcmpiW (lpString1=".xlsx", lpString2="O.DLL") returned -1 [0115.393] lstrlenW (lpString=".ppt") returned 4 [0115.393] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0115.393] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL") returned 63 [0115.393] lstrlenW (lpString=".zip") returned 4 [0115.393] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0115.393] lstrlenW (lpString=".rar") returned 4 [0115.393] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0115.393] lstrlenW (lpString=".bz2") returned 4 [0115.394] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0115.394] lstrlenW (lpString=".7z") returned 3 [0115.394] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0115.394] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL") returned 63 [0115.394] lstrlenW (lpString=".dbf") returned 4 [0115.394] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0115.394] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL") returned 63 [0115.394] lstrlenW (lpString=".1cd") returned 4 [0115.394] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0115.394] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL") returned 63 [0115.394] lstrlenW (lpString=".jpg") returned 4 [0115.394] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0115.394] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL") returned 63 [0115.394] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL") returned 63 [0115.394] lstrlenW (lpString=".doc") returned 4 [0115.394] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0115.394] lstrlenW (lpString=".docx") returned 5 [0115.394] lstrcmpiW (lpString1=".docx", lpString2="O.DLL") returned -1 [0115.394] lstrlenW (lpString=".pdf") returned 4 [0115.394] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0115.394] lstrlenW (lpString=".xls") returned 4 [0115.394] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0115.394] lstrlenW (lpString=".xlsx") returned 5 [0115.394] lstrcmpiW (lpString1=".xlsx", lpString2="O.DLL") returned -1 [0115.394] lstrlenW (lpString=".ppt") returned 4 [0115.394] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0115.394] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL") returned 63 [0115.394] lstrlenW (lpString=".zip") returned 4 [0115.394] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0115.394] lstrlenW (lpString=".rar") returned 4 [0115.394] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0115.394] lstrlenW (lpString=".bz2") returned 4 [0115.394] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0115.394] lstrlenW (lpString=".7z") returned 3 [0115.394] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0115.394] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL") returned 63 [0115.394] lstrlenW (lpString=".dbf") returned 4 [0115.394] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0115.394] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL") returned 63 [0115.394] lstrlenW (lpString=".1cd") returned 4 [0115.394] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0115.394] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL") returned 63 [0115.394] lstrlenW (lpString=".jpg") returned 4 [0115.394] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0115.394] lstrcmpiW (lpString1=".dll", lpString2=".waifu") returned -1 [0115.395] lstrlenW (lpString="msgfilt.dll") returned 11 [0115.395] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\msgfilt.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0115.395] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x391fc2c | out: lpFileSize=0x391fc2c*=38768) returned 1 [0115.395] CloseHandle (hObject=0x1f0) returned 1 [0115.395] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\msgfilt.dll")) returned 0x20 [0115.396] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\msgfilt.dll.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0115.396] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\msgfilt.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0115.396] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fbd8 | out: lpNewFilePointer=0x0) returned 1 [0115.396] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fbd8 | out: lpNewFilePointer=0x0) returned 1 [0115.396] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\msgfilt.dll.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0115.400] GetLastError () returned 0x0 [0115.400] ReadFile (in: hFile=0x1f0, lpBuffer=0x4340020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fbe4, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesRead=0x391fbe4*=0x9770, lpOverlapped=0x0) returned 1 [0115.401] WriteFile (in: hFile=0x1c0, lpBuffer=0x4340020*, nNumberOfBytesToWrite=0x9780, lpNumberOfBytesWritten=0x391f9ac, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesWritten=0x391f9ac*=0x9780, lpOverlapped=0x0) returned 1 [0115.402] ReadFile (in: hFile=0x1f0, lpBuffer=0x4340020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fbe4, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesRead=0x391fbe4*=0x0, lpOverlapped=0x0) returned 1 [0115.402] WriteFile (in: hFile=0x1c0, lpBuffer=0x4340020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x391f9ac, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesWritten=0x391f9ac*=0xea, lpOverlapped=0x0) returned 1 [0115.402] SetEndOfFile (hFile=0x1c0) returned 1 [0115.402] CloseHandle (hObject=0x1c0) returned 1 [0115.402] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fbd8 | out: lpNewFilePointer=0x0) returned 1 [0115.402] SetEndOfFile (hFile=0x1f0) returned 1 [0115.403] CloseHandle (hObject=0x1f0) returned 1 [0115.403] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0115.403] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\msgfilt.dll")) returned 1 [0115.403] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll") returned 66 [0115.403] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll") returned 66 [0115.403] lstrlenW (lpString=".doc") returned 4 [0115.403] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0115.403] lstrlenW (lpString=".docx") returned 5 [0115.403] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0115.403] lstrlenW (lpString=".pdf") returned 4 [0115.403] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0115.403] lstrlenW (lpString=".xls") returned 4 [0115.403] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0115.404] lstrlenW (lpString=".xlsx") returned 5 [0115.404] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0115.404] lstrlenW (lpString=".ppt") returned 4 [0115.404] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0115.404] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll") returned 66 [0115.404] lstrlenW (lpString=".zip") returned 4 [0115.404] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0115.404] lstrlenW (lpString=".rar") returned 4 [0115.404] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0115.404] lstrlenW (lpString=".bz2") returned 4 [0115.404] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0115.404] lstrlenW (lpString=".7z") returned 3 [0115.404] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0115.404] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll") returned 66 [0115.404] lstrlenW (lpString=".dbf") returned 4 [0115.404] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0115.404] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll") returned 66 [0115.404] lstrlenW (lpString=".1cd") returned 4 [0115.404] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0115.404] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll") returned 66 [0115.404] lstrlenW (lpString=".jpg") returned 4 [0115.404] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0115.404] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll") returned 66 [0115.404] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll") returned 66 [0115.404] lstrlenW (lpString=".doc") returned 4 [0115.404] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0115.404] lstrlenW (lpString=".docx") returned 5 [0115.404] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0115.404] lstrlenW (lpString=".pdf") returned 4 [0115.404] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0115.404] lstrlenW (lpString=".xls") returned 4 [0115.404] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0115.404] lstrlenW (lpString=".xlsx") returned 5 [0115.404] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0115.404] lstrlenW (lpString=".ppt") returned 4 [0115.404] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0115.404] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll") returned 66 [0115.404] lstrlenW (lpString=".zip") returned 4 [0115.404] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0115.404] lstrlenW (lpString=".rar") returned 4 [0115.404] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0115.404] lstrlenW (lpString=".bz2") returned 4 [0115.404] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0115.404] lstrlenW (lpString=".7z") returned 3 [0115.404] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0115.404] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll") returned 66 [0115.404] lstrlenW (lpString=".dbf") returned 4 [0115.404] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0115.404] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll") returned 66 [0115.404] lstrlenW (lpString=".1cd") returned 4 [0115.404] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0115.405] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll") returned 66 [0115.405] lstrlenW (lpString=".jpg") returned 4 [0115.405] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0115.405] lstrcmpiW (lpString1=".dll", lpString2=".waifu") returned -1 [0115.405] lstrlenW (lpString="odffilt.dll") returned 11 [0115.405] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\odffilt.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0115.462] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x391fc2c | out: lpFileSize=0x391fc2c*=1312656) returned 1 [0115.462] CloseHandle (hObject=0x1f8) returned 1 [0115.462] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\odffilt.dll")) returned 0x20 [0115.462] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\odffilt.dll.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0115.462] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\odffilt.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0115.462] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fbd8 | out: lpNewFilePointer=0x0) returned 1 [0115.462] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fbd8 | out: lpNewFilePointer=0x0) returned 1 [0115.462] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\odffilt.dll.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0115.462] GetLastError () returned 0x0 [0115.463] ReadFile (in: hFile=0x1f8, lpBuffer=0x4340020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fbe4, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesRead=0x391fbe4*=0xffff0, lpOverlapped=0x0) returned 1 [0115.492] WriteFile (in: hFile=0x1f0, lpBuffer=0x4340020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x391f9ac, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesWritten=0x391f9ac*=0xffff0, lpOverlapped=0x0) returned 1 [0115.500] ReadFile (in: hFile=0x1f8, lpBuffer=0x4340020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fbe4, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesRead=0x391fbe4*=0x407a0, lpOverlapped=0x0) returned 1 [0115.506] WriteFile (in: hFile=0x1f0, lpBuffer=0x4340020*, nNumberOfBytesToWrite=0x407b0, lpNumberOfBytesWritten=0x391f9ac, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesWritten=0x391f9ac*=0x407b0, lpOverlapped=0x0) returned 1 [0115.510] ReadFile (in: hFile=0x1f8, lpBuffer=0x4340020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fbe4, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesRead=0x391fbe4*=0x0, lpOverlapped=0x0) returned 1 [0115.510] WriteFile (in: hFile=0x1f0, lpBuffer=0x4340020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x391f9ac, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesWritten=0x391f9ac*=0xea, lpOverlapped=0x0) returned 1 [0115.510] SetEndOfFile (hFile=0x1f0) returned 1 [0115.510] CloseHandle (hObject=0x1f0) returned 1 [0115.510] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fbd8 | out: lpNewFilePointer=0x0) returned 1 [0115.510] SetEndOfFile (hFile=0x1f8) returned 1 [0115.512] CloseHandle (hObject=0x1f8) returned 1 [0115.512] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0115.512] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\odffilt.dll")) returned 1 [0115.512] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll") returned 66 [0115.512] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll") returned 66 [0115.512] lstrlenW (lpString=".doc") returned 4 [0115.512] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0115.512] lstrlenW (lpString=".docx") returned 5 [0115.512] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0115.512] lstrlenW (lpString=".pdf") returned 4 [0115.512] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0115.512] lstrlenW (lpString=".xls") returned 4 [0115.512] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0115.512] lstrlenW (lpString=".xlsx") returned 5 [0115.512] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0115.512] lstrlenW (lpString=".ppt") returned 4 [0115.512] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0115.512] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll") returned 66 [0115.512] lstrlenW (lpString=".zip") returned 4 [0115.512] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0115.512] lstrlenW (lpString=".rar") returned 4 [0115.512] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0115.512] lstrlenW (lpString=".bz2") returned 4 [0115.512] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0115.512] lstrlenW (lpString=".7z") returned 3 [0115.512] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0115.512] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll") returned 66 [0115.512] lstrlenW (lpString=".dbf") returned 4 [0115.512] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0115.512] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll") returned 66 [0115.512] lstrlenW (lpString=".1cd") returned 4 [0115.513] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0115.513] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll") returned 66 [0115.513] lstrlenW (lpString=".jpg") returned 4 [0115.513] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0115.513] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll") returned 66 [0115.513] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll") returned 66 [0115.513] lstrlenW (lpString=".doc") returned 4 [0115.513] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0115.513] lstrlenW (lpString=".docx") returned 5 [0115.513] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0115.513] lstrlenW (lpString=".pdf") returned 4 [0115.513] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0115.513] lstrlenW (lpString=".xls") returned 4 [0115.513] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0115.513] lstrlenW (lpString=".xlsx") returned 5 [0115.513] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0115.513] lstrlenW (lpString=".ppt") returned 4 [0115.513] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0115.513] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll") returned 66 [0115.513] lstrlenW (lpString=".zip") returned 4 [0115.513] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0115.513] lstrlenW (lpString=".rar") returned 4 [0115.513] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0115.513] lstrlenW (lpString=".bz2") returned 4 [0115.513] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0115.513] lstrlenW (lpString=".7z") returned 3 [0115.513] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0115.513] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll") returned 66 [0115.513] lstrlenW (lpString=".dbf") returned 4 [0115.513] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0115.513] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll") returned 66 [0115.513] lstrlenW (lpString=".1cd") returned 4 [0115.513] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0115.513] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll") returned 66 [0115.513] lstrlenW (lpString=".jpg") returned 4 [0115.513] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0115.513] lstrcmpiW (lpString1=".dll", lpString2=".waifu") returned -1 [0115.513] lstrlenW (lpString="offfiltx.dll") returned 12 [0115.513] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\offfiltx.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0115.693] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x391fc2c | out: lpFileSize=0x391fc2c*=1486736) returned 1 [0115.693] CloseHandle (hObject=0x1f4) returned 1 [0115.693] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\offfiltx.dll")) returned 0x20 [0115.693] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\offfiltx.dll.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0115.693] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\offfiltx.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0115.693] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fbd8 | out: lpNewFilePointer=0x0) returned 1 [0115.693] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fbd8 | out: lpNewFilePointer=0x0) returned 1 [0115.693] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\offfiltx.dll.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0115.693] GetLastError () returned 0x0 [0115.693] ReadFile (in: hFile=0x1f4, lpBuffer=0x4340020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fbe4, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesRead=0x391fbe4*=0xffff0, lpOverlapped=0x0) returned 1 [0115.710] WriteFile (in: hFile=0x1fc, lpBuffer=0x4340020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x391f9ac, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesWritten=0x391f9ac*=0xffff0, lpOverlapped=0x0) returned 1 [0115.722] ReadFile (in: hFile=0x1f4, lpBuffer=0x4340020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fbe4, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesRead=0x391fbe4*=0x6afa0, lpOverlapped=0x0) returned 1 [0115.729] WriteFile (in: hFile=0x1fc, lpBuffer=0x4340020*, nNumberOfBytesToWrite=0x6afb0, lpNumberOfBytesWritten=0x391f9ac, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesWritten=0x391f9ac*=0x6afb0, lpOverlapped=0x0) returned 1 [0115.735] ReadFile (in: hFile=0x1f4, lpBuffer=0x4340020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fbe4, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesRead=0x391fbe4*=0x0, lpOverlapped=0x0) returned 1 [0115.735] WriteFile (in: hFile=0x1fc, lpBuffer=0x4340020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x391f9ac, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesWritten=0x391f9ac*=0xec, lpOverlapped=0x0) returned 1 [0115.735] SetEndOfFile (hFile=0x1fc) returned 1 [0115.736] CloseHandle (hObject=0x1fc) returned 1 [0115.736] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fbd8 | out: lpNewFilePointer=0x0) returned 1 [0115.736] SetEndOfFile (hFile=0x1f4) returned 1 [0115.898] CloseHandle (hObject=0x1f4) returned 1 [0115.898] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0115.898] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\offfiltx.dll")) returned 1 [0115.898] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll") returned 67 [0115.898] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll") returned 67 [0115.898] lstrlenW (lpString=".doc") returned 4 [0115.898] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0115.898] lstrlenW (lpString=".docx") returned 5 [0115.898] lstrcmpiW (lpString1=".docx", lpString2="x.dll") returned -1 [0115.898] lstrlenW (lpString=".pdf") returned 4 [0115.899] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0115.899] lstrlenW (lpString=".xls") returned 4 [0115.899] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0115.899] lstrlenW (lpString=".xlsx") returned 5 [0115.899] lstrcmpiW (lpString1=".xlsx", lpString2="x.dll") returned -1 [0115.899] lstrlenW (lpString=".ppt") returned 4 [0115.899] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0115.899] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll") returned 67 [0115.899] lstrlenW (lpString=".zip") returned 4 [0115.899] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0115.899] lstrlenW (lpString=".rar") returned 4 [0115.899] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0115.899] lstrlenW (lpString=".bz2") returned 4 [0115.899] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0115.899] lstrlenW (lpString=".7z") returned 3 [0115.899] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0115.899] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll") returned 67 [0115.899] lstrlenW (lpString=".dbf") returned 4 [0115.899] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0115.899] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll") returned 67 [0115.899] lstrlenW (lpString=".1cd") returned 4 [0115.899] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0115.899] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll") returned 67 [0115.899] lstrlenW (lpString=".jpg") returned 4 [0115.899] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0115.899] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll") returned 67 [0115.899] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll") returned 67 [0115.899] lstrlenW (lpString=".doc") returned 4 [0115.899] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0115.899] lstrlenW (lpString=".docx") returned 5 [0115.899] lstrcmpiW (lpString1=".docx", lpString2="x.dll") returned -1 [0115.899] lstrlenW (lpString=".pdf") returned 4 [0115.899] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0115.899] lstrlenW (lpString=".xls") returned 4 [0115.900] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0115.900] lstrlenW (lpString=".xlsx") returned 5 [0115.900] lstrcmpiW (lpString1=".xlsx", lpString2="x.dll") returned -1 [0115.900] lstrlenW (lpString=".ppt") returned 4 [0115.900] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0115.900] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll") returned 67 [0115.900] lstrlenW (lpString=".zip") returned 4 [0115.900] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0115.900] lstrlenW (lpString=".rar") returned 4 [0115.900] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0115.900] lstrlenW (lpString=".bz2") returned 4 [0115.900] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0115.900] lstrlenW (lpString=".7z") returned 3 [0115.900] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0115.900] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll") returned 67 [0115.900] lstrlenW (lpString=".dbf") returned 4 [0115.900] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0115.900] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll") returned 67 [0115.900] lstrlenW (lpString=".1cd") returned 4 [0115.900] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0115.900] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll") returned 67 [0115.900] lstrlenW (lpString=".jpg") returned 4 [0115.900] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0115.900] lstrcmpiW (lpString1=".CFG", lpString2=".waifu") returned -1 [0115.900] lstrlenW (lpString="CGMIMP32.CFG") returned 12 [0115.900] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.cfg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0115.901] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x391fc2c | out: lpFileSize=0x391fc2c*=6811) returned 1 [0115.901] CloseHandle (hObject=0x1f4) returned 1 [0115.901] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.cfg")) returned 0x20 [0115.901] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.cfg.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0115.901] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0115.901] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fbd8 | out: lpNewFilePointer=0x0) returned 1 [0115.901] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fbd8 | out: lpNewFilePointer=0x0) returned 1 [0115.901] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.cfg.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0115.902] GetLastError () returned 0x0 [0115.902] ReadFile (in: hFile=0x1f4, lpBuffer=0x4340020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fbe4, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesRead=0x391fbe4*=0x1a9b, lpOverlapped=0x0) returned 1 [0115.903] WriteFile (in: hFile=0x1e4, lpBuffer=0x4340020*, nNumberOfBytesToWrite=0x1aa0, lpNumberOfBytesWritten=0x391f9ac, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesWritten=0x391f9ac*=0x1aa0, lpOverlapped=0x0) returned 1 [0115.904] ReadFile (in: hFile=0x1f4, lpBuffer=0x4340020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fbe4, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesRead=0x391fbe4*=0x0, lpOverlapped=0x0) returned 1 [0115.904] WriteFile (in: hFile=0x1e4, lpBuffer=0x4340020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x391f9ac, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesWritten=0x391f9ac*=0xec, lpOverlapped=0x0) returned 1 [0115.904] SetEndOfFile (hFile=0x1e4) returned 1 [0115.905] CloseHandle (hObject=0x1e4) returned 1 [0115.905] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fbd8 | out: lpNewFilePointer=0x0) returned 1 [0115.905] SetEndOfFile (hFile=0x1f4) returned 1 [0115.906] CloseHandle (hObject=0x1f4) returned 1 [0115.906] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0115.907] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.cfg")) returned 1 [0115.907] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG") returned 67 [0115.907] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG") returned 67 [0115.907] lstrlenW (lpString=".doc") returned 4 [0115.907] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0115.907] lstrlenW (lpString=".docx") returned 5 [0115.907] lstrcmpiW (lpString1=".docx", lpString2="2.CFG") returned -1 [0115.907] lstrlenW (lpString=".pdf") returned 4 [0115.907] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0115.907] lstrlenW (lpString=".xls") returned 4 [0115.907] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0115.907] lstrlenW (lpString=".xlsx") returned 5 [0115.907] lstrcmpiW (lpString1=".xlsx", lpString2="2.CFG") returned -1 [0115.907] lstrlenW (lpString=".ppt") returned 4 [0115.907] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0115.907] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG") returned 67 [0115.907] lstrlenW (lpString=".zip") returned 4 [0115.907] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0115.907] lstrlenW (lpString=".rar") returned 4 [0115.907] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0115.908] lstrlenW (lpString=".bz2") returned 4 [0115.908] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0115.908] lstrlenW (lpString=".7z") returned 3 [0115.908] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0115.908] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG") returned 67 [0115.908] lstrlenW (lpString=".dbf") returned 4 [0115.908] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0115.908] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG") returned 67 [0115.908] lstrlenW (lpString=".1cd") returned 4 [0115.908] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0115.908] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG") returned 67 [0115.908] lstrlenW (lpString=".jpg") returned 4 [0115.908] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0115.908] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG") returned 67 [0115.908] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG") returned 67 [0115.908] lstrlenW (lpString=".doc") returned 4 [0115.908] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0115.908] lstrlenW (lpString=".docx") returned 5 [0115.908] lstrcmpiW (lpString1=".docx", lpString2="2.CFG") returned -1 [0115.908] lstrlenW (lpString=".pdf") returned 4 [0115.908] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0115.908] lstrlenW (lpString=".xls") returned 4 [0115.908] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0115.908] lstrlenW (lpString=".xlsx") returned 5 [0115.908] lstrcmpiW (lpString1=".xlsx", lpString2="2.CFG") returned -1 [0115.908] lstrlenW (lpString=".ppt") returned 4 [0115.908] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0115.908] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG") returned 67 [0115.908] lstrlenW (lpString=".zip") returned 4 [0115.908] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0115.908] lstrlenW (lpString=".rar") returned 4 [0115.908] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0115.908] lstrlenW (lpString=".bz2") returned 4 [0115.908] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0115.909] lstrlenW (lpString=".7z") returned 3 [0115.909] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0115.909] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG") returned 67 [0115.909] lstrlenW (lpString=".dbf") returned 4 [0115.909] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0115.909] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG") returned 67 [0115.909] lstrlenW (lpString=".1cd") returned 4 [0115.909] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0115.909] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG") returned 67 [0115.909] lstrlenW (lpString=".jpg") returned 4 [0115.909] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0115.909] lstrcmpiW (lpString1=".FLT", lpString2=".waifu") returned -1 [0115.909] lstrlenW (lpString="CGMIMP32.FLT") returned 12 [0115.909] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.flt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0115.910] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x391fc2c | out: lpFileSize=0x391fc2c*=323936) returned 1 [0115.910] CloseHandle (hObject=0x1f4) returned 1 [0115.910] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.flt")) returned 0x20 [0115.910] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.flt.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0115.911] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.flt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0115.911] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fbd8 | out: lpNewFilePointer=0x0) returned 1 [0115.911] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fbd8 | out: lpNewFilePointer=0x0) returned 1 [0115.911] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.flt.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0115.911] GetLastError () returned 0x0 [0115.911] ReadFile (in: hFile=0x1f4, lpBuffer=0x4340020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fbe4, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesRead=0x391fbe4*=0x4f160, lpOverlapped=0x0) returned 1 [0115.920] WriteFile (in: hFile=0x1e4, lpBuffer=0x4340020*, nNumberOfBytesToWrite=0x4f170, lpNumberOfBytesWritten=0x391f9ac, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesWritten=0x391f9ac*=0x4f170, lpOverlapped=0x0) returned 1 [0115.923] ReadFile (in: hFile=0x1f4, lpBuffer=0x4340020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fbe4, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesRead=0x391fbe4*=0x0, lpOverlapped=0x0) returned 1 [0115.923] WriteFile (in: hFile=0x1e4, lpBuffer=0x4340020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x391f9ac, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesWritten=0x391f9ac*=0xec, lpOverlapped=0x0) returned 1 [0115.923] SetEndOfFile (hFile=0x1e4) returned 1 [0115.923] CloseHandle (hObject=0x1e4) returned 1 [0115.923] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fbd8 | out: lpNewFilePointer=0x0) returned 1 [0115.923] SetEndOfFile (hFile=0x1f4) returned 1 [0115.925] CloseHandle (hObject=0x1f4) returned 1 [0115.925] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0115.925] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.flt")) returned 1 [0115.925] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT") returned 67 [0115.925] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT") returned 67 [0115.925] lstrlenW (lpString=".doc") returned 4 [0115.925] lstrcmpiW (lpString1=".doc", lpString2=".FLT") returned -1 [0115.925] lstrlenW (lpString=".docx") returned 5 [0115.925] lstrcmpiW (lpString1=".docx", lpString2="2.FLT") returned -1 [0115.925] lstrlenW (lpString=".pdf") returned 4 [0115.925] lstrcmpiW (lpString1=".pdf", lpString2=".FLT") returned 1 [0115.925] lstrlenW (lpString=".xls") returned 4 [0115.925] lstrcmpiW (lpString1=".xls", lpString2=".FLT") returned 1 [0115.925] lstrlenW (lpString=".xlsx") returned 5 [0115.925] lstrcmpiW (lpString1=".xlsx", lpString2="2.FLT") returned -1 [0115.925] lstrlenW (lpString=".ppt") returned 4 [0115.925] lstrcmpiW (lpString1=".ppt", lpString2=".FLT") returned 1 [0115.925] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT") returned 67 [0115.925] lstrlenW (lpString=".zip") returned 4 [0115.925] lstrcmpiW (lpString1=".zip", lpString2=".FLT") returned 1 [0115.926] lstrlenW (lpString=".rar") returned 4 [0115.926] lstrcmpiW (lpString1=".rar", lpString2=".FLT") returned 1 [0115.926] lstrlenW (lpString=".bz2") returned 4 [0115.926] lstrcmpiW (lpString1=".bz2", lpString2=".FLT") returned -1 [0115.926] lstrlenW (lpString=".7z") returned 3 [0115.926] lstrcmpiW (lpString1=".7z", lpString2="FLT") returned -1 [0115.926] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT") returned 67 [0115.926] lstrlenW (lpString=".dbf") returned 4 [0115.926] lstrcmpiW (lpString1=".dbf", lpString2=".FLT") returned -1 [0115.926] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT") returned 67 [0115.926] lstrlenW (lpString=".1cd") returned 4 [0115.926] lstrcmpiW (lpString1=".1cd", lpString2=".FLT") returned -1 [0115.926] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT") returned 67 [0115.926] lstrlenW (lpString=".jpg") returned 4 [0115.926] lstrcmpiW (lpString1=".jpg", lpString2=".FLT") returned 1 [0115.926] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT") returned 67 [0115.926] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT") returned 67 [0115.926] lstrlenW (lpString=".doc") returned 4 [0115.926] lstrcmpiW (lpString1=".doc", lpString2=".FLT") returned -1 [0115.926] lstrlenW (lpString=".docx") returned 5 [0115.926] lstrcmpiW (lpString1=".docx", lpString2="2.FLT") returned -1 [0115.926] lstrlenW (lpString=".pdf") returned 4 [0115.926] lstrcmpiW (lpString1=".pdf", lpString2=".FLT") returned 1 [0115.926] lstrlenW (lpString=".xls") returned 4 [0115.926] lstrcmpiW (lpString1=".xls", lpString2=".FLT") returned 1 [0115.926] lstrlenW (lpString=".xlsx") returned 5 [0115.926] lstrcmpiW (lpString1=".xlsx", lpString2="2.FLT") returned -1 [0115.926] lstrlenW (lpString=".ppt") returned 4 [0115.926] lstrcmpiW (lpString1=".ppt", lpString2=".FLT") returned 1 [0115.926] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT") returned 67 [0115.926] lstrlenW (lpString=".zip") returned 4 [0115.927] lstrcmpiW (lpString1=".zip", lpString2=".FLT") returned 1 [0115.927] lstrlenW (lpString=".rar") returned 4 [0115.927] lstrcmpiW (lpString1=".rar", lpString2=".FLT") returned 1 [0115.927] lstrlenW (lpString=".bz2") returned 4 [0115.927] lstrcmpiW (lpString1=".bz2", lpString2=".FLT") returned -1 [0115.927] lstrlenW (lpString=".7z") returned 3 [0115.927] lstrcmpiW (lpString1=".7z", lpString2="FLT") returned -1 [0115.927] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT") returned 67 [0115.927] lstrlenW (lpString=".dbf") returned 4 [0115.927] lstrcmpiW (lpString1=".dbf", lpString2=".FLT") returned -1 [0115.927] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT") returned 67 [0115.927] lstrlenW (lpString=".1cd") returned 4 [0115.927] lstrcmpiW (lpString1=".1cd", lpString2=".FLT") returned -1 [0115.927] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT") returned 67 [0115.927] lstrlenW (lpString=".jpg") returned 4 [0115.927] lstrcmpiW (lpString1=".jpg", lpString2=".FLT") returned 1 [0115.927] lstrcmpiW (lpString1=".FNT", lpString2=".waifu") returned -1 [0115.927] lstrlenW (lpString="CGMIMP32.FNT") returned 12 [0115.927] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.fnt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0115.929] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x391fc2c | out: lpFileSize=0x391fc2c*=606062) returned 1 [0115.929] CloseHandle (hObject=0x1f4) returned 1 [0115.929] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.fnt")) returned 0x20 [0115.929] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.fnt.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0115.929] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.fnt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0115.929] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fbd8 | out: lpNewFilePointer=0x0) returned 1 [0115.929] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fbd8 | out: lpNewFilePointer=0x0) returned 1 [0115.929] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.fnt.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0115.929] GetLastError () returned 0x0 [0115.929] ReadFile (in: hFile=0x1f4, lpBuffer=0x4340020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fbe4, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesRead=0x391fbe4*=0x93f6e, lpOverlapped=0x0) returned 1 [0115.941] WriteFile (in: hFile=0x1e4, lpBuffer=0x4340020*, nNumberOfBytesToWrite=0x93f70, lpNumberOfBytesWritten=0x391f9ac, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesWritten=0x391f9ac*=0x93f70, lpOverlapped=0x0) returned 1 [0115.946] ReadFile (in: hFile=0x1f4, lpBuffer=0x4340020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fbe4, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesRead=0x391fbe4*=0x0, lpOverlapped=0x0) returned 1 [0115.946] WriteFile (in: hFile=0x1e4, lpBuffer=0x4340020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x391f9ac, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesWritten=0x391f9ac*=0xec, lpOverlapped=0x0) returned 1 [0115.946] SetEndOfFile (hFile=0x1e4) returned 1 [0115.946] CloseHandle (hObject=0x1e4) returned 1 [0115.946] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fbd8 | out: lpNewFilePointer=0x0) returned 1 [0115.946] SetEndOfFile (hFile=0x1f4) returned 1 [0115.948] CloseHandle (hObject=0x1f4) returned 1 [0115.949] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0115.949] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.fnt")) returned 1 [0115.949] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT") returned 67 [0115.949] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT") returned 67 [0115.949] lstrlenW (lpString=".doc") returned 4 [0115.949] lstrcmpiW (lpString1=".doc", lpString2=".FNT") returned -1 [0115.949] lstrlenW (lpString=".docx") returned 5 [0115.949] lstrcmpiW (lpString1=".docx", lpString2="2.FNT") returned -1 [0115.949] lstrlenW (lpString=".pdf") returned 4 [0115.949] lstrcmpiW (lpString1=".pdf", lpString2=".FNT") returned 1 [0115.949] lstrlenW (lpString=".xls") returned 4 [0115.949] lstrcmpiW (lpString1=".xls", lpString2=".FNT") returned 1 [0115.949] lstrlenW (lpString=".xlsx") returned 5 [0115.949] lstrcmpiW (lpString1=".xlsx", lpString2="2.FNT") returned -1 [0115.949] lstrlenW (lpString=".ppt") returned 4 [0115.949] lstrcmpiW (lpString1=".ppt", lpString2=".FNT") returned 1 [0115.949] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT") returned 67 [0115.949] lstrlenW (lpString=".zip") returned 4 [0115.950] lstrcmpiW (lpString1=".zip", lpString2=".FNT") returned 1 [0115.950] lstrlenW (lpString=".rar") returned 4 [0115.950] lstrcmpiW (lpString1=".rar", lpString2=".FNT") returned 1 [0115.950] lstrlenW (lpString=".bz2") returned 4 [0115.950] lstrcmpiW (lpString1=".bz2", lpString2=".FNT") returned -1 [0115.950] lstrlenW (lpString=".7z") returned 3 [0115.950] lstrcmpiW (lpString1=".7z", lpString2="FNT") returned -1 [0115.950] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT") returned 67 [0115.950] lstrlenW (lpString=".dbf") returned 4 [0115.950] lstrcmpiW (lpString1=".dbf", lpString2=".FNT") returned -1 [0115.950] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT") returned 67 [0115.950] lstrlenW (lpString=".1cd") returned 4 [0115.950] lstrcmpiW (lpString1=".1cd", lpString2=".FNT") returned -1 [0115.950] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT") returned 67 [0115.950] lstrlenW (lpString=".jpg") returned 4 [0115.950] lstrcmpiW (lpString1=".jpg", lpString2=".FNT") returned 1 [0115.950] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT") returned 67 [0115.950] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT") returned 67 [0115.950] lstrlenW (lpString=".doc") returned 4 [0115.950] lstrcmpiW (lpString1=".doc", lpString2=".FNT") returned -1 [0115.950] lstrlenW (lpString=".docx") returned 5 [0115.950] lstrcmpiW (lpString1=".docx", lpString2="2.FNT") returned -1 [0115.950] lstrlenW (lpString=".pdf") returned 4 [0115.950] lstrcmpiW (lpString1=".pdf", lpString2=".FNT") returned 1 [0115.950] lstrlenW (lpString=".xls") returned 4 [0115.950] lstrcmpiW (lpString1=".xls", lpString2=".FNT") returned 1 [0115.950] lstrlenW (lpString=".xlsx") returned 5 [0115.950] lstrcmpiW (lpString1=".xlsx", lpString2="2.FNT") returned -1 [0115.950] lstrlenW (lpString=".ppt") returned 4 [0115.950] lstrcmpiW (lpString1=".ppt", lpString2=".FNT") returned 1 [0115.950] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT") returned 67 [0115.950] lstrlenW (lpString=".zip") returned 4 [0115.950] lstrcmpiW (lpString1=".zip", lpString2=".FNT") returned 1 [0115.950] lstrlenW (lpString=".rar") returned 4 [0115.950] lstrcmpiW (lpString1=".rar", lpString2=".FNT") returned 1 [0115.950] lstrlenW (lpString=".bz2") returned 4 [0115.950] lstrcmpiW (lpString1=".bz2", lpString2=".FNT") returned -1 [0115.950] lstrlenW (lpString=".7z") returned 3 [0115.950] lstrcmpiW (lpString1=".7z", lpString2="FNT") returned -1 [0115.951] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT") returned 67 [0115.951] lstrlenW (lpString=".dbf") returned 4 [0115.951] lstrcmpiW (lpString1=".dbf", lpString2=".FNT") returned -1 [0115.951] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT") returned 67 [0115.951] lstrlenW (lpString=".1cd") returned 4 [0115.951] lstrcmpiW (lpString1=".1cd", lpString2=".FNT") returned -1 [0115.951] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT") returned 67 [0115.951] lstrlenW (lpString=".jpg") returned 4 [0115.951] lstrcmpiW (lpString1=".jpg", lpString2=".FNT") returned 1 [0115.951] lstrcmpiW (lpString1=".FLT", lpString2=".waifu") returned -1 [0115.951] lstrlenW (lpString="EPSIMP32.FLT") returned 12 [0115.951] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\epsimp32.flt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0115.951] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x391fc2c | out: lpFileSize=0x391fc2c*=712592) returned 1 [0115.951] CloseHandle (hObject=0x1f4) returned 1 [0115.951] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\epsimp32.flt")) returned 0x20 [0115.951] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\epsimp32.flt.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0115.952] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\epsimp32.flt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0115.952] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fbd8 | out: lpNewFilePointer=0x0) returned 1 [0115.952] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fbd8 | out: lpNewFilePointer=0x0) returned 1 [0115.952] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\epsimp32.flt.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0115.952] GetLastError () returned 0x0 [0115.952] ReadFile (in: hFile=0x1f4, lpBuffer=0x4340020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fbe4, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesRead=0x391fbe4*=0xadf90, lpOverlapped=0x0) returned 1 [0115.965] WriteFile (in: hFile=0x1e4, lpBuffer=0x4340020*, nNumberOfBytesToWrite=0xadfa0, lpNumberOfBytesWritten=0x391f9ac, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesWritten=0x391f9ac*=0xadfa0, lpOverlapped=0x0) returned 1 [0115.971] ReadFile (in: hFile=0x1f4, lpBuffer=0x4340020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fbe4, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesRead=0x391fbe4*=0x0, lpOverlapped=0x0) returned 1 [0115.971] WriteFile (in: hFile=0x1e4, lpBuffer=0x4340020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x391f9ac, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesWritten=0x391f9ac*=0xec, lpOverlapped=0x0) returned 1 [0115.971] SetEndOfFile (hFile=0x1e4) returned 1 [0115.971] CloseHandle (hObject=0x1e4) returned 1 [0115.971] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fbd8 | out: lpNewFilePointer=0x0) returned 1 [0115.971] SetEndOfFile (hFile=0x1f4) returned 1 [0116.056] CloseHandle (hObject=0x1f4) returned 1 [0116.059] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0116.059] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\epsimp32.flt")) returned 1 [0116.059] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT") returned 67 [0116.059] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT") returned 67 [0116.059] lstrlenW (lpString=".doc") returned 4 [0116.059] lstrcmpiW (lpString1=".doc", lpString2=".FLT") returned -1 [0116.059] lstrlenW (lpString=".docx") returned 5 [0116.059] lstrcmpiW (lpString1=".docx", lpString2="2.FLT") returned -1 [0116.059] lstrlenW (lpString=".pdf") returned 4 [0116.059] lstrcmpiW (lpString1=".pdf", lpString2=".FLT") returned 1 [0116.059] lstrlenW (lpString=".xls") returned 4 [0116.059] lstrcmpiW (lpString1=".xls", lpString2=".FLT") returned 1 [0116.059] lstrlenW (lpString=".xlsx") returned 5 [0116.059] lstrcmpiW (lpString1=".xlsx", lpString2="2.FLT") returned -1 [0116.059] lstrlenW (lpString=".ppt") returned 4 [0116.059] lstrcmpiW (lpString1=".ppt", lpString2=".FLT") returned 1 [0116.059] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT") returned 67 [0116.059] lstrlenW (lpString=".zip") returned 4 [0116.059] lstrcmpiW (lpString1=".zip", lpString2=".FLT") returned 1 [0116.059] lstrlenW (lpString=".rar") returned 4 [0116.059] lstrcmpiW (lpString1=".rar", lpString2=".FLT") returned 1 [0116.059] lstrlenW (lpString=".bz2") returned 4 [0116.059] lstrcmpiW (lpString1=".bz2", lpString2=".FLT") returned -1 [0116.059] lstrlenW (lpString=".7z") returned 3 [0116.059] lstrcmpiW (lpString1=".7z", lpString2="FLT") returned -1 [0116.059] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT") returned 67 [0116.059] lstrlenW (lpString=".dbf") returned 4 [0116.059] lstrcmpiW (lpString1=".dbf", lpString2=".FLT") returned -1 [0116.059] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT") returned 67 [0116.059] lstrlenW (lpString=".1cd") returned 4 [0116.059] lstrcmpiW (lpString1=".1cd", lpString2=".FLT") returned -1 [0116.060] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT") returned 67 [0116.060] lstrlenW (lpString=".jpg") returned 4 [0116.060] lstrcmpiW (lpString1=".jpg", lpString2=".FLT") returned 1 [0116.060] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT") returned 67 [0116.060] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT") returned 67 [0116.060] lstrlenW (lpString=".doc") returned 4 [0116.060] lstrcmpiW (lpString1=".doc", lpString2=".FLT") returned -1 [0116.060] lstrlenW (lpString=".docx") returned 5 [0116.060] lstrcmpiW (lpString1=".docx", lpString2="2.FLT") returned -1 [0116.060] lstrlenW (lpString=".pdf") returned 4 [0116.060] lstrcmpiW (lpString1=".pdf", lpString2=".FLT") returned 1 [0116.060] lstrlenW (lpString=".xls") returned 4 [0116.060] lstrcmpiW (lpString1=".xls", lpString2=".FLT") returned 1 [0116.060] lstrlenW (lpString=".xlsx") returned 5 [0116.060] lstrcmpiW (lpString1=".xlsx", lpString2="2.FLT") returned -1 [0116.060] lstrlenW (lpString=".ppt") returned 4 [0116.060] lstrcmpiW (lpString1=".ppt", lpString2=".FLT") returned 1 [0116.060] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT") returned 67 [0116.060] lstrlenW (lpString=".zip") returned 4 [0116.060] lstrcmpiW (lpString1=".zip", lpString2=".FLT") returned 1 [0116.060] lstrlenW (lpString=".rar") returned 4 [0116.060] lstrcmpiW (lpString1=".rar", lpString2=".FLT") returned 1 [0116.060] lstrlenW (lpString=".bz2") returned 4 [0116.060] lstrcmpiW (lpString1=".bz2", lpString2=".FLT") returned -1 [0116.060] lstrlenW (lpString=".7z") returned 3 [0116.060] lstrcmpiW (lpString1=".7z", lpString2="FLT") returned -1 [0116.060] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT") returned 67 [0116.060] lstrlenW (lpString=".dbf") returned 4 [0116.060] lstrcmpiW (lpString1=".dbf", lpString2=".FLT") returned -1 [0116.060] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT") returned 67 [0116.060] lstrlenW (lpString=".1cd") returned 4 [0116.060] lstrcmpiW (lpString1=".1cd", lpString2=".FLT") returned -1 [0116.060] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT") returned 67 [0116.060] lstrlenW (lpString=".jpg") returned 4 [0116.060] lstrcmpiW (lpString1=".jpg", lpString2=".FLT") returned 1 [0116.060] lstrcmpiW (lpString1=".FLT", lpString2=".waifu") returned -1 [0116.060] lstrlenW (lpString="GIFIMP32.FLT") returned 12 [0116.060] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\gifimp32.flt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0116.061] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x391fc2c | out: lpFileSize=0x391fc2c*=320384) returned 1 [0116.061] CloseHandle (hObject=0x1f4) returned 1 [0116.061] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\gifimp32.flt")) returned 0x20 [0116.061] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\gifimp32.flt.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0116.061] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\gifimp32.flt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0116.062] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fbd8 | out: lpNewFilePointer=0x0) returned 1 [0116.062] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fbd8 | out: lpNewFilePointer=0x0) returned 1 [0116.062] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\gifimp32.flt.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0116.062] GetLastError () returned 0x0 [0116.062] ReadFile (in: hFile=0x1f4, lpBuffer=0x4340020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fbe4, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesRead=0x391fbe4*=0x4e380, lpOverlapped=0x0) returned 1 [0116.068] WriteFile (in: hFile=0x208, lpBuffer=0x4340020*, nNumberOfBytesToWrite=0x4e390, lpNumberOfBytesWritten=0x391f9ac, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesWritten=0x391f9ac*=0x4e390, lpOverlapped=0x0) returned 1 [0116.071] ReadFile (in: hFile=0x1f4, lpBuffer=0x4340020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fbe4, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesRead=0x391fbe4*=0x0, lpOverlapped=0x0) returned 1 [0116.071] WriteFile (in: hFile=0x208, lpBuffer=0x4340020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x391f9ac, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesWritten=0x391f9ac*=0xec, lpOverlapped=0x0) returned 1 [0116.071] SetEndOfFile (hFile=0x208) returned 1 [0116.071] CloseHandle (hObject=0x208) returned 1 [0116.071] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fbd8 | out: lpNewFilePointer=0x0) returned 1 [0116.071] SetEndOfFile (hFile=0x1f4) returned 1 [0116.072] CloseHandle (hObject=0x1f4) returned 1 [0116.072] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0116.072] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\gifimp32.flt")) returned 1 [0116.073] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT") returned 67 [0116.073] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT") returned 67 [0116.073] lstrlenW (lpString=".doc") returned 4 [0116.073] lstrcmpiW (lpString1=".doc", lpString2=".FLT") returned -1 [0116.073] lstrlenW (lpString=".docx") returned 5 [0116.073] lstrcmpiW (lpString1=".docx", lpString2="2.FLT") returned -1 [0116.073] lstrlenW (lpString=".pdf") returned 4 [0116.073] lstrcmpiW (lpString1=".pdf", lpString2=".FLT") returned 1 [0116.073] lstrlenW (lpString=".xls") returned 4 [0116.073] lstrcmpiW (lpString1=".xls", lpString2=".FLT") returned 1 [0116.073] lstrlenW (lpString=".xlsx") returned 5 [0116.073] lstrcmpiW (lpString1=".xlsx", lpString2="2.FLT") returned -1 [0116.073] lstrlenW (lpString=".ppt") returned 4 [0116.073] lstrcmpiW (lpString1=".ppt", lpString2=".FLT") returned 1 [0116.073] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT") returned 67 [0116.073] lstrlenW (lpString=".zip") returned 4 [0116.073] lstrcmpiW (lpString1=".zip", lpString2=".FLT") returned 1 [0116.073] lstrlenW (lpString=".rar") returned 4 [0116.073] lstrcmpiW (lpString1=".rar", lpString2=".FLT") returned 1 [0116.073] lstrlenW (lpString=".bz2") returned 4 [0116.073] lstrcmpiW (lpString1=".bz2", lpString2=".FLT") returned -1 [0116.073] lstrlenW (lpString=".7z") returned 3 [0116.073] lstrcmpiW (lpString1=".7z", lpString2="FLT") returned -1 [0116.073] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT") returned 67 [0116.073] lstrlenW (lpString=".dbf") returned 4 [0116.073] lstrcmpiW (lpString1=".dbf", lpString2=".FLT") returned -1 [0116.073] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT") returned 67 [0116.073] lstrlenW (lpString=".1cd") returned 4 [0116.073] lstrcmpiW (lpString1=".1cd", lpString2=".FLT") returned -1 [0116.073] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT") returned 67 [0116.073] lstrlenW (lpString=".jpg") returned 4 [0116.073] lstrcmpiW (lpString1=".jpg", lpString2=".FLT") returned 1 [0116.073] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT") returned 67 [0116.073] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT") returned 67 [0116.073] lstrlenW (lpString=".doc") returned 4 [0116.073] lstrcmpiW (lpString1=".doc", lpString2=".FLT") returned -1 [0116.073] lstrlenW (lpString=".docx") returned 5 [0116.073] lstrcmpiW (lpString1=".docx", lpString2="2.FLT") returned -1 [0116.073] lstrlenW (lpString=".pdf") returned 4 [0116.073] lstrcmpiW (lpString1=".pdf", lpString2=".FLT") returned 1 [0116.073] lstrlenW (lpString=".xls") returned 4 [0116.073] lstrcmpiW (lpString1=".xls", lpString2=".FLT") returned 1 [0116.073] lstrlenW (lpString=".xlsx") returned 5 [0116.074] lstrcmpiW (lpString1=".xlsx", lpString2="2.FLT") returned -1 [0116.074] lstrlenW (lpString=".ppt") returned 4 [0116.074] lstrcmpiW (lpString1=".ppt", lpString2=".FLT") returned 1 [0116.074] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT") returned 67 [0116.074] lstrlenW (lpString=".zip") returned 4 [0116.074] lstrcmpiW (lpString1=".zip", lpString2=".FLT") returned 1 [0116.074] lstrlenW (lpString=".rar") returned 4 [0116.074] lstrcmpiW (lpString1=".rar", lpString2=".FLT") returned 1 [0116.074] lstrlenW (lpString=".bz2") returned 4 [0116.074] lstrcmpiW (lpString1=".bz2", lpString2=".FLT") returned -1 [0116.074] lstrlenW (lpString=".7z") returned 3 [0116.074] lstrcmpiW (lpString1=".7z", lpString2="FLT") returned -1 [0116.074] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT") returned 67 [0116.074] lstrlenW (lpString=".dbf") returned 4 [0116.074] lstrcmpiW (lpString1=".dbf", lpString2=".FLT") returned -1 [0116.074] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT") returned 67 [0116.074] lstrlenW (lpString=".1cd") returned 4 [0116.074] lstrcmpiW (lpString1=".1cd", lpString2=".FLT") returned -1 [0116.074] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT") returned 67 [0116.074] lstrlenW (lpString=".jpg") returned 4 [0116.074] lstrcmpiW (lpString1=".jpg", lpString2=".FLT") returned 1 [0116.074] lstrcmpiW (lpString1=".FLT", lpString2=".waifu") returned -1 [0116.074] lstrlenW (lpString="JPEGIM32.FLT") returned 12 [0116.074] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\jpegim32.flt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0116.075] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x391fc2c | out: lpFileSize=0x391fc2c*=241024) returned 1 [0116.075] CloseHandle (hObject=0x1f4) returned 1 [0116.075] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\jpegim32.flt")) returned 0x20 [0116.075] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\jpegim32.flt.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0116.075] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\jpegim32.flt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0116.075] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fbd8 | out: lpNewFilePointer=0x0) returned 1 [0116.075] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fbd8 | out: lpNewFilePointer=0x0) returned 1 [0116.075] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\jpegim32.flt.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0116.075] GetLastError () returned 0x0 [0116.075] ReadFile (in: hFile=0x1f4, lpBuffer=0x4340020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fbe4, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesRead=0x391fbe4*=0x3ad80, lpOverlapped=0x0) returned 1 [0116.079] WriteFile (in: hFile=0x208, lpBuffer=0x4340020*, nNumberOfBytesToWrite=0x3ad90, lpNumberOfBytesWritten=0x391f9ac, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesWritten=0x391f9ac*=0x3ad90, lpOverlapped=0x0) returned 1 [0116.081] ReadFile (in: hFile=0x1f4, lpBuffer=0x4340020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fbe4, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesRead=0x391fbe4*=0x0, lpOverlapped=0x0) returned 1 [0116.081] WriteFile (in: hFile=0x208, lpBuffer=0x4340020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x391f9ac, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesWritten=0x391f9ac*=0xec, lpOverlapped=0x0) returned 1 [0116.081] SetEndOfFile (hFile=0x208) returned 1 [0116.082] CloseHandle (hObject=0x208) returned 1 [0116.082] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fbd8 | out: lpNewFilePointer=0x0) returned 1 [0116.082] SetEndOfFile (hFile=0x1f4) returned 1 [0116.083] CloseHandle (hObject=0x1f4) returned 1 [0116.083] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0116.083] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\jpegim32.flt")) returned 1 [0116.083] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT") returned 67 [0116.083] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT") returned 67 [0116.083] lstrlenW (lpString=".doc") returned 4 [0116.083] lstrcmpiW (lpString1=".doc", lpString2=".FLT") returned -1 [0116.083] lstrlenW (lpString=".docx") returned 5 [0116.083] lstrcmpiW (lpString1=".docx", lpString2="2.FLT") returned -1 [0116.083] lstrlenW (lpString=".pdf") returned 4 [0116.083] lstrcmpiW (lpString1=".pdf", lpString2=".FLT") returned 1 [0116.083] lstrlenW (lpString=".xls") returned 4 [0116.083] lstrcmpiW (lpString1=".xls", lpString2=".FLT") returned 1 [0116.083] lstrlenW (lpString=".xlsx") returned 5 [0116.083] lstrcmpiW (lpString1=".xlsx", lpString2="2.FLT") returned -1 [0116.083] lstrlenW (lpString=".ppt") returned 4 [0116.083] lstrcmpiW (lpString1=".ppt", lpString2=".FLT") returned 1 [0116.083] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT") returned 67 [0116.083] lstrlenW (lpString=".zip") returned 4 [0116.083] lstrcmpiW (lpString1=".zip", lpString2=".FLT") returned 1 [0116.083] lstrlenW (lpString=".rar") returned 4 [0116.083] lstrcmpiW (lpString1=".rar", lpString2=".FLT") returned 1 [0116.083] lstrlenW (lpString=".bz2") returned 4 [0116.083] lstrcmpiW (lpString1=".bz2", lpString2=".FLT") returned -1 [0116.083] lstrlenW (lpString=".7z") returned 3 [0116.083] lstrcmpiW (lpString1=".7z", lpString2="FLT") returned -1 [0116.083] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT") returned 67 [0116.083] lstrlenW (lpString=".dbf") returned 4 [0116.083] lstrcmpiW (lpString1=".dbf", lpString2=".FLT") returned -1 [0116.083] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT") returned 67 [0116.083] lstrlenW (lpString=".1cd") returned 4 [0116.084] lstrcmpiW (lpString1=".1cd", lpString2=".FLT") returned -1 [0116.084] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT") returned 67 [0116.084] lstrlenW (lpString=".jpg") returned 4 [0116.084] lstrcmpiW (lpString1=".jpg", lpString2=".FLT") returned 1 [0116.084] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT") returned 67 [0116.084] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT") returned 67 [0116.084] lstrlenW (lpString=".doc") returned 4 [0116.084] lstrcmpiW (lpString1=".doc", lpString2=".FLT") returned -1 [0116.084] lstrlenW (lpString=".docx") returned 5 [0116.084] lstrcmpiW (lpString1=".docx", lpString2="2.FLT") returned -1 [0116.084] lstrlenW (lpString=".pdf") returned 4 [0116.084] lstrcmpiW (lpString1=".pdf", lpString2=".FLT") returned 1 [0116.084] lstrlenW (lpString=".xls") returned 4 [0116.084] lstrcmpiW (lpString1=".xls", lpString2=".FLT") returned 1 [0116.084] lstrlenW (lpString=".xlsx") returned 5 [0116.084] lstrcmpiW (lpString1=".xlsx", lpString2="2.FLT") returned -1 [0116.084] lstrlenW (lpString=".ppt") returned 4 [0116.084] lstrcmpiW (lpString1=".ppt", lpString2=".FLT") returned 1 [0116.084] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT") returned 67 [0116.084] lstrlenW (lpString=".zip") returned 4 [0116.084] lstrcmpiW (lpString1=".zip", lpString2=".FLT") returned 1 [0116.084] lstrlenW (lpString=".rar") returned 4 [0116.084] lstrcmpiW (lpString1=".rar", lpString2=".FLT") returned 1 [0116.084] lstrlenW (lpString=".bz2") returned 4 [0116.084] lstrcmpiW (lpString1=".bz2", lpString2=".FLT") returned -1 [0116.084] lstrlenW (lpString=".7z") returned 3 [0116.084] lstrcmpiW (lpString1=".7z", lpString2="FLT") returned -1 [0116.084] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT") returned 67 [0116.084] lstrlenW (lpString=".dbf") returned 4 [0116.084] lstrcmpiW (lpString1=".dbf", lpString2=".FLT") returned -1 [0116.084] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT") returned 67 [0116.084] lstrlenW (lpString=".1cd") returned 4 [0116.084] lstrcmpiW (lpString1=".1cd", lpString2=".FLT") returned -1 [0116.084] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT") returned 67 [0116.084] lstrlenW (lpString=".jpg") returned 4 [0116.084] lstrcmpiW (lpString1=".jpg", lpString2=".FLT") returned 1 [0116.084] lstrcmpiW (lpString1=".CGM", lpString2=".waifu") returned -1 [0116.084] lstrlenW (lpString="MS.CGM") returned 6 [0116.084] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.cgm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0116.085] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x391fc2c | out: lpFileSize=0x391fc2c*=1908) returned 1 [0116.085] CloseHandle (hObject=0x1f4) returned 1 [0116.085] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.cgm")) returned 0x20 [0116.085] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.cgm.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0116.085] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.cgm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0116.085] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fbd8 | out: lpNewFilePointer=0x0) returned 1 [0116.085] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fbd8 | out: lpNewFilePointer=0x0) returned 1 [0116.085] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.cgm.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0116.085] GetLastError () returned 0x0 [0116.085] ReadFile (in: hFile=0x1f4, lpBuffer=0x4340020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fbe4, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesRead=0x391fbe4*=0x774, lpOverlapped=0x0) returned 1 [0116.087] WriteFile (in: hFile=0x208, lpBuffer=0x4340020*, nNumberOfBytesToWrite=0x780, lpNumberOfBytesWritten=0x391f9ac, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesWritten=0x391f9ac*=0x780, lpOverlapped=0x0) returned 1 [0116.088] ReadFile (in: hFile=0x1f4, lpBuffer=0x4340020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fbe4, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesRead=0x391fbe4*=0x0, lpOverlapped=0x0) returned 1 [0116.088] WriteFile (in: hFile=0x208, lpBuffer=0x4340020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x391f9ac, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesWritten=0x391f9ac*=0xe0, lpOverlapped=0x0) returned 1 [0116.088] SetEndOfFile (hFile=0x208) returned 1 [0116.088] CloseHandle (hObject=0x208) returned 1 [0116.088] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fbd8 | out: lpNewFilePointer=0x0) returned 1 [0116.088] SetEndOfFile (hFile=0x1f4) returned 1 [0116.089] CloseHandle (hObject=0x1f4) returned 1 [0116.089] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0116.089] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.cgm")) returned 1 [0116.089] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM") returned 61 [0116.089] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM") returned 61 [0116.089] lstrlenW (lpString=".doc") returned 4 [0116.089] lstrcmpiW (lpString1=".doc", lpString2=".CGM") returned 1 [0116.089] lstrlenW (lpString=".docx") returned 5 [0116.089] lstrcmpiW (lpString1=".docx", lpString2="S.CGM") returned -1 [0116.089] lstrlenW (lpString=".pdf") returned 4 [0116.089] lstrcmpiW (lpString1=".pdf", lpString2=".CGM") returned 1 [0116.089] lstrlenW (lpString=".xls") returned 4 [0116.089] lstrcmpiW (lpString1=".xls", lpString2=".CGM") returned 1 [0116.090] lstrlenW (lpString=".xlsx") returned 5 [0116.090] lstrcmpiW (lpString1=".xlsx", lpString2="S.CGM") returned -1 [0116.090] lstrlenW (lpString=".ppt") returned 4 [0116.090] lstrcmpiW (lpString1=".ppt", lpString2=".CGM") returned 1 [0116.090] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM") returned 61 [0116.090] lstrlenW (lpString=".zip") returned 4 [0116.090] lstrcmpiW (lpString1=".zip", lpString2=".CGM") returned 1 [0116.090] lstrlenW (lpString=".rar") returned 4 [0116.090] lstrcmpiW (lpString1=".rar", lpString2=".CGM") returned 1 [0116.090] lstrlenW (lpString=".bz2") returned 4 [0116.090] lstrcmpiW (lpString1=".bz2", lpString2=".CGM") returned -1 [0116.090] lstrlenW (lpString=".7z") returned 3 [0116.090] lstrcmpiW (lpString1=".7z", lpString2="CGM") returned -1 [0116.090] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM") returned 61 [0116.090] lstrlenW (lpString=".dbf") returned 4 [0116.090] lstrcmpiW (lpString1=".dbf", lpString2=".CGM") returned 1 [0116.090] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM") returned 61 [0116.090] lstrlenW (lpString=".1cd") returned 4 [0116.090] lstrcmpiW (lpString1=".1cd", lpString2=".CGM") returned -1 [0116.090] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM") returned 61 [0116.090] lstrlenW (lpString=".jpg") returned 4 [0116.090] lstrcmpiW (lpString1=".jpg", lpString2=".CGM") returned 1 [0116.090] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM") returned 61 [0116.090] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM") returned 61 [0116.090] lstrlenW (lpString=".doc") returned 4 [0116.090] lstrcmpiW (lpString1=".doc", lpString2=".CGM") returned 1 [0116.090] lstrlenW (lpString=".docx") returned 5 [0116.090] lstrcmpiW (lpString1=".docx", lpString2="S.CGM") returned -1 [0116.090] lstrlenW (lpString=".pdf") returned 4 [0116.090] lstrcmpiW (lpString1=".pdf", lpString2=".CGM") returned 1 [0116.090] lstrlenW (lpString=".xls") returned 4 [0116.090] lstrcmpiW (lpString1=".xls", lpString2=".CGM") returned 1 [0116.090] lstrlenW (lpString=".xlsx") returned 5 [0116.090] lstrcmpiW (lpString1=".xlsx", lpString2="S.CGM") returned -1 [0116.090] lstrlenW (lpString=".ppt") returned 4 [0116.090] lstrcmpiW (lpString1=".ppt", lpString2=".CGM") returned 1 [0116.090] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM") returned 61 [0116.090] lstrlenW (lpString=".zip") returned 4 [0116.090] lstrcmpiW (lpString1=".zip", lpString2=".CGM") returned 1 [0116.090] lstrlenW (lpString=".rar") returned 4 [0116.090] lstrcmpiW (lpString1=".rar", lpString2=".CGM") returned 1 [0116.090] lstrlenW (lpString=".bz2") returned 4 [0116.090] lstrcmpiW (lpString1=".bz2", lpString2=".CGM") returned -1 [0116.090] lstrlenW (lpString=".7z") returned 3 [0116.090] lstrcmpiW (lpString1=".7z", lpString2="CGM") returned -1 [0116.090] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM") returned 61 [0116.090] lstrlenW (lpString=".dbf") returned 4 [0116.090] lstrcmpiW (lpString1=".dbf", lpString2=".CGM") returned 1 [0116.090] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM") returned 61 [0116.091] lstrlenW (lpString=".1cd") returned 4 [0116.091] lstrcmpiW (lpString1=".1cd", lpString2=".CGM") returned -1 [0116.091] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM") returned 61 [0116.091] lstrlenW (lpString=".jpg") returned 4 [0116.091] lstrcmpiW (lpString1=".jpg", lpString2=".CGM") returned 1 [0116.091] lstrcmpiW (lpString1=".WPG", lpString2=".waifu") returned 1 [0116.091] lstrlenW (lpString="MS.WPG") returned 6 [0116.091] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.wpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0116.091] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x391fc2c | out: lpFileSize=0x391fc2c*=1382) returned 1 [0116.091] CloseHandle (hObject=0x1f4) returned 1 [0116.091] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.wpg")) returned 0x20 [0116.091] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.wpg.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0116.091] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.wpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0116.091] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fbd8 | out: lpNewFilePointer=0x0) returned 1 [0116.091] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fbd8 | out: lpNewFilePointer=0x0) returned 1 [0116.091] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.wpg.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0116.092] GetLastError () returned 0x0 [0116.092] ReadFile (in: hFile=0x1f4, lpBuffer=0x4340020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fbe4, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesRead=0x391fbe4*=0x566, lpOverlapped=0x0) returned 1 [0116.153] WriteFile (in: hFile=0x208, lpBuffer=0x4340020*, nNumberOfBytesToWrite=0x570, lpNumberOfBytesWritten=0x391f9ac, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesWritten=0x391f9ac*=0x570, lpOverlapped=0x0) returned 1 [0116.154] ReadFile (in: hFile=0x1f4, lpBuffer=0x4340020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fbe4, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesRead=0x391fbe4*=0x0, lpOverlapped=0x0) returned 1 [0116.154] WriteFile (in: hFile=0x208, lpBuffer=0x4340020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x391f9ac, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesWritten=0x391f9ac*=0xe0, lpOverlapped=0x0) returned 1 [0116.154] SetEndOfFile (hFile=0x208) returned 1 [0116.213] CloseHandle (hObject=0x208) returned 1 [0116.214] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fbd8 | out: lpNewFilePointer=0x0) returned 1 [0116.214] SetEndOfFile (hFile=0x1f4) returned 1 [0116.214] CloseHandle (hObject=0x1f4) returned 1 [0116.214] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0116.239] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.wpg")) returned 1 [0116.239] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG") returned 61 [0116.239] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG") returned 61 [0116.239] lstrlenW (lpString=".doc") returned 4 [0116.239] lstrcmpiW (lpString1=".doc", lpString2=".WPG") returned -1 [0116.239] lstrlenW (lpString=".docx") returned 5 [0116.239] lstrcmpiW (lpString1=".docx", lpString2="S.WPG") returned -1 [0116.239] lstrlenW (lpString=".pdf") returned 4 [0116.239] lstrcmpiW (lpString1=".pdf", lpString2=".WPG") returned -1 [0116.239] lstrlenW (lpString=".xls") returned 4 [0116.239] lstrcmpiW (lpString1=".xls", lpString2=".WPG") returned 1 [0116.239] lstrlenW (lpString=".xlsx") returned 5 [0116.239] lstrcmpiW (lpString1=".xlsx", lpString2="S.WPG") returned -1 [0116.239] lstrlenW (lpString=".ppt") returned 4 [0116.239] lstrcmpiW (lpString1=".ppt", lpString2=".WPG") returned -1 [0116.239] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG") returned 61 [0116.239] lstrlenW (lpString=".zip") returned 4 [0116.239] lstrcmpiW (lpString1=".zip", lpString2=".WPG") returned 1 [0116.239] lstrlenW (lpString=".rar") returned 4 [0116.239] lstrcmpiW (lpString1=".rar", lpString2=".WPG") returned -1 [0116.239] lstrlenW (lpString=".bz2") returned 4 [0116.239] lstrcmpiW (lpString1=".bz2", lpString2=".WPG") returned -1 [0116.239] lstrlenW (lpString=".7z") returned 3 [0116.239] lstrcmpiW (lpString1=".7z", lpString2="WPG") returned -1 [0116.239] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG") returned 61 [0116.239] lstrlenW (lpString=".dbf") returned 4 [0116.239] lstrcmpiW (lpString1=".dbf", lpString2=".WPG") returned -1 [0116.239] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG") returned 61 [0116.239] lstrlenW (lpString=".1cd") returned 4 [0116.239] lstrcmpiW (lpString1=".1cd", lpString2=".WPG") returned -1 [0116.239] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG") returned 61 [0116.239] lstrlenW (lpString=".jpg") returned 4 [0116.239] lstrcmpiW (lpString1=".jpg", lpString2=".WPG") returned -1 [0116.239] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG") returned 61 [0116.239] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG") returned 61 [0116.239] lstrlenW (lpString=".doc") returned 4 [0116.239] lstrcmpiW (lpString1=".doc", lpString2=".WPG") returned -1 [0116.240] lstrlenW (lpString=".docx") returned 5 [0116.240] lstrcmpiW (lpString1=".docx", lpString2="S.WPG") returned -1 [0116.240] lstrlenW (lpString=".pdf") returned 4 [0116.240] lstrcmpiW (lpString1=".pdf", lpString2=".WPG") returned -1 [0116.240] lstrlenW (lpString=".xls") returned 4 [0116.240] lstrcmpiW (lpString1=".xls", lpString2=".WPG") returned 1 [0116.240] lstrlenW (lpString=".xlsx") returned 5 [0116.240] lstrcmpiW (lpString1=".xlsx", lpString2="S.WPG") returned -1 [0116.240] lstrlenW (lpString=".ppt") returned 4 [0116.240] lstrcmpiW (lpString1=".ppt", lpString2=".WPG") returned -1 [0116.240] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG") returned 61 [0116.240] lstrlenW (lpString=".zip") returned 4 [0116.240] lstrcmpiW (lpString1=".zip", lpString2=".WPG") returned 1 [0116.240] lstrlenW (lpString=".rar") returned 4 [0116.240] lstrcmpiW (lpString1=".rar", lpString2=".WPG") returned -1 [0116.240] lstrlenW (lpString=".bz2") returned 4 [0116.240] lstrcmpiW (lpString1=".bz2", lpString2=".WPG") returned -1 [0116.240] lstrlenW (lpString=".7z") returned 3 [0116.240] lstrcmpiW (lpString1=".7z", lpString2="WPG") returned -1 [0116.240] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG") returned 61 [0116.240] lstrlenW (lpString=".dbf") returned 4 [0116.240] lstrcmpiW (lpString1=".dbf", lpString2=".WPG") returned -1 [0116.240] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG") returned 61 [0116.240] lstrlenW (lpString=".1cd") returned 4 [0116.240] lstrcmpiW (lpString1=".1cd", lpString2=".WPG") returned -1 [0116.240] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG") returned 61 [0116.240] lstrlenW (lpString=".jpg") returned 4 [0116.240] lstrcmpiW (lpString1=".jpg", lpString2=".WPG") returned -1 [0116.240] lstrcmpiW (lpString1=".DLL", lpString2=".waifu") returned -1 [0116.240] lstrlenW (lpString="ITIRCL55.DLL") returned 12 [0116.240] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\itircl55.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0116.249] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x391fc2c | out: lpFileSize=0x391fc2c*=1831424) returned 1 [0116.249] CloseHandle (hObject=0x1e4) returned 1 [0116.249] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\itircl55.dll")) returned 0x20 [0116.249] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\itircl55.dll.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0116.249] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\itircl55.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\itircl55.dll.id-9c354b42.[darknes@420blaze.it].waifu")) returned 1 [0116.352] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\itircl55.dll.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0116.352] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391f97c | out: lpNewFilePointer=0x0) returned 1 [0116.352] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391f93c | out: lpNewFilePointer=0x0) returned 1 [0116.352] ReadFile (in: hFile=0x1e4, lpBuffer=0x4340058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x391f948, lpOverlapped=0x0 | out: lpBuffer=0x4340058*, lpNumberOfBytesRead=0x391f948*=0x40000, lpOverlapped=0x0) returned 1 [0116.354] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x950aa, lpNewFilePointer=0x0, dwMoveMethod=0x391f93c | out: lpNewFilePointer=0x0) returned 1 [0116.355] ReadFile (in: hFile=0x1e4, lpBuffer=0x4380058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x391f948, lpOverlapped=0x0 | out: lpBuffer=0x4380058*, lpNumberOfBytesRead=0x391f948*=0x40000, lpOverlapped=0x0) returned 1 [0116.357] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x391f97c | out: lpNewFilePointer=0xffffffff) returned 1 [0116.357] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x17f200, lpNewFilePointer=0x0, dwMoveMethod=0x391f93c | out: lpNewFilePointer=0x0) returned 1 [0116.357] ReadFile (in: hFile=0x1e4, lpBuffer=0x43c0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x391f948, lpOverlapped=0x0 | out: lpBuffer=0x43c0058*, lpNumberOfBytesRead=0x391f948*=0x40000, lpOverlapped=0x0) returned 1 [0116.370] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fbd8 | out: lpNewFilePointer=0x0) returned 1 [0116.370] WriteFile (in: hFile=0x1e4, lpBuffer=0x4340020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x391f9c0, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesWritten=0x391f9c0*=0xc0104, lpOverlapped=0x0) returned 1 [0116.379] SetEndOfFile (hFile=0x1e4) returned 1 [0116.381] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391f98c | out: lpNewFilePointer=0x0) returned 1 [0116.381] WriteFile (in: hFile=0x1e4, lpBuffer=0x4554008*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x391f998, lpOverlapped=0x0 | out: lpBuffer=0x4554008*, lpNumberOfBytesWritten=0x391f998*=0x40000, lpOverlapped=0x0) returned 1 [0116.382] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x950aa, lpNewFilePointer=0x0, dwMoveMethod=0x391f98c | out: lpNewFilePointer=0x0) returned 1 [0116.382] WriteFile (in: hFile=0x1e4, lpBuffer=0x4554008*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x391f998, lpOverlapped=0x0 | out: lpBuffer=0x4554008*, lpNumberOfBytesWritten=0x391f998*=0x40000, lpOverlapped=0x0) returned 1 [0116.384] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x17f200, lpNewFilePointer=0x0, dwMoveMethod=0x391f98c | out: lpNewFilePointer=0x0) returned 1 [0116.384] WriteFile (in: hFile=0x1e4, lpBuffer=0x4554008*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x391f998, lpOverlapped=0x0 | out: lpBuffer=0x4554008*, lpNumberOfBytesWritten=0x391f998*=0x40000, lpOverlapped=0x0) returned 1 [0116.385] CloseHandle (hObject=0x1e4) returned 1 [0116.385] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0116.386] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL") returned 64 [0116.386] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL") returned 64 [0116.386] lstrlenW (lpString=".doc") returned 4 [0116.386] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0116.386] lstrlenW (lpString=".docx") returned 5 [0116.386] lstrcmpiW (lpString1=".docx", lpString2="5.DLL") returned -1 [0116.386] lstrlenW (lpString=".pdf") returned 4 [0116.386] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0116.386] lstrlenW (lpString=".xls") returned 4 [0116.386] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0116.386] lstrlenW (lpString=".xlsx") returned 5 [0116.386] lstrcmpiW (lpString1=".xlsx", lpString2="5.DLL") returned -1 [0116.386] lstrlenW (lpString=".ppt") returned 4 [0116.386] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0116.386] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL") returned 64 [0116.386] lstrlenW (lpString=".zip") returned 4 [0116.386] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0116.386] lstrlenW (lpString=".rar") returned 4 [0116.386] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0116.386] lstrlenW (lpString=".bz2") returned 4 [0116.386] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0116.386] lstrlenW (lpString=".7z") returned 3 [0116.386] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0116.386] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL") returned 64 [0116.386] lstrlenW (lpString=".dbf") returned 4 [0116.386] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0116.386] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL") returned 64 [0116.386] lstrlenW (lpString=".1cd") returned 4 [0116.386] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0116.386] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL") returned 64 [0116.386] lstrlenW (lpString=".jpg") returned 4 [0116.386] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0116.386] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL") returned 64 [0116.386] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL") returned 64 [0116.386] lstrlenW (lpString=".doc") returned 4 [0116.386] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0116.386] lstrlenW (lpString=".docx") returned 5 [0116.386] lstrcmpiW (lpString1=".docx", lpString2="5.DLL") returned -1 [0116.386] lstrlenW (lpString=".pdf") returned 4 [0116.386] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0116.386] lstrlenW (lpString=".xls") returned 4 [0116.386] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0116.386] lstrlenW (lpString=".xlsx") returned 5 [0116.386] lstrcmpiW (lpString1=".xlsx", lpString2="5.DLL") returned -1 [0116.386] lstrlenW (lpString=".ppt") returned 4 [0116.387] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0116.387] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL") returned 64 [0116.387] lstrlenW (lpString=".zip") returned 4 [0116.387] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0116.387] lstrlenW (lpString=".rar") returned 4 [0116.387] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0116.387] lstrlenW (lpString=".bz2") returned 4 [0116.387] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0116.387] lstrlenW (lpString=".7z") returned 3 [0116.387] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0116.387] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL") returned 64 [0116.387] lstrlenW (lpString=".dbf") returned 4 [0116.387] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0116.387] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL") returned 64 [0116.387] lstrlenW (lpString=".1cd") returned 4 [0116.387] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0116.387] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL") returned 64 [0116.387] lstrlenW (lpString=".jpg") returned 4 [0116.387] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0116.387] lstrcmpiW (lpString1=".mui", lpString2=".waifu") returned -1 [0116.387] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0116.387] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\el-gr\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0116.459] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x391fc2c | out: lpFileSize=0x391fc2c*=4096) returned 1 [0116.459] CloseHandle (hObject=0x16c) returned 1 [0116.459] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\el-gr\\tipresx.dll.mui")) returned 0x20 [0116.459] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\el-gr\\tipresx.dll.mui.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0116.459] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\el-gr\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0116.459] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui") returned 72 [0116.459] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui") returned 72 [0116.459] lstrlenW (lpString=".doc") returned 4 [0116.459] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0116.459] lstrlenW (lpString=".docx") returned 5 [0116.459] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0116.459] lstrlenW (lpString=".pdf") returned 4 [0116.459] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0116.459] lstrlenW (lpString=".xls") returned 4 [0116.459] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0116.459] lstrlenW (lpString=".xlsx") returned 5 [0116.459] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0116.459] lstrlenW (lpString=".ppt") returned 4 [0116.459] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0116.459] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui") returned 72 [0116.459] lstrlenW (lpString=".zip") returned 4 [0116.459] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0116.460] lstrlenW (lpString=".rar") returned 4 [0116.460] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0116.460] lstrlenW (lpString=".bz2") returned 4 [0116.460] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0116.460] lstrlenW (lpString=".7z") returned 3 [0116.460] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0116.460] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui") returned 72 [0116.460] lstrlenW (lpString=".dbf") returned 4 [0116.460] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0116.460] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui") returned 72 [0116.460] lstrlenW (lpString=".1cd") returned 4 [0116.460] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0116.460] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui") returned 72 [0116.460] lstrlenW (lpString=".jpg") returned 4 [0116.460] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0116.460] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui") returned 72 [0116.460] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui") returned 72 [0116.460] lstrlenW (lpString=".doc") returned 4 [0116.460] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0116.460] lstrlenW (lpString=".docx") returned 5 [0116.460] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0116.460] lstrlenW (lpString=".pdf") returned 4 [0116.460] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0116.460] lstrlenW (lpString=".xls") returned 4 [0116.460] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0116.460] lstrlenW (lpString=".xlsx") returned 5 [0116.460] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0116.460] lstrlenW (lpString=".ppt") returned 4 [0116.460] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0116.460] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui") returned 72 [0116.460] lstrlenW (lpString=".zip") returned 4 [0116.460] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0116.460] lstrlenW (lpString=".rar") returned 4 [0116.460] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0116.460] lstrlenW (lpString=".bz2") returned 4 [0116.460] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0116.460] lstrlenW (lpString=".7z") returned 3 [0116.460] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0116.460] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui") returned 72 [0116.460] lstrlenW (lpString=".dbf") returned 4 [0116.460] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0116.460] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui") returned 72 [0116.460] lstrlenW (lpString=".1cd") returned 4 [0116.460] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0116.460] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui") returned 72 [0116.460] lstrlenW (lpString=".jpg") returned 4 [0116.460] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0116.461] lstrcmpiW (lpString1=".mui", lpString2=".waifu") returned -1 [0116.461] lstrlenW (lpString="rtscom.dll.mui") returned 14 [0116.461] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\rtscom.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\rtscom.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0116.763] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x391fc2c | out: lpFileSize=0x391fc2c*=2560) returned 1 [0116.763] CloseHandle (hObject=0x180) returned 1 [0116.764] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\rtscom.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\rtscom.dll.mui")) returned 0x20 [0116.764] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\rtscom.dll.mui.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\rtscom.dll.mui.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0116.764] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\rtscom.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\rtscom.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0116.764] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\rtscom.dll.mui") returned 71 [0116.764] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\rtscom.dll.mui") returned 71 [0116.764] lstrlenW (lpString=".doc") returned 4 [0116.764] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0116.764] lstrlenW (lpString=".docx") returned 5 [0116.764] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0116.764] lstrlenW (lpString=".pdf") returned 4 [0116.764] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0116.764] lstrlenW (lpString=".xls") returned 4 [0116.764] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0116.764] lstrlenW (lpString=".xlsx") returned 5 [0116.764] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0116.764] lstrlenW (lpString=".ppt") returned 4 [0116.764] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0116.764] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\rtscom.dll.mui") returned 71 [0116.764] lstrlenW (lpString=".zip") returned 4 [0116.764] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0116.764] lstrlenW (lpString=".rar") returned 4 [0116.764] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0116.764] lstrlenW (lpString=".bz2") returned 4 [0116.764] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0116.764] lstrlenW (lpString=".7z") returned 3 [0116.764] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0116.764] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\rtscom.dll.mui") returned 71 [0116.764] lstrlenW (lpString=".dbf") returned 4 [0116.764] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0116.764] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\rtscom.dll.mui") returned 71 [0116.764] lstrlenW (lpString=".1cd") returned 4 [0116.764] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0116.764] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\rtscom.dll.mui") returned 71 [0116.764] lstrlenW (lpString=".jpg") returned 4 [0116.764] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0116.764] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\rtscom.dll.mui") returned 71 [0116.764] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\rtscom.dll.mui") returned 71 [0116.764] lstrlenW (lpString=".doc") returned 4 [0116.764] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0116.764] lstrlenW (lpString=".docx") returned 5 [0116.764] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0116.765] lstrlenW (lpString=".pdf") returned 4 [0116.765] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0116.765] lstrlenW (lpString=".xls") returned 4 [0116.765] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0116.765] lstrlenW (lpString=".xlsx") returned 5 [0116.765] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0116.765] lstrlenW (lpString=".ppt") returned 4 [0116.765] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0116.765] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\rtscom.dll.mui") returned 71 [0116.765] lstrlenW (lpString=".zip") returned 4 [0116.765] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0116.765] lstrlenW (lpString=".rar") returned 4 [0116.765] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0116.765] lstrlenW (lpString=".bz2") returned 4 [0116.765] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0116.765] lstrlenW (lpString=".7z") returned 3 [0116.765] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0116.765] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\rtscom.dll.mui") returned 71 [0116.765] lstrlenW (lpString=".dbf") returned 4 [0116.765] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0116.765] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\rtscom.dll.mui") returned 71 [0116.765] lstrlenW (lpString=".1cd") returned 4 [0116.765] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0116.765] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\rtscom.dll.mui") returned 71 [0116.765] lstrlenW (lpString=".jpg") returned 4 [0116.765] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0116.765] lstrcmpiW (lpString1=".mui", lpString2=".waifu") returned -1 [0116.765] lstrlenW (lpString="TipRes.dll.mui") returned 14 [0116.765] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipRes.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipres.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0116.765] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x391fc2c | out: lpFileSize=0x391fc2c*=32768) returned 1 [0116.765] CloseHandle (hObject=0x180) returned 1 [0116.765] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipRes.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipres.dll.mui")) returned 0x20 [0116.765] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipRes.dll.mui.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipres.dll.mui.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0116.766] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipRes.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipres.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0116.766] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipRes.dll.mui") returned 71 [0116.766] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipRes.dll.mui") returned 71 [0116.766] lstrlenW (lpString=".doc") returned 4 [0116.766] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0116.766] lstrlenW (lpString=".docx") returned 5 [0116.766] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0116.766] lstrlenW (lpString=".pdf") returned 4 [0116.766] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0116.766] lstrlenW (lpString=".xls") returned 4 [0116.766] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0116.766] lstrlenW (lpString=".xlsx") returned 5 [0116.766] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0116.766] lstrlenW (lpString=".ppt") returned 4 [0116.766] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0116.766] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipRes.dll.mui") returned 71 [0116.766] lstrlenW (lpString=".zip") returned 4 [0116.766] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0116.766] lstrlenW (lpString=".rar") returned 4 [0116.766] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0116.766] lstrlenW (lpString=".bz2") returned 4 [0116.766] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0116.766] lstrlenW (lpString=".7z") returned 3 [0116.766] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0116.766] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipRes.dll.mui") returned 71 [0116.766] lstrlenW (lpString=".dbf") returned 4 [0116.766] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0116.766] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipRes.dll.mui") returned 71 [0116.766] lstrlenW (lpString=".1cd") returned 4 [0116.766] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0116.766] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipRes.dll.mui") returned 71 [0116.766] lstrlenW (lpString=".jpg") returned 4 [0116.766] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0116.766] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipRes.dll.mui") returned 71 [0116.766] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipRes.dll.mui") returned 71 [0116.766] lstrlenW (lpString=".doc") returned 4 [0116.766] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0116.766] lstrlenW (lpString=".docx") returned 5 [0116.766] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0116.766] lstrlenW (lpString=".pdf") returned 4 [0116.766] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0116.766] lstrlenW (lpString=".xls") returned 4 [0116.766] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0116.766] lstrlenW (lpString=".xlsx") returned 5 [0116.766] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0116.766] lstrlenW (lpString=".ppt") returned 4 [0116.767] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0116.767] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipRes.dll.mui") returned 71 [0116.767] lstrlenW (lpString=".zip") returned 4 [0116.767] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0116.767] lstrlenW (lpString=".rar") returned 4 [0116.767] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0116.767] lstrlenW (lpString=".bz2") returned 4 [0116.767] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0116.767] lstrlenW (lpString=".7z") returned 3 [0116.767] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0116.767] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipRes.dll.mui") returned 71 [0116.767] lstrlenW (lpString=".dbf") returned 4 [0116.767] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0116.767] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipRes.dll.mui") returned 71 [0116.767] lstrlenW (lpString=".1cd") returned 4 [0116.767] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0116.767] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipRes.dll.mui") returned 71 [0116.767] lstrlenW (lpString=".jpg") returned 4 [0116.767] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0116.767] lstrcmpiW (lpString1=".mui", lpString2=".waifu") returned -1 [0116.767] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0116.767] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0116.767] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x391fc2c | out: lpFileSize=0x391fc2c*=3584) returned 1 [0116.767] CloseHandle (hObject=0x180) returned 1 [0116.767] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipresx.dll.mui")) returned 0x20 [0116.767] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tipresx.dll.mui.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipresx.dll.mui.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0116.767] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0116.767] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tipresx.dll.mui") returned 72 [0116.768] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tipresx.dll.mui") returned 72 [0116.768] lstrlenW (lpString=".doc") returned 4 [0116.768] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0116.768] lstrlenW (lpString=".docx") returned 5 [0116.768] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0116.768] lstrlenW (lpString=".pdf") returned 4 [0116.768] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0116.768] lstrlenW (lpString=".xls") returned 4 [0116.768] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0116.768] lstrlenW (lpString=".xlsx") returned 5 [0116.768] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0116.768] lstrlenW (lpString=".ppt") returned 4 [0116.768] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0116.768] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tipresx.dll.mui") returned 72 [0116.768] lstrlenW (lpString=".zip") returned 4 [0116.768] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0116.768] lstrlenW (lpString=".rar") returned 4 [0116.768] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0116.768] lstrlenW (lpString=".bz2") returned 4 [0116.768] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0116.768] lstrlenW (lpString=".7z") returned 3 [0116.768] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0116.768] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tipresx.dll.mui") returned 72 [0116.768] lstrlenW (lpString=".dbf") returned 4 [0116.768] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0116.768] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tipresx.dll.mui") returned 72 [0116.768] lstrlenW (lpString=".1cd") returned 4 [0116.768] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0116.768] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tipresx.dll.mui") returned 72 [0116.768] lstrlenW (lpString=".jpg") returned 4 [0116.768] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0116.768] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tipresx.dll.mui") returned 72 [0116.768] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tipresx.dll.mui") returned 72 [0116.768] lstrlenW (lpString=".doc") returned 4 [0116.768] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0116.768] lstrlenW (lpString=".docx") returned 5 [0116.768] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0116.768] lstrlenW (lpString=".pdf") returned 4 [0116.768] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0116.768] lstrlenW (lpString=".xls") returned 4 [0116.768] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0116.768] lstrlenW (lpString=".xlsx") returned 5 [0116.768] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0116.768] lstrlenW (lpString=".ppt") returned 4 [0116.768] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0116.768] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tipresx.dll.mui") returned 72 [0116.768] lstrlenW (lpString=".zip") returned 4 [0116.768] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0116.768] lstrlenW (lpString=".rar") returned 4 [0116.768] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0116.769] lstrlenW (lpString=".bz2") returned 4 [0116.769] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0116.769] lstrlenW (lpString=".7z") returned 3 [0116.769] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0116.769] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tipresx.dll.mui") returned 72 [0116.769] lstrlenW (lpString=".dbf") returned 4 [0116.769] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0116.769] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tipresx.dll.mui") returned 72 [0116.769] lstrlenW (lpString=".1cd") returned 4 [0116.769] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0116.769] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tipresx.dll.mui") returned 72 [0116.769] lstrlenW (lpString=".jpg") returned 4 [0116.769] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0116.769] lstrcmpiW (lpString1=".mui", lpString2=".waifu") returned -1 [0116.769] lstrlenW (lpString="TipTsf.dll.mui") returned 14 [0116.769] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipTsf.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tiptsf.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0116.769] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x391fc2c | out: lpFileSize=0x391fc2c*=3072) returned 1 [0116.769] CloseHandle (hObject=0x180) returned 1 [0116.769] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipTsf.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tiptsf.dll.mui")) returned 0x20 [0116.769] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipTsf.dll.mui.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tiptsf.dll.mui.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0116.769] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipTsf.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tiptsf.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0116.769] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipTsf.dll.mui") returned 71 [0116.769] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipTsf.dll.mui") returned 71 [0116.769] lstrlenW (lpString=".doc") returned 4 [0116.770] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0116.770] lstrlenW (lpString=".docx") returned 5 [0116.770] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0116.770] lstrlenW (lpString=".pdf") returned 4 [0116.770] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0116.770] lstrlenW (lpString=".xls") returned 4 [0116.770] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0116.770] lstrlenW (lpString=".xlsx") returned 5 [0116.770] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0116.770] lstrlenW (lpString=".ppt") returned 4 [0116.770] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0116.770] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipTsf.dll.mui") returned 71 [0116.770] lstrlenW (lpString=".zip") returned 4 [0116.770] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0116.770] lstrlenW (lpString=".rar") returned 4 [0116.770] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0116.770] lstrlenW (lpString=".bz2") returned 4 [0116.770] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0116.770] lstrlenW (lpString=".7z") returned 3 [0116.770] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0116.770] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipTsf.dll.mui") returned 71 [0116.770] lstrlenW (lpString=".dbf") returned 4 [0116.770] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0116.770] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipTsf.dll.mui") returned 71 [0116.770] lstrlenW (lpString=".1cd") returned 4 [0116.770] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0116.770] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipTsf.dll.mui") returned 71 [0116.770] lstrlenW (lpString=".jpg") returned 4 [0116.770] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0116.770] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipTsf.dll.mui") returned 71 [0116.770] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipTsf.dll.mui") returned 71 [0116.770] lstrlenW (lpString=".doc") returned 4 [0116.770] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0116.770] lstrlenW (lpString=".docx") returned 5 [0116.770] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0116.770] lstrlenW (lpString=".pdf") returned 4 [0116.770] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0116.770] lstrlenW (lpString=".xls") returned 4 [0116.770] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0116.770] lstrlenW (lpString=".xlsx") returned 5 [0116.770] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0116.770] lstrlenW (lpString=".ppt") returned 4 [0116.770] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0116.770] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipTsf.dll.mui") returned 71 [0116.770] lstrlenW (lpString=".zip") returned 4 [0116.770] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0116.770] lstrlenW (lpString=".rar") returned 4 [0116.770] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0116.770] lstrlenW (lpString=".bz2") returned 4 [0116.770] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0116.771] lstrlenW (lpString=".7z") returned 3 [0116.771] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0116.771] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipTsf.dll.mui") returned 71 [0116.771] lstrlenW (lpString=".dbf") returned 4 [0116.771] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0116.771] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipTsf.dll.mui") returned 71 [0116.771] lstrlenW (lpString=".1cd") returned 4 [0116.771] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0116.771] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipTsf.dll.mui") returned 71 [0116.771] lstrlenW (lpString=".jpg") returned 4 [0116.771] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0116.771] lstrcmpiW (lpString1=".mui", lpString2=".waifu") returned -1 [0116.771] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0116.771] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\es-es\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0116.771] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x391fc2c | out: lpFileSize=0x391fc2c*=4096) returned 1 [0116.771] CloseHandle (hObject=0x180) returned 1 [0116.771] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\es-es\\tipresx.dll.mui")) returned 0x20 [0116.771] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\tipresx.dll.mui.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\es-es\\tipresx.dll.mui.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0116.771] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\es-es\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0116.771] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\tipresx.dll.mui") returned 72 [0116.771] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\tipresx.dll.mui") returned 72 [0116.771] lstrlenW (lpString=".doc") returned 4 [0116.771] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0116.772] lstrlenW (lpString=".docx") returned 5 [0116.772] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0116.772] lstrlenW (lpString=".pdf") returned 4 [0116.772] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0116.772] lstrlenW (lpString=".xls") returned 4 [0116.772] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0116.772] lstrlenW (lpString=".xlsx") returned 5 [0116.772] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0116.772] lstrlenW (lpString=".ppt") returned 4 [0116.772] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0116.772] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\tipresx.dll.mui") returned 72 [0116.772] lstrlenW (lpString=".zip") returned 4 [0116.772] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0116.772] lstrlenW (lpString=".rar") returned 4 [0116.772] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0116.772] lstrlenW (lpString=".bz2") returned 4 [0116.772] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0116.772] lstrlenW (lpString=".7z") returned 3 [0116.772] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0116.772] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\tipresx.dll.mui") returned 72 [0116.772] lstrlenW (lpString=".dbf") returned 4 [0116.772] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0116.781] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkObj.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkobj.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkObj.dll.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkobj.dll.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0 [0116.786] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\micaut.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\micaut.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\micaut.dll.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\micaut.dll.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0 [0116.786] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mraut.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mraut.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mraut.dll.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mraut.dll.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0 [0116.798] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fbd8 | out: lpNewFilePointer=0x0) returned 1 [0116.798] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fbd8 | out: lpNewFilePointer=0x0) returned 1 [0116.798] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\msclientdatamgr\\mscdm.dll.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0116.798] GetLastError () returned 0x0 [0116.798] ReadFile (in: hFile=0x180, lpBuffer=0x4340020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fbe4, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesRead=0x391fbe4*=0x665a0, lpOverlapped=0x0) returned 1 [0117.326] WriteFile (in: hFile=0x1c0, lpBuffer=0x4340020*, nNumberOfBytesToWrite=0x665b0, lpNumberOfBytesWritten=0x391f9ac, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesWritten=0x391f9ac*=0x665b0, lpOverlapped=0x0) returned 1 [0117.519] ReadFile (in: hFile=0x180, lpBuffer=0x4340020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fbe4, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesRead=0x391fbe4*=0x0, lpOverlapped=0x0) returned 1 [0117.519] WriteFile (in: hFile=0x1c0, lpBuffer=0x4340020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x391f9ac, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesWritten=0x391f9ac*=0xe6, lpOverlapped=0x0) returned 1 [0117.524] SetEndOfFile (hFile=0x1c0) returned 1 [0117.524] CloseHandle (hObject=0x1c0) returned 1 [0117.524] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fbd8 | out: lpNewFilePointer=0x0) returned 1 [0117.524] SetEndOfFile (hFile=0x180) returned 1 [0117.525] CloseHandle (hObject=0x180) returned 1 [0117.526] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0117.526] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\msclientdatamgr\\mscdm.dll")) returned 1 [0117.526] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL") returned 72 [0117.526] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL") returned 72 [0117.526] lstrlenW (lpString=".doc") returned 4 [0117.526] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0117.526] lstrlenW (lpString=".docx") returned 5 [0117.526] lstrcmpiW (lpString1=".docx", lpString2="M.DLL") returned -1 [0117.526] lstrlenW (lpString=".pdf") returned 4 [0117.526] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0117.526] lstrlenW (lpString=".xls") returned 4 [0117.526] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0117.526] lstrlenW (lpString=".xlsx") returned 5 [0117.526] lstrcmpiW (lpString1=".xlsx", lpString2="M.DLL") returned -1 [0117.526] lstrlenW (lpString=".ppt") returned 4 [0117.526] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0117.526] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL") returned 72 [0117.526] lstrlenW (lpString=".zip") returned 4 [0117.526] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0117.526] lstrlenW (lpString=".rar") returned 4 [0117.526] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0117.526] lstrlenW (lpString=".bz2") returned 4 [0117.526] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0117.526] lstrlenW (lpString=".7z") returned 3 [0117.527] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0117.527] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL") returned 72 [0117.527] lstrlenW (lpString=".dbf") returned 4 [0117.527] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0117.527] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL") returned 72 [0117.527] lstrlenW (lpString=".1cd") returned 4 [0117.527] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0117.527] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL") returned 72 [0117.527] lstrlenW (lpString=".jpg") returned 4 [0117.527] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0117.527] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL") returned 72 [0117.527] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL") returned 72 [0117.527] lstrlenW (lpString=".doc") returned 4 [0117.527] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0117.527] lstrlenW (lpString=".docx") returned 5 [0117.527] lstrcmpiW (lpString1=".docx", lpString2="M.DLL") returned -1 [0117.527] lstrlenW (lpString=".pdf") returned 4 [0117.527] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0117.527] lstrlenW (lpString=".xls") returned 4 [0117.527] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0117.527] lstrlenW (lpString=".xlsx") returned 5 [0117.527] lstrcmpiW (lpString1=".xlsx", lpString2="M.DLL") returned -1 [0117.527] lstrlenW (lpString=".ppt") returned 4 [0117.527] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0117.527] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL") returned 72 [0117.527] lstrlenW (lpString=".zip") returned 4 [0117.527] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0117.527] lstrlenW (lpString=".rar") returned 4 [0117.527] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0117.527] lstrlenW (lpString=".bz2") returned 4 [0117.527] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0117.527] lstrlenW (lpString=".7z") returned 3 [0117.527] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0117.527] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL") returned 72 [0117.527] lstrlenW (lpString=".dbf") returned 4 [0117.527] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0117.527] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL") returned 72 [0117.527] lstrlenW (lpString=".1cd") returned 4 [0117.527] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0117.527] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL") returned 72 [0117.527] lstrlenW (lpString=".jpg") returned 4 [0117.527] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0117.527] lstrcmpiW (lpString1=".dll", lpString2=".waifu") returned -1 [0117.527] lstrlenW (lpString="xlsrvintl.dll") returned 13 [0117.528] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\xlsrvintl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0117.946] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x391fc2c | out: lpFileSize=0x391fc2c*=105344) returned 1 [0117.946] CloseHandle (hObject=0x1e4) returned 1 [0117.946] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\xlsrvintl.dll")) returned 0x20 [0117.946] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\xlsrvintl.dll.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0117.946] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\xlsrvintl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0117.946] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fbd8 | out: lpNewFilePointer=0x0) returned 1 [0117.946] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fbd8 | out: lpNewFilePointer=0x0) returned 1 [0117.946] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\xlsrvintl.dll.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0117.947] GetLastError () returned 0x0 [0117.947] ReadFile (in: hFile=0x1e4, lpBuffer=0x4340020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fbe4, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesRead=0x391fbe4*=0x19b80, lpOverlapped=0x0) returned 1 [0118.159] WriteFile (in: hFile=0x1fc, lpBuffer=0x4340020*, nNumberOfBytesToWrite=0x19b90, lpNumberOfBytesWritten=0x391f9ac, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesWritten=0x391f9ac*=0x19b90, lpOverlapped=0x0) returned 1 [0118.160] ReadFile (in: hFile=0x1e4, lpBuffer=0x4340020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fbe4, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesRead=0x391fbe4*=0x0, lpOverlapped=0x0) returned 1 [0118.160] WriteFile (in: hFile=0x1fc, lpBuffer=0x4340020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x391f9ac, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesWritten=0x391f9ac*=0xee, lpOverlapped=0x0) returned 1 [0118.160] SetEndOfFile (hFile=0x1fc) returned 1 [0118.160] CloseHandle (hObject=0x1fc) returned 1 [0118.160] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fbd8 | out: lpNewFilePointer=0x0) returned 1 [0118.160] SetEndOfFile (hFile=0x1e4) returned 1 [0118.161] CloseHandle (hObject=0x1e4) returned 1 [0118.161] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0118.161] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\xlsrvintl.dll")) returned 1 [0118.161] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll") returned 74 [0118.162] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll") returned 74 [0118.162] lstrlenW (lpString=".doc") returned 4 [0118.162] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0118.162] lstrlenW (lpString=".docx") returned 5 [0118.162] lstrcmpiW (lpString1=".docx", lpString2="l.dll") returned -1 [0118.162] lstrlenW (lpString=".pdf") returned 4 [0118.162] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0118.162] lstrlenW (lpString=".xls") returned 4 [0118.162] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0118.162] lstrlenW (lpString=".xlsx") returned 5 [0118.162] lstrcmpiW (lpString1=".xlsx", lpString2="l.dll") returned -1 [0118.162] lstrlenW (lpString=".ppt") returned 4 [0118.162] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0118.162] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll") returned 74 [0118.162] lstrlenW (lpString=".zip") returned 4 [0118.162] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0118.162] lstrlenW (lpString=".rar") returned 4 [0118.162] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0118.162] lstrlenW (lpString=".bz2") returned 4 [0118.162] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0118.162] lstrlenW (lpString=".7z") returned 3 [0118.162] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0118.162] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll") returned 74 [0118.162] lstrlenW (lpString=".dbf") returned 4 [0118.162] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0118.162] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll") returned 74 [0118.162] lstrlenW (lpString=".1cd") returned 4 [0118.162] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0118.162] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll") returned 74 [0118.162] lstrlenW (lpString=".jpg") returned 4 [0118.162] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0118.162] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll") returned 74 [0118.162] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll") returned 74 [0118.162] lstrlenW (lpString=".doc") returned 4 [0118.162] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0118.162] lstrlenW (lpString=".docx") returned 5 [0118.162] lstrcmpiW (lpString1=".docx", lpString2="l.dll") returned -1 [0118.162] lstrlenW (lpString=".pdf") returned 4 [0118.162] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0118.162] lstrlenW (lpString=".xls") returned 4 [0118.162] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0118.162] lstrlenW (lpString=".xlsx") returned 5 [0118.162] lstrcmpiW (lpString1=".xlsx", lpString2="l.dll") returned -1 [0118.162] lstrlenW (lpString=".ppt") returned 4 [0118.162] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0118.162] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll") returned 74 [0118.162] lstrlenW (lpString=".zip") returned 4 [0118.162] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0118.162] lstrlenW (lpString=".rar") returned 4 [0118.162] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0118.163] lstrlenW (lpString=".bz2") returned 4 [0118.163] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0118.163] lstrlenW (lpString=".7z") returned 3 [0118.163] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0118.163] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll") returned 74 [0118.163] lstrlenW (lpString=".dbf") returned 4 [0118.163] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0118.163] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll") returned 74 [0118.163] lstrlenW (lpString=".1cd") returned 4 [0118.163] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0118.163] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll") returned 74 [0118.163] lstrlenW (lpString=".jpg") returned 4 [0118.163] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0118.163] lstrcmpiW (lpString1=".DLL", lpString2=".waifu") returned -1 [0118.163] lstrlenW (lpString="ACEERR.DLL") returned 10 [0118.163] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceerr.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0118.491] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x391fc2c | out: lpFileSize=0x391fc2c*=43408) returned 1 [0118.491] CloseHandle (hObject=0x20c) returned 1 [0118.491] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceerr.dll")) returned 0x20 [0118.491] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceerr.dll.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0118.491] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceerr.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0118.491] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fbd8 | out: lpNewFilePointer=0x0) returned 1 [0118.491] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fbd8 | out: lpNewFilePointer=0x0) returned 1 [0118.491] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceerr.dll.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0118.492] GetLastError () returned 0x0 [0118.492] ReadFile (in: hFile=0x20c, lpBuffer=0x4340020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fbe4, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesRead=0x391fbe4*=0xa990, lpOverlapped=0x0) returned 1 [0118.785] WriteFile (in: hFile=0x19c, lpBuffer=0x4340020*, nNumberOfBytesToWrite=0xa9a0, lpNumberOfBytesWritten=0x391f9ac, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesWritten=0x391f9ac*=0xa9a0, lpOverlapped=0x0) returned 1 [0118.911] ReadFile (in: hFile=0x20c, lpBuffer=0x4340020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fbe4, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesRead=0x391fbe4*=0x0, lpOverlapped=0x0) returned 1 [0118.911] WriteFile (in: hFile=0x19c, lpBuffer=0x4340020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x391f9ac, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesWritten=0x391f9ac*=0xe8, lpOverlapped=0x0) returned 1 [0118.912] SetEndOfFile (hFile=0x19c) returned 1 [0118.912] CloseHandle (hObject=0x19c) returned 1 [0118.912] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fbd8 | out: lpNewFilePointer=0x0) returned 1 [0118.912] SetEndOfFile (hFile=0x20c) returned 1 [0118.912] CloseHandle (hObject=0x20c) returned 1 [0118.912] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0118.935] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceerr.dll")) returned 1 [0118.935] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL") returned 66 [0118.935] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL") returned 66 [0118.935] lstrlenW (lpString=".doc") returned 4 [0118.935] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0118.935] lstrlenW (lpString=".docx") returned 5 [0118.935] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1 [0118.936] lstrlenW (lpString=".pdf") returned 4 [0118.936] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0118.936] lstrlenW (lpString=".xls") returned 4 [0118.936] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0118.936] lstrlenW (lpString=".xlsx") returned 5 [0118.936] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1 [0118.936] lstrlenW (lpString=".ppt") returned 4 [0118.936] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0118.936] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL") returned 66 [0118.936] lstrlenW (lpString=".zip") returned 4 [0118.936] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0118.936] lstrlenW (lpString=".rar") returned 4 [0118.936] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0118.936] lstrlenW (lpString=".bz2") returned 4 [0118.936] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0118.936] lstrlenW (lpString=".7z") returned 3 [0118.936] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0118.936] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL") returned 66 [0118.936] lstrlenW (lpString=".dbf") returned 4 [0118.936] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0118.936] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL") returned 66 [0118.936] lstrlenW (lpString=".1cd") returned 4 [0118.936] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0118.936] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL") returned 66 [0118.936] lstrlenW (lpString=".jpg") returned 4 [0118.936] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0118.936] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL") returned 66 [0118.936] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL") returned 66 [0118.936] lstrlenW (lpString=".doc") returned 4 [0118.936] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0118.936] lstrlenW (lpString=".docx") returned 5 [0118.936] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1 [0118.936] lstrlenW (lpString=".pdf") returned 4 [0118.936] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0118.936] lstrlenW (lpString=".xls") returned 4 [0118.936] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0118.936] lstrlenW (lpString=".xlsx") returned 5 [0118.936] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1 [0118.936] lstrlenW (lpString=".ppt") returned 4 [0118.936] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0118.936] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL") returned 66 [0118.936] lstrlenW (lpString=".zip") returned 4 [0118.936] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0118.936] lstrlenW (lpString=".rar") returned 4 [0118.936] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0118.936] lstrlenW (lpString=".bz2") returned 4 [0118.936] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0118.936] lstrlenW (lpString=".7z") returned 3 [0118.936] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0118.937] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL") returned 66 [0118.937] lstrlenW (lpString=".dbf") returned 4 [0118.937] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0118.937] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL") returned 66 [0118.937] lstrlenW (lpString=".1cd") returned 4 [0118.937] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0118.937] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL") returned 66 [0118.937] lstrlenW (lpString=".jpg") returned 4 [0118.937] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0118.937] lstrcmpiW (lpString1=".DLL", lpString2=".waifu") returned -1 [0118.937] lstrlenW (lpString="ACEODDBS.DLL") returned 12 [0118.937] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceoddbs.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0119.272] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x391fc2c | out: lpFileSize=0x391fc2c*=15800) returned 1 [0119.272] CloseHandle (hObject=0x218) returned 1 [0119.272] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceoddbs.dll")) returned 0x20 [0119.272] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceoddbs.dll.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0119.272] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceoddbs.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0119.272] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fbd8 | out: lpNewFilePointer=0x0) returned 1 [0119.273] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fbd8 | out: lpNewFilePointer=0x0) returned 1 [0119.273] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceoddbs.dll.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0119.273] GetLastError () returned 0x0 [0119.273] ReadFile (in: hFile=0x218, lpBuffer=0x4340020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fbe4, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesRead=0x391fbe4*=0x3db8, lpOverlapped=0x0) returned 1 [0119.342] WriteFile (in: hFile=0x1e4, lpBuffer=0x4340020*, nNumberOfBytesToWrite=0x3dc0, lpNumberOfBytesWritten=0x391f9ac, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesWritten=0x391f9ac*=0x3dc0, lpOverlapped=0x0) returned 1 [0119.343] ReadFile (in: hFile=0x218, lpBuffer=0x4340020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fbe4, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesRead=0x391fbe4*=0x0, lpOverlapped=0x0) returned 1 [0119.343] WriteFile (in: hFile=0x1e4, lpBuffer=0x4340020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x391f9ac, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesWritten=0x391f9ac*=0xec, lpOverlapped=0x0) returned 1 [0119.343] SetEndOfFile (hFile=0x1e4) returned 1 [0119.343] CloseHandle (hObject=0x1e4) returned 1 [0119.343] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fbd8 | out: lpNewFilePointer=0x0) returned 1 [0119.343] SetEndOfFile (hFile=0x218) returned 1 [0119.344] CloseHandle (hObject=0x218) returned 1 [0119.344] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0119.344] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceoddbs.dll")) returned 1 [0119.344] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL") returned 68 [0119.344] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL") returned 68 [0119.344] lstrlenW (lpString=".doc") returned 4 [0119.344] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0119.344] lstrlenW (lpString=".docx") returned 5 [0119.344] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0119.344] lstrlenW (lpString=".pdf") returned 4 [0119.344] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0119.344] lstrlenW (lpString=".xls") returned 4 [0119.344] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0119.344] lstrlenW (lpString=".xlsx") returned 5 [0119.344] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0119.344] lstrlenW (lpString=".ppt") returned 4 [0119.344] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0119.344] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL") returned 68 [0119.345] lstrlenW (lpString=".zip") returned 4 [0119.345] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0119.345] lstrlenW (lpString=".rar") returned 4 [0119.345] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0119.345] lstrlenW (lpString=".bz2") returned 4 [0119.345] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0119.345] lstrlenW (lpString=".7z") returned 3 [0119.345] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0119.345] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL") returned 68 [0119.345] lstrlenW (lpString=".dbf") returned 4 [0119.345] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0119.345] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL") returned 68 [0119.345] lstrlenW (lpString=".1cd") returned 4 [0119.345] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0119.345] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL") returned 68 [0119.345] lstrlenW (lpString=".jpg") returned 4 [0119.345] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0119.345] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL") returned 68 [0119.345] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL") returned 68 [0119.345] lstrlenW (lpString=".doc") returned 4 [0119.345] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0119.345] lstrlenW (lpString=".docx") returned 5 [0119.345] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0119.345] lstrlenW (lpString=".pdf") returned 4 [0119.345] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0119.345] lstrlenW (lpString=".xls") returned 4 [0119.345] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0119.345] lstrlenW (lpString=".xlsx") returned 5 [0119.345] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0119.345] lstrlenW (lpString=".ppt") returned 4 [0119.345] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0119.345] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL") returned 68 [0119.345] lstrlenW (lpString=".zip") returned 4 [0119.345] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0119.345] lstrlenW (lpString=".rar") returned 4 [0119.345] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0119.345] lstrlenW (lpString=".bz2") returned 4 [0119.345] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0119.345] lstrlenW (lpString=".7z") returned 3 [0119.345] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0119.345] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL") returned 68 [0119.345] lstrlenW (lpString=".dbf") returned 4 [0119.345] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0119.345] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL") returned 68 [0119.345] lstrlenW (lpString=".1cd") returned 4 [0119.345] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0119.345] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL") returned 68 [0119.345] lstrlenW (lpString=".jpg") returned 4 [0119.345] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0119.346] lstrcmpiW (lpString1=".DLL", lpString2=".waifu") returned -1 [0119.346] lstrlenW (lpString="ACEWDAT.DLL") returned 11 [0119.346] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWDAT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acewdat.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0119.346] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x391fc2c | out: lpFileSize=0x391fc2c*=3050912) returned 1 [0119.346] CloseHandle (hObject=0x218) returned 1 [0119.346] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWDAT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acewdat.dll")) returned 0x20 [0119.346] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWDAT.DLL.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acewdat.dll.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0119.346] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWDAT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acewdat.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWDAT.DLL.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acewdat.dll.id-9c354b42.[darknes@420blaze.it].waifu")) returned 1 [0119.347] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWDAT.DLL.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acewdat.dll.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0119.347] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391f97c | out: lpNewFilePointer=0x0) returned 1 [0119.347] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391f93c | out: lpNewFilePointer=0x0) returned 1 [0119.347] ReadFile (in: hFile=0x218, lpBuffer=0x4340058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x391f948, lpOverlapped=0x0 | out: lpBuffer=0x4340058*, lpNumberOfBytesRead=0x391f948*=0x40000, lpOverlapped=0x0) returned 1 [0119.501] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0xf848a, lpNewFilePointer=0x0, dwMoveMethod=0x391f93c | out: lpNewFilePointer=0x0) returned 1 [0119.501] ReadFile (in: hFile=0x218, lpBuffer=0x4380058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x391f948, lpOverlapped=0x0 | out: lpBuffer=0x4380058*, lpNumberOfBytesRead=0x391f948*=0x40000, lpOverlapped=0x0) returned 1 [0119.563] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x391f97c | out: lpNewFilePointer=0xffffffff) returned 1 [0119.563] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x2a8da0, lpNewFilePointer=0x0, dwMoveMethod=0x391f93c | out: lpNewFilePointer=0x0) returned 1 [0119.563] ReadFile (in: hFile=0x218, lpBuffer=0x43c0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x391f948, lpOverlapped=0x0 | out: lpBuffer=0x43c0058*, lpNumberOfBytesRead=0x391f948*=0x40000, lpOverlapped=0x0) returned 1 [0119.635] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fbd8 | out: lpNewFilePointer=0x0) returned 1 [0119.636] WriteFile (in: hFile=0x218, lpBuffer=0x4340020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x391f9c0, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesWritten=0x391f9c0*=0xc0102, lpOverlapped=0x0) returned 1 [0119.644] SetEndOfFile (hFile=0x218) returned 1 [0119.644] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391f98c | out: lpNewFilePointer=0x0) returned 1 [0119.644] WriteFile (in: hFile=0x218, lpBuffer=0x44c2078*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x391f998, lpOverlapped=0x0 | out: lpBuffer=0x44c2078*, lpNumberOfBytesWritten=0x391f998*=0x40000, lpOverlapped=0x0) returned 1 [0119.645] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0xf848a, lpNewFilePointer=0x0, dwMoveMethod=0x391f98c | out: lpNewFilePointer=0x0) returned 1 [0119.645] WriteFile (in: hFile=0x218, lpBuffer=0x44c2078*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x391f998, lpOverlapped=0x0 | out: lpBuffer=0x44c2078*, lpNumberOfBytesWritten=0x391f998*=0x40000, lpOverlapped=0x0) returned 1 [0119.649] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x2a8da0, lpNewFilePointer=0x0, dwMoveMethod=0x391f98c | out: lpNewFilePointer=0x0) returned 1 [0119.650] WriteFile (in: hFile=0x218, lpBuffer=0x44c2078*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x391f998, lpOverlapped=0x0 | out: lpBuffer=0x44c2078*, lpNumberOfBytesWritten=0x391f998*=0x40000, lpOverlapped=0x0) returned 1 [0119.651] CloseHandle (hObject=0x218) returned 1 [0119.651] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWDAT.DLL.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0119.651] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWDAT.DLL") returned 67 [0119.651] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWDAT.DLL") returned 67 [0119.651] lstrlenW (lpString=".doc") returned 4 [0119.651] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0119.651] lstrlenW (lpString=".docx") returned 5 [0119.651] lstrcmpiW (lpString1=".docx", lpString2="T.DLL") returned -1 [0119.652] lstrlenW (lpString=".pdf") returned 4 [0119.652] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0119.652] lstrlenW (lpString=".xls") returned 4 [0119.652] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0119.652] lstrlenW (lpString=".xlsx") returned 5 [0119.652] lstrcmpiW (lpString1=".xlsx", lpString2="T.DLL") returned -1 [0119.652] lstrlenW (lpString=".ppt") returned 4 [0119.652] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0119.652] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWDAT.DLL") returned 67 [0119.652] lstrlenW (lpString=".zip") returned 4 [0119.652] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0119.652] lstrlenW (lpString=".rar") returned 4 [0119.652] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0119.652] lstrlenW (lpString=".bz2") returned 4 [0119.652] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0119.652] lstrlenW (lpString=".7z") returned 3 [0119.652] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0119.652] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWDAT.DLL") returned 67 [0119.652] lstrlenW (lpString=".dbf") returned 4 [0119.652] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0119.652] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWDAT.DLL") returned 67 [0119.652] lstrlenW (lpString=".1cd") returned 4 [0119.652] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0119.652] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWDAT.DLL") returned 67 [0119.652] lstrlenW (lpString=".jpg") returned 4 [0119.652] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0119.652] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWDAT.DLL") returned 67 [0119.652] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWDAT.DLL") returned 67 [0119.652] lstrlenW (lpString=".doc") returned 4 [0119.652] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0119.652] lstrlenW (lpString=".docx") returned 5 [0119.652] lstrcmpiW (lpString1=".docx", lpString2="T.DLL") returned -1 [0119.652] lstrlenW (lpString=".pdf") returned 4 [0119.652] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0119.652] lstrlenW (lpString=".xls") returned 4 [0119.652] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0119.652] lstrlenW (lpString=".xlsx") returned 5 [0119.652] lstrcmpiW (lpString1=".xlsx", lpString2="T.DLL") returned -1 [0119.652] lstrlenW (lpString=".ppt") returned 4 [0119.652] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0119.652] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWDAT.DLL") returned 67 [0119.652] lstrlenW (lpString=".zip") returned 4 [0119.652] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0119.652] lstrlenW (lpString=".rar") returned 4 [0119.652] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0119.652] lstrlenW (lpString=".bz2") returned 4 [0119.652] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0119.652] lstrlenW (lpString=".7z") returned 3 [0119.652] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0119.653] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWDAT.DLL") returned 67 [0119.653] lstrlenW (lpString=".dbf") returned 4 [0119.653] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0119.653] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWDAT.DLL") returned 67 [0119.653] lstrlenW (lpString=".1cd") returned 4 [0119.653] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0119.653] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWDAT.DLL") returned 67 [0119.653] lstrlenW (lpString=".jpg") returned 4 [0119.653] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0119.653] lstrcmpiW (lpString1=".DLL", lpString2=".waifu") returned -1 [0119.653] lstrlenW (lpString="EXP_XPS.DLL") returned 11 [0119.653] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_XPS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\exp_xps.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0119.654] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x391fc2c | out: lpFileSize=0x391fc2c*=71032) returned 1 [0119.654] CloseHandle (hObject=0x218) returned 1 [0119.654] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_XPS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\exp_xps.dll")) returned 0x20 [0119.654] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_XPS.DLL.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\exp_xps.dll.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0119.654] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_XPS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\exp_xps.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0119.654] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fbd8 | out: lpNewFilePointer=0x0) returned 1 [0119.654] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fbd8 | out: lpNewFilePointer=0x0) returned 1 [0119.654] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_XPS.DLL.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\exp_xps.dll.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0119.655] GetLastError () returned 0x0 [0119.655] ReadFile (in: hFile=0x218, lpBuffer=0x4340020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fbe4, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesRead=0x391fbe4*=0x11578, lpOverlapped=0x0) returned 1 [0119.752] WriteFile (in: hFile=0x16c, lpBuffer=0x4340020*, nNumberOfBytesToWrite=0x11580, lpNumberOfBytesWritten=0x391f9ac, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesWritten=0x391f9ac*=0x11580, lpOverlapped=0x0) returned 1 [0119.753] ReadFile (in: hFile=0x218, lpBuffer=0x4340020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fbe4, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesRead=0x391fbe4*=0x0, lpOverlapped=0x0) returned 1 [0119.753] WriteFile (in: hFile=0x16c, lpBuffer=0x4340020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x391f9ac, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesWritten=0x391f9ac*=0xea, lpOverlapped=0x0) returned 1 [0119.754] SetEndOfFile (hFile=0x16c) returned 1 [0119.754] CloseHandle (hObject=0x16c) returned 1 [0119.754] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fbd8 | out: lpNewFilePointer=0x0) returned 1 [0119.754] SetEndOfFile (hFile=0x218) returned 1 [0119.754] CloseHandle (hObject=0x218) returned 1 [0119.754] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_XPS.DLL.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0119.755] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_XPS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\exp_xps.dll")) returned 1 [0119.755] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_XPS.DLL") returned 67 [0119.755] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_XPS.DLL") returned 67 [0119.755] lstrlenW (lpString=".doc") returned 4 [0119.755] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0119.755] lstrlenW (lpString=".docx") returned 5 [0119.755] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0119.755] lstrlenW (lpString=".pdf") returned 4 [0119.755] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0119.755] lstrlenW (lpString=".xls") returned 4 [0119.755] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0119.755] lstrlenW (lpString=".xlsx") returned 5 [0119.755] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0119.755] lstrlenW (lpString=".ppt") returned 4 [0119.755] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0119.755] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_XPS.DLL") returned 67 [0119.755] lstrlenW (lpString=".zip") returned 4 [0119.755] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0119.755] lstrlenW (lpString=".rar") returned 4 [0119.755] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0119.755] lstrlenW (lpString=".bz2") returned 4 [0119.755] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0119.755] lstrlenW (lpString=".7z") returned 3 [0119.755] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0119.755] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_XPS.DLL") returned 67 [0119.755] lstrlenW (lpString=".dbf") returned 4 [0119.755] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0119.755] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_XPS.DLL") returned 67 [0119.755] lstrlenW (lpString=".1cd") returned 4 [0119.755] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0119.755] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_XPS.DLL") returned 67 [0119.755] lstrlenW (lpString=".jpg") returned 4 [0119.755] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0119.755] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_XPS.DLL") returned 67 [0119.755] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_XPS.DLL") returned 67 [0119.756] lstrlenW (lpString=".doc") returned 4 [0119.756] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0119.756] lstrlenW (lpString=".docx") returned 5 [0119.756] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0119.756] lstrlenW (lpString=".pdf") returned 4 [0119.756] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0119.756] lstrlenW (lpString=".xls") returned 4 [0119.756] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0119.756] lstrlenW (lpString=".xlsx") returned 5 [0119.756] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0119.756] lstrlenW (lpString=".ppt") returned 4 [0119.756] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0119.756] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_XPS.DLL") returned 67 [0119.756] lstrlenW (lpString=".zip") returned 4 [0119.756] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0119.756] lstrlenW (lpString=".rar") returned 4 [0119.756] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0119.756] lstrlenW (lpString=".bz2") returned 4 [0119.756] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0119.756] lstrlenW (lpString=".7z") returned 3 [0119.756] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0119.756] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_XPS.DLL") returned 67 [0119.756] lstrlenW (lpString=".dbf") returned 4 [0119.756] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0119.756] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_XPS.DLL") returned 67 [0119.756] lstrlenW (lpString=".1cd") returned 4 [0119.756] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0119.756] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_XPS.DLL") returned 67 [0119.756] lstrlenW (lpString=".jpg") returned 4 [0119.756] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0119.756] lstrcmpiW (lpString1=".DLL", lpString2=".waifu") returned -1 [0119.756] lstrlenW (lpString="IACOM2.DLL") returned 10 [0119.756] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\IACOM2.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\iacom2.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0119.772] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x391fc2c | out: lpFileSize=0x391fc2c*=4289376) returned 1 [0119.773] CloseHandle (hObject=0x16c) returned 1 [0119.773] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\IACOM2.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\iacom2.dll")) returned 0x20 [0119.773] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\IACOM2.DLL.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\iacom2.dll.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0119.773] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\IACOM2.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\iacom2.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\IACOM2.DLL.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\iacom2.dll.id-9c354b42.[darknes@420blaze.it].waifu")) returned 1 [0119.773] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\IACOM2.DLL.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\iacom2.dll.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0119.774] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391f97c | out: lpNewFilePointer=0x0) returned 1 [0119.774] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391f93c | out: lpNewFilePointer=0x0) returned 1 [0119.774] ReadFile (in: hFile=0x16c, lpBuffer=0x4340058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x391f948, lpOverlapped=0x0 | out: lpBuffer=0x4340058*, lpNumberOfBytesRead=0x391f948*=0x40000, lpOverlapped=0x0) returned 1 [0119.842] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x15d120, lpNewFilePointer=0x0, dwMoveMethod=0x391f93c | out: lpNewFilePointer=0x0) returned 1 [0119.842] ReadFile (in: hFile=0x16c, lpBuffer=0x4380058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x391f948, lpOverlapped=0x0 | out: lpBuffer=0x4380058*, lpNumberOfBytesRead=0x391f948*=0x40000, lpOverlapped=0x0) returned 1 [0120.174] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x391f97c | out: lpNewFilePointer=0xffffffff) returned 1 [0120.174] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x3d7360, lpNewFilePointer=0x0, dwMoveMethod=0x391f93c | out: lpNewFilePointer=0x0) returned 1 [0120.174] ReadFile (in: hFile=0x16c, lpBuffer=0x43c0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x391f948, lpOverlapped=0x0 | out: lpBuffer=0x43c0058*, lpNumberOfBytesRead=0x391f948*=0x40000, lpOverlapped=0x0) returned 1 [0120.356] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fbd8 | out: lpNewFilePointer=0x0) returned 1 [0120.356] WriteFile (in: hFile=0x16c, lpBuffer=0x4340020*, nNumberOfBytesToWrite=0xc0100, lpNumberOfBytesWritten=0x391f9c0, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesWritten=0x391f9c0*=0xc0100, lpOverlapped=0x0) returned 1 [0120.425] SetEndOfFile (hFile=0x16c) returned 1 [0120.425] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391f98c | out: lpNewFilePointer=0x0) returned 1 [0120.425] WriteFile (in: hFile=0x16c, lpBuffer=0x44c2078*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x391f998, lpOverlapped=0x0 | out: lpBuffer=0x44c2078*, lpNumberOfBytesWritten=0x391f998*=0x40000, lpOverlapped=0x0) returned 1 [0120.426] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x15d120, lpNewFilePointer=0x0, dwMoveMethod=0x391f98c | out: lpNewFilePointer=0x0) returned 1 [0120.426] WriteFile (in: hFile=0x16c, lpBuffer=0x44c2078*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x391f998, lpOverlapped=0x0 | out: lpBuffer=0x44c2078*, lpNumberOfBytesWritten=0x391f998*=0x40000, lpOverlapped=0x0) returned 1 [0120.427] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x3d7360, lpNewFilePointer=0x0, dwMoveMethod=0x391f98c | out: lpNewFilePointer=0x0) returned 1 [0120.427] WriteFile (in: hFile=0x16c, lpBuffer=0x44c2078*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x391f998, lpOverlapped=0x0 | out: lpBuffer=0x44c2078*, lpNumberOfBytesWritten=0x391f998*=0x40000, lpOverlapped=0x0) returned 1 [0120.428] CloseHandle (hObject=0x16c) returned 1 [0120.428] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\IACOM2.DLL.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0120.429] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\IACOM2.DLL") returned 66 [0120.429] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\IACOM2.DLL") returned 66 [0120.429] lstrlenW (lpString=".doc") returned 4 [0120.429] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0120.429] lstrlenW (lpString=".docx") returned 5 [0120.429] lstrcmpiW (lpString1=".docx", lpString2="2.DLL") returned -1 [0120.429] lstrlenW (lpString=".pdf") returned 4 [0120.429] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0120.429] lstrlenW (lpString=".xls") returned 4 [0120.429] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0120.429] lstrlenW (lpString=".xlsx") returned 5 [0120.429] lstrcmpiW (lpString1=".xlsx", lpString2="2.DLL") returned -1 [0120.429] lstrlenW (lpString=".ppt") returned 4 [0120.429] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0120.429] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\IACOM2.DLL") returned 66 [0120.429] lstrlenW (lpString=".zip") returned 4 [0120.429] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0120.429] lstrlenW (lpString=".rar") returned 4 [0120.429] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0120.429] lstrlenW (lpString=".bz2") returned 4 [0120.429] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0120.429] lstrlenW (lpString=".7z") returned 3 [0120.429] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0120.429] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\IACOM2.DLL") returned 66 [0120.429] lstrlenW (lpString=".dbf") returned 4 [0120.429] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0120.429] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\IACOM2.DLL") returned 66 [0120.429] lstrlenW (lpString=".1cd") returned 4 [0120.429] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0120.429] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\IACOM2.DLL") returned 66 [0120.429] lstrlenW (lpString=".jpg") returned 4 [0120.429] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0120.429] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\IACOM2.DLL") returned 66 [0120.429] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\IACOM2.DLL") returned 66 [0120.429] lstrlenW (lpString=".doc") returned 4 [0120.429] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0120.429] lstrlenW (lpString=".docx") returned 5 [0120.429] lstrcmpiW (lpString1=".docx", lpString2="2.DLL") returned -1 [0120.429] lstrlenW (lpString=".pdf") returned 4 [0120.429] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0120.429] lstrlenW (lpString=".xls") returned 4 [0120.429] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0120.429] lstrlenW (lpString=".xlsx") returned 5 [0120.429] lstrcmpiW (lpString1=".xlsx", lpString2="2.DLL") returned -1 [0120.429] lstrlenW (lpString=".ppt") returned 4 [0120.429] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0120.429] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\IACOM2.DLL") returned 66 [0120.429] lstrlenW (lpString=".zip") returned 4 [0120.429] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0120.429] lstrlenW (lpString=".rar") returned 4 [0120.429] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0120.430] lstrlenW (lpString=".bz2") returned 4 [0120.430] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0120.430] lstrlenW (lpString=".7z") returned 3 [0120.430] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0120.430] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\IACOM2.DLL") returned 66 [0120.430] lstrlenW (lpString=".dbf") returned 4 [0120.430] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0120.430] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\IACOM2.DLL") returned 66 [0120.430] lstrlenW (lpString=".1cd") returned 4 [0120.430] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0120.430] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\IACOM2.DLL") returned 66 [0120.430] lstrlenW (lpString=".jpg") returned 4 [0120.430] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0120.430] lstrcmpiW (lpString1=".DLL", lpString2=".waifu") returned -1 [0120.430] lstrlenW (lpString="MUOPTIN.DLL") returned 11 [0120.430] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUOPTIN.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\muoptin.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0120.483] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x391fc2c | out: lpFileSize=0x391fc2c*=24976) returned 1 [0120.483] CloseHandle (hObject=0x170) returned 1 [0120.483] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUOPTIN.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\muoptin.dll")) returned 0x20 [0120.483] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUOPTIN.DLL.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\muoptin.dll.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0120.483] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUOPTIN.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\muoptin.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0120.483] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fbd8 | out: lpNewFilePointer=0x0) returned 1 [0120.483] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fbd8 | out: lpNewFilePointer=0x0) returned 1 [0120.483] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUOPTIN.DLL.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\muoptin.dll.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0120.483] GetLastError () returned 0x0 [0120.483] ReadFile (in: hFile=0x170, lpBuffer=0x4340020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fbe4, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesRead=0x391fbe4*=0x6190, lpOverlapped=0x0) returned 1 [0120.550] WriteFile (in: hFile=0x228, lpBuffer=0x4340020*, nNumberOfBytesToWrite=0x61a0, lpNumberOfBytesWritten=0x391f9ac, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesWritten=0x391f9ac*=0x61a0, lpOverlapped=0x0) returned 1 [0120.551] ReadFile (in: hFile=0x170, lpBuffer=0x4340020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fbe4, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesRead=0x391fbe4*=0x0, lpOverlapped=0x0) returned 1 [0120.551] WriteFile (in: hFile=0x228, lpBuffer=0x4340020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x391f9ac, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesWritten=0x391f9ac*=0xea, lpOverlapped=0x0) returned 1 [0120.551] SetEndOfFile (hFile=0x228) returned 1 [0120.551] CloseHandle (hObject=0x228) returned 1 [0120.551] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fbd8 | out: lpNewFilePointer=0x0) returned 1 [0120.551] SetEndOfFile (hFile=0x170) returned 1 [0120.552] CloseHandle (hObject=0x170) returned 1 [0120.552] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUOPTIN.DLL.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0120.552] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUOPTIN.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\muoptin.dll")) returned 1 [0120.552] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUOPTIN.DLL") returned 67 [0120.552] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUOPTIN.DLL") returned 67 [0120.552] lstrlenW (lpString=".doc") returned 4 [0120.552] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0120.552] lstrlenW (lpString=".docx") returned 5 [0120.552] lstrcmpiW (lpString1=".docx", lpString2="N.DLL") returned -1 [0120.552] lstrlenW (lpString=".pdf") returned 4 [0120.552] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0120.552] lstrlenW (lpString=".xls") returned 4 [0120.553] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0120.553] lstrlenW (lpString=".xlsx") returned 5 [0120.553] lstrcmpiW (lpString1=".xlsx", lpString2="N.DLL") returned -1 [0120.553] lstrlenW (lpString=".ppt") returned 4 [0120.553] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0120.553] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUOPTIN.DLL") returned 67 [0120.553] lstrlenW (lpString=".zip") returned 4 [0120.553] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0120.553] lstrlenW (lpString=".rar") returned 4 [0120.553] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0120.553] lstrlenW (lpString=".bz2") returned 4 [0120.553] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0120.553] lstrlenW (lpString=".7z") returned 3 [0120.553] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0120.553] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUOPTIN.DLL") returned 67 [0120.553] lstrlenW (lpString=".dbf") returned 4 [0120.553] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0120.553] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUOPTIN.DLL") returned 67 [0120.553] lstrlenW (lpString=".1cd") returned 4 [0120.553] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0120.553] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUOPTIN.DLL") returned 67 [0120.553] lstrlenW (lpString=".jpg") returned 4 [0120.553] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0120.553] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUOPTIN.DLL") returned 67 [0120.553] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUOPTIN.DLL") returned 67 [0120.553] lstrlenW (lpString=".doc") returned 4 [0120.553] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0120.553] lstrlenW (lpString=".docx") returned 5 [0120.553] lstrcmpiW (lpString1=".docx", lpString2="N.DLL") returned -1 [0120.553] lstrlenW (lpString=".pdf") returned 4 [0120.553] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0120.553] lstrlenW (lpString=".xls") returned 4 [0120.553] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0120.553] lstrlenW (lpString=".xlsx") returned 5 [0120.553] lstrcmpiW (lpString1=".xlsx", lpString2="N.DLL") returned -1 [0120.553] lstrlenW (lpString=".ppt") returned 4 [0120.553] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0120.553] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUOPTIN.DLL") returned 67 [0120.553] lstrlenW (lpString=".zip") returned 4 [0120.553] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0120.554] lstrlenW (lpString=".rar") returned 4 [0120.554] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0120.554] lstrlenW (lpString=".bz2") returned 4 [0120.554] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0120.554] lstrlenW (lpString=".7z") returned 3 [0120.554] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0120.554] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUOPTIN.DLL") returned 67 [0120.554] lstrlenW (lpString=".dbf") returned 4 [0120.554] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0120.554] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUOPTIN.DLL") returned 67 [0120.554] lstrlenW (lpString=".1cd") returned 4 [0120.554] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0120.554] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUOPTIN.DLL") returned 67 [0120.554] lstrlenW (lpString=".jpg") returned 4 [0120.554] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0120.554] lstrcmpiW (lpString1=".dll", lpString2=".waifu") returned -1 [0120.554] lstrlenW (lpString="promointl.dll") returned 13 [0120.554] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\promointl.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\promointl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0120.555] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x391fc2c | out: lpFileSize=0x391fc2c*=15760) returned 1 [0120.555] CloseHandle (hObject=0x170) returned 1 [0120.555] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\promointl.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\promointl.dll")) returned 0x20 [0120.555] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\promointl.dll.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\promointl.dll.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0120.555] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\promointl.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\promointl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0120.555] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fbd8 | out: lpNewFilePointer=0x0) returned 1 [0120.555] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fbd8 | out: lpNewFilePointer=0x0) returned 1 [0120.555] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\promointl.dll.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\promointl.dll.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0120.556] GetLastError () returned 0x0 [0120.556] ReadFile (in: hFile=0x170, lpBuffer=0x4340020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fbe4, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesRead=0x391fbe4*=0x3d90, lpOverlapped=0x0) returned 1 [0120.573] WriteFile (in: hFile=0x228, lpBuffer=0x4340020*, nNumberOfBytesToWrite=0x3da0, lpNumberOfBytesWritten=0x391f9ac, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesWritten=0x391f9ac*=0x3da0, lpOverlapped=0x0) returned 1 [0120.574] ReadFile (in: hFile=0x170, lpBuffer=0x4340020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fbe4, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesRead=0x391fbe4*=0x0, lpOverlapped=0x0) returned 1 [0120.574] WriteFile (in: hFile=0x228, lpBuffer=0x4340020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x391f9ac, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesWritten=0x391f9ac*=0xee, lpOverlapped=0x0) returned 1 [0120.574] SetEndOfFile (hFile=0x228) returned 1 [0120.574] CloseHandle (hObject=0x228) returned 1 [0120.575] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fbd8 | out: lpNewFilePointer=0x0) returned 1 [0120.575] SetEndOfFile (hFile=0x170) returned 1 [0120.575] CloseHandle (hObject=0x170) returned 1 [0120.575] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\promointl.dll.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0120.576] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\promointl.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\promointl.dll")) returned 1 [0120.576] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\promointl.dll") returned 106 [0120.576] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\promointl.dll") returned 106 [0120.576] lstrlenW (lpString=".doc") returned 4 [0120.576] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0120.576] lstrlenW (lpString=".docx") returned 5 [0120.576] lstrcmpiW (lpString1=".docx", lpString2="l.dll") returned -1 [0120.576] lstrlenW (lpString=".pdf") returned 4 [0120.576] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0120.576] lstrlenW (lpString=".xls") returned 4 [0120.576] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0120.576] lstrlenW (lpString=".xlsx") returned 5 [0120.576] lstrcmpiW (lpString1=".xlsx", lpString2="l.dll") returned -1 [0120.576] lstrlenW (lpString=".ppt") returned 4 [0120.576] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0120.576] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\promointl.dll") returned 106 [0120.576] lstrlenW (lpString=".zip") returned 4 [0120.576] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0120.576] lstrlenW (lpString=".rar") returned 4 [0120.576] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0120.576] lstrlenW (lpString=".bz2") returned 4 [0120.576] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0120.576] lstrlenW (lpString=".7z") returned 3 [0120.576] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0120.576] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\promointl.dll") returned 106 [0120.576] lstrlenW (lpString=".dbf") returned 4 [0120.576] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0120.576] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\promointl.dll") returned 106 [0120.576] lstrlenW (lpString=".1cd") returned 4 [0120.576] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0120.576] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\promointl.dll") returned 106 [0120.576] lstrlenW (lpString=".jpg") returned 4 [0120.576] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0120.577] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\promointl.dll") returned 106 [0120.577] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\promointl.dll") returned 106 [0120.577] lstrlenW (lpString=".doc") returned 4 [0120.577] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0120.577] lstrlenW (lpString=".docx") returned 5 [0120.577] lstrcmpiW (lpString1=".docx", lpString2="l.dll") returned -1 [0120.577] lstrlenW (lpString=".pdf") returned 4 [0120.577] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0120.577] lstrlenW (lpString=".xls") returned 4 [0120.577] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0120.577] lstrlenW (lpString=".xlsx") returned 5 [0120.577] lstrcmpiW (lpString1=".xlsx", lpString2="l.dll") returned -1 [0120.577] lstrlenW (lpString=".ppt") returned 4 [0120.577] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0120.577] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\promointl.dll") returned 106 [0120.577] lstrlenW (lpString=".zip") returned 4 [0120.577] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0120.577] lstrlenW (lpString=".rar") returned 4 [0120.577] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0120.577] lstrlenW (lpString=".bz2") returned 4 [0120.577] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0120.577] lstrlenW (lpString=".7z") returned 3 [0120.577] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0120.577] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\promointl.dll") returned 106 [0120.577] lstrlenW (lpString=".dbf") returned 4 [0120.577] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0120.577] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\promointl.dll") returned 106 [0120.577] lstrlenW (lpString=".1cd") returned 4 [0120.577] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0120.577] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\promointl.dll") returned 106 [0120.577] lstrlenW (lpString=".jpg") returned 4 [0120.577] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0120.577] lstrcmpiW (lpString1=".DLL", lpString2=".waifu") returned -1 [0120.577] lstrlenW (lpString="OSETUP.DLL") returned 10 [0120.577] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSETUP.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\osetup.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0120.578] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x391fc2c | out: lpFileSize=0x391fc2c*=7379816) returned 1 [0120.578] CloseHandle (hObject=0x1f0) returned 1 [0120.578] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSETUP.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\osetup.dll")) returned 0x20 [0120.578] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSETUP.DLL.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\osetup.dll.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0120.578] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSETUP.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\osetup.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSETUP.DLL.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\osetup.dll.id-9c354b42.[darknes@420blaze.it].waifu")) returned 1 [0120.579] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSETUP.DLL.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\osetup.dll.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0120.579] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391f97c | out: lpNewFilePointer=0x0) returned 1 [0120.579] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391f93c | out: lpNewFilePointer=0x0) returned 1 [0120.579] ReadFile (in: hFile=0x1f0, lpBuffer=0x4340058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x391f948, lpOverlapped=0x0 | out: lpBuffer=0x4340058*, lpNumberOfBytesRead=0x391f948*=0x40000, lpOverlapped=0x0) returned 1 [0120.610] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x258922, lpNewFilePointer=0x0, dwMoveMethod=0x391f93c | out: lpNewFilePointer=0x0) returned 1 [0120.610] ReadFile (in: hFile=0x1f0, lpBuffer=0x4380058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x391f948, lpOverlapped=0x0 | out: lpBuffer=0x4380058*, lpNumberOfBytesRead=0x391f948*=0x40000, lpOverlapped=0x0) returned 1 [0120.629] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x391f97c | out: lpNewFilePointer=0xffffffff) returned 1 [0120.629] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x6c9b68, lpNewFilePointer=0x0, dwMoveMethod=0x391f93c | out: lpNewFilePointer=0x0) returned 1 [0120.629] ReadFile (in: hFile=0x1f0, lpBuffer=0x43c0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x391f948, lpOverlapped=0x0 | out: lpBuffer=0x43c0058*, lpNumberOfBytesRead=0x391f948*=0x40000, lpOverlapped=0x0) returned 1 [0120.663] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fbd8 | out: lpNewFilePointer=0x0) returned 1 [0120.663] WriteFile (in: hFile=0x1f0, lpBuffer=0x4340020*, nNumberOfBytesToWrite=0xc0100, lpNumberOfBytesWritten=0x391f9c0, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesWritten=0x391f9c0*=0xc0100, lpOverlapped=0x0) returned 1 [0120.668] SetEndOfFile (hFile=0x1f0) returned 1 [0120.668] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391f98c | out: lpNewFilePointer=0x0) returned 1 [0120.669] WriteFile (in: hFile=0x1f0, lpBuffer=0x44c2078*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x391f998, lpOverlapped=0x0 | out: lpBuffer=0x44c2078*, lpNumberOfBytesWritten=0x391f998*=0x40000, lpOverlapped=0x0) returned 1 [0120.711] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x258922, lpNewFilePointer=0x0, dwMoveMethod=0x391f98c | out: lpNewFilePointer=0x0) returned 1 [0120.711] WriteFile (in: hFile=0x1f0, lpBuffer=0x44c2078*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x391f998, lpOverlapped=0x0 | out: lpBuffer=0x44c2078*, lpNumberOfBytesWritten=0x391f998*=0x40000, lpOverlapped=0x0) returned 1 [0120.713] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x6c9b68, lpNewFilePointer=0x0, dwMoveMethod=0x391f98c | out: lpNewFilePointer=0x0) returned 1 [0120.713] WriteFile (in: hFile=0x1f0, lpBuffer=0x44c2078*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x391f998, lpOverlapped=0x0 | out: lpBuffer=0x44c2078*, lpNumberOfBytesWritten=0x391f998*=0x40000, lpOverlapped=0x0) returned 1 [0120.714] CloseHandle (hObject=0x1f0) returned 1 [0120.714] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSETUP.DLL.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0120.714] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSETUP.DLL") returned 90 [0120.714] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSETUP.DLL") returned 90 [0120.714] lstrlenW (lpString=".doc") returned 4 [0120.714] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0120.714] lstrlenW (lpString=".docx") returned 5 [0120.714] lstrcmpiW (lpString1=".docx", lpString2="P.DLL") returned -1 [0120.714] lstrlenW (lpString=".pdf") returned 4 [0120.714] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0120.714] lstrlenW (lpString=".xls") returned 4 [0120.714] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0120.714] lstrlenW (lpString=".xlsx") returned 5 [0120.714] lstrcmpiW (lpString1=".xlsx", lpString2="P.DLL") returned -1 [0120.714] lstrlenW (lpString=".ppt") returned 4 [0120.714] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0120.715] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSETUP.DLL") returned 90 [0120.715] lstrlenW (lpString=".zip") returned 4 [0120.715] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0120.715] lstrlenW (lpString=".rar") returned 4 [0120.715] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0120.715] lstrlenW (lpString=".bz2") returned 4 [0120.715] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0120.715] lstrlenW (lpString=".7z") returned 3 [0120.715] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0120.715] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSETUP.DLL") returned 90 [0120.715] lstrlenW (lpString=".dbf") returned 4 [0120.715] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0120.715] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSETUP.DLL") returned 90 [0120.715] lstrlenW (lpString=".1cd") returned 4 [0120.715] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0120.715] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSETUP.DLL") returned 90 [0120.715] lstrlenW (lpString=".jpg") returned 4 [0120.715] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0120.715] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSETUP.DLL") returned 90 [0120.715] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSETUP.DLL") returned 90 [0120.715] lstrlenW (lpString=".doc") returned 4 [0120.715] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0120.715] lstrlenW (lpString=".docx") returned 5 [0120.715] lstrcmpiW (lpString1=".docx", lpString2="P.DLL") returned -1 [0120.715] lstrlenW (lpString=".pdf") returned 4 [0120.715] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0120.715] lstrlenW (lpString=".xls") returned 4 [0120.715] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0120.715] lstrlenW (lpString=".xlsx") returned 5 [0120.715] lstrcmpiW (lpString1=".xlsx", lpString2="P.DLL") returned -1 [0120.715] lstrlenW (lpString=".ppt") returned 4 [0120.715] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0120.715] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSETUP.DLL") returned 90 [0120.715] lstrlenW (lpString=".zip") returned 4 [0120.715] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0120.715] lstrlenW (lpString=".rar") returned 4 [0120.715] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0120.715] lstrlenW (lpString=".bz2") returned 4 [0120.715] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0120.715] lstrlenW (lpString=".7z") returned 3 [0120.715] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0120.715] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSETUP.DLL") returned 90 [0120.715] lstrlenW (lpString=".dbf") returned 4 [0120.715] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0120.716] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSETUP.DLL") returned 90 [0120.716] lstrlenW (lpString=".1cd") returned 4 [0120.716] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0120.716] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSETUP.DLL") returned 90 [0120.716] lstrlenW (lpString=".jpg") returned 4 [0120.716] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0120.716] lstrcmpiW (lpString1=".xrm-ms", lpString2=".waifu") returned 1 [0120.716] lstrlenW (lpString="pkeyconfig-office.xrm-ms") returned 24 [0120.716] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig-office.xrm-ms" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\pkeyconfig-office.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x224 [0120.842] GetFileSizeEx (in: hFile=0x224, lpFileSize=0x391fc2c | out: lpFileSize=0x391fc2c*=715834) returned 1 [0120.842] CloseHandle (hObject=0x224) returned 1 [0120.843] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig-office.xrm-ms" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\pkeyconfig-office.xrm-ms")) returned 0x20 [0120.843] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig-office.xrm-ms.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\pkeyconfig-office.xrm-ms.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0120.843] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig-office.xrm-ms" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\pkeyconfig-office.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x224 [0120.843] SetFilePointerEx (in: hFile=0x224, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fbd8 | out: lpNewFilePointer=0x0) returned 1 [0120.843] SetFilePointerEx (in: hFile=0x224, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fbd8 | out: lpNewFilePointer=0x0) returned 1 [0120.843] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig-office.xrm-ms.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\pkeyconfig-office.xrm-ms.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0120.843] GetLastError () returned 0x0 [0120.843] ReadFile (in: hFile=0x224, lpBuffer=0x4340020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fbe4, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesRead=0x391fbe4*=0xaec3a, lpOverlapped=0x0) returned 1 [0120.932] WriteFile (in: hFile=0x19c, lpBuffer=0x4340020*, nNumberOfBytesToWrite=0xaec40, lpNumberOfBytesWritten=0x391f9ac, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesWritten=0x391f9ac*=0xaec40, lpOverlapped=0x0) returned 1 [0120.938] ReadFile (in: hFile=0x224, lpBuffer=0x4340020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fbe4, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesRead=0x391fbe4*=0x0, lpOverlapped=0x0) returned 1 [0120.938] WriteFile (in: hFile=0x19c, lpBuffer=0x4340020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x391f9ac, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesWritten=0x391f9ac*=0x104, lpOverlapped=0x0) returned 1 [0120.938] SetEndOfFile (hFile=0x19c) returned 1 [0120.938] CloseHandle (hObject=0x19c) returned 1 [0120.938] SetFilePointerEx (in: hFile=0x224, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fbd8 | out: lpNewFilePointer=0x0) returned 1 [0120.938] SetEndOfFile (hFile=0x224) returned 1 [0120.949] CloseHandle (hObject=0x224) returned 1 [0120.949] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig-office.xrm-ms.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0120.949] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig-office.xrm-ms" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\pkeyconfig-office.xrm-ms")) returned 1 [0120.949] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig-office.xrm-ms") returned 104 [0120.949] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig-office.xrm-ms") returned 104 [0120.949] lstrlenW (lpString=".doc") returned 4 [0120.949] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0120.949] lstrlenW (lpString=".docx") returned 5 [0120.949] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0120.949] lstrlenW (lpString=".pdf") returned 4 [0120.949] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0120.949] lstrlenW (lpString=".xls") returned 4 [0120.949] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0120.949] lstrlenW (lpString=".xlsx") returned 5 [0120.949] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0120.949] lstrlenW (lpString=".ppt") returned 4 [0120.949] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0120.949] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig-office.xrm-ms") returned 104 [0120.949] lstrlenW (lpString=".zip") returned 4 [0120.949] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0120.949] lstrlenW (lpString=".rar") returned 4 [0120.949] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0120.949] lstrlenW (lpString=".bz2") returned 4 [0120.949] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0120.949] lstrlenW (lpString=".7z") returned 3 [0120.949] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0120.950] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig-office.xrm-ms") returned 104 [0120.950] lstrlenW (lpString=".dbf") returned 4 [0120.950] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0120.950] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig-office.xrm-ms") returned 104 [0120.950] lstrlenW (lpString=".1cd") returned 4 [0120.950] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0120.950] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig-office.xrm-ms") returned 104 [0120.950] lstrlenW (lpString=".jpg") returned 4 [0120.950] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0120.950] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig-office.xrm-ms") returned 104 [0120.950] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig-office.xrm-ms") returned 104 [0120.950] lstrlenW (lpString=".doc") returned 4 [0120.950] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0120.950] lstrlenW (lpString=".docx") returned 5 [0120.950] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0120.950] lstrlenW (lpString=".pdf") returned 4 [0120.950] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0120.950] lstrlenW (lpString=".xls") returned 4 [0120.950] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0120.950] lstrlenW (lpString=".xlsx") returned 5 [0120.950] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0120.950] lstrlenW (lpString=".ppt") returned 4 [0120.950] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0120.950] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig-office.xrm-ms") returned 104 [0120.950] lstrlenW (lpString=".zip") returned 4 [0120.950] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0120.950] lstrlenW (lpString=".rar") returned 4 [0120.950] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0120.950] lstrlenW (lpString=".bz2") returned 4 [0120.950] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0120.950] lstrlenW (lpString=".7z") returned 3 [0120.950] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0120.950] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig-office.xrm-ms") returned 104 [0120.950] lstrlenW (lpString=".dbf") returned 4 [0120.950] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0120.950] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig-office.xrm-ms") returned 104 [0120.950] lstrlenW (lpString=".1cd") returned 4 [0120.950] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0120.950] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig-office.xrm-ms") returned 104 [0120.950] lstrlenW (lpString=".jpg") returned 4 [0120.950] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0120.950] lstrcmpiW (lpString1=".DLL", lpString2=".waifu") returned -1 [0120.950] lstrlenW (lpString="OFFREL.DLL") returned 10 [0120.951] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OFFREL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\offrel.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0120.963] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x391fc2c | out: lpFileSize=0x391fc2c*=9568) returned 1 [0120.963] CloseHandle (hObject=0x1f0) returned 1 [0120.963] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OFFREL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\offrel.dll")) returned 0x20 [0120.963] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OFFREL.DLL.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\offrel.dll.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0120.963] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OFFREL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\offrel.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0120.963] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fbd8 | out: lpNewFilePointer=0x0) returned 1 [0120.963] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fbd8 | out: lpNewFilePointer=0x0) returned 1 [0120.963] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OFFREL.DLL.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\offrel.dll.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0120.964] GetLastError () returned 0x0 [0120.964] ReadFile (in: hFile=0x1f0, lpBuffer=0x4340020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fbe4, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesRead=0x391fbe4*=0x2560, lpOverlapped=0x0) returned 1 [0121.016] WriteFile (in: hFile=0x1e0, lpBuffer=0x4340020*, nNumberOfBytesToWrite=0x2570, lpNumberOfBytesWritten=0x391f9ac, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesWritten=0x391f9ac*=0x2570, lpOverlapped=0x0) returned 1 [0121.017] ReadFile (in: hFile=0x1f0, lpBuffer=0x4340020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fbe4, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesRead=0x391fbe4*=0x0, lpOverlapped=0x0) returned 1 [0121.017] WriteFile (in: hFile=0x1e0, lpBuffer=0x4340020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x391f9ac, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesWritten=0x391f9ac*=0xe8, lpOverlapped=0x0) returned 1 [0121.017] SetEndOfFile (hFile=0x1e0) returned 1 [0121.017] CloseHandle (hObject=0x1e0) returned 1 [0121.017] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fbd8 | out: lpNewFilePointer=0x0) returned 1 [0121.017] SetEndOfFile (hFile=0x1f0) returned 1 [0121.018] CloseHandle (hObject=0x1f0) returned 1 [0121.018] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OFFREL.DLL.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0121.018] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OFFREL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\offrel.dll")) returned 1 [0121.018] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OFFREL.DLL") returned 66 [0121.018] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OFFREL.DLL") returned 66 [0121.018] lstrlenW (lpString=".doc") returned 4 [0121.018] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0121.018] lstrlenW (lpString=".docx") returned 5 [0121.018] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0121.018] lstrlenW (lpString=".pdf") returned 4 [0121.018] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0121.018] lstrlenW (lpString=".xls") returned 4 [0121.018] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0121.018] lstrlenW (lpString=".xlsx") returned 5 [0121.018] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0121.018] lstrlenW (lpString=".ppt") returned 4 [0121.018] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0121.018] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OFFREL.DLL") returned 66 [0121.018] lstrlenW (lpString=".zip") returned 4 [0121.018] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0121.018] lstrlenW (lpString=".rar") returned 4 [0121.018] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0121.018] lstrlenW (lpString=".bz2") returned 4 [0121.018] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0121.018] lstrlenW (lpString=".7z") returned 3 [0121.018] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0121.018] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OFFREL.DLL") returned 66 [0121.018] lstrlenW (lpString=".dbf") returned 4 [0121.018] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0121.019] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OFFREL.DLL") returned 66 [0121.019] lstrlenW (lpString=".1cd") returned 4 [0121.019] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0121.019] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OFFREL.DLL") returned 66 [0121.019] lstrlenW (lpString=".jpg") returned 4 [0121.019] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0121.019] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OFFREL.DLL") returned 66 [0121.019] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OFFREL.DLL") returned 66 [0121.019] lstrlenW (lpString=".doc") returned 4 [0121.019] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0121.019] lstrlenW (lpString=".docx") returned 5 [0121.019] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0121.019] lstrlenW (lpString=".pdf") returned 4 [0121.019] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0121.019] lstrlenW (lpString=".xls") returned 4 [0121.019] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0121.019] lstrlenW (lpString=".xlsx") returned 5 [0121.019] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0121.019] lstrlenW (lpString=".ppt") returned 4 [0121.019] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0121.019] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OFFREL.DLL") returned 66 [0121.019] lstrlenW (lpString=".zip") returned 4 [0121.019] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0121.019] lstrlenW (lpString=".rar") returned 4 [0121.019] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0121.019] lstrlenW (lpString=".bz2") returned 4 [0121.019] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0121.019] lstrlenW (lpString=".7z") returned 3 [0121.019] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0121.019] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OFFREL.DLL") returned 66 [0121.019] lstrlenW (lpString=".dbf") returned 4 [0121.019] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0121.019] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OFFREL.DLL") returned 66 [0121.019] lstrlenW (lpString=".1cd") returned 4 [0121.019] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0121.019] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\OFFREL.DLL") returned 66 [0121.019] lstrlenW (lpString=".jpg") returned 4 [0121.019] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0121.019] lstrcmpiW (lpString1=".DLL", lpString2=".waifu") returned -1 [0121.019] lstrlenW (lpString="PJ11OD11.DLL") returned 12 [0121.019] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJ11OD11.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\pj11od11.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0121.020] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x391fc2c | out: lpFileSize=0x391fc2c*=752552) returned 1 [0121.020] CloseHandle (hObject=0x1f0) returned 1 [0121.020] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJ11OD11.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\pj11od11.dll")) returned 0x20 [0121.020] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJ11OD11.DLL.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\pj11od11.dll.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0121.020] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJ11OD11.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\pj11od11.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0121.020] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fbd8 | out: lpNewFilePointer=0x0) returned 1 [0121.020] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fbd8 | out: lpNewFilePointer=0x0) returned 1 [0121.021] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJ11OD11.DLL.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\pj11od11.dll.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0121.021] GetLastError () returned 0x0 [0121.021] ReadFile (in: hFile=0x1f0, lpBuffer=0x4340020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fbe4, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesRead=0x391fbe4*=0xb7ba8, lpOverlapped=0x0) returned 1 [0121.488] WriteFile (in: hFile=0x1e0, lpBuffer=0x4340020*, nNumberOfBytesToWrite=0xb7bb0, lpNumberOfBytesWritten=0x391f9ac, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesWritten=0x391f9ac*=0xb7bb0, lpOverlapped=0x0) returned 1 [0121.495] ReadFile (in: hFile=0x1f0, lpBuffer=0x4340020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fbe4, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesRead=0x391fbe4*=0x0, lpOverlapped=0x0) returned 1 [0121.495] WriteFile (in: hFile=0x1e0, lpBuffer=0x4340020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x391f9ac, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesWritten=0x391f9ac*=0xec, lpOverlapped=0x0) returned 1 [0121.495] SetEndOfFile (hFile=0x1e0) returned 1 [0121.495] CloseHandle (hObject=0x1e0) returned 1 [0121.495] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fbd8 | out: lpNewFilePointer=0x0) returned 1 [0121.495] SetEndOfFile (hFile=0x1f0) returned 1 [0121.497] CloseHandle (hObject=0x1f0) returned 1 [0121.498] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJ11OD11.DLL.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0121.498] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJ11OD11.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\pj11od11.dll")) returned 1 [0121.498] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJ11OD11.DLL") returned 68 [0121.498] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJ11OD11.DLL") returned 68 [0121.498] lstrlenW (lpString=".doc") returned 4 [0121.498] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0121.498] lstrlenW (lpString=".docx") returned 5 [0121.498] lstrcmpiW (lpString1=".docx", lpString2="1.DLL") returned -1 [0121.498] lstrlenW (lpString=".pdf") returned 4 [0121.498] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0121.498] lstrlenW (lpString=".xls") returned 4 [0121.498] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0121.498] lstrlenW (lpString=".xlsx") returned 5 [0121.498] lstrcmpiW (lpString1=".xlsx", lpString2="1.DLL") returned -1 [0121.498] lstrlenW (lpString=".ppt") returned 4 [0121.498] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0121.498] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJ11OD11.DLL") returned 68 [0121.498] lstrlenW (lpString=".zip") returned 4 [0121.498] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0121.498] lstrlenW (lpString=".rar") returned 4 [0121.498] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0121.498] lstrlenW (lpString=".bz2") returned 4 [0121.498] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0121.498] lstrlenW (lpString=".7z") returned 3 [0121.498] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0121.498] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJ11OD11.DLL") returned 68 [0121.498] lstrlenW (lpString=".dbf") returned 4 [0121.498] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0121.498] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJ11OD11.DLL") returned 68 [0121.498] lstrlenW (lpString=".1cd") returned 4 [0121.498] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0121.498] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJ11OD11.DLL") returned 68 [0121.498] lstrlenW (lpString=".jpg") returned 4 [0121.499] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0121.499] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJ11OD11.DLL") returned 68 [0121.499] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJ11OD11.DLL") returned 68 [0121.499] lstrlenW (lpString=".doc") returned 4 [0121.499] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0121.499] lstrlenW (lpString=".docx") returned 5 [0121.499] lstrcmpiW (lpString1=".docx", lpString2="1.DLL") returned -1 [0121.499] lstrlenW (lpString=".pdf") returned 4 [0121.499] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0121.499] lstrlenW (lpString=".xls") returned 4 [0121.499] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0121.499] lstrlenW (lpString=".xlsx") returned 5 [0121.499] lstrcmpiW (lpString1=".xlsx", lpString2="1.DLL") returned -1 [0121.499] lstrlenW (lpString=".ppt") returned 4 [0121.499] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0121.499] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJ11OD11.DLL") returned 68 [0121.499] lstrlenW (lpString=".zip") returned 4 [0121.499] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0121.499] lstrlenW (lpString=".rar") returned 4 [0121.499] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0121.499] lstrlenW (lpString=".bz2") returned 4 [0121.499] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0121.499] lstrlenW (lpString=".7z") returned 3 [0121.499] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0121.499] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJ11OD11.DLL") returned 68 [0121.499] lstrlenW (lpString=".dbf") returned 4 [0121.499] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0121.499] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJ11OD11.DLL") returned 68 [0121.499] lstrlenW (lpString=".1cd") returned 4 [0121.499] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0121.499] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PJ11OD11.DLL") returned 68 [0121.499] lstrlenW (lpString=".jpg") returned 4 [0121.499] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0121.499] lstrcmpiW (lpString1=".DLL", lpString2=".waifu") returned -1 [0121.499] lstrlenW (lpString="SERCONV.DLL") returned 11 [0121.499] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\SERCONV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\serconv.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0121.500] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x391fc2c | out: lpFileSize=0x391fc2c*=591736) returned 1 [0121.500] CloseHandle (hObject=0x1f0) returned 1 [0121.500] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\SERCONV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\serconv.dll")) returned 0x20 [0121.500] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\SERCONV.DLL.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\serconv.dll.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0121.500] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\SERCONV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\serconv.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0121.500] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fbd8 | out: lpNewFilePointer=0x0) returned 1 [0121.500] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fbd8 | out: lpNewFilePointer=0x0) returned 1 [0121.500] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\SERCONV.DLL.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\serconv.dll.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0121.500] GetLastError () returned 0x0 [0121.501] ReadFile (in: hFile=0x1f0, lpBuffer=0x4340020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fbe4, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesRead=0x391fbe4*=0x90778, lpOverlapped=0x0) returned 1 [0121.740] WriteFile (in: hFile=0x1e0, lpBuffer=0x4340020*, nNumberOfBytesToWrite=0x90780, lpNumberOfBytesWritten=0x391f9ac, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesWritten=0x391f9ac*=0x90780, lpOverlapped=0x0) returned 1 [0121.745] ReadFile (in: hFile=0x1f0, lpBuffer=0x4340020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fbe4, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesRead=0x391fbe4*=0x0, lpOverlapped=0x0) returned 1 [0121.745] WriteFile (in: hFile=0x1e0, lpBuffer=0x4340020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x391f9ac, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesWritten=0x391f9ac*=0xea, lpOverlapped=0x0) returned 1 [0121.745] SetEndOfFile (hFile=0x1e0) returned 1 [0121.745] CloseHandle (hObject=0x1e0) returned 1 [0121.745] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fbd8 | out: lpNewFilePointer=0x0) returned 1 [0121.745] SetEndOfFile (hFile=0x1f0) returned 1 [0121.747] CloseHandle (hObject=0x1f0) returned 1 [0121.747] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\SERCONV.DLL.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0121.747] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\SERCONV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\serconv.dll")) returned 1 [0121.747] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\SERCONV.DLL") returned 67 [0121.747] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\SERCONV.DLL") returned 67 [0121.747] lstrlenW (lpString=".doc") returned 4 [0121.747] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0121.747] lstrlenW (lpString=".docx") returned 5 [0121.747] lstrcmpiW (lpString1=".docx", lpString2="V.DLL") returned -1 [0121.747] lstrlenW (lpString=".pdf") returned 4 [0121.747] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0121.747] lstrlenW (lpString=".xls") returned 4 [0121.747] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0121.747] lstrlenW (lpString=".xlsx") returned 5 [0121.747] lstrcmpiW (lpString1=".xlsx", lpString2="V.DLL") returned -1 [0121.747] lstrlenW (lpString=".ppt") returned 4 [0121.747] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0121.747] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\SERCONV.DLL") returned 67 [0121.747] lstrlenW (lpString=".zip") returned 4 [0121.748] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0121.748] lstrlenW (lpString=".rar") returned 4 [0121.748] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0121.748] lstrlenW (lpString=".bz2") returned 4 [0121.748] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0121.748] lstrlenW (lpString=".7z") returned 3 [0121.748] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0121.748] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\SERCONV.DLL") returned 67 [0121.748] lstrlenW (lpString=".dbf") returned 4 [0121.748] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0121.748] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\SERCONV.DLL") returned 67 [0121.748] lstrlenW (lpString=".1cd") returned 4 [0121.748] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0121.748] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\SERCONV.DLL") returned 67 [0121.748] lstrlenW (lpString=".jpg") returned 4 [0121.748] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0121.748] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\SERCONV.DLL") returned 67 [0121.748] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\SERCONV.DLL") returned 67 [0121.748] lstrlenW (lpString=".doc") returned 4 [0121.748] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0121.748] lstrlenW (lpString=".docx") returned 5 [0121.748] lstrcmpiW (lpString1=".docx", lpString2="V.DLL") returned -1 [0121.756] lstrlenW (lpString=".pdf") returned 4 [0121.756] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0121.759] lstrlenW (lpString=".xls") returned 4 [0121.759] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0121.759] lstrlenW (lpString=".xlsx") returned 5 [0121.759] lstrcmpiW (lpString1=".xlsx", lpString2="V.DLL") returned -1 [0121.759] lstrlenW (lpString=".ppt") returned 4 [0121.759] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0121.759] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\SERCONV.DLL") returned 67 [0121.759] lstrlenW (lpString=".zip") returned 4 [0121.759] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0121.759] lstrlenW (lpString=".rar") returned 4 [0121.759] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0121.759] lstrlenW (lpString=".bz2") returned 4 [0121.759] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0121.759] lstrlenW (lpString=".7z") returned 3 [0121.759] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0121.759] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\SERCONV.DLL") returned 67 [0121.759] lstrlenW (lpString=".dbf") returned 4 [0121.759] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0121.759] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\SERCONV.DLL") returned 67 [0121.759] lstrlenW (lpString=".1cd") returned 4 [0121.759] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0121.759] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\SERCONV.DLL") returned 67 [0121.759] lstrlenW (lpString=".jpg") returned 4 [0121.759] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0121.759] lstrcmpiW (lpString1=".DLL", lpString2=".waifu") returned -1 [0121.759] lstrlenW (lpString="OSPPC.DLL") returned 9 [0121.759] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPC.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppc.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0121.948] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x391fc2c | out: lpFileSize=0x391fc2c*=148736) returned 1 [0121.948] CloseHandle (hObject=0x1e0) returned 1 [0121.948] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPC.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppc.dll")) returned 0x20 [0121.948] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPC.DLL.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppc.dll.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0121.948] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPC.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppc.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0121.952] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fbd8 | out: lpNewFilePointer=0x0) returned 1 [0121.952] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fbd8 | out: lpNewFilePointer=0x0) returned 1 [0121.952] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPC.DLL.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppc.dll.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0121.952] GetLastError () returned 0x0 [0121.952] ReadFile (in: hFile=0x1e0, lpBuffer=0x4340020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fbe4, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesRead=0x391fbe4*=0x24500, lpOverlapped=0x0) returned 1 [0121.975] WriteFile (in: hFile=0x194, lpBuffer=0x4340020*, nNumberOfBytesToWrite=0x24510, lpNumberOfBytesWritten=0x391f9ac, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesWritten=0x391f9ac*=0x24510, lpOverlapped=0x0) returned 1 [0121.977] ReadFile (in: hFile=0x1e0, lpBuffer=0x4340020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fbe4, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesRead=0x391fbe4*=0x0, lpOverlapped=0x0) returned 1 [0121.977] WriteFile (in: hFile=0x194, lpBuffer=0x4340020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x391f9ac, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesWritten=0x391f9ac*=0xe6, lpOverlapped=0x0) returned 1 [0121.977] SetEndOfFile (hFile=0x194) returned 1 [0121.977] CloseHandle (hObject=0x194) returned 1 [0121.977] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fbd8 | out: lpNewFilePointer=0x0) returned 1 [0121.977] SetEndOfFile (hFile=0x1e0) returned 1 [0121.978] CloseHandle (hObject=0x1e0) returned 1 [0121.978] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPC.DLL.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0121.978] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPC.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppc.dll")) returned 1 [0121.978] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPC.DLL") returned 89 [0121.978] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPC.DLL") returned 89 [0121.978] lstrlenW (lpString=".doc") returned 4 [0121.978] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0121.979] lstrlenW (lpString=".docx") returned 5 [0121.979] lstrcmpiW (lpString1=".docx", lpString2="C.DLL") returned -1 [0121.979] lstrlenW (lpString=".pdf") returned 4 [0121.979] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0121.979] lstrlenW (lpString=".xls") returned 4 [0121.979] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0121.979] lstrlenW (lpString=".xlsx") returned 5 [0121.979] lstrcmpiW (lpString1=".xlsx", lpString2="C.DLL") returned -1 [0121.979] lstrlenW (lpString=".ppt") returned 4 [0121.979] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0121.979] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPC.DLL") returned 89 [0121.979] lstrlenW (lpString=".zip") returned 4 [0121.979] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0121.979] lstrlenW (lpString=".rar") returned 4 [0121.979] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0121.979] lstrlenW (lpString=".bz2") returned 4 [0121.979] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0121.979] lstrlenW (lpString=".7z") returned 3 [0121.979] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0121.979] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPC.DLL") returned 89 [0121.980] lstrlenW (lpString=".dbf") returned 4 [0121.980] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0121.980] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPC.DLL") returned 89 [0121.980] lstrlenW (lpString=".1cd") returned 4 [0121.980] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0121.980] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPC.DLL") returned 89 [0121.980] lstrlenW (lpString=".jpg") returned 4 [0121.980] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0121.980] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPC.DLL") returned 89 [0121.980] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPC.DLL") returned 89 [0121.980] lstrlenW (lpString=".doc") returned 4 [0121.980] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0121.980] lstrlenW (lpString=".docx") returned 5 [0121.980] lstrcmpiW (lpString1=".docx", lpString2="C.DLL") returned -1 [0121.980] lstrlenW (lpString=".pdf") returned 4 [0121.980] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0121.980] lstrlenW (lpString=".xls") returned 4 [0121.980] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0121.980] lstrlenW (lpString=".xlsx") returned 5 [0121.980] lstrcmpiW (lpString1=".xlsx", lpString2="C.DLL") returned -1 [0121.980] lstrlenW (lpString=".ppt") returned 4 [0121.980] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0121.980] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPC.DLL") returned 89 [0121.980] lstrlenW (lpString=".zip") returned 4 [0121.980] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0121.980] lstrlenW (lpString=".rar") returned 4 [0121.980] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0121.980] lstrlenW (lpString=".bz2") returned 4 [0121.980] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0121.980] lstrlenW (lpString=".7z") returned 3 [0121.980] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0121.980] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPC.DLL") returned 89 [0121.980] lstrlenW (lpString=".dbf") returned 4 [0121.980] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0121.980] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPC.DLL") returned 89 [0121.980] lstrlenW (lpString=".1cd") returned 4 [0121.980] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0121.980] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPC.DLL") returned 89 [0121.980] lstrlenW (lpString=".jpg") returned 4 [0121.980] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0121.980] lstrcmpiW (lpString1=".EXE", lpString2=".waifu") returned -1 [0121.980] lstrlenW (lpString="OSPPREARM.EXE") returned 13 [0121.980] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPREARM.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\ospprearm.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0122.048] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x391fc2c | out: lpFileSize=0x391fc2c*=15712) returned 1 [0122.048] CloseHandle (hObject=0x19c) returned 1 [0122.048] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPREARM.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\ospprearm.exe")) returned 0x20 [0122.048] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPREARM.EXE.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\ospprearm.exe.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0122.048] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPREARM.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\ospprearm.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0122.048] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fbd8 | out: lpNewFilePointer=0x0) returned 1 [0122.048] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fbd8 | out: lpNewFilePointer=0x0) returned 1 [0122.049] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPREARM.EXE.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\ospprearm.exe.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0122.050] GetLastError () returned 0x0 [0122.050] ReadFile (in: hFile=0x19c, lpBuffer=0x4340020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fbe4, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesRead=0x391fbe4*=0x3d60, lpOverlapped=0x0) returned 1 [0122.169] WriteFile (in: hFile=0x1f4, lpBuffer=0x4340020*, nNumberOfBytesToWrite=0x3d70, lpNumberOfBytesWritten=0x391f9ac, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesWritten=0x391f9ac*=0x3d70, lpOverlapped=0x0) returned 1 [0122.174] ReadFile (in: hFile=0x19c, lpBuffer=0x4340020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fbe4, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesRead=0x391fbe4*=0x0, lpOverlapped=0x0) returned 1 [0122.186] WriteFile (in: hFile=0x1f4, lpBuffer=0x4340020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x391f9ac, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesWritten=0x391f9ac*=0xee, lpOverlapped=0x0) returned 1 [0122.186] SetEndOfFile (hFile=0x1f4) returned 1 [0122.187] CloseHandle (hObject=0x1f4) returned 1 [0122.187] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fbd8 | out: lpNewFilePointer=0x0) returned 1 [0122.187] SetEndOfFile (hFile=0x19c) returned 1 [0122.188] CloseHandle (hObject=0x19c) returned 1 [0122.188] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPREARM.EXE.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0122.188] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPREARM.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\ospprearm.exe")) returned 1 [0122.188] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPREARM.EXE") returned 93 [0122.188] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPREARM.EXE") returned 93 [0122.188] lstrlenW (lpString=".doc") returned 4 [0122.188] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0122.188] lstrlenW (lpString=".docx") returned 5 [0122.188] lstrcmpiW (lpString1=".docx", lpString2="M.EXE") returned -1 [0122.188] lstrlenW (lpString=".pdf") returned 4 [0122.188] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0122.188] lstrlenW (lpString=".xls") returned 4 [0122.188] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0122.189] lstrlenW (lpString=".xlsx") returned 5 [0122.189] lstrcmpiW (lpString1=".xlsx", lpString2="M.EXE") returned -1 [0122.189] lstrlenW (lpString=".ppt") returned 4 [0122.189] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0122.189] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPREARM.EXE") returned 93 [0122.189] lstrlenW (lpString=".zip") returned 4 [0122.189] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0122.189] lstrlenW (lpString=".rar") returned 4 [0122.189] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0122.189] lstrlenW (lpString=".bz2") returned 4 [0122.189] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0122.189] lstrlenW (lpString=".7z") returned 3 [0122.189] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0122.189] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPREARM.EXE") returned 93 [0122.189] lstrlenW (lpString=".dbf") returned 4 [0122.189] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0122.189] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPREARM.EXE") returned 93 [0122.189] lstrlenW (lpString=".1cd") returned 4 [0122.189] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0122.189] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPREARM.EXE") returned 93 [0122.189] lstrlenW (lpString=".jpg") returned 4 [0122.189] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0122.189] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPREARM.EXE") returned 93 [0122.189] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPREARM.EXE") returned 93 [0122.189] lstrlenW (lpString=".doc") returned 4 [0122.189] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0122.189] lstrlenW (lpString=".docx") returned 5 [0122.189] lstrcmpiW (lpString1=".docx", lpString2="M.EXE") returned -1 [0122.189] lstrlenW (lpString=".pdf") returned 4 [0122.189] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0122.189] lstrlenW (lpString=".xls") returned 4 [0122.189] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0122.189] lstrlenW (lpString=".xlsx") returned 5 [0122.189] lstrcmpiW (lpString1=".xlsx", lpString2="M.EXE") returned -1 [0122.189] lstrlenW (lpString=".ppt") returned 4 [0122.189] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0122.189] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPREARM.EXE") returned 93 [0122.189] lstrlenW (lpString=".zip") returned 4 [0122.190] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0122.190] lstrlenW (lpString=".rar") returned 4 [0122.190] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0122.190] lstrlenW (lpString=".bz2") returned 4 [0122.190] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0122.190] lstrlenW (lpString=".7z") returned 3 [0122.190] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0122.190] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPREARM.EXE") returned 93 [0122.190] lstrlenW (lpString=".dbf") returned 4 [0122.190] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0122.190] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPREARM.EXE") returned 93 [0122.190] lstrlenW (lpString=".1cd") returned 4 [0122.190] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0122.190] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPREARM.EXE") returned 93 [0122.190] lstrlenW (lpString=".jpg") returned 4 [0122.190] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0122.190] lstrcmpiW (lpString1=".DLL", lpString2=".waifu") returned -1 [0122.190] lstrlenW (lpString="OSPPWMI.DLL") returned 11 [0122.190] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppwmi.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0122.191] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x391fc2c | out: lpFileSize=0x391fc2c*=146192) returned 1 [0122.191] CloseHandle (hObject=0x19c) returned 1 [0122.191] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppwmi.dll")) returned 0x20 [0122.191] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.DLL.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppwmi.dll.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0122.191] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppwmi.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0122.191] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fbd8 | out: lpNewFilePointer=0x0) returned 1 [0122.191] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fbd8 | out: lpNewFilePointer=0x0) returned 1 [0122.191] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.DLL.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppwmi.dll.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0122.191] GetLastError () returned 0x0 [0122.191] ReadFile (in: hFile=0x19c, lpBuffer=0x4340020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fbe4, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesRead=0x391fbe4*=0x23b10, lpOverlapped=0x0) returned 1 [0122.243] WriteFile (in: hFile=0x1f4, lpBuffer=0x4340020*, nNumberOfBytesToWrite=0x23b20, lpNumberOfBytesWritten=0x391f9ac, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesWritten=0x391f9ac*=0x23b20, lpOverlapped=0x0) returned 1 [0122.245] ReadFile (in: hFile=0x19c, lpBuffer=0x4340020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fbe4, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesRead=0x391fbe4*=0x0, lpOverlapped=0x0) returned 1 [0122.245] WriteFile (in: hFile=0x1f4, lpBuffer=0x4340020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x391f9ac, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesWritten=0x391f9ac*=0xea, lpOverlapped=0x0) returned 1 [0122.245] SetEndOfFile (hFile=0x1f4) returned 1 [0122.245] CloseHandle (hObject=0x1f4) returned 1 [0122.245] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fbd8 | out: lpNewFilePointer=0x0) returned 1 [0122.245] SetEndOfFile (hFile=0x19c) returned 1 [0122.246] CloseHandle (hObject=0x19c) returned 1 [0122.246] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.DLL.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0122.246] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppwmi.dll")) returned 1 [0122.246] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.DLL") returned 91 [0122.246] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.DLL") returned 91 [0122.246] lstrlenW (lpString=".doc") returned 4 [0122.246] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0122.246] lstrlenW (lpString=".docx") returned 5 [0122.246] lstrcmpiW (lpString1=".docx", lpString2="I.DLL") returned -1 [0122.246] lstrlenW (lpString=".pdf") returned 4 [0122.246] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0122.246] lstrlenW (lpString=".xls") returned 4 [0122.246] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0122.246] lstrlenW (lpString=".xlsx") returned 5 [0122.246] lstrcmpiW (lpString1=".xlsx", lpString2="I.DLL") returned -1 [0122.246] lstrlenW (lpString=".ppt") returned 4 [0122.246] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0122.246] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.DLL") returned 91 [0122.246] lstrlenW (lpString=".zip") returned 4 [0122.246] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0122.246] lstrlenW (lpString=".rar") returned 4 [0122.246] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0122.246] lstrlenW (lpString=".bz2") returned 4 [0122.246] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0122.246] lstrlenW (lpString=".7z") returned 3 [0122.246] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0122.247] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.DLL") returned 91 [0122.247] lstrlenW (lpString=".dbf") returned 4 [0122.247] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0122.247] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.DLL") returned 91 [0122.247] lstrlenW (lpString=".1cd") returned 4 [0122.247] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0122.247] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.DLL") returned 91 [0122.247] lstrlenW (lpString=".jpg") returned 4 [0122.247] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0122.247] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.DLL") returned 91 [0122.247] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.DLL") returned 91 [0122.247] lstrlenW (lpString=".doc") returned 4 [0122.247] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0122.247] lstrlenW (lpString=".docx") returned 5 [0122.247] lstrcmpiW (lpString1=".docx", lpString2="I.DLL") returned -1 [0122.247] lstrlenW (lpString=".pdf") returned 4 [0122.247] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0122.247] lstrlenW (lpString=".xls") returned 4 [0122.247] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0122.247] lstrlenW (lpString=".xlsx") returned 5 [0122.247] lstrcmpiW (lpString1=".xlsx", lpString2="I.DLL") returned -1 [0122.247] lstrlenW (lpString=".ppt") returned 4 [0122.247] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0122.247] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.DLL") returned 91 [0122.247] lstrlenW (lpString=".zip") returned 4 [0122.247] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0122.247] lstrlenW (lpString=".rar") returned 4 [0122.247] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0122.247] lstrlenW (lpString=".bz2") returned 4 [0122.247] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0122.247] lstrlenW (lpString=".7z") returned 3 [0122.247] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0122.247] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.DLL") returned 91 [0122.247] lstrlenW (lpString=".dbf") returned 4 [0122.247] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0122.247] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.DLL") returned 91 [0122.247] lstrlenW (lpString=".1cd") returned 4 [0122.247] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0122.247] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.DLL") returned 91 [0122.247] lstrlenW (lpString=".jpg") returned 4 [0122.247] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0122.247] lstrcmpiW (lpString1=".DLL", lpString2=".waifu") returned -1 [0122.247] lstrlenW (lpString="MSLID.DLL") returned 9 [0122.247] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSLID.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mslid.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0122.248] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x391fc2c | out: lpFileSize=0x391fc2c*=591168) returned 1 [0122.248] CloseHandle (hObject=0x19c) returned 1 [0122.248] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSLID.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mslid.dll")) returned 0x20 [0122.249] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSLID.DLL.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mslid.dll.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0122.249] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSLID.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mslid.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0122.249] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fbd8 | out: lpNewFilePointer=0x0) returned 1 [0122.249] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fbd8 | out: lpNewFilePointer=0x0) returned 1 [0122.249] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSLID.DLL.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mslid.dll.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x234 [0122.365] GetLastError () returned 0x0 [0122.365] ReadFile (in: hFile=0x19c, lpBuffer=0x4340020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fbe4, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesRead=0x391fbe4*=0x90540, lpOverlapped=0x0) returned 1 [0122.573] WriteFile (in: hFile=0x234, lpBuffer=0x4340020*, nNumberOfBytesToWrite=0x90550, lpNumberOfBytesWritten=0x391f9ac, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesWritten=0x391f9ac*=0x90550, lpOverlapped=0x0) returned 1 [0122.578] ReadFile (in: hFile=0x19c, lpBuffer=0x4340020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fbe4, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesRead=0x391fbe4*=0x0, lpOverlapped=0x0) returned 1 [0122.578] WriteFile (in: hFile=0x234, lpBuffer=0x4340020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x391f9ac, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesWritten=0x391f9ac*=0xe6, lpOverlapped=0x0) returned 1 [0122.578] SetEndOfFile (hFile=0x234) returned 1 [0122.579] CloseHandle (hObject=0x234) returned 1 [0122.579] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fbd8 | out: lpNewFilePointer=0x0) returned 1 [0122.579] SetEndOfFile (hFile=0x19c) returned 1 [0122.581] CloseHandle (hObject=0x19c) returned 1 [0122.581] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSLID.DLL.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0122.581] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSLID.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mslid.dll")) returned 1 [0122.581] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSLID.DLL") returned 62 [0122.581] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSLID.DLL") returned 62 [0122.581] lstrlenW (lpString=".doc") returned 4 [0122.581] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0122.581] lstrlenW (lpString=".docx") returned 5 [0122.581] lstrcmpiW (lpString1=".docx", lpString2="D.DLL") returned -1 [0122.581] lstrlenW (lpString=".pdf") returned 4 [0122.581] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0122.581] lstrlenW (lpString=".xls") returned 4 [0122.581] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0122.581] lstrlenW (lpString=".xlsx") returned 5 [0122.581] lstrcmpiW (lpString1=".xlsx", lpString2="D.DLL") returned -1 [0122.581] lstrlenW (lpString=".ppt") returned 4 [0122.581] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0122.581] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSLID.DLL") returned 62 [0122.581] lstrlenW (lpString=".zip") returned 4 [0122.581] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0122.581] lstrlenW (lpString=".rar") returned 4 [0122.581] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0122.581] lstrlenW (lpString=".bz2") returned 4 [0122.581] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0122.581] lstrlenW (lpString=".7z") returned 3 [0122.581] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0122.581] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSLID.DLL") returned 62 [0122.581] lstrlenW (lpString=".dbf") returned 4 [0122.581] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0122.582] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSLID.DLL") returned 62 [0122.582] lstrlenW (lpString=".1cd") returned 4 [0122.582] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0122.582] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSLID.DLL") returned 62 [0122.582] lstrlenW (lpString=".jpg") returned 4 [0122.582] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0122.582] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSLID.DLL") returned 62 [0122.582] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSLID.DLL") returned 62 [0122.582] lstrlenW (lpString=".doc") returned 4 [0122.582] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0122.582] lstrlenW (lpString=".docx") returned 5 [0122.582] lstrcmpiW (lpString1=".docx", lpString2="D.DLL") returned -1 [0122.582] lstrlenW (lpString=".pdf") returned 4 [0122.582] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0122.582] lstrlenW (lpString=".xls") returned 4 [0122.582] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0122.582] lstrlenW (lpString=".xlsx") returned 5 [0122.582] lstrcmpiW (lpString1=".xlsx", lpString2="D.DLL") returned -1 [0122.582] lstrlenW (lpString=".ppt") returned 4 [0122.582] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0122.582] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSLID.DLL") returned 62 [0122.582] lstrlenW (lpString=".zip") returned 4 [0122.582] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0122.582] lstrlenW (lpString=".rar") returned 4 [0122.582] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0122.582] lstrlenW (lpString=".bz2") returned 4 [0122.582] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0122.582] lstrlenW (lpString=".7z") returned 3 [0122.582] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0122.582] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSLID.DLL") returned 62 [0122.582] lstrlenW (lpString=".dbf") returned 4 [0122.582] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0122.582] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSLID.DLL") returned 62 [0122.582] lstrlenW (lpString=".1cd") returned 4 [0122.582] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0122.582] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSLID.DLL") returned 62 [0122.582] lstrlenW (lpString=".jpg") returned 4 [0122.582] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0122.582] lstrcmpiW (lpString1=".DLL", lpString2=".waifu") returned -1 [0122.582] lstrlenW (lpString="FDATE.DLL") returned 9 [0122.583] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fdate.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0122.631] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x391fc2c | out: lpFileSize=0x391fc2c*=98176) returned 1 [0122.631] CloseHandle (hObject=0x19c) returned 1 [0122.631] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fdate.dll")) returned 0x20 [0122.631] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fdate.dll.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0122.636] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fdate.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0122.636] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fbd8 | out: lpNewFilePointer=0x0) returned 1 [0122.636] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fbd8 | out: lpNewFilePointer=0x0) returned 1 [0122.636] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fdate.dll.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x234 [0122.636] GetLastError () returned 0x0 [0122.636] ReadFile (in: hFile=0x19c, lpBuffer=0x4340020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fbe4, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesRead=0x391fbe4*=0x17f80, lpOverlapped=0x0) returned 1 [0122.757] WriteFile (in: hFile=0x234, lpBuffer=0x4340020*, nNumberOfBytesToWrite=0x17f90, lpNumberOfBytesWritten=0x391f9ac, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesWritten=0x391f9ac*=0x17f90, lpOverlapped=0x0) returned 1 [0122.758] ReadFile (in: hFile=0x19c, lpBuffer=0x4340020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fbe4, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesRead=0x391fbe4*=0x0, lpOverlapped=0x0) returned 1 [0122.758] WriteFile (in: hFile=0x234, lpBuffer=0x4340020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x391f9ac, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesWritten=0x391f9ac*=0xe6, lpOverlapped=0x0) returned 1 [0122.758] SetEndOfFile (hFile=0x234) returned 1 [0122.758] CloseHandle (hObject=0x234) returned 1 [0122.758] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fbd8 | out: lpNewFilePointer=0x0) returned 1 [0122.758] SetEndOfFile (hFile=0x19c) returned 1 [0122.759] CloseHandle (hObject=0x19c) returned 1 [0122.759] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0122.759] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\fdate.dll")) returned 1 [0122.759] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL") returned 66 [0122.759] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL") returned 66 [0122.759] lstrlenW (lpString=".doc") returned 4 [0122.759] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0122.759] lstrlenW (lpString=".docx") returned 5 [0122.759] lstrcmpiW (lpString1=".docx", lpString2="E.DLL") returned -1 [0122.759] lstrlenW (lpString=".pdf") returned 4 [0122.760] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0122.760] lstrlenW (lpString=".xls") returned 4 [0122.760] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0122.760] lstrlenW (lpString=".xlsx") returned 5 [0122.760] lstrcmpiW (lpString1=".xlsx", lpString2="E.DLL") returned -1 [0122.760] lstrlenW (lpString=".ppt") returned 4 [0122.760] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0122.760] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL") returned 66 [0122.760] lstrlenW (lpString=".zip") returned 4 [0122.760] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0122.760] lstrlenW (lpString=".rar") returned 4 [0122.760] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0122.760] lstrlenW (lpString=".bz2") returned 4 [0122.760] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0122.760] lstrlenW (lpString=".7z") returned 3 [0122.760] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0122.760] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL") returned 66 [0122.760] lstrlenW (lpString=".dbf") returned 4 [0122.760] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0122.760] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL") returned 66 [0122.760] lstrlenW (lpString=".1cd") returned 4 [0122.760] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0122.760] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL") returned 66 [0122.760] lstrlenW (lpString=".jpg") returned 4 [0122.760] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0122.760] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL") returned 66 [0122.760] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL") returned 66 [0122.760] lstrlenW (lpString=".doc") returned 4 [0122.760] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0122.760] lstrlenW (lpString=".docx") returned 5 [0122.760] lstrcmpiW (lpString1=".docx", lpString2="E.DLL") returned -1 [0122.760] lstrlenW (lpString=".pdf") returned 4 [0122.760] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0122.760] lstrlenW (lpString=".xls") returned 4 [0122.760] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0122.760] lstrlenW (lpString=".xlsx") returned 5 [0122.760] lstrcmpiW (lpString1=".xlsx", lpString2="E.DLL") returned -1 [0122.760] lstrlenW (lpString=".ppt") returned 4 [0122.760] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0122.760] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL") returned 66 [0122.760] lstrlenW (lpString=".zip") returned 4 [0122.760] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0122.760] lstrlenW (lpString=".rar") returned 4 [0122.760] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0122.761] lstrlenW (lpString=".bz2") returned 4 [0122.761] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0122.761] lstrlenW (lpString=".7z") returned 3 [0122.761] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0122.761] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL") returned 66 [0122.761] lstrlenW (lpString=".dbf") returned 4 [0122.761] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0122.761] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL") returned 66 [0122.761] lstrlenW (lpString=".1cd") returned 4 [0122.761] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0122.761] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\FDATE.DLL") returned 66 [0122.761] lstrlenW (lpString=".jpg") returned 4 [0122.761] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0122.761] lstrcmpiW (lpString1=".DLL", lpString2=".waifu") returned -1 [0122.761] lstrlenW (lpString="IMCONTACT.DLL") returned 13 [0122.761] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IMCONTACT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\imcontact.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0122.820] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x391fc2c | out: lpFileSize=0x391fc2c*=101248) returned 1 [0122.820] CloseHandle (hObject=0x1e0) returned 1 [0122.820] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IMCONTACT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\imcontact.dll")) returned 0x20 [0122.820] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IMCONTACT.DLL.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\imcontact.dll.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0122.820] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IMCONTACT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\imcontact.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0122.820] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fbd8 | out: lpNewFilePointer=0x0) returned 1 [0122.820] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fbd8 | out: lpNewFilePointer=0x0) returned 1 [0122.820] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IMCONTACT.DLL.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\imcontact.dll.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0122.821] GetLastError () returned 0x0 [0122.821] ReadFile (in: hFile=0x1e0, lpBuffer=0x4340020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fbe4, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesRead=0x391fbe4*=0x18b80, lpOverlapped=0x0) returned 1 [0122.883] WriteFile (in: hFile=0x16c, lpBuffer=0x4340020*, nNumberOfBytesToWrite=0x18b90, lpNumberOfBytesWritten=0x391f9ac, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesWritten=0x391f9ac*=0x18b90, lpOverlapped=0x0) returned 1 [0122.897] ReadFile (in: hFile=0x1e0, lpBuffer=0x4340020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fbe4, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesRead=0x391fbe4*=0x0, lpOverlapped=0x0) returned 1 [0122.897] WriteFile (in: hFile=0x16c, lpBuffer=0x4340020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x391f9ac, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesWritten=0x391f9ac*=0xee, lpOverlapped=0x0) returned 1 [0122.897] SetEndOfFile (hFile=0x16c) returned 1 [0122.897] CloseHandle (hObject=0x16c) returned 1 [0122.897] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fbd8 | out: lpNewFilePointer=0x0) returned 1 [0122.897] SetEndOfFile (hFile=0x1e0) returned 1 [0122.898] CloseHandle (hObject=0x1e0) returned 1 [0122.898] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IMCONTACT.DLL.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0122.898] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IMCONTACT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\imcontact.dll")) returned 1 [0122.901] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IMCONTACT.DLL") returned 70 [0122.901] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IMCONTACT.DLL") returned 70 [0122.901] lstrlenW (lpString=".doc") returned 4 [0122.901] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0122.901] lstrlenW (lpString=".docx") returned 5 [0122.901] lstrcmpiW (lpString1=".docx", lpString2="T.DLL") returned -1 [0122.901] lstrlenW (lpString=".pdf") returned 4 [0122.901] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0122.901] lstrlenW (lpString=".xls") returned 4 [0122.901] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0122.901] lstrlenW (lpString=".xlsx") returned 5 [0122.901] lstrcmpiW (lpString1=".xlsx", lpString2="T.DLL") returned -1 [0122.902] lstrlenW (lpString=".ppt") returned 4 [0122.902] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0122.902] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IMCONTACT.DLL") returned 70 [0122.902] lstrlenW (lpString=".zip") returned 4 [0122.902] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0122.902] lstrlenW (lpString=".rar") returned 4 [0122.902] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0122.902] lstrlenW (lpString=".bz2") returned 4 [0122.902] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0122.902] lstrlenW (lpString=".7z") returned 3 [0122.902] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0122.902] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IMCONTACT.DLL") returned 70 [0122.902] lstrlenW (lpString=".dbf") returned 4 [0122.902] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0122.902] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IMCONTACT.DLL") returned 70 [0122.902] lstrlenW (lpString=".1cd") returned 4 [0122.902] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0122.902] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IMCONTACT.DLL") returned 70 [0122.902] lstrlenW (lpString=".jpg") returned 4 [0122.902] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0122.902] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IMCONTACT.DLL") returned 70 [0122.902] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IMCONTACT.DLL") returned 70 [0122.902] lstrlenW (lpString=".doc") returned 4 [0122.902] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0122.902] lstrlenW (lpString=".docx") returned 5 [0122.902] lstrcmpiW (lpString1=".docx", lpString2="T.DLL") returned -1 [0122.902] lstrlenW (lpString=".pdf") returned 4 [0122.902] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0122.902] lstrlenW (lpString=".xls") returned 4 [0122.902] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0122.902] lstrlenW (lpString=".xlsx") returned 5 [0122.902] lstrcmpiW (lpString1=".xlsx", lpString2="T.DLL") returned -1 [0122.902] lstrlenW (lpString=".ppt") returned 4 [0122.902] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0122.902] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IMCONTACT.DLL") returned 70 [0122.902] lstrlenW (lpString=".zip") returned 4 [0122.902] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0122.902] lstrlenW (lpString=".rar") returned 4 [0122.902] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0122.902] lstrlenW (lpString=".bz2") returned 4 [0122.902] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0122.902] lstrlenW (lpString=".7z") returned 3 [0122.902] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0122.902] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IMCONTACT.DLL") returned 70 [0122.903] lstrlenW (lpString=".dbf") returned 4 [0122.903] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0122.903] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IMCONTACT.DLL") returned 70 [0122.903] lstrlenW (lpString=".1cd") returned 4 [0122.903] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0122.903] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\IMCONTACT.DLL") returned 70 [0122.903] lstrlenW (lpString=".jpg") returned 4 [0122.903] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0122.904] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fbd8 | out: lpNewFilePointer=0x0) returned 1 [0122.904] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fbd8 | out: lpNewFilePointer=0x0) returned 1 [0122.904] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\smarttaginstall.exe.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0122.904] GetLastError () returned 0x0 [0122.904] ReadFile (in: hFile=0x16c, lpBuffer=0x4340020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fbe4, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesRead=0x391fbe4*=0x3d80, lpOverlapped=0x0) returned 1 [0122.917] WriteFile (in: hFile=0x1a0, lpBuffer=0x4340020*, nNumberOfBytesToWrite=0x3d90, lpNumberOfBytesWritten=0x391f9ac, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesWritten=0x391f9ac*=0x3d90, lpOverlapped=0x0) returned 1 [0122.918] ReadFile (in: hFile=0x16c, lpBuffer=0x4340020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fbe4, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesRead=0x391fbe4*=0x0, lpOverlapped=0x0) returned 1 [0122.918] WriteFile (in: hFile=0x1a0, lpBuffer=0x4340020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x391f9ac, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesWritten=0x391f9ac*=0xfa, lpOverlapped=0x0) returned 1 [0122.918] SetEndOfFile (hFile=0x1a0) returned 1 [0122.926] CloseHandle (hObject=0x1a0) returned 1 [0122.926] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fbd8 | out: lpNewFilePointer=0x0) returned 1 [0122.926] SetEndOfFile (hFile=0x16c) returned 1 [0122.927] CloseHandle (hObject=0x16c) returned 1 [0122.927] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0122.927] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\smarttaginstall.exe")) returned 1 [0122.927] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe") returned 76 [0122.927] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe") returned 76 [0122.927] lstrlenW (lpString=".doc") returned 4 [0122.927] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0122.927] lstrlenW (lpString=".docx") returned 5 [0122.928] lstrcmpiW (lpString1=".docx", lpString2="l.exe") returned -1 [0122.928] lstrlenW (lpString=".pdf") returned 4 [0122.928] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0122.928] lstrlenW (lpString=".xls") returned 4 [0122.928] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0122.928] lstrlenW (lpString=".xlsx") returned 5 [0122.928] lstrcmpiW (lpString1=".xlsx", lpString2="l.exe") returned -1 [0122.928] lstrlenW (lpString=".ppt") returned 4 [0122.928] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0122.928] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe") returned 76 [0122.928] lstrlenW (lpString=".zip") returned 4 [0122.928] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0122.928] lstrlenW (lpString=".rar") returned 4 [0122.928] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0122.928] lstrlenW (lpString=".bz2") returned 4 [0122.928] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0122.928] lstrlenW (lpString=".7z") returned 3 [0122.928] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0122.928] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe") returned 76 [0122.928] lstrlenW (lpString=".dbf") returned 4 [0122.928] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0122.928] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe") returned 76 [0122.928] lstrlenW (lpString=".1cd") returned 4 [0122.928] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0122.928] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\SmartTagInstall.exe") returned 76 [0122.928] lstrlenW (lpString=".jpg") returned 4 [0122.928] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0122.929] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fbd8 | out: lpNewFilePointer=0x0) returned 1 [0122.929] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fbd8 | out: lpNewFilePointer=0x0) returned 1 [0122.929] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\source engine\\ose.exe.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0122.929] GetLastError () returned 0x0 [0122.929] ReadFile (in: hFile=0x16c, lpBuffer=0x4340020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fbe4, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesRead=0x391fbe4*=0x2a968, lpOverlapped=0x0) returned 1 [0122.933] WriteFile (in: hFile=0x1a0, lpBuffer=0x4340020*, nNumberOfBytesToWrite=0x2a970, lpNumberOfBytesWritten=0x391f9ac, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesWritten=0x391f9ac*=0x2a970, lpOverlapped=0x0) returned 1 [0122.935] ReadFile (in: hFile=0x16c, lpBuffer=0x4340020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fbe4, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesRead=0x391fbe4*=0x0, lpOverlapped=0x0) returned 1 [0122.935] WriteFile (in: hFile=0x1a0, lpBuffer=0x4340020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x391f9ac, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesWritten=0x391f9ac*=0xe2, lpOverlapped=0x0) returned 1 [0122.935] SetEndOfFile (hFile=0x1a0) returned 1 [0122.935] CloseHandle (hObject=0x1a0) returned 1 [0122.938] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fbd8 | out: lpNewFilePointer=0x0) returned 1 [0122.938] SetEndOfFile (hFile=0x16c) returned 1 [0122.939] CloseHandle (hObject=0x16c) returned 1 [0122.939] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0122.939] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\source engine\\ose.exe")) returned 1 [0122.940] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE") returned 68 [0122.940] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE") returned 68 [0122.940] lstrlenW (lpString=".doc") returned 4 [0122.940] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0122.940] lstrlenW (lpString=".docx") returned 5 [0122.940] lstrcmpiW (lpString1=".docx", lpString2="E.EXE") returned -1 [0122.940] lstrlenW (lpString=".pdf") returned 4 [0122.940] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0122.940] lstrlenW (lpString=".xls") returned 4 [0122.940] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0122.940] lstrlenW (lpString=".xlsx") returned 5 [0122.940] lstrcmpiW (lpString1=".xlsx", lpString2="E.EXE") returned -1 [0122.940] lstrlenW (lpString=".ppt") returned 4 [0122.940] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0122.940] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE") returned 68 [0122.940] lstrlenW (lpString=".zip") returned 4 [0122.940] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0122.940] lstrlenW (lpString=".rar") returned 4 [0122.940] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0122.940] lstrlenW (lpString=".bz2") returned 4 [0122.940] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0122.940] lstrlenW (lpString=".7z") returned 3 [0122.940] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0122.940] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE") returned 68 [0122.940] lstrlenW (lpString=".dbf") returned 4 [0122.940] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0122.940] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE") returned 68 [0122.940] lstrlenW (lpString=".1cd") returned 4 [0122.940] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0122.940] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\OSE.EXE") returned 68 [0122.940] lstrlenW (lpString=".jpg") returned 4 [0122.940] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0122.991] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fbd8 | out: lpNewFilePointer=0x0) returned 1 [0122.991] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fbd8 | out: lpNewFilePointer=0x0) returned 1 [0122.991] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\MSCONV97.DLL.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\msconv97.dll.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0122.992] GetLastError () returned 0x0 [0122.992] ReadFile (in: hFile=0x168, lpBuffer=0x4340020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fbe4, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesRead=0x391fbe4*=0x23d78, lpOverlapped=0x0) returned 1 [0123.039] WriteFile (in: hFile=0x1a0, lpBuffer=0x4340020*, nNumberOfBytesToWrite=0x23d80, lpNumberOfBytesWritten=0x391f9ac, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesWritten=0x391f9ac*=0x23d80, lpOverlapped=0x0) returned 1 [0123.042] ReadFile (in: hFile=0x168, lpBuffer=0x4340020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fbe4, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesRead=0x391fbe4*=0x0, lpOverlapped=0x0) returned 1 [0123.042] WriteFile (in: hFile=0x1a0, lpBuffer=0x4340020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x391f9ac, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesWritten=0x391f9ac*=0xec, lpOverlapped=0x0) returned 1 [0123.042] SetEndOfFile (hFile=0x1a0) returned 1 [0123.042] CloseHandle (hObject=0x1a0) returned 1 [0123.042] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fbd8 | out: lpNewFilePointer=0x0) returned 1 [0123.042] SetEndOfFile (hFile=0x168) returned 1 [0123.043] CloseHandle (hObject=0x168) returned 1 [0123.043] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\MSCONV97.DLL.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0123.043] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\MSCONV97.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\msconv97.dll")) returned 1 [0123.043] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\MSCONV97.DLL") returned 68 [0123.043] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\MSCONV97.DLL") returned 68 [0123.043] lstrlenW (lpString=".doc") returned 4 [0123.043] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0123.043] lstrlenW (lpString=".docx") returned 5 [0123.044] lstrcmpiW (lpString1=".docx", lpString2="7.DLL") returned -1 [0123.044] lstrlenW (lpString=".pdf") returned 4 [0123.044] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0123.044] lstrlenW (lpString=".xls") returned 4 [0123.044] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0123.044] lstrlenW (lpString=".xlsx") returned 5 [0123.044] lstrcmpiW (lpString1=".xlsx", lpString2="7.DLL") returned -1 [0123.044] lstrlenW (lpString=".ppt") returned 4 [0123.044] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0123.044] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\MSCONV97.DLL") returned 68 [0123.044] lstrlenW (lpString=".zip") returned 4 [0123.044] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0123.044] lstrlenW (lpString=".rar") returned 4 [0123.044] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0123.044] lstrlenW (lpString=".bz2") returned 4 [0123.044] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0123.044] lstrlenW (lpString=".7z") returned 3 [0123.044] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0123.044] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\MSCONV97.DLL") returned 68 [0123.044] lstrlenW (lpString=".dbf") returned 4 [0123.044] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0123.044] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\MSCONV97.DLL") returned 68 [0123.044] lstrlenW (lpString=".1cd") returned 4 [0123.044] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0123.044] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\MSCONV97.DLL") returned 68 [0123.044] lstrlenW (lpString=".jpg") returned 4 [0123.044] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0123.045] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fbd8 | out: lpNewFilePointer=0x0) returned 1 [0123.045] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fbd8 | out: lpNewFilePointer=0x0) returned 1 [0123.045] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT632.CNV.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wpft632.cnv.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0123.046] GetLastError () returned 0x0 [0123.046] ReadFile (in: hFile=0x168, lpBuffer=0x4340020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fbe4, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesRead=0x391fbe4*=0x46b70, lpOverlapped=0x0) returned 1 [0123.135] WriteFile (in: hFile=0x1a0, lpBuffer=0x4340020*, nNumberOfBytesToWrite=0x46b80, lpNumberOfBytesWritten=0x391f9ac, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesWritten=0x391f9ac*=0x46b80, lpOverlapped=0x0) returned 1 [0123.138] ReadFile (in: hFile=0x168, lpBuffer=0x4340020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fbe4, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesRead=0x391fbe4*=0x0, lpOverlapped=0x0) returned 1 [0123.138] WriteFile (in: hFile=0x1a0, lpBuffer=0x4340020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x391f9ac, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesWritten=0x391f9ac*=0xea, lpOverlapped=0x0) returned 1 [0123.138] SetEndOfFile (hFile=0x1a0) returned 1 [0123.138] CloseHandle (hObject=0x1a0) returned 1 [0123.138] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fbd8 | out: lpNewFilePointer=0x0) returned 1 [0123.138] SetEndOfFile (hFile=0x168) returned 1 [0123.139] CloseHandle (hObject=0x168) returned 1 [0123.139] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT632.CNV.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0123.139] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT632.CNV" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wpft632.cnv")) returned 1 [0123.140] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT632.CNV") returned 67 [0123.140] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT632.CNV") returned 67 [0123.140] lstrlenW (lpString=".doc") returned 4 [0123.140] lstrcmpiW (lpString1=".doc", lpString2=".CNV") returned 1 [0123.140] lstrlenW (lpString=".docx") returned 5 [0123.140] lstrcmpiW (lpString1=".docx", lpString2="2.CNV") returned -1 [0123.140] lstrlenW (lpString=".pdf") returned 4 [0123.140] lstrcmpiW (lpString1=".pdf", lpString2=".CNV") returned 1 [0123.140] lstrlenW (lpString=".xls") returned 4 [0123.140] lstrcmpiW (lpString1=".xls", lpString2=".CNV") returned 1 [0123.140] lstrlenW (lpString=".xlsx") returned 5 [0123.140] lstrcmpiW (lpString1=".xlsx", lpString2="2.CNV") returned -1 [0123.140] lstrlenW (lpString=".ppt") returned 4 [0123.140] lstrcmpiW (lpString1=".ppt", lpString2=".CNV") returned 1 [0123.140] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT632.CNV") returned 67 [0123.140] lstrlenW (lpString=".zip") returned 4 [0123.140] lstrcmpiW (lpString1=".zip", lpString2=".CNV") returned 1 [0123.140] lstrlenW (lpString=".rar") returned 4 [0123.140] lstrcmpiW (lpString1=".rar", lpString2=".CNV") returned 1 [0123.140] lstrlenW (lpString=".bz2") returned 4 [0123.140] lstrcmpiW (lpString1=".bz2", lpString2=".CNV") returned -1 [0123.140] lstrlenW (lpString=".7z") returned 3 [0123.140] lstrcmpiW (lpString1=".7z", lpString2="CNV") returned -1 [0123.140] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT632.CNV") returned 67 [0123.140] lstrlenW (lpString=".dbf") returned 4 [0123.140] lstrcmpiW (lpString1=".dbf", lpString2=".CNV") returned 1 [0123.140] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT632.CNV") returned 67 [0123.140] lstrlenW (lpString=".1cd") returned 4 [0123.140] lstrcmpiW (lpString1=".1cd", lpString2=".CNV") returned -1 [0123.140] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT632.CNV") returned 67 [0123.140] lstrlenW (lpString=".jpg") returned 4 [0123.140] lstrcmpiW (lpString1=".jpg", lpString2=".CNV") returned 1 [0123.141] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fbd8 | out: lpNewFilePointer=0x0) returned 1 [0123.141] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fbd8 | out: lpNewFilePointer=0x0) returned 1 [0123.141] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\arctic.inf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0123.141] GetLastError () returned 0x0 [0123.141] ReadFile (in: hFile=0x168, lpBuffer=0x4340020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fbe4, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesRead=0x391fbe4*=0x201, lpOverlapped=0x0) returned 1 [0123.156] WriteFile (in: hFile=0x1a0, lpBuffer=0x4340020*, nNumberOfBytesToWrite=0x210, lpNumberOfBytesWritten=0x391f9ac, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesWritten=0x391f9ac*=0x210, lpOverlapped=0x0) returned 1 [0123.156] ReadFile (in: hFile=0x168, lpBuffer=0x4340020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fbe4, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesRead=0x391fbe4*=0x0, lpOverlapped=0x0) returned 1 [0123.156] WriteFile (in: hFile=0x1a0, lpBuffer=0x4340020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x391f9ac, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesWritten=0x391f9ac*=0xe8, lpOverlapped=0x0) returned 1 [0123.156] SetEndOfFile (hFile=0x1a0) returned 1 [0123.157] CloseHandle (hObject=0x1a0) returned 1 [0123.157] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fbd8 | out: lpNewFilePointer=0x0) returned 1 [0123.157] SetEndOfFile (hFile=0x168) returned 1 [0123.157] CloseHandle (hObject=0x168) returned 1 [0123.157] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0123.157] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\arctic.inf")) returned 1 [0123.158] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF") returned 73 [0123.158] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF") returned 73 [0123.158] lstrlenW (lpString=".doc") returned 4 [0123.158] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1 [0123.158] lstrlenW (lpString=".docx") returned 5 [0123.158] lstrcmpiW (lpString1=".docx", lpString2="C.INF") returned -1 [0123.158] lstrlenW (lpString=".pdf") returned 4 [0123.158] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1 [0123.158] lstrlenW (lpString=".xls") returned 4 [0123.158] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1 [0123.158] lstrlenW (lpString=".xlsx") returned 5 [0123.158] lstrcmpiW (lpString1=".xlsx", lpString2="C.INF") returned -1 [0123.158] lstrlenW (lpString=".ppt") returned 4 [0123.158] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1 [0123.158] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF") returned 73 [0123.158] lstrlenW (lpString=".zip") returned 4 [0123.158] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1 [0123.158] lstrlenW (lpString=".rar") returned 4 [0123.158] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1 [0123.158] lstrlenW (lpString=".bz2") returned 4 [0123.158] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1 [0123.158] lstrlenW (lpString=".7z") returned 3 [0123.158] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1 [0123.158] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF") returned 73 [0123.158] lstrlenW (lpString=".dbf") returned 4 [0123.158] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1 [0123.158] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF") returned 73 [0123.158] lstrlenW (lpString=".1cd") returned 4 [0123.158] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1 [0123.158] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF") returned 73 [0123.158] lstrlenW (lpString=".jpg") returned 4 [0123.158] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1 [0123.163] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fbd8 | out: lpNewFilePointer=0x0) returned 1 [0123.163] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fbd8 | out: lpNewFilePointer=0x0) returned 1 [0123.163] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\axis.inf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0123.164] GetLastError () returned 0x0 [0123.164] ReadFile (in: hFile=0x21c, lpBuffer=0x4340020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fbe4, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesRead=0x391fbe4*=0x211, lpOverlapped=0x0) returned 1 [0123.164] WriteFile (in: hFile=0x218, lpBuffer=0x4340020*, nNumberOfBytesToWrite=0x220, lpNumberOfBytesWritten=0x391f9ac, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesWritten=0x391f9ac*=0x220, lpOverlapped=0x0) returned 1 [0123.166] ReadFile (in: hFile=0x21c, lpBuffer=0x4340020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fbe4, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesRead=0x391fbe4*=0x0, lpOverlapped=0x0) returned 1 [0123.166] WriteFile (in: hFile=0x218, lpBuffer=0x4340020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x391f9ac, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesWritten=0x391f9ac*=0xe4, lpOverlapped=0x0) returned 1 [0123.166] SetEndOfFile (hFile=0x218) returned 1 [0123.166] CloseHandle (hObject=0x218) returned 1 [0123.166] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fbd8 | out: lpNewFilePointer=0x0) returned 1 [0123.166] SetEndOfFile (hFile=0x21c) returned 1 [0123.167] CloseHandle (hObject=0x21c) returned 1 [0123.167] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0123.167] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\axis.inf")) returned 1 [0123.167] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF") returned 69 [0123.167] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF") returned 69 [0123.167] lstrlenW (lpString=".doc") returned 4 [0123.167] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1 [0123.167] lstrlenW (lpString=".docx") returned 5 [0123.167] lstrcmpiW (lpString1=".docx", lpString2="S.INF") returned -1 [0123.167] lstrlenW (lpString=".pdf") returned 4 [0123.167] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1 [0123.168] lstrlenW (lpString=".xls") returned 4 [0123.168] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1 [0123.168] lstrlenW (lpString=".xlsx") returned 5 [0123.168] lstrcmpiW (lpString1=".xlsx", lpString2="S.INF") returned -1 [0123.168] lstrlenW (lpString=".ppt") returned 4 [0123.168] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1 [0123.168] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF") returned 69 [0123.168] lstrlenW (lpString=".zip") returned 4 [0123.168] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1 [0123.168] lstrlenW (lpString=".rar") returned 4 [0123.168] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1 [0123.168] lstrlenW (lpString=".bz2") returned 4 [0123.168] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1 [0123.168] lstrlenW (lpString=".7z") returned 3 [0123.168] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1 [0123.168] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF") returned 69 [0123.168] lstrlenW (lpString=".dbf") returned 4 [0123.168] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1 [0123.168] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF") returned 69 [0123.168] lstrlenW (lpString=".1cd") returned 4 [0123.168] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1 [0123.168] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF") returned 69 [0123.168] lstrlenW (lpString=".jpg") returned 4 [0123.168] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1 [0123.168] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fbd8 | out: lpNewFilePointer=0x0) returned 1 [0123.168] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fbd8 | out: lpNewFilePointer=0x0) returned 1 [0123.168] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\blends.elm.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0123.169] GetLastError () returned 0x0 [0123.169] ReadFile (in: hFile=0x21c, lpBuffer=0x4340020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fbe4, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesRead=0x391fbe4*=0x10db7, lpOverlapped=0x0) returned 1 [0123.217] WriteFile (in: hFile=0x218, lpBuffer=0x4340020*, nNumberOfBytesToWrite=0x10dc0, lpNumberOfBytesWritten=0x391f9ac, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesWritten=0x391f9ac*=0x10dc0, lpOverlapped=0x0) returned 1 [0123.218] ReadFile (in: hFile=0x21c, lpBuffer=0x4340020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fbe4, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesRead=0x391fbe4*=0x0, lpOverlapped=0x0) returned 1 [0123.218] WriteFile (in: hFile=0x218, lpBuffer=0x4340020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x391f9ac, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesWritten=0x391f9ac*=0xe8, lpOverlapped=0x0) returned 1 [0123.218] SetEndOfFile (hFile=0x218) returned 1 [0123.218] CloseHandle (hObject=0x218) returned 1 [0123.218] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fbd8 | out: lpNewFilePointer=0x0) returned 1 [0123.218] SetEndOfFile (hFile=0x21c) returned 1 [0123.219] CloseHandle (hObject=0x21c) returned 1 [0123.219] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0123.219] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\blends.elm")) returned 1 [0123.219] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM") returned 73 [0123.219] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM") returned 73 [0123.219] lstrlenW (lpString=".doc") returned 4 [0123.219] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1 [0123.219] lstrlenW (lpString=".docx") returned 5 [0123.219] lstrcmpiW (lpString1=".docx", lpString2="S.ELM") returned -1 [0123.219] lstrlenW (lpString=".pdf") returned 4 [0123.219] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1 [0123.220] lstrlenW (lpString=".xls") returned 4 [0123.220] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1 [0123.220] lstrlenW (lpString=".xlsx") returned 5 [0123.220] lstrcmpiW (lpString1=".xlsx", lpString2="S.ELM") returned -1 [0123.220] lstrlenW (lpString=".ppt") returned 4 [0123.220] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1 [0123.220] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM") returned 73 [0123.220] lstrlenW (lpString=".zip") returned 4 [0123.220] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1 [0123.220] lstrlenW (lpString=".rar") returned 4 [0123.220] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1 [0123.220] lstrlenW (lpString=".bz2") returned 4 [0123.220] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1 [0123.220] lstrlenW (lpString=".7z") returned 3 [0123.220] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1 [0123.220] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM") returned 73 [0123.220] lstrlenW (lpString=".dbf") returned 4 [0123.220] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1 [0123.220] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM") returned 73 [0123.220] lstrlenW (lpString=".1cd") returned 4 [0123.220] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1 [0123.220] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM") returned 73 [0123.220] lstrlenW (lpString=".jpg") returned 4 [0123.220] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1 [0123.220] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fbd8 | out: lpNewFilePointer=0x0) returned 1 [0123.220] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fbd8 | out: lpNewFilePointer=0x0) returned 1 [0123.220] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\blueprnt.elm.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0123.221] GetLastError () returned 0x0 [0123.221] ReadFile (in: hFile=0x21c, lpBuffer=0x4340020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fbe4, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesRead=0x391fbe4*=0xda86, lpOverlapped=0x0) returned 1 [0123.411] WriteFile (in: hFile=0x218, lpBuffer=0x4340020*, nNumberOfBytesToWrite=0xda90, lpNumberOfBytesWritten=0x391f9ac, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesWritten=0x391f9ac*=0xda90, lpOverlapped=0x0) returned 1 [0124.028] ReadFile (in: hFile=0x21c, lpBuffer=0x4340020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fbe4, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesRead=0x391fbe4*=0x0, lpOverlapped=0x0) returned 1 [0124.028] WriteFile (in: hFile=0x218, lpBuffer=0x4340020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x391f9ac, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesWritten=0x391f9ac*=0xec, lpOverlapped=0x0) returned 1 [0124.028] SetEndOfFile (hFile=0x218) returned 1 [0124.028] CloseHandle (hObject=0x218) returned 1 [0124.028] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fbd8 | out: lpNewFilePointer=0x0) returned 1 [0124.028] SetEndOfFile (hFile=0x21c) returned 1 [0124.029] CloseHandle (hObject=0x21c) returned 1 [0124.029] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0124.029] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\blueprnt.elm")) returned 1 [0124.029] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM") returned 77 [0124.029] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM") returned 77 [0124.029] lstrlenW (lpString=".doc") returned 4 [0124.029] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1 [0124.030] lstrlenW (lpString=".docx") returned 5 [0124.030] lstrcmpiW (lpString1=".docx", lpString2="T.ELM") returned -1 [0124.030] lstrlenW (lpString=".pdf") returned 4 [0124.030] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1 [0124.030] lstrlenW (lpString=".xls") returned 4 [0124.030] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1 [0124.030] lstrlenW (lpString=".xlsx") returned 5 [0124.030] lstrcmpiW (lpString1=".xlsx", lpString2="T.ELM") returned -1 [0124.030] lstrlenW (lpString=".ppt") returned 4 [0124.030] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1 [0124.030] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM") returned 77 [0124.030] lstrlenW (lpString=".zip") returned 4 [0124.030] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1 [0124.030] lstrlenW (lpString=".rar") returned 4 [0124.030] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1 [0124.030] lstrlenW (lpString=".bz2") returned 4 [0124.030] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1 [0124.030] lstrlenW (lpString=".7z") returned 3 [0124.030] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1 [0124.030] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM") returned 77 [0124.030] lstrlenW (lpString=".dbf") returned 4 [0124.030] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1 [0124.030] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM") returned 77 [0124.030] lstrlenW (lpString=".1cd") returned 4 [0124.030] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1 [0124.030] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM") returned 77 [0124.030] lstrlenW (lpString=".jpg") returned 4 [0124.030] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1 [0124.030] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fbd8 | out: lpNewFilePointer=0x0) returned 1 [0124.030] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fbd8 | out: lpNewFilePointer=0x0) returned 1 [0124.030] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\cascade.elm.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0124.031] GetLastError () returned 0x0 [0124.031] ReadFile (in: hFile=0x21c, lpBuffer=0x4340020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fbe4, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesRead=0x391fbe4*=0xba44, lpOverlapped=0x0) returned 1 [0124.060] WriteFile (in: hFile=0x218, lpBuffer=0x4340020*, nNumberOfBytesToWrite=0xba50, lpNumberOfBytesWritten=0x391f9ac, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesWritten=0x391f9ac*=0xba50, lpOverlapped=0x0) returned 1 [0124.060] ReadFile (in: hFile=0x21c, lpBuffer=0x4340020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fbe4, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesRead=0x391fbe4*=0x0, lpOverlapped=0x0) returned 1 [0124.060] WriteFile (in: hFile=0x218, lpBuffer=0x4340020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x391f9ac, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesWritten=0x391f9ac*=0xea, lpOverlapped=0x0) returned 1 [0124.060] SetEndOfFile (hFile=0x218) returned 1 [0124.061] CloseHandle (hObject=0x218) returned 1 [0124.061] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fbd8 | out: lpNewFilePointer=0x0) returned 1 [0124.061] SetEndOfFile (hFile=0x21c) returned 1 [0124.061] CloseHandle (hObject=0x21c) returned 1 [0124.061] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0124.061] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\cascade.elm")) returned 1 [0124.062] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM") returned 75 [0124.062] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM") returned 75 [0124.062] lstrlenW (lpString=".doc") returned 4 [0124.062] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1 [0124.062] lstrlenW (lpString=".docx") returned 5 [0124.062] lstrcmpiW (lpString1=".docx", lpString2="E.ELM") returned -1 [0124.062] lstrlenW (lpString=".pdf") returned 4 [0124.062] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1 [0124.062] lstrlenW (lpString=".xls") returned 4 [0124.062] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1 [0124.062] lstrlenW (lpString=".xlsx") returned 5 [0124.062] lstrcmpiW (lpString1=".xlsx", lpString2="E.ELM") returned -1 [0124.062] lstrlenW (lpString=".ppt") returned 4 [0124.062] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1 [0124.062] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM") returned 75 [0124.062] lstrlenW (lpString=".zip") returned 4 [0124.062] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1 [0124.062] lstrlenW (lpString=".rar") returned 4 [0124.062] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1 [0124.062] lstrlenW (lpString=".bz2") returned 4 [0124.062] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1 [0124.062] lstrlenW (lpString=".7z") returned 3 [0124.062] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1 [0124.062] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM") returned 75 [0124.062] lstrlenW (lpString=".dbf") returned 4 [0124.062] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1 [0124.062] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM") returned 75 [0124.062] lstrlenW (lpString=".1cd") returned 4 [0124.062] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1 [0124.062] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM") returned 75 [0124.062] lstrlenW (lpString=".jpg") returned 4 [0124.062] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1 [0124.062] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fbd8 | out: lpNewFilePointer=0x0) returned 1 [0124.063] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fbd8 | out: lpNewFilePointer=0x0) returned 1 [0124.063] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.INF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\cascade.inf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0124.063] GetLastError () returned 0x0 [0124.063] ReadFile (in: hFile=0x21c, lpBuffer=0x4340020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fbe4, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesRead=0x391fbe4*=0x262, lpOverlapped=0x0) returned 1 [0124.064] WriteFile (in: hFile=0x218, lpBuffer=0x4340020*, nNumberOfBytesToWrite=0x270, lpNumberOfBytesWritten=0x391f9ac, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesWritten=0x391f9ac*=0x270, lpOverlapped=0x0) returned 1 [0124.064] ReadFile (in: hFile=0x21c, lpBuffer=0x4340020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fbe4, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesRead=0x391fbe4*=0x0, lpOverlapped=0x0) returned 1 [0124.064] WriteFile (in: hFile=0x218, lpBuffer=0x4340020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x391f9ac, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesWritten=0x391f9ac*=0xea, lpOverlapped=0x0) returned 1 [0124.064] SetEndOfFile (hFile=0x218) returned 1 [0124.065] CloseHandle (hObject=0x218) returned 1 [0124.065] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fbd8 | out: lpNewFilePointer=0x0) returned 1 [0124.065] SetEndOfFile (hFile=0x21c) returned 1 [0124.065] CloseHandle (hObject=0x21c) returned 1 [0124.065] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.INF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0124.065] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\cascade.inf")) returned 1 [0124.066] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.INF") returned 75 [0124.066] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.INF") returned 75 [0124.066] lstrlenW (lpString=".doc") returned 4 [0124.066] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1 [0124.066] lstrlenW (lpString=".docx") returned 5 [0124.066] lstrcmpiW (lpString1=".docx", lpString2="E.INF") returned -1 [0124.066] lstrlenW (lpString=".pdf") returned 4 [0124.066] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1 [0124.066] lstrlenW (lpString=".xls") returned 4 [0124.066] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1 [0124.066] lstrlenW (lpString=".xlsx") returned 5 [0124.066] lstrcmpiW (lpString1=".xlsx", lpString2="E.INF") returned -1 [0124.066] lstrlenW (lpString=".ppt") returned 4 [0124.066] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1 [0124.066] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.INF") returned 75 [0124.066] lstrlenW (lpString=".zip") returned 4 [0124.066] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1 [0124.066] lstrlenW (lpString=".rar") returned 4 [0124.066] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1 [0124.066] lstrlenW (lpString=".bz2") returned 4 [0124.066] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1 [0124.066] lstrlenW (lpString=".7z") returned 3 [0124.066] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1 [0124.066] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.INF") returned 75 [0124.066] lstrlenW (lpString=".dbf") returned 4 [0124.066] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1 [0124.066] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.INF") returned 75 [0124.066] lstrlenW (lpString=".1cd") returned 4 [0124.066] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1 [0124.066] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.INF") returned 75 [0124.066] lstrlenW (lpString=".jpg") returned 4 [0124.066] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1 [0124.067] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fbd8 | out: lpNewFilePointer=0x0) returned 1 [0124.067] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fbd8 | out: lpNewFilePointer=0x0) returned 1 [0124.067] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.ELM.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\compass.elm.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0124.067] GetLastError () returned 0x0 [0124.067] ReadFile (in: hFile=0x21c, lpBuffer=0x4340020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fbe4, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesRead=0x391fbe4*=0xd613, lpOverlapped=0x0) returned 1 [0124.082] WriteFile (in: hFile=0x218, lpBuffer=0x4340020*, nNumberOfBytesToWrite=0xd620, lpNumberOfBytesWritten=0x391f9ac, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesWritten=0x391f9ac*=0xd620, lpOverlapped=0x0) returned 1 [0124.083] ReadFile (in: hFile=0x21c, lpBuffer=0x4340020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fbe4, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesRead=0x391fbe4*=0x0, lpOverlapped=0x0) returned 1 [0124.083] WriteFile (in: hFile=0x218, lpBuffer=0x4340020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x391f9ac, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesWritten=0x391f9ac*=0xea, lpOverlapped=0x0) returned 1 [0124.083] SetEndOfFile (hFile=0x218) returned 1 [0124.083] CloseHandle (hObject=0x218) returned 1 [0124.084] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fbd8 | out: lpNewFilePointer=0x0) returned 1 [0124.084] SetEndOfFile (hFile=0x21c) returned 1 [0124.084] CloseHandle (hObject=0x21c) returned 1 [0124.084] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.ELM.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0124.084] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\compass.elm")) returned 1 [0124.085] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.ELM") returned 75 [0124.085] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.ELM") returned 75 [0124.085] lstrlenW (lpString=".doc") returned 4 [0124.085] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1 [0124.085] lstrlenW (lpString=".docx") returned 5 [0124.085] lstrcmpiW (lpString1=".docx", lpString2="S.ELM") returned -1 [0124.085] lstrlenW (lpString=".pdf") returned 4 [0124.085] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1 [0124.085] lstrlenW (lpString=".xls") returned 4 [0124.085] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1 [0124.085] lstrlenW (lpString=".xlsx") returned 5 [0124.085] lstrcmpiW (lpString1=".xlsx", lpString2="S.ELM") returned -1 [0124.085] lstrlenW (lpString=".ppt") returned 4 [0124.085] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1 [0124.085] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.ELM") returned 75 [0124.085] lstrlenW (lpString=".zip") returned 4 [0124.085] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1 [0124.085] lstrlenW (lpString=".rar") returned 4 [0124.085] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1 [0124.085] lstrlenW (lpString=".bz2") returned 4 [0124.085] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1 [0124.085] lstrlenW (lpString=".7z") returned 3 [0124.085] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1 [0124.085] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.ELM") returned 75 [0124.234] lstrlenW (lpString=".dbf") returned 4 [0124.234] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1 [0124.234] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.ELM") returned 75 [0124.234] lstrlenW (lpString=".1cd") returned 4 [0124.234] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1 [0124.234] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.ELM") returned 75 [0124.234] lstrlenW (lpString=".jpg") returned 4 [0124.234] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1 [0124.234] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fbd8 | out: lpNewFilePointer=0x0) returned 1 [0124.235] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fbd8 | out: lpNewFilePointer=0x0) returned 1 [0124.235] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\deepblue.inf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0124.235] GetLastError () returned 0x0 [0124.235] ReadFile (in: hFile=0x23c, lpBuffer=0x4340020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fbe4, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesRead=0x391fbe4*=0x239, lpOverlapped=0x0) returned 1 [0124.236] WriteFile (in: hFile=0x180, lpBuffer=0x4340020*, nNumberOfBytesToWrite=0x240, lpNumberOfBytesWritten=0x391f9ac, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesWritten=0x391f9ac*=0x240, lpOverlapped=0x0) returned 1 [0124.236] ReadFile (in: hFile=0x23c, lpBuffer=0x4340020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fbe4, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesRead=0x391fbe4*=0x0, lpOverlapped=0x0) returned 1 [0124.236] WriteFile (in: hFile=0x180, lpBuffer=0x4340020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x391f9ac, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesWritten=0x391f9ac*=0xec, lpOverlapped=0x0) returned 1 [0124.236] SetEndOfFile (hFile=0x180) returned 1 [0124.236] CloseHandle (hObject=0x180) returned 1 [0124.236] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fbd8 | out: lpNewFilePointer=0x0) returned 1 [0124.236] SetEndOfFile (hFile=0x23c) returned 1 [0124.238] CloseHandle (hObject=0x23c) returned 1 [0124.238] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0124.238] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\deepblue.inf")) returned 1 [0124.239] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF") returned 77 [0124.239] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF") returned 77 [0124.239] lstrlenW (lpString=".doc") returned 4 [0124.239] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1 [0124.239] lstrlenW (lpString=".docx") returned 5 [0124.239] lstrcmpiW (lpString1=".docx", lpString2="E.INF") returned -1 [0124.239] lstrlenW (lpString=".pdf") returned 4 [0124.239] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1 [0124.239] lstrlenW (lpString=".xls") returned 4 [0124.239] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1 [0124.239] lstrlenW (lpString=".xlsx") returned 5 [0124.239] lstrcmpiW (lpString1=".xlsx", lpString2="E.INF") returned -1 [0124.239] lstrlenW (lpString=".ppt") returned 4 [0124.239] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1 [0124.239] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF") returned 77 [0124.239] lstrlenW (lpString=".zip") returned 4 [0124.239] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1 [0124.239] lstrlenW (lpString=".rar") returned 4 [0124.239] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1 [0124.239] lstrlenW (lpString=".bz2") returned 4 [0124.239] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1 [0124.239] lstrlenW (lpString=".7z") returned 3 [0124.239] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1 [0124.239] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF") returned 77 [0124.239] lstrlenW (lpString=".dbf") returned 4 [0124.239] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1 [0124.239] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF") returned 77 [0124.239] lstrlenW (lpString=".1cd") returned 4 [0124.239] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1 [0124.239] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF") returned 77 [0124.239] lstrlenW (lpString=".jpg") returned 4 [0124.239] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1 [0124.292] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fbd8 | out: lpNewFilePointer=0x0) returned 1 [0124.292] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fbd8 | out: lpNewFilePointer=0x0) returned 1 [0124.292] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\echo.elm.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0124.292] GetLastError () returned 0x0 [0124.292] ReadFile (in: hFile=0x220, lpBuffer=0x4340020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fbe4, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesRead=0x391fbe4*=0xb0ce, lpOverlapped=0x0) returned 1 [0124.294] WriteFile (in: hFile=0x21c, lpBuffer=0x4340020*, nNumberOfBytesToWrite=0xb0d0, lpNumberOfBytesWritten=0x391f9ac, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesWritten=0x391f9ac*=0xb0d0, lpOverlapped=0x0) returned 1 [0124.295] ReadFile (in: hFile=0x220, lpBuffer=0x4340020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fbe4, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesRead=0x391fbe4*=0x0, lpOverlapped=0x0) returned 1 [0124.295] WriteFile (in: hFile=0x21c, lpBuffer=0x4340020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x391f9ac, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesWritten=0x391f9ac*=0xe4, lpOverlapped=0x0) returned 1 [0124.295] SetEndOfFile (hFile=0x21c) returned 1 [0124.295] CloseHandle (hObject=0x21c) returned 1 [0124.295] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fbd8 | out: lpNewFilePointer=0x0) returned 1 [0124.295] SetEndOfFile (hFile=0x220) returned 1 [0124.296] CloseHandle (hObject=0x220) returned 1 [0124.296] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0124.296] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\echo.elm")) returned 1 [0124.296] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM") returned 69 [0124.296] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM") returned 69 [0124.296] lstrlenW (lpString=".doc") returned 4 [0124.296] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1 [0124.296] lstrlenW (lpString=".docx") returned 5 [0124.296] lstrcmpiW (lpString1=".docx", lpString2="O.ELM") returned -1 [0124.296] lstrlenW (lpString=".pdf") returned 4 [0124.296] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1 [0124.296] lstrlenW (lpString=".xls") returned 4 [0124.296] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1 [0124.296] lstrlenW (lpString=".xlsx") returned 5 [0124.296] lstrcmpiW (lpString1=".xlsx", lpString2="O.ELM") returned -1 [0124.296] lstrlenW (lpString=".ppt") returned 4 [0124.296] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1 [0124.296] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM") returned 69 [0124.296] lstrlenW (lpString=".zip") returned 4 [0124.296] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1 [0124.296] lstrlenW (lpString=".rar") returned 4 [0124.297] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1 [0124.297] lstrlenW (lpString=".bz2") returned 4 [0124.297] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1 [0124.297] lstrlenW (lpString=".7z") returned 3 [0124.297] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1 [0124.297] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM") returned 69 [0124.297] lstrlenW (lpString=".dbf") returned 4 [0124.297] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1 [0124.297] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM") returned 69 [0124.297] lstrlenW (lpString=".1cd") returned 4 [0124.297] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1 [0124.297] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM") returned 69 [0124.297] lstrlenW (lpString=".jpg") returned 4 [0124.297] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1 [0124.297] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fbd8 | out: lpNewFilePointer=0x0) returned 1 [0124.297] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fbd8 | out: lpNewFilePointer=0x0) returned 1 [0124.297] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.ELM.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\edge.elm.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0124.298] GetLastError () returned 0x0 [0124.298] ReadFile (in: hFile=0x220, lpBuffer=0x4340020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fbe4, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesRead=0x391fbe4*=0xb8f8, lpOverlapped=0x0) returned 1 [0124.311] WriteFile (in: hFile=0x21c, lpBuffer=0x4340020*, nNumberOfBytesToWrite=0xb900, lpNumberOfBytesWritten=0x391f9ac, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesWritten=0x391f9ac*=0xb900, lpOverlapped=0x0) returned 1 [0124.312] ReadFile (in: hFile=0x220, lpBuffer=0x4340020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fbe4, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesRead=0x391fbe4*=0x0, lpOverlapped=0x0) returned 1 [0124.312] WriteFile (in: hFile=0x21c, lpBuffer=0x4340020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x391f9ac, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesWritten=0x391f9ac*=0xe4, lpOverlapped=0x0) returned 1 [0124.312] SetEndOfFile (hFile=0x21c) returned 1 [0124.312] CloseHandle (hObject=0x21c) returned 1 [0124.312] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fbd8 | out: lpNewFilePointer=0x0) returned 1 [0124.312] SetEndOfFile (hFile=0x220) returned 1 [0124.313] CloseHandle (hObject=0x220) returned 1 [0124.313] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.ELM.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0124.313] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\edge.elm")) returned 1 [0124.313] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.ELM") returned 69 [0124.313] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.ELM") returned 69 [0124.313] lstrlenW (lpString=".doc") returned 4 [0124.313] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1 [0124.313] lstrlenW (lpString=".docx") returned 5 [0124.314] lstrcmpiW (lpString1=".docx", lpString2="E.ELM") returned -1 [0124.314] lstrlenW (lpString=".pdf") returned 4 [0124.314] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1 [0124.314] lstrlenW (lpString=".xls") returned 4 [0124.314] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1 [0124.314] lstrlenW (lpString=".xlsx") returned 5 [0124.314] lstrcmpiW (lpString1=".xlsx", lpString2="E.ELM") returned -1 [0124.314] lstrlenW (lpString=".ppt") returned 4 [0124.314] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1 [0124.314] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.ELM") returned 69 [0124.314] lstrlenW (lpString=".zip") returned 4 [0124.314] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1 [0124.314] lstrlenW (lpString=".rar") returned 4 [0124.314] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1 [0124.314] lstrlenW (lpString=".bz2") returned 4 [0124.314] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1 [0124.314] lstrlenW (lpString=".7z") returned 3 [0124.314] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1 [0124.314] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.ELM") returned 69 [0124.314] lstrlenW (lpString=".dbf") returned 4 [0124.314] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1 [0124.314] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.ELM") returned 69 [0124.314] lstrlenW (lpString=".1cd") returned 4 [0124.314] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1 [0124.314] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.ELM") returned 69 [0124.314] lstrlenW (lpString=".jpg") returned 4 [0124.314] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1 [0124.314] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fbd8 | out: lpNewFilePointer=0x0) returned 1 [0124.314] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fbd8 | out: lpNewFilePointer=0x0) returned 1 [0124.314] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.ELM.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\evrgreen.elm.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0124.315] GetLastError () returned 0x0 [0124.315] ReadFile (in: hFile=0x220, lpBuffer=0x4340020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fbe4, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesRead=0x391fbe4*=0x12dee, lpOverlapped=0x0) returned 1 [0124.398] WriteFile (in: hFile=0x21c, lpBuffer=0x4340020*, nNumberOfBytesToWrite=0x12df0, lpNumberOfBytesWritten=0x391f9ac, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesWritten=0x391f9ac*=0x12df0, lpOverlapped=0x0) returned 1 [0124.399] ReadFile (in: hFile=0x220, lpBuffer=0x4340020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fbe4, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesRead=0x391fbe4*=0x0, lpOverlapped=0x0) returned 1 [0124.399] WriteFile (in: hFile=0x21c, lpBuffer=0x4340020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x391f9ac, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesWritten=0x391f9ac*=0xec, lpOverlapped=0x0) returned 1 [0124.399] SetEndOfFile (hFile=0x21c) returned 1 [0124.399] CloseHandle (hObject=0x21c) returned 1 [0124.399] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fbd8 | out: lpNewFilePointer=0x0) returned 1 [0124.399] SetEndOfFile (hFile=0x220) returned 1 [0124.400] CloseHandle (hObject=0x220) returned 1 [0124.400] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.ELM.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0124.400] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\evrgreen.elm")) returned 1 [0124.400] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.ELM") returned 77 [0124.401] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.ELM") returned 77 [0124.401] lstrlenW (lpString=".doc") returned 4 [0124.401] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1 [0124.401] lstrlenW (lpString=".docx") returned 5 [0124.401] lstrcmpiW (lpString1=".docx", lpString2="N.ELM") returned -1 [0124.401] lstrlenW (lpString=".pdf") returned 4 [0124.401] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1 [0124.401] lstrlenW (lpString=".xls") returned 4 [0124.401] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1 [0124.401] lstrlenW (lpString=".xlsx") returned 5 [0124.401] lstrcmpiW (lpString1=".xlsx", lpString2="N.ELM") returned -1 [0124.401] lstrlenW (lpString=".ppt") returned 4 [0124.401] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1 [0124.401] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.ELM") returned 77 [0124.401] lstrlenW (lpString=".zip") returned 4 [0124.401] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1 [0124.401] lstrlenW (lpString=".rar") returned 4 [0124.401] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1 [0124.401] lstrlenW (lpString=".bz2") returned 4 [0124.401] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1 [0124.401] lstrlenW (lpString=".7z") returned 3 [0124.401] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1 [0124.401] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.ELM") returned 77 [0124.401] lstrlenW (lpString=".dbf") returned 4 [0124.401] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1 [0124.401] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.ELM") returned 77 [0124.401] lstrlenW (lpString=".1cd") returned 4 [0124.401] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1 [0124.401] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.ELM") returned 77 [0124.401] lstrlenW (lpString=".jpg") returned 4 [0124.401] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1 [0124.415] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fbd8 | out: lpNewFilePointer=0x0) returned 1 [0124.415] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fbd8 | out: lpNewFilePointer=0x0) returned 1 [0124.415] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\iris.elm.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0124.416] GetLastError () returned 0x0 [0124.416] ReadFile (in: hFile=0x218, lpBuffer=0x4340020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fbe4, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesRead=0x391fbe4*=0x1015d, lpOverlapped=0x0) returned 1 [0124.469] WriteFile (in: hFile=0x1e0, lpBuffer=0x4340020*, nNumberOfBytesToWrite=0x10160, lpNumberOfBytesWritten=0x391f9ac, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesWritten=0x391f9ac*=0x10160, lpOverlapped=0x0) returned 1 [0124.469] ReadFile (in: hFile=0x218, lpBuffer=0x4340020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fbe4, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesRead=0x391fbe4*=0x0, lpOverlapped=0x0) returned 1 [0124.470] WriteFile (in: hFile=0x1e0, lpBuffer=0x4340020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x391f9ac, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesWritten=0x391f9ac*=0xe4, lpOverlapped=0x0) returned 1 [0124.470] SetEndOfFile (hFile=0x1e0) returned 1 [0124.470] CloseHandle (hObject=0x1e0) returned 1 [0124.470] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fbd8 | out: lpNewFilePointer=0x0) returned 1 [0124.470] SetEndOfFile (hFile=0x218) returned 1 [0124.470] CloseHandle (hObject=0x218) returned 1 [0124.471] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0124.471] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\iris.elm")) returned 1 [0124.471] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM") returned 69 [0124.471] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM") returned 69 [0124.471] lstrlenW (lpString=".doc") returned 4 [0124.471] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1 [0124.471] lstrlenW (lpString=".docx") returned 5 [0124.471] lstrcmpiW (lpString1=".docx", lpString2="S.ELM") returned -1 [0124.471] lstrlenW (lpString=".pdf") returned 4 [0124.471] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1 [0124.471] lstrlenW (lpString=".xls") returned 4 [0124.471] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1 [0124.471] lstrlenW (lpString=".xlsx") returned 5 [0124.471] lstrcmpiW (lpString1=".xlsx", lpString2="S.ELM") returned -1 [0124.471] lstrlenW (lpString=".ppt") returned 4 [0124.471] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1 [0124.471] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM") returned 69 [0124.471] lstrlenW (lpString=".zip") returned 4 [0124.471] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1 [0124.472] lstrlenW (lpString=".rar") returned 4 [0124.472] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1 [0124.472] lstrlenW (lpString=".bz2") returned 4 [0124.472] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1 [0124.472] lstrlenW (lpString=".7z") returned 3 [0124.472] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1 [0124.472] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM") returned 69 [0124.472] lstrlenW (lpString=".dbf") returned 4 [0124.472] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1 [0124.472] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM") returned 69 [0124.472] lstrlenW (lpString=".1cd") returned 4 [0124.472] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1 [0124.472] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM") returned 69 [0124.472] lstrlenW (lpString=".jpg") returned 4 [0124.472] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1 [0124.473] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fbd8 | out: lpNewFilePointer=0x0) returned 1 [0124.473] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fbd8 | out: lpNewFilePointer=0x0) returned 1 [0124.473] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.INF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\network.inf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0124.474] GetLastError () returned 0x0 [0124.474] ReadFile (in: hFile=0x218, lpBuffer=0x4340020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fbe4, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesRead=0x391fbe4*=0x249, lpOverlapped=0x0) returned 1 [0124.475] WriteFile (in: hFile=0x1e0, lpBuffer=0x4340020*, nNumberOfBytesToWrite=0x250, lpNumberOfBytesWritten=0x391f9ac, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesWritten=0x391f9ac*=0x250, lpOverlapped=0x0) returned 1 [0124.476] ReadFile (in: hFile=0x218, lpBuffer=0x4340020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fbe4, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesRead=0x391fbe4*=0x0, lpOverlapped=0x0) returned 1 [0124.476] WriteFile (in: hFile=0x1e0, lpBuffer=0x4340020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x391f9ac, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesWritten=0x391f9ac*=0xea, lpOverlapped=0x0) returned 1 [0124.476] SetEndOfFile (hFile=0x1e0) returned 1 [0124.476] CloseHandle (hObject=0x1e0) returned 1 [0124.476] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fbd8 | out: lpNewFilePointer=0x0) returned 1 [0124.476] SetEndOfFile (hFile=0x218) returned 1 [0124.477] CloseHandle (hObject=0x218) returned 1 [0124.477] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.INF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0124.477] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\network.inf")) returned 1 [0124.477] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.INF") returned 75 [0124.477] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.INF") returned 75 [0124.477] lstrlenW (lpString=".doc") returned 4 [0124.478] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1 [0124.478] lstrlenW (lpString=".docx") returned 5 [0124.478] lstrcmpiW (lpString1=".docx", lpString2="K.INF") returned -1 [0124.478] lstrlenW (lpString=".pdf") returned 4 [0124.478] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1 [0124.478] lstrlenW (lpString=".xls") returned 4 [0124.478] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1 [0124.478] lstrlenW (lpString=".xlsx") returned 5 [0124.478] lstrcmpiW (lpString1=".xlsx", lpString2="K.INF") returned -1 [0124.478] lstrlenW (lpString=".ppt") returned 4 [0124.478] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1 [0124.478] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.INF") returned 75 [0124.478] lstrlenW (lpString=".zip") returned 4 [0124.478] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1 [0124.478] lstrlenW (lpString=".rar") returned 4 [0124.478] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1 [0124.478] lstrlenW (lpString=".bz2") returned 4 [0124.478] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1 [0124.478] lstrlenW (lpString=".7z") returned 3 [0124.478] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1 [0124.478] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.INF") returned 75 [0124.478] lstrlenW (lpString=".dbf") returned 4 [0124.478] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1 [0124.478] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.INF") returned 75 [0124.478] lstrlenW (lpString=".1cd") returned 4 [0124.478] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1 [0124.478] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.INF") returned 75 [0124.478] lstrlenW (lpString=".jpg") returned 4 [0124.478] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1 [0124.478] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x391fc2c | out: lpFileSize=0x391fc2c*=91861) returned 1 [0124.478] CloseHandle (hObject=0x218) returned 1 [0124.478] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\papyrus.elm")) returned 0x20 [0124.478] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\papyrus.elm.id-9c354b42.[darknes@420blaze.it].waifu")) returned 0xffffffff [0124.479] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\papyrus.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0124.479] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fbd8 | out: lpNewFilePointer=0x0) returned 1 [0124.479] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fbd8 | out: lpNewFilePointer=0x0) returned 1 [0124.479] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\papyrus.elm.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0124.479] GetLastError () returned 0x0 [0124.479] ReadFile (in: hFile=0x218, lpBuffer=0x4340020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fbe4, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesRead=0x391fbe4*=0x166d5, lpOverlapped=0x0) returned 1 [0124.511] WriteFile (in: hFile=0x1e0, lpBuffer=0x4340020*, nNumberOfBytesToWrite=0x166e0, lpNumberOfBytesWritten=0x391f9ac, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesWritten=0x391f9ac*=0x166e0, lpOverlapped=0x0) returned 1 [0124.512] ReadFile (in: hFile=0x218, lpBuffer=0x4340020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fbe4, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesRead=0x391fbe4*=0x0, lpOverlapped=0x0) returned 1 [0124.512] WriteFile (in: hFile=0x1e0, lpBuffer=0x4340020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x391f9ac, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesWritten=0x391f9ac*=0xea, lpOverlapped=0x0) returned 1 [0124.513] SetEndOfFile (hFile=0x1e0) returned 1 [0124.513] CloseHandle (hObject=0x1e0) returned 1 [0124.513] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fbd8 | out: lpNewFilePointer=0x0) returned 1 [0124.513] SetEndOfFile (hFile=0x218) returned 1 [0124.513] CloseHandle (hObject=0x218) returned 1 [0124.513] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0124.513] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\papyrus.elm")) returned 1 [0124.514] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM") returned 75 [0124.514] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM") returned 75 [0124.514] lstrlenW (lpString=".doc") returned 4 [0124.514] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1 [0124.514] lstrlenW (lpString=".docx") returned 5 [0124.514] lstrcmpiW (lpString1=".docx", lpString2="S.ELM") returned -1 [0124.514] lstrlenW (lpString=".pdf") returned 4 [0124.514] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1 [0124.514] lstrlenW (lpString=".xls") returned 4 [0124.514] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1 [0124.514] lstrlenW (lpString=".xlsx") returned 5 [0124.514] lstrcmpiW (lpString1=".xlsx", lpString2="S.ELM") returned -1 [0124.514] lstrlenW (lpString=".ppt") returned 4 [0124.514] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1 [0124.514] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM") returned 75 [0124.514] lstrlenW (lpString=".zip") returned 4 [0124.514] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1 [0124.514] lstrlenW (lpString=".rar") returned 4 [0124.514] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1 [0124.514] lstrlenW (lpString=".bz2") returned 4 [0124.514] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1 [0124.514] lstrlenW (lpString=".7z") returned 3 [0124.514] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1 [0124.514] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM") returned 75 [0124.514] lstrlenW (lpString=".dbf") returned 4 [0124.514] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1 [0124.514] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM") returned 75 [0124.514] lstrlenW (lpString=".1cd") returned 4 [0124.514] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1 [0124.514] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM") returned 75 [0124.514] lstrlenW (lpString=".jpg") returned 4 [0124.514] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1 [0124.515] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fbd8 | out: lpNewFilePointer=0x0) returned 1 [0124.515] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fbd8 | out: lpNewFilePointer=0x0) returned 1 [0124.515] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.INF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\pixel.inf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0124.515] GetLastError () returned 0x0 [0124.515] ReadFile (in: hFile=0x218, lpBuffer=0x4340020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fbe4, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesRead=0x391fbe4*=0x21b, lpOverlapped=0x0) returned 1 [0124.516] WriteFile (in: hFile=0x1e0, lpBuffer=0x4340020*, nNumberOfBytesToWrite=0x220, lpNumberOfBytesWritten=0x391f9ac, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesWritten=0x391f9ac*=0x220, lpOverlapped=0x0) returned 1 [0124.516] ReadFile (in: hFile=0x218, lpBuffer=0x4340020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fbe4, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesRead=0x391fbe4*=0x0, lpOverlapped=0x0) returned 1 [0124.516] WriteFile (in: hFile=0x1e0, lpBuffer=0x4340020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x391f9ac, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesWritten=0x391f9ac*=0xe6, lpOverlapped=0x0) returned 1 [0124.516] SetEndOfFile (hFile=0x1e0) returned 1 [0124.517] CloseHandle (hObject=0x1e0) returned 1 [0124.517] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fbd8 | out: lpNewFilePointer=0x0) returned 1 [0124.517] SetEndOfFile (hFile=0x218) returned 1 [0124.517] CloseHandle (hObject=0x218) returned 1 [0124.517] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.INF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0124.517] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\pixel.inf")) returned 1 [0124.518] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.INF") returned 71 [0124.518] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.INF") returned 71 [0124.518] lstrlenW (lpString=".doc") returned 4 [0124.518] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1 [0124.518] lstrlenW (lpString=".docx") returned 5 [0124.518] lstrcmpiW (lpString1=".docx", lpString2="L.INF") returned -1 [0124.518] lstrlenW (lpString=".pdf") returned 4 [0124.518] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1 [0124.518] lstrlenW (lpString=".xls") returned 4 [0124.518] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1 [0124.518] lstrlenW (lpString=".xlsx") returned 5 [0124.518] lstrcmpiW (lpString1=".xlsx", lpString2="L.INF") returned -1 [0124.518] lstrlenW (lpString=".ppt") returned 4 [0124.518] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1 [0124.518] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.INF") returned 71 [0124.518] lstrlenW (lpString=".zip") returned 4 [0124.518] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1 [0124.518] lstrlenW (lpString=".rar") returned 4 [0124.518] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1 [0124.518] lstrlenW (lpString=".bz2") returned 4 [0124.518] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1 [0124.518] lstrlenW (lpString=".7z") returned 3 [0124.518] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1 [0124.518] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.INF") returned 71 [0124.518] lstrlenW (lpString=".dbf") returned 4 [0124.518] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1 [0124.518] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.INF") returned 71 [0124.518] lstrlenW (lpString=".1cd") returned 4 [0124.518] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1 [0124.518] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.INF") returned 71 [0124.518] lstrlenW (lpString=".jpg") returned 4 [0124.518] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1 [0124.519] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fbd8 | out: lpNewFilePointer=0x0) returned 1 [0124.519] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fbd8 | out: lpNewFilePointer=0x0) returned 1 [0124.519] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.ELM.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\profile.elm.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0124.520] GetLastError () returned 0x0 [0124.520] ReadFile (in: hFile=0x218, lpBuffer=0x4340020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fbe4, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesRead=0x391fbe4*=0xb20e, lpOverlapped=0x0) returned 1 [0124.527] WriteFile (in: hFile=0x1e0, lpBuffer=0x4340020*, nNumberOfBytesToWrite=0xb210, lpNumberOfBytesWritten=0x391f9ac, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesWritten=0x391f9ac*=0xb210, lpOverlapped=0x0) returned 1 [0124.528] ReadFile (in: hFile=0x218, lpBuffer=0x4340020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fbe4, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesRead=0x391fbe4*=0x0, lpOverlapped=0x0) returned 1 [0124.528] WriteFile (in: hFile=0x1e0, lpBuffer=0x4340020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x391f9ac, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesWritten=0x391f9ac*=0xea, lpOverlapped=0x0) returned 1 [0124.528] SetEndOfFile (hFile=0x1e0) returned 1 [0124.528] CloseHandle (hObject=0x1e0) returned 1 [0124.528] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fbd8 | out: lpNewFilePointer=0x0) returned 1 [0124.528] SetEndOfFile (hFile=0x218) returned 1 [0124.529] CloseHandle (hObject=0x218) returned 1 [0124.529] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.ELM.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0124.529] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\profile.elm")) returned 1 [0124.529] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.ELM") returned 75 [0124.529] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.ELM") returned 75 [0124.529] lstrlenW (lpString=".doc") returned 4 [0124.529] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1 [0124.529] lstrlenW (lpString=".docx") returned 5 [0124.529] lstrcmpiW (lpString1=".docx", lpString2="E.ELM") returned -1 [0124.529] lstrlenW (lpString=".pdf") returned 4 [0124.529] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1 [0124.529] lstrlenW (lpString=".xls") returned 4 [0124.529] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1 [0124.529] lstrlenW (lpString=".xlsx") returned 5 [0124.529] lstrcmpiW (lpString1=".xlsx", lpString2="E.ELM") returned -1 [0124.529] lstrlenW (lpString=".ppt") returned 4 [0124.530] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1 [0124.530] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.ELM") returned 75 [0124.530] lstrlenW (lpString=".zip") returned 4 [0124.530] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1 [0124.530] lstrlenW (lpString=".rar") returned 4 [0124.530] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1 [0124.530] lstrlenW (lpString=".bz2") returned 4 [0124.530] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1 [0124.530] lstrlenW (lpString=".7z") returned 3 [0124.530] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1 [0124.530] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.ELM") returned 75 [0124.530] lstrlenW (lpString=".dbf") returned 4 [0124.530] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1 [0124.530] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.ELM") returned 75 [0124.530] lstrlenW (lpString=".1cd") returned 4 [0124.530] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1 [0124.530] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.ELM") returned 75 [0124.530] lstrlenW (lpString=".jpg") returned 4 [0124.530] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1 [0124.531] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fbd8 | out: lpNewFilePointer=0x0) returned 1 [0124.531] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fbd8 | out: lpNewFilePointer=0x0) returned 1 [0124.531] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.ELM.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\quad.elm.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0124.531] GetLastError () returned 0x0 [0124.531] ReadFile (in: hFile=0x218, lpBuffer=0x4340020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fbe4, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesRead=0x391fbe4*=0xbba7, lpOverlapped=0x0) returned 1 [0124.604] WriteFile (in: hFile=0x1e0, lpBuffer=0x4340020*, nNumberOfBytesToWrite=0xbbb0, lpNumberOfBytesWritten=0x391f9ac, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesWritten=0x391f9ac*=0xbbb0, lpOverlapped=0x0) returned 1 [0124.604] ReadFile (in: hFile=0x218, lpBuffer=0x4340020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fbe4, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesRead=0x391fbe4*=0x0, lpOverlapped=0x0) returned 1 [0124.604] WriteFile (in: hFile=0x1e0, lpBuffer=0x4340020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x391f9ac, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesWritten=0x391f9ac*=0xe4, lpOverlapped=0x0) returned 1 [0124.605] SetEndOfFile (hFile=0x1e0) returned 1 [0124.605] CloseHandle (hObject=0x1e0) returned 1 [0124.605] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fbd8 | out: lpNewFilePointer=0x0) returned 1 [0124.605] SetEndOfFile (hFile=0x218) returned 1 [0124.605] CloseHandle (hObject=0x218) returned 1 [0124.605] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.ELM.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0124.605] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\quad.elm")) returned 1 [0124.606] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.ELM") returned 69 [0124.606] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.ELM") returned 69 [0124.606] lstrlenW (lpString=".doc") returned 4 [0124.606] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1 [0124.606] lstrlenW (lpString=".docx") returned 5 [0124.606] lstrcmpiW (lpString1=".docx", lpString2="D.ELM") returned -1 [0124.606] lstrlenW (lpString=".pdf") returned 4 [0124.606] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1 [0124.606] lstrlenW (lpString=".xls") returned 4 [0124.606] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1 [0124.606] lstrlenW (lpString=".xlsx") returned 5 [0124.606] lstrcmpiW (lpString1=".xlsx", lpString2="D.ELM") returned -1 [0124.606] lstrlenW (lpString=".ppt") returned 4 [0124.606] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1 [0124.606] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.ELM") returned 69 [0124.606] lstrlenW (lpString=".zip") returned 4 [0124.606] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1 [0124.606] lstrlenW (lpString=".rar") returned 4 [0124.606] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1 [0124.606] lstrlenW (lpString=".bz2") returned 4 [0124.606] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1 [0124.606] lstrlenW (lpString=".7z") returned 3 [0124.606] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1 [0124.606] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.ELM") returned 69 [0124.606] lstrlenW (lpString=".dbf") returned 4 [0124.606] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1 [0124.606] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.ELM") returned 69 [0124.606] lstrlenW (lpString=".1cd") returned 4 [0124.606] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1 [0124.606] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.ELM") returned 69 [0124.606] lstrlenW (lpString=".jpg") returned 4 [0124.606] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1 [0124.619] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fbd8 | out: lpNewFilePointer=0x0) returned 1 [0124.619] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fbd8 | out: lpNewFilePointer=0x0) returned 1 [0124.620] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.INF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\ricepapr.inf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0124.620] GetLastError () returned 0x0 [0124.620] ReadFile (in: hFile=0x230, lpBuffer=0x4340020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fbe4, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesRead=0x391fbe4*=0x239, lpOverlapped=0x0) returned 1 [0124.621] WriteFile (in: hFile=0x1b0, lpBuffer=0x4340020*, nNumberOfBytesToWrite=0x240, lpNumberOfBytesWritten=0x391f9ac, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesWritten=0x391f9ac*=0x240, lpOverlapped=0x0) returned 1 [0124.621] ReadFile (in: hFile=0x230, lpBuffer=0x4340020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fbe4, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesRead=0x391fbe4*=0x0, lpOverlapped=0x0) returned 1 [0124.621] WriteFile (in: hFile=0x1b0, lpBuffer=0x4340020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x391f9ac, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesWritten=0x391f9ac*=0xec, lpOverlapped=0x0) returned 1 [0124.621] SetEndOfFile (hFile=0x1b0) returned 1 [0124.621] CloseHandle (hObject=0x1b0) returned 1 [0124.621] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fbd8 | out: lpNewFilePointer=0x0) returned 1 [0124.621] SetEndOfFile (hFile=0x230) returned 1 [0124.622] CloseHandle (hObject=0x230) returned 1 [0124.622] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.INF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0124.622] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\ricepapr.inf")) returned 1 [0124.623] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.INF") returned 77 [0124.623] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.INF") returned 77 [0124.623] lstrlenW (lpString=".doc") returned 4 [0124.623] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1 [0124.623] lstrlenW (lpString=".docx") returned 5 [0124.623] lstrcmpiW (lpString1=".docx", lpString2="R.INF") returned -1 [0124.623] lstrlenW (lpString=".pdf") returned 4 [0124.623] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1 [0124.623] lstrlenW (lpString=".xls") returned 4 [0124.623] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1 [0124.623] lstrlenW (lpString=".xlsx") returned 5 [0124.623] lstrcmpiW (lpString1=".xlsx", lpString2="R.INF") returned -1 [0124.623] lstrlenW (lpString=".ppt") returned 4 [0124.623] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1 [0124.623] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.INF") returned 77 [0124.623] lstrlenW (lpString=".zip") returned 4 [0124.623] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1 [0124.623] lstrlenW (lpString=".rar") returned 4 [0124.623] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1 [0124.623] lstrlenW (lpString=".bz2") returned 4 [0124.623] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1 [0124.623] lstrlenW (lpString=".7z") returned 3 [0124.623] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1 [0124.623] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.INF") returned 77 [0124.623] lstrlenW (lpString=".dbf") returned 4 [0124.623] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1 [0124.623] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.INF") returned 77 [0124.623] lstrlenW (lpString=".1cd") returned 4 [0124.623] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1 [0124.623] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.INF") returned 77 [0124.623] lstrlenW (lpString=".jpg") returned 4 [0124.623] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1 [0124.624] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fbd8 | out: lpNewFilePointer=0x0) returned 1 [0124.624] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fbd8 | out: lpNewFilePointer=0x0) returned 1 [0124.624] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\ripple.elm.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0124.625] GetLastError () returned 0x0 [0124.625] ReadFile (in: hFile=0x230, lpBuffer=0x4340020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fbe4, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesRead=0x391fbe4*=0x101e0, lpOverlapped=0x0) returned 1 [0124.696] WriteFile (in: hFile=0x1b0, lpBuffer=0x4340020*, nNumberOfBytesToWrite=0x101f0, lpNumberOfBytesWritten=0x391f9ac, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesWritten=0x391f9ac*=0x101f0, lpOverlapped=0x0) returned 1 [0124.697] ReadFile (in: hFile=0x230, lpBuffer=0x4340020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fbe4, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesRead=0x391fbe4*=0x0, lpOverlapped=0x0) returned 1 [0124.697] WriteFile (in: hFile=0x1b0, lpBuffer=0x4340020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x391f9ac, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesWritten=0x391f9ac*=0xe8, lpOverlapped=0x0) returned 1 [0124.698] SetEndOfFile (hFile=0x1b0) returned 1 [0124.698] CloseHandle (hObject=0x1b0) returned 1 [0124.698] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fbd8 | out: lpNewFilePointer=0x0) returned 1 [0124.698] SetEndOfFile (hFile=0x230) returned 1 [0124.698] CloseHandle (hObject=0x230) returned 1 [0124.698] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0124.699] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\ripple.elm")) returned 1 [0124.699] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM") returned 73 [0124.699] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM") returned 73 [0124.699] lstrlenW (lpString=".doc") returned 4 [0124.699] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1 [0124.699] lstrlenW (lpString=".docx") returned 5 [0124.699] lstrcmpiW (lpString1=".docx", lpString2="E.ELM") returned -1 [0124.699] lstrlenW (lpString=".pdf") returned 4 [0124.699] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1 [0124.699] lstrlenW (lpString=".xls") returned 4 [0124.699] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1 [0124.699] lstrlenW (lpString=".xlsx") returned 5 [0124.699] lstrcmpiW (lpString1=".xlsx", lpString2="E.ELM") returned -1 [0124.699] lstrlenW (lpString=".ppt") returned 4 [0124.699] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1 [0124.699] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM") returned 73 [0124.699] lstrlenW (lpString=".zip") returned 4 [0124.699] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1 [0124.699] lstrlenW (lpString=".rar") returned 4 [0124.699] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1 [0124.699] lstrlenW (lpString=".bz2") returned 4 [0124.700] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1 [0124.700] lstrlenW (lpString=".7z") returned 3 [0124.700] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1 [0124.700] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM") returned 73 [0124.700] lstrlenW (lpString=".dbf") returned 4 [0124.700] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1 [0124.700] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM") returned 73 [0124.700] lstrlenW (lpString=".1cd") returned 4 [0124.700] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1 [0124.700] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM") returned 73 [0124.700] lstrlenW (lpString=".jpg") returned 4 [0124.700] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1 [0124.701] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fbd8 | out: lpNewFilePointer=0x0) returned 1 [0124.701] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fbd8 | out: lpNewFilePointer=0x0) returned 1 [0124.701] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.ELM.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\satin.elm.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0124.701] GetLastError () returned 0x0 [0124.701] ReadFile (in: hFile=0x230, lpBuffer=0x4340020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fbe4, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesRead=0x391fbe4*=0x1936f, lpOverlapped=0x0) returned 1 [0124.776] WriteFile (in: hFile=0x1b0, lpBuffer=0x4340020*, nNumberOfBytesToWrite=0x19370, lpNumberOfBytesWritten=0x391f9ac, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesWritten=0x391f9ac*=0x19370, lpOverlapped=0x0) returned 1 [0124.777] ReadFile (in: hFile=0x230, lpBuffer=0x4340020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fbe4, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesRead=0x391fbe4*=0x0, lpOverlapped=0x0) returned 1 [0124.777] WriteFile (in: hFile=0x1b0, lpBuffer=0x4340020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x391f9ac, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesWritten=0x391f9ac*=0xe6, lpOverlapped=0x0) returned 1 [0124.777] SetEndOfFile (hFile=0x1b0) returned 1 [0124.777] CloseHandle (hObject=0x1b0) returned 1 [0124.777] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fbd8 | out: lpNewFilePointer=0x0) returned 1 [0124.777] SetEndOfFile (hFile=0x230) returned 1 [0124.778] CloseHandle (hObject=0x230) returned 1 [0124.778] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.ELM.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0124.778] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\satin.elm")) returned 1 [0124.778] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.ELM") returned 71 [0124.778] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.ELM") returned 71 [0124.778] lstrlenW (lpString=".doc") returned 4 [0124.778] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1 [0124.778] lstrlenW (lpString=".docx") returned 5 [0124.778] lstrcmpiW (lpString1=".docx", lpString2="N.ELM") returned -1 [0124.779] lstrlenW (lpString=".pdf") returned 4 [0124.779] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1 [0124.779] lstrlenW (lpString=".xls") returned 4 [0124.779] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1 [0124.779] lstrlenW (lpString=".xlsx") returned 5 [0124.779] lstrcmpiW (lpString1=".xlsx", lpString2="N.ELM") returned -1 [0124.779] lstrlenW (lpString=".ppt") returned 4 [0124.779] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1 [0124.779] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.ELM") returned 71 [0124.779] lstrlenW (lpString=".zip") returned 4 [0124.779] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1 [0124.779] lstrlenW (lpString=".rar") returned 4 [0124.779] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1 [0124.779] lstrlenW (lpString=".bz2") returned 4 [0124.779] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1 [0124.779] lstrlenW (lpString=".7z") returned 3 [0124.779] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1 [0124.779] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.ELM") returned 71 [0124.779] lstrlenW (lpString=".dbf") returned 4 [0124.779] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1 [0124.779] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.ELM") returned 71 [0124.779] lstrlenW (lpString=".1cd") returned 4 [0124.779] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1 [0124.779] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.ELM") returned 71 [0124.779] lstrlenW (lpString=".jpg") returned 4 [0124.779] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1 [0124.779] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fbd8 | out: lpNewFilePointer=0x0) returned 1 [0124.779] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fbd8 | out: lpNewFilePointer=0x0) returned 1 [0124.779] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.INF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\sky.inf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0124.780] GetLastError () returned 0x0 [0124.780] ReadFile (in: hFile=0x230, lpBuffer=0x4340020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fbe4, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesRead=0x391fbe4*=0x1bc, lpOverlapped=0x0) returned 1 [0124.781] WriteFile (in: hFile=0x1b0, lpBuffer=0x4340020*, nNumberOfBytesToWrite=0x1c0, lpNumberOfBytesWritten=0x391f9ac, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesWritten=0x391f9ac*=0x1c0, lpOverlapped=0x0) returned 1 [0124.781] ReadFile (in: hFile=0x230, lpBuffer=0x4340020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fbe4, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesRead=0x391fbe4*=0x0, lpOverlapped=0x0) returned 1 [0124.782] WriteFile (in: hFile=0x1b0, lpBuffer=0x4340020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x391f9ac, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesWritten=0x391f9ac*=0xe2, lpOverlapped=0x0) returned 1 [0124.782] SetEndOfFile (hFile=0x1b0) returned 1 [0124.782] CloseHandle (hObject=0x1b0) returned 1 [0124.782] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fbd8 | out: lpNewFilePointer=0x0) returned 1 [0124.782] SetEndOfFile (hFile=0x230) returned 1 [0124.783] CloseHandle (hObject=0x230) returned 1 [0124.783] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.INF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0124.783] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\sky.inf")) returned 1 [0124.783] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.INF") returned 67 [0124.783] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.INF") returned 67 [0124.783] lstrlenW (lpString=".doc") returned 4 [0124.783] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1 [0124.783] lstrlenW (lpString=".docx") returned 5 [0124.783] lstrcmpiW (lpString1=".docx", lpString2="Y.INF") returned -1 [0124.783] lstrlenW (lpString=".pdf") returned 4 [0124.783] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1 [0124.783] lstrlenW (lpString=".xls") returned 4 [0124.783] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1 [0124.783] lstrlenW (lpString=".xlsx") returned 5 [0124.783] lstrcmpiW (lpString1=".xlsx", lpString2="Y.INF") returned -1 [0124.783] lstrlenW (lpString=".ppt") returned 4 [0124.784] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1 [0124.784] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.INF") returned 67 [0124.784] lstrlenW (lpString=".zip") returned 4 [0124.784] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1 [0124.784] lstrlenW (lpString=".rar") returned 4 [0124.784] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1 [0124.784] lstrlenW (lpString=".bz2") returned 4 [0124.784] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1 [0124.784] lstrlenW (lpString=".7z") returned 3 [0124.784] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1 [0124.784] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.INF") returned 67 [0124.784] lstrlenW (lpString=".dbf") returned 4 [0124.784] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1 [0124.784] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.INF") returned 67 [0124.784] lstrlenW (lpString=".1cd") returned 4 [0124.784] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1 [0124.784] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.INF") returned 67 [0124.784] lstrlenW (lpString=".jpg") returned 4 [0124.784] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1 [0124.784] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fbd8 | out: lpNewFilePointer=0x0) returned 1 [0124.784] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fbd8 | out: lpNewFilePointer=0x0) returned 1 [0124.785] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.ELM.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\slate.elm.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0124.795] GetLastError () returned 0x0 [0124.795] ReadFile (in: hFile=0x230, lpBuffer=0x4340020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fbe4, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesRead=0x391fbe4*=0x14c40, lpOverlapped=0x0) returned 1 [0124.835] WriteFile (in: hFile=0x1b0, lpBuffer=0x4340020*, nNumberOfBytesToWrite=0x14c50, lpNumberOfBytesWritten=0x391f9ac, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesWritten=0x391f9ac*=0x14c50, lpOverlapped=0x0) returned 1 [0124.836] ReadFile (in: hFile=0x230, lpBuffer=0x4340020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fbe4, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesRead=0x391fbe4*=0x0, lpOverlapped=0x0) returned 1 [0124.836] WriteFile (in: hFile=0x1b0, lpBuffer=0x4340020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x391f9ac, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesWritten=0x391f9ac*=0xe6, lpOverlapped=0x0) returned 1 [0124.837] SetEndOfFile (hFile=0x1b0) returned 1 [0124.837] CloseHandle (hObject=0x1b0) returned 1 [0124.837] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fbd8 | out: lpNewFilePointer=0x0) returned 1 [0124.837] SetEndOfFile (hFile=0x230) returned 1 [0124.837] CloseHandle (hObject=0x230) returned 1 [0124.837] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.ELM.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0124.838] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\slate.elm")) returned 1 [0124.838] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.ELM") returned 71 [0124.838] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.ELM") returned 71 [0124.838] lstrlenW (lpString=".doc") returned 4 [0124.838] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1 [0124.838] lstrlenW (lpString=".docx") returned 5 [0124.838] lstrcmpiW (lpString1=".docx", lpString2="E.ELM") returned -1 [0124.838] lstrlenW (lpString=".pdf") returned 4 [0124.838] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1 [0124.838] lstrlenW (lpString=".xls") returned 4 [0124.838] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1 [0124.838] lstrlenW (lpString=".xlsx") returned 5 [0124.838] lstrcmpiW (lpString1=".xlsx", lpString2="E.ELM") returned -1 [0124.838] lstrlenW (lpString=".ppt") returned 4 [0124.838] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1 [0124.838] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.ELM") returned 71 [0124.838] lstrlenW (lpString=".zip") returned 4 [0124.838] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1 [0124.838] lstrlenW (lpString=".rar") returned 4 [0124.838] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1 [0124.838] lstrlenW (lpString=".bz2") returned 4 [0124.838] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1 [0124.838] lstrlenW (lpString=".7z") returned 3 [0124.838] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1 [0124.838] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.ELM") returned 71 [0124.838] lstrlenW (lpString=".dbf") returned 4 [0124.838] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1 [0124.838] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.ELM") returned 71 [0124.838] lstrlenW (lpString=".1cd") returned 4 [0124.838] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1 [0124.838] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.ELM") returned 71 [0124.838] lstrlenW (lpString=".jpg") returned 4 [0124.839] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1 [0124.839] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fbd8 | out: lpNewFilePointer=0x0) returned 1 [0124.839] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fbd8 | out: lpNewFilePointer=0x0) returned 1 [0124.839] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.INF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\slate.inf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0124.840] GetLastError () returned 0x0 [0124.840] ReadFile (in: hFile=0x230, lpBuffer=0x4340020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fbe4, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesRead=0x391fbe4*=0x1f4, lpOverlapped=0x0) returned 1 [0124.840] WriteFile (in: hFile=0x1b0, lpBuffer=0x4340020*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x391f9ac, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesWritten=0x391f9ac*=0x200, lpOverlapped=0x0) returned 1 [0124.841] ReadFile (in: hFile=0x230, lpBuffer=0x4340020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fbe4, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesRead=0x391fbe4*=0x0, lpOverlapped=0x0) returned 1 [0124.841] WriteFile (in: hFile=0x1b0, lpBuffer=0x4340020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x391f9ac, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesWritten=0x391f9ac*=0xe6, lpOverlapped=0x0) returned 1 [0124.841] SetEndOfFile (hFile=0x1b0) returned 1 [0124.842] CloseHandle (hObject=0x1b0) returned 1 [0124.842] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fbd8 | out: lpNewFilePointer=0x0) returned 1 [0124.842] SetEndOfFile (hFile=0x230) returned 1 [0124.842] CloseHandle (hObject=0x230) returned 1 [0124.842] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.INF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0124.843] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\slate.inf")) returned 1 [0124.843] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.INF") returned 71 [0124.843] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.INF") returned 71 [0124.843] lstrlenW (lpString=".doc") returned 4 [0124.843] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1 [0124.843] lstrlenW (lpString=".docx") returned 5 [0124.843] lstrcmpiW (lpString1=".docx", lpString2="E.INF") returned -1 [0124.843] lstrlenW (lpString=".pdf") returned 4 [0124.843] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1 [0124.843] lstrlenW (lpString=".xls") returned 4 [0124.843] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1 [0124.843] lstrlenW (lpString=".xlsx") returned 5 [0124.843] lstrcmpiW (lpString1=".xlsx", lpString2="E.INF") returned -1 [0124.843] lstrlenW (lpString=".ppt") returned 4 [0124.843] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1 [0124.843] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.INF") returned 71 [0124.843] lstrlenW (lpString=".zip") returned 4 [0124.843] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1 [0124.844] lstrlenW (lpString=".rar") returned 4 [0124.844] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1 [0124.844] lstrlenW (lpString=".bz2") returned 4 [0124.844] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1 [0124.844] lstrlenW (lpString=".7z") returned 3 [0124.844] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1 [0124.844] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.INF") returned 71 [0124.844] lstrlenW (lpString=".dbf") returned 4 [0124.844] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1 [0124.844] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.INF") returned 71 [0124.844] lstrlenW (lpString=".1cd") returned 4 [0124.844] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1 [0124.844] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.INF") returned 71 [0124.844] lstrlenW (lpString=".jpg") returned 4 [0124.844] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1 [0125.354] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fbd8 | out: lpNewFilePointer=0x0) returned 1 [0125.354] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fbd8 | out: lpNewFilePointer=0x0) returned 1 [0125.355] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.ELM.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\sonora.elm.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0125.355] GetLastError () returned 0x0 [0125.355] ReadFile (in: hFile=0x1e4, lpBuffer=0x4340020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fbe4, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesRead=0x391fbe4*=0xd59f, lpOverlapped=0x0) returned 1 [0125.357] WriteFile (in: hFile=0x170, lpBuffer=0x4340020*, nNumberOfBytesToWrite=0xd5a0, lpNumberOfBytesWritten=0x391f9ac, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesWritten=0x391f9ac*=0xd5a0, lpOverlapped=0x0) returned 1 [0125.358] ReadFile (in: hFile=0x1e4, lpBuffer=0x4340020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fbe4, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesRead=0x391fbe4*=0x0, lpOverlapped=0x0) returned 1 [0125.358] WriteFile (in: hFile=0x170, lpBuffer=0x4340020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x391f9ac, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesWritten=0x391f9ac*=0xe8, lpOverlapped=0x0) returned 1 [0125.358] SetEndOfFile (hFile=0x170) returned 1 [0125.358] CloseHandle (hObject=0x170) returned 1 [0125.358] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fbd8 | out: lpNewFilePointer=0x0) returned 1 [0125.358] SetEndOfFile (hFile=0x1e4) returned 1 [0125.359] CloseHandle (hObject=0x1e4) returned 1 [0125.359] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.ELM.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0125.359] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\sonora.elm")) returned 1 [0125.359] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.ELM") returned 73 [0125.359] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.ELM") returned 73 [0125.359] lstrlenW (lpString=".doc") returned 4 [0125.359] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1 [0125.359] lstrlenW (lpString=".docx") returned 5 [0125.359] lstrcmpiW (lpString1=".docx", lpString2="A.ELM") returned -1 [0125.359] lstrlenW (lpString=".pdf") returned 4 [0125.359] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1 [0125.359] lstrlenW (lpString=".xls") returned 4 [0125.359] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1 [0125.359] lstrlenW (lpString=".xlsx") returned 5 [0125.359] lstrcmpiW (lpString1=".xlsx", lpString2="A.ELM") returned -1 [0125.359] lstrlenW (lpString=".ppt") returned 4 [0125.359] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1 [0125.359] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.ELM") returned 73 [0125.359] lstrlenW (lpString=".zip") returned 4 [0125.359] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1 [0125.359] lstrlenW (lpString=".rar") returned 4 [0125.359] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1 [0125.359] lstrlenW (lpString=".bz2") returned 4 [0125.359] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1 [0125.359] lstrlenW (lpString=".7z") returned 3 [0125.360] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1 [0125.360] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.ELM") returned 73 [0125.360] lstrlenW (lpString=".dbf") returned 4 [0125.360] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1 [0125.360] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.ELM") returned 73 [0125.360] lstrlenW (lpString=".1cd") returned 4 [0125.360] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1 [0125.360] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.ELM") returned 73 [0125.360] lstrlenW (lpString=".jpg") returned 4 [0125.360] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1 [0125.364] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fbd8 | out: lpNewFilePointer=0x0) returned 1 [0125.364] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fbd8 | out: lpNewFilePointer=0x0) returned 1 [0125.364] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.ELM.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\studio.elm.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0125.364] GetLastError () returned 0x0 [0125.364] ReadFile (in: hFile=0x1f8, lpBuffer=0x4340020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fbe4, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesRead=0x391fbe4*=0xbfed, lpOverlapped=0x0) returned 1 [0125.399] WriteFile (in: hFile=0x19c, lpBuffer=0x4340020*, nNumberOfBytesToWrite=0xbff0, lpNumberOfBytesWritten=0x391f9ac, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesWritten=0x391f9ac*=0xbff0, lpOverlapped=0x0) returned 1 [0125.399] ReadFile (in: hFile=0x1f8, lpBuffer=0x4340020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fbe4, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesRead=0x391fbe4*=0x0, lpOverlapped=0x0) returned 1 [0125.399] WriteFile (in: hFile=0x19c, lpBuffer=0x4340020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x391f9ac, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesWritten=0x391f9ac*=0xe8, lpOverlapped=0x0) returned 1 [0125.400] SetEndOfFile (hFile=0x19c) returned 1 [0125.400] CloseHandle (hObject=0x19c) returned 1 [0125.400] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fbd8 | out: lpNewFilePointer=0x0) returned 1 [0125.400] SetEndOfFile (hFile=0x1f8) returned 1 [0125.400] CloseHandle (hObject=0x1f8) returned 1 [0125.400] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.ELM.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0125.400] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\studio.elm")) returned 1 [0125.401] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.ELM") returned 73 [0125.401] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.ELM") returned 73 [0125.401] lstrlenW (lpString=".doc") returned 4 [0125.401] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1 [0125.401] lstrlenW (lpString=".docx") returned 5 [0125.401] lstrcmpiW (lpString1=".docx", lpString2="O.ELM") returned -1 [0125.401] lstrlenW (lpString=".pdf") returned 4 [0125.401] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1 [0125.401] lstrlenW (lpString=".xls") returned 4 [0125.401] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1 [0125.401] lstrlenW (lpString=".xlsx") returned 5 [0125.401] lstrcmpiW (lpString1=".xlsx", lpString2="O.ELM") returned -1 [0125.401] lstrlenW (lpString=".ppt") returned 4 [0125.401] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1 [0125.401] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.ELM") returned 73 [0125.401] lstrlenW (lpString=".zip") returned 4 [0125.401] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1 [0125.401] lstrlenW (lpString=".rar") returned 4 [0125.401] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1 [0125.401] lstrlenW (lpString=".bz2") returned 4 [0125.401] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1 [0125.401] lstrlenW (lpString=".7z") returned 3 [0125.401] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1 [0125.401] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.ELM") returned 73 [0125.401] lstrlenW (lpString=".dbf") returned 4 [0125.401] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1 [0125.401] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.ELM") returned 73 [0125.402] lstrlenW (lpString=".1cd") returned 4 [0125.402] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1 [0125.402] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.ELM") returned 73 [0125.402] lstrlenW (lpString=".jpg") returned 4 [0125.402] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1 [0125.500] SetFilePointerEx (in: hFile=0x248, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fbd8 | out: lpNewFilePointer=0x0) returned 1 [0125.500] SetFilePointerEx (in: hFile=0x248, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fbd8 | out: lpNewFilePointer=0x0) returned 1 [0125.500] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\water.inf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0125.500] GetLastError () returned 0x0 [0125.500] ReadFile (in: hFile=0x248, lpBuffer=0x4340020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fbe4, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesRead=0x391fbe4*=0x1a1, lpOverlapped=0x0) returned 1 [0125.501] WriteFile (in: hFile=0x208, lpBuffer=0x4340020*, nNumberOfBytesToWrite=0x1b0, lpNumberOfBytesWritten=0x391f9ac, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesWritten=0x391f9ac*=0x1b0, lpOverlapped=0x0) returned 1 [0125.502] ReadFile (in: hFile=0x248, lpBuffer=0x4340020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fbe4, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesRead=0x391fbe4*=0x0, lpOverlapped=0x0) returned 1 [0125.502] WriteFile (in: hFile=0x208, lpBuffer=0x4340020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x391f9ac, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesWritten=0x391f9ac*=0xe6, lpOverlapped=0x0) returned 1 [0125.502] SetEndOfFile (hFile=0x208) returned 1 [0125.502] CloseHandle (hObject=0x208) returned 1 [0125.502] SetFilePointerEx (in: hFile=0x248, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fbd8 | out: lpNewFilePointer=0x0) returned 1 [0125.502] SetEndOfFile (hFile=0x248) returned 1 [0125.502] CloseHandle (hObject=0x248) returned 1 [0125.502] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0125.503] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\water.inf")) returned 1 [0125.503] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF") returned 71 [0125.503] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF") returned 71 [0125.503] lstrlenW (lpString=".doc") returned 4 [0125.503] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1 [0125.503] lstrlenW (lpString=".docx") returned 5 [0125.503] lstrcmpiW (lpString1=".docx", lpString2="R.INF") returned -1 [0125.503] lstrlenW (lpString=".pdf") returned 4 [0125.503] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1 [0125.503] lstrlenW (lpString=".xls") returned 4 [0125.503] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1 [0125.503] lstrlenW (lpString=".xlsx") returned 5 [0125.503] lstrcmpiW (lpString1=".xlsx", lpString2="R.INF") returned -1 [0125.503] lstrlenW (lpString=".ppt") returned 4 [0125.503] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1 [0125.503] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF") returned 71 [0125.503] lstrlenW (lpString=".zip") returned 4 [0125.503] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1 [0125.503] lstrlenW (lpString=".rar") returned 4 [0125.503] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1 [0125.503] lstrlenW (lpString=".bz2") returned 4 [0125.503] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1 [0125.503] lstrlenW (lpString=".7z") returned 3 [0125.503] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1 [0125.503] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF") returned 71 [0125.503] lstrlenW (lpString=".dbf") returned 4 [0125.503] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1 [0125.503] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF") returned 71 [0125.503] lstrlenW (lpString=".1cd") returned 4 [0125.503] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1 [0125.503] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF") returned 71 [0125.503] lstrlenW (lpString=".jpg") returned 4 [0125.503] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1 [0125.504] SetFilePointerEx (in: hFile=0x248, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fbd8 | out: lpNewFilePointer=0x0) returned 1 [0125.504] SetFilePointerEx (in: hFile=0x248, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fbd8 | out: lpNewFilePointer=0x0) returned 1 [0125.504] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\watermar.inf.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0125.504] GetLastError () returned 0x0 [0125.504] ReadFile (in: hFile=0x248, lpBuffer=0x4340020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fbe4, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesRead=0x391fbe4*=0x2ab, lpOverlapped=0x0) returned 1 [0125.505] WriteFile (in: hFile=0x208, lpBuffer=0x4340020*, nNumberOfBytesToWrite=0x2b0, lpNumberOfBytesWritten=0x391f9ac, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesWritten=0x391f9ac*=0x2b0, lpOverlapped=0x0) returned 1 [0125.505] ReadFile (in: hFile=0x248, lpBuffer=0x4340020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fbe4, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesRead=0x391fbe4*=0x0, lpOverlapped=0x0) returned 1 [0125.505] WriteFile (in: hFile=0x208, lpBuffer=0x4340020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x391f9ac, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesWritten=0x391f9ac*=0xec, lpOverlapped=0x0) returned 1 [0125.506] SetEndOfFile (hFile=0x208) returned 1 [0125.506] CloseHandle (hObject=0x208) returned 1 [0125.506] SetFilePointerEx (in: hFile=0x248, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fbd8 | out: lpNewFilePointer=0x0) returned 1 [0125.506] SetEndOfFile (hFile=0x248) returned 1 [0125.506] CloseHandle (hObject=0x248) returned 1 [0125.506] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0125.506] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\watermar.inf")) returned 1 [0125.507] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF") returned 77 [0125.507] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF") returned 77 [0125.507] lstrlenW (lpString=".doc") returned 4 [0125.507] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1 [0125.507] lstrlenW (lpString=".docx") returned 5 [0125.507] lstrcmpiW (lpString1=".docx", lpString2="R.INF") returned -1 [0125.507] lstrlenW (lpString=".pdf") returned 4 [0125.507] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1 [0125.507] lstrlenW (lpString=".xls") returned 4 [0125.507] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1 [0125.507] lstrlenW (lpString=".xlsx") returned 5 [0125.507] lstrcmpiW (lpString1=".xlsx", lpString2="R.INF") returned -1 [0125.507] lstrlenW (lpString=".ppt") returned 4 [0125.507] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1 [0125.507] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF") returned 77 [0125.507] lstrlenW (lpString=".zip") returned 4 [0125.507] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1 [0125.507] lstrlenW (lpString=".rar") returned 4 [0125.507] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1 [0125.507] lstrlenW (lpString=".bz2") returned 4 [0125.507] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1 [0125.507] lstrlenW (lpString=".7z") returned 3 [0125.507] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1 [0125.507] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF") returned 77 [0125.507] lstrlenW (lpString=".dbf") returned 4 [0125.507] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1 [0125.507] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF") returned 77 [0125.507] lstrlenW (lpString=".1cd") returned 4 [0125.507] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1 [0125.507] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF") returned 77 [0125.507] lstrlenW (lpString=".jpg") returned 4 [0125.507] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1 [0125.508] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\arfr\\msb1arfr.its"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\arfr\\msb1arfr.its.id-9c354b42.[darknes@420blaze.it].waifu")) returned 1 [0125.509] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\arfr\\msb1arfr.its.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x248 [0125.509] SetFilePointerEx (in: hFile=0x248, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391f97c | out: lpNewFilePointer=0x0) returned 1 [0125.509] SetFilePointerEx (in: hFile=0x248, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391f93c | out: lpNewFilePointer=0x0) returned 1 [0125.509] ReadFile (in: hFile=0x248, lpBuffer=0x4340058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x391f948, lpOverlapped=0x0 | out: lpBuffer=0x4340058*, lpNumberOfBytesRead=0x391f948*=0x40000, lpOverlapped=0x0) returned 1 [0125.805] SetFilePointerEx (in: hFile=0x248, liDistanceToMove=0x87008, lpNewFilePointer=0x0, dwMoveMethod=0x391f93c | out: lpNewFilePointer=0x0) returned 1 [0125.805] ReadFile (in: hFile=0x248, lpBuffer=0x4380058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x391f948, lpOverlapped=0x0 | out: lpBuffer=0x4380058*, lpNumberOfBytesRead=0x391f948*=0x40000, lpOverlapped=0x0) returned 1 [0125.988] SetFilePointerEx (in: hFile=0x248, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x391f97c | out: lpNewFilePointer=0xffffffff) returned 1 [0125.988] SetFilePointerEx (in: hFile=0x248, liDistanceToMove=0x155018, lpNewFilePointer=0x0, dwMoveMethod=0x391f93c | out: lpNewFilePointer=0x0) returned 1 [0125.988] ReadFile (in: hFile=0x248, lpBuffer=0x43c0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x391f948, lpOverlapped=0x0 | out: lpBuffer=0x43c0058*, lpNumberOfBytesRead=0x391f948*=0x40000, lpOverlapped=0x0) returned 1 [0126.268] SetFilePointerEx (in: hFile=0x248, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fbd8 | out: lpNewFilePointer=0x0) returned 1 [0126.268] WriteFile (in: hFile=0x248, lpBuffer=0x4340020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x391f9c0, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesWritten=0x391f9c0*=0xc0104, lpOverlapped=0x0) returned 1 [0126.288] SetEndOfFile (hFile=0x248) returned 1 [0126.290] SetFilePointerEx (in: hFile=0x248, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391f98c | out: lpNewFilePointer=0x0) returned 1 [0126.290] WriteFile (in: hFile=0x248, lpBuffer=0x44d2080*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x391f998, lpOverlapped=0x0 | out: lpBuffer=0x44d2080*, lpNumberOfBytesWritten=0x391f998*=0x40000, lpOverlapped=0x0) returned 1 [0126.291] SetFilePointerEx (in: hFile=0x248, liDistanceToMove=0x87008, lpNewFilePointer=0x0, dwMoveMethod=0x391f98c | out: lpNewFilePointer=0x0) returned 1 [0126.291] WriteFile (in: hFile=0x248, lpBuffer=0x44d2080*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x391f998, lpOverlapped=0x0 | out: lpBuffer=0x44d2080*, lpNumberOfBytesWritten=0x391f998*=0x40000, lpOverlapped=0x0) returned 1 [0126.292] SetFilePointerEx (in: hFile=0x248, liDistanceToMove=0x155018, lpNewFilePointer=0x0, dwMoveMethod=0x391f98c | out: lpNewFilePointer=0x0) returned 1 [0126.292] WriteFile (in: hFile=0x248, lpBuffer=0x44d2080*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x391f998, lpOverlapped=0x0 | out: lpBuffer=0x44d2080*, lpNumberOfBytesWritten=0x391f998*=0x40000, lpOverlapped=0x0) returned 1 [0126.293] CloseHandle (hObject=0x248) returned 1 [0126.294] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0126.294] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS") returned 73 [0126.294] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS") returned 73 [0126.294] lstrlenW (lpString=".doc") returned 4 [0126.294] lstrcmpiW (lpString1=".doc", lpString2=".ITS") returned -1 [0126.294] lstrlenW (lpString=".docx") returned 5 [0126.294] lstrcmpiW (lpString1=".docx", lpString2="R.ITS") returned -1 [0126.294] lstrlenW (lpString=".pdf") returned 4 [0126.294] lstrcmpiW (lpString1=".pdf", lpString2=".ITS") returned 1 [0126.294] lstrlenW (lpString=".xls") returned 4 [0126.294] lstrcmpiW (lpString1=".xls", lpString2=".ITS") returned 1 [0126.294] lstrlenW (lpString=".xlsx") returned 5 [0126.294] lstrcmpiW (lpString1=".xlsx", lpString2="R.ITS") returned -1 [0126.294] lstrlenW (lpString=".ppt") returned 4 [0126.294] lstrcmpiW (lpString1=".ppt", lpString2=".ITS") returned 1 [0126.294] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS") returned 73 [0126.294] lstrlenW (lpString=".zip") returned 4 [0126.294] lstrcmpiW (lpString1=".zip", lpString2=".ITS") returned 1 [0126.294] lstrlenW (lpString=".rar") returned 4 [0126.294] lstrcmpiW (lpString1=".rar", lpString2=".ITS") returned 1 [0126.294] lstrlenW (lpString=".bz2") returned 4 [0126.294] lstrcmpiW (lpString1=".bz2", lpString2=".ITS") returned -1 [0126.294] lstrlenW (lpString=".7z") returned 3 [0126.294] lstrcmpiW (lpString1=".7z", lpString2="ITS") returned -1 [0126.294] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS") returned 73 [0126.294] lstrlenW (lpString=".dbf") returned 4 [0126.294] lstrcmpiW (lpString1=".dbf", lpString2=".ITS") returned -1 [0126.294] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS") returned 73 [0126.294] lstrlenW (lpString=".1cd") returned 4 [0126.294] lstrcmpiW (lpString1=".1cd", lpString2=".ITS") returned -1 [0126.294] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS") returned 73 [0126.294] lstrlenW (lpString=".jpg") returned 4 [0126.294] lstrcmpiW (lpString1=".jpg", lpString2=".ITS") returned 1 [0126.295] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1ar.lex"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1ar.lex.id-9c354b42.[darknes@420blaze.it].waifu")) returned 1 [0126.295] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1ar.lex.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x248 [0126.295] SetFilePointerEx (in: hFile=0x248, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391f97c | out: lpNewFilePointer=0x0) returned 1 [0126.295] SetFilePointerEx (in: hFile=0x248, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391f93c | out: lpNewFilePointer=0x0) returned 1 [0126.295] ReadFile (in: hFile=0x248, lpBuffer=0x4340058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x391f948, lpOverlapped=0x0 | out: lpBuffer=0x4340058*, lpNumberOfBytesRead=0x391f948*=0x40000, lpOverlapped=0x0) returned 1 [0126.312] SetFilePointerEx (in: hFile=0x248, liDistanceToMove=0xac903, lpNewFilePointer=0x0, dwMoveMethod=0x391f93c | out: lpNewFilePointer=0x0) returned 1 [0126.312] ReadFile (in: hFile=0x248, lpBuffer=0x4380058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x391f948, lpOverlapped=0x0 | out: lpBuffer=0x4380058*, lpNumberOfBytesRead=0x391f948*=0x40000, lpOverlapped=0x0) returned 1 [0126.333] SetFilePointerEx (in: hFile=0x248, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x391f97c | out: lpNewFilePointer=0xffffffff) returned 1 [0126.333] SetFilePointerEx (in: hFile=0x248, liDistanceToMove=0x1c5b0b, lpNewFilePointer=0x0, dwMoveMethod=0x391f93c | out: lpNewFilePointer=0x0) returned 1 [0126.333] ReadFile (in: hFile=0x248, lpBuffer=0x43c0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x391f948, lpOverlapped=0x0 | out: lpBuffer=0x43c0058*, lpNumberOfBytesRead=0x391f948*=0x40000, lpOverlapped=0x0) returned 1 [0126.554] SetFilePointerEx (in: hFile=0x248, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fbd8 | out: lpNewFilePointer=0x0) returned 1 [0126.554] WriteFile (in: hFile=0x248, lpBuffer=0x4340020*, nNumberOfBytesToWrite=0xc0100, lpNumberOfBytesWritten=0x391f9c0, lpOverlapped=0x0 | out: lpBuffer=0x4340020*, lpNumberOfBytesWritten=0x391f9c0*=0xc0100, lpOverlapped=0x0) returned 1 [0126.560] SetEndOfFile (hFile=0x248) returned 1 [0126.591] SetFilePointerEx (in: hFile=0x248, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391f98c | out: lpNewFilePointer=0x0) returned 1 [0126.591] WriteFile (in: hFile=0x248, lpBuffer=0x4574018*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x391f998, lpOverlapped=0x0 | out: lpBuffer=0x4574018*, lpNumberOfBytesWritten=0x391f998*=0x40000, lpOverlapped=0x0) returned 1 [0126.592] SetFilePointerEx (in: hFile=0x248, liDistanceToMove=0xac903, lpNewFilePointer=0x0, dwMoveMethod=0x391f98c | out: lpNewFilePointer=0x0) returned 1 [0126.592] WriteFile (in: hFile=0x248, lpBuffer=0x4574018*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x391f998, lpOverlapped=0x0 | out: lpBuffer=0x4574018*, lpNumberOfBytesWritten=0x391f998*=0x40000, lpOverlapped=0x0) returned 1 [0126.594] SetFilePointerEx (in: hFile=0x248, liDistanceToMove=0x1c5b0b, lpNewFilePointer=0x0, dwMoveMethod=0x391f98c | out: lpNewFilePointer=0x0) returned 1 [0126.594] WriteFile (in: hFile=0x248, lpBuffer=0x4574018*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x391f998, lpOverlapped=0x0 | out: lpBuffer=0x4574018*, lpNumberOfBytesWritten=0x391f998*=0x40000, lpOverlapped=0x0) returned 1 [0126.596] CloseHandle (hObject=0x248) returned 1 [0126.596] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX.id-9C354B42.[Darknes@420blaze.it].waifu", dwFileAttributes=0x20) returned 1 [0126.596] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX") returned 66 [0126.596] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX") returned 66 [0126.596] lstrlenW (lpString=".doc") returned 4 [0126.596] lstrcmpiW (lpString1=".doc", lpString2=".LEX") returned -1 [0126.596] lstrlenW (lpString=".docx") returned 5 [0126.596] lstrcmpiW (lpString1=".docx", lpString2="R.LEX") returned -1 [0126.596] lstrlenW (lpString=".pdf") returned 4 [0126.596] lstrcmpiW (lpString1=".pdf", lpString2=".LEX") returned 1 [0126.596] lstrlenW (lpString=".xls") returned 4 [0126.596] lstrcmpiW (lpString1=".xls", lpString2=".LEX") returned 1 [0126.596] lstrlenW (lpString=".xlsx") returned 5 [0126.596] lstrcmpiW (lpString1=".xlsx", lpString2="R.LEX") returned -1 [0126.596] lstrlenW (lpString=".ppt") returned 4 [0126.596] lstrcmpiW (lpString1=".ppt", lpString2=".LEX") returned 1 [0126.596] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX") returned 66 [0126.596] lstrlenW (lpString=".zip") returned 4 [0126.596] lstrcmpiW (lpString1=".zip", lpString2=".LEX") returned 1 [0126.596] lstrlenW (lpString=".rar") returned 4 [0126.596] lstrcmpiW (lpString1=".rar", lpString2=".LEX") returned 1 [0126.596] lstrlenW (lpString=".bz2") returned 4 [0126.596] lstrcmpiW (lpString1=".bz2", lpString2=".LEX") returned -1 [0126.596] lstrlenW (lpString=".7z") returned 3 [0126.596] lstrcmpiW (lpString1=".7z", lpString2="LEX") returned -1 [0126.596] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX") returned 66 [0126.596] lstrlenW (lpString=".dbf") returned 4 [0126.596] lstrcmpiW (lpString1=".dbf", lpString2=".LEX") returned -1 [0126.596] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX") returned 66 [0126.596] lstrlenW (lpString=".1cd") returned 4 [0126.596] lstrcmpiW (lpString1=".1cd", lpString2=".LEX") returned -1 [0126.596] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX") returned 66 [0126.596] lstrlenW (lpString=".jpg") returned 4 [0126.597] lstrcmpiW (lpString1=".jpg", lpString2=".LEX") returned -1 [0126.597] SetFilePointerEx (in: hFile=0x248, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fbd8 | out: lpNewFilePointer=0x0) returned 1 [0126.597] SetFilePointerEx (in: hFile=0x248, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x391fbd8 | out: lpNewFilePointer=0x0) returned 1 [0126.597] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1STAR.DLL.id-9C354B42.[Darknes@420blaze.it].waifu" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1star.dll.id-9c354b42.[darknes@420blaze.it].waifu"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0126.597] GetLastError () returned 0x0 [0126.597] ReadFile (hFile=0x248, lpBuffer=0x4340020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x391fbe4, lpOverlapped=0x0) Thread: id = 34 os_tid = 0xbb8 [0102.644] lstrlenW (lpString="C:") returned 2 [0102.644] FindFirstFileW (in: lpFileName="C:\\*", lpFindFileData=0x36cf890 | out: lpFindFileData=0x36cf890) returned 0x81b160 [0102.644] lstrlenW (lpString="C:\\$Recycle.Bin") returned 15 [0102.644] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\$Recycle.Bin") returned 1 [0102.644] lstrlenW (lpString="$Recycle.Bin") returned 12 [0102.644] lstrcmpiW (lpString1="C:\\Windows", lpString2="$Recycle.Bin") returned 1 [0102.644] lstrlenW (lpString="C:\\$Recycle.Bin") returned 15 [0102.644] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\*", lpFindFileData=0x36cf614 | out: lpFindFileData=0x36cf614) returned 0x81b1a0 [0102.644] FindNextFileW (in: hFindFile=0x81b1a0, lpFindFileData=0x36cf614 | out: lpFindFileData=0x36cf614) returned 1 [0102.644] FindNextFileW (in: hFindFile=0x81b1a0, lpFindFileData=0x36cf614 | out: lpFindFileData=0x36cf614) returned 1 [0102.644] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 62 [0102.644] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 1 [0102.644] lstrlenW (lpString="S-1-5-21-3388679973-3930757225-3770151564-1000") returned 46 [0102.644] lstrcmpiW (lpString1="C:\\Windows", lpString2="S-1-5-21-3388679973-3930757225-3770151564-1000") returned -1 [0102.645] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 62 [0102.645] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\*", lpFindFileData=0x36cf398 | out: lpFindFileData=0x36cf398) returned 0x81b1e0 [0102.645] FindNextFileW (in: hFindFile=0x81b1e0, lpFindFileData=0x36cf398 | out: lpFindFileData=0x36cf398) returned 1 [0102.645] FindNextFileW (in: hFindFile=0x81b1e0, lpFindFileData=0x36cf398 | out: lpFindFileData=0x36cf398) returned 1 [0102.645] lstrlenW (lpString="desktop.ini") returned 11 [0102.645] lstrlenW (lpString=".1cd") returned 4 [0102.645] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0102.645] lstrlenW (lpString=".3ds") returned 4 [0102.645] lstrcmpiW (lpString1=".3ds", lpString2=".ini") returned -1 [0102.645] lstrlenW (lpString=".3fr") returned 4 [0102.645] lstrcmpiW (lpString1=".3fr", lpString2=".ini") returned -1 [0102.645] lstrlenW (lpString=".3g2") returned 4 [0102.645] lstrcmpiW (lpString1=".3g2", lpString2=".ini") returned -1 [0102.645] lstrlenW (lpString=".3gp") returned 4 [0102.645] lstrcmpiW (lpString1=".3gp", lpString2=".ini") returned -1 [0102.645] lstrlenW (lpString=".7z") returned 3 [0102.645] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0102.645] lstrlenW (lpString=".accda") returned 6 [0102.645] lstrcmpiW (lpString1=".accda", lpString2="op.ini") returned -1 [0102.645] lstrlenW (lpString=".accdb") returned 6 [0102.645] lstrcmpiW (lpString1=".accdb", lpString2="op.ini") returned -1 [0102.645] lstrlenW (lpString=".accdc") returned 6 [0102.645] lstrcmpiW (lpString1=".accdc", lpString2="op.ini") returned -1 [0102.645] lstrlenW (lpString=".accde") returned 6 [0102.645] lstrcmpiW (lpString1=".accde", lpString2="op.ini") returned -1 [0102.645] lstrlenW (lpString=".accdt") returned 6 [0102.645] lstrcmpiW (lpString1=".accdt", lpString2="op.ini") returned -1 [0102.645] lstrlenW (lpString=".accdw") returned 6 [0102.645] lstrcmpiW (lpString1=".accdw", lpString2="op.ini") returned -1 [0102.645] lstrlenW (lpString=".adb") returned 4 [0102.645] lstrcmpiW (lpString1=".adb", lpString2=".ini") returned -1 [0102.645] lstrlenW (lpString=".adp") returned 4 [0102.645] lstrcmpiW (lpString1=".adp", lpString2=".ini") returned -1 [0102.646] lstrlenW (lpString=".ai") returned 3 [0102.646] lstrcmpiW (lpString1=".ai", lpString2="ini") returned -1 [0102.646] lstrlenW (lpString=".ai3") returned 4 [0102.646] lstrcmpiW (lpString1=".ai3", lpString2=".ini") returned -1 [0102.646] lstrlenW (lpString=".ai4") returned 4 [0102.646] lstrcmpiW (lpString1=".ai4", lpString2=".ini") returned -1 [0102.646] lstrlenW (lpString=".ai5") returned 4 [0102.646] lstrcmpiW (lpString1=".ai5", lpString2=".ini") returned -1 [0102.646] lstrlenW (lpString=".ai6") returned 4 [0102.646] lstrcmpiW (lpString1=".ai6", lpString2=".ini") returned -1 [0102.646] lstrlenW (lpString=".ai7") returned 4 [0102.646] lstrcmpiW (lpString1=".ai7", lpString2=".ini") returned -1 [0102.646] lstrlenW (lpString=".ai8") returned 4 [0102.646] lstrcmpiW (lpString1=".ai8", lpString2=".ini") returned -1 [0102.646] lstrlenW (lpString=".anim") returned 5 [0102.646] lstrcmpiW (lpString1=".anim", lpString2="p.ini") returned -1 [0102.646] lstrlenW (lpString=".arw") returned 4 [0102.646] lstrcmpiW (lpString1=".arw", lpString2=".ini") returned -1 [0102.646] lstrlenW (lpString=".as") returned 3 [0102.646] lstrcmpiW (lpString1=".as", lpString2="ini") returned -1 [0102.646] lstrlenW (lpString=".asa") returned 4 [0102.646] lstrcmpiW (lpString1=".asa", lpString2=".ini") returned -1 [0102.646] lstrlenW (lpString=".asc") returned 4 [0102.646] lstrcmpiW (lpString1=".asc", lpString2=".ini") returned -1 [0102.646] lstrlenW (lpString=".ascx") returned 5 [0102.646] lstrcmpiW (lpString1=".ascx", lpString2="p.ini") returned -1 [0102.646] lstrlenW (lpString=".asm") returned 4 [0102.646] lstrcmpiW (lpString1=".asm", lpString2=".ini") returned -1 [0102.646] lstrlenW (lpString=".asmx") returned 5 [0102.646] lstrcmpiW (lpString1=".asmx", lpString2="p.ini") returned -1 [0102.646] lstrlenW (lpString=".asp") returned 4 [0102.646] lstrcmpiW (lpString1=".asp", lpString2=".ini") returned -1 [0102.646] lstrlenW (lpString=".aspx") returned 5 [0102.646] lstrcmpiW (lpString1=".aspx", lpString2="p.ini") returned -1 [0102.646] lstrlenW (lpString=".asr") returned 4 [0102.646] lstrcmpiW (lpString1=".asr", lpString2=".ini") returned -1 [0102.646] lstrlenW (lpString=".asx") returned 4 [0102.646] lstrcmpiW (lpString1=".asx", lpString2=".ini") returned -1 [0102.646] lstrlenW (lpString=".avi") returned 4 [0102.646] lstrcmpiW (lpString1=".avi", lpString2=".ini") returned -1 [0102.646] lstrlenW (lpString=".avs") returned 4 [0102.646] lstrcmpiW (lpString1=".avs", lpString2=".ini") returned -1 [0102.646] lstrlenW (lpString=".backup") returned 7 [0102.646] lstrcmpiW (lpString1=".backup", lpString2="top.ini") returned -1 [0102.646] lstrlenW (lpString=".bak") returned 4 [0102.646] lstrcmpiW (lpString1=".bak", lpString2=".ini") returned -1 [0102.646] lstrlenW (lpString=".bay") returned 4 [0102.646] lstrcmpiW (lpString1=".bay", lpString2=".ini") returned -1 [0102.646] lstrlenW (lpString=".bd") returned 3 [0102.646] lstrcmpiW (lpString1=".bd", lpString2="ini") returned -1 [0102.646] lstrlenW (lpString=".bin") returned 4 [0102.646] lstrcmpiW (lpString1=".bin", lpString2=".ini") returned -1 [0102.646] lstrlenW (lpString=".bmp") returned 4 [0102.647] lstrcmpiW (lpString1=".bmp", lpString2=".ini") returned -1 [0102.647] lstrlenW (lpString=".bz2") returned 4 [0102.647] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0102.647] lstrlenW (lpString=".c") returned 2 [0102.647] lstrcmpiW (lpString1=".c", lpString2="ni") returned -1 [0102.647] lstrlenW (lpString=".cdr") returned 4 [0102.647] lstrcmpiW (lpString1=".cdr", lpString2=".ini") returned -1 [0102.647] lstrlenW (lpString=".cer") returned 4 [0102.647] lstrcmpiW (lpString1=".cer", lpString2=".ini") returned -1 [0102.647] lstrlenW (lpString=".cf") returned 3 [0102.647] lstrcmpiW (lpString1=".cf", lpString2="ini") returned -1 [0102.647] lstrlenW (lpString=".cfc") returned 4 [0102.647] lstrcmpiW (lpString1=".cfc", lpString2=".ini") returned -1 [0102.647] lstrlenW (lpString=".cfm") returned 4 [0102.647] lstrcmpiW (lpString1=".cfm", lpString2=".ini") returned -1 [0102.647] lstrlenW (lpString=".cfml") returned 5 [0102.647] lstrcmpiW (lpString1=".cfml", lpString2="p.ini") returned -1 [0102.647] lstrlenW (lpString=".cfu") returned 4 [0102.647] lstrcmpiW (lpString1=".cfu", lpString2=".ini") returned -1 [0102.647] lstrlenW (lpString=".chm") returned 4 [0102.647] lstrcmpiW (lpString1=".chm", lpString2=".ini") returned -1 [0102.647] lstrlenW (lpString=".cin") returned 4 [0102.647] lstrcmpiW (lpString1=".cin", lpString2=".ini") returned -1 [0102.647] lstrlenW (lpString=".class") returned 6 [0102.647] lstrcmpiW (lpString1=".class", lpString2="op.ini") returned -1 [0102.647] lstrlenW (lpString=".clx") returned 4 [0102.647] lstrcmpiW (lpString1=".clx", lpString2=".ini") returned -1 [0102.647] lstrlenW (lpString=".config") returned 7 [0102.647] lstrcmpiW (lpString1=".config", lpString2="top.ini") returned -1 [0102.647] lstrlenW (lpString=".cpp") returned 4 [0102.647] lstrcmpiW (lpString1=".cpp", lpString2=".ini") returned -1 [0102.647] lstrlenW (lpString=".cr2") returned 4 [0102.647] lstrcmpiW (lpString1=".cr2", lpString2=".ini") returned -1 [0102.647] lstrlenW (lpString=".crt") returned 4 [0102.647] lstrcmpiW (lpString1=".crt", lpString2=".ini") returned -1 [0102.647] lstrlenW (lpString=".crw") returned 4 [0102.647] lstrcmpiW (lpString1=".crw", lpString2=".ini") returned -1 [0102.647] lstrlenW (lpString=".cs") returned 3 [0102.647] lstrcmpiW (lpString1=".cs", lpString2="ini") returned -1 [0102.647] lstrlenW (lpString=".css") returned 4 [0102.647] lstrcmpiW (lpString1=".css", lpString2=".ini") returned -1 [0102.647] lstrlenW (lpString=".csv") returned 4 [0102.647] lstrcmpiW (lpString1=".csv", lpString2=".ini") returned -1 [0102.647] lstrlenW (lpString=".cub") returned 4 [0102.647] lstrcmpiW (lpString1=".cub", lpString2=".ini") returned -1 [0102.647] lstrlenW (lpString=".dae") returned 4 [0102.647] lstrcmpiW (lpString1=".dae", lpString2=".ini") returned -1 [0102.647] lstrlenW (lpString=".dat") returned 4 [0102.647] lstrcmpiW (lpString1=".dat", lpString2=".ini") returned -1 [0102.647] lstrlenW (lpString=".db") returned 3 [0102.647] lstrcmpiW (lpString1=".db", lpString2="ini") returned -1 [0102.647] lstrlenW (lpString=".dbf") returned 4 [0102.647] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0102.648] lstrlenW (lpString=".dbx") returned 4 [0102.648] lstrcmpiW (lpString1=".dbx", lpString2=".ini") returned -1 [0102.648] lstrlenW (lpString=".dc3") returned 4 [0102.648] lstrcmpiW (lpString1=".dc3", lpString2=".ini") returned -1 [0102.648] lstrlenW (lpString=".dcm") returned 4 [0102.648] lstrcmpiW (lpString1=".dcm", lpString2=".ini") returned -1 [0102.648] lstrlenW (lpString=".dcr") returned 4 [0102.648] lstrcmpiW (lpString1=".dcr", lpString2=".ini") returned -1 [0102.648] lstrlenW (lpString=".der") returned 4 [0102.648] lstrcmpiW (lpString1=".der", lpString2=".ini") returned -1 [0102.648] lstrlenW (lpString=".dib") returned 4 [0102.648] lstrcmpiW (lpString1=".dib", lpString2=".ini") returned -1 [0102.648] lstrlenW (lpString=".dic") returned 4 [0102.648] lstrcmpiW (lpString1=".dic", lpString2=".ini") returned -1 [0102.648] lstrlenW (lpString=".dif") returned 4 [0102.648] lstrcmpiW (lpString1=".dif", lpString2=".ini") returned -1 [0102.648] lstrlenW (lpString=".divx") returned 5 [0102.648] lstrcmpiW (lpString1=".divx", lpString2="p.ini") returned -1 [0102.648] lstrlenW (lpString=".djvu") returned 5 [0102.648] lstrcmpiW (lpString1=".djvu", lpString2="p.ini") returned -1 [0102.648] lstrlenW (lpString=".dng") returned 4 [0102.648] lstrcmpiW (lpString1=".dng", lpString2=".ini") returned -1 [0102.648] lstrlenW (lpString=".doc") returned 4 [0102.648] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0102.648] lstrlenW (lpString=".docm") returned 5 [0102.648] lstrcmpiW (lpString1=".docm", lpString2="p.ini") returned -1 [0102.648] lstrlenW (lpString=".docx") returned 5 [0102.648] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0102.648] lstrlenW (lpString=".dot") returned 4 [0102.648] lstrcmpiW (lpString1=".dot", lpString2=".ini") returned -1 [0102.648] lstrlenW (lpString=".dotm") returned 5 [0102.648] lstrcmpiW (lpString1=".dotm", lpString2="p.ini") returned -1 [0102.648] lstrlenW (lpString=".dotx") returned 5 [0102.648] lstrcmpiW (lpString1=".dotx", lpString2="p.ini") returned -1 [0102.648] lstrlenW (lpString=".dpx") returned 4 [0102.648] lstrcmpiW (lpString1=".dpx", lpString2=".ini") returned -1 [0102.648] lstrlenW (lpString=".dqy") returned 4 [0102.648] lstrcmpiW (lpString1=".dqy", lpString2=".ini") returned -1 [0102.648] lstrlenW (lpString=".dsn") returned 4 [0102.648] lstrcmpiW (lpString1=".dsn", lpString2=".ini") returned -1 [0102.648] lstrlenW (lpString=".dt") returned 3 [0102.648] lstrcmpiW (lpString1=".dt", lpString2="ini") returned -1 [0102.648] lstrlenW (lpString=".dtd") returned 4 [0102.648] lstrcmpiW (lpString1=".dtd", lpString2=".ini") returned -1 [0102.648] lstrlenW (lpString=".dwg") returned 4 [0102.648] lstrcmpiW (lpString1=".dwg", lpString2=".ini") returned -1 [0102.648] lstrlenW (lpString=".dwt") returned 4 [0102.648] lstrcmpiW (lpString1=".dwt", lpString2=".ini") returned -1 [0102.648] lstrlenW (lpString=".dx") returned 3 [0102.648] lstrcmpiW (lpString1=".dx", lpString2="ini") returned -1 [0102.648] lstrlenW (lpString=".dxf") returned 4 [0102.648] lstrcmpiW (lpString1=".dxf", lpString2=".ini") returned -1 [0102.648] lstrlenW (lpString=".edml") returned 5 [0102.649] lstrcmpiW (lpString1=".edml", lpString2="p.ini") returned -1 [0102.649] lstrlenW (lpString=".efd") returned 4 [0102.649] lstrcmpiW (lpString1=".efd", lpString2=".ini") returned -1 [0102.649] lstrlenW (lpString=".elf") returned 4 [0102.649] lstrcmpiW (lpString1=".elf", lpString2=".ini") returned -1 [0102.649] lstrlenW (lpString=".emf") returned 4 [0102.649] lstrcmpiW (lpString1=".emf", lpString2=".ini") returned -1 [0102.649] lstrlenW (lpString=".emz") returned 4 [0102.649] lstrcmpiW (lpString1=".emz", lpString2=".ini") returned -1 [0102.649] lstrlenW (lpString=".epf") returned 4 [0102.649] lstrcmpiW (lpString1=".epf", lpString2=".ini") returned -1 [0102.649] lstrlenW (lpString=".eps") returned 4 [0102.649] lstrcmpiW (lpString1=".eps", lpString2=".ini") returned -1 [0102.649] lstrlenW (lpString=".epsf") returned 5 [0102.649] lstrcmpiW (lpString1=".epsf", lpString2="p.ini") returned -1 [0102.649] lstrlenW (lpString=".epsp") returned 5 [0102.649] lstrcmpiW (lpString1=".epsp", lpString2="p.ini") returned -1 [0102.649] lstrlenW (lpString=".erf") returned 4 [0102.649] lstrcmpiW (lpString1=".erf", lpString2=".ini") returned -1 [0102.649] lstrlenW (lpString=".exr") returned 4 [0102.649] lstrcmpiW (lpString1=".exr", lpString2=".ini") returned -1 [0102.649] lstrlenW (lpString=".f4v") returned 4 [0102.649] lstrcmpiW (lpString1=".f4v", lpString2=".ini") returned -1 [0102.649] lstrlenW (lpString=".fido") returned 5 [0102.649] lstrcmpiW (lpString1=".fido", lpString2="p.ini") returned -1 [0102.649] lstrlenW (lpString=".flm") returned 4 [0102.649] lstrcmpiW (lpString1=".flm", lpString2=".ini") returned -1 [0102.649] lstrlenW (lpString=".flv") returned 4 [0102.649] lstrcmpiW (lpString1=".flv", lpString2=".ini") returned -1 [0102.649] lstrlenW (lpString=".frm") returned 4 [0102.649] lstrcmpiW (lpString1=".frm", lpString2=".ini") returned -1 [0102.649] lstrlenW (lpString=".fxg") returned 4 [0102.649] lstrcmpiW (lpString1=".fxg", lpString2=".ini") returned -1 [0102.649] lstrlenW (lpString=".geo") returned 4 [0102.649] lstrcmpiW (lpString1=".geo", lpString2=".ini") returned -1 [0102.649] lstrlenW (lpString=".gif") returned 4 [0102.649] lstrcmpiW (lpString1=".gif", lpString2=".ini") returned -1 [0102.649] lstrlenW (lpString=".grs") returned 4 [0102.649] lstrcmpiW (lpString1=".grs", lpString2=".ini") returned -1 [0102.649] lstrlenW (lpString=".gz") returned 3 [0102.649] lstrcmpiW (lpString1=".gz", lpString2="ini") returned -1 [0102.649] lstrlenW (lpString=".h") returned 2 [0102.649] lstrcmpiW (lpString1=".h", lpString2="ni") returned -1 [0102.649] lstrlenW (lpString=".hdr") returned 4 [0102.649] lstrcmpiW (lpString1=".hdr", lpString2=".ini") returned -1 [0102.649] lstrlenW (lpString=".hpp") returned 4 [0102.649] lstrcmpiW (lpString1=".hpp", lpString2=".ini") returned -1 [0102.649] lstrlenW (lpString=".hta") returned 4 [0102.649] lstrcmpiW (lpString1=".hta", lpString2=".ini") returned -1 [0102.649] lstrlenW (lpString=".htc") returned 4 [0102.649] lstrcmpiW (lpString1=".htc", lpString2=".ini") returned -1 [0102.649] lstrlenW (lpString=".htm") returned 4 [0102.649] lstrcmpiW (lpString1=".htm", lpString2=".ini") returned -1 [0102.650] lstrlenW (lpString=".html") returned 5 [0102.650] lstrcmpiW (lpString1=".html", lpString2="p.ini") returned -1 [0102.650] lstrlenW (lpString=".icb") returned 4 [0102.650] lstrcmpiW (lpString1=".icb", lpString2=".ini") returned -1 [0102.650] lstrlenW (lpString=".ics") returned 4 [0102.650] lstrcmpiW (lpString1=".ics", lpString2=".ini") returned -1 [0102.650] lstrlenW (lpString=".iff") returned 4 [0102.650] lstrcmpiW (lpString1=".iff", lpString2=".ini") returned -1 [0102.650] lstrlenW (lpString=".inc") returned 4 [0102.650] lstrcmpiW (lpString1=".inc", lpString2=".ini") returned -1 [0102.650] lstrlenW (lpString=".indd") returned 5 [0102.650] lstrcmpiW (lpString1=".indd", lpString2="p.ini") returned -1 [0102.650] lstrlenW (lpString=".ini") returned 4 [0102.650] lstrcmpiW (lpString1=".ini", lpString2=".ini") returned 0 [0102.650] lstrlenW (lpString="desktop.ini") returned 11 [0102.650] lstrlenW (lpString=".waifu") returned 6 [0102.650] lstrcmpiW (lpString1=".waifu", lpString2="op.ini") returned -1 [0102.650] lstrlenW (lpString="desktop.ini") returned 11 [0102.650] lstrcmpiW (lpString1="boot.ini", lpString2="desktop.ini") returned -1 [0102.650] lstrcmpiW (lpString1="bootfont.bin", lpString2="desktop.ini") returned -1 [0102.650] lstrcmpiW (lpString1="ntldr", lpString2="desktop.ini") returned 1 [0102.650] lstrcmpiW (lpString1="ntdetect.com", lpString2="desktop.ini") returned 1 [0102.650] lstrcmpiW (lpString1="io.sys", lpString2="desktop.ini") returned 1 [0102.650] lstrcmpiW (lpString1="FILES ENCRYPTED.txt", lpString2="desktop.ini") returned 1 [0102.650] lstrcmpiW (lpString1="Info.hta", lpString2="desktop.ini") returned 1 [0102.650] lstrcmpiW (lpString1="unlikexpc.exe", lpString2="desktop.ini") returned 1 [0102.650] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0102.650] FindNextFileW (in: hFindFile=0x81b1e0, lpFindFileData=0x36cf398 | out: lpFindFileData=0x36cf398) returned 0 [0102.650] FindClose (in: hFindFile=0x81b1e0 | out: hFindFile=0x81b1e0) returned 1 [0102.650] FindNextFileW (in: hFindFile=0x81b1a0, lpFindFileData=0x36cf614 | out: lpFindFileData=0x36cf614) returned 0 [0102.650] FindClose (in: hFindFile=0x81b1a0 | out: hFindFile=0x81b1a0) returned 1 [0102.650] FindNextFileW (in: hFindFile=0x81b160, lpFindFileData=0x36cf890 | out: lpFindFileData=0x36cf890) returned 1 [0102.650] lstrlenW (lpString="C:\\Boot") returned 7 [0102.650] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\Boot") returned 1 [0102.650] lstrlenW (lpString="Boot") returned 4 [0102.650] lstrcmpiW (lpString1="C:\\Windows", lpString2="Boot") returned 1 [0102.650] lstrlenW (lpString="C:\\Boot") returned 7 [0102.650] FindFirstFileW (in: lpFileName="C:\\Boot\\*", lpFindFileData=0x36cf614 | out: lpFindFileData=0x36cf614) returned 0x81b1a0 [0102.651] FindNextFileW (in: hFindFile=0x81b1a0, lpFindFileData=0x36cf614 | out: lpFindFileData=0x36cf614) returned 1 [0102.651] FindNextFileW (in: hFindFile=0x81b1a0, lpFindFileData=0x36cf614 | out: lpFindFileData=0x36cf614) returned 1 [0102.651] lstrlenW (lpString="BCD") returned 3 [0102.651] lstrlenW (lpString=".1cd") returned 4 [0102.651] lstrcmpiW (lpString1=".1cd", lpString2="") returned 1 [0102.651] lstrlenW (lpString=".3ds") returned 4 [0102.651] lstrcmpiW (lpString1=".3ds", lpString2="") returned 1 [0102.651] lstrlenW (lpString=".3fr") returned 4 [0102.651] lstrcmpiW (lpString1=".3fr", lpString2="") returned 1 [0102.651] lstrlenW (lpString=".3g2") returned 4 [0102.651] lstrcmpiW (lpString1=".3g2", lpString2="") returned 1 [0102.651] lstrlenW (lpString=".3gp") returned 4 [0102.651] lstrcmpiW (lpString1=".3gp", lpString2="") returned 1 [0102.651] lstrlenW (lpString=".7z") returned 3 [0102.651] lstrcmpiW (lpString1=".7z", lpString2="BCD") returned -1 [0102.651] lstrlenW (lpString=".accda") returned 6 [0102.651] lstrcmpiW (lpString1=".accda", lpString2="") returned 1 [0102.651] lstrlenW (lpString=".accdb") returned 6 [0102.651] lstrcmpiW (lpString1=".accdb", lpString2="") returned 1 [0102.651] lstrlenW (lpString=".accdc") returned 6 [0102.651] lstrcmpiW (lpString1=".accdc", lpString2="") returned 1 [0102.651] lstrlenW (lpString=".accde") returned 6 [0102.651] lstrcmpiW (lpString1=".accde", lpString2="") returned 1 [0102.651] lstrlenW (lpString=".accdt") returned 6 [0102.651] lstrcmpiW (lpString1=".accdt", lpString2="") returned 1 [0102.651] lstrlenW (lpString=".accdw") returned 6 [0102.651] lstrcmpiW (lpString1=".accdw", lpString2="") returned 1 [0102.651] lstrlenW (lpString=".adb") returned 4 [0102.651] lstrcmpiW (lpString1=".adb", lpString2="") returned 1 [0102.651] lstrlenW (lpString=".adp") returned 4 [0102.651] lstrcmpiW (lpString1=".adp", lpString2="") returned 1 [0102.651] lstrlenW (lpString=".ai") returned 3 [0102.651] lstrcmpiW (lpString1=".ai", lpString2="BCD") returned -1 [0102.651] lstrlenW (lpString=".ai3") returned 4 [0102.651] lstrcmpiW (lpString1=".ai3", lpString2="") returned 1 [0102.651] lstrlenW (lpString=".ai4") returned 4 [0102.651] lstrcmpiW (lpString1=".ai4", lpString2="") returned 1 [0102.651] lstrlenW (lpString=".ai5") returned 4 [0102.651] lstrcmpiW (lpString1=".ai5", lpString2="") returned 1 [0102.651] lstrlenW (lpString=".ai6") returned 4 [0102.651] lstrcmpiW (lpString1=".ai6", lpString2="") returned 1 [0102.651] lstrlenW (lpString=".ai7") returned 4 [0102.651] lstrcmpiW (lpString1=".ai7", lpString2="") returned 1 [0102.651] lstrlenW (lpString=".ai8") returned 4 [0102.651] lstrcmpiW (lpString1=".ai8", lpString2="") returned 1 [0102.651] lstrlenW (lpString=".anim") returned 5 [0102.651] lstrcmpiW (lpString1=".anim", lpString2="") returned 1 [0102.651] lstrlenW (lpString=".arw") returned 4 [0102.652] lstrcmpiW (lpString1=".arw", lpString2="") returned 1 [0102.652] lstrlenW (lpString=".as") returned 3 [0102.652] lstrcmpiW (lpString1=".as", lpString2="BCD") returned -1 [0102.652] lstrlenW (lpString=".asa") returned 4 [0102.652] lstrcmpiW (lpString1=".asa", lpString2="") returned 1 [0102.652] lstrlenW (lpString=".asc") returned 4 [0102.652] lstrcmpiW (lpString1=".asc", lpString2="") returned 1 [0102.652] lstrlenW (lpString=".ascx") returned 5 [0102.652] lstrcmpiW (lpString1=".ascx", lpString2="") returned 1 [0102.652] lstrlenW (lpString=".asm") returned 4 [0102.652] lstrcmpiW (lpString1=".asm", lpString2="") returned 1 [0102.652] lstrlenW (lpString=".asmx") returned 5 [0102.652] lstrcmpiW (lpString1=".asmx", lpString2="") returned 1 [0102.652] lstrlenW (lpString=".asp") returned 4 [0102.652] lstrcmpiW (lpString1=".asp", lpString2="") returned 1 [0102.652] lstrlenW (lpString=".aspx") returned 5 [0102.652] lstrcmpiW (lpString1=".aspx", lpString2="") returned 1 [0102.652] lstrlenW (lpString=".asr") returned 4 [0102.652] lstrcmpiW (lpString1=".asr", lpString2="") returned 1 [0102.652] lstrlenW (lpString=".asx") returned 4 [0102.652] lstrcmpiW (lpString1=".asx", lpString2="") returned 1 [0102.652] lstrlenW (lpString=".avi") returned 4 [0102.652] lstrcmpiW (lpString1=".avi", lpString2="") returned 1 [0102.652] lstrlenW (lpString=".avs") returned 4 [0102.652] lstrcmpiW (lpString1=".avs", lpString2="") returned 1 [0102.652] lstrlenW (lpString=".backup") returned 7 [0102.652] lstrcmpiW (lpString1=".backup", lpString2="") returned 1 [0102.652] lstrlenW (lpString=".bak") returned 4 [0102.652] lstrcmpiW (lpString1=".bak", lpString2="") returned 1 [0102.652] lstrlenW (lpString=".bay") returned 4 [0102.652] lstrcmpiW (lpString1=".bay", lpString2="") returned 1 [0102.652] lstrlenW (lpString=".bd") returned 3 [0102.652] lstrcmpiW (lpString1=".bd", lpString2="BCD") returned -1 [0102.652] lstrlenW (lpString=".bin") returned 4 [0102.652] lstrcmpiW (lpString1=".bin", lpString2="") returned 1 [0102.652] lstrlenW (lpString=".bmp") returned 4 [0102.652] lstrcmpiW (lpString1=".bmp", lpString2="") returned 1 [0102.652] lstrlenW (lpString=".bz2") returned 4 [0102.652] lstrcmpiW (lpString1=".bz2", lpString2="") returned 1 [0102.652] lstrlenW (lpString=".c") returned 2 [0102.652] lstrcmpiW (lpString1=".c", lpString2="CD") returned -1 [0102.652] lstrlenW (lpString=".cdr") returned 4 [0102.652] lstrcmpiW (lpString1=".cdr", lpString2="") returned 1 [0102.652] lstrlenW (lpString=".cer") returned 4 [0102.652] lstrcmpiW (lpString1=".cer", lpString2="") returned 1 [0102.652] lstrlenW (lpString=".cf") returned 3 [0102.652] lstrcmpiW (lpString1=".cf", lpString2="BCD") returned -1 [0102.652] lstrlenW (lpString=".cfc") returned 4 [0102.652] lstrcmpiW (lpString1=".cfc", lpString2="") returned 1 [0102.652] lstrlenW (lpString=".cfm") returned 4 [0102.652] lstrcmpiW (lpString1=".cfm", lpString2="") returned 1 [0102.652] lstrlenW (lpString=".cfml") returned 5 [0102.652] lstrcmpiW (lpString1=".cfml", lpString2="") returned 1 [0102.653] lstrlenW (lpString=".cfu") returned 4 [0102.653] lstrcmpiW (lpString1=".cfu", lpString2="") returned 1 [0102.653] lstrlenW (lpString=".chm") returned 4 [0102.653] lstrcmpiW (lpString1=".chm", lpString2="") returned 1 [0102.653] lstrlenW (lpString=".cin") returned 4 [0102.653] lstrcmpiW (lpString1=".cin", lpString2="") returned 1 [0102.653] lstrlenW (lpString=".class") returned 6 [0102.653] lstrcmpiW (lpString1=".class", lpString2="") returned 1 [0102.653] lstrlenW (lpString=".clx") returned 4 [0102.653] lstrcmpiW (lpString1=".clx", lpString2="") returned 1 [0102.653] lstrlenW (lpString=".config") returned 7 [0102.653] lstrcmpiW (lpString1=".config", lpString2="") returned 1 [0102.653] lstrlenW (lpString=".cpp") returned 4 [0102.653] lstrcmpiW (lpString1=".cpp", lpString2="") returned 1 [0102.653] lstrlenW (lpString=".cr2") returned 4 [0102.653] lstrcmpiW (lpString1=".cr2", lpString2="") returned 1 [0102.653] lstrlenW (lpString=".crt") returned 4 [0102.653] lstrcmpiW (lpString1=".crt", lpString2="") returned 1 [0102.653] lstrlenW (lpString=".crw") returned 4 [0102.653] lstrcmpiW (lpString1=".crw", lpString2="") returned 1 [0102.653] lstrlenW (lpString=".cs") returned 3 [0102.653] lstrcmpiW (lpString1=".cs", lpString2="BCD") returned -1 [0102.653] lstrlenW (lpString=".css") returned 4 [0102.653] lstrcmpiW (lpString1=".css", lpString2="") returned 1 [0102.653] lstrlenW (lpString=".csv") returned 4 [0102.653] lstrcmpiW (lpString1=".csv", lpString2="") returned 1 [0102.653] lstrlenW (lpString=".cub") returned 4 [0102.653] lstrcmpiW (lpString1=".cub", lpString2="") returned 1 [0102.653] lstrlenW (lpString=".dae") returned 4 [0102.653] lstrcmpiW (lpString1=".dae", lpString2="") returned 1 [0102.653] lstrlenW (lpString=".dat") returned 4 [0102.653] lstrcmpiW (lpString1=".dat", lpString2="") returned 1 [0102.653] lstrlenW (lpString=".db") returned 3 [0102.653] lstrcmpiW (lpString1=".db", lpString2="BCD") returned -1 [0102.653] lstrlenW (lpString=".dbf") returned 4 [0102.653] lstrcmpiW (lpString1=".dbf", lpString2="") returned 1 [0102.653] lstrlenW (lpString=".dbx") returned 4 [0102.653] lstrcmpiW (lpString1=".dbx", lpString2="") returned 1 [0102.653] lstrlenW (lpString=".dc3") returned 4 [0102.653] lstrcmpiW (lpString1=".dc3", lpString2="") returned 1 [0102.653] lstrlenW (lpString=".dcm") returned 4 [0102.653] lstrcmpiW (lpString1=".dcm", lpString2="") returned 1 [0102.653] lstrlenW (lpString=".dcr") returned 4 [0102.653] lstrcmpiW (lpString1=".dcr", lpString2="") returned 1 [0102.653] lstrlenW (lpString=".der") returned 4 [0102.653] lstrcmpiW (lpString1=".der", lpString2="") returned 1 [0102.653] lstrlenW (lpString=".dib") returned 4 [0102.653] lstrcmpiW (lpString1=".dib", lpString2="") returned 1 [0102.653] lstrlenW (lpString=".dic") returned 4 [0102.653] lstrcmpiW (lpString1=".dic", lpString2="") returned 1 [0102.653] lstrlenW (lpString=".dif") returned 4 [0102.653] lstrcmpiW (lpString1=".dif", lpString2="") returned 1 [0102.653] lstrlenW (lpString=".divx") returned 5 [0102.654] lstrcmpiW (lpString1=".divx", lpString2="") returned 1 [0102.654] lstrlenW (lpString=".djvu") returned 5 [0102.654] lstrcmpiW (lpString1=".djvu", lpString2="") returned 1 [0102.654] lstrlenW (lpString=".dng") returned 4 [0102.654] lstrcmpiW (lpString1=".dng", lpString2="") returned 1 [0102.654] lstrlenW (lpString=".doc") returned 4 [0102.654] lstrcmpiW (lpString1=".doc", lpString2="") returned 1 [0102.654] lstrlenW (lpString=".docm") returned 5 [0102.654] lstrcmpiW (lpString1=".docm", lpString2="") returned 1 [0102.654] lstrlenW (lpString=".docx") returned 5 [0102.654] lstrcmpiW (lpString1=".docx", lpString2="") returned 1 [0102.654] lstrlenW (lpString=".dot") returned 4 [0102.654] lstrcmpiW (lpString1=".dot", lpString2="") returned 1 [0102.654] lstrlenW (lpString=".dotm") returned 5 [0102.654] lstrcmpiW (lpString1=".dotm", lpString2="") returned 1 [0102.654] lstrlenW (lpString=".dotx") returned 5 [0102.654] lstrcmpiW (lpString1=".dotx", lpString2="") returned 1 [0102.654] lstrlenW (lpString=".dpx") returned 4 [0102.654] lstrcmpiW (lpString1=".dpx", lpString2="") returned 1 [0102.654] lstrlenW (lpString=".dqy") returned 4 [0102.654] lstrcmpiW (lpString1=".dqy", lpString2="") returned 1 [0102.654] lstrlenW (lpString=".dsn") returned 4 [0102.654] lstrcmpiW (lpString1=".dsn", lpString2="") returned 1 [0102.654] lstrlenW (lpString=".dt") returned 3 [0102.654] lstrcmpiW (lpString1=".dt", lpString2="BCD") returned -1 [0102.654] lstrlenW (lpString=".dtd") returned 4 [0102.654] lstrcmpiW (lpString1=".dtd", lpString2="") returned 1 [0102.654] lstrlenW (lpString=".dwg") returned 4 [0102.654] lstrcmpiW (lpString1=".dwg", lpString2="") returned 1 [0102.654] lstrlenW (lpString=".dwt") returned 4 [0102.654] lstrcmpiW (lpString1=".dwt", lpString2="") returned 1 [0102.654] lstrlenW (lpString=".dx") returned 3 [0102.654] lstrcmpiW (lpString1=".dx", lpString2="BCD") returned -1 [0102.654] lstrlenW (lpString=".dxf") returned 4 [0102.654] lstrcmpiW (lpString1=".dxf", lpString2="") returned 1 [0102.654] lstrlenW (lpString=".edml") returned 5 [0102.654] lstrcmpiW (lpString1=".edml", lpString2="") returned 1 [0102.654] lstrlenW (lpString=".efd") returned 4 [0102.654] lstrcmpiW (lpString1=".efd", lpString2="") returned 1 [0102.654] lstrlenW (lpString=".elf") returned 4 [0102.654] lstrcmpiW (lpString1=".elf", lpString2="") returned 1 [0102.654] lstrlenW (lpString=".emf") returned 4 [0102.654] lstrcmpiW (lpString1=".emf", lpString2="") returned 1 [0102.654] lstrlenW (lpString=".emz") returned 4 [0102.654] lstrcmpiW (lpString1=".emz", lpString2="") returned 1 [0102.654] lstrlenW (lpString=".epf") returned 4 [0102.654] lstrcmpiW (lpString1=".epf", lpString2="") returned 1 [0102.654] lstrlenW (lpString=".eps") returned 4 [0102.654] lstrcmpiW (lpString1=".eps", lpString2="") returned 1 [0102.654] lstrlenW (lpString=".epsf") returned 5 [0102.654] lstrcmpiW (lpString1=".epsf", lpString2="") returned 1 [0102.654] lstrlenW (lpString=".epsp") returned 5 [0102.654] lstrcmpiW (lpString1=".epsp", lpString2="") returned 1 [0102.655] lstrlenW (lpString=".erf") returned 4 [0102.655] lstrcmpiW (lpString1=".erf", lpString2="") returned 1 [0102.655] lstrlenW (lpString=".exr") returned 4 [0102.655] lstrcmpiW (lpString1=".exr", lpString2="") returned 1 [0102.655] lstrlenW (lpString=".f4v") returned 4 [0102.655] lstrcmpiW (lpString1=".f4v", lpString2="") returned 1 [0102.655] lstrlenW (lpString=".fido") returned 5 [0102.655] lstrcmpiW (lpString1=".fido", lpString2="") returned 1 [0102.706] FindNextFileW (in: hFindFile=0x44710f8, lpFindFileData=0x36cf11c | out: lpFindFileData=0x36cf11c) returned 1 [0102.706] FindNextFileW (in: hFindFile=0x44710f8, lpFindFileData=0x36cf11c | out: lpFindFileData=0x36cf11c) returned 1 [0102.707] FindClose (in: hFindFile=0x44710f8 | out: hFindFile=0x44710f8) returned 1 [0102.707] FindNextFileW (in: hFindFile=0x44710b8, lpFindFileData=0x36cf398 | out: lpFindFileData=0x36cf398) returned 1 [0114.336] lstrcmpiW (lpString1=".1cd", lpString2=".pdf") returned -1 [0114.336] lstrcmpiW (lpString1=".3ds", lpString2=".pdf") returned -1 [0114.336] lstrcmpiW (lpString1=".3fr", lpString2=".pdf") returned -1 [0114.336] lstrcmpiW (lpString1=".3g2", lpString2=".pdf") returned -1 [0114.336] lstrcmpiW (lpString1=".3gp", lpString2=".pdf") returned -1 [0114.336] lstrcmpiW (lpString1=".7z", lpString2="pdf") returned -1 [0114.336] lstrcmpiW (lpString1=".accda", lpString2="ic.pdf") returned -1 [0114.336] lstrcmpiW (lpString1=".accdb", lpString2="ic.pdf") returned -1 [0114.337] lstrcmpiW (lpString1=".accdc", lpString2="ic.pdf") returned -1 [0114.337] lstrcmpiW (lpString1=".accde", lpString2="ic.pdf") returned -1 [0114.337] lstrcmpiW (lpString1=".accdt", lpString2="ic.pdf") returned -1 [0114.337] lstrcmpiW (lpString1=".accdw", lpString2="ic.pdf") returned -1 [0114.337] lstrcmpiW (lpString1=".adb", lpString2=".pdf") returned -1 [0114.337] lstrcmpiW (lpString1=".adp", lpString2=".pdf") returned -1 [0114.337] lstrcmpiW (lpString1=".ai", lpString2="pdf") returned -1 [0114.337] lstrcmpiW (lpString1=".ai3", lpString2=".pdf") returned -1 [0114.337] lstrcmpiW (lpString1=".ai4", lpString2=".pdf") returned -1 [0114.337] lstrcmpiW (lpString1=".ai5", lpString2=".pdf") returned -1 [0114.337] lstrcmpiW (lpString1=".ai6", lpString2=".pdf") returned -1 [0114.337] lstrcmpiW (lpString1=".ai7", lpString2=".pdf") returned -1 [0114.337] lstrcmpiW (lpString1=".ai8", lpString2=".pdf") returned -1 [0114.337] lstrcmpiW (lpString1=".anim", lpString2="c.pdf") returned -1 [0114.337] lstrcmpiW (lpString1=".arw", lpString2=".pdf") returned -1 [0114.337] lstrcmpiW (lpString1=".as", lpString2="pdf") returned -1 [0114.337] lstrcmpiW (lpString1=".asa", lpString2=".pdf") returned -1 [0114.337] lstrcmpiW (lpString1=".asc", lpString2=".pdf") returned -1 [0114.337] lstrcmpiW (lpString1=".ascx", lpString2="c.pdf") returned -1 [0114.337] lstrcmpiW (lpString1=".asm", lpString2=".pdf") returned -1 [0114.337] lstrcmpiW (lpString1=".asmx", lpString2="c.pdf") returned -1 [0114.337] lstrcmpiW (lpString1=".asp", lpString2=".pdf") returned -1 [0114.337] lstrcmpiW (lpString1=".aspx", lpString2="c.pdf") returned -1 [0114.337] lstrcmpiW (lpString1=".asr", lpString2=".pdf") returned -1 [0114.338] lstrcmpiW (lpString1=".asx", lpString2=".pdf") returned -1 [0114.338] lstrcmpiW (lpString1=".avi", lpString2=".pdf") returned -1 [0114.338] lstrcmpiW (lpString1=".avs", lpString2=".pdf") returned -1 [0114.338] lstrcmpiW (lpString1=".backup", lpString2="mic.pdf") returned -1 [0114.338] lstrcmpiW (lpString1=".bak", lpString2=".pdf") returned -1 [0114.338] lstrcmpiW (lpString1=".bay", lpString2=".pdf") returned -1 [0114.338] lstrcmpiW (lpString1=".bd", lpString2="pdf") returned -1 [0114.338] lstrcmpiW (lpString1=".bin", lpString2=".pdf") returned -1 [0114.338] lstrcmpiW (lpString1=".bmp", lpString2=".pdf") returned -1 [0114.338] lstrcmpiW (lpString1=".bz2", lpString2=".pdf") returned -1 [0114.338] lstrcmpiW (lpString1=".c", lpString2="df") returned -1 [0114.338] lstrcmpiW (lpString1=".cdr", lpString2=".pdf") returned -1 [0114.338] lstrcmpiW (lpString1=".cer", lpString2=".pdf") returned -1 [0114.338] lstrcmpiW (lpString1=".cf", lpString2="pdf") returned -1 [0114.338] lstrcmpiW (lpString1=".cfc", lpString2=".pdf") returned -1 [0114.338] lstrcmpiW (lpString1=".cfm", lpString2=".pdf") returned -1 [0114.338] lstrcmpiW (lpString1=".cfml", lpString2="c.pdf") returned -1 [0114.338] lstrcmpiW (lpString1=".cfu", lpString2=".pdf") returned -1 [0114.338] lstrcmpiW (lpString1=".chm", lpString2=".pdf") returned -1 [0114.338] lstrcmpiW (lpString1=".cin", lpString2=".pdf") returned -1 [0114.338] lstrcmpiW (lpString1=".class", lpString2="ic.pdf") returned -1 [0114.338] lstrcmpiW (lpString1=".clx", lpString2=".pdf") returned -1 [0114.338] lstrcmpiW (lpString1=".config", lpString2="mic.pdf") returned -1 [0114.339] lstrcmpiW (lpString1=".cpp", lpString2=".pdf") returned -1 [0114.339] lstrcmpiW (lpString1=".cr2", lpString2=".pdf") returned -1 [0114.339] lstrcmpiW (lpString1=".crt", lpString2=".pdf") returned -1 [0114.339] lstrcmpiW (lpString1=".crw", lpString2=".pdf") returned -1 [0114.339] lstrcmpiW (lpString1=".cs", lpString2="pdf") returned -1 [0114.339] lstrcmpiW (lpString1=".css", lpString2=".pdf") returned -1 [0114.339] lstrcmpiW (lpString1=".csv", lpString2=".pdf") returned -1 [0114.339] lstrcmpiW (lpString1=".cub", lpString2=".pdf") returned -1 [0114.339] lstrcmpiW (lpString1=".dae", lpString2=".pdf") returned -1 [0114.339] lstrcmpiW (lpString1=".dat", lpString2=".pdf") returned -1 [0114.339] lstrcmpiW (lpString1=".db", lpString2="pdf") returned -1 [0114.339] lstrcmpiW (lpString1=".dbf", lpString2=".pdf") returned -1 [0114.339] lstrcmpiW (lpString1=".dbx", lpString2=".pdf") returned -1 [0114.339] lstrcmpiW (lpString1=".dc3", lpString2=".pdf") returned -1 [0114.339] lstrcmpiW (lpString1=".dcm", lpString2=".pdf") returned -1 [0114.339] lstrcmpiW (lpString1=".dcr", lpString2=".pdf") returned -1 [0114.339] lstrcmpiW (lpString1=".der", lpString2=".pdf") returned -1 [0114.339] lstrcmpiW (lpString1=".dib", lpString2=".pdf") returned -1 [0114.339] lstrcmpiW (lpString1=".dic", lpString2=".pdf") returned -1 [0114.339] lstrcmpiW (lpString1=".dif", lpString2=".pdf") returned -1 [0114.339] lstrcmpiW (lpString1=".divx", lpString2="c.pdf") returned -1 [0114.339] lstrcmpiW (lpString1=".djvu", lpString2="c.pdf") returned -1 [0114.339] lstrcmpiW (lpString1=".dng", lpString2=".pdf") returned -1 [0114.340] lstrcmpiW (lpString1=".doc", lpString2=".pdf") returned -1 [0114.340] lstrcmpiW (lpString1=".docm", lpString2="c.pdf") returned -1 [0114.340] lstrcmpiW (lpString1=".docx", lpString2="c.pdf") returned -1 [0114.340] lstrcmpiW (lpString1=".dot", lpString2=".pdf") returned -1 [0114.340] lstrcmpiW (lpString1=".dotm", lpString2="c.pdf") returned -1 [0114.340] lstrcmpiW (lpString1=".dotx", lpString2="c.pdf") returned -1 [0114.340] lstrcmpiW (lpString1=".dpx", lpString2=".pdf") returned -1 [0114.340] lstrcmpiW (lpString1=".dqy", lpString2=".pdf") returned -1 [0114.340] lstrcmpiW (lpString1=".dsn", lpString2=".pdf") returned -1 [0114.340] lstrcmpiW (lpString1=".dt", lpString2="pdf") returned -1 [0114.340] lstrcmpiW (lpString1=".dtd", lpString2=".pdf") returned -1 [0114.340] lstrcmpiW (lpString1=".dwg", lpString2=".pdf") returned -1 [0114.340] lstrcmpiW (lpString1=".dwt", lpString2=".pdf") returned -1 [0114.340] lstrcmpiW (lpString1=".dx", lpString2="pdf") returned -1 [0114.340] lstrcmpiW (lpString1=".dxf", lpString2=".pdf") returned -1 [0114.340] lstrcmpiW (lpString1=".edml", lpString2="c.pdf") returned -1 [0114.340] lstrcmpiW (lpString1=".efd", lpString2=".pdf") returned -1 [0114.340] lstrcmpiW (lpString1=".elf", lpString2=".pdf") returned -1 [0114.340] lstrcmpiW (lpString1=".emf", lpString2=".pdf") returned -1 [0114.340] lstrcmpiW (lpString1=".emz", lpString2=".pdf") returned -1 [0114.340] lstrcmpiW (lpString1=".epf", lpString2=".pdf") returned -1 [0114.340] lstrcmpiW (lpString1=".eps", lpString2=".pdf") returned -1 [0114.340] lstrcmpiW (lpString1=".epsf", lpString2="c.pdf") returned -1 [0114.340] lstrcmpiW (lpString1=".epsp", lpString2="c.pdf") returned -1 [0114.341] lstrcmpiW (lpString1=".erf", lpString2=".pdf") returned -1 [0114.341] lstrcmpiW (lpString1=".exr", lpString2=".pdf") returned -1 [0114.341] lstrcmpiW (lpString1=".f4v", lpString2=".pdf") returned -1 [0114.341] lstrcmpiW (lpString1=".fido", lpString2="c.pdf") returned -1 [0114.341] lstrcmpiW (lpString1=".flm", lpString2=".pdf") returned -1 [0114.341] lstrcmpiW (lpString1=".flv", lpString2=".pdf") returned -1 [0114.341] lstrcmpiW (lpString1=".frm", lpString2=".pdf") returned -1 [0114.341] lstrcmpiW (lpString1=".fxg", lpString2=".pdf") returned -1 [0114.341] lstrcmpiW (lpString1=".geo", lpString2=".pdf") returned -1 [0114.341] lstrcmpiW (lpString1=".gif", lpString2=".pdf") returned -1 [0114.341] lstrcmpiW (lpString1=".grs", lpString2=".pdf") returned -1 [0114.341] lstrcmpiW (lpString1=".gz", lpString2="pdf") returned -1 [0114.341] lstrcmpiW (lpString1=".h", lpString2="df") returned -1 [0114.341] lstrcmpiW (lpString1=".hdr", lpString2=".pdf") returned -1 [0114.341] lstrcmpiW (lpString1=".hpp", lpString2=".pdf") returned -1 [0114.341] lstrcmpiW (lpString1=".hta", lpString2=".pdf") returned -1 [0114.341] lstrcmpiW (lpString1=".htc", lpString2=".pdf") returned -1 [0114.341] lstrcmpiW (lpString1=".htm", lpString2=".pdf") returned -1 [0114.341] lstrcmpiW (lpString1=".html", lpString2="c.pdf") returned -1 [0114.341] lstrcmpiW (lpString1=".icb", lpString2=".pdf") returned -1 [0114.341] lstrcmpiW (lpString1=".ics", lpString2=".pdf") returned -1 [0114.341] lstrcmpiW (lpString1=".iff", lpString2=".pdf") returned -1 [0114.341] lstrcmpiW (lpString1=".inc", lpString2=".pdf") returned -1 [0114.341] lstrcmpiW (lpString1=".indd", lpString2="c.pdf") returned -1 [0114.342] lstrcmpiW (lpString1=".ini", lpString2=".pdf") returned -1 [0114.342] lstrcmpiW (lpString1=".iqy", lpString2=".pdf") returned -1 [0114.342] lstrcmpiW (lpString1=".j2c", lpString2=".pdf") returned -1 [0114.342] lstrcmpiW (lpString1=".j2k", lpString2=".pdf") returned -1 [0114.342] lstrcmpiW (lpString1=".java", lpString2="c.pdf") returned -1 [0114.342] lstrcmpiW (lpString1=".jp2", lpString2=".pdf") returned -1 [0114.342] lstrcmpiW (lpString1=".jpc", lpString2=".pdf") returned -1 [0114.342] lstrcmpiW (lpString1=".jpe", lpString2=".pdf") returned -1 [0114.342] lstrcmpiW (lpString1=".jpeg", lpString2="c.pdf") returned -1 [0114.342] lstrcmpiW (lpString1=".jpf", lpString2=".pdf") returned -1 [0114.342] lstrcmpiW (lpString1=".jpg", lpString2=".pdf") returned -1 [0114.342] lstrcmpiW (lpString1=".jpx", lpString2=".pdf") returned -1 [0114.342] lstrcmpiW (lpString1=".js", lpString2="pdf") returned -1 [0114.342] lstrcmpiW (lpString1=".jsf", lpString2=".pdf") returned -1 [0114.342] lstrcmpiW (lpString1=".json", lpString2="c.pdf") returned -1 [0114.342] lstrcmpiW (lpString1=".jsp", lpString2=".pdf") returned -1 [0114.342] lstrcmpiW (lpString1=".kdc", lpString2=".pdf") returned -1 [0114.342] lstrcmpiW (lpString1=".kmz", lpString2=".pdf") returned -1 [0114.342] lstrcmpiW (lpString1=".kwm", lpString2=".pdf") returned -1 [0114.342] lstrcmpiW (lpString1=".lasso", lpString2="ic.pdf") returned -1 [0114.342] lstrcmpiW (lpString1=".lbi", lpString2=".pdf") returned -1 [0114.342] lstrcmpiW (lpString1=".lgf", lpString2=".pdf") returned -1 [0114.342] lstrcmpiW (lpString1=".lgp", lpString2=".pdf") returned -1 [0114.342] lstrcmpiW (lpString1=".log", lpString2=".pdf") returned -1 [0114.343] lstrcmpiW (lpString1=".m1v", lpString2=".pdf") returned -1 [0114.343] lstrcmpiW (lpString1=".m4a", lpString2=".pdf") returned -1 [0114.343] lstrcmpiW (lpString1=".m4v", lpString2=".pdf") returned -1 [0114.343] lstrcmpiW (lpString1=".max", lpString2=".pdf") returned -1 [0114.343] lstrcmpiW (lpString1=".md", lpString2="pdf") returned -1 [0114.343] lstrcmpiW (lpString1=".mda", lpString2=".pdf") returned -1 [0114.343] lstrcmpiW (lpString1=".mdb", lpString2=".pdf") returned -1 [0114.343] lstrcmpiW (lpString1=".mde", lpString2=".pdf") returned -1 [0114.343] lstrcmpiW (lpString1=".mdf", lpString2=".pdf") returned -1 [0114.343] lstrcmpiW (lpString1=".mdw", lpString2=".pdf") returned -1 [0114.343] lstrcmpiW (lpString1=".mef", lpString2=".pdf") returned -1 [0114.343] lstrcmpiW (lpString1=".mft", lpString2=".pdf") returned -1 [0114.343] lstrcmpiW (lpString1=".mfw", lpString2=".pdf") returned -1 [0114.343] lstrcmpiW (lpString1=".mht", lpString2=".pdf") returned -1 [0114.343] lstrcmpiW (lpString1=".mhtml", lpString2="ic.pdf") returned -1 [0114.343] lstrcmpiW (lpString1=".mka", lpString2=".pdf") returned -1 [0114.343] lstrcmpiW (lpString1=".mkidx", lpString2="ic.pdf") returned -1 [0114.343] lstrcmpiW (lpString1=".mkv", lpString2=".pdf") returned -1 [0114.343] lstrcmpiW (lpString1=".mos", lpString2=".pdf") returned -1 [0114.343] lstrcmpiW (lpString1=".mov", lpString2=".pdf") returned -1 [0114.343] lstrcmpiW (lpString1=".mp3", lpString2=".pdf") returned -1 [0114.343] lstrcmpiW (lpString1=".mp4", lpString2=".pdf") returned -1 [0114.343] lstrcmpiW (lpString1=".mpeg", lpString2="c.pdf") returned -1 [0114.344] lstrcmpiW (lpString1=".mpg", lpString2=".pdf") returned -1 [0114.344] lstrcmpiW (lpString1=".mpv", lpString2=".pdf") returned -1 [0114.344] lstrcmpiW (lpString1=".mrw", lpString2=".pdf") returned -1 [0114.344] lstrcmpiW (lpString1=".msg", lpString2=".pdf") returned -1 [0114.344] lstrcmpiW (lpString1=".mxl", lpString2=".pdf") returned -1 [0114.344] lstrcmpiW (lpString1=".myd", lpString2=".pdf") returned -1 [0114.344] lstrcmpiW (lpString1=".myi", lpString2=".pdf") returned -1 [0114.344] lstrcmpiW (lpString1=".nef", lpString2=".pdf") returned -1 [0114.344] lstrcmpiW (lpString1=".nrw", lpString2=".pdf") returned -1 [0114.344] lstrcmpiW (lpString1=".obj", lpString2=".pdf") returned -1 [0114.344] lstrcmpiW (lpString1=".odb", lpString2=".pdf") returned -1 [0114.344] lstrcmpiW (lpString1=".odc", lpString2=".pdf") returned -1 [0114.344] lstrcmpiW (lpString1=".odm", lpString2=".pdf") returned -1 [0114.344] lstrcmpiW (lpString1=".odp", lpString2=".pdf") returned -1 [0114.344] lstrcmpiW (lpString1=".ods", lpString2=".pdf") returned -1 [0114.344] lstrcmpiW (lpString1=".oft", lpString2=".pdf") returned -1 [0114.344] lstrcmpiW (lpString1=".one", lpString2=".pdf") returned -1 [0114.344] lstrcmpiW (lpString1=".onepkg", lpString2="mic.pdf") returned -1 [0114.344] lstrcmpiW (lpString1=".onetoc2", lpString2="amic.pdf") returned -1 [0114.344] lstrcmpiW (lpString1=".opt", lpString2=".pdf") returned -1 [0114.344] lstrcmpiW (lpString1=".oqy", lpString2=".pdf") returned -1 [0114.344] lstrcmpiW (lpString1=".orf", lpString2=".pdf") returned -1 [0114.344] lstrcmpiW (lpString1=".p12", lpString2=".pdf") returned -1 [0114.344] lstrcmpiW (lpString1=".p7b", lpString2=".pdf") returned -1 [0114.345] lstrcmpiW (lpString1=".p7c", lpString2=".pdf") returned -1 [0114.345] lstrcmpiW (lpString1=".pam", lpString2=".pdf") returned -1 [0114.345] lstrcmpiW (lpString1=".pbm", lpString2=".pdf") returned -1 [0114.345] lstrcmpiW (lpString1=".pct", lpString2=".pdf") returned -1 [0114.345] lstrcmpiW (lpString1=".pcx", lpString2=".pdf") returned -1 [0114.345] lstrcmpiW (lpString1=".pdd", lpString2=".pdf") returned -1 [0114.345] lstrcmpiW (lpString1=".pdf", lpString2=".pdf") returned 0 [0114.345] lstrcmpiW (lpString1=".waifu", lpString2="ic.pdf") returned -1 [0114.345] lstrcmpiW (lpString1="boot.ini", lpString2="Dynamic.pdf") returned -1 [0114.345] lstrcmpiW (lpString1="bootfont.bin", lpString2="Dynamic.pdf") returned -1 [0114.345] lstrcmpiW (lpString1="ntldr", lpString2="Dynamic.pdf") returned 1 [0114.345] lstrcmpiW (lpString1="ntdetect.com", lpString2="Dynamic.pdf") returned 1 [0114.345] lstrcmpiW (lpString1="io.sys", lpString2="Dynamic.pdf") returned 1 [0114.345] lstrcmpiW (lpString1="FILES ENCRYPTED.txt", lpString2="Dynamic.pdf") returned 1 [0114.345] lstrcmpiW (lpString1="Info.hta", lpString2="Dynamic.pdf") returned 1 [0114.345] lstrcmpiW (lpString1="unlikexpc.exe", lpString2="Dynamic.pdf") returned 1 [0114.345] lstrcmpiW (lpString1=".1cd", lpString2=".pdf") returned -1 [0114.345] lstrcmpiW (lpString1=".3ds", lpString2=".pdf") returned -1 [0114.345] lstrcmpiW (lpString1=".3fr", lpString2=".pdf") returned -1 [0114.345] lstrcmpiW (lpString1=".3g2", lpString2=".pdf") returned -1 [0114.345] lstrcmpiW (lpString1=".3gp", lpString2=".pdf") returned -1 [0114.345] lstrcmpiW (lpString1=".7z", lpString2="pdf") returned -1 [0114.345] lstrcmpiW (lpString1=".accda", lpString2="es.pdf") returned -1 [0114.345] lstrcmpiW (lpString1=".accdb", lpString2="es.pdf") returned -1 [0114.345] lstrcmpiW (lpString1=".accdc", lpString2="es.pdf") returned -1 [0114.345] lstrcmpiW (lpString1=".accde", lpString2="es.pdf") returned -1 [0114.345] lstrcmpiW (lpString1=".accdt", lpString2="es.pdf") returned -1 [0114.346] lstrcmpiW (lpString1=".accdw", lpString2="es.pdf") returned -1 [0114.346] lstrcmpiW (lpString1=".adb", lpString2=".pdf") returned -1 [0114.346] lstrcmpiW (lpString1=".adp", lpString2=".pdf") returned -1 [0114.346] lstrcmpiW (lpString1=".ai", lpString2="pdf") returned -1 [0114.346] lstrcmpiW (lpString1=".ai3", lpString2=".pdf") returned -1 [0114.346] lstrcmpiW (lpString1=".ai4", lpString2=".pdf") returned -1 [0114.346] lstrcmpiW (lpString1=".ai5", lpString2=".pdf") returned -1 [0114.346] lstrcmpiW (lpString1=".ai6", lpString2=".pdf") returned -1 [0114.346] lstrcmpiW (lpString1=".ai7", lpString2=".pdf") returned -1 [0114.346] lstrcmpiW (lpString1=".ai8", lpString2=".pdf") returned -1 [0114.346] lstrcmpiW (lpString1=".anim", lpString2="s.pdf") returned -1 [0114.346] lstrcmpiW (lpString1=".arw", lpString2=".pdf") returned -1 [0114.346] lstrcmpiW (lpString1=".as", lpString2="pdf") returned -1 [0114.346] lstrcmpiW (lpString1=".asa", lpString2=".pdf") returned -1 [0114.346] lstrcmpiW (lpString1=".asc", lpString2=".pdf") returned -1 [0114.346] lstrcmpiW (lpString1=".ascx", lpString2="s.pdf") returned -1 [0114.346] lstrcmpiW (lpString1=".asm", lpString2=".pdf") returned -1 [0114.346] lstrcmpiW (lpString1=".asmx", lpString2="s.pdf") returned -1 [0114.346] lstrcmpiW (lpString1=".asp", lpString2=".pdf") returned -1 [0114.346] lstrcmpiW (lpString1=".aspx", lpString2="s.pdf") returned -1 [0114.346] lstrcmpiW (lpString1=".asr", lpString2=".pdf") returned -1 [0114.346] lstrcmpiW (lpString1=".asx", lpString2=".pdf") returned -1 [0114.346] lstrcmpiW (lpString1=".avi", lpString2=".pdf") returned -1 [0114.346] lstrcmpiW (lpString1=".avs", lpString2=".pdf") returned -1 [0114.347] lstrcmpiW (lpString1=".backup", lpString2="ces.pdf") returned -1 [0121.209] FindNextFileW (in: hFindFile=0x4471178, lpFindFileData=0x36cec24 | out: lpFindFileData=0x36cec24) returned 1 [0121.209] FindNextFileW (in: hFindFile=0x4471178, lpFindFileData=0x36cec24 | out: lpFindFileData=0x36cec24) returned 1 Thread: id = 35 os_tid = 0xbbc [0102.657] lstrlenW (lpString="C:") returned 2 [0102.657] FindFirstFileW (in: lpFileName="C:\\*", lpFindFileData=0x3bdf8a0 | out: lpFindFileData=0x3bdf8a0) returned 0x81b618 [0102.657] lstrlenW (lpString="C:\\$Recycle.Bin") returned 15 [0102.657] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\$Recycle.Bin") returned 1 [0102.657] lstrlenW (lpString="$Recycle.Bin") returned 12 [0102.657] lstrcmpiW (lpString1="C:\\Windows", lpString2="$Recycle.Bin") returned 1 [0102.657] lstrlenW (lpString="C:\\$Recycle.Bin") returned 15 [0102.657] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\*", lpFindFileData=0x3bdf624 | out: lpFindFileData=0x3bdf624) returned 0x8b38d8 [0102.657] FindNextFileW (in: hFindFile=0x8b38d8, lpFindFileData=0x3bdf624 | out: lpFindFileData=0x3bdf624) returned 1 [0102.657] FindNextFileW (in: hFindFile=0x8b38d8, lpFindFileData=0x3bdf624 | out: lpFindFileData=0x3bdf624) returned 1 [0102.657] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 62 [0102.657] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 1 [0102.657] lstrlenW (lpString="S-1-5-21-3388679973-3930757225-3770151564-1000") returned 46 [0102.657] lstrcmpiW (lpString1="C:\\Windows", lpString2="S-1-5-21-3388679973-3930757225-3770151564-1000") returned -1 [0102.657] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 62 [0102.657] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\*", lpFindFileData=0x3bdf3a8 | out: lpFindFileData=0x3bdf3a8) returned 0x8b4920 [0102.658] FindNextFileW (in: hFindFile=0x8b4920, lpFindFileData=0x3bdf3a8 | out: lpFindFileData=0x3bdf3a8) returned 1 [0102.658] FindNextFileW (in: hFindFile=0x8b4920, lpFindFileData=0x3bdf3a8 | out: lpFindFileData=0x3bdf3a8) returned 1 [0102.658] lstrlenW (lpString="desktop.ini") returned 11 [0102.658] lstrlenW (lpString=".1cd") returned 4 [0102.658] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0102.658] lstrlenW (lpString=".3ds") returned 4 [0102.658] lstrcmpiW (lpString1=".3ds", lpString2=".ini") returned -1 [0102.658] lstrlenW (lpString=".3fr") returned 4 [0102.658] lstrcmpiW (lpString1=".3fr", lpString2=".ini") returned -1 [0102.658] lstrlenW (lpString=".3g2") returned 4 [0102.658] lstrcmpiW (lpString1=".3g2", lpString2=".ini") returned -1 [0102.658] lstrlenW (lpString=".3gp") returned 4 [0102.658] lstrcmpiW (lpString1=".3gp", lpString2=".ini") returned -1 [0102.658] lstrlenW (lpString=".7z") returned 3 [0102.658] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0102.658] lstrlenW (lpString=".accda") returned 6 [0102.658] lstrcmpiW (lpString1=".accda", lpString2="op.ini") returned -1 [0102.658] lstrlenW (lpString=".accdb") returned 6 [0102.658] lstrcmpiW (lpString1=".accdb", lpString2="op.ini") returned -1 [0102.658] lstrlenW (lpString=".accdc") returned 6 [0102.658] lstrcmpiW (lpString1=".accdc", lpString2="op.ini") returned -1 [0102.658] lstrlenW (lpString=".accde") returned 6 [0102.658] lstrcmpiW (lpString1=".accde", lpString2="op.ini") returned -1 [0102.658] lstrlenW (lpString=".accdt") returned 6 [0102.658] lstrcmpiW (lpString1=".accdt", lpString2="op.ini") returned -1 [0102.658] lstrlenW (lpString=".accdw") returned 6 [0102.658] lstrcmpiW (lpString1=".accdw", lpString2="op.ini") returned -1 [0102.658] lstrlenW (lpString=".adb") returned 4 [0102.658] lstrcmpiW (lpString1=".adb", lpString2=".ini") returned -1 [0102.658] lstrlenW (lpString=".adp") returned 4 [0102.658] lstrcmpiW (lpString1=".adp", lpString2=".ini") returned -1 [0102.658] lstrlenW (lpString=".ai") returned 3 [0102.658] lstrcmpiW (lpString1=".ai", lpString2="ini") returned -1 [0102.658] lstrlenW (lpString=".ai3") returned 4 [0102.658] lstrcmpiW (lpString1=".ai3", lpString2=".ini") returned -1 [0102.658] lstrlenW (lpString=".ai4") returned 4 [0102.658] lstrcmpiW (lpString1=".ai4", lpString2=".ini") returned -1 [0102.658] lstrlenW (lpString=".ai5") returned 4 [0102.658] lstrcmpiW (lpString1=".ai5", lpString2=".ini") returned -1 [0102.658] lstrlenW (lpString=".ai6") returned 4 [0102.658] lstrcmpiW (lpString1=".ai6", lpString2=".ini") returned -1 [0102.658] lstrlenW (lpString=".ai7") returned 4 [0102.658] lstrcmpiW (lpString1=".ai7", lpString2=".ini") returned -1 [0102.658] lstrlenW (lpString=".ai8") returned 4 [0102.658] lstrcmpiW (lpString1=".ai8", lpString2=".ini") returned -1 [0102.658] lstrlenW (lpString=".anim") returned 5 [0102.658] lstrcmpiW (lpString1=".anim", lpString2="p.ini") returned -1 [0102.658] lstrlenW (lpString=".arw") returned 4 [0102.659] lstrcmpiW (lpString1=".arw", lpString2=".ini") returned -1 [0102.659] lstrlenW (lpString=".as") returned 3 [0102.659] lstrcmpiW (lpString1=".as", lpString2="ini") returned -1 [0102.659] lstrlenW (lpString=".asa") returned 4 [0102.659] lstrcmpiW (lpString1=".asa", lpString2=".ini") returned -1 [0102.659] lstrlenW (lpString=".asc") returned 4 [0102.659] lstrcmpiW (lpString1=".asc", lpString2=".ini") returned -1 [0102.659] lstrlenW (lpString=".ascx") returned 5 [0102.659] lstrcmpiW (lpString1=".ascx", lpString2="p.ini") returned -1 [0102.659] lstrlenW (lpString=".asm") returned 4 [0102.659] lstrcmpiW (lpString1=".asm", lpString2=".ini") returned -1 [0102.659] lstrlenW (lpString=".asmx") returned 5 [0102.659] lstrcmpiW (lpString1=".asmx", lpString2="p.ini") returned -1 [0102.659] lstrlenW (lpString=".asp") returned 4 [0102.659] lstrcmpiW (lpString1=".asp", lpString2=".ini") returned -1 [0102.659] lstrlenW (lpString=".aspx") returned 5 [0102.659] lstrcmpiW (lpString1=".aspx", lpString2="p.ini") returned -1 [0102.659] lstrlenW (lpString=".asr") returned 4 [0102.659] lstrcmpiW (lpString1=".asr", lpString2=".ini") returned -1 [0102.659] lstrlenW (lpString=".asx") returned 4 [0102.659] lstrcmpiW (lpString1=".asx", lpString2=".ini") returned -1 [0102.659] lstrlenW (lpString=".avi") returned 4 [0102.659] lstrcmpiW (lpString1=".avi", lpString2=".ini") returned -1 [0102.659] lstrlenW (lpString=".avs") returned 4 [0102.659] lstrcmpiW (lpString1=".avs", lpString2=".ini") returned -1 [0102.659] lstrlenW (lpString=".backup") returned 7 [0102.659] lstrcmpiW (lpString1=".backup", lpString2="top.ini") returned -1 [0102.659] lstrlenW (lpString=".bak") returned 4 [0102.659] lstrcmpiW (lpString1=".bak", lpString2=".ini") returned -1 [0102.659] lstrlenW (lpString=".bay") returned 4 [0102.659] lstrcmpiW (lpString1=".bay", lpString2=".ini") returned -1 [0102.659] lstrlenW (lpString=".bd") returned 3 [0102.659] lstrcmpiW (lpString1=".bd", lpString2="ini") returned -1 [0102.659] lstrlenW (lpString=".bin") returned 4 [0102.659] lstrcmpiW (lpString1=".bin", lpString2=".ini") returned -1 [0102.659] lstrlenW (lpString=".bmp") returned 4 [0102.659] lstrcmpiW (lpString1=".bmp", lpString2=".ini") returned -1 [0102.659] lstrlenW (lpString=".bz2") returned 4 [0102.659] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0102.659] lstrlenW (lpString=".c") returned 2 [0102.659] lstrcmpiW (lpString1=".c", lpString2="ni") returned -1 [0102.659] lstrlenW (lpString=".cdr") returned 4 [0102.659] lstrcmpiW (lpString1=".cdr", lpString2=".ini") returned -1 [0102.659] lstrlenW (lpString=".cer") returned 4 [0102.660] lstrcmpiW (lpString1=".cer", lpString2=".ini") returned -1 [0102.660] lstrlenW (lpString=".cf") returned 3 [0102.660] lstrcmpiW (lpString1=".cf", lpString2="ini") returned -1 [0102.660] lstrlenW (lpString=".cfc") returned 4 [0102.660] lstrcmpiW (lpString1=".cfc", lpString2=".ini") returned -1 [0102.660] lstrlenW (lpString=".cfm") returned 4 [0102.660] lstrcmpiW (lpString1=".cfm", lpString2=".ini") returned -1 [0102.660] lstrlenW (lpString=".cfml") returned 5 [0102.660] lstrcmpiW (lpString1=".cfml", lpString2="p.ini") returned -1 [0102.660] lstrlenW (lpString=".cfu") returned 4 [0102.660] lstrcmpiW (lpString1=".cfu", lpString2=".ini") returned -1 [0102.660] lstrlenW (lpString=".chm") returned 4 [0102.660] lstrcmpiW (lpString1=".chm", lpString2=".ini") returned -1 [0102.660] lstrlenW (lpString=".cin") returned 4 [0102.660] lstrcmpiW (lpString1=".cin", lpString2=".ini") returned -1 [0102.660] lstrlenW (lpString=".class") returned 6 [0102.660] lstrcmpiW (lpString1=".class", lpString2="op.ini") returned -1 [0102.660] lstrlenW (lpString=".clx") returned 4 [0102.660] lstrcmpiW (lpString1=".clx", lpString2=".ini") returned -1 [0102.660] lstrlenW (lpString=".config") returned 7 [0102.660] lstrcmpiW (lpString1=".config", lpString2="top.ini") returned -1 [0102.660] lstrlenW (lpString=".cpp") returned 4 [0102.660] lstrcmpiW (lpString1=".cpp", lpString2=".ini") returned -1 [0102.660] lstrlenW (lpString=".cr2") returned 4 [0102.660] lstrcmpiW (lpString1=".cr2", lpString2=".ini") returned -1 [0102.660] lstrlenW (lpString=".crt") returned 4 [0102.660] lstrcmpiW (lpString1=".crt", lpString2=".ini") returned -1 [0102.660] lstrlenW (lpString=".crw") returned 4 [0102.660] lstrcmpiW (lpString1=".crw", lpString2=".ini") returned -1 [0102.660] lstrlenW (lpString=".cs") returned 3 [0102.660] lstrcmpiW (lpString1=".cs", lpString2="ini") returned -1 [0102.660] lstrlenW (lpString=".css") returned 4 [0102.660] lstrcmpiW (lpString1=".css", lpString2=".ini") returned -1 [0102.660] lstrlenW (lpString=".csv") returned 4 [0102.660] lstrcmpiW (lpString1=".csv", lpString2=".ini") returned -1 [0102.660] lstrlenW (lpString=".cub") returned 4 [0102.660] lstrcmpiW (lpString1=".cub", lpString2=".ini") returned -1 [0102.660] lstrlenW (lpString=".dae") returned 4 [0102.660] lstrcmpiW (lpString1=".dae", lpString2=".ini") returned -1 [0102.660] lstrlenW (lpString=".dat") returned 4 [0102.660] lstrcmpiW (lpString1=".dat", lpString2=".ini") returned -1 [0102.660] lstrlenW (lpString=".db") returned 3 [0102.660] lstrcmpiW (lpString1=".db", lpString2="ini") returned -1 [0102.660] lstrlenW (lpString=".dbf") returned 4 [0102.660] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0102.660] lstrlenW (lpString=".dbx") returned 4 [0102.660] lstrcmpiW (lpString1=".dbx", lpString2=".ini") returned -1 [0102.660] lstrlenW (lpString=".dc3") returned 4 [0102.660] lstrcmpiW (lpString1=".dc3", lpString2=".ini") returned -1 [0102.660] lstrlenW (lpString=".dcm") returned 4 [0102.660] lstrcmpiW (lpString1=".dcm", lpString2=".ini") returned -1 [0102.660] lstrlenW (lpString=".dcr") returned 4 [0102.660] lstrcmpiW (lpString1=".dcr", lpString2=".ini") returned -1 [0102.661] lstrlenW (lpString=".der") returned 4 [0102.661] lstrcmpiW (lpString1=".der", lpString2=".ini") returned -1 [0102.661] lstrlenW (lpString=".dib") returned 4 [0102.661] lstrcmpiW (lpString1=".dib", lpString2=".ini") returned -1 [0102.661] lstrlenW (lpString=".dic") returned 4 [0102.661] lstrcmpiW (lpString1=".dic", lpString2=".ini") returned -1 [0102.661] lstrlenW (lpString=".dif") returned 4 [0102.661] lstrcmpiW (lpString1=".dif", lpString2=".ini") returned -1 [0102.661] lstrlenW (lpString=".divx") returned 5 [0102.661] lstrcmpiW (lpString1=".divx", lpString2="p.ini") returned -1 [0102.661] lstrlenW (lpString=".djvu") returned 5 [0102.661] lstrcmpiW (lpString1=".djvu", lpString2="p.ini") returned -1 [0102.661] lstrlenW (lpString=".dng") returned 4 [0102.661] lstrcmpiW (lpString1=".dng", lpString2=".ini") returned -1 [0102.661] lstrlenW (lpString=".doc") returned 4 [0102.661] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0102.661] lstrlenW (lpString=".docm") returned 5 [0102.661] lstrcmpiW (lpString1=".docm", lpString2="p.ini") returned -1 [0102.661] lstrlenW (lpString=".docx") returned 5 [0102.661] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0102.661] lstrlenW (lpString=".dot") returned 4 [0102.661] lstrcmpiW (lpString1=".dot", lpString2=".ini") returned -1 [0102.661] lstrlenW (lpString=".dotm") returned 5 [0102.661] lstrcmpiW (lpString1=".dotm", lpString2="p.ini") returned -1 [0102.661] lstrlenW (lpString=".dotx") returned 5 [0102.661] lstrcmpiW (lpString1=".dotx", lpString2="p.ini") returned -1 [0102.661] lstrlenW (lpString=".dpx") returned 4 [0102.661] lstrcmpiW (lpString1=".dpx", lpString2=".ini") returned -1 [0102.661] lstrlenW (lpString=".dqy") returned 4 [0102.661] lstrcmpiW (lpString1=".dqy", lpString2=".ini") returned -1 [0102.661] lstrlenW (lpString=".dsn") returned 4 [0102.661] lstrcmpiW (lpString1=".dsn", lpString2=".ini") returned -1 [0102.661] lstrlenW (lpString=".dt") returned 3 [0102.661] lstrcmpiW (lpString1=".dt", lpString2="ini") returned -1 [0102.661] lstrlenW (lpString=".dtd") returned 4 [0102.661] lstrcmpiW (lpString1=".dtd", lpString2=".ini") returned -1 [0102.661] lstrlenW (lpString=".dwg") returned 4 [0102.661] lstrcmpiW (lpString1=".dwg", lpString2=".ini") returned -1 [0102.661] lstrlenW (lpString=".dwt") returned 4 [0102.661] lstrcmpiW (lpString1=".dwt", lpString2=".ini") returned -1 [0102.661] lstrlenW (lpString=".dx") returned 3 [0102.661] lstrcmpiW (lpString1=".dx", lpString2="ini") returned -1 [0102.661] lstrlenW (lpString=".dxf") returned 4 [0102.661] lstrcmpiW (lpString1=".dxf", lpString2=".ini") returned -1 [0102.661] lstrlenW (lpString=".edml") returned 5 [0102.661] lstrcmpiW (lpString1=".edml", lpString2="p.ini") returned -1 [0102.661] lstrlenW (lpString=".efd") returned 4 [0102.661] lstrcmpiW (lpString1=".efd", lpString2=".ini") returned -1 [0102.661] lstrlenW (lpString=".elf") returned 4 [0102.661] lstrcmpiW (lpString1=".elf", lpString2=".ini") returned -1 [0102.661] lstrlenW (lpString=".emf") returned 4 [0102.661] lstrcmpiW (lpString1=".emf", lpString2=".ini") returned -1 [0102.661] lstrlenW (lpString=".emz") returned 4 [0102.662] lstrcmpiW (lpString1=".emz", lpString2=".ini") returned -1 [0102.662] lstrlenW (lpString=".epf") returned 4 [0102.662] lstrcmpiW (lpString1=".epf", lpString2=".ini") returned -1 [0102.662] lstrlenW (lpString=".eps") returned 4 [0102.662] lstrcmpiW (lpString1=".eps", lpString2=".ini") returned -1 [0102.662] lstrlenW (lpString=".epsf") returned 5 [0102.662] lstrcmpiW (lpString1=".epsf", lpString2="p.ini") returned -1 [0102.662] lstrlenW (lpString=".epsp") returned 5 [0102.662] lstrcmpiW (lpString1=".epsp", lpString2="p.ini") returned -1 [0102.662] lstrlenW (lpString=".erf") returned 4 [0102.662] lstrcmpiW (lpString1=".erf", lpString2=".ini") returned -1 [0102.662] lstrlenW (lpString=".exr") returned 4 [0102.662] lstrcmpiW (lpString1=".exr", lpString2=".ini") returned -1 [0102.662] lstrlenW (lpString=".f4v") returned 4 [0102.662] lstrcmpiW (lpString1=".f4v", lpString2=".ini") returned -1 [0102.662] lstrlenW (lpString=".fido") returned 5 [0102.662] lstrcmpiW (lpString1=".fido", lpString2="p.ini") returned -1 [0102.662] lstrlenW (lpString=".flm") returned 4 [0102.662] lstrcmpiW (lpString1=".flm", lpString2=".ini") returned -1 [0102.662] lstrlenW (lpString=".flv") returned 4 [0102.662] lstrcmpiW (lpString1=".flv", lpString2=".ini") returned -1 [0102.662] lstrlenW (lpString=".frm") returned 4 [0102.662] lstrcmpiW (lpString1=".frm", lpString2=".ini") returned -1 [0102.662] lstrlenW (lpString=".fxg") returned 4 [0102.662] lstrcmpiW (lpString1=".fxg", lpString2=".ini") returned -1 [0102.662] lstrlenW (lpString=".geo") returned 4 [0102.662] lstrcmpiW (lpString1=".geo", lpString2=".ini") returned -1 [0102.662] lstrlenW (lpString=".gif") returned 4 [0102.662] lstrcmpiW (lpString1=".gif", lpString2=".ini") returned -1 [0102.662] lstrlenW (lpString=".grs") returned 4 [0102.662] lstrcmpiW (lpString1=".grs", lpString2=".ini") returned -1 [0102.662] lstrlenW (lpString=".gz") returned 3 [0102.662] lstrcmpiW (lpString1=".gz", lpString2="ini") returned -1 [0102.662] lstrlenW (lpString=".h") returned 2 [0102.662] lstrcmpiW (lpString1=".h", lpString2="ni") returned -1 [0102.662] lstrlenW (lpString=".hdr") returned 4 [0102.662] lstrcmpiW (lpString1=".hdr", lpString2=".ini") returned -1 [0102.662] lstrlenW (lpString=".hpp") returned 4 [0102.662] lstrcmpiW (lpString1=".hpp", lpString2=".ini") returned -1 [0102.662] lstrlenW (lpString=".hta") returned 4 [0102.662] lstrcmpiW (lpString1=".hta", lpString2=".ini") returned -1 [0102.662] lstrlenW (lpString=".htc") returned 4 [0102.662] lstrcmpiW (lpString1=".htc", lpString2=".ini") returned -1 [0102.662] lstrlenW (lpString=".htm") returned 4 [0102.662] lstrcmpiW (lpString1=".htm", lpString2=".ini") returned -1 [0102.662] lstrlenW (lpString=".html") returned 5 [0102.662] lstrcmpiW (lpString1=".html", lpString2="p.ini") returned -1 [0102.662] lstrlenW (lpString=".icb") returned 4 [0102.662] lstrcmpiW (lpString1=".icb", lpString2=".ini") returned -1 [0102.662] lstrlenW (lpString=".ics") returned 4 [0102.662] lstrcmpiW (lpString1=".ics", lpString2=".ini") returned -1 [0102.662] lstrlenW (lpString=".iff") returned 4 [0102.662] lstrcmpiW (lpString1=".iff", lpString2=".ini") returned -1 [0102.663] lstrlenW (lpString=".inc") returned 4 [0102.663] lstrcmpiW (lpString1=".inc", lpString2=".ini") returned -1 [0102.663] lstrlenW (lpString=".indd") returned 5 [0102.663] lstrcmpiW (lpString1=".indd", lpString2="p.ini") returned -1 [0102.663] lstrlenW (lpString=".ini") returned 4 [0102.663] lstrcmpiW (lpString1=".ini", lpString2=".ini") returned 0 [0102.663] FindNextFileW (in: hFindFile=0x8b4920, lpFindFileData=0x3bdf3a8 | out: lpFindFileData=0x3bdf3a8) returned 0 [0102.663] FindClose (in: hFindFile=0x8b4920 | out: hFindFile=0x8b4920) returned 1 [0102.663] FindNextFileW (in: hFindFile=0x8b38d8, lpFindFileData=0x3bdf624 | out: lpFindFileData=0x3bdf624) returned 0 [0102.663] FindClose (in: hFindFile=0x8b38d8 | out: hFindFile=0x8b38d8) returned 1 [0102.663] FindNextFileW (in: hFindFile=0x81b618, lpFindFileData=0x3bdf8a0 | out: lpFindFileData=0x3bdf8a0) returned 1 [0102.663] lstrlenW (lpString="C:\\Boot") returned 7 [0102.663] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\Boot") returned 1 [0102.663] lstrlenW (lpString="Boot") returned 4 [0102.663] lstrcmpiW (lpString1="C:\\Windows", lpString2="Boot") returned 1 [0102.663] lstrlenW (lpString="C:\\Boot") returned 7 [0102.663] FindFirstFileW (in: lpFileName="C:\\Boot\\*", lpFindFileData=0x3bdf624 | out: lpFindFileData=0x3bdf624) returned 0x8b48e0 [0102.663] FindNextFileW (in: hFindFile=0x8b48e0, lpFindFileData=0x3bdf624 | out: lpFindFileData=0x3bdf624) returned 1 [0102.663] FindNextFileW (in: hFindFile=0x8b48e0, lpFindFileData=0x3bdf624 | out: lpFindFileData=0x3bdf624) returned 1 [0102.663] lstrlenW (lpString="BCD") returned 3 [0102.663] lstrlenW (lpString=".1cd") returned 4 [0102.664] lstrcmpiW (lpString1=".1cd", lpString2="") returned 1 [0102.664] lstrlenW (lpString=".3ds") returned 4 [0102.664] lstrcmpiW (lpString1=".3ds", lpString2="") returned 1 [0102.664] lstrlenW (lpString=".3fr") returned 4 [0102.664] lstrcmpiW (lpString1=".3fr", lpString2="") returned 1 [0102.664] lstrlenW (lpString=".3g2") returned 4 [0102.664] lstrcmpiW (lpString1=".3g2", lpString2="") returned 1 [0102.664] lstrlenW (lpString=".3gp") returned 4 [0102.664] lstrcmpiW (lpString1=".3gp", lpString2="") returned 1 [0102.664] lstrlenW (lpString=".7z") returned 3 [0102.664] lstrcmpiW (lpString1=".7z", lpString2="BCD") returned -1 [0102.664] lstrlenW (lpString=".accda") returned 6 [0102.664] lstrcmpiW (lpString1=".accda", lpString2="") returned 1 [0102.664] lstrlenW (lpString=".accdb") returned 6 [0102.664] lstrcmpiW (lpString1=".accdb", lpString2="") returned 1 [0102.664] lstrlenW (lpString=".accdc") returned 6 [0102.664] lstrcmpiW (lpString1=".accdc", lpString2="") returned 1 [0102.664] lstrlenW (lpString=".accde") returned 6 [0102.664] lstrcmpiW (lpString1=".accde", lpString2="") returned 1 [0102.664] lstrlenW (lpString=".accdt") returned 6 [0102.664] lstrcmpiW (lpString1=".accdt", lpString2="") returned 1 [0102.664] lstrlenW (lpString=".accdw") returned 6 [0102.664] lstrcmpiW (lpString1=".accdw", lpString2="") returned 1 [0102.664] lstrlenW (lpString=".adb") returned 4 [0102.664] lstrcmpiW (lpString1=".adb", lpString2="") returned 1 [0102.664] lstrlenW (lpString=".adp") returned 4 [0102.664] lstrcmpiW (lpString1=".adp", lpString2="") returned 1 [0102.664] lstrlenW (lpString=".ai") returned 3 [0102.664] lstrcmpiW (lpString1=".ai", lpString2="BCD") returned -1 [0102.664] lstrlenW (lpString=".ai3") returned 4 [0102.664] lstrcmpiW (lpString1=".ai3", lpString2="") returned 1 [0102.664] lstrlenW (lpString=".ai4") returned 4 [0102.664] lstrcmpiW (lpString1=".ai4", lpString2="") returned 1 [0102.664] lstrlenW (lpString=".ai5") returned 4 [0102.664] lstrcmpiW (lpString1=".ai5", lpString2="") returned 1 [0102.664] lstrlenW (lpString=".ai6") returned 4 [0102.664] lstrcmpiW (lpString1=".ai6", lpString2="") returned 1 [0102.664] lstrlenW (lpString=".ai7") returned 4 [0102.664] lstrcmpiW (lpString1=".ai7", lpString2="") returned 1 [0102.664] lstrlenW (lpString=".ai8") returned 4 [0102.664] lstrcmpiW (lpString1=".ai8", lpString2="") returned 1 [0102.664] lstrlenW (lpString=".anim") returned 5 [0102.664] lstrcmpiW (lpString1=".anim", lpString2="") returned 1 [0102.664] lstrlenW (lpString=".arw") returned 4 [0102.664] lstrcmpiW (lpString1=".arw", lpString2="") returned 1 [0102.664] lstrlenW (lpString=".as") returned 3 [0102.664] lstrcmpiW (lpString1=".as", lpString2="BCD") returned -1 [0102.664] lstrlenW (lpString=".asa") returned 4 [0102.664] lstrcmpiW (lpString1=".asa", lpString2="") returned 1 [0102.664] lstrlenW (lpString=".asc") returned 4 [0102.664] lstrcmpiW (lpString1=".asc", lpString2="") returned 1 [0102.664] lstrlenW (lpString=".ascx") returned 5 [0102.665] lstrcmpiW (lpString1=".ascx", lpString2="") returned 1 [0102.665] lstrlenW (lpString=".asm") returned 4 [0102.665] lstrcmpiW (lpString1=".asm", lpString2="") returned 1 [0102.665] lstrlenW (lpString=".asmx") returned 5 [0102.665] lstrcmpiW (lpString1=".asmx", lpString2="") returned 1 [0102.665] lstrlenW (lpString=".asp") returned 4 [0102.665] lstrcmpiW (lpString1=".asp", lpString2="") returned 1 [0102.665] lstrlenW (lpString=".aspx") returned 5 [0102.665] lstrcmpiW (lpString1=".aspx", lpString2="") returned 1 [0102.665] lstrlenW (lpString=".asr") returned 4 [0102.665] lstrcmpiW (lpString1=".asr", lpString2="") returned 1 [0102.665] lstrlenW (lpString=".asx") returned 4 [0102.665] lstrcmpiW (lpString1=".asx", lpString2="") returned 1 [0102.665] lstrlenW (lpString=".avi") returned 4 [0102.665] lstrcmpiW (lpString1=".avi", lpString2="") returned 1 [0102.665] lstrlenW (lpString=".avs") returned 4 [0102.665] lstrcmpiW (lpString1=".avs", lpString2="") returned 1 [0102.665] lstrlenW (lpString=".backup") returned 7 [0102.665] lstrcmpiW (lpString1=".backup", lpString2="") returned 1 [0102.665] lstrlenW (lpString=".bak") returned 4 [0102.665] lstrcmpiW (lpString1=".bak", lpString2="") returned 1 [0102.665] lstrlenW (lpString=".bay") returned 4 [0102.665] lstrcmpiW (lpString1=".bay", lpString2="") returned 1 [0102.665] lstrlenW (lpString=".bd") returned 3 [0102.665] lstrcmpiW (lpString1=".bd", lpString2="BCD") returned -1 [0102.665] lstrlenW (lpString=".bin") returned 4 [0102.665] lstrcmpiW (lpString1=".bin", lpString2="") returned 1 [0102.665] lstrlenW (lpString=".bmp") returned 4 [0102.665] lstrcmpiW (lpString1=".bmp", lpString2="") returned 1 [0102.665] lstrlenW (lpString=".bz2") returned 4 [0102.665] lstrcmpiW (lpString1=".bz2", lpString2="") returned 1 [0102.665] lstrlenW (lpString=".c") returned 2 [0102.665] lstrcmpiW (lpString1=".c", lpString2="CD") returned -1 [0102.665] lstrlenW (lpString=".cdr") returned 4 [0102.665] lstrcmpiW (lpString1=".cdr", lpString2="") returned 1 [0102.665] lstrlenW (lpString=".cer") returned 4 [0102.665] lstrcmpiW (lpString1=".cer", lpString2="") returned 1 [0102.665] lstrlenW (lpString=".cf") returned 3 [0102.665] lstrcmpiW (lpString1=".cf", lpString2="BCD") returned -1 [0102.665] lstrlenW (lpString=".cfc") returned 4 [0102.665] lstrcmpiW (lpString1=".cfc", lpString2="") returned 1 [0102.665] lstrlenW (lpString=".cfm") returned 4 [0102.665] lstrcmpiW (lpString1=".cfm", lpString2="") returned 1 [0102.665] lstrlenW (lpString=".cfml") returned 5 [0102.665] lstrcmpiW (lpString1=".cfml", lpString2="") returned 1 [0102.665] lstrlenW (lpString=".cfu") returned 4 [0102.665] lstrcmpiW (lpString1=".cfu", lpString2="") returned 1 [0102.665] lstrlenW (lpString=".chm") returned 4 [0102.665] lstrcmpiW (lpString1=".chm", lpString2="") returned 1 [0102.665] lstrlenW (lpString=".cin") returned 4 [0102.665] lstrcmpiW (lpString1=".cin", lpString2="") returned 1 [0102.665] lstrlenW (lpString=".class") returned 6 [0102.665] lstrcmpiW (lpString1=".class", lpString2="") returned 1 [0102.665] lstrlenW (lpString=".clx") returned 4 [0102.666] lstrcmpiW (lpString1=".clx", lpString2="") returned 1 [0102.666] lstrlenW (lpString=".config") returned 7 [0102.666] lstrcmpiW (lpString1=".config", lpString2="") returned 1 [0102.666] lstrlenW (lpString=".cpp") returned 4 [0102.666] lstrcmpiW (lpString1=".cpp", lpString2="") returned 1 [0102.666] lstrlenW (lpString=".cr2") returned 4 [0102.666] lstrcmpiW (lpString1=".cr2", lpString2="") returned 1 [0102.666] lstrlenW (lpString=".crt") returned 4 [0102.666] lstrcmpiW (lpString1=".crt", lpString2="") returned 1 [0102.666] lstrlenW (lpString=".crw") returned 4 [0102.666] lstrcmpiW (lpString1=".crw", lpString2="") returned 1 [0102.666] lstrlenW (lpString=".cs") returned 3 [0102.666] lstrcmpiW (lpString1=".cs", lpString2="BCD") returned -1 [0102.666] lstrlenW (lpString=".css") returned 4 [0102.666] lstrcmpiW (lpString1=".css", lpString2="") returned 1 [0102.666] lstrlenW (lpString=".csv") returned 4 [0102.666] lstrcmpiW (lpString1=".csv", lpString2="") returned 1 [0102.666] lstrlenW (lpString=".cub") returned 4 [0102.666] lstrcmpiW (lpString1=".cub", lpString2="") returned 1 [0102.666] lstrlenW (lpString=".dae") returned 4 [0102.666] lstrcmpiW (lpString1=".dae", lpString2="") returned 1 [0102.666] lstrlenW (lpString=".dat") returned 4 [0102.666] lstrcmpiW (lpString1=".dat", lpString2="") returned 1 [0102.666] lstrlenW (lpString=".db") returned 3 [0102.666] lstrcmpiW (lpString1=".db", lpString2="BCD") returned -1 [0102.666] lstrlenW (lpString=".dbf") returned 4 [0102.666] lstrcmpiW (lpString1=".dbf", lpString2="") returned 1 [0102.666] lstrlenW (lpString=".dbx") returned 4 [0102.666] lstrcmpiW (lpString1=".dbx", lpString2="") returned 1 [0102.666] lstrlenW (lpString=".dc3") returned 4 [0102.666] lstrcmpiW (lpString1=".dc3", lpString2="") returned 1 [0102.666] lstrlenW (lpString=".dcm") returned 4 [0102.666] lstrcmpiW (lpString1=".dcm", lpString2="") returned 1 [0102.666] lstrlenW (lpString=".dcr") returned 4 [0102.666] lstrcmpiW (lpString1=".dcr", lpString2="") returned 1 [0102.666] lstrlenW (lpString=".der") returned 4 [0102.666] lstrcmpiW (lpString1=".der", lpString2="") returned 1 [0102.666] lstrlenW (lpString=".dib") returned 4 [0102.666] lstrcmpiW (lpString1=".dib", lpString2="") returned 1 [0102.666] lstrlenW (lpString=".dic") returned 4 [0102.666] lstrcmpiW (lpString1=".dic", lpString2="") returned 1 [0102.666] lstrlenW (lpString=".dif") returned 4 [0102.666] lstrcmpiW (lpString1=".dif", lpString2="") returned 1 [0102.666] lstrlenW (lpString=".divx") returned 5 [0102.666] lstrcmpiW (lpString1=".divx", lpString2="") returned 1 [0102.667] lstrlenW (lpString=".djvu") returned 5 [0102.667] lstrcmpiW (lpString1=".djvu", lpString2="") returned 1 [0102.667] lstrlenW (lpString=".dng") returned 4 [0102.667] lstrcmpiW (lpString1=".dng", lpString2="") returned 1 [0102.667] lstrlenW (lpString=".doc") returned 4 [0102.667] lstrcmpiW (lpString1=".doc", lpString2="") returned 1 [0102.667] lstrlenW (lpString=".docm") returned 5 [0102.667] lstrcmpiW (lpString1=".docm", lpString2="") returned 1 [0102.667] lstrlenW (lpString=".docx") returned 5 [0102.667] lstrcmpiW (lpString1=".docx", lpString2="") returned 1 [0102.667] lstrlenW (lpString=".dot") returned 4 [0102.667] lstrcmpiW (lpString1=".dot", lpString2="") returned 1 [0102.667] lstrlenW (lpString=".dotm") returned 5 [0102.667] lstrcmpiW (lpString1=".dotm", lpString2="") returned 1 [0102.667] lstrlenW (lpString=".dotx") returned 5 [0102.667] lstrcmpiW (lpString1=".dotx", lpString2="") returned 1 [0102.667] lstrlenW (lpString=".dpx") returned 4 [0102.667] lstrcmpiW (lpString1=".dpx", lpString2="") returned 1 [0102.667] lstrlenW (lpString=".dqy") returned 4 [0102.667] lstrcmpiW (lpString1=".dqy", lpString2="") returned 1 [0102.667] lstrlenW (lpString=".dsn") returned 4 [0102.667] lstrcmpiW (lpString1=".dsn", lpString2="") returned 1 [0102.667] lstrlenW (lpString=".dt") returned 3 [0102.667] lstrcmpiW (lpString1=".dt", lpString2="BCD") returned -1 [0102.667] lstrlenW (lpString=".dtd") returned 4 [0102.667] lstrcmpiW (lpString1=".dtd", lpString2="") returned 1 [0102.667] lstrlenW (lpString=".dwg") returned 4 [0102.667] lstrcmpiW (lpString1=".dwg", lpString2="") returned 1 [0102.667] lstrlenW (lpString=".dwt") returned 4 [0102.667] lstrcmpiW (lpString1=".dwt", lpString2="") returned 1 [0102.667] lstrlenW (lpString=".dx") returned 3 [0102.667] lstrcmpiW (lpString1=".dx", lpString2="BCD") returned -1 [0102.667] lstrlenW (lpString=".dxf") returned 4 [0102.667] lstrcmpiW (lpString1=".dxf", lpString2="") returned 1 [0102.667] lstrlenW (lpString=".edml") returned 5 [0102.667] lstrcmpiW (lpString1=".edml", lpString2="") returned 1 [0102.667] lstrlenW (lpString=".efd") returned 4 [0102.667] lstrcmpiW (lpString1=".efd", lpString2="") returned 1 [0102.667] lstrlenW (lpString=".elf") returned 4 [0102.667] lstrcmpiW (lpString1=".elf", lpString2="") returned 1 [0102.667] lstrlenW (lpString=".emf") returned 4 [0102.667] lstrcmpiW (lpString1=".emf", lpString2="") returned 1 [0102.667] lstrlenW (lpString=".emz") returned 4 [0102.667] lstrcmpiW (lpString1=".emz", lpString2="") returned 1 [0102.667] lstrlenW (lpString=".epf") returned 4 [0102.667] lstrcmpiW (lpString1=".epf", lpString2="") returned 1 [0102.667] lstrlenW (lpString=".eps") returned 4 [0102.667] lstrcmpiW (lpString1=".eps", lpString2="") returned 1 [0102.667] lstrlenW (lpString=".epsf") returned 5 [0102.667] lstrcmpiW (lpString1=".epsf", lpString2="") returned 1 [0102.667] lstrlenW (lpString=".epsp") returned 5 [0102.667] lstrcmpiW (lpString1=".epsp", lpString2="") returned 1 [0102.667] lstrlenW (lpString=".erf") returned 4 [0102.667] lstrcmpiW (lpString1=".erf", lpString2="") returned 1 [0102.668] lstrlenW (lpString=".exr") returned 4 [0102.668] lstrcmpiW (lpString1=".exr", lpString2="") returned 1 [0102.668] lstrlenW (lpString=".f4v") returned 4 [0102.668] lstrcmpiW (lpString1=".f4v", lpString2="") returned 1 [0102.668] lstrlenW (lpString=".fido") returned 5 [0102.668] lstrcmpiW (lpString1=".fido", lpString2="") returned 1 [0102.668] lstrlenW (lpString=".flm") returned 4 [0102.668] lstrcmpiW (lpString1=".flm", lpString2="") returned 1 [0102.668] lstrlenW (lpString=".flv") returned 4 [0102.668] lstrcmpiW (lpString1=".flv", lpString2="") returned 1 [0102.668] lstrlenW (lpString=".frm") returned 4 [0102.668] lstrcmpiW (lpString1=".frm", lpString2="") returned 1 [0102.668] lstrlenW (lpString=".fxg") returned 4 [0102.668] lstrcmpiW (lpString1=".fxg", lpString2="") returned 1 [0102.669] FindNextFileW (in: hFindFile=0x8b5928, lpFindFileData=0x3bdf3a8 | out: lpFindFileData=0x3bdf3a8) returned 1 [0102.669] FindNextFileW (in: hFindFile=0x8b5928, lpFindFileData=0x3bdf3a8 | out: lpFindFileData=0x3bdf3a8) returned 1 [0114.788] FindNextFileW (in: hFindFile=0x44712b8, lpFindFileData=0x3bde73c | out: lpFindFileData=0x3bde73c) returned 1 [0114.788] FindNextFileW (in: hFindFile=0x44712b8, lpFindFileData=0x3bde73c | out: lpFindFileData=0x3bde73c) returned 1 Thread: id = 36 os_tid = 0xbc8 Process: id = "3" image_name = "cmd.exe" filename = "c:\\windows\\system32\\cmd.exe" page_root = "0x39610000" os_pid = "0xb74" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "2" os_parent_pid = "0xb58" cmd_line = "\"C:\\Windows\\system32\\cmd.exe\"" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f065" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 374 start_va = 0x10000 end_va = 0x2ffff entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 375 start_va = 0x30000 end_va = 0x33fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 376 start_va = 0x40000 end_va = 0x40fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 377 start_va = 0x70000 end_va = 0x16ffff entry_point = 0x0 region_type = private name = "private_0x0000000000070000" filename = "" Region: id = 378 start_va = 0x4aaf0000 end_va = 0x4ab48fff entry_point = 0x4aaf0000 region_type = mapped_file name = "cmd.exe" filename = "\\Windows\\System32\\cmd.exe" (normalized: "c:\\windows\\system32\\cmd.exe") Region: id = 379 start_va = 0x778d0000 end_va = 0x77a78fff entry_point = 0x778d0000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 380 start_va = 0x7efe0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 381 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 382 start_va = 0x7fff5000 end_va = 0x7fff5fff entry_point = 0x0 region_type = private name = "private_0x000000007fff5000" filename = "" Region: id = 383 start_va = 0x7feffbf0000 end_va = 0x7feffbf0fff entry_point = 0x7feffbf0000 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 384 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 385 start_va = 0x7fffffdd000 end_va = 0x7fffffdefff entry_point = 0x0 region_type = private name = "private_0x000007fffffdd000" filename = "" Region: id = 386 start_va = 0x7fffffdf000 end_va = 0x7fffffdffff entry_point = 0x0 region_type = private name = "private_0x000007fffffdf000" filename = "" Region: id = 463 start_va = 0x360000 end_va = 0x45ffff entry_point = 0x0 region_type = private name = "private_0x0000000000360000" filename = "" Region: id = 464 start_va = 0x777b0000 end_va = 0x778cefff entry_point = 0x777b0000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 465 start_va = 0x7fefd8d0000 end_va = 0x7fefd93afff entry_point = 0x7fefd8d0000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 797 start_va = 0x10000 end_va = 0x1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 798 start_va = 0x20000 end_va = 0x2ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000020000" filename = "" Region: id = 799 start_va = 0x170000 end_va = 0x1d6fff entry_point = 0x170000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 800 start_va = 0x7efe0000 end_va = 0x7f0dffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 801 start_va = 0x7f0e0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 802 start_va = 0x7fefe170000 end_va = 0x7fefe20efff entry_point = 0x7fefe170000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 803 start_va = 0x776b0000 end_va = 0x777a9fff entry_point = 0x776b0000 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 804 start_va = 0x7fef8350000 end_va = 0x7fef8357fff entry_point = 0x7fef8350000 region_type = mapped_file name = "winbrand.dll" filename = "\\Windows\\System32\\winbrand.dll" (normalized: "c:\\windows\\system32\\winbrand.dll") Region: id = 805 start_va = 0x7fefdec0000 end_va = 0x7fefdecdfff entry_point = 0x7fefdec0000 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 806 start_va = 0x7fefe100000 end_va = 0x7fefe166fff entry_point = 0x7fefe100000 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 807 start_va = 0x7fefe320000 end_va = 0x7fefe3e8fff entry_point = 0x7fefe320000 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 870 start_va = 0x1e0000 end_va = 0x2dffff entry_point = 0x0 region_type = private name = "private_0x00000000001e0000" filename = "" Region: id = 871 start_va = 0x5e0000 end_va = 0x5effff entry_point = 0x0 region_type = private name = "private_0x00000000005e0000" filename = "" Region: id = 872 start_va = 0x5f0000 end_va = 0x777fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005f0000" filename = "" Region: id = 873 start_va = 0x7fefdfb0000 end_va = 0x7fefdfddfff entry_point = 0x7fefdfb0000 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 874 start_va = 0x7fefe210000 end_va = 0x7fefe318fff entry_point = 0x7fefe210000 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 875 start_va = 0x50000 end_va = 0x56fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000050000" filename = "" Region: id = 876 start_va = 0x60000 end_va = 0x61fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000060000" filename = "" Region: id = 877 start_va = 0x2e0000 end_va = 0x2e0fff entry_point = 0x0 region_type = private name = "private_0x00000000002e0000" filename = "" Region: id = 878 start_va = 0x2f0000 end_va = 0x2f0fff entry_point = 0x0 region_type = private name = "private_0x00000000002f0000" filename = "" Region: id = 879 start_va = 0x780000 end_va = 0x900fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000780000" filename = "" Region: id = 880 start_va = 0x910000 end_va = 0x1d0ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000910000" filename = "" Region: id = 881 start_va = 0x1d10000 end_va = 0x2052fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001d10000" filename = "" Region: id = 882 start_va = 0x460000 end_va = 0x527fff entry_point = 0x460000 region_type = mapped_file name = "basebrd.dll" filename = "\\Windows\\Branding\\Basebrd\\basebrd.dll" (normalized: "c:\\windows\\branding\\basebrd\\basebrd.dll") Region: id = 883 start_va = 0x460000 end_va = 0x527fff entry_point = 0x460000 region_type = mapped_file name = "basebrd.dll" filename = "\\Windows\\Branding\\Basebrd\\basebrd.dll" (normalized: "c:\\windows\\branding\\basebrd\\basebrd.dll") Region: id = 884 start_va = 0x2060000 end_va = 0x2452fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000002060000" filename = "" Region: id = 885 start_va = 0x2460000 end_va = 0x272efff entry_point = 0x2460000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 1047 start_va = 0x300000 end_va = 0x310fff entry_point = 0x300000 region_type = mapped_file name = "c_1251.nls" filename = "\\Windows\\System32\\C_1251.NLS" (normalized: "c:\\windows\\system32\\c_1251.nls") Thread: id = 20 os_tid = 0xb78 [0108.038] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x16fd90 | out: lpSystemTimeAsFileTime=0x16fd90*(dwLowDateTime=0x8ce8cb20, dwHighDateTime=0x1d461c1)) [0108.038] GetCurrentProcessId () returned 0xb74 [0108.038] GetCurrentThreadId () returned 0xb78 [0108.038] GetTickCount () returned 0x28ab1 [0108.038] QueryPerformanceCounter (in: lpPerformanceCount=0x16fd98 | out: lpPerformanceCount=0x16fd98*=17807796514) returned 1 [0108.039] GetModuleHandleW (lpModuleName=0x0) returned 0x4aaf0000 [0108.039] __set_app_type (_Type=0x1) [0108.039] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x4ab17810) returned 0x0 [0108.039] __getmainargs (in: _Argc=0x4ab3a608, _Argv=0x4ab3a618, _Env=0x4ab3a610, _DoWildCard=0, _StartInfo=0x4ab1e0f4 | out: _Argc=0x4ab3a608, _Argv=0x4ab3a618, _Env=0x4ab3a610) returned 0 [0108.039] GetCurrentThreadId () returned 0xb78 [0108.039] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0xb78) returned 0x3c [0108.040] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x777b0000 [0108.040] GetProcAddress (hModule=0x777b0000, lpProcName="SetThreadUILanguage") returned 0x777c6d40 [0108.040] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0108.040] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0108.040] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x16fd28 | out: phkResult=0x16fd28*=0x0) returned 0x2 [0108.040] VirtualQuery (in: lpAddress=0x16fd10, lpBuffer=0x16fc90, dwLength=0x30 | out: lpBuffer=0x16fc90*(BaseAddress=0x16f000, AllocationBase=0x70000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0108.040] VirtualQuery (in: lpAddress=0x70000, lpBuffer=0x16fc90, dwLength=0x30 | out: lpBuffer=0x16fc90*(BaseAddress=0x70000, AllocationBase=0x70000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000, __alignment2=0x0)) returned 0x30 [0108.040] VirtualQuery (in: lpAddress=0x71000, lpBuffer=0x16fc90, dwLength=0x30 | out: lpBuffer=0x16fc90*(BaseAddress=0x71000, AllocationBase=0x70000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x3000, State=0x1000, Protect=0x104, Type=0x20000, __alignment2=0x0)) returned 0x30 [0108.040] VirtualQuery (in: lpAddress=0x74000, lpBuffer=0x16fc90, dwLength=0x30 | out: lpBuffer=0x16fc90*(BaseAddress=0x74000, AllocationBase=0x70000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0xfc000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0108.040] VirtualQuery (in: lpAddress=0x170000, lpBuffer=0x16fc90, dwLength=0x30 | out: lpBuffer=0x16fc90*(BaseAddress=0x170000, AllocationBase=0x170000, AllocationProtect=0x2, __alignment1=0x0, RegionSize=0x67000, State=0x1000, Protect=0x2, Type=0x40000, __alignment2=0x0)) returned 0x30 [0108.040] GetConsoleOutputCP () returned 0x1b5 [0108.040] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4ab2bfe0 | out: lpCPInfo=0x4ab2bfe0) returned 1 [0108.040] SetConsoleCtrlHandler (HandlerRoutine=0x4ab13184, Add=1) returned 1 [0108.041] _get_osfhandle (_FileHandle=1) returned 0xf4 [0108.041] SetConsoleMode (hConsoleHandle=0xf4, dwMode=0x0) returned 0 [0108.041] _get_osfhandle (_FileHandle=1) returned 0xf4 [0108.041] GetConsoleMode (in: hConsoleHandle=0xf4, lpMode=0x4ab1e194 | out: lpMode=0x4ab1e194) returned 0 [0108.041] _get_osfhandle (_FileHandle=0) returned 0xe8 [0108.041] GetConsoleMode (in: hConsoleHandle=0xe8, lpMode=0x4ab1e198 | out: lpMode=0x4ab1e198) returned 0 [0108.041] GetEnvironmentStringsW () returned 0x378a60* [0108.041] FreeEnvironmentStringsW (penv=0x378a60) returned 1 [0108.041] GetEnvironmentStringsW () returned 0x378a60* [0108.041] FreeEnvironmentStringsW (penv=0x378a60) returned 1 [0108.041] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x16ebe8 | out: phkResult=0x16ebe8*=0x44) returned 0x0 [0108.041] RegQueryValueExW (in: hKey=0x44, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x16ebe0, lpData=0x16ec00, lpcbData=0x16ebe4*=0x1000 | out: lpType=0x16ebe0*=0x0, lpData=0x16ec00*=0x18, lpcbData=0x16ebe4*=0x1000) returned 0x2 [0108.041] RegQueryValueExW (in: hKey=0x44, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x16ebe0, lpData=0x16ec00, lpcbData=0x16ebe4*=0x1000 | out: lpType=0x16ebe0*=0x4, lpData=0x16ec00*=0x1, lpcbData=0x16ebe4*=0x4) returned 0x0 [0108.041] RegQueryValueExW (in: hKey=0x44, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x16ebe0, lpData=0x16ec00, lpcbData=0x16ebe4*=0x1000 | out: lpType=0x16ebe0*=0x0, lpData=0x16ec00*=0x1, lpcbData=0x16ebe4*=0x1000) returned 0x2 [0108.041] RegQueryValueExW (in: hKey=0x44, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x16ebe0, lpData=0x16ec00, lpcbData=0x16ebe4*=0x1000 | out: lpType=0x16ebe0*=0x4, lpData=0x16ec00*=0x0, lpcbData=0x16ebe4*=0x4) returned 0x0 [0108.041] RegQueryValueExW (in: hKey=0x44, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x16ebe0, lpData=0x16ec00, lpcbData=0x16ebe4*=0x1000 | out: lpType=0x16ebe0*=0x4, lpData=0x16ec00*=0x40, lpcbData=0x16ebe4*=0x4) returned 0x0 [0108.042] RegQueryValueExW (in: hKey=0x44, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x16ebe0, lpData=0x16ec00, lpcbData=0x16ebe4*=0x1000 | out: lpType=0x16ebe0*=0x4, lpData=0x16ec00*=0x40, lpcbData=0x16ebe4*=0x4) returned 0x0 [0108.042] RegQueryValueExW (in: hKey=0x44, lpValueName="AutoRun", lpReserved=0x0, lpType=0x16ebe0, lpData=0x16ec00, lpcbData=0x16ebe4*=0x1000 | out: lpType=0x16ebe0*=0x0, lpData=0x16ec00*=0x40, lpcbData=0x16ebe4*=0x1000) returned 0x2 [0108.042] RegCloseKey (hKey=0x44) returned 0x0 [0108.042] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x16ebe8 | out: phkResult=0x16ebe8*=0x44) returned 0x0 [0108.042] RegQueryValueExW (in: hKey=0x44, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x16ebe0, lpData=0x16ec00, lpcbData=0x16ebe4*=0x1000 | out: lpType=0x16ebe0*=0x0, lpData=0x16ec00*=0x40, lpcbData=0x16ebe4*=0x1000) returned 0x2 [0108.042] RegQueryValueExW (in: hKey=0x44, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x16ebe0, lpData=0x16ec00, lpcbData=0x16ebe4*=0x1000 | out: lpType=0x16ebe0*=0x4, lpData=0x16ec00*=0x1, lpcbData=0x16ebe4*=0x4) returned 0x0 [0108.042] RegQueryValueExW (in: hKey=0x44, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x16ebe0, lpData=0x16ec00, lpcbData=0x16ebe4*=0x1000 | out: lpType=0x16ebe0*=0x0, lpData=0x16ec00*=0x1, lpcbData=0x16ebe4*=0x1000) returned 0x2 [0108.042] RegQueryValueExW (in: hKey=0x44, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x16ebe0, lpData=0x16ec00, lpcbData=0x16ebe4*=0x1000 | out: lpType=0x16ebe0*=0x4, lpData=0x16ec00*=0x0, lpcbData=0x16ebe4*=0x4) returned 0x0 [0108.042] RegQueryValueExW (in: hKey=0x44, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x16ebe0, lpData=0x16ec00, lpcbData=0x16ebe4*=0x1000 | out: lpType=0x16ebe0*=0x4, lpData=0x16ec00*=0x9, lpcbData=0x16ebe4*=0x4) returned 0x0 [0108.042] RegQueryValueExW (in: hKey=0x44, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x16ebe0, lpData=0x16ec00, lpcbData=0x16ebe4*=0x1000 | out: lpType=0x16ebe0*=0x4, lpData=0x16ec00*=0x9, lpcbData=0x16ebe4*=0x4) returned 0x0 [0108.042] RegQueryValueExW (in: hKey=0x44, lpValueName="AutoRun", lpReserved=0x0, lpType=0x16ebe0, lpData=0x16ec00, lpcbData=0x16ebe4*=0x1000 | out: lpType=0x16ebe0*=0x0, lpData=0x16ec00*=0x9, lpcbData=0x16ebe4*=0x1000) returned 0x2 [0108.042] RegCloseKey (hKey=0x44) returned 0x0 [0108.042] time (in: timer=0x0 | out: timer=0x0) returned 0x5bbfe916 [0108.042] srand (_Seed=0x5bbfe916) [0108.042] GetCommandLineW () returned="\"C:\\Windows\\system32\\cmd.exe\"" [0108.042] GetCommandLineW () returned="\"C:\\Windows\\system32\\cmd.exe\"" [0108.042] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4ab2c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0108.042] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x37aa20, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\cmd.exe" (normalized: "c:\\windows\\system32\\cmd.exe")) returned 0x1b [0108.042] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4ab1f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0108.042] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4ab1f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0108.042] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4ab1f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0108.042] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13 [0108.042] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11 [0108.042] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13 [0108.042] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13 [0108.042] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12 [0108.042] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4 [0108.042] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2 [0108.043] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8 [0108.043] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1 [0108.043] GetEnvironmentStringsW () returned 0x378a60* [0108.043] FreeEnvironmentStringsW (penv=0x378a60) returned 1 [0108.043] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x4ab1f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0108.043] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x4ab1f360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0108.043] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0108.043] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0108.043] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0108.043] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0108.043] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0108.043] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0108.043] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0108.043] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0108.043] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x16f9f0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0108.043] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", nBufferLength=0x104, lpBuffer=0x16f9f0, lpFilePart=0x16f9d0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x16f9d0*="Desktop") returned 0x25 [0108.043] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0108.043] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x16f700 | out: lpFindFileData=0x16f700) returned 0x37b740 [0108.043] FindClose (in: hFindFile=0x37b740 | out: hFindFile=0x37b740) returned 1 [0108.043] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz", lpFindFileData=0x16f700 | out: lpFindFileData=0x16f700) returned 0x37b740 [0108.043] FindClose (in: hFindFile=0x37b740 | out: hFindFile=0x37b740) returned 1 [0108.043] _wcsnicmp (_String1="5P5NRG~1", _String2="5p5NrGJn0jS HALPmcxz", _MaxCount=0x14) returned 20 [0108.044] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFindFileData=0x16f700 | out: lpFindFileData=0x16f700) returned 0x37b740 [0108.044] FindClose (in: hFindFile=0x37b740 | out: hFindFile=0x37b740) returned 1 [0108.044] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0108.044] SetCurrentDirectoryW (lpPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 1 [0108.044] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 1 [0108.044] GetEnvironmentStringsW () returned 0x37b740* [0108.044] FreeEnvironmentStringsW (penv=0x37b740) returned 1 [0108.044] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4ab2c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0108.044] GetConsoleOutputCP () returned 0x1b5 [0108.044] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4ab2bfe0 | out: lpCPInfo=0x4ab2bfe0) returned 1 [0108.044] GetUserDefaultLCID () returned 0x409 [0108.045] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x4ab27b50, cchData=8 | out: lpLCData=":") returned 2 [0108.045] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x16fb00, cchData=128 | out: lpLCData="0") returned 2 [0108.045] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x16fb00, cchData=128 | out: lpLCData="0") returned 2 [0108.045] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x16fb00, cchData=128 | out: lpLCData="1") returned 2 [0108.045] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x4ab3a740, cchData=8 | out: lpLCData="/") returned 2 [0108.045] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x4ab3a4a0, cchData=32 | out: lpLCData="Mon") returned 4 [0108.045] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x4ab3a460, cchData=32 | out: lpLCData="Tue") returned 4 [0108.045] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x4ab3a420, cchData=32 | out: lpLCData="Wed") returned 4 [0108.045] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x4ab3a3e0, cchData=32 | out: lpLCData="Thu") returned 4 [0108.045] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x4ab3a3a0, cchData=32 | out: lpLCData="Fri") returned 4 [0108.045] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x4ab3a360, cchData=32 | out: lpLCData="Sat") returned 4 [0108.045] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x4ab3a700, cchData=32 | out: lpLCData="Sun") returned 4 [0108.045] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x4ab27b40, cchData=8 | out: lpLCData=".") returned 2 [0108.045] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x4ab3a4e0, cchData=8 | out: lpLCData=",") returned 2 [0108.045] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0108.046] GetConsoleTitleW (in: lpConsoleTitle=0x3795c0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0108.046] _get_osfhandle (_FileHandle=1) returned 0xf4 [0108.046] GetFileType (hFile=0xf4) returned 0x3 [0108.046] BrandingFormatString () returned 0x3797e0 [0108.145] GetVersion () returned 0x1db10106 [0108.145] _vsnwprintf (in: _Buffer=0x16fc70, _BufferCount=0x1f, _Format="%d.%d.%04d", _ArgList=0x16fc08 | out: _Buffer="6.1.7601") returned 8 [0108.145] _get_osfhandle (_FileHandle=1) returned 0xf4 [0108.145] GetFileType (hFile=0xf4) returned 0x3 [0108.145] FormatMessageW (in: dwFlags=0x1a00, lpSource=0x0, dwMessageId=0x2350, dwLanguageId=0x0, lpBuffer=0x4ab36340, nSize=0x2000, Arguments=0x0 | out: lpBuffer="Microsoft Windows [Version %1]") returned 0x1e [0108.146] FormatMessageW (in: dwFlags=0x1800, lpSource=0x0, dwMessageId=0x2350, dwLanguageId=0x0, lpBuffer=0x4ab36340, nSize=0x2000, Arguments=0x16fc10 | out: lpBuffer="Microsoft Windows [Version 6.1.7601]") returned 0x24 [0108.146] _get_osfhandle (_FileHandle=1) returned 0xf4 [0108.146] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Microsoft Windows [Version 6.1.7601]", cchWideChar=-1, lpMultiByteStr=0x4ab2c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Microsoft Windows [Version 6.1.7601]", lpUsedDefaultChar=0x0) returned 37 [0108.146] WriteFile (in: hFile=0xf4, lpBuffer=0x4ab2c320*, nNumberOfBytesToWrite=0x24, lpNumberOfBytesWritten=0x16fb98, lpOverlapped=0x0 | out: lpBuffer=0x4ab2c320*, lpNumberOfBytesWritten=0x16fb98*=0x24, lpOverlapped=0x0) returned 1 [0108.146] _vsnwprintf (in: _Buffer=0x4ab36340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x16fc38 | out: _Buffer="\r\n") returned 2 [0108.146] _get_osfhandle (_FileHandle=1) returned 0xf4 [0108.146] GetFileType (hFile=0xf4) returned 0x3 [0108.146] _get_osfhandle (_FileHandle=1) returned 0xf4 [0108.146] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4ab2c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0108.146] WriteFile (in: hFile=0xf4, lpBuffer=0x4ab2c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x16fc08, lpOverlapped=0x0 | out: lpBuffer=0x4ab2c320*, lpNumberOfBytesWritten=0x16fc08*=0x2, lpOverlapped=0x0) returned 1 [0108.146] _vsnwprintf (in: _Buffer=0x4ab36340, _BufferCount=0x1fff, _Format="%s", _ArgList=0x16fc38 | out: _Buffer="Copyright (c) 2009 Microsoft Corporation. All rights reserved.") returned 63 [0108.146] _get_osfhandle (_FileHandle=1) returned 0xf4 [0108.146] GetFileType (hFile=0xf4) returned 0x3 [0108.146] _get_osfhandle (_FileHandle=1) returned 0xf4 [0108.146] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Copyright (c) 2009 Microsoft Corporation. All rights reserved.", cchWideChar=-1, lpMultiByteStr=0x4ab2c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Copyright (c) 2009 Microsoft Corporation. All rights reserved.", lpUsedDefaultChar=0x0) returned 64 [0108.146] WriteFile (in: hFile=0xf4, lpBuffer=0x4ab2c320*, nNumberOfBytesToWrite=0x3f, lpNumberOfBytesWritten=0x16fc08, lpOverlapped=0x0 | out: lpBuffer=0x4ab2c320*, lpNumberOfBytesWritten=0x16fc08*=0x3f, lpOverlapped=0x0) returned 1 [0108.146] _vsnwprintf (in: _Buffer=0x4ab36340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x16fc38 | out: _Buffer="\r\n") returned 2 [0108.146] _get_osfhandle (_FileHandle=1) returned 0xf4 [0108.146] GetFileType (hFile=0xf4) returned 0x3 [0108.146] _get_osfhandle (_FileHandle=1) returned 0xf4 [0108.146] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4ab2c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0108.146] WriteFile (in: hFile=0xf4, lpBuffer=0x4ab2c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x16fc08, lpOverlapped=0x0 | out: lpBuffer=0x4ab2c320*, lpNumberOfBytesWritten=0x16fc08*=0x2, lpOverlapped=0x0) returned 1 [0108.146] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x777b0000 [0108.146] GetProcAddress (hModule=0x777b0000, lpProcName="CopyFileExW") returned 0x777c23d0 [0108.146] GetProcAddress (hModule=0x777b0000, lpProcName="IsDebuggerPresent") returned 0x777b8290 [0108.146] GetProcAddress (hModule=0x777b0000, lpProcName="SetConsoleInputExeNameW") returned 0x777c17e0 [0108.146] _get_osfhandle (_FileHandle=0) returned 0xe8 [0108.146] GetFileType (hFile=0xe8) returned 0x3 [0108.146] _setmode (_FileHandle=0, _Mode=32768) returned 16384 [0108.147] NtOpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x8, OpenAsSelf=0, TokenHandle=0x16fa60 | out: TokenHandle=0x16fa60*=0x0) returned 0xc000007c [0108.147] NtOpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x8, TokenHandle=0x16fa60 | out: TokenHandle=0x16fa60*=0x50) returned 0x0 [0108.147] NtQueryInformationToken (in: TokenHandle=0x50, TokenInformationClass=0x12, TokenInformation=0x16fa70, TokenInformationLength=0x4, ReturnLength=0x16fa78 | out: TokenInformation=0x16fa70, ReturnLength=0x16fa78) returned 0x0 [0108.147] NtQueryInformationToken (in: TokenHandle=0x50, TokenInformationClass=0x1a, TokenInformation=0x16fa78, TokenInformationLength=0x4, ReturnLength=0x16fa70 | out: TokenInformation=0x16fa78, ReturnLength=0x16fa70) returned 0x0 [0108.147] NtClose (Handle=0x50) returned 0x0 [0108.147] FormatMessageW (in: dwFlags=0x1900, lpSource=0x0, dwMessageId=0x40002748, dwLanguageId=0x0, lpBuffer=0x16fa40, nSize=0x0, Arguments=0x16fa48 | out: lpBuffer="\x97e0\x37") returned 0xf [0108.148] GetConsoleTitleW (in: lpConsoleTitle=0x16fa90, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0108.148] wcsstr (_Str="C:\\Windows\\system32\\cmd.exe", _SubStr="Administrator: ") returned 0x0 [0108.148] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0108.149] LocalFree (hMem=0x3797e0) returned 0x0 [0108.149] _vsnwprintf (in: _Buffer=0x4ab36340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x16f778 | out: _Buffer="\r\n") returned 2 [0108.149] _get_osfhandle (_FileHandle=1) returned 0xf4 [0108.149] GetFileType (hFile=0xf4) returned 0x3 [0108.149] _get_osfhandle (_FileHandle=1) returned 0xf4 [0108.149] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4ab2c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0108.149] WriteFile (in: hFile=0xf4, lpBuffer=0x4ab2c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x16f748, lpOverlapped=0x0 | out: lpBuffer=0x4ab2c320*, lpNumberOfBytesWritten=0x16f748*=0x2, lpOverlapped=0x0) returned 1 [0108.149] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4ab1f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0108.149] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4ab2c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0108.149] _vsnwprintf (in: _Buffer=0x4ab1eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x16f788 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0108.149] _vsnwprintf (in: _Buffer=0x4ab1ebaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x16f788 | out: _Buffer=">") returned 1 [0108.149] _get_osfhandle (_FileHandle=1) returned 0xf4 [0108.149] GetFileType (hFile=0xf4) returned 0x3 [0108.149] _get_osfhandle (_FileHandle=1) returned 0xf4 [0108.149] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x4ab2c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39 [0108.149] WriteFile (in: hFile=0xf4, lpBuffer=0x4ab2c320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x16f778, lpOverlapped=0x0 | out: lpBuffer=0x4ab2c320*, lpNumberOfBytesWritten=0x16f778*=0x26, lpOverlapped=0x0) returned 1 [0108.149] _get_osfhandle (_FileHandle=0) returned 0xe8 [0108.150] GetFileType (hFile=0xe8) returned 0x3 [0108.150] _get_osfhandle (_FileHandle=0) returned 0xe8 [0108.150] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0108.150] ReadFile (in: hFile=0xe8, lpBuffer=0x4ab2c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x16fa78, lpOverlapped=0x0 | out: lpBuffer=0x4ab2c320*, lpNumberOfBytesRead=0x16fa78*=0x1, lpOverlapped=0x0) returned 1 [0108.150] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4ab2c320, cbMultiByte=1, lpWideCharStr=0x4ab2e320, cchWideChar=1 | out: lpWideCharStr="m") returned 1 [0108.150] _get_osfhandle (_FileHandle=0) returned 0xe8 [0108.150] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0108.150] ReadFile (in: hFile=0xe8, lpBuffer=0x4ab2c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x16fa78, lpOverlapped=0x0 | out: lpBuffer=0x4ab2c320*, lpNumberOfBytesRead=0x16fa78*=0x1, lpOverlapped=0x0) returned 1 [0108.150] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4ab2c320, cbMultiByte=1, lpWideCharStr=0x4ab2e322, cchWideChar=1 | out: lpWideCharStr="o") returned 1 [0108.150] _get_osfhandle (_FileHandle=0) returned 0xe8 [0108.150] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0108.150] ReadFile (in: hFile=0xe8, lpBuffer=0x4ab2c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x16fa78, lpOverlapped=0x0 | out: lpBuffer=0x4ab2c320*, lpNumberOfBytesRead=0x16fa78*=0x1, lpOverlapped=0x0) returned 1 [0108.150] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4ab2c320, cbMultiByte=1, lpWideCharStr=0x4ab2e324, cchWideChar=1 | out: lpWideCharStr="d") returned 1 [0108.150] _get_osfhandle (_FileHandle=0) returned 0xe8 [0108.150] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0108.150] ReadFile (in: hFile=0xe8, lpBuffer=0x4ab2c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x16fa78, lpOverlapped=0x0 | out: lpBuffer=0x4ab2c320*, lpNumberOfBytesRead=0x16fa78*=0x1, lpOverlapped=0x0) returned 1 [0108.150] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4ab2c320, cbMultiByte=1, lpWideCharStr=0x4ab2e326, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0108.150] _get_osfhandle (_FileHandle=0) returned 0xe8 [0108.150] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0108.150] ReadFile (in: hFile=0xe8, lpBuffer=0x4ab2c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x16fa78, lpOverlapped=0x0 | out: lpBuffer=0x4ab2c320*, lpNumberOfBytesRead=0x16fa78*=0x1, lpOverlapped=0x0) returned 1 [0108.151] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4ab2c320, cbMultiByte=1, lpWideCharStr=0x4ab2e328, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0108.151] _get_osfhandle (_FileHandle=0) returned 0xe8 [0108.151] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0108.151] ReadFile (in: hFile=0xe8, lpBuffer=0x4ab2c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x16fa78, lpOverlapped=0x0 | out: lpBuffer=0x4ab2c320*, lpNumberOfBytesRead=0x16fa78*=0x1, lpOverlapped=0x0) returned 1 [0108.151] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4ab2c320, cbMultiByte=1, lpWideCharStr=0x4ab2e32a, cchWideChar=1 | out: lpWideCharStr="c") returned 1 [0108.151] _get_osfhandle (_FileHandle=0) returned 0xe8 [0108.151] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0108.151] ReadFile (in: hFile=0xe8, lpBuffer=0x4ab2c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x16fa78, lpOverlapped=0x0 | out: lpBuffer=0x4ab2c320*, lpNumberOfBytesRead=0x16fa78*=0x1, lpOverlapped=0x0) returned 1 [0108.151] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4ab2c320, cbMultiByte=1, lpWideCharStr=0x4ab2e32c, cchWideChar=1 | out: lpWideCharStr="o") returned 1 [0108.151] _get_osfhandle (_FileHandle=0) returned 0xe8 [0108.151] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0108.151] ReadFile (in: hFile=0xe8, lpBuffer=0x4ab2c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x16fa78, lpOverlapped=0x0 | out: lpBuffer=0x4ab2c320*, lpNumberOfBytesRead=0x16fa78*=0x1, lpOverlapped=0x0) returned 1 [0108.151] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4ab2c320, cbMultiByte=1, lpWideCharStr=0x4ab2e32e, cchWideChar=1 | out: lpWideCharStr="n") returned 1 [0108.151] _get_osfhandle (_FileHandle=0) returned 0xe8 [0108.151] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0108.151] ReadFile (in: hFile=0xe8, lpBuffer=0x4ab2c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x16fa78, lpOverlapped=0x0 | out: lpBuffer=0x4ab2c320*, lpNumberOfBytesRead=0x16fa78*=0x1, lpOverlapped=0x0) returned 1 [0108.151] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4ab2c320, cbMultiByte=1, lpWideCharStr=0x4ab2e330, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0108.151] _get_osfhandle (_FileHandle=0) returned 0xe8 [0108.151] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0108.151] ReadFile (in: hFile=0xe8, lpBuffer=0x4ab2c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x16fa78, lpOverlapped=0x0 | out: lpBuffer=0x4ab2c320*, lpNumberOfBytesRead=0x16fa78*=0x1, lpOverlapped=0x0) returned 1 [0108.151] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4ab2c320, cbMultiByte=1, lpWideCharStr=0x4ab2e332, cchWideChar=1 | out: lpWideCharStr="c") returned 1 [0108.151] _get_osfhandle (_FileHandle=0) returned 0xe8 [0108.151] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0108.151] ReadFile (in: hFile=0xe8, lpBuffer=0x4ab2c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x16fa78, lpOverlapped=0x0 | out: lpBuffer=0x4ab2c320*, lpNumberOfBytesRead=0x16fa78*=0x1, lpOverlapped=0x0) returned 1 [0108.151] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4ab2c320, cbMultiByte=1, lpWideCharStr=0x4ab2e334, cchWideChar=1 | out: lpWideCharStr="p") returned 1 [0108.151] _get_osfhandle (_FileHandle=0) returned 0xe8 [0108.151] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0108.151] ReadFile (in: hFile=0xe8, lpBuffer=0x4ab2c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x16fa78, lpOverlapped=0x0 | out: lpBuffer=0x4ab2c320*, lpNumberOfBytesRead=0x16fa78*=0x1, lpOverlapped=0x0) returned 1 [0108.151] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4ab2c320, cbMultiByte=1, lpWideCharStr=0x4ab2e336, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0108.151] _get_osfhandle (_FileHandle=0) returned 0xe8 [0108.151] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0108.151] ReadFile (in: hFile=0xe8, lpBuffer=0x4ab2c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x16fa78, lpOverlapped=0x0 | out: lpBuffer=0x4ab2c320*, lpNumberOfBytesRead=0x16fa78*=0x1, lpOverlapped=0x0) returned 1 [0108.151] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4ab2c320, cbMultiByte=1, lpWideCharStr=0x4ab2e338, cchWideChar=1 | out: lpWideCharStr="s") returned 1 [0108.151] _get_osfhandle (_FileHandle=0) returned 0xe8 [0108.151] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0108.151] ReadFile (in: hFile=0xe8, lpBuffer=0x4ab2c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x16fa78, lpOverlapped=0x0 | out: lpBuffer=0x4ab2c320*, lpNumberOfBytesRead=0x16fa78*=0x1, lpOverlapped=0x0) returned 1 [0108.151] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4ab2c320, cbMultiByte=1, lpWideCharStr=0x4ab2e33a, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0108.151] _get_osfhandle (_FileHandle=0) returned 0xe8 [0108.151] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0108.152] ReadFile (in: hFile=0xe8, lpBuffer=0x4ab2c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x16fa78, lpOverlapped=0x0 | out: lpBuffer=0x4ab2c320*, lpNumberOfBytesRead=0x16fa78*=0x1, lpOverlapped=0x0) returned 1 [0108.152] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4ab2c320, cbMultiByte=1, lpWideCharStr=0x4ab2e33c, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0108.152] _get_osfhandle (_FileHandle=0) returned 0xe8 [0108.152] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0108.152] ReadFile (in: hFile=0xe8, lpBuffer=0x4ab2c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x16fa78, lpOverlapped=0x0 | out: lpBuffer=0x4ab2c320*, lpNumberOfBytesRead=0x16fa78*=0x1, lpOverlapped=0x0) returned 1 [0108.152] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4ab2c320, cbMultiByte=1, lpWideCharStr=0x4ab2e33e, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0108.152] _get_osfhandle (_FileHandle=0) returned 0xe8 [0108.152] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0108.152] ReadFile (in: hFile=0xe8, lpBuffer=0x4ab2c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x16fa78, lpOverlapped=0x0 | out: lpBuffer=0x4ab2c320*, lpNumberOfBytesRead=0x16fa78*=0x1, lpOverlapped=0x0) returned 1 [0108.152] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4ab2c320, cbMultiByte=1, lpWideCharStr=0x4ab2e340, cchWideChar=1 | out: lpWideCharStr="c") returned 1 [0108.152] _get_osfhandle (_FileHandle=0) returned 0xe8 [0108.152] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0108.152] ReadFile (in: hFile=0xe8, lpBuffer=0x4ab2c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x16fa78, lpOverlapped=0x0 | out: lpBuffer=0x4ab2c320*, lpNumberOfBytesRead=0x16fa78*=0x1, lpOverlapped=0x0) returned 1 [0108.152] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4ab2c320, cbMultiByte=1, lpWideCharStr=0x4ab2e342, cchWideChar=1 | out: lpWideCharStr="t") returned 1 [0108.152] _get_osfhandle (_FileHandle=0) returned 0xe8 [0108.152] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0108.152] ReadFile (in: hFile=0xe8, lpBuffer=0x4ab2c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x16fa78, lpOverlapped=0x0 | out: lpBuffer=0x4ab2c320*, lpNumberOfBytesRead=0x16fa78*=0x1, lpOverlapped=0x0) returned 1 [0108.152] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4ab2c320, cbMultiByte=1, lpWideCharStr=0x4ab2e344, cchWideChar=1 | out: lpWideCharStr="=") returned 1 [0108.152] _get_osfhandle (_FileHandle=0) returned 0xe8 [0108.152] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0108.152] ReadFile (in: hFile=0xe8, lpBuffer=0x4ab2c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x16fa78, lpOverlapped=0x0 | out: lpBuffer=0x4ab2c320*, lpNumberOfBytesRead=0x16fa78*=0x1, lpOverlapped=0x0) returned 1 [0108.152] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4ab2c320, cbMultiByte=1, lpWideCharStr=0x4ab2e346, cchWideChar=1 | out: lpWideCharStr="1") returned 1 [0108.152] _get_osfhandle (_FileHandle=0) returned 0xe8 [0108.152] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0108.152] ReadFile (in: hFile=0xe8, lpBuffer=0x4ab2c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x16fa78, lpOverlapped=0x0 | out: lpBuffer=0x4ab2c320*, lpNumberOfBytesRead=0x16fa78*=0x1, lpOverlapped=0x0) returned 1 [0108.152] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4ab2c320, cbMultiByte=1, lpWideCharStr=0x4ab2e348, cchWideChar=1 | out: lpWideCharStr="2") returned 1 [0108.152] _get_osfhandle (_FileHandle=0) returned 0xe8 [0108.152] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0108.152] ReadFile (in: hFile=0xe8, lpBuffer=0x4ab2c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x16fa78, lpOverlapped=0x0 | out: lpBuffer=0x4ab2c320*, lpNumberOfBytesRead=0x16fa78*=0x1, lpOverlapped=0x0) returned 1 [0108.152] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4ab2c320, cbMultiByte=1, lpWideCharStr=0x4ab2e34a, cchWideChar=1 | out: lpWideCharStr="5") returned 1 [0108.152] _get_osfhandle (_FileHandle=0) returned 0xe8 [0108.152] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0108.152] ReadFile (in: hFile=0xe8, lpBuffer=0x4ab2c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x16fa78, lpOverlapped=0x0 | out: lpBuffer=0x4ab2c320*, lpNumberOfBytesRead=0x16fa78*=0x1, lpOverlapped=0x0) returned 1 [0108.152] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4ab2c320, cbMultiByte=1, lpWideCharStr=0x4ab2e34c, cchWideChar=1 | out: lpWideCharStr="1") returned 1 [0108.152] _get_osfhandle (_FileHandle=0) returned 0xe8 [0108.152] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0108.152] ReadFile (in: hFile=0xe8, lpBuffer=0x4ab2c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x16fa78, lpOverlapped=0x0 | out: lpBuffer=0x4ab2c320*, lpNumberOfBytesRead=0x16fa78*=0x1, lpOverlapped=0x0) returned 1 [0108.153] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4ab2c320, cbMultiByte=1, lpWideCharStr=0x4ab2e34e, cchWideChar=1 | out: lpWideCharStr="\n") returned 1 [0108.153] _get_osfhandle (_FileHandle=0) returned 0xe8 [0108.153] GetFileType (hFile=0xe8) returned 0x3 [0108.153] _get_osfhandle (_FileHandle=0) returned 0xe8 [0108.153] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0108.153] _get_osfhandle (_FileHandle=1) returned 0xf4 [0108.153] GetFileType (hFile=0xf4) returned 0x3 [0108.153] _get_osfhandle (_FileHandle=1) returned 0xf4 [0108.153] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="mode con cp select=1251\n", cchWideChar=-1, lpMultiByteStr=0x4ab2c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mode con cp select=1251\n", lpUsedDefaultChar=0x0) returned 25 [0108.153] WriteFile (in: hFile=0xf4, lpBuffer=0x4ab2c320*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x16fa58, lpOverlapped=0x0 | out: lpBuffer=0x4ab2c320*, lpNumberOfBytesWritten=0x16fa58*=0x18, lpOverlapped=0x0) returned 1 [0108.153] _wcsicmp (_String1="mode", _String2=")") returned 68 [0108.153] _wcsicmp (_String1="FOR", _String2="mode") returned -7 [0108.153] _wcsicmp (_String1="FOR/?", _String2="mode") returned -7 [0108.153] _wcsicmp (_String1="IF", _String2="mode") returned -4 [0108.153] _wcsicmp (_String1="IF/?", _String2="mode") returned -4 [0108.153] _wcsicmp (_String1="REM", _String2="mode") returned 5 [0108.154] _wcsicmp (_String1="REM/?", _String2="mode") returned 5 [0108.154] GetConsoleOutputCP () returned 0x1b5 [0108.155] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4ab2bfe0 | out: lpCPInfo=0x4ab2bfe0) returned 1 [0108.155] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0108.155] GetConsoleTitleW (in: lpConsoleTitle=0x16fa10, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0108.155] _wcsicmp (_String1="mode", _String2="DIR") returned 9 [0108.155] _wcsicmp (_String1="mode", _String2="ERASE") returned 8 [0108.155] _wcsicmp (_String1="mode", _String2="DEL") returned 9 [0108.155] _wcsicmp (_String1="mode", _String2="TYPE") returned -7 [0108.155] _wcsicmp (_String1="mode", _String2="COPY") returned 10 [0108.155] _wcsicmp (_String1="mode", _String2="CD") returned 10 [0108.155] _wcsicmp (_String1="mode", _String2="CHDIR") returned 10 [0108.155] _wcsicmp (_String1="mode", _String2="RENAME") returned -5 [0108.155] _wcsicmp (_String1="mode", _String2="REN") returned -5 [0108.155] _wcsicmp (_String1="mode", _String2="ECHO") returned 8 [0108.155] _wcsicmp (_String1="mode", _String2="SET") returned -6 [0108.155] _wcsicmp (_String1="mode", _String2="PAUSE") returned -3 [0108.155] _wcsicmp (_String1="mode", _String2="DATE") returned 9 [0108.155] _wcsicmp (_String1="mode", _String2="TIME") returned -7 [0108.155] _wcsicmp (_String1="mode", _String2="PROMPT") returned -3 [0108.155] _wcsicmp (_String1="mode", _String2="MD") returned 11 [0108.155] _wcsicmp (_String1="mode", _String2="MKDIR") returned 4 [0108.155] _wcsicmp (_String1="mode", _String2="RD") returned -5 [0108.155] _wcsicmp (_String1="mode", _String2="RMDIR") returned -5 [0108.155] _wcsicmp (_String1="mode", _String2="PATH") returned -3 [0108.155] _wcsicmp (_String1="mode", _String2="GOTO") returned 6 [0108.155] _wcsicmp (_String1="mode", _String2="SHIFT") returned -6 [0108.155] _wcsicmp (_String1="mode", _String2="CLS") returned 10 [0108.155] _wcsicmp (_String1="mode", _String2="CALL") returned 10 [0108.155] _wcsicmp (_String1="mode", _String2="VERIFY") returned -9 [0108.155] _wcsicmp (_String1="mode", _String2="VER") returned -9 [0108.155] _wcsicmp (_String1="mode", _String2="VOL") returned -9 [0108.155] _wcsicmp (_String1="mode", _String2="EXIT") returned 8 [0108.155] _wcsicmp (_String1="mode", _String2="SETLOCAL") returned -6 [0108.155] _wcsicmp (_String1="mode", _String2="ENDLOCAL") returned 8 [0108.155] _wcsicmp (_String1="mode", _String2="TITLE") returned -7 [0108.155] _wcsicmp (_String1="mode", _String2="START") returned -6 [0108.155] _wcsicmp (_String1="mode", _String2="DPATH") returned 9 [0108.155] _wcsicmp (_String1="mode", _String2="KEYS") returned 2 [0108.155] _wcsicmp (_String1="mode", _String2="MOVE") returned -18 [0108.156] _wcsicmp (_String1="mode", _String2="PUSHD") returned -3 [0108.156] _wcsicmp (_String1="mode", _String2="POPD") returned -3 [0108.156] _wcsicmp (_String1="mode", _String2="ASSOC") returned 12 [0108.156] _wcsicmp (_String1="mode", _String2="FTYPE") returned 7 [0108.156] _wcsicmp (_String1="mode", _String2="BREAK") returned 11 [0108.156] _wcsicmp (_String1="mode", _String2="COLOR") returned 10 [0108.156] _wcsicmp (_String1="mode", _String2="MKLINK") returned 4 [0108.156] _wcsicmp (_String1="mode", _String2="DIR") returned 9 [0108.156] _wcsicmp (_String1="mode", _String2="ERASE") returned 8 [0108.156] _wcsicmp (_String1="mode", _String2="DEL") returned 9 [0108.156] _wcsicmp (_String1="mode", _String2="TYPE") returned -7 [0108.156] _wcsicmp (_String1="mode", _String2="COPY") returned 10 [0108.156] _wcsicmp (_String1="mode", _String2="CD") returned 10 [0108.156] _wcsicmp (_String1="mode", _String2="CHDIR") returned 10 [0108.156] _wcsicmp (_String1="mode", _String2="RENAME") returned -5 [0108.156] _wcsicmp (_String1="mode", _String2="REN") returned -5 [0108.156] _wcsicmp (_String1="mode", _String2="ECHO") returned 8 [0108.156] _wcsicmp (_String1="mode", _String2="SET") returned -6 [0108.156] _wcsicmp (_String1="mode", _String2="PAUSE") returned -3 [0108.156] _wcsicmp (_String1="mode", _String2="DATE") returned 9 [0108.156] _wcsicmp (_String1="mode", _String2="TIME") returned -7 [0108.156] _wcsicmp (_String1="mode", _String2="PROMPT") returned -3 [0108.156] _wcsicmp (_String1="mode", _String2="MD") returned 11 [0108.156] _wcsicmp (_String1="mode", _String2="MKDIR") returned 4 [0108.156] _wcsicmp (_String1="mode", _String2="RD") returned -5 [0108.156] _wcsicmp (_String1="mode", _String2="RMDIR") returned -5 [0108.156] _wcsicmp (_String1="mode", _String2="PATH") returned -3 [0108.156] _wcsicmp (_String1="mode", _String2="GOTO") returned 6 [0108.156] _wcsicmp (_String1="mode", _String2="SHIFT") returned -6 [0108.156] _wcsicmp (_String1="mode", _String2="CLS") returned 10 [0108.156] _wcsicmp (_String1="mode", _String2="CALL") returned 10 [0108.156] _wcsicmp (_String1="mode", _String2="VERIFY") returned -9 [0108.156] _wcsicmp (_String1="mode", _String2="VER") returned -9 [0108.156] _wcsicmp (_String1="mode", _String2="VOL") returned -9 [0108.156] _wcsicmp (_String1="mode", _String2="EXIT") returned 8 [0108.156] _wcsicmp (_String1="mode", _String2="SETLOCAL") returned -6 [0108.156] _wcsicmp (_String1="mode", _String2="ENDLOCAL") returned 8 [0108.156] _wcsicmp (_String1="mode", _String2="TITLE") returned -7 [0108.156] _wcsicmp (_String1="mode", _String2="START") returned -6 [0108.156] _wcsicmp (_String1="mode", _String2="DPATH") returned 9 [0108.156] _wcsicmp (_String1="mode", _String2="KEYS") returned 2 [0108.156] _wcsicmp (_String1="mode", _String2="MOVE") returned -18 [0108.156] _wcsicmp (_String1="mode", _String2="PUSHD") returned -3 [0108.156] _wcsicmp (_String1="mode", _String2="POPD") returned -3 [0108.156] _wcsicmp (_String1="mode", _String2="ASSOC") returned 12 [0108.156] _wcsicmp (_String1="mode", _String2="FTYPE") returned 7 [0108.156] _wcsicmp (_String1="mode", _String2="BREAK") returned 11 [0108.156] _wcsicmp (_String1="mode", _String2="COLOR") returned 10 [0108.156] _wcsicmp (_String1="mode", _String2="MKLINK") returned 4 [0108.156] _wcsicmp (_String1="mode", _String2="FOR") returned 7 [0108.156] _wcsicmp (_String1="mode", _String2="IF") returned 4 [0108.156] _wcsicmp (_String1="mode", _String2="REM") returned -5 [0108.157] _wcsnicmp (_String1="mode", _String2="cmd ", _MaxCount=0x4) returned 10 [0108.157] SetErrorMode (uMode=0x0) returned 0x0 [0108.157] SetErrorMode (uMode=0x1) returned 0x0 [0108.157] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x379a90, lpFilePart=0x16f2a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x16f2a0*="Desktop") returned 0x25 [0108.157] SetErrorMode (uMode=0x0) returned 0x1 [0108.157] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4ab1f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0108.157] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0108.161] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4ab1f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0108.162] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0108.163] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\mode.*", fInfoLevelId=0x1, lpFindFileData=0x16f010, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x16f010) returned 0xffffffffffffffff [0108.163] GetLastError () returned 0x2 [0108.163] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\mode", fInfoLevelId=0x1, lpFindFileData=0x16f010, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x16f010) returned 0xffffffffffffffff [0108.163] GetLastError () returned 0x2 [0108.163] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0108.163] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\mode.*", fInfoLevelId=0x1, lpFindFileData=0x16f010, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x16f010) returned 0x375c00 [0108.163] FindClose (in: hFindFile=0x375c00 | out: hFindFile=0x375c00) returned 1 [0108.163] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\mode.COM", fInfoLevelId=0x1, lpFindFileData=0x16f010, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x16f010) returned 0x375c00 [0108.163] FindClose (in: hFindFile=0x375c00 | out: hFindFile=0x375c00) returned 1 [0108.163] _wcsicmp (_String1=".COM", _String2=".BAT") returned 1 [0108.163] _wcsicmp (_String1=".COM", _String2=".CMD") returned 2 [0108.163] GetConsoleTitleW (in: lpConsoleTitle=0x16f560, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0108.163] GetConsoleTitleW (in: lpConsoleTitle=0x379c50, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0108.164] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - mode con cp select=1251") returned 1 [0108.164] InitializeProcThreadAttributeList (in: lpAttributeList=0x16f318, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x16f2d8 | out: lpAttributeList=0x16f318, lpSize=0x16f2d8) returned 1 [0108.164] UpdateProcThreadAttribute (in: lpAttributeList=0x16f318, dwFlags=0x0, Attribute=0x60001, lpValue=0x16f2c8, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x16f318, lpPreviousValue=0x0) returned 1 [0108.164] GetStartupInfoW (in: lpStartupInfo=0x16f430 | out: lpStartupInfo=0x16f430*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xe8, hStdOutput=0xf4, hStdError=0xf4)) [0108.164] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0108.164] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0108.164] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0108.164] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0108.164] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0108.164] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0108.164] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0108.164] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0108.164] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0108.164] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0108.164] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0108.164] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0108.164] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0108.164] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0108.164] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0108.164] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0108.164] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0108.164] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0108.164] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0108.165] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0108.165] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0108.165] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0108.165] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0108.165] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0108.165] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0108.165] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0108.165] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0108.165] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0108.165] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0108.165] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0108.165] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0108.165] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0108.165] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0108.165] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0108.165] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0108.165] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0108.165] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0108.165] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0108.165] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\mode.com", lpCommandLine="mode con cp select=1251", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x16f350*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="mode con cp select=1251", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x16f300 | out: lpCommandLine="mode con cp select=1251", lpProcessInformation=0x16f300*(hProcess=0x54, hThread=0x50, dwProcessId=0xbcc, dwThreadId=0xbd0)) returned 1 [0110.350] CloseHandle (hObject=0x50) returned 1 [0110.351] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0110.351] GetEnvironmentStringsW () returned 0x37aa10* [0110.351] FreeEnvironmentStringsW (penv=0x37aa10) returned 1 [0110.351] LoadLibraryW (lpLibFileName="NTDLL.DLL") returned 0x778d0000 [0110.351] GetProcAddress (hModule=0x778d0000, lpProcName="NtQueryInformationProcess") returned 0x779214a0 [0110.351] NtQueryInformationProcess (in: ProcessHandle=0x54, ProcessInformationClass=0x0, ProcessInformation=0x16ec08, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x16ec08, ReturnLength=0x0) returned 0x0 [0110.351] ReadProcessMemory (in: hProcess=0x54, lpBaseAddress=0x7fffffdf000, lpBuffer=0x16ec40, nSize=0x380, lpNumberOfBytesRead=0x16ec00 | out: lpBuffer=0x16ec40*, lpNumberOfBytesRead=0x16ec00*=0x380) returned 1 [0110.351] WaitForSingleObject (hHandle=0x54, dwMilliseconds=0xffffffff) returned 0x0 [0112.245] GetExitCodeProcess (in: hProcess=0x54, lpExitCode=0x16f248 | out: lpExitCode=0x16f248*=0x0) returned 1 [0112.245] CloseHandle (hObject=0x54) returned 1 [0112.245] _vsnwprintf (in: _Buffer=0x16f4b8, _BufferCount=0x13, _Format="%08X", _ArgList=0x16f258 | out: _Buffer="00000000") returned 8 [0112.245] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000000") returned 1 [0112.245] GetEnvironmentStringsW () returned 0x37aa10* [0112.245] FreeEnvironmentStringsW (penv=0x37aa10) returned 1 [0112.245] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0112.245] GetEnvironmentStringsW () returned 0x37aa10* [0112.245] FreeEnvironmentStringsW (penv=0x37aa10) returned 1 [0112.245] DeleteProcThreadAttributeList (in: lpAttributeList=0x16f318 | out: lpAttributeList=0x16f318) [0112.317] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0112.317] _get_osfhandle (_FileHandle=1) returned 0xf4 [0112.317] SetConsoleMode (hConsoleHandle=0xf4, dwMode=0x0) returned 0 [0112.317] _get_osfhandle (_FileHandle=1) returned 0xf4 [0112.317] GetConsoleMode (in: hConsoleHandle=0xf4, lpMode=0x4ab1e194 | out: lpMode=0x4ab1e194) returned 0 [0112.317] _get_osfhandle (_FileHandle=0) returned 0xe8 [0112.317] GetConsoleMode (in: hConsoleHandle=0xe8, lpMode=0x4ab1e198 | out: lpMode=0x4ab1e198) returned 0 [0112.317] GetConsoleOutputCP () returned 0x4e3 [0112.317] GetCPInfo (in: CodePage=0x4e3, lpCPInfo=0x4ab2bfe0 | out: lpCPInfo=0x4ab2bfe0) returned 1 [0112.318] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0112.318] _vsnwprintf (in: _Buffer=0x4ab36340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x16f778 | out: _Buffer="\r\n") returned 2 [0112.318] _get_osfhandle (_FileHandle=1) returned 0xf4 [0112.318] GetFileType (hFile=0xf4) returned 0x3 [0112.318] _get_osfhandle (_FileHandle=1) returned 0xf4 [0112.318] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4ab2c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0112.318] WriteFile (in: hFile=0xf4, lpBuffer=0x4ab2c320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x16f748, lpOverlapped=0x0 | out: lpBuffer=0x4ab2c320*, lpNumberOfBytesWritten=0x16f748*=0x2, lpOverlapped=0x0) returned 1 [0112.318] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4ab1f360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0112.318] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4ab2c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0112.318] _vsnwprintf (in: _Buffer=0x4ab1eb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x16f788 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0112.319] _vsnwprintf (in: _Buffer=0x4ab1ebaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x16f788 | out: _Buffer=">") returned 1 [0112.319] _get_osfhandle (_FileHandle=1) returned 0xf4 [0112.319] GetFileType (hFile=0xf4) returned 0x3 [0112.319] _get_osfhandle (_FileHandle=1) returned 0xf4 [0112.319] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x4ab2c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39 [0112.319] WriteFile (in: hFile=0xf4, lpBuffer=0x4ab2c320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x16f778, lpOverlapped=0x0 | out: lpBuffer=0x4ab2c320*, lpNumberOfBytesWritten=0x16f778*=0x26, lpOverlapped=0x0) returned 1 [0112.319] _get_osfhandle (_FileHandle=0) returned 0xe8 [0112.319] GetFileType (hFile=0xe8) returned 0x3 [0112.319] _get_osfhandle (_FileHandle=0) returned 0xe8 [0112.319] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0112.319] ReadFile (in: hFile=0xe8, lpBuffer=0x4ab2c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x16fa78, lpOverlapped=0x0 | out: lpBuffer=0x4ab2c320*, lpNumberOfBytesRead=0x16fa78*=0x1, lpOverlapped=0x0) returned 1 [0112.319] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4ab2c320, cbMultiByte=1, lpWideCharStr=0x4ab2e320, cchWideChar=1 | out: lpWideCharStr="vode con cp select=1251\n") returned 1 [0112.319] _get_osfhandle (_FileHandle=0) returned 0xe8 [0112.319] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0112.319] ReadFile (in: hFile=0xe8, lpBuffer=0x4ab2c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x16fa78, lpOverlapped=0x0 | out: lpBuffer=0x4ab2c320*, lpNumberOfBytesRead=0x16fa78*=0x1, lpOverlapped=0x0) returned 1 [0112.319] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4ab2c320, cbMultiByte=1, lpWideCharStr=0x4ab2e322, cchWideChar=1 | out: lpWideCharStr="sde con cp select=1251\n") returned 1 [0112.319] _get_osfhandle (_FileHandle=0) returned 0xe8 [0112.319] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0112.319] ReadFile (in: hFile=0xe8, lpBuffer=0x4ab2c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x16fa78, lpOverlapped=0x0 | out: lpBuffer=0x4ab2c320*, lpNumberOfBytesRead=0x16fa78*=0x1, lpOverlapped=0x0) returned 1 [0112.319] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4ab2c320, cbMultiByte=1, lpWideCharStr=0x4ab2e324, cchWideChar=1 | out: lpWideCharStr="se con cp select=1251\n") returned 1 [0112.319] _get_osfhandle (_FileHandle=0) returned 0xe8 [0112.319] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0112.319] ReadFile (in: hFile=0xe8, lpBuffer=0x4ab2c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x16fa78, lpOverlapped=0x0 | out: lpBuffer=0x4ab2c320*, lpNumberOfBytesRead=0x16fa78*=0x1, lpOverlapped=0x0) returned 1 [0112.319] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4ab2c320, cbMultiByte=1, lpWideCharStr=0x4ab2e326, cchWideChar=1 | out: lpWideCharStr="a con cp select=1251\n") returned 1 [0112.319] _get_osfhandle (_FileHandle=0) returned 0xe8 [0112.319] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0112.319] ReadFile (in: hFile=0xe8, lpBuffer=0x4ab2c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x16fa78, lpOverlapped=0x0 | out: lpBuffer=0x4ab2c320*, lpNumberOfBytesRead=0x16fa78*=0x1, lpOverlapped=0x0) returned 1 [0112.319] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4ab2c320, cbMultiByte=1, lpWideCharStr=0x4ab2e328, cchWideChar=1 | out: lpWideCharStr="dcon cp select=1251\n") returned 1 [0112.319] _get_osfhandle (_FileHandle=0) returned 0xe8 [0112.319] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0112.319] ReadFile (in: hFile=0xe8, lpBuffer=0x4ab2c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x16fa78, lpOverlapped=0x0 | out: lpBuffer=0x4ab2c320*, lpNumberOfBytesRead=0x16fa78*=0x1, lpOverlapped=0x0) returned 1 [0112.319] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4ab2c320, cbMultiByte=1, lpWideCharStr=0x4ab2e32a, cchWideChar=1 | out: lpWideCharStr="mon cp select=1251\n") returned 1 [0112.319] _get_osfhandle (_FileHandle=0) returned 0xe8 [0112.319] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0112.319] ReadFile (in: hFile=0xe8, lpBuffer=0x4ab2c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x16fa78, lpOverlapped=0x0 | out: lpBuffer=0x4ab2c320*, lpNumberOfBytesRead=0x16fa78*=0x1, lpOverlapped=0x0) returned 1 [0112.319] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4ab2c320, cbMultiByte=1, lpWideCharStr=0x4ab2e32c, cchWideChar=1 | out: lpWideCharStr="in cp select=1251\n") returned 1 [0112.320] _get_osfhandle (_FileHandle=0) returned 0xe8 [0112.320] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0112.320] ReadFile (in: hFile=0xe8, lpBuffer=0x4ab2c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x16fa78, lpOverlapped=0x0 | out: lpBuffer=0x4ab2c320*, lpNumberOfBytesRead=0x16fa78*=0x1, lpOverlapped=0x0) returned 1 [0112.320] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4ab2c320, cbMultiByte=1, lpWideCharStr=0x4ab2e32e, cchWideChar=1 | out: lpWideCharStr="n cp select=1251\n") returned 1 [0112.320] _get_osfhandle (_FileHandle=0) returned 0xe8 [0112.320] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0112.320] ReadFile (in: hFile=0xe8, lpBuffer=0x4ab2c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x16fa78, lpOverlapped=0x0 | out: lpBuffer=0x4ab2c320*, lpNumberOfBytesRead=0x16fa78*=0x1, lpOverlapped=0x0) returned 1 [0112.320] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4ab2c320, cbMultiByte=1, lpWideCharStr=0x4ab2e330, cchWideChar=1 | out: lpWideCharStr=" cp select=1251\n") returned 1 [0112.320] _get_osfhandle (_FileHandle=0) returned 0xe8 [0112.320] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0112.320] ReadFile (in: hFile=0xe8, lpBuffer=0x4ab2c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x16fa78, lpOverlapped=0x0 | out: lpBuffer=0x4ab2c320*, lpNumberOfBytesRead=0x16fa78*=0x1, lpOverlapped=0x0) returned 1 [0112.320] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4ab2c320, cbMultiByte=1, lpWideCharStr=0x4ab2e332, cchWideChar=1 | out: lpWideCharStr="dp select=1251\n") returned 1 [0112.320] _get_osfhandle (_FileHandle=0) returned 0xe8 [0112.320] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0112.320] ReadFile (in: hFile=0xe8, lpBuffer=0x4ab2c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x16fa78, lpOverlapped=0x0 | out: lpBuffer=0x4ab2c320*, lpNumberOfBytesRead=0x16fa78*=0x1, lpOverlapped=0x0) returned 1 [0112.320] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4ab2c320, cbMultiByte=1, lpWideCharStr=0x4ab2e334, cchWideChar=1 | out: lpWideCharStr="e select=1251\n") returned 1 [0112.320] _get_osfhandle (_FileHandle=0) returned 0xe8 [0112.320] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0112.320] ReadFile (in: hFile=0xe8, lpBuffer=0x4ab2c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x16fa78, lpOverlapped=0x0 | out: lpBuffer=0x4ab2c320*, lpNumberOfBytesRead=0x16fa78*=0x1, lpOverlapped=0x0) returned 1 [0112.320] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4ab2c320, cbMultiByte=1, lpWideCharStr=0x4ab2e336, cchWideChar=1 | out: lpWideCharStr="lselect=1251\n") returned 1 [0112.320] _get_osfhandle (_FileHandle=0) returned 0xe8 [0112.320] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0112.320] ReadFile (in: hFile=0xe8, lpBuffer=0x4ab2c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x16fa78, lpOverlapped=0x0 | out: lpBuffer=0x4ab2c320*, lpNumberOfBytesRead=0x16fa78*=0x1, lpOverlapped=0x0) returned 1 [0112.320] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4ab2c320, cbMultiByte=1, lpWideCharStr=0x4ab2e338, cchWideChar=1 | out: lpWideCharStr="eelect=1251\n") returned 1 [0112.320] _get_osfhandle (_FileHandle=0) returned 0xe8 [0112.320] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0112.320] ReadFile (in: hFile=0xe8, lpBuffer=0x4ab2c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x16fa78, lpOverlapped=0x0 | out: lpBuffer=0x4ab2c320*, lpNumberOfBytesRead=0x16fa78*=0x1, lpOverlapped=0x0) returned 1 [0112.320] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4ab2c320, cbMultiByte=1, lpWideCharStr=0x4ab2e33a, cchWideChar=1 | out: lpWideCharStr="tlect=1251\n") returned 1 [0112.320] _get_osfhandle (_FileHandle=0) returned 0xe8 [0112.320] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0112.320] ReadFile (in: hFile=0xe8, lpBuffer=0x4ab2c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x16fa78, lpOverlapped=0x0 | out: lpBuffer=0x4ab2c320*, lpNumberOfBytesRead=0x16fa78*=0x1, lpOverlapped=0x0) returned 1 [0112.320] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4ab2c320, cbMultiByte=1, lpWideCharStr=0x4ab2e33c, cchWideChar=1 | out: lpWideCharStr="eect=1251\n") returned 1 [0112.320] _get_osfhandle (_FileHandle=0) returned 0xe8 [0112.320] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0112.320] ReadFile (in: hFile=0xe8, lpBuffer=0x4ab2c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x16fa78, lpOverlapped=0x0 | out: lpBuffer=0x4ab2c320*, lpNumberOfBytesRead=0x16fa78*=0x1, lpOverlapped=0x0) returned 1 [0112.321] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4ab2c320, cbMultiByte=1, lpWideCharStr=0x4ab2e33e, cchWideChar=1 | out: lpWideCharStr=" ct=1251\n") returned 1 [0112.321] _get_osfhandle (_FileHandle=0) returned 0xe8 [0112.321] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0112.321] ReadFile (in: hFile=0xe8, lpBuffer=0x4ab2c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x16fa78, lpOverlapped=0x0 | out: lpBuffer=0x4ab2c320*, lpNumberOfBytesRead=0x16fa78*=0x1, lpOverlapped=0x0) returned 1 [0112.321] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4ab2c320, cbMultiByte=1, lpWideCharStr=0x4ab2e340, cchWideChar=1 | out: lpWideCharStr="st=1251\n") returned 1 [0112.321] _get_osfhandle (_FileHandle=0) returned 0xe8 [0112.321] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0112.321] ReadFile (in: hFile=0xe8, lpBuffer=0x4ab2c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x16fa78, lpOverlapped=0x0 | out: lpBuffer=0x4ab2c320*, lpNumberOfBytesRead=0x16fa78*=0x1, lpOverlapped=0x0) returned 1 [0112.321] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4ab2c320, cbMultiByte=1, lpWideCharStr=0x4ab2e342, cchWideChar=1 | out: lpWideCharStr="h=1251\n") returned 1 [0112.321] _get_osfhandle (_FileHandle=0) returned 0xe8 [0112.321] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0112.321] ReadFile (in: hFile=0xe8, lpBuffer=0x4ab2c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x16fa78, lpOverlapped=0x0 | out: lpBuffer=0x4ab2c320*, lpNumberOfBytesRead=0x16fa78*=0x1, lpOverlapped=0x0) returned 1 [0112.321] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4ab2c320, cbMultiByte=1, lpWideCharStr=0x4ab2e344, cchWideChar=1 | out: lpWideCharStr="a1251\n") returned 1 [0112.321] _get_osfhandle (_FileHandle=0) returned 0xe8 [0112.321] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0112.321] ReadFile (in: hFile=0xe8, lpBuffer=0x4ab2c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x16fa78, lpOverlapped=0x0 | out: lpBuffer=0x4ab2c320*, lpNumberOfBytesRead=0x16fa78*=0x1, lpOverlapped=0x0) returned 1 [0112.321] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4ab2c320, cbMultiByte=1, lpWideCharStr=0x4ab2e346, cchWideChar=1 | out: lpWideCharStr="d251\n") returned 1 [0112.321] _get_osfhandle (_FileHandle=0) returned 0xe8 [0112.321] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0112.321] ReadFile (in: hFile=0xe8, lpBuffer=0x4ab2c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x16fa78, lpOverlapped=0x0 | out: lpBuffer=0x4ab2c320*, lpNumberOfBytesRead=0x16fa78*=0x1, lpOverlapped=0x0) returned 1 [0112.321] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4ab2c320, cbMultiByte=1, lpWideCharStr=0x4ab2e348, cchWideChar=1 | out: lpWideCharStr="o51\n") returned 1 [0112.321] _get_osfhandle (_FileHandle=0) returned 0xe8 [0112.321] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0112.321] ReadFile (in: hFile=0xe8, lpBuffer=0x4ab2c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x16fa78, lpOverlapped=0x0 | out: lpBuffer=0x4ab2c320*, lpNumberOfBytesRead=0x16fa78*=0x1, lpOverlapped=0x0) returned 1 [0112.321] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4ab2c320, cbMultiByte=1, lpWideCharStr=0x4ab2e34a, cchWideChar=1 | out: lpWideCharStr="w1\n") returned 1 [0112.321] _get_osfhandle (_FileHandle=0) returned 0xe8 [0112.321] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0112.321] ReadFile (in: hFile=0xe8, lpBuffer=0x4ab2c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x16fa78, lpOverlapped=0x0 | out: lpBuffer=0x4ab2c320*, lpNumberOfBytesRead=0x16fa78*=0x1, lpOverlapped=0x0) returned 1 [0112.321] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4ab2c320, cbMultiByte=1, lpWideCharStr=0x4ab2e34c, cchWideChar=1 | out: lpWideCharStr="s\n") returned 1 [0112.321] _get_osfhandle (_FileHandle=0) returned 0xe8 [0112.321] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0112.321] ReadFile (in: hFile=0xe8, lpBuffer=0x4ab2c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x16fa78, lpOverlapped=0x0 | out: lpBuffer=0x4ab2c320*, lpNumberOfBytesRead=0x16fa78*=0x1, lpOverlapped=0x0) returned 1 [0112.321] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4ab2c320, cbMultiByte=1, lpWideCharStr=0x4ab2e34e, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0112.321] _get_osfhandle (_FileHandle=0) returned 0xe8 [0112.321] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0112.322] ReadFile (in: hFile=0xe8, lpBuffer=0x4ab2c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x16fa78, lpOverlapped=0x0 | out: lpBuffer=0x4ab2c320*, lpNumberOfBytesRead=0x16fa78*=0x1, lpOverlapped=0x0) returned 1 [0112.322] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4ab2c320, cbMultiByte=1, lpWideCharStr=0x4ab2e350, cchWideChar=1 | out: lpWideCharStr="/") returned 1 [0112.322] _get_osfhandle (_FileHandle=0) returned 0xe8 [0112.322] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0112.322] ReadFile (in: hFile=0xe8, lpBuffer=0x4ab2c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x16fa78, lpOverlapped=0x0 | out: lpBuffer=0x4ab2c320*, lpNumberOfBytesRead=0x16fa78*=0x1, lpOverlapped=0x0) returned 1 [0112.322] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4ab2c320, cbMultiByte=1, lpWideCharStr=0x4ab2e352, cchWideChar=1 | out: lpWideCharStr="a") returned 1 [0112.322] _get_osfhandle (_FileHandle=0) returned 0xe8 [0112.322] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0112.322] ReadFile (in: hFile=0xe8, lpBuffer=0x4ab2c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x16fa78, lpOverlapped=0x0 | out: lpBuffer=0x4ab2c320*, lpNumberOfBytesRead=0x16fa78*=0x1, lpOverlapped=0x0) returned 1 [0112.322] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4ab2c320, cbMultiByte=1, lpWideCharStr=0x4ab2e354, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0112.322] _get_osfhandle (_FileHandle=0) returned 0xe8 [0112.322] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0112.322] ReadFile (in: hFile=0xe8, lpBuffer=0x4ab2c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x16fa78, lpOverlapped=0x0 | out: lpBuffer=0x4ab2c320*, lpNumberOfBytesRead=0x16fa78*=0x1, lpOverlapped=0x0) returned 1 [0112.322] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4ab2c320, cbMultiByte=1, lpWideCharStr=0x4ab2e356, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0112.322] _get_osfhandle (_FileHandle=0) returned 0xe8 [0112.322] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0112.322] ReadFile (in: hFile=0xe8, lpBuffer=0x4ab2c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x16fa78, lpOverlapped=0x0 | out: lpBuffer=0x4ab2c320*, lpNumberOfBytesRead=0x16fa78*=0x1, lpOverlapped=0x0) returned 1 [0112.322] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4ab2c320, cbMultiByte=1, lpWideCharStr=0x4ab2e358, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0112.322] _get_osfhandle (_FileHandle=0) returned 0xe8 [0112.322] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0112.322] ReadFile (in: hFile=0xe8, lpBuffer=0x4ab2c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x16fa78, lpOverlapped=0x0 | out: lpBuffer=0x4ab2c320*, lpNumberOfBytesRead=0x16fa78*=0x1, lpOverlapped=0x0) returned 1 [0112.322] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4ab2c320, cbMultiByte=1, lpWideCharStr=0x4ab2e35a, cchWideChar=1 | out: lpWideCharStr="/") returned 1 [0112.322] _get_osfhandle (_FileHandle=0) returned 0xe8 [0112.322] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0112.322] ReadFile (in: hFile=0xe8, lpBuffer=0x4ab2c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x16fa78, lpOverlapped=0x0 | out: lpBuffer=0x4ab2c320*, lpNumberOfBytesRead=0x16fa78*=0x1, lpOverlapped=0x0) returned 1 [0112.322] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4ab2c320, cbMultiByte=1, lpWideCharStr=0x4ab2e35c, cchWideChar=1 | out: lpWideCharStr="q") returned 1 [0112.322] _get_osfhandle (_FileHandle=0) returned 0xe8 [0112.322] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0112.322] ReadFile (in: hFile=0xe8, lpBuffer=0x4ab2c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x16fa78, lpOverlapped=0x0 | out: lpBuffer=0x4ab2c320*, lpNumberOfBytesRead=0x16fa78*=0x1, lpOverlapped=0x0) returned 1 [0112.322] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4ab2c320, cbMultiByte=1, lpWideCharStr=0x4ab2e35e, cchWideChar=1 | out: lpWideCharStr="u") returned 1 [0112.322] _get_osfhandle (_FileHandle=0) returned 0xe8 [0112.322] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0112.322] ReadFile (in: hFile=0xe8, lpBuffer=0x4ab2c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x16fa78, lpOverlapped=0x0 | out: lpBuffer=0x4ab2c320*, lpNumberOfBytesRead=0x16fa78*=0x1, lpOverlapped=0x0) returned 1 [0112.322] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4ab2c320, cbMultiByte=1, lpWideCharStr=0x4ab2e360, cchWideChar=1 | out: lpWideCharStr="i") returned 1 [0112.322] _get_osfhandle (_FileHandle=0) returned 0xe8 [0112.322] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0112.323] ReadFile (in: hFile=0xe8, lpBuffer=0x4ab2c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x16fa78, lpOverlapped=0x0 | out: lpBuffer=0x4ab2c320*, lpNumberOfBytesRead=0x16fa78*=0x1, lpOverlapped=0x0) returned 1 [0112.323] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4ab2c320, cbMultiByte=1, lpWideCharStr=0x4ab2e362, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0112.323] _get_osfhandle (_FileHandle=0) returned 0xe8 [0112.323] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0112.323] ReadFile (in: hFile=0xe8, lpBuffer=0x4ab2c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x16fa78, lpOverlapped=0x0 | out: lpBuffer=0x4ab2c320*, lpNumberOfBytesRead=0x16fa78*=0x1, lpOverlapped=0x0) returned 1 [0112.323] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4ab2c320, cbMultiByte=1, lpWideCharStr=0x4ab2e364, cchWideChar=1 | out: lpWideCharStr="t") returned 1 [0112.323] _get_osfhandle (_FileHandle=0) returned 0xe8 [0112.323] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0112.323] ReadFile (in: hFile=0xe8, lpBuffer=0x4ab2c320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x16fa78, lpOverlapped=0x0 | out: lpBuffer=0x4ab2c320*, lpNumberOfBytesRead=0x16fa78*=0x1, lpOverlapped=0x0) returned 1 [0112.323] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4ab2c320, cbMultiByte=1, lpWideCharStr=0x4ab2e366, cchWideChar=1 | out: lpWideCharStr="\n") returned 1 [0112.323] _get_osfhandle (_FileHandle=0) returned 0xe8 [0112.323] GetFileType (hFile=0xe8) returned 0x3 [0112.323] _get_osfhandle (_FileHandle=0) returned 0xe8 [0112.323] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0112.323] _get_osfhandle (_FileHandle=1) returned 0xf4 [0112.323] GetFileType (hFile=0xf4) returned 0x3 [0112.323] _get_osfhandle (_FileHandle=1) returned 0xf4 [0112.323] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="vssadmin delete shadows /all /quiet\n", cchWideChar=-1, lpMultiByteStr=0x4ab2c320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vssadmin delete shadows /all /quiet\n", lpUsedDefaultChar=0x0) returned 37 [0112.323] WriteFile (in: hFile=0xf4, lpBuffer=0x4ab2c320*, nNumberOfBytesToWrite=0x24, lpNumberOfBytesWritten=0x16fa58, lpOverlapped=0x0 | out: lpBuffer=0x4ab2c320*, lpNumberOfBytesWritten=0x16fa58*=0x24, lpOverlapped=0x0) returned 1 [0112.324] GetConsoleOutputCP () returned 0x4e3 [0112.324] GetCPInfo (in: CodePage=0x4e3, lpCPInfo=0x4ab2bfe0 | out: lpCPInfo=0x4ab2bfe0) returned 1 [0112.324] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0112.324] GetConsoleTitleW (in: lpConsoleTitle=0x16fa10, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0112.325] SetErrorMode (uMode=0x0) returned 0x0 [0112.325] SetErrorMode (uMode=0x1) returned 0x0 [0112.325] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x3790a0, lpFilePart=0x16f2a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x16f2a0*="Desktop") returned 0x25 [0112.325] SetErrorMode (uMode=0x0) returned 0x1 [0112.325] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4ab1f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0112.325] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0112.325] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4ab1f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0112.325] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0112.325] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\vssadmin.*", fInfoLevelId=0x1, lpFindFileData=0x16f010, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x16f010) returned 0xffffffffffffffff [0112.325] GetLastError () returned 0x2 [0112.325] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\vssadmin", fInfoLevelId=0x1, lpFindFileData=0x16f010, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x16f010) returned 0xffffffffffffffff [0112.326] GetLastError () returned 0x2 [0112.326] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0112.326] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\vssadmin.*", fInfoLevelId=0x1, lpFindFileData=0x16f010, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x16f010) returned 0x379ba0 [0112.326] FindClose (in: hFindFile=0x379ba0 | out: hFindFile=0x379ba0) returned 1 [0112.326] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\vssadmin.COM", fInfoLevelId=0x1, lpFindFileData=0x16f010, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x16f010) returned 0xffffffffffffffff [0112.326] GetLastError () returned 0x2 [0112.326] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\vssadmin.EXE", fInfoLevelId=0x1, lpFindFileData=0x16f010, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x16f010) returned 0x379ba0 [0112.326] FindClose (in: hFindFile=0x379ba0 | out: hFindFile=0x379ba0) returned 1 [0112.326] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0112.326] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0112.326] GetConsoleTitleW (in: lpConsoleTitle=0x16f560, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0112.326] GetConsoleTitleW (in: lpConsoleTitle=0x379120, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0112.326] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - vssadmin delete shadows /all /quiet") returned 1 [0112.327] InitializeProcThreadAttributeList (in: lpAttributeList=0x16f318, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x16f2d8 | out: lpAttributeList=0x16f318, lpSize=0x16f2d8) returned 1 [0112.327] UpdateProcThreadAttribute (in: lpAttributeList=0x16f318, dwFlags=0x0, Attribute=0x60001, lpValue=0x16f2c8, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x16f318, lpPreviousValue=0x0) returned 1 [0112.327] GetStartupInfoW (in: lpStartupInfo=0x16f430 | out: lpStartupInfo=0x16f430*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xe8, hStdOutput=0xf4, hStdError=0xf4)) [0112.327] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0112.327] _wcsnicmp (_String1="COPYCMD", _String2="=ExitCo", _MaxCount=0x7) returned 38 [0112.327] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0112.327] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0112.327] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0112.327] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0112.327] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0112.327] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0112.327] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0112.327] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0112.327] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0112.327] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0112.327] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0112.327] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0112.327] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0112.327] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0112.327] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0112.327] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0112.327] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0112.327] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0112.327] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0112.327] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0112.327] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0112.327] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0112.327] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0112.327] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0112.328] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0112.328] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0112.328] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0112.328] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0112.328] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0112.328] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0112.328] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0112.328] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0112.328] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0112.328] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0112.328] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0112.328] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0112.328] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0112.328] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\vssadmin.exe", lpCommandLine="vssadmin delete shadows /all /quiet", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x16f350*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="vssadmin delete shadows /all /quiet", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x16f300 | out: lpCommandLine="vssadmin delete shadows /all /quiet", lpProcessInformation=0x16f300*(hProcess=0x50, hThread=0x54, dwProcessId=0xbd4, dwThreadId=0xbd8)) returned 1 [0112.673] CloseHandle (hObject=0x54) returned 1 [0112.673] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0112.673] GetEnvironmentStringsW () returned 0x37eb10* [0112.673] FreeEnvironmentStringsW (penv=0x37eb10) returned 1 [0112.673] NtQueryInformationProcess (in: ProcessHandle=0x50, ProcessInformationClass=0x0, ProcessInformation=0x16ec08, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x16ec08, ReturnLength=0x0) returned 0x0 [0112.673] ReadProcessMemory (in: hProcess=0x50, lpBaseAddress=0x7fffffdf000, lpBuffer=0x16ec40, nSize=0x380, lpNumberOfBytesRead=0x16ec00 | out: lpBuffer=0x16ec40*, lpNumberOfBytesRead=0x16ec00*=0x380) returned 1 [0112.673] WaitForSingleObject (hHandle=0x50, dwMilliseconds=0xffffffff) Process: id = "4" image_name = "mode.com" filename = "c:\\windows\\system32\\mode.com" page_root = "0x2aab0000" os_pid = "0xbcc" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0xb74" cmd_line = "mode con cp select=1251" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f065" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 941 start_va = 0x10000 end_va = 0x2ffff entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 942 start_va = 0x30000 end_va = 0x33fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 943 start_va = 0x40000 end_va = 0x40fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 944 start_va = 0x130000 end_va = 0x1affff entry_point = 0x0 region_type = private name = "private_0x0000000000130000" filename = "" Region: id = 945 start_va = 0x778d0000 end_va = 0x77a78fff entry_point = 0x778d0000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 946 start_va = 0x7efe0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 947 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 948 start_va = 0xff1a0000 end_va = 0xff1abfff entry_point = 0xff1a0000 region_type = mapped_file name = "mode.com" filename = "\\Windows\\System32\\mode.com" (normalized: "c:\\windows\\system32\\mode.com") Region: id = 949 start_va = 0x7feffbf0000 end_va = 0x7feffbf0fff entry_point = 0x7feffbf0000 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 950 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 951 start_va = 0x7fffffdd000 end_va = 0x7fffffdefff entry_point = 0x0 region_type = private name = "private_0x000007fffffdd000" filename = "" Region: id = 952 start_va = 0x7fffffdf000 end_va = 0x7fffffdffff entry_point = 0x0 region_type = private name = "private_0x000007fffffdf000" filename = "" Region: id = 956 start_va = 0x2c0000 end_va = 0x3bffff entry_point = 0x0 region_type = private name = "private_0x00000000002c0000" filename = "" Region: id = 957 start_va = 0x777b0000 end_va = 0x778cefff entry_point = 0x777b0000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 958 start_va = 0x7fefd8d0000 end_va = 0x7fefd93afff entry_point = 0x7fefd8d0000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 959 start_va = 0x10000 end_va = 0x1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 960 start_va = 0x20000 end_va = 0x2ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000020000" filename = "" Region: id = 961 start_va = 0x50000 end_va = 0xb6fff entry_point = 0x50000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 962 start_va = 0xc0000 end_va = 0xc0fff entry_point = 0x0 region_type = private name = "private_0x00000000000c0000" filename = "" Region: id = 963 start_va = 0xd0000 end_va = 0xd0fff entry_point = 0x0 region_type = private name = "private_0x00000000000d0000" filename = "" Region: id = 964 start_va = 0x1b0000 end_va = 0x2affff entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 965 start_va = 0x3c0000 end_va = 0x547fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000003c0000" filename = "" Region: id = 966 start_va = 0x560000 end_va = 0x56ffff entry_point = 0x0 region_type = private name = "private_0x0000000000560000" filename = "" Region: id = 967 start_va = 0x570000 end_va = 0x6f0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000570000" filename = "" Region: id = 968 start_va = 0x700000 end_va = 0x1afffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000700000" filename = "" Region: id = 969 start_va = 0x776b0000 end_va = 0x777a9fff entry_point = 0x776b0000 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 970 start_va = 0x7efe0000 end_va = 0x7f0dffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 971 start_va = 0x7f0e0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 972 start_va = 0x7fef3c50000 end_va = 0x7fef3c77fff entry_point = 0x7fef3c50000 region_type = mapped_file name = "ulib.dll" filename = "\\Windows\\System32\\ulib.dll" (normalized: "c:\\windows\\system32\\ulib.dll") Region: id = 973 start_va = 0x7fef8360000 end_va = 0x7fef836bfff entry_point = 0x7fef8360000 region_type = mapped_file name = "ureg.dll" filename = "\\Windows\\System32\\ureg.dll" (normalized: "c:\\windows\\system32\\ureg.dll") Region: id = 974 start_va = 0x7fefdec0000 end_va = 0x7fefdecdfff entry_point = 0x7fefdec0000 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 975 start_va = 0x7fefdfb0000 end_va = 0x7fefdfddfff entry_point = 0x7fefdfb0000 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 976 start_va = 0x7fefe100000 end_va = 0x7fefe166fff entry_point = 0x7fefe100000 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 977 start_va = 0x7fefe170000 end_va = 0x7fefe20efff entry_point = 0x7fefe170000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 978 start_va = 0x7fefe210000 end_va = 0x7fefe318fff entry_point = 0x7fefe210000 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 979 start_va = 0x7fefe320000 end_va = 0x7fefe3e8fff entry_point = 0x7fefe320000 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 980 start_va = 0x7fefe3f0000 end_va = 0x7fefe4cafff entry_point = 0x7fefe3f0000 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 981 start_va = 0x7fefe4d0000 end_va = 0x7fefe5fcfff entry_point = 0x7fefe4d0000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 982 start_va = 0x7fefea30000 end_va = 0x7fefea4efff entry_point = 0x7fefea30000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 1042 start_va = 0xe0000 end_va = 0xf0fff entry_point = 0xe0000 region_type = mapped_file name = "c_1251.nls" filename = "\\Windows\\System32\\C_1251.NLS" (normalized: "c:\\windows\\system32\\c_1251.nls") Region: id = 1043 start_va = 0x100000 end_va = 0x106fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000100000" filename = "" Region: id = 1044 start_va = 0x110000 end_va = 0x111fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000110000" filename = "" Region: id = 1045 start_va = 0x1b00000 end_va = 0x1b37fff entry_point = 0x1b00000 region_type = mapped_file name = "ulib.dll.mui" filename = "\\Windows\\System32\\en-US\\ulib.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\ulib.dll.mui") Region: id = 1046 start_va = 0x7fefc140000 end_va = 0x7fefc195fff entry_point = 0x7fefc140000 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Thread: id = 37 os_tid = 0xbd0 Process: id = "5" image_name = "vssadmin.exe" filename = "c:\\windows\\system32\\vssadmin.exe" page_root = "0x26ed6000" os_pid = "0xbd4" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0xb74" cmd_line = "vssadmin delete shadows /all /quiet" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f065" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 1107 start_va = 0x10000 end_va = 0x2ffff entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 1108 start_va = 0x30000 end_va = 0x33fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 1109 start_va = 0x40000 end_va = 0x40fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 1110 start_va = 0xb0000 end_va = 0x12ffff entry_point = 0x0 region_type = private name = "private_0x00000000000b0000" filename = "" Region: id = 1111 start_va = 0x778d0000 end_va = 0x77a78fff entry_point = 0x778d0000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 1112 start_va = 0x7efe0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 1113 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 1114 start_va = 0xff230000 end_va = 0xff25cfff entry_point = 0xff230000 region_type = mapped_file name = "vssadmin.exe" filename = "\\Windows\\System32\\vssadmin.exe" (normalized: "c:\\windows\\system32\\vssadmin.exe") Region: id = 1115 start_va = 0x7feffbf0000 end_va = 0x7feffbf0fff entry_point = 0x7feffbf0000 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 1116 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 1117 start_va = 0x7fffffdd000 end_va = 0x7fffffdefff entry_point = 0x0 region_type = private name = "private_0x000007fffffdd000" filename = "" Region: id = 1118 start_va = 0x7fffffdf000 end_va = 0x7fffffdffff entry_point = 0x0 region_type = private name = "private_0x000007fffffdf000" filename = "" Region: id = 1119 start_va = 0x160000 end_va = 0x25ffff entry_point = 0x0 region_type = private name = "private_0x0000000000160000" filename = "" Region: id = 1120 start_va = 0x777b0000 end_va = 0x778cefff entry_point = 0x777b0000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 1121 start_va = 0x7fefd8d0000 end_va = 0x7fefd93afff entry_point = 0x7fefd8d0000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 1180 start_va = 0x10000 end_va = 0x1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 1181 start_va = 0x20000 end_va = 0x2ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000020000" filename = "" Region: id = 1182 start_va = 0x50000 end_va = 0x56fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000050000" filename = "" Region: id = 1183 start_va = 0x60000 end_va = 0x61fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000060000" filename = "" Region: id = 1184 start_va = 0x70000 end_va = 0x7cfff entry_point = 0x70000 region_type = mapped_file name = "vssadmin.exe.mui" filename = "\\Windows\\System32\\en-US\\vssadmin.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\vssadmin.exe.mui") Region: id = 1185 start_va = 0x80000 end_va = 0x80fff entry_point = 0x0 region_type = private name = "private_0x0000000000080000" filename = "" Region: id = 1186 start_va = 0x90000 end_va = 0x90fff entry_point = 0x0 region_type = private name = "private_0x0000000000090000" filename = "" Region: id = 1187 start_va = 0x260000 end_va = 0x2c6fff entry_point = 0x260000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 1188 start_va = 0x2d0000 end_va = 0x3cffff entry_point = 0x0 region_type = private name = "private_0x00000000002d0000" filename = "" Region: id = 1189 start_va = 0x3d0000 end_va = 0x3dffff entry_point = 0x0 region_type = private name = "private_0x00000000003d0000" filename = "" Region: id = 1190 start_va = 0x3e0000 end_va = 0x567fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000003e0000" filename = "" Region: id = 1191 start_va = 0x570000 end_va = 0x6f0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000570000" filename = "" Region: id = 1192 start_va = 0x700000 end_va = 0x1afffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000700000" filename = "" Region: id = 1193 start_va = 0x776b0000 end_va = 0x777a9fff entry_point = 0x776b0000 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 1194 start_va = 0x7efe0000 end_va = 0x7f0dffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 1195 start_va = 0x7f0e0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 1196 start_va = 0x7fefa8d0000 end_va = 0x7fefa8e6fff entry_point = 0x7fefa8d0000 region_type = mapped_file name = "vsstrace.dll" filename = "\\Windows\\System32\\vsstrace.dll" (normalized: "c:\\windows\\system32\\vsstrace.dll") Region: id = 1197 start_va = 0x7fefa8f0000 end_va = 0x7fefaa9ffff entry_point = 0x7fefa8f0000 region_type = mapped_file name = "vssapi.dll" filename = "\\Windows\\System32\\vssapi.dll" (normalized: "c:\\windows\\system32\\vssapi.dll") Region: id = 1198 start_va = 0x7fefb2d0000 end_va = 0x7fefb2e8fff entry_point = 0x7fefb2d0000 region_type = mapped_file name = "atl.dll" filename = "\\Windows\\System32\\atl.dll" (normalized: "c:\\windows\\system32\\atl.dll") Region: id = 1199 start_va = 0x7fefdec0000 end_va = 0x7fefdecdfff entry_point = 0x7fefdec0000 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 1200 start_va = 0x7fefded0000 end_va = 0x7fefdfa6fff entry_point = 0x7fefded0000 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 1201 start_va = 0x7fefdfb0000 end_va = 0x7fefdfddfff entry_point = 0x7fefdfb0000 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 1202 start_va = 0x7fefe100000 end_va = 0x7fefe166fff entry_point = 0x7fefe100000 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 1203 start_va = 0x7fefe170000 end_va = 0x7fefe20efff entry_point = 0x7fefe170000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 1204 start_va = 0x7fefe210000 end_va = 0x7fefe318fff entry_point = 0x7fefe210000 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 1205 start_va = 0x7fefe320000 end_va = 0x7fefe3e8fff entry_point = 0x7fefe320000 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 1206 start_va = 0x7fefe3f0000 end_va = 0x7fefe4cafff entry_point = 0x7fefe3f0000 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 1207 start_va = 0x7fefe4d0000 end_va = 0x7fefe5fcfff entry_point = 0x7fefe4d0000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 1208 start_va = 0x7fefea30000 end_va = 0x7fefea4efff entry_point = 0x7fefea30000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 1209 start_va = 0x7feff9d0000 end_va = 0x7feffbd2fff entry_point = 0x7feff9d0000 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 1268 start_va = 0x7fefd710000 end_va = 0x7fefd71efff entry_point = 0x7fefd710000 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 1269 start_va = 0xa0000 end_va = 0xa0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000a0000" filename = "" Region: id = 1270 start_va = 0x130000 end_va = 0x140fff entry_point = 0x130000 region_type = mapped_file name = "c_1251.nls" filename = "\\Windows\\System32\\C_1251.NLS" (normalized: "c:\\windows\\system32\\c_1251.nls") Region: id = 1271 start_va = 0x1be0000 end_va = 0x1c5ffff entry_point = 0x0 region_type = private name = "private_0x0000000001be0000" filename = "" Region: id = 1272 start_va = 0x7fefe600000 end_va = 0x7fefe698fff entry_point = 0x7fefe600000 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 1273 start_va = 0x7fffffdb000 end_va = 0x7fffffdcfff entry_point = 0x0 region_type = private name = "private_0x000007fffffdb000" filename = "" Region: id = 1274 start_va = 0x150000 end_va = 0x150fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000150000" filename = "" Region: id = 1275 start_va = 0x1b60000 end_va = 0x1bdffff entry_point = 0x0 region_type = private name = "private_0x0000000001b60000" filename = "" Region: id = 1276 start_va = 0x7fefd110000 end_va = 0x7fefd126fff entry_point = 0x7fefd110000 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 1277 start_va = 0x7fffffd9000 end_va = 0x7fffffdafff entry_point = 0x0 region_type = private name = "private_0x000007fffffd9000" filename = "" Region: id = 1278 start_va = 0x7fefce10000 end_va = 0x7fefce56fff entry_point = 0x7fefce10000 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 1279 start_va = 0x1c60000 end_va = 0x1f2efff entry_point = 0x1c60000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 1280 start_va = 0x7fefd800000 end_va = 0x7fefd813fff entry_point = 0x7fefd800000 region_type = mapped_file name = "rpcrtremote.dll" filename = "\\Windows\\System32\\RpcRtRemote.dll" (normalized: "c:\\windows\\system32\\rpcrtremote.dll") Region: id = 1457 start_va = 0x2010000 end_va = 0x208ffff entry_point = 0x0 region_type = private name = "private_0x0000000002010000" filename = "" Region: id = 1458 start_va = 0x2140000 end_va = 0x21bffff entry_point = 0x0 region_type = private name = "private_0x0000000002140000" filename = "" Region: id = 1459 start_va = 0x7fef3c60000 end_va = 0x7fef3c73fff entry_point = 0x7fef3c60000 region_type = mapped_file name = "vss_ps.dll" filename = "\\Windows\\System32\\vss_ps.dll" (normalized: "c:\\windows\\system32\\vss_ps.dll") Region: id = 1460 start_va = 0x7fffffd5000 end_va = 0x7fffffd6fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd5000" filename = "" Region: id = 1461 start_va = 0x7fffffd7000 end_va = 0x7fffffd8fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd7000" filename = "" Thread: id = 38 os_tid = 0xbd8 Thread: id = 39 os_tid = 0xbdc Thread: id = 40 os_tid = 0xbe0 Thread: id = 41 os_tid = 0xbe4 Thread: id = 42 os_tid = 0xbe8 Process: id = "6" image_name = "vssvc.exe" filename = "c:\\windows\\system32\\vssvc.exe" page_root = "0x12270000" os_pid = "0xbec" os_integrity_level = "0x4000" os_privileges = "0xe60b7e890" monitor_reason = "rpc_server" parent_id = "5" os_parent_pid = "0xbd4" cmd_line = "C:\\Windows\\system32\\vssvc.exe" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\VSS" [0xe], "NT AUTHORITY\\Logon Session 00000000:0004e1d0" [0xc000000f], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Region: id = 1462 start_va = 0x10000 end_va = 0x1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 1463 start_va = 0x20000 end_va = 0x26fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000020000" filename = "" Region: id = 1464 start_va = 0x30000 end_va = 0x33fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 1465 start_va = 0x40000 end_va = 0x40fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 1466 start_va = 0x50000 end_va = 0xb6fff entry_point = 0x50000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 1467 start_va = 0xc0000 end_va = 0xc1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000c0000" filename = "" Region: id = 1468 start_va = 0xd0000 end_va = 0xe0fff entry_point = 0xd0000 region_type = mapped_file name = "vssvc.exe.mui" filename = "\\Windows\\System32\\en-US\\VSSVC.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\vssvc.exe.mui") Region: id = 1469 start_va = 0xf0000 end_va = 0x16ffff entry_point = 0x0 region_type = private name = "private_0x00000000000f0000" filename = "" Region: id = 1470 start_va = 0x170000 end_va = 0x26ffff entry_point = 0x0 region_type = private name = "private_0x0000000000170000" filename = "" Region: id = 1471 start_va = 0x270000 end_va = 0x270fff entry_point = 0x0 region_type = private name = "private_0x0000000000270000" filename = "" Region: id = 1472 start_va = 0x280000 end_va = 0x280fff entry_point = 0x0 region_type = private name = "private_0x0000000000280000" filename = "" Region: id = 1473 start_va = 0x290000 end_va = 0x38ffff entry_point = 0x0 region_type = private name = "private_0x0000000000290000" filename = "" Region: id = 1474 start_va = 0x390000 end_va = 0x517fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000390000" filename = "" Region: id = 1475 start_va = 0x520000 end_va = 0x520fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000520000" filename = "" Region: id = 1476 start_va = 0x530000 end_va = 0x53ffff entry_point = 0x0 region_type = private name = "private_0x0000000000530000" filename = "" Region: id = 1477 start_va = 0x540000 end_va = 0x6c0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000540000" filename = "" Region: id = 1478 start_va = 0x6d0000 end_va = 0x78ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000006d0000" filename = "" Region: id = 1479 start_va = 0x790000 end_va = 0xb82fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000790000" filename = "" Region: id = 1480 start_va = 0xc90000 end_va = 0xd0ffff entry_point = 0x0 region_type = private name = "private_0x0000000000c90000" filename = "" Region: id = 1481 start_va = 0xd80000 end_va = 0xdfffff entry_point = 0x0 region_type = private name = "private_0x0000000000d80000" filename = "" Region: id = 1482 start_va = 0xe20000 end_va = 0xe9ffff entry_point = 0x0 region_type = private name = "private_0x0000000000e20000" filename = "" Region: id = 1483 start_va = 0xed0000 end_va = 0xf4ffff entry_point = 0x0 region_type = private name = "private_0x0000000000ed0000" filename = "" Region: id = 1484 start_va = 0xf50000 end_va = 0x121efff entry_point = 0xf50000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 1485 start_va = 0x1270000 end_va = 0x12effff entry_point = 0x0 region_type = private name = "private_0x0000000001270000" filename = "" Region: id = 1486 start_va = 0x1440000 end_va = 0x14bffff entry_point = 0x0 region_type = private name = "private_0x0000000001440000" filename = "" Region: id = 1487 start_va = 0x776b0000 end_va = 0x777a9fff entry_point = 0x776b0000 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 1488 start_va = 0x777b0000 end_va = 0x778cefff entry_point = 0x777b0000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 1489 start_va = 0x778d0000 end_va = 0x77a78fff entry_point = 0x778d0000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 1490 start_va = 0x7efe0000 end_va = 0x7f0dffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 1491 start_va = 0x7f0e0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 1492 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 1493 start_va = 0xff1a0000 end_va = 0xff32afff entry_point = 0xff1a0000 region_type = mapped_file name = "vssvc.exe" filename = "\\Windows\\System32\\VSSVC.exe" (normalized: "c:\\windows\\system32\\vssvc.exe") Region: id = 1494 start_va = 0x7fef3ae0000 end_va = 0x7fef3af3fff entry_point = 0x7fef3ae0000 region_type = mapped_file name = "xolehlp.dll" filename = "\\Windows\\System32\\xolehlp.dll" (normalized: "c:\\windows\\system32\\xolehlp.dll") Region: id = 1495 start_va = 0x7fef3c60000 end_va = 0x7fef3c73fff entry_point = 0x7fef3c60000 region_type = mapped_file name = "vss_ps.dll" filename = "\\Windows\\System32\\vss_ps.dll" (normalized: "c:\\windows\\system32\\vss_ps.dll") Region: id = 1496 start_va = 0x7fef59f0000 end_va = 0x7fef59f9fff entry_point = 0x7fef59f0000 region_type = mapped_file name = "virtdisk.dll" filename = "\\Windows\\System32\\virtdisk.dll" (normalized: "c:\\windows\\system32\\virtdisk.dll") Region: id = 1497 start_va = 0x7fef7f00000 end_va = 0x7fef7f18fff entry_point = 0x7fef7f00000 region_type = mapped_file name = "resutils.dll" filename = "\\Windows\\System32\\resutils.dll" (normalized: "c:\\windows\\system32\\resutils.dll") Region: id = 1498 start_va = 0x7fef7f20000 end_va = 0x7fef7f6ffff entry_point = 0x7fef7f20000 region_type = mapped_file name = "clusapi.dll" filename = "\\Windows\\System32\\clusapi.dll" (normalized: "c:\\windows\\system32\\clusapi.dll") Region: id = 1499 start_va = 0x7fef8360000 end_va = 0x7fef8368fff entry_point = 0x7fef8360000 region_type = mapped_file name = "fltlib.dll" filename = "\\Windows\\System32\\fltLib.dll" (normalized: "c:\\windows\\system32\\fltlib.dll") Region: id = 1500 start_va = 0x7fefa8d0000 end_va = 0x7fefa8e6fff entry_point = 0x7fefa8d0000 region_type = mapped_file name = "vsstrace.dll" filename = "\\Windows\\System32\\vsstrace.dll" (normalized: "c:\\windows\\system32\\vsstrace.dll") Region: id = 1501 start_va = 0x7fefa8f0000 end_va = 0x7fefaa9ffff entry_point = 0x7fefa8f0000 region_type = mapped_file name = "vssapi.dll" filename = "\\Windows\\System32\\vssapi.dll" (normalized: "c:\\windows\\system32\\vssapi.dll") Region: id = 1502 start_va = 0x7fefb2d0000 end_va = 0x7fefb2e8fff entry_point = 0x7fefb2d0000 region_type = mapped_file name = "atl.dll" filename = "\\Windows\\System32\\atl.dll" (normalized: "c:\\windows\\system32\\atl.dll") Region: id = 1503 start_va = 0x7fefb9f0000 end_va = 0x7fefba03fff entry_point = 0x7fefb9f0000 region_type = mapped_file name = "samcli.dll" filename = "\\Windows\\System32\\samcli.dll" (normalized: "c:\\windows\\system32\\samcli.dll") Region: id = 1504 start_va = 0x7fefba10000 end_va = 0x7fefba24fff entry_point = 0x7fefba10000 region_type = mapped_file name = "wkscli.dll" filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll") Region: id = 1505 start_va = 0x7fefba30000 end_va = 0x7fefba3bfff entry_point = 0x7fefba30000 region_type = mapped_file name = "netutils.dll" filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll") Region: id = 1506 start_va = 0x7fefba40000 end_va = 0x7fefba55fff entry_point = 0x7fefba40000 region_type = mapped_file name = "netapi32.dll" filename = "\\Windows\\System32\\netapi32.dll" (normalized: "c:\\windows\\system32\\netapi32.dll") Region: id = 1507 start_va = 0x7fefc9e0000 end_va = 0x7fefc9ebfff entry_point = 0x7fefc9e0000 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 1508 start_va = 0x7fefce10000 end_va = 0x7fefce56fff entry_point = 0x7fefce10000 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 1509 start_va = 0x7fefd110000 end_va = 0x7fefd126fff entry_point = 0x7fefd110000 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 1510 start_va = 0x7fefd300000 end_va = 0x7fefd32efff entry_point = 0x7fefd300000 region_type = mapped_file name = "authz.dll" filename = "\\Windows\\System32\\authz.dll" (normalized: "c:\\windows\\system32\\authz.dll") Region: id = 1511 start_va = 0x7fefd3b0000 end_va = 0x7fefd3c3fff entry_point = 0x7fefd3b0000 region_type = mapped_file name = "cryptdll.dll" filename = "\\Windows\\System32\\cryptdll.dll" (normalized: "c:\\windows\\system32\\cryptdll.dll") Region: id = 1512 start_va = 0x7fefd610000 end_va = 0x7fefd632fff entry_point = 0x7fefd610000 region_type = mapped_file name = "srvcli.dll" filename = "\\Windows\\System32\\srvcli.dll" (normalized: "c:\\windows\\system32\\srvcli.dll") Region: id = 1513 start_va = 0x7fefd710000 end_va = 0x7fefd71efff entry_point = 0x7fefd710000 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 1514 start_va = 0x7fefd800000 end_va = 0x7fefd813fff entry_point = 0x7fefd800000 region_type = mapped_file name = "rpcrtremote.dll" filename = "\\Windows\\System32\\RpcRtRemote.dll" (normalized: "c:\\windows\\system32\\rpcrtremote.dll") Region: id = 1515 start_va = 0x7fefd8d0000 end_va = 0x7fefd93afff entry_point = 0x7fefd8d0000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 1516 start_va = 0x7fefdab0000 end_va = 0x7fefdae5fff entry_point = 0x7fefdab0000 region_type = mapped_file name = "cfgmgr32.dll" filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll") Region: id = 1517 start_va = 0x7fefdaf0000 end_va = 0x7fefdb09fff entry_point = 0x7fefdaf0000 region_type = mapped_file name = "devobj.dll" filename = "\\Windows\\System32\\devobj.dll" (normalized: "c:\\windows\\system32\\devobj.dll") Region: id = 1518 start_va = 0x7fefdec0000 end_va = 0x7fefdecdfff entry_point = 0x7fefdec0000 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 1519 start_va = 0x7fefded0000 end_va = 0x7fefdfa6fff entry_point = 0x7fefded0000 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 1520 start_va = 0x7fefdfb0000 end_va = 0x7fefdfddfff entry_point = 0x7fefdfb0000 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 1521 start_va = 0x7fefe100000 end_va = 0x7fefe166fff entry_point = 0x7fefe100000 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 1522 start_va = 0x7fefe170000 end_va = 0x7fefe20efff entry_point = 0x7fefe170000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 1523 start_va = 0x7fefe210000 end_va = 0x7fefe318fff entry_point = 0x7fefe210000 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 1524 start_va = 0x7fefe320000 end_va = 0x7fefe3e8fff entry_point = 0x7fefe320000 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 1525 start_va = 0x7fefe3f0000 end_va = 0x7fefe4cafff entry_point = 0x7fefe3f0000 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 1526 start_va = 0x7fefe4d0000 end_va = 0x7fefe5fcfff entry_point = 0x7fefe4d0000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 1527 start_va = 0x7fefe600000 end_va = 0x7fefe698fff entry_point = 0x7fefe600000 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 1528 start_va = 0x7fefe900000 end_va = 0x7fefe970fff entry_point = 0x7fefe900000 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 1529 start_va = 0x7fefea30000 end_va = 0x7fefea4efff entry_point = 0x7fefea30000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 1530 start_va = 0x7fefea50000 end_va = 0x7fefec26fff entry_point = 0x7fefea50000 region_type = mapped_file name = "setupapi.dll" filename = "\\Windows\\System32\\setupapi.dll" (normalized: "c:\\windows\\system32\\setupapi.dll") Region: id = 1531 start_va = 0x7feff9d0000 end_va = 0x7feffbd2fff entry_point = 0x7feff9d0000 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 1532 start_va = 0x7feffbf0000 end_va = 0x7feffbf0fff entry_point = 0x7feffbf0000 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 1533 start_va = 0x7fffffae000 end_va = 0x7fffffaffff entry_point = 0x0 region_type = private name = "private_0x000007fffffae000" filename = "" Region: id = 1534 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 1535 start_va = 0x7fffffd3000 end_va = 0x7fffffd4fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd3000" filename = "" Region: id = 1536 start_va = 0x7fffffd5000 end_va = 0x7fffffd6fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd5000" filename = "" Region: id = 1537 start_va = 0x7fffffd7000 end_va = 0x7fffffd8fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd7000" filename = "" Region: id = 1538 start_va = 0x7fffffd9000 end_va = 0x7fffffdafff entry_point = 0x0 region_type = private name = "private_0x000007fffffd9000" filename = "" Region: id = 1539 start_va = 0x7fffffdb000 end_va = 0x7fffffdcfff entry_point = 0x0 region_type = private name = "private_0x000007fffffdb000" filename = "" Region: id = 1540 start_va = 0x7fffffdd000 end_va = 0x7fffffddfff entry_point = 0x0 region_type = private name = "private_0x000007fffffdd000" filename = "" Region: id = 1541 start_va = 0x7fffffde000 end_va = 0x7fffffdffff entry_point = 0x0 region_type = private name = "private_0x000007fffffde000" filename = "" Region: id = 1542 start_va = 0x7fefc2d0000 end_va = 0x7fefc2ecfff entry_point = 0x7fefc2d0000 region_type = mapped_file name = "samlib.dll" filename = "\\Windows\\System32\\samlib.dll" (normalized: "c:\\windows\\system32\\samlib.dll") Region: id = 1543 start_va = 0xb90000 end_va = 0xb90fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000b90000" filename = "" Region: id = 1544 start_va = 0x7fefb230000 end_va = 0x7fefb296fff entry_point = 0x7fefb230000 region_type = mapped_file name = "es.dll" filename = "\\Windows\\System32\\es.dll" (normalized: "c:\\windows\\system32\\es.dll") Region: id = 1672 start_va = 0x7fefc1a0000 end_va = 0x7fefc2cbfff entry_point = 0x7fefc1a0000 region_type = mapped_file name = "propsys.dll" filename = "\\Windows\\System32\\propsys.dll" (normalized: "c:\\windows\\system32\\propsys.dll") Region: id = 1733 start_va = 0x7fef3480000 end_va = 0x7fef3504fff entry_point = 0x7fef3480000 region_type = mapped_file name = "catsrvut.dll" filename = "\\Windows\\System32\\catsrvut.dll" (normalized: "c:\\windows\\system32\\catsrvut.dll") Region: id = 1734 start_va = 0x7fef3ad0000 end_va = 0x7fef3adbfff entry_point = 0x7fef3ad0000 region_type = mapped_file name = "mfcsubs.dll" filename = "\\Windows\\System32\\mfcsubs.dll" (normalized: "c:\\windows\\system32\\mfcsubs.dll") Thread: id = 43 os_tid = 0x804 Thread: id = 44 os_tid = 0x328 Thread: id = 45 os_tid = 0xbfc Thread: id = 46 os_tid = 0xbf8 Thread: id = 47 os_tid = 0xbf4 Thread: id = 48 os_tid = 0xbf0 Thread: id = 49 os_tid = 0x814 Thread: id = 65 os_tid = 0x870 Thread: id = 72 os_tid = 0x8b0 Process: id = "7" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x974a000" os_pid = "0xf0" os_integrity_level = "0x4000" os_privileges = "0x60801000" monitor_reason = "rpc_server" parent_id = "6" os_parent_pid = "0xbec" cmd_line = "C:\\Windows\\system32\\svchost.exe -k LocalService" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\Local Service" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\EventSystem" [0xe], "NT SERVICE\\fdPHost" [0xa], "NT SERVICE\\lltdsvc" [0xa], "NT SERVICE\\netprofm" [0xa], "NT SERVICE\\nsi" [0xa], "NT SERVICE\\sppuinotify" [0xa], "NT SERVICE\\SstpSvc" [0xa], "NT SERVICE\\THREADORDER" [0xa], "NT SERVICE\\W32Time" [0xa], "NT SERVICE\\WdiServiceHost" [0xa], "NT SERVICE\\WebClient" [0xa], "NT SERVICE\\WinHttpAutoProxySvc" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000dbbc" [0xc000000f], "LOCAL" [0x7] Region: id = 1545 start_va = 0x10000 end_va = 0x1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 1546 start_va = 0x20000 end_va = 0x26fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000020000" filename = "" Region: id = 1547 start_va = 0x30000 end_va = 0x33fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 1548 start_va = 0x40000 end_va = 0x40fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 1549 start_va = 0x50000 end_va = 0xb6fff entry_point = 0x50000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 1550 start_va = 0xc0000 end_va = 0xc1fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000c0000" filename = "" Region: id = 1551 start_va = 0xd0000 end_va = 0xd0fff entry_point = 0x0 region_type = private name = "private_0x00000000000d0000" filename = "" Region: id = 1552 start_va = 0xe0000 end_va = 0xe0fff entry_point = 0x0 region_type = private name = "private_0x00000000000e0000" filename = "" Region: id = 1553 start_va = 0xf0000 end_va = 0xf0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000f0000" filename = "" Region: id = 1554 start_va = 0x130000 end_va = 0x131fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000130000" filename = "" Region: id = 1555 start_va = 0x140000 end_va = 0x140fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000140000" filename = "" Region: id = 1556 start_va = 0x150000 end_va = 0x150fff entry_point = 0x0 region_type = private name = "private_0x0000000000150000" filename = "" Region: id = 1557 start_va = 0x170000 end_va = 0x1effff entry_point = 0x0 region_type = private name = "private_0x0000000000170000" filename = "" Region: id = 1558 start_va = 0x1f0000 end_va = 0x2effff entry_point = 0x0 region_type = private name = "private_0x00000000001f0000" filename = "" Region: id = 1559 start_va = 0x310000 end_va = 0x40ffff entry_point = 0x0 region_type = private name = "private_0x0000000000310000" filename = "" Region: id = 1560 start_va = 0x410000 end_va = 0x4cffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000410000" filename = "" Region: id = 1561 start_va = 0x560000 end_va = 0x56ffff entry_point = 0x0 region_type = private name = "private_0x0000000000560000" filename = "" Region: id = 1562 start_va = 0x570000 end_va = 0x6f7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000570000" filename = "" Region: id = 1563 start_va = 0x700000 end_va = 0x880fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000700000" filename = "" Region: id = 1564 start_va = 0x890000 end_va = 0xc82fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000890000" filename = "" Region: id = 1565 start_va = 0xd60000 end_va = 0xddffff entry_point = 0x0 region_type = private name = "private_0x0000000000d60000" filename = "" Region: id = 1566 start_va = 0xe00000 end_va = 0xe7ffff entry_point = 0x0 region_type = private name = "private_0x0000000000e00000" filename = "" Region: id = 1567 start_va = 0xf00000 end_va = 0xf7ffff entry_point = 0x0 region_type = private name = "private_0x0000000000f00000" filename = "" Region: id = 1568 start_va = 0xf80000 end_va = 0x124efff entry_point = 0xf80000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 1569 start_va = 0x1420000 end_va = 0x149ffff entry_point = 0x0 region_type = private name = "private_0x0000000001420000" filename = "" Region: id = 1570 start_va = 0x14a0000 end_va = 0x159ffff entry_point = 0x0 region_type = private name = "private_0x00000000014a0000" filename = "" Region: id = 1571 start_va = 0x15b0000 end_va = 0x162ffff entry_point = 0x0 region_type = private name = "private_0x00000000015b0000" filename = "" Region: id = 1572 start_va = 0x1630000 end_va = 0x16affff entry_point = 0x0 region_type = private name = "private_0x0000000001630000" filename = "" Region: id = 1573 start_va = 0x16c0000 end_va = 0x17bffff entry_point = 0x0 region_type = private name = "private_0x00000000016c0000" filename = "" Region: id = 1574 start_va = 0x1830000 end_va = 0x18affff entry_point = 0x0 region_type = private name = "private_0x0000000001830000" filename = "" Region: id = 1575 start_va = 0x1980000 end_va = 0x19fffff entry_point = 0x0 region_type = private name = "private_0x0000000001980000" filename = "" Region: id = 1576 start_va = 0x1a00000 end_va = 0x1a0ffff entry_point = 0x0 region_type = private name = "private_0x0000000001a00000" filename = "" Region: id = 1577 start_va = 0x1a20000 end_va = 0x1a9ffff entry_point = 0x0 region_type = private name = "private_0x0000000001a20000" filename = "" Region: id = 1578 start_va = 0x1ab0000 end_va = 0x1b2ffff entry_point = 0x0 region_type = private name = "private_0x0000000001ab0000" filename = "" Region: id = 1579 start_va = 0x1b40000 end_va = 0x1bbffff entry_point = 0x0 region_type = private name = "private_0x0000000001b40000" filename = "" Region: id = 1580 start_va = 0x1bc0000 end_va = 0x1cbffff entry_point = 0x0 region_type = private name = "private_0x0000000001bc0000" filename = "" Region: id = 1581 start_va = 0x1cc0000 end_va = 0x1ccffff entry_point = 0x0 region_type = private name = "private_0x0000000001cc0000" filename = "" Region: id = 1582 start_va = 0x1cd0000 end_va = 0x1d8ffff entry_point = 0x1cd0000 region_type = mapped_file name = "kernelbase.dll.mui" filename = "\\Windows\\System32\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\kernelbase.dll.mui") Region: id = 1583 start_va = 0x1e00000 end_va = 0x1e7ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e00000" filename = "" Region: id = 1584 start_va = 0x1ec0000 end_va = 0x1f3ffff entry_point = 0x0 region_type = private name = "private_0x0000000001ec0000" filename = "" Region: id = 1585 start_va = 0x2080000 end_va = 0x20fffff entry_point = 0x0 region_type = private name = "private_0x0000000002080000" filename = "" Region: id = 1586 start_va = 0x2120000 end_va = 0x212ffff entry_point = 0x0 region_type = private name = "private_0x0000000002120000" filename = "" Region: id = 1587 start_va = 0x2300000 end_va = 0x237ffff entry_point = 0x0 region_type = private name = "private_0x0000000002300000" filename = "" Region: id = 1588 start_va = 0x2380000 end_va = 0x257ffff entry_point = 0x0 region_type = private name = "private_0x0000000002380000" filename = "" Region: id = 1589 start_va = 0x740c0000 end_va = 0x740c2fff entry_point = 0x740c0000 region_type = mapped_file name = "sfc.dll" filename = "\\Windows\\System32\\sfc.dll" (normalized: "c:\\windows\\system32\\sfc.dll") Region: id = 1590 start_va = 0x776b0000 end_va = 0x777a9fff entry_point = 0x776b0000 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 1591 start_va = 0x777b0000 end_va = 0x778cefff entry_point = 0x777b0000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 1592 start_va = 0x778d0000 end_va = 0x77a78fff entry_point = 0x778d0000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 1593 start_va = 0x7efe0000 end_va = 0x7f0dffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 1594 start_va = 0x7f0e0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 1595 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 1596 start_va = 0xff860000 end_va = 0xff86afff entry_point = 0xff860000 region_type = mapped_file name = "svchost.exe" filename = "\\Windows\\System32\\svchost.exe" (normalized: "c:\\windows\\system32\\svchost.exe") Region: id = 1597 start_va = 0x7fef6340000 end_va = 0x7fef634bfff entry_point = 0x7fef6340000 region_type = mapped_file name = "npmproxy.dll" filename = "\\Windows\\System32\\npmproxy.dll" (normalized: "c:\\windows\\system32\\npmproxy.dll") Region: id = 1598 start_va = 0x7fef63e0000 end_va = 0x7fef64b7fff entry_point = 0x7fef63e0000 region_type = mapped_file name = "perftrack.dll" filename = "\\Windows\\System32\\perftrack.dll" (normalized: "c:\\windows\\system32\\perftrack.dll") Region: id = 1599 start_va = 0x7fef6900000 end_va = 0x7fef6973fff entry_point = 0x7fef6900000 region_type = mapped_file name = "netprofm.dll" filename = "\\Windows\\System32\\netprofm.dll" (normalized: "c:\\windows\\system32\\netprofm.dll") Region: id = 1600 start_va = 0x7fef7600000 end_va = 0x7fef7607fff entry_point = 0x7fef7600000 region_type = mapped_file name = "rasadhlp.dll" filename = "\\Windows\\System32\\rasadhlp.dll" (normalized: "c:\\windows\\system32\\rasadhlp.dll") Region: id = 1601 start_va = 0x7fef7ad0000 end_va = 0x7fef7b4bfff entry_point = 0x7fef7ad0000 region_type = mapped_file name = "wer.dll" filename = "\\Windows\\System32\\wer.dll" (normalized: "c:\\windows\\system32\\wer.dll") Region: id = 1602 start_va = 0x7fef8300000 end_va = 0x7fef8317fff entry_point = 0x7fef8300000 region_type = mapped_file name = "vmictimeprovider.dll" filename = "\\Windows\\System32\\vmictimeprovider.dll" (normalized: "c:\\windows\\system32\\vmictimeprovider.dll") Region: id = 1603 start_va = 0x7fef8370000 end_va = 0x7fef83cffff entry_point = 0x7fef8370000 region_type = mapped_file name = "w32time.dll" filename = "\\Windows\\System32\\w32time.dll" (normalized: "c:\\windows\\system32\\w32time.dll") Region: id = 1604 start_va = 0x7fef8c20000 end_va = 0x7fef8c2ffff entry_point = 0x7fef8c20000 region_type = mapped_file name = "sfc_os.dll" filename = "\\Windows\\System32\\sfc_os.dll" (normalized: "c:\\windows\\system32\\sfc_os.dll") Region: id = 1605 start_va = 0x7fef8c30000 end_va = 0x7fef8c41fff entry_point = 0x7fef8c30000 region_type = mapped_file name = "aepic.dll" filename = "\\Windows\\System32\\aepic.dll" (normalized: "c:\\windows\\system32\\aepic.dll") Region: id = 1606 start_va = 0x7fefa710000 end_va = 0x7fefa728fff entry_point = 0x7fefa710000 region_type = mapped_file name = "wdi.dll" filename = "\\Windows\\System32\\wdi.dll" (normalized: "c:\\windows\\system32\\wdi.dll") Region: id = 1607 start_va = 0x7fefa750000 end_va = 0x7fefa7b3fff entry_point = 0x7fefa750000 region_type = mapped_file name = "webio.dll" filename = "\\Windows\\System32\\webio.dll" (normalized: "c:\\windows\\system32\\webio.dll") Region: id = 1608 start_va = 0x7fefa7c0000 end_va = 0x7fefa830fff entry_point = 0x7fefa7c0000 region_type = mapped_file name = "winhttp.dll" filename = "\\Windows\\System32\\winhttp.dll" (normalized: "c:\\windows\\system32\\winhttp.dll") Region: id = 1609 start_va = 0x7fefb010000 end_va = 0x7fefb027fff entry_point = 0x7fefb010000 region_type = mapped_file name = "dhcpcsvc.dll" filename = "\\Windows\\System32\\dhcpcsvc.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc.dll") Region: id = 1610 start_va = 0x7fefb030000 end_va = 0x7fefb040fff entry_point = 0x7fefb030000 region_type = mapped_file name = "dhcpcsvc6.dll" filename = "\\Windows\\System32\\dhcpcsvc6.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc6.dll") Region: id = 1611 start_va = 0x7fefb060000 end_va = 0x7fefb0b2fff entry_point = 0x7fefb060000 region_type = mapped_file name = "fwpuclnt.dll" filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll") Region: id = 1612 start_va = 0x7fefb190000 end_va = 0x7fefb199fff entry_point = 0x7fefb190000 region_type = mapped_file name = "nsisvc.dll" filename = "\\Windows\\System32\\nsisvc.dll" (normalized: "c:\\windows\\system32\\nsisvc.dll") Region: id = 1613 start_va = 0x7fefb1b0000 end_va = 0x7fefb1bafff entry_point = 0x7fefb1b0000 region_type = mapped_file name = "winnsi.dll" filename = "\\Windows\\System32\\winnsi.dll" (normalized: "c:\\windows\\system32\\winnsi.dll") Region: id = 1614 start_va = 0x7fefb1c0000 end_va = 0x7fefb1e6fff entry_point = 0x7fefb1c0000 region_type = mapped_file name = "iphlpapi.dll" filename = "\\Windows\\System32\\IPHLPAPI.DLL" (normalized: "c:\\windows\\system32\\iphlpapi.dll") Region: id = 1615 start_va = 0x7fefb230000 end_va = 0x7fefb296fff entry_point = 0x7fefb230000 region_type = mapped_file name = "es.dll" filename = "\\Windows\\System32\\es.dll" (normalized: "c:\\windows\\system32\\es.dll") Region: id = 1616 start_va = 0x7fefb2b0000 end_va = 0x7fefb2bbfff entry_point = 0x7fefb2b0000 region_type = mapped_file name = "dsrole.dll" filename = "\\Windows\\System32\\dsrole.dll" (normalized: "c:\\windows\\system32\\dsrole.dll") Region: id = 1617 start_va = 0x7fefb370000 end_va = 0x7fefb384fff entry_point = 0x7fefb370000 region_type = mapped_file name = "nlaapi.dll" filename = "\\Windows\\System32\\nlaapi.dll" (normalized: "c:\\windows\\system32\\nlaapi.dll") Region: id = 1618 start_va = 0x7fefbb20000 end_va = 0x7fefbb2afff entry_point = 0x7fefbb20000 region_type = mapped_file name = "winrnr.dll" filename = "\\Windows\\System32\\winrnr.dll" (normalized: "c:\\windows\\system32\\winrnr.dll") Region: id = 1619 start_va = 0x7fefbb30000 end_va = 0x7fefbb48fff entry_point = 0x7fefbb30000 region_type = mapped_file name = "pnrpnsp.dll" filename = "\\Windows\\System32\\pnrpnsp.dll" (normalized: "c:\\windows\\system32\\pnrpnsp.dll") Region: id = 1620 start_va = 0x7fefbb50000 end_va = 0x7fefbb64fff entry_point = 0x7fefbb50000 region_type = mapped_file name = "napinsp.dll" filename = "\\Windows\\System32\\NapiNSP.dll" (normalized: "c:\\windows\\system32\\napinsp.dll") Region: id = 1621 start_va = 0x7fefbd10000 end_va = 0x7fefbd27fff entry_point = 0x7fefbd10000 region_type = mapped_file name = "dwmapi.dll" filename = "\\Windows\\System32\\dwmapi.dll" (normalized: "c:\\windows\\system32\\dwmapi.dll") Region: id = 1622 start_va = 0x7fefc9e0000 end_va = 0x7fefc9ebfff entry_point = 0x7fefc9e0000 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 1623 start_va = 0x7fefcab0000 end_va = 0x7fefcab6fff entry_point = 0x7fefcab0000 region_type = mapped_file name = "wshtcpip.dll" filename = "\\Windows\\System32\\WSHTCPIP.DLL" (normalized: "c:\\windows\\system32\\wshtcpip.dll") Region: id = 1624 start_va = 0x7fefcba0000 end_va = 0x7fefcbbafff entry_point = 0x7fefcba0000 region_type = mapped_file name = "gpapi.dll" filename = "\\Windows\\System32\\gpapi.dll" (normalized: "c:\\windows\\system32\\gpapi.dll") Region: id = 1625 start_va = 0x7fefcbc0000 end_va = 0x7fefcbddfff entry_point = 0x7fefcbc0000 region_type = mapped_file name = "userenv.dll" filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll") Region: id = 1626 start_va = 0x7fefcd10000 end_va = 0x7fefcd19fff entry_point = 0x7fefcd10000 region_type = mapped_file name = "credssp.dll" filename = "\\Windows\\System32\\credssp.dll" (normalized: "c:\\windows\\system32\\credssp.dll") Region: id = 1627 start_va = 0x7fefce10000 end_va = 0x7fefce56fff entry_point = 0x7fefce10000 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 1628 start_va = 0x7fefcf00000 end_va = 0x7fefcf2ffff entry_point = 0x7fefcf00000 region_type = mapped_file name = "logoncli.dll" filename = "\\Windows\\System32\\logoncli.dll" (normalized: "c:\\windows\\system32\\logoncli.dll") Region: id = 1629 start_va = 0x7fefcf30000 end_va = 0x7fefcf8afff entry_point = 0x7fefcf30000 region_type = mapped_file name = "dnsapi.dll" filename = "\\Windows\\System32\\dnsapi.dll" (normalized: "c:\\windows\\system32\\dnsapi.dll") Region: id = 1630 start_va = 0x7fefd0a0000 end_va = 0x7fefd0a6fff entry_point = 0x7fefd0a0000 region_type = mapped_file name = "wship6.dll" filename = "\\Windows\\System32\\wship6.dll" (normalized: "c:\\windows\\system32\\wship6.dll") Region: id = 1631 start_va = 0x7fefd0b0000 end_va = 0x7fefd104fff entry_point = 0x7fefd0b0000 region_type = mapped_file name = "mswsock.dll" filename = "\\Windows\\System32\\mswsock.dll" (normalized: "c:\\windows\\system32\\mswsock.dll") Region: id = 1632 start_va = 0x7fefd110000 end_va = 0x7fefd126fff entry_point = 0x7fefd110000 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 1633 start_va = 0x7fefd3b0000 end_va = 0x7fefd3c3fff entry_point = 0x7fefd3b0000 region_type = mapped_file name = "cryptdll.dll" filename = "\\Windows\\System32\\cryptdll.dll" (normalized: "c:\\windows\\system32\\cryptdll.dll") Region: id = 1634 start_va = 0x7fefd6b0000 end_va = 0x7fefd6bafff entry_point = 0x7fefd6b0000 region_type = mapped_file name = "secur32.dll" filename = "\\Windows\\System32\\secur32.dll" (normalized: "c:\\windows\\system32\\secur32.dll") Region: id = 1635 start_va = 0x7fefd6e0000 end_va = 0x7fefd704fff entry_point = 0x7fefd6e0000 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 1636 start_va = 0x7fefd710000 end_va = 0x7fefd71efff entry_point = 0x7fefd710000 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 1637 start_va = 0x7fefd720000 end_va = 0x7fefd7b0fff entry_point = 0x7fefd720000 region_type = mapped_file name = "sxs.dll" filename = "\\Windows\\System32\\sxs.dll" (normalized: "c:\\windows\\system32\\sxs.dll") Region: id = 1638 start_va = 0x7fefd800000 end_va = 0x7fefd813fff entry_point = 0x7fefd800000 region_type = mapped_file name = "rpcrtremote.dll" filename = "\\Windows\\System32\\RpcRtRemote.dll" (normalized: "c:\\windows\\system32\\rpcrtremote.dll") Region: id = 1639 start_va = 0x7fefd820000 end_va = 0x7fefd82efff entry_point = 0x7fefd820000 region_type = mapped_file name = "profapi.dll" filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll") Region: id = 1640 start_va = 0x7fefd8d0000 end_va = 0x7fefd93afff entry_point = 0x7fefd8d0000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 1641 start_va = 0x7fefdec0000 end_va = 0x7fefdecdfff entry_point = 0x7fefdec0000 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 1642 start_va = 0x7fefded0000 end_va = 0x7fefdfa6fff entry_point = 0x7fefded0000 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 1643 start_va = 0x7fefdfb0000 end_va = 0x7fefdfddfff entry_point = 0x7fefdfb0000 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 1644 start_va = 0x7fefe100000 end_va = 0x7fefe166fff entry_point = 0x7fefe100000 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 1645 start_va = 0x7fefe170000 end_va = 0x7fefe20efff entry_point = 0x7fefe170000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 1646 start_va = 0x7fefe210000 end_va = 0x7fefe318fff entry_point = 0x7fefe210000 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 1647 start_va = 0x7fefe320000 end_va = 0x7fefe3e8fff entry_point = 0x7fefe320000 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 1648 start_va = 0x7fefe3f0000 end_va = 0x7fefe4cafff entry_point = 0x7fefe3f0000 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 1649 start_va = 0x7fefe4d0000 end_va = 0x7fefe5fcfff entry_point = 0x7fefe4d0000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 1650 start_va = 0x7fefe600000 end_va = 0x7fefe698fff entry_point = 0x7fefe600000 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 1651 start_va = 0x7fefe900000 end_va = 0x7fefe970fff entry_point = 0x7fefe900000 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 1652 start_va = 0x7fefe980000 end_va = 0x7fefe9ccfff entry_point = 0x7fefe980000 region_type = mapped_file name = "ws2_32.dll" filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll") Region: id = 1653 start_va = 0x7fefea30000 end_va = 0x7fefea4efff entry_point = 0x7fefea30000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 1654 start_va = 0x7feff9c0000 end_va = 0x7feff9c7fff entry_point = 0x7feff9c0000 region_type = mapped_file name = "nsi.dll" filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll") Region: id = 1655 start_va = 0x7feff9d0000 end_va = 0x7feffbd2fff entry_point = 0x7feff9d0000 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 1656 start_va = 0x7feffbf0000 end_va = 0x7feffbf0fff entry_point = 0x7feffbf0000 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 1657 start_va = 0x7fffff9a000 end_va = 0x7fffff9bfff entry_point = 0x0 region_type = private name = "private_0x000007fffff9a000" filename = "" Region: id = 1658 start_va = 0x7fffff9c000 end_va = 0x7fffff9dfff entry_point = 0x0 region_type = private name = "private_0x000007fffff9c000" filename = "" Region: id = 1659 start_va = 0x7fffff9e000 end_va = 0x7fffff9ffff entry_point = 0x0 region_type = private name = "private_0x000007fffff9e000" filename = "" Region: id = 1660 start_va = 0x7fffffa0000 end_va = 0x7fffffa1fff entry_point = 0x0 region_type = private name = "private_0x000007fffffa0000" filename = "" Region: id = 1661 start_va = 0x7fffffa2000 end_va = 0x7fffffa3fff entry_point = 0x0 region_type = private name = "private_0x000007fffffa2000" filename = "" Region: id = 1662 start_va = 0x7fffffa4000 end_va = 0x7fffffa5fff entry_point = 0x0 region_type = private name = "private_0x000007fffffa4000" filename = "" Region: id = 1663 start_va = 0x7fffffa6000 end_va = 0x7fffffa7fff entry_point = 0x0 region_type = private name = "private_0x000007fffffa6000" filename = "" Region: id = 1664 start_va = 0x7fffffa8000 end_va = 0x7fffffa9fff entry_point = 0x0 region_type = private name = "private_0x000007fffffa8000" filename = "" Region: id = 1665 start_va = 0x7fffffae000 end_va = 0x7fffffaffff entry_point = 0x0 region_type = private name = "private_0x000007fffffae000" filename = "" Region: id = 1666 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 1667 start_va = 0x7fffffd5000 end_va = 0x7fffffd5fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd5000" filename = "" Region: id = 1668 start_va = 0x7fffffd8000 end_va = 0x7fffffd9fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd8000" filename = "" Region: id = 1669 start_va = 0x7fffffda000 end_va = 0x7fffffdbfff entry_point = 0x0 region_type = private name = "private_0x000007fffffda000" filename = "" Region: id = 1670 start_va = 0x7fffffdc000 end_va = 0x7fffffddfff entry_point = 0x0 region_type = private name = "private_0x000007fffffdc000" filename = "" Region: id = 1671 start_va = 0x7fffffde000 end_va = 0x7fffffdffff entry_point = 0x0 region_type = private name = "private_0x000007fffffde000" filename = "" Thread: id = 50 os_tid = 0xb50 Thread: id = 51 os_tid = 0x924 Thread: id = 52 os_tid = 0x7f4 Thread: id = 53 os_tid = 0x7ec Thread: id = 54 os_tid = 0x79c Thread: id = 55 os_tid = 0x788 Thread: id = 56 os_tid = 0x76c Thread: id = 57 os_tid = 0x760 Thread: id = 58 os_tid = 0x6f8 Thread: id = 59 os_tid = 0x154 Thread: id = 60 os_tid = 0x128 Thread: id = 61 os_tid = 0x12c Thread: id = 62 os_tid = 0x11c Thread: id = 63 os_tid = 0x660 Thread: id = 64 os_tid = 0x85c Thread: id = 73 os_tid = 0x6c0 Process: id = "8" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x2778000" os_pid = "0x824" os_integrity_level = "0x4000" os_privileges = "0x60814080" monitor_reason = "rpc_server" parent_id = "6" os_parent_pid = "0xbec" cmd_line = "C:\\Windows\\System32\\svchost.exe -k swprv" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\swprv" [0xe], "NT AUTHORITY\\Logon Session 00000000:0004f50e" [0xc000000f], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Region: id = 1735 start_va = 0x10000 end_va = 0x1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 1736 start_va = 0x20000 end_va = 0x26fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000020000" filename = "" Region: id = 1737 start_va = 0x30000 end_va = 0x33fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 1738 start_va = 0x40000 end_va = 0x40fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000040000" filename = "" Region: id = 1739 start_va = 0x50000 end_va = 0x51fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000050000" filename = "" Region: id = 1740 start_va = 0x60000 end_va = 0x60fff entry_point = 0x0 region_type = private name = "private_0x0000000000060000" filename = "" Region: id = 1741 start_va = 0x70000 end_va = 0x70fff entry_point = 0x0 region_type = private name = "private_0x0000000000070000" filename = "" Region: id = 1742 start_va = 0x80000 end_va = 0x80fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000080000" filename = "" Region: id = 1743 start_va = 0x90000 end_va = 0x10ffff entry_point = 0x0 region_type = private name = "private_0x0000000000090000" filename = "" Region: id = 1744 start_va = 0x110000 end_va = 0x176fff entry_point = 0x110000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 1745 start_va = 0x180000 end_va = 0x27ffff entry_point = 0x0 region_type = private name = "private_0x0000000000180000" filename = "" Region: id = 1746 start_va = 0x290000 end_va = 0x29ffff entry_point = 0x0 region_type = private name = "private_0x0000000000290000" filename = "" Region: id = 1747 start_va = 0x2e0000 end_va = 0x3dffff entry_point = 0x0 region_type = private name = "private_0x00000000002e0000" filename = "" Region: id = 1748 start_va = 0x420000 end_va = 0x49ffff entry_point = 0x0 region_type = private name = "private_0x0000000000420000" filename = "" Region: id = 1749 start_va = 0x540000 end_va = 0x5bffff entry_point = 0x0 region_type = private name = "private_0x0000000000540000" filename = "" Region: id = 1750 start_va = 0x5c0000 end_va = 0x747fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005c0000" filename = "" Region: id = 1751 start_va = 0x770000 end_va = 0x7effff entry_point = 0x0 region_type = private name = "private_0x0000000000770000" filename = "" Region: id = 1752 start_va = 0x7f0000 end_va = 0xabefff entry_point = 0x7f0000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 1753 start_va = 0xac0000 end_va = 0xc40fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000ac0000" filename = "" Region: id = 1754 start_va = 0xc50000 end_va = 0xd0ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000c50000" filename = "" Region: id = 1755 start_va = 0xd10000 end_va = 0x1102fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000d10000" filename = "" Region: id = 1756 start_va = 0x1220000 end_va = 0x129ffff entry_point = 0x0 region_type = private name = "private_0x0000000001220000" filename = "" Region: id = 1757 start_va = 0x13b0000 end_va = 0x142ffff entry_point = 0x0 region_type = private name = "private_0x00000000013b0000" filename = "" Region: id = 1758 start_va = 0x776b0000 end_va = 0x777a9fff entry_point = 0x776b0000 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 1759 start_va = 0x777b0000 end_va = 0x778cefff entry_point = 0x777b0000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 1760 start_va = 0x778d0000 end_va = 0x77a78fff entry_point = 0x778d0000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 1761 start_va = 0x7efe0000 end_va = 0x7f0dffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 1762 start_va = 0x7f0e0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 1763 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 1764 start_va = 0xff860000 end_va = 0xff86afff entry_point = 0xff860000 region_type = mapped_file name = "svchost.exe" filename = "\\Windows\\System32\\svchost.exe" (normalized: "c:\\windows\\system32\\svchost.exe") Region: id = 1765 start_va = 0x7fef3510000 end_va = 0x7fef3591fff entry_point = 0x7fef3510000 region_type = mapped_file name = "swprv.dll" filename = "\\Windows\\System32\\swprv.dll" (normalized: "c:\\windows\\system32\\swprv.dll") Region: id = 1766 start_va = 0x7fef3c60000 end_va = 0x7fef3c73fff entry_point = 0x7fef3c60000 region_type = mapped_file name = "vss_ps.dll" filename = "\\Windows\\System32\\vss_ps.dll" (normalized: "c:\\windows\\system32\\vss_ps.dll") Region: id = 1767 start_va = 0x7fef59f0000 end_va = 0x7fef59f9fff entry_point = 0x7fef59f0000 region_type = mapped_file name = "virtdisk.dll" filename = "\\Windows\\System32\\virtdisk.dll" (normalized: "c:\\windows\\system32\\virtdisk.dll") Region: id = 1768 start_va = 0x7fef8360000 end_va = 0x7fef8368fff entry_point = 0x7fef8360000 region_type = mapped_file name = "fltlib.dll" filename = "\\Windows\\System32\\fltLib.dll" (normalized: "c:\\windows\\system32\\fltlib.dll") Region: id = 1769 start_va = 0x7fefa8d0000 end_va = 0x7fefa8e6fff entry_point = 0x7fefa8d0000 region_type = mapped_file name = "vsstrace.dll" filename = "\\Windows\\System32\\vsstrace.dll" (normalized: "c:\\windows\\system32\\vsstrace.dll") Region: id = 1770 start_va = 0x7fefb2d0000 end_va = 0x7fefb2e8fff entry_point = 0x7fefb2d0000 region_type = mapped_file name = "atl.dll" filename = "\\Windows\\System32\\atl.dll" (normalized: "c:\\windows\\system32\\atl.dll") Region: id = 1771 start_va = 0x7fefce10000 end_va = 0x7fefce56fff entry_point = 0x7fefce10000 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 1772 start_va = 0x7fefd110000 end_va = 0x7fefd126fff entry_point = 0x7fefd110000 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 1773 start_va = 0x7fefd710000 end_va = 0x7fefd71efff entry_point = 0x7fefd710000 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 1774 start_va = 0x7fefd800000 end_va = 0x7fefd813fff entry_point = 0x7fefd800000 region_type = mapped_file name = "rpcrtremote.dll" filename = "\\Windows\\System32\\RpcRtRemote.dll" (normalized: "c:\\windows\\system32\\rpcrtremote.dll") Region: id = 1775 start_va = 0x7fefd8d0000 end_va = 0x7fefd93afff entry_point = 0x7fefd8d0000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 1776 start_va = 0x7fefdec0000 end_va = 0x7fefdecdfff entry_point = 0x7fefdec0000 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 1777 start_va = 0x7fefded0000 end_va = 0x7fefdfa6fff entry_point = 0x7fefded0000 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 1778 start_va = 0x7fefdfb0000 end_va = 0x7fefdfddfff entry_point = 0x7fefdfb0000 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 1779 start_va = 0x7fefe100000 end_va = 0x7fefe166fff entry_point = 0x7fefe100000 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 1780 start_va = 0x7fefe170000 end_va = 0x7fefe20efff entry_point = 0x7fefe170000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 1781 start_va = 0x7fefe210000 end_va = 0x7fefe318fff entry_point = 0x7fefe210000 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 1782 start_va = 0x7fefe320000 end_va = 0x7fefe3e8fff entry_point = 0x7fefe320000 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 1783 start_va = 0x7fefe3f0000 end_va = 0x7fefe4cafff entry_point = 0x7fefe3f0000 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 1784 start_va = 0x7fefe4d0000 end_va = 0x7fefe5fcfff entry_point = 0x7fefe4d0000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 1785 start_va = 0x7fefe600000 end_va = 0x7fefe698fff entry_point = 0x7fefe600000 region_type = mapped_file name = "clbcatq.dll" filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll") Region: id = 1786 start_va = 0x7fefea30000 end_va = 0x7fefea4efff entry_point = 0x7fefea30000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 1787 start_va = 0x7feff9d0000 end_va = 0x7feffbd2fff entry_point = 0x7feff9d0000 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 1788 start_va = 0x7feffbf0000 end_va = 0x7feffbf0fff entry_point = 0x7feffbf0000 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 1789 start_va = 0x7fffffae000 end_va = 0x7fffffaffff entry_point = 0x0 region_type = private name = "private_0x000007fffffae000" filename = "" Region: id = 1790 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 1791 start_va = 0x7fffffd4000 end_va = 0x7fffffd5fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd4000" filename = "" Region: id = 1792 start_va = 0x7fffffd6000 end_va = 0x7fffffd6fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd6000" filename = "" Region: id = 1793 start_va = 0x7fffffd8000 end_va = 0x7fffffd9fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd8000" filename = "" Region: id = 1794 start_va = 0x7fffffda000 end_va = 0x7fffffdbfff entry_point = 0x0 region_type = private name = "private_0x000007fffffda000" filename = "" Region: id = 1795 start_va = 0x7fffffdc000 end_va = 0x7fffffddfff entry_point = 0x0 region_type = private name = "private_0x000007fffffdc000" filename = "" Region: id = 1796 start_va = 0x7fffffde000 end_va = 0x7fffffdffff entry_point = 0x0 region_type = private name = "private_0x000007fffffde000" filename = "" Region: id = 1797 start_va = 0x7fefa8f0000 end_va = 0x7fefaa9ffff entry_point = 0x7fefa8f0000 region_type = mapped_file name = "vssapi.dll" filename = "\\Windows\\System32\\vssapi.dll" (normalized: "c:\\windows\\system32\\vssapi.dll") Thread: id = 66 os_tid = 0x86c Thread: id = 67 os_tid = 0x850 Thread: id = 68 os_tid = 0x854 Thread: id = 69 os_tid = 0x858 Thread: id = 70 os_tid = 0x674 Thread: id = 71 os_tid = 0x834 Process: id = "9" image_name = "unlikexpc.exe" filename = "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\unlikexpc.exe" page_root = "0xf566000" os_pid = "0x7a8" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "autostart" parent_id = "0" os_parent_pid = "0x0" cmd_line = "\"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\unlikexpc.exe\" " cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:00015e2b" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 2522 start_va = 0x10000 end_va = 0x2ffff entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 2523 start_va = 0x30000 end_va = 0x31fff entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 2524 start_va = 0x40000 end_va = 0x40fff entry_point = 0x40000 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 2525 start_va = 0x50000 end_va = 0x53fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000050000" filename = "" Region: id = 2526 start_va = 0x60000 end_va = 0x60fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000060000" filename = "" Region: id = 2527 start_va = 0x170000 end_va = 0x1affff entry_point = 0x0 region_type = private name = "private_0x0000000000170000" filename = "" Region: id = 2528 start_va = 0x320000 end_va = 0x41ffff entry_point = 0x0 region_type = private name = "private_0x0000000000320000" filename = "" Region: id = 2529 start_va = 0x8f0000 end_va = 0x92dfff entry_point = 0x8f0000 region_type = mapped_file name = "unlikexpc.exe" filename = "\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\unlikexpc.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\unlikexpc.exe") Region: id = 2530 start_va = 0x77950000 end_va = 0x77af8fff entry_point = 0x77950000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 2531 start_va = 0x77b30000 end_va = 0x77caffff entry_point = 0x77b30000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 2532 start_va = 0x7efb0000 end_va = 0x7efd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efb0000" filename = "" Region: id = 2533 start_va = 0x7efdb000 end_va = 0x7efddfff entry_point = 0x0 region_type = private name = "private_0x000000007efdb000" filename = "" Region: id = 2534 start_va = 0x7efde000 end_va = 0x7efdefff entry_point = 0x0 region_type = private name = "private_0x000000007efde000" filename = "" Region: id = 2535 start_va = 0x7efdf000 end_va = 0x7efdffff entry_point = 0x0 region_type = private name = "private_0x000000007efdf000" filename = "" Region: id = 2536 start_va = 0x7efe0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 2537 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 2538 start_va = 0x7fff0000 end_va = 0x7fffffeffff entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 2692 start_va = 0x290000 end_va = 0x30ffff entry_point = 0x0 region_type = private name = "private_0x0000000000290000" filename = "" Region: id = 2693 start_va = 0x74080000 end_va = 0x74087fff entry_point = 0x74080000 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 2694 start_va = 0x74090000 end_va = 0x740ebfff entry_point = 0x74090000 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 2695 start_va = 0x740f0000 end_va = 0x7412efff entry_point = 0x740f0000 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 2696 start_va = 0x500000 end_va = 0x5fffff entry_point = 0x0 region_type = private name = "private_0x0000000000500000" filename = "" Region: id = 2697 start_va = 0x73e90000 end_va = 0x73ed9fff entry_point = 0x73e90000 region_type = mapped_file name = "mscoree.dll" filename = "\\Windows\\SysWOW64\\mscoree.dll" (normalized: "c:\\windows\\syswow64\\mscoree.dll") Region: id = 2698 start_va = 0x75880000 end_va = 0x758c5fff entry_point = 0x75880000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 2699 start_va = 0x77100000 end_va = 0x7720ffff entry_point = 0x77100000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 2700 start_va = 0x77730000 end_va = 0x77829fff entry_point = 0x0 region_type = private name = "private_0x0000000077730000" filename = "" Region: id = 2701 start_va = 0x77830000 end_va = 0x7794efff entry_point = 0x0 region_type = private name = "private_0x0000000077830000" filename = "" Region: id = 2712 start_va = 0x10000 end_va = 0x1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 2713 start_va = 0x70000 end_va = 0xd6fff entry_point = 0x70000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 2714 start_va = 0x6f0000 end_va = 0x72ffff entry_point = 0x0 region_type = private name = "private_0x00000000006f0000" filename = "" Region: id = 2715 start_va = 0x780000 end_va = 0x78ffff entry_point = 0x0 region_type = private name = "private_0x0000000000780000" filename = "" Region: id = 2716 start_va = 0x75680000 end_va = 0x7568bfff entry_point = 0x75680000 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 2717 start_va = 0x75690000 end_va = 0x756effff entry_point = 0x75690000 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 2718 start_va = 0x75a60000 end_va = 0x75b0bfff entry_point = 0x75a60000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 2719 start_va = 0x76b50000 end_va = 0x76b68fff entry_point = 0x76b50000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 2720 start_va = 0x77210000 end_va = 0x772fffff entry_point = 0x77210000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 2721 start_va = 0x77690000 end_va = 0x7772ffff entry_point = 0x77690000 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll") Region: id = 2722 start_va = 0x7efe0000 end_va = 0x7f0dffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 2723 start_va = 0x7f0e0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 2733 start_va = 0x260000 end_va = 0x26ffff entry_point = 0x0 region_type = private name = "private_0x0000000000260000" filename = "" Region: id = 2734 start_va = 0x73310000 end_va = 0x73387fff entry_point = 0x73310000 region_type = mapped_file name = "mscoreei.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscoreei.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\mscoreei.dll") Region: id = 2736 start_va = 0x75b10000 end_va = 0x75b66fff entry_point = 0x75b10000 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\SysWOW64\\shlwapi.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll") Region: id = 2737 start_va = 0x76ab0000 end_va = 0x76b4cfff entry_point = 0x76ab0000 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\SysWOW64\\usp10.dll" (normalized: "c:\\windows\\syswow64\\usp10.dll") Region: id = 2738 start_va = 0x76d70000 end_va = 0x76dfffff entry_point = 0x76d70000 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 2739 start_va = 0x77060000 end_va = 0x77069fff entry_point = 0x77060000 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\SysWOW64\\lpk.dll" (normalized: "c:\\windows\\syswow64\\lpk.dll") Region: id = 2740 start_va = 0x77590000 end_va = 0x7768ffff entry_point = 0x77590000 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 2741 start_va = 0x930000 end_va = 0xab7fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000930000" filename = "" Region: id = 2742 start_va = 0x756f0000 end_va = 0x7574ffff entry_point = 0x756f0000 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 2743 start_va = 0x77420000 end_va = 0x774ebfff entry_point = 0x77420000 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll") Region: id = 2757 start_va = 0x20000 end_va = 0x20fff entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 2758 start_va = 0x30000 end_va = 0x30fff entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 2759 start_va = 0xac0000 end_va = 0xc40fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000ac0000" filename = "" Region: id = 2760 start_va = 0xc50000 end_va = 0x204ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000c50000" filename = "" Region: id = 2761 start_va = 0x75650000 end_va = 0x75658fff entry_point = 0x75650000 region_type = mapped_file name = "version.dll" filename = "\\Windows\\SysWOW64\\version.dll" (normalized: "c:\\windows\\syswow64\\version.dll") Region: id = 2762 start_va = 0x74ea0000 end_va = 0x74f94fff entry_point = 0x74ea0000 region_type = mapped_file name = "msvcr120_clr0400.dll" filename = "\\Windows\\SysWOW64\\msvcr120_clr0400.dll" (normalized: "c:\\windows\\syswow64\\msvcr120_clr0400.dll") Region: id = 2763 start_va = 0x74fa0000 end_va = 0x75647fff entry_point = 0x74fa0000 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\clr.dll") Region: id = 2766 start_va = 0xe0000 end_va = 0xe0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000e0000" filename = "" Region: id = 2767 start_va = 0xf0000 end_va = 0xfffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000f0000" filename = "" Region: id = 2768 start_va = 0x100000 end_va = 0x10ffff entry_point = 0x0 region_type = private name = "private_0x0000000000100000" filename = "" Region: id = 2769 start_va = 0x110000 end_va = 0x11ffff entry_point = 0x0 region_type = private name = "private_0x0000000000110000" filename = "" Region: id = 2770 start_va = 0x120000 end_va = 0x12ffff entry_point = 0x0 region_type = private name = "private_0x0000000000120000" filename = "" Region: id = 2771 start_va = 0x130000 end_va = 0x13ffff entry_point = 0x0 region_type = private name = "private_0x0000000000130000" filename = "" Region: id = 2772 start_va = 0x140000 end_va = 0x14ffff entry_point = 0x0 region_type = private name = "private_0x0000000000140000" filename = "" Region: id = 2773 start_va = 0x150000 end_va = 0x150fff entry_point = 0x0 region_type = private name = "private_0x0000000000150000" filename = "" Region: id = 2774 start_va = 0x160000 end_va = 0x160fff entry_point = 0x0 region_type = private name = "private_0x0000000000160000" filename = "" Region: id = 2775 start_va = 0x1b0000 end_va = 0x24ffff entry_point = 0x0 region_type = private name = "private_0x00000000001b0000" filename = "" Region: id = 2776 start_va = 0x440000 end_va = 0x47ffff entry_point = 0x0 region_type = private name = "private_0x0000000000440000" filename = "" Region: id = 2777 start_va = 0x610000 end_va = 0x64ffff entry_point = 0x0 region_type = private name = "private_0x0000000000610000" filename = "" Region: id = 2778 start_va = 0x670000 end_va = 0x6affff entry_point = 0x0 region_type = private name = "private_0x0000000000670000" filename = "" Region: id = 2779 start_va = 0x860000 end_va = 0x89ffff entry_point = 0x0 region_type = private name = "private_0x0000000000860000" filename = "" Region: id = 2780 start_va = 0x2120000 end_va = 0x215ffff entry_point = 0x0 region_type = private name = "private_0x0000000002120000" filename = "" Region: id = 2781 start_va = 0x2220000 end_va = 0x231ffff entry_point = 0x0 region_type = private name = "private_0x0000000002220000" filename = "" Region: id = 2782 start_va = 0x2340000 end_va = 0x243ffff entry_point = 0x0 region_type = private name = "private_0x0000000002340000" filename = "" Region: id = 2783 start_va = 0x2440000 end_va = 0x443ffff entry_point = 0x0 region_type = private name = "private_0x0000000002440000" filename = "" Region: id = 2784 start_va = 0x4490000 end_va = 0x458ffff entry_point = 0x0 region_type = private name = "private_0x0000000004490000" filename = "" Region: id = 2785 start_va = 0x4590000 end_va = 0x485efff entry_point = 0x4590000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 2786 start_va = 0x720d0000 end_va = 0x732fafff entry_point = 0x720d0000 region_type = mapped_file name = "mscorlib.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\b7a12c4c0032847fcc6b9c710460456f\\mscorlib.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\mscorlib\\b7a12c4c0032847fcc6b9c710460456f\\mscorlib.ni.dll") Region: id = 2787 start_va = 0x7efad000 end_va = 0x7efaffff entry_point = 0x0 region_type = private name = "private_0x000000007efad000" filename = "" Region: id = 2788 start_va = 0x7efd5000 end_va = 0x7efd7fff entry_point = 0x0 region_type = private name = "private_0x000000007efd5000" filename = "" Region: id = 2789 start_va = 0x7efd8000 end_va = 0x7efdafff entry_point = 0x0 region_type = private name = "private_0x000000007efd8000" filename = "" Region: id = 2790 start_va = 0x76e70000 end_va = 0x76fcbfff entry_point = 0x76e70000 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\SysWOW64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll") Region: id = 2791 start_va = 0x73e10000 end_va = 0x73e8ffff entry_point = 0x73e10000 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\SysWOW64\\uxtheme.dll" (normalized: "c:\\windows\\syswow64\\uxtheme.dll") Region: id = 2792 start_va = 0x4860000 end_va = 0x497ffff entry_point = 0x0 region_type = private name = "private_0x0000000004860000" filename = "" Region: id = 2820 start_va = 0x4860000 end_va = 0x493efff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000004860000" filename = "" Region: id = 2821 start_va = 0x4940000 end_va = 0x497ffff entry_point = 0x0 region_type = private name = "private_0x0000000004940000" filename = "" Region: id = 2823 start_va = 0x250000 end_va = 0x25ffff entry_point = 0x0 region_type = private name = "private_0x0000000000250000" filename = "" Region: id = 2827 start_va = 0x74e20000 end_va = 0x74e9cfff entry_point = 0x74e20000 region_type = mapped_file name = "clrjit.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clrjit.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\clrjit.dll") Region: id = 2828 start_va = 0x76fd0000 end_va = 0x7705efff entry_point = 0x76fd0000 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\SysWOW64\\oleaut32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll") Region: id = 2837 start_va = 0x270000 end_va = 0x27ffff entry_point = 0x0 region_type = private name = "private_0x0000000000270000" filename = "" Region: id = 2838 start_va = 0x420000 end_va = 0x430fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000420000" filename = "" Region: id = 2839 start_va = 0x480000 end_va = 0x4e1fff entry_point = 0x480000 region_type = mapped_file name = "mscorrc.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorrc.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\mscorrc.dll") Region: id = 2840 start_va = 0x4a60000 end_va = 0x4a9ffff entry_point = 0x0 region_type = private name = "private_0x0000000004a60000" filename = "" Region: id = 2841 start_va = 0x719b0000 end_va = 0x720c5fff entry_point = 0x719b0000 region_type = mapped_file name = "system.core.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Core\\386fde9190d499d6645df8b90eb76242\\System.Core.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.core\\386fde9190d499d6645df8b90eb76242\\system.core.ni.dll") Region: id = 2842 start_va = 0x73c40000 end_va = 0x73e0afff entry_point = 0x73c40000 region_type = mapped_file name = "microsoft.visualbasic.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Microsoft.V9921e851#\\cfbddeb6e93e8f421b92229b20e51233\\Microsoft.VisualBasic.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\microsoft.v9921e851#\\cfbddeb6e93e8f421b92229b20e51233\\microsoft.visualbasic.ni.dll") Region: id = 2843 start_va = 0x74470000 end_va = 0x74e1cfff entry_point = 0x74470000 region_type = mapped_file name = "system.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System\\500ffa28b327e171fe664023003e947e\\System.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system\\500ffa28b327e171fe664023003e947e\\system.ni.dll") Region: id = 2844 start_va = 0x74450000 end_va = 0x74462fff entry_point = 0x74450000 region_type = mapped_file name = "nlssorting.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\nlssorting.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\nlssorting.dll") Region: id = 2846 start_va = 0x4aa0000 end_va = 0x4d71fff entry_point = 0x4aa0000 region_type = mapped_file name = "sortdefault.nlp" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\sortdefault.nlp" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\sortdefault.nlp") Region: id = 2847 start_va = 0x74430000 end_va = 0x74445fff entry_point = 0x74430000 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\SysWOW64\\cryptsp.dll" (normalized: "c:\\windows\\syswow64\\cryptsp.dll") Region: id = 2851 start_va = 0x743f0000 end_va = 0x7442afff entry_point = 0x743f0000 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 2856 start_va = 0x280000 end_va = 0x28ffff entry_point = 0x0 region_type = private name = "private_0x0000000000280000" filename = "" Region: id = 2857 start_va = 0x310000 end_va = 0x31ffff entry_point = 0x0 region_type = private name = "private_0x0000000000310000" filename = "" Region: id = 2858 start_va = 0x650000 end_va = 0x66cfff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000650000" filename = "" Region: id = 2859 start_va = 0x6b0000 end_va = 0x6d4fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000006b0000" filename = "" Region: id = 2860 start_va = 0x774f0000 end_va = 0x774f4fff entry_point = 0x774f0000 region_type = mapped_file name = "psapi.dll" filename = "\\Windows\\SysWOW64\\psapi.dll" (normalized: "c:\\windows\\syswow64\\psapi.dll") Thread: id = 74 os_tid = 0x7ac [0246.990] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0 [0247.299] EtwEventRegister () returned 0x0 [0247.330] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\unlikexpc.exe.config", nBufferLength=0x105, lpBuffer=0x41e640, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\unlikexpc.exe.config", lpFilePart=0x0) returned 0x51 [0247.348] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x41ead4) returned 1 [0247.348] GetFileAttributesExW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\unlikexpc.exe.config" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\unlikexpc.exe.config"), fInfoLevelId=0x0, lpFileInformation=0x41eb50 | out: lpFileInformation=0x41eb50*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0247.348] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x41ead0) returned 1 [0255.821] GetCurrentProcessId () returned 0x7a8 [0256.601] LookupPrivilegeValueW (in: lpSystemName=0x0, lpName="SeDebugPrivilege", lpLuid=0x41b22c | out: lpLuid=0x41b22c*(LowPart=0x14, HighPart=0)) returned 1 [0256.602] GetCurrentProcess () returned 0xffffffff [0256.602] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x20, TokenHandle=0x41b228 | out: TokenHandle=0x41b228*=0x2f0) returned 1 [0256.602] AdjustTokenPrivileges (in: TokenHandle=0x2f0, DisableAllPrivileges=0, NewState=0x273a134*(PrivilegesCount=0x1, Privileges=((Luid.LowPart=0x14, Luid.HighPart=0, Attributes=0x2))), BufferLength=0x0, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1 [0256.605] CloseHandle (hObject=0x2f0) returned 1 [0256.613] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x7a8) returned 0x2f0 [0256.619] EnumProcessModules (in: hProcess=0x2f0, lphModule=0x273a9b0, cb=0x100, lpcbNeeded=0x41b900 | out: lphModule=0x273a9b0, lpcbNeeded=0x41b900) returned 1 [0256.620] GetModuleInformation (in: hProcess=0x2f0, hModule=0x8f0000, lpmodinfo=0x273aaf0, cb=0xc | out: lpmodinfo=0x273aaf0*(lpBaseOfDll=0x8f0000, SizeOfImage=0x3e000, EntryPoint=0x9279ce)) returned 1 [0256.620] CoTaskMemAlloc (cb=0x804) returned 0x587218 [0256.621] GetModuleBaseNameW (in: hProcess=0x2f0, hModule=0x8f0000, lpBaseName=0x587218, nSize=0x800 | out: lpBaseName="unlikexpc.exe") returned 0xd [0256.621] CoTaskMemFree (pv=0x587218) [0256.621] CoTaskMemAlloc (cb=0x804) returned 0x587218 [0256.621] GetModuleFileNameExW (in: hProcess=0x2f0, hModule=0x8f0000, lpFilename=0x587218, nSize=0x800 | out: lpFilename="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\unlikexpc.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\unlikexpc.exe")) returned 0x4a [0256.621] CoTaskMemFree (pv=0x587218) [0256.622] GetModuleInformation (in: hProcess=0x2f0, hModule=0x77b30000, lpmodinfo=0x273cc90, cb=0xc | out: lpmodinfo=0x273cc90*(lpBaseOfDll=0x77b30000, SizeOfImage=0x180000, EntryPoint=0x0)) returned 1 [0256.622] CoTaskMemAlloc (cb=0x804) returned 0x587218 [0256.622] GetModuleBaseNameW (in: hProcess=0x2f0, hModule=0x77b30000, lpBaseName=0x587218, nSize=0x800 | out: lpBaseName="ntdll.dll") returned 0x9 [0256.622] CoTaskMemFree (pv=0x587218) [0256.622] CoTaskMemAlloc (cb=0x804) returned 0x587218 [0256.622] GetModuleFileNameExW (in: hProcess=0x2f0, hModule=0x77b30000, lpFilename=0x587218, nSize=0x800 | out: lpFilename="C:\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll")) returned 0x1d [0256.622] CoTaskMemFree (pv=0x587218) [0256.622] GetModuleInformation (in: hProcess=0x2f0, hModule=0x73e90000, lpmodinfo=0x273ed94, cb=0xc | out: lpmodinfo=0x273ed94*(lpBaseOfDll=0x73e90000, SizeOfImage=0x4a000, EntryPoint=0x73e92e54)) returned 1 [0256.622] CoTaskMemAlloc (cb=0x804) returned 0x587218 [0256.622] GetModuleBaseNameW (in: hProcess=0x2f0, hModule=0x73e90000, lpBaseName=0x587218, nSize=0x800 | out: lpBaseName="MSCOREE.DLL") returned 0xb [0256.622] CoTaskMemFree (pv=0x587218) [0256.622] CoTaskMemAlloc (cb=0x804) returned 0x587218 [0256.622] GetModuleFileNameExW (in: hProcess=0x2f0, hModule=0x73e90000, lpFilename=0x587218, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\MSCOREE.DLL" (normalized: "c:\\windows\\system32\\mscoree.dll")) returned 0x1f [0256.623] CoTaskMemFree (pv=0x587218) [0256.623] GetModuleInformation (in: hProcess=0x2f0, hModule=0x77100000, lpmodinfo=0x2740ea0, cb=0xc | out: lpmodinfo=0x2740ea0*(lpBaseOfDll=0x77100000, SizeOfImage=0x110000, EntryPoint=0x771132d3)) returned 1 [0256.623] CoTaskMemAlloc (cb=0x804) returned 0x587218 [0256.623] GetModuleBaseNameW (in: hProcess=0x2f0, hModule=0x77100000, lpBaseName=0x587218, nSize=0x800 | out: lpBaseName="KERNEL32.dll") returned 0xc [0256.623] CoTaskMemFree (pv=0x587218) [0256.623] CoTaskMemAlloc (cb=0x804) returned 0x587218 [0256.623] GetModuleFileNameExW (in: hProcess=0x2f0, hModule=0x77100000, lpFilename=0x587218, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\KERNEL32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll")) returned 0x20 [0256.623] CoTaskMemFree (pv=0x587218) [0256.623] GetModuleInformation (in: hProcess=0x2f0, hModule=0x75880000, lpmodinfo=0x2742fb4, cb=0xc | out: lpmodinfo=0x2742fb4*(lpBaseOfDll=0x75880000, SizeOfImage=0x46000, EntryPoint=0x75887478)) returned 1 [0256.623] CoTaskMemAlloc (cb=0x804) returned 0x587218 [0256.623] GetModuleBaseNameW (in: hProcess=0x2f0, hModule=0x75880000, lpBaseName=0x587218, nSize=0x800 | out: lpBaseName="KERNELBASE.dll") returned 0xe [0256.624] CoTaskMemFree (pv=0x587218) [0256.624] CoTaskMemAlloc (cb=0x804) returned 0x587218 [0256.624] GetModuleFileNameExW (in: hProcess=0x2f0, hModule=0x75880000, lpFilename=0x587218, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\KERNELBASE.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll")) returned 0x22 [0256.624] CoTaskMemFree (pv=0x587218) [0256.624] GetModuleInformation (in: hProcess=0x2f0, hModule=0x77690000, lpmodinfo=0x27450fc, cb=0xc | out: lpmodinfo=0x27450fc*(lpBaseOfDll=0x77690000, SizeOfImage=0xa0000, EntryPoint=0x776a49e5)) returned 1 [0256.624] CoTaskMemAlloc (cb=0x804) returned 0x587218 [0256.624] GetModuleBaseNameW (in: hProcess=0x2f0, hModule=0x77690000, lpBaseName=0x587218, nSize=0x800 | out: lpBaseName="ADVAPI32.dll") returned 0xc [0256.624] CoTaskMemFree (pv=0x587218) [0256.624] CoTaskMemAlloc (cb=0x804) returned 0x587218 [0256.624] GetModuleFileNameExW (in: hProcess=0x2f0, hModule=0x77690000, lpFilename=0x587218, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\ADVAPI32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll")) returned 0x20 [0256.624] CoTaskMemFree (pv=0x587218) [0256.624] GetModuleInformation (in: hProcess=0x2f0, hModule=0x75a60000, lpmodinfo=0x2747210, cb=0xc | out: lpmodinfo=0x2747210*(lpBaseOfDll=0x75a60000, SizeOfImage=0xac000, EntryPoint=0x75a6a472)) returned 1 [0256.624] CoTaskMemAlloc (cb=0x804) returned 0x587218 [0256.625] GetModuleBaseNameW (in: hProcess=0x2f0, hModule=0x75a60000, lpBaseName=0x587218, nSize=0x800 | out: lpBaseName="msvcrt.dll") returned 0xa [0256.625] CoTaskMemFree (pv=0x587218) [0256.625] CoTaskMemAlloc (cb=0x804) returned 0x587218 [0256.625] GetModuleFileNameExW (in: hProcess=0x2f0, hModule=0x75a60000, lpFilename=0x587218, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll")) returned 0x1e [0256.625] CoTaskMemFree (pv=0x587218) [0256.625] GetModuleInformation (in: hProcess=0x2f0, hModule=0x76b50000, lpmodinfo=0x274931c, cb=0xc | out: lpmodinfo=0x274931c*(lpBaseOfDll=0x76b50000, SizeOfImage=0x19000, EntryPoint=0x76b54975)) returned 1 [0256.625] CoTaskMemAlloc (cb=0x804) returned 0x587218 [0256.625] GetModuleBaseNameW (in: hProcess=0x2f0, hModule=0x76b50000, lpBaseName=0x587218, nSize=0x800 | out: lpBaseName="sechost.dll") returned 0xb [0256.625] CoTaskMemFree (pv=0x587218) [0256.625] CoTaskMemAlloc (cb=0x804) returned 0x587218 [0256.625] GetModuleFileNameExW (in: hProcess=0x2f0, hModule=0x76b50000, lpFilename=0x587218, nSize=0x800 | out: lpFilename="C:\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll")) returned 0x1f [0256.626] CoTaskMemFree (pv=0x587218) [0256.626] GetModuleInformation (in: hProcess=0x2f0, hModule=0x77210000, lpmodinfo=0x274b428, cb=0xc | out: lpmodinfo=0x274b428*(lpBaseOfDll=0x77210000, SizeOfImage=0xf0000, EntryPoint=0x77220569)) returned 1 [0256.626] CoTaskMemAlloc (cb=0x804) returned 0x587218 [0256.626] GetModuleBaseNameW (in: hProcess=0x2f0, hModule=0x77210000, lpBaseName=0x587218, nSize=0x800 | out: lpBaseName="RPCRT4.dll") returned 0xa [0256.626] CoTaskMemFree (pv=0x587218) [0256.626] CoTaskMemAlloc (cb=0x804) returned 0x587218 [0256.626] GetModuleFileNameExW (in: hProcess=0x2f0, hModule=0x77210000, lpFilename=0x587218, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\RPCRT4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll")) returned 0x1e [0256.626] CoTaskMemFree (pv=0x587218) [0256.626] GetModuleInformation (in: hProcess=0x2f0, hModule=0x75690000, lpmodinfo=0x274d580, cb=0xc | out: lpmodinfo=0x274d580*(lpBaseOfDll=0x75690000, SizeOfImage=0x60000, EntryPoint=0x756aa3b3)) returned 1 [0256.626] CoTaskMemAlloc (cb=0x804) returned 0x587218 [0256.627] GetModuleBaseNameW (in: hProcess=0x2f0, hModule=0x75690000, lpBaseName=0x587218, nSize=0x800 | out: lpBaseName="SspiCli.dll") returned 0xb [0256.627] CoTaskMemFree (pv=0x587218) [0256.627] CoTaskMemAlloc (cb=0x804) returned 0x587218 [0256.627] GetModuleFileNameExW (in: hProcess=0x2f0, hModule=0x75690000, lpFilename=0x587218, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\SspiCli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll")) returned 0x1f [0256.627] CoTaskMemFree (pv=0x587218) [0256.627] GetModuleInformation (in: hProcess=0x2f0, hModule=0x75680000, lpmodinfo=0x274f68c, cb=0xc | out: lpmodinfo=0x274f68c*(lpBaseOfDll=0x75680000, SizeOfImage=0xc000, EntryPoint=0x756810e1)) returned 1 [0256.627] CoTaskMemAlloc (cb=0x804) returned 0x587218 [0256.627] GetModuleBaseNameW (in: hProcess=0x2f0, hModule=0x75680000, lpBaseName=0x587218, nSize=0x800 | out: lpBaseName="CRYPTBASE.dll") returned 0xd [0256.627] CoTaskMemFree (pv=0x587218) [0256.627] CoTaskMemAlloc (cb=0x804) returned 0x587218 [0256.628] GetModuleFileNameExW (in: hProcess=0x2f0, hModule=0x75680000, lpFilename=0x587218, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\CRYPTBASE.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll")) returned 0x21 [0256.628] CoTaskMemFree (pv=0x587218) [0256.628] GetModuleInformation (in: hProcess=0x2f0, hModule=0x73310000, lpmodinfo=0x27517a0, cb=0xc | out: lpmodinfo=0x27517a0*(lpBaseOfDll=0x73310000, SizeOfImage=0x78000, EntryPoint=0x7331f7ba)) returned 1 [0256.628] CoTaskMemAlloc (cb=0x804) returned 0x587218 [0256.628] GetModuleBaseNameW (in: hProcess=0x2f0, hModule=0x73310000, lpBaseName=0x587218, nSize=0x800 | out: lpBaseName="mscoreei.dll") returned 0xc [0256.628] CoTaskMemFree (pv=0x587218) [0256.628] CoTaskMemAlloc (cb=0x804) returned 0x587218 [0256.628] GetModuleFileNameExW (in: hProcess=0x2f0, hModule=0x73310000, lpFilename=0x587218, nSize=0x800 | out: lpFilename="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscoreei.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\mscoreei.dll")) returned 0x3a [0256.629] CoTaskMemFree (pv=0x587218) [0256.629] GetModuleInformation (in: hProcess=0x2f0, hModule=0x75b10000, lpmodinfo=0x27538e8, cb=0xc | out: lpmodinfo=0x27538e8*(lpBaseOfDll=0x75b10000, SizeOfImage=0x57000, EntryPoint=0x75b29ba6)) returned 1 [0256.629] CoTaskMemAlloc (cb=0x804) returned 0x587218 [0256.629] GetModuleBaseNameW (in: hProcess=0x2f0, hModule=0x75b10000, lpBaseName=0x587218, nSize=0x800 | out: lpBaseName="SHLWAPI.dll") returned 0xb [0256.629] CoTaskMemFree (pv=0x587218) [0256.629] CoTaskMemAlloc (cb=0x804) returned 0x587218 [0256.629] GetModuleFileNameExW (in: hProcess=0x2f0, hModule=0x75b10000, lpFilename=0x587218, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\SHLWAPI.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll")) returned 0x1f [0256.629] CoTaskMemFree (pv=0x587218) [0256.629] GetModuleInformation (in: hProcess=0x2f0, hModule=0x76d70000, lpmodinfo=0x27559f4, cb=0xc | out: lpmodinfo=0x27559f4*(lpBaseOfDll=0x76d70000, SizeOfImage=0x90000, EntryPoint=0x76d86343)) returned 1 [0256.630] CoTaskMemAlloc (cb=0x804) returned 0x587218 [0256.630] GetModuleBaseNameW (in: hProcess=0x2f0, hModule=0x76d70000, lpBaseName=0x587218, nSize=0x800 | out: lpBaseName="GDI32.dll") returned 0x9 [0256.630] CoTaskMemFree (pv=0x587218) [0256.630] CoTaskMemAlloc (cb=0x804) returned 0x587218 [0256.630] GetModuleFileNameExW (in: hProcess=0x2f0, hModule=0x76d70000, lpFilename=0x587218, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\GDI32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll")) returned 0x1d [0256.630] CoTaskMemFree (pv=0x587218) [0256.630] GetModuleInformation (in: hProcess=0x2f0, hModule=0x77590000, lpmodinfo=0x2757af8, cb=0xc | out: lpmodinfo=0x2757af8*(lpBaseOfDll=0x77590000, SizeOfImage=0x100000, EntryPoint=0x775ab6ed)) returned 1 [0256.631] CoTaskMemAlloc (cb=0x804) returned 0x587218 [0256.631] GetModuleBaseNameW (in: hProcess=0x2f0, hModule=0x77590000, lpBaseName=0x587218, nSize=0x800 | out: lpBaseName="USER32.dll") returned 0xa [0256.631] CoTaskMemFree (pv=0x587218) [0256.631] CoTaskMemAlloc (cb=0x804) returned 0x587218 [0256.631] GetModuleFileNameExW (in: hProcess=0x2f0, hModule=0x77590000, lpFilename=0x587218, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\USER32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll")) returned 0x1e [0256.631] CoTaskMemFree (pv=0x587218) [0256.631] GetModuleInformation (in: hProcess=0x2f0, hModule=0x77060000, lpmodinfo=0x2759c04, cb=0xc | out: lpmodinfo=0x2759c04*(lpBaseOfDll=0x77060000, SizeOfImage=0xa000, EntryPoint=0x770636a0)) returned 1 [0256.631] CoTaskMemAlloc (cb=0x804) returned 0x587218 [0256.631] GetModuleBaseNameW (in: hProcess=0x2f0, hModule=0x77060000, lpBaseName=0x587218, nSize=0x800 | out: lpBaseName="LPK.dll") returned 0x7 [0256.632] CoTaskMemFree (pv=0x587218) [0256.632] CoTaskMemAlloc (cb=0x804) returned 0x587218 [0256.632] GetModuleFileNameExW (in: hProcess=0x2f0, hModule=0x77060000, lpFilename=0x587218, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\LPK.dll" (normalized: "c:\\windows\\syswow64\\lpk.dll")) returned 0x1b [0256.632] CoTaskMemFree (pv=0x587218) [0256.632] GetModuleInformation (in: hProcess=0x2f0, hModule=0x76ab0000, lpmodinfo=0x275bd00, cb=0xc | out: lpmodinfo=0x275bd00*(lpBaseOfDll=0x76ab0000, SizeOfImage=0x9d000, EntryPoint=0x76ae3fd7)) returned 1 [0256.632] CoTaskMemAlloc (cb=0x804) returned 0x587218 [0256.632] GetModuleBaseNameW (in: hProcess=0x2f0, hModule=0x76ab0000, lpBaseName=0x587218, nSize=0x800 | out: lpBaseName="USP10.dll") returned 0x9 [0256.648] CoTaskMemFree (pv=0x587218) [0256.648] CoTaskMemAlloc (cb=0x804) returned 0x587218 [0256.648] GetModuleFileNameExW (in: hProcess=0x2f0, hModule=0x76ab0000, lpFilename=0x587218, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\USP10.dll" (normalized: "c:\\windows\\syswow64\\usp10.dll")) returned 0x1d [0256.649] CoTaskMemFree (pv=0x587218) [0256.649] GetModuleInformation (in: hProcess=0x2f0, hModule=0x756f0000, lpmodinfo=0x275de90, cb=0xc | out: lpmodinfo=0x275de90*(lpBaseOfDll=0x756f0000, SizeOfImage=0x60000, EntryPoint=0x7570158f)) returned 1 [0256.649] CoTaskMemAlloc (cb=0x804) returned 0x587218 [0256.649] GetModuleBaseNameW (in: hProcess=0x2f0, hModule=0x756f0000, lpBaseName=0x587218, nSize=0x800 | out: lpBaseName="IMM32.DLL") returned 0x9 [0256.649] CoTaskMemFree (pv=0x587218) [0256.649] CoTaskMemAlloc (cb=0x804) returned 0x587218 [0256.649] GetModuleFileNameExW (in: hProcess=0x2f0, hModule=0x756f0000, lpFilename=0x587218, nSize=0x800 | out: lpFilename="C:\\Windows\\system32\\IMM32.DLL" (normalized: "c:\\windows\\system32\\imm32.dll")) returned 0x1d [0256.650] CoTaskMemFree (pv=0x587218) [0256.650] GetModuleInformation (in: hProcess=0x2f0, hModule=0x77420000, lpmodinfo=0x275ff94, cb=0xc | out: lpmodinfo=0x275ff94*(lpBaseOfDll=0x77420000, SizeOfImage=0xcc000, EntryPoint=0x7742168b)) returned 1 [0256.650] CoTaskMemAlloc (cb=0x804) returned 0x587218 [0256.650] GetModuleBaseNameW (in: hProcess=0x2f0, hModule=0x77420000, lpBaseName=0x587218, nSize=0x800 | out: lpBaseName="MSCTF.dll") returned 0x9 [0256.650] CoTaskMemFree (pv=0x587218) [0256.650] CoTaskMemAlloc (cb=0x804) returned 0x587218 [0256.650] GetModuleFileNameExW (in: hProcess=0x2f0, hModule=0x77420000, lpFilename=0x587218, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\MSCTF.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll")) returned 0x1d [0256.651] CoTaskMemFree (pv=0x587218) [0256.651] GetModuleInformation (in: hProcess=0x2f0, hModule=0x75650000, lpmodinfo=0x2762098, cb=0xc | out: lpmodinfo=0x2762098*(lpBaseOfDll=0x75650000, SizeOfImage=0x9000, EntryPoint=0x75651220)) returned 1 [0256.651] CoTaskMemAlloc (cb=0x804) returned 0x587218 [0256.651] GetModuleBaseNameW (in: hProcess=0x2f0, hModule=0x75650000, lpBaseName=0x587218, nSize=0x800 | out: lpBaseName="VERSION.dll") returned 0xb [0256.652] CoTaskMemFree (pv=0x587218) [0256.652] CoTaskMemAlloc (cb=0x804) returned 0x587218 [0256.652] GetModuleFileNameExW (in: hProcess=0x2f0, hModule=0x75650000, lpFilename=0x587218, nSize=0x800 | out: lpFilename="C:\\Windows\\system32\\VERSION.dll" (normalized: "c:\\windows\\system32\\version.dll")) returned 0x1f [0256.652] CoTaskMemFree (pv=0x587218) [0256.652] GetModuleInformation (in: hProcess=0x2f0, hModule=0x74fa0000, lpmodinfo=0x27641a4, cb=0xc | out: lpmodinfo=0x27641a4*(lpBaseOfDll=0x74fa0000, SizeOfImage=0x6a8000, EntryPoint=0x750e7040)) returned 1 [0256.652] CoTaskMemAlloc (cb=0x804) returned 0x587218 [0256.652] GetModuleBaseNameW (in: hProcess=0x2f0, hModule=0x74fa0000, lpBaseName=0x587218, nSize=0x800 | out: lpBaseName="clr.dll") returned 0x7 [0256.653] CoTaskMemFree (pv=0x587218) [0256.653] CoTaskMemAlloc (cb=0x804) returned 0x587218 [0256.653] GetModuleFileNameExW (in: hProcess=0x2f0, hModule=0x74fa0000, lpFilename=0x587218, nSize=0x800 | out: lpFilename="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\clr.dll")) returned 0x35 [0256.653] CoTaskMemFree (pv=0x587218) [0256.653] GetModuleInformation (in: hProcess=0x2f0, hModule=0x74ea0000, lpmodinfo=0x27662d4, cb=0xc | out: lpmodinfo=0x27662d4*(lpBaseOfDll=0x74ea0000, SizeOfImage=0xf5000, EntryPoint=0x74ef4160)) returned 1 [0256.653] CoTaskMemAlloc (cb=0x804) returned 0x587218 [0256.653] GetModuleBaseNameW (in: hProcess=0x2f0, hModule=0x74ea0000, lpBaseName=0x587218, nSize=0x800 | out: lpBaseName="MSVCR120_CLR0400.dll") returned 0x14 [0256.654] CoTaskMemFree (pv=0x587218) [0256.654] CoTaskMemAlloc (cb=0x804) returned 0x587218 [0256.654] GetModuleFileNameExW (in: hProcess=0x2f0, hModule=0x74ea0000, lpFilename=0x587218, nSize=0x800 | out: lpFilename="C:\\Windows\\system32\\MSVCR120_CLR0400.dll" (normalized: "c:\\windows\\system32\\msvcr120_clr0400.dll")) returned 0x28 [0256.654] CoTaskMemFree (pv=0x587218) [0256.654] GetModuleInformation (in: hProcess=0x2f0, hModule=0x720d0000, lpmodinfo=0x2768408, cb=0xc | out: lpmodinfo=0x2768408*(lpBaseOfDll=0x720d0000, SizeOfImage=0x122b000, EntryPoint=0x0)) returned 1 [0256.655] CoTaskMemAlloc (cb=0x804) returned 0x587218 [0256.655] GetModuleBaseNameW (in: hProcess=0x2f0, hModule=0x720d0000, lpBaseName=0x587218, nSize=0x800 | out: lpBaseName="mscorlib.ni.dll") returned 0xf [0256.655] CoTaskMemFree (pv=0x587218) [0256.671] CoTaskMemAlloc (cb=0x804) returned 0x587218 [0256.671] GetModuleFileNameExW (in: hProcess=0x2f0, hModule=0x720d0000, lpFilename=0x587218, nSize=0x800 | out: lpFilename="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\b7a12c4c0032847fcc6b9c710460456f\\mscorlib.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\mscorlib\\b7a12c4c0032847fcc6b9c710460456f\\mscorlib.ni.dll")) returned 0x68 [0256.671] CoTaskMemFree (pv=0x587218) [0256.671] GetModuleInformation (in: hProcess=0x2f0, hModule=0x76e70000, lpmodinfo=0x24ce860, cb=0xc | out: lpmodinfo=0x24ce860*(lpBaseOfDll=0x76e70000, SizeOfImage=0x15c000, EntryPoint=0x76ebba3d)) returned 1 [0256.671] CoTaskMemAlloc (cb=0x804) returned 0x587218 [0256.672] GetModuleBaseNameW (in: hProcess=0x2f0, hModule=0x76e70000, lpBaseName=0x587218, nSize=0x800 | out: lpBaseName="ole32.dll") returned 0x9 [0256.672] CoTaskMemFree (pv=0x587218) [0256.672] CoTaskMemAlloc (cb=0x804) returned 0x587218 [0256.672] GetModuleFileNameExW (in: hProcess=0x2f0, hModule=0x76e70000, lpFilename=0x587218, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll")) returned 0x1d [0256.672] CoTaskMemFree (pv=0x587218) [0256.672] GetModuleInformation (in: hProcess=0x2f0, hModule=0x73e10000, lpmodinfo=0x24d0964, cb=0xc | out: lpmodinfo=0x24d0964*(lpBaseOfDll=0x73e10000, SizeOfImage=0x80000, EntryPoint=0x73e237c9)) returned 1 [0256.673] CoTaskMemAlloc (cb=0x804) returned 0x587218 [0256.673] GetModuleBaseNameW (in: hProcess=0x2f0, hModule=0x73e10000, lpBaseName=0x587218, nSize=0x800 | out: lpBaseName="uxtheme.dll") returned 0xb [0256.673] CoTaskMemFree (pv=0x587218) [0256.673] CoTaskMemAlloc (cb=0x804) returned 0x587218 [0256.673] GetModuleFileNameExW (in: hProcess=0x2f0, hModule=0x73e10000, lpFilename=0x587218, nSize=0x800 | out: lpFilename="C:\\Windows\\system32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll")) returned 0x1f [0256.674] CoTaskMemFree (pv=0x587218) [0256.674] GetModuleInformation (in: hProcess=0x2f0, hModule=0x74e20000, lpmodinfo=0x24d2a70, cb=0xc | out: lpmodinfo=0x24d2a70*(lpBaseOfDll=0x74e20000, SizeOfImage=0x7d000, EntryPoint=0x74e21140)) returned 1 [0256.674] CoTaskMemAlloc (cb=0x804) returned 0x587218 [0256.674] GetModuleBaseNameW (in: hProcess=0x2f0, hModule=0x74e20000, lpBaseName=0x587218, nSize=0x800 | out: lpBaseName="clrjit.dll") returned 0xa [0256.674] CoTaskMemFree (pv=0x587218) [0256.674] CoTaskMemAlloc (cb=0x804) returned 0x587218 [0256.674] GetModuleFileNameExW (in: hProcess=0x2f0, hModule=0x74e20000, lpFilename=0x587218, nSize=0x800 | out: lpFilename="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clrjit.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\clrjit.dll")) returned 0x38 [0256.675] CoTaskMemFree (pv=0x587218) [0256.675] GetModuleInformation (in: hProcess=0x2f0, hModule=0x76fd0000, lpmodinfo=0x24d4bb0, cb=0xc | out: lpmodinfo=0x24d4bb0*(lpBaseOfDll=0x76fd0000, SizeOfImage=0x8f000, EntryPoint=0x76fd3fb1)) returned 1 [0256.675] CoTaskMemAlloc (cb=0x804) returned 0x587218 [0256.675] GetModuleBaseNameW (in: hProcess=0x2f0, hModule=0x76fd0000, lpBaseName=0x587218, nSize=0x800 | out: lpBaseName="OLEAUT32.dll") returned 0xc [0256.676] CoTaskMemFree (pv=0x587218) [0256.676] CoTaskMemAlloc (cb=0x804) returned 0x587218 [0256.676] GetModuleFileNameExW (in: hProcess=0x2f0, hModule=0x76fd0000, lpFilename=0x587218, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\OLEAUT32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll")) returned 0x20 [0256.676] CoTaskMemFree (pv=0x587218) [0256.676] GetModuleInformation (in: hProcess=0x2f0, hModule=0x74470000, lpmodinfo=0x24d6cc4, cb=0xc | out: lpmodinfo=0x24d6cc4*(lpBaseOfDll=0x74470000, SizeOfImage=0x9ad000, EntryPoint=0x0)) returned 1 [0256.676] CoTaskMemAlloc (cb=0x804) returned 0x587218 [0256.676] GetModuleBaseNameW (in: hProcess=0x2f0, hModule=0x74470000, lpBaseName=0x587218, nSize=0x800 | out: lpBaseName="System.ni.dll") returned 0xd [0256.677] CoTaskMemFree (pv=0x587218) [0256.677] CoTaskMemAlloc (cb=0x804) returned 0x587218 [0256.677] GetModuleFileNameExW (in: hProcess=0x2f0, hModule=0x74470000, lpFilename=0x587218, nSize=0x800 | out: lpFilename="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System\\500ffa28b327e171fe664023003e947e\\System.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system\\500ffa28b327e171fe664023003e947e\\system.ni.dll")) returned 0x64 [0256.677] CoTaskMemFree (pv=0x587218) [0256.677] GetModuleInformation (in: hProcess=0x2f0, hModule=0x719b0000, lpmodinfo=0x24d8e60, cb=0xc | out: lpmodinfo=0x24d8e60*(lpBaseOfDll=0x719b0000, SizeOfImage=0x716000, EntryPoint=0x0)) returned 1 [0256.678] CoTaskMemAlloc (cb=0x804) returned 0x587218 [0256.678] GetModuleBaseNameW (in: hProcess=0x2f0, hModule=0x719b0000, lpBaseName=0x587218, nSize=0x800 | out: lpBaseName="System.Core.ni.dll") returned 0x12 [0256.678] CoTaskMemFree (pv=0x587218) [0256.678] CoTaskMemAlloc (cb=0x804) returned 0x587218 [0256.678] GetModuleFileNameExW (in: hProcess=0x2f0, hModule=0x719b0000, lpFilename=0x587218, nSize=0x800 | out: lpFilename="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Core\\386fde9190d499d6645df8b90eb76242\\System.Core.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.core\\386fde9190d499d6645df8b90eb76242\\system.core.ni.dll")) returned 0x6e [0256.679] CoTaskMemFree (pv=0x587218) [0256.679] GetModuleInformation (in: hProcess=0x2f0, hModule=0x73c40000, lpmodinfo=0x24db01c, cb=0xc | out: lpmodinfo=0x24db01c*(lpBaseOfDll=0x73c40000, SizeOfImage=0x1cb000, EntryPoint=0x0)) returned 1 [0256.679] CoTaskMemAlloc (cb=0x804) returned 0x587218 [0256.679] GetModuleBaseNameW (in: hProcess=0x2f0, hModule=0x73c40000, lpBaseName=0x587218, nSize=0x800 | out: lpBaseName="Microsoft.VisualBasic.ni.dll") returned 0x1c [0256.680] CoTaskMemFree (pv=0x587218) [0256.680] CoTaskMemAlloc (cb=0x804) returned 0x587218 [0256.680] GetModuleFileNameExW (in: hProcess=0x2f0, hModule=0x73c40000, lpFilename=0x587218, nSize=0x800 | out: lpFilename="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Microsoft.V9921e851#\\cfbddeb6e93e8f421b92229b20e51233\\Microsoft.VisualBasic.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\microsoft.v9921e851#\\cfbddeb6e93e8f421b92229b20e51233\\microsoft.visualbasic.ni.dll")) returned 0x81 [0256.680] CoTaskMemFree (pv=0x587218) [0256.680] GetModuleInformation (in: hProcess=0x2f0, hModule=0x74450000, lpmodinfo=0x24dd210, cb=0xc | out: lpmodinfo=0x24dd210*(lpBaseOfDll=0x74450000, SizeOfImage=0x13000, EntryPoint=0x744518f0)) returned 1 [0256.680] CoTaskMemAlloc (cb=0x804) returned 0x587218 [0256.680] GetModuleBaseNameW (in: hProcess=0x2f0, hModule=0x74450000, lpBaseName=0x587218, nSize=0x800 | out: lpBaseName="nlssorting.dll") returned 0xe [0256.681] CoTaskMemFree (pv=0x587218) [0256.681] CoTaskMemAlloc (cb=0x804) returned 0x587218 [0256.681] GetModuleFileNameExW (in: hProcess=0x2f0, hModule=0x74450000, lpFilename=0x587218, nSize=0x800 | out: lpFilename="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\nlssorting.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\nlssorting.dll")) returned 0x3c [0256.681] CoTaskMemFree (pv=0x587218) [0256.681] GetModuleInformation (in: hProcess=0x2f0, hModule=0x74430000, lpmodinfo=0x24df360, cb=0xc | out: lpmodinfo=0x24df360*(lpBaseOfDll=0x74430000, SizeOfImage=0x16000, EntryPoint=0x74432dc3)) returned 1 [0256.682] CoTaskMemAlloc (cb=0x804) returned 0x587218 [0256.682] GetModuleBaseNameW (in: hProcess=0x2f0, hModule=0x74430000, lpBaseName=0x587218, nSize=0x800 | out: lpBaseName="CRYPTSP.dll") returned 0xb [0256.682] CoTaskMemFree (pv=0x587218) [0256.682] CoTaskMemAlloc (cb=0x804) returned 0x587218 [0256.682] GetModuleFileNameExW (in: hProcess=0x2f0, hModule=0x74430000, lpFilename=0x587218, nSize=0x800 | out: lpFilename="C:\\Windows\\system32\\CRYPTSP.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll")) returned 0x1f [0256.683] CoTaskMemFree (pv=0x587218) [0256.683] GetModuleInformation (in: hProcess=0x2f0, hModule=0x743f0000, lpmodinfo=0x24e146c, cb=0xc | out: lpmodinfo=0x24e146c*(lpBaseOfDll=0x743f0000, SizeOfImage=0x3b000, EntryPoint=0x743f128d)) returned 1 [0256.683] CoTaskMemAlloc (cb=0x804) returned 0x587218 [0256.683] GetModuleBaseNameW (in: hProcess=0x2f0, hModule=0x743f0000, lpBaseName=0x587218, nSize=0x800 | out: lpBaseName="rsaenh.dll") returned 0xa [0256.684] CoTaskMemFree (pv=0x587218) [0256.684] CoTaskMemAlloc (cb=0x804) returned 0x587218 [0256.684] GetModuleFileNameExW (in: hProcess=0x2f0, hModule=0x743f0000, lpFilename=0x587218, nSize=0x800 | out: lpFilename="C:\\Windows\\system32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll")) returned 0x1e [0256.684] CoTaskMemFree (pv=0x587218) [0256.684] GetModuleInformation (in: hProcess=0x2f0, hModule=0x774f0000, lpmodinfo=0x24e3684, cb=0xc | out: lpmodinfo=0x24e3684*(lpBaseOfDll=0x774f0000, SizeOfImage=0x5000, EntryPoint=0x774f1438)) returned 1 [0256.685] CoTaskMemAlloc (cb=0x804) returned 0x587218 [0256.685] GetModuleBaseNameW (in: hProcess=0x2f0, hModule=0x774f0000, lpBaseName=0x587218, nSize=0x800 | out: lpBaseName="psapi.dll") returned 0x9 [0256.685] CoTaskMemFree (pv=0x587218) [0256.685] CoTaskMemAlloc (cb=0x804) returned 0x587218 [0256.685] GetModuleFileNameExW (in: hProcess=0x2f0, hModule=0x774f0000, lpFilename=0x587218, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\psapi.dll" (normalized: "c:\\windows\\syswow64\\psapi.dll")) returned 0x1d [0256.686] CoTaskMemFree (pv=0x587218) [0256.686] CloseHandle (hObject=0x2f0) returned 1 [0257.631] SleepEx (dwMilliseconds=0x7d0, bAlertable=1) returned 0x0 [0260.172] SleepEx (dwMilliseconds=0x7d0, bAlertable=1) returned 0x0 [0262.683] SleepEx (dwMilliseconds=0x7d0, bAlertable=1) returned 0x0 [0265.217] SleepEx (dwMilliseconds=0x7d0, bAlertable=1) returned 0x0 [0267.693] SleepEx (dwMilliseconds=0x7d0, bAlertable=1) returned 0x0 [0271.471] SleepEx (dwMilliseconds=0x7d0, bAlertable=1) returned 0x0 [0274.068] SleepEx (dwMilliseconds=0x7d0, bAlertable=1) returned 0x0 [0276.707] SleepEx (dwMilliseconds=0x7d0, bAlertable=1) returned 0x0 [0279.309] SleepEx (dwMilliseconds=0x7d0, bAlertable=1) Thread: id = 78 os_tid = 0x578 Thread: id = 79 os_tid = 0x66c [0247.011] CoGetContextToken (in: pToken=0x458f59c | out: pToken=0x458f59c) returned 0x800401f0 [0247.012] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 Thread: id = 81 os_tid = 0x668 Thread: id = 82 os_tid = 0x79c [0255.200] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0255.225] CoUninitialize () Thread: id = 84 os_tid = 0x7bc [0255.260] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0255.267] CoUninitialize () Thread: id = 86 os_tid = 0x7a4 [0255.290] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0255.295] CoUninitialize () Thread: id = 88 os_tid = 0x7cc [0255.445] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0255.455] CoUninitialize () Thread: id = 91 os_tid = 0x7e8 [0255.471] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0255.476] CoUninitialize () Thread: id = 93 os_tid = 0x7e4 [0255.487] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0255.492] CoUninitialize () Thread: id = 95 os_tid = 0x7f8 [0255.503] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0255.508] CoUninitialize () Thread: id = 97 os_tid = 0x7dc [0255.520] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0255.524] CoUninitialize () Thread: id = 99 os_tid = 0x594 [0255.534] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0255.539] CoUninitialize () Thread: id = 101 os_tid = 0x590 [0255.550] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0255.555] CoUninitialize () Process: id = "10" image_name = "unlikexpc.exe" filename = "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\unlikexpc.exe" page_root = "0xec87000" os_pid = "0x7b0" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "autostart" parent_id = "0" os_parent_pid = "0x0" cmd_line = "\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\unlikexpc.exe\" " cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:00015e2b" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 2671 start_va = 0x10000 end_va = 0x2ffff entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 2672 start_va = 0x30000 end_va = 0x31fff entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 2673 start_va = 0x40000 end_va = 0x40fff entry_point = 0x40000 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 2674 start_va = 0x50000 end_va = 0x53fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000050000" filename = "" Region: id = 2675 start_va = 0x60000 end_va = 0x60fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000060000" filename = "" Region: id = 2676 start_va = 0x110000 end_va = 0x14ffff entry_point = 0x0 region_type = private name = "private_0x0000000000110000" filename = "" Region: id = 2677 start_va = 0x170000 end_va = 0x26ffff entry_point = 0x0 region_type = private name = "private_0x0000000000170000" filename = "" Region: id = 2678 start_va = 0x1380000 end_va = 0x13bdfff entry_point = 0x1380000 region_type = mapped_file name = "unlikexpc.exe" filename = "\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\unlikexpc.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\unlikexpc.exe") Region: id = 2679 start_va = 0x77950000 end_va = 0x77af8fff entry_point = 0x77950000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 2680 start_va = 0x77b30000 end_va = 0x77caffff entry_point = 0x77b30000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll") Region: id = 2681 start_va = 0x7efb0000 end_va = 0x7efd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efb0000" filename = "" Region: id = 2682 start_va = 0x7efdb000 end_va = 0x7efddfff entry_point = 0x0 region_type = private name = "private_0x000000007efdb000" filename = "" Region: id = 2683 start_va = 0x7efde000 end_va = 0x7efdefff entry_point = 0x0 region_type = private name = "private_0x000000007efde000" filename = "" Region: id = 2684 start_va = 0x7efdf000 end_va = 0x7efdffff entry_point = 0x0 region_type = private name = "private_0x000000007efdf000" filename = "" Region: id = 2685 start_va = 0x7efe0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 2686 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 2687 start_va = 0x7fff0000 end_va = 0x7fffffeffff entry_point = 0x0 region_type = private name = "private_0x000000007fff0000" filename = "" Region: id = 2688 start_va = 0x2a0000 end_va = 0x31ffff entry_point = 0x0 region_type = private name = "private_0x00000000002a0000" filename = "" Region: id = 2689 start_va = 0x74080000 end_va = 0x74087fff entry_point = 0x74080000 region_type = mapped_file name = "wow64cpu.dll" filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll") Region: id = 2690 start_va = 0x74090000 end_va = 0x740ebfff entry_point = 0x74090000 region_type = mapped_file name = "wow64win.dll" filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll") Region: id = 2691 start_va = 0x740f0000 end_va = 0x7412efff entry_point = 0x740f0000 region_type = mapped_file name = "wow64.dll" filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll") Region: id = 2702 start_va = 0x10000 end_va = 0x1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 2703 start_va = 0x70000 end_va = 0xd6fff entry_point = 0x70000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 2704 start_va = 0x350000 end_va = 0x44ffff entry_point = 0x0 region_type = private name = "private_0x0000000000350000" filename = "" Region: id = 2705 start_va = 0x73e90000 end_va = 0x73ed9fff entry_point = 0x73e90000 region_type = mapped_file name = "mscoree.dll" filename = "\\Windows\\SysWOW64\\mscoree.dll" (normalized: "c:\\windows\\syswow64\\mscoree.dll") Region: id = 2706 start_va = 0x75880000 end_va = 0x758c5fff entry_point = 0x75880000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll") Region: id = 2707 start_va = 0x77100000 end_va = 0x7720ffff entry_point = 0x77100000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll") Region: id = 2708 start_va = 0x77730000 end_va = 0x77829fff entry_point = 0x0 region_type = private name = "private_0x0000000077730000" filename = "" Region: id = 2709 start_va = 0x77830000 end_va = 0x7794efff entry_point = 0x0 region_type = private name = "private_0x0000000077830000" filename = "" Region: id = 2710 start_va = 0x7efe0000 end_va = 0x7f0dffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 2711 start_va = 0x7f0e0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 2724 start_va = 0x20000 end_va = 0x2ffff entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 2725 start_va = 0x450000 end_va = 0x48ffff entry_point = 0x0 region_type = private name = "private_0x0000000000450000" filename = "" Region: id = 2726 start_va = 0x5c0000 end_va = 0x5cffff entry_point = 0x0 region_type = private name = "private_0x00000000005c0000" filename = "" Region: id = 2727 start_va = 0x75680000 end_va = 0x7568bfff entry_point = 0x75680000 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll") Region: id = 2728 start_va = 0x75690000 end_va = 0x756effff entry_point = 0x75690000 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll") Region: id = 2729 start_va = 0x75a60000 end_va = 0x75b0bfff entry_point = 0x75a60000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll") Region: id = 2730 start_va = 0x76b50000 end_va = 0x76b68fff entry_point = 0x76b50000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll") Region: id = 2731 start_va = 0x77210000 end_va = 0x772fffff entry_point = 0x77210000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll") Region: id = 2732 start_va = 0x77690000 end_va = 0x7772ffff entry_point = 0x77690000 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll") Region: id = 2735 start_va = 0x73310000 end_va = 0x73387fff entry_point = 0x73310000 region_type = mapped_file name = "mscoreei.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscoreei.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\mscoreei.dll") Region: id = 2744 start_va = 0x5d0000 end_va = 0x757fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005d0000" filename = "" Region: id = 2745 start_va = 0x756f0000 end_va = 0x7574ffff entry_point = 0x756f0000 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll") Region: id = 2746 start_va = 0x75b10000 end_va = 0x75b66fff entry_point = 0x75b10000 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\SysWOW64\\shlwapi.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll") Region: id = 2747 start_va = 0x76ab0000 end_va = 0x76b4cfff entry_point = 0x76ab0000 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\SysWOW64\\usp10.dll" (normalized: "c:\\windows\\syswow64\\usp10.dll") Region: id = 2748 start_va = 0x76d70000 end_va = 0x76dfffff entry_point = 0x76d70000 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll") Region: id = 2749 start_va = 0x77060000 end_va = 0x77069fff entry_point = 0x77060000 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\SysWOW64\\lpk.dll" (normalized: "c:\\windows\\syswow64\\lpk.dll") Region: id = 2750 start_va = 0x77420000 end_va = 0x774ebfff entry_point = 0x77420000 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll") Region: id = 2751 start_va = 0x77590000 end_va = 0x7768ffff entry_point = 0x77590000 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll") Region: id = 2752 start_va = 0x30000 end_va = 0x30fff entry_point = 0x0 region_type = private name = "private_0x0000000000030000" filename = "" Region: id = 2753 start_va = 0xe0000 end_va = 0xe0fff entry_point = 0x0 region_type = private name = "private_0x00000000000e0000" filename = "" Region: id = 2754 start_va = 0x760000 end_va = 0x8e0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000760000" filename = "" Region: id = 2755 start_va = 0x13c0000 end_va = 0x27bffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000013c0000" filename = "" Region: id = 2756 start_va = 0x75650000 end_va = 0x75658fff entry_point = 0x75650000 region_type = mapped_file name = "version.dll" filename = "\\Windows\\SysWOW64\\version.dll" (normalized: "c:\\windows\\syswow64\\version.dll") Region: id = 2764 start_va = 0x74ea0000 end_va = 0x74f94fff entry_point = 0x74ea0000 region_type = mapped_file name = "msvcr120_clr0400.dll" filename = "\\Windows\\SysWOW64\\msvcr120_clr0400.dll" (normalized: "c:\\windows\\syswow64\\msvcr120_clr0400.dll") Region: id = 2765 start_va = 0x74fa0000 end_va = 0x75647fff entry_point = 0x74fa0000 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\clr.dll") Region: id = 2793 start_va = 0xf0000 end_va = 0xf0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000000f0000" filename = "" Region: id = 2794 start_va = 0x100000 end_va = 0x10ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000100000" filename = "" Region: id = 2795 start_va = 0x150000 end_va = 0x15ffff entry_point = 0x0 region_type = private name = "private_0x0000000000150000" filename = "" Region: id = 2796 start_va = 0x160000 end_va = 0x16ffff entry_point = 0x0 region_type = private name = "private_0x0000000000160000" filename = "" Region: id = 2797 start_va = 0x270000 end_va = 0x27ffff entry_point = 0x0 region_type = private name = "private_0x0000000000270000" filename = "" Region: id = 2798 start_va = 0x280000 end_va = 0x28ffff entry_point = 0x0 region_type = private name = "private_0x0000000000280000" filename = "" Region: id = 2799 start_va = 0x290000 end_va = 0x29ffff entry_point = 0x0 region_type = private name = "private_0x0000000000290000" filename = "" Region: id = 2800 start_va = 0x320000 end_va = 0x320fff entry_point = 0x0 region_type = private name = "private_0x0000000000320000" filename = "" Region: id = 2801 start_va = 0x330000 end_va = 0x330fff entry_point = 0x0 region_type = private name = "private_0x0000000000330000" filename = "" Region: id = 2802 start_va = 0x4f0000 end_va = 0x52ffff entry_point = 0x0 region_type = private name = "private_0x00000000004f0000" filename = "" Region: id = 2803 start_va = 0x560000 end_va = 0x59ffff entry_point = 0x0 region_type = private name = "private_0x0000000000560000" filename = "" Region: id = 2804 start_va = 0x8f0000 end_va = 0x98ffff entry_point = 0x0 region_type = private name = "private_0x00000000008f0000" filename = "" Region: id = 2805 start_va = 0x9e0000 end_va = 0xa1ffff entry_point = 0x0 region_type = private name = "private_0x00000000009e0000" filename = "" Region: id = 2806 start_va = 0xa20000 end_va = 0xa5ffff entry_point = 0x0 region_type = private name = "private_0x0000000000a20000" filename = "" Region: id = 2807 start_va = 0xa80000 end_va = 0xb7ffff entry_point = 0x0 region_type = private name = "private_0x0000000000a80000" filename = "" Region: id = 2808 start_va = 0xbe0000 end_va = 0xcdffff entry_point = 0x0 region_type = private name = "private_0x0000000000be0000" filename = "" Region: id = 2809 start_va = 0xd00000 end_va = 0xdfffff entry_point = 0x0 region_type = private name = "private_0x0000000000d00000" filename = "" Region: id = 2810 start_va = 0xe40000 end_va = 0xe7ffff entry_point = 0x0 region_type = private name = "private_0x0000000000e40000" filename = "" Region: id = 2811 start_va = 0xe80000 end_va = 0x114efff entry_point = 0xe80000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 2812 start_va = 0x27c0000 end_va = 0x47bffff entry_point = 0x0 region_type = private name = "private_0x00000000027c0000" filename = "" Region: id = 2813 start_va = 0x720d0000 end_va = 0x732fafff entry_point = 0x720d0000 region_type = mapped_file name = "mscorlib.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\b7a12c4c0032847fcc6b9c710460456f\\mscorlib.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\mscorlib\\b7a12c4c0032847fcc6b9c710460456f\\mscorlib.ni.dll") Region: id = 2814 start_va = 0x7efad000 end_va = 0x7efaffff entry_point = 0x0 region_type = private name = "private_0x000000007efad000" filename = "" Region: id = 2815 start_va = 0x7efd5000 end_va = 0x7efd7fff entry_point = 0x0 region_type = private name = "private_0x000000007efd5000" filename = "" Region: id = 2816 start_va = 0x7efd8000 end_va = 0x7efdafff entry_point = 0x0 region_type = private name = "private_0x000000007efd8000" filename = "" Region: id = 2817 start_va = 0x76e70000 end_va = 0x76fcbfff entry_point = 0x76e70000 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\SysWOW64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll") Region: id = 2818 start_va = 0x73e10000 end_va = 0x73e8ffff entry_point = 0x73e10000 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\SysWOW64\\uxtheme.dll" (normalized: "c:\\windows\\syswow64\\uxtheme.dll") Region: id = 2819 start_va = 0x1150000 end_va = 0x125ffff entry_point = 0x0 region_type = private name = "private_0x0000000001150000" filename = "" Region: id = 2822 start_va = 0x1260000 end_va = 0x133efff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000001260000" filename = "" Region: id = 2824 start_va = 0x340000 end_va = 0x34ffff entry_point = 0x0 region_type = private name = "private_0x0000000000340000" filename = "" Region: id = 2825 start_va = 0x74e20000 end_va = 0x74e9cfff entry_point = 0x74e20000 region_type = mapped_file name = "clrjit.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clrjit.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\clrjit.dll") Region: id = 2826 start_va = 0x76fd0000 end_va = 0x7705efff entry_point = 0x76fd0000 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\SysWOW64\\oleaut32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll") Region: id = 2829 start_va = 0x490000 end_va = 0x49ffff entry_point = 0x0 region_type = private name = "private_0x0000000000490000" filename = "" Region: id = 2830 start_va = 0x4a0000 end_va = 0x4b0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000004a0000" filename = "" Region: id = 2831 start_va = 0x1150000 end_va = 0x11b1fff entry_point = 0x1150000 region_type = mapped_file name = "mscorrc.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorrc.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\mscorrc.dll") Region: id = 2832 start_va = 0x1220000 end_va = 0x125ffff entry_point = 0x0 region_type = private name = "private_0x0000000001220000" filename = "" Region: id = 2833 start_va = 0x48c0000 end_va = 0x48fffff entry_point = 0x0 region_type = private name = "private_0x00000000048c0000" filename = "" Region: id = 2834 start_va = 0x719b0000 end_va = 0x720c5fff entry_point = 0x719b0000 region_type = mapped_file name = "system.core.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Core\\386fde9190d499d6645df8b90eb76242\\System.Core.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.core\\386fde9190d499d6645df8b90eb76242\\system.core.ni.dll") Region: id = 2835 start_va = 0x73c40000 end_va = 0x73e0afff entry_point = 0x73c40000 region_type = mapped_file name = "microsoft.visualbasic.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Microsoft.V9921e851#\\cfbddeb6e93e8f421b92229b20e51233\\Microsoft.VisualBasic.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\microsoft.v9921e851#\\cfbddeb6e93e8f421b92229b20e51233\\microsoft.visualbasic.ni.dll") Region: id = 2836 start_va = 0x74470000 end_va = 0x74e1cfff entry_point = 0x74470000 region_type = mapped_file name = "system.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System\\500ffa28b327e171fe664023003e947e\\System.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system\\500ffa28b327e171fe664023003e947e\\system.ni.dll") Region: id = 2845 start_va = 0x74450000 end_va = 0x74462fff entry_point = 0x74450000 region_type = mapped_file name = "nlssorting.dll" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\nlssorting.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\nlssorting.dll") Region: id = 2848 start_va = 0x4900000 end_va = 0x4bd1fff entry_point = 0x4900000 region_type = mapped_file name = "sortdefault.nlp" filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\sortdefault.nlp" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\sortdefault.nlp") Region: id = 2849 start_va = 0x743f0000 end_va = 0x7442afff entry_point = 0x743f0000 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll") Region: id = 2850 start_va = 0x74430000 end_va = 0x74445fff entry_point = 0x74430000 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\SysWOW64\\cryptsp.dll" (normalized: "c:\\windows\\syswow64\\cryptsp.dll") Region: id = 2852 start_va = 0x4c0000 end_va = 0x4cffff entry_point = 0x0 region_type = private name = "private_0x00000000004c0000" filename = "" Region: id = 2853 start_va = 0x4d0000 end_va = 0x4dffff entry_point = 0x0 region_type = private name = "private_0x00000000004d0000" filename = "" Region: id = 2854 start_va = 0x530000 end_va = 0x554fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000530000" filename = "" Region: id = 2855 start_va = 0x5a0000 end_va = 0x5bcfff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000005a0000" filename = "" Region: id = 2861 start_va = 0x774f0000 end_va = 0x774f4fff entry_point = 0x774f0000 region_type = mapped_file name = "psapi.dll" filename = "\\Windows\\SysWOW64\\psapi.dll" (normalized: "c:\\windows\\syswow64\\psapi.dll") Thread: id = 75 os_tid = 0x7b4 [0247.004] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0 [0247.297] EtwEventRegister () returned 0x0 [0247.327] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\unlikexpc.exe.config", nBufferLength=0x105, lpBuffer=0x26e6e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\unlikexpc.exe.config", lpFilePart=0x0) returned 0x70 [0247.327] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x26eb74) returned 1 [0247.328] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\unlikexpc.exe.config" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\unlikexpc.exe.config"), fInfoLevelId=0x0, lpFileInformation=0x26ebf0 | out: lpFileInformation=0x26ebf0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0247.328] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x26eb70) returned 1 [0255.826] GetCurrentProcessId () returned 0x7b0 [0256.603] LookupPrivilegeValueW (in: lpSystemName=0x0, lpName="SeDebugPrivilege", lpLuid=0x26b2cc | out: lpLuid=0x26b2cc*(LowPart=0x14, HighPart=0)) returned 1 [0256.603] GetCurrentProcess () returned 0xffffffff [0256.603] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x20, TokenHandle=0x26b2c8 | out: TokenHandle=0x26b2c8*=0x2f0) returned 1 [0256.604] AdjustTokenPrivileges (in: TokenHandle=0x2f0, DisableAllPrivileges=0, NewState=0x2aba11c*(PrivilegesCount=0x1, Privileges=((Luid.LowPart=0x14, Luid.HighPart=0, Attributes=0x2))), BufferLength=0x0, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1 [0256.605] CloseHandle (hObject=0x2f0) returned 1 [0256.633] OpenProcess (dwDesiredAccess=0x410, bInheritHandle=0, dwProcessId=0x7b0) returned 0x2f0 [0256.638] EnumProcessModules (in: hProcess=0x2f0, lphModule=0x2aba998, cb=0x100, lpcbNeeded=0x26b9a0 | out: lphModule=0x2aba998, lpcbNeeded=0x26b9a0) returned 1 [0256.639] GetModuleInformation (in: hProcess=0x2f0, hModule=0x1380000, lpmodinfo=0x2abaad8, cb=0xc | out: lpmodinfo=0x2abaad8*(lpBaseOfDll=0x1380000, SizeOfImage=0x3e000, EntryPoint=0x13b79ce)) returned 1 [0256.640] CoTaskMemAlloc (cb=0x804) returned 0x3f8670 [0256.640] GetModuleBaseNameW (in: hProcess=0x2f0, hModule=0x1380000, lpBaseName=0x3f8670, nSize=0x800 | out: lpBaseName="unlikexpc.exe") returned 0xd [0256.640] CoTaskMemFree (pv=0x3f8670) [0256.641] CoTaskMemAlloc (cb=0x804) returned 0x3f8670 [0256.641] GetModuleFileNameExW (in: hProcess=0x2f0, hModule=0x1380000, lpFilename=0x3f8670, nSize=0x800 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\unlikexpc.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\unlikexpc.exe")) returned 0x69 [0256.641] CoTaskMemFree (pv=0x3f8670) [0256.641] GetModuleInformation (in: hProcess=0x2f0, hModule=0x77b30000, lpmodinfo=0x2abccb4, cb=0xc | out: lpmodinfo=0x2abccb4*(lpBaseOfDll=0x77b30000, SizeOfImage=0x180000, EntryPoint=0x0)) returned 1 [0256.641] CoTaskMemAlloc (cb=0x804) returned 0x3f8670 [0256.641] GetModuleBaseNameW (in: hProcess=0x2f0, hModule=0x77b30000, lpBaseName=0x3f8670, nSize=0x800 | out: lpBaseName="ntdll.dll") returned 0x9 [0256.641] CoTaskMemFree (pv=0x3f8670) [0256.641] CoTaskMemAlloc (cb=0x804) returned 0x3f8670 [0256.641] GetModuleFileNameExW (in: hProcess=0x2f0, hModule=0x77b30000, lpFilename=0x3f8670, nSize=0x800 | out: lpFilename="C:\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll")) returned 0x1d [0256.641] CoTaskMemFree (pv=0x3f8670) [0256.641] GetModuleInformation (in: hProcess=0x2f0, hModule=0x73e90000, lpmodinfo=0x2abedb8, cb=0xc | out: lpmodinfo=0x2abedb8*(lpBaseOfDll=0x73e90000, SizeOfImage=0x4a000, EntryPoint=0x73e92e54)) returned 1 [0256.642] CoTaskMemAlloc (cb=0x804) returned 0x3f8670 [0256.642] GetModuleBaseNameW (in: hProcess=0x2f0, hModule=0x73e90000, lpBaseName=0x3f8670, nSize=0x800 | out: lpBaseName="MSCOREE.DLL") returned 0xb [0256.642] CoTaskMemFree (pv=0x3f8670) [0256.642] CoTaskMemAlloc (cb=0x804) returned 0x3f8670 [0256.642] GetModuleFileNameExW (in: hProcess=0x2f0, hModule=0x73e90000, lpFilename=0x3f8670, nSize=0x800 | out: lpFilename="C:\\Windows\\SYSTEM32\\MSCOREE.DLL" (normalized: "c:\\windows\\system32\\mscoree.dll")) returned 0x1f [0256.642] CoTaskMemFree (pv=0x3f8670) [0256.642] GetModuleInformation (in: hProcess=0x2f0, hModule=0x77100000, lpmodinfo=0x2ac0ec4, cb=0xc | out: lpmodinfo=0x2ac0ec4*(lpBaseOfDll=0x77100000, SizeOfImage=0x110000, EntryPoint=0x771132d3)) returned 1 [0256.642] CoTaskMemAlloc (cb=0x804) returned 0x3f8670 [0256.642] GetModuleBaseNameW (in: hProcess=0x2f0, hModule=0x77100000, lpBaseName=0x3f8670, nSize=0x800 | out: lpBaseName="KERNEL32.dll") returned 0xc [0256.642] CoTaskMemFree (pv=0x3f8670) [0256.642] CoTaskMemAlloc (cb=0x804) returned 0x3f8670 [0256.642] GetModuleFileNameExW (in: hProcess=0x2f0, hModule=0x77100000, lpFilename=0x3f8670, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\KERNEL32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll")) returned 0x20 [0256.643] CoTaskMemFree (pv=0x3f8670) [0256.643] GetModuleInformation (in: hProcess=0x2f0, hModule=0x75880000, lpmodinfo=0x2ac2fd8, cb=0xc | out: lpmodinfo=0x2ac2fd8*(lpBaseOfDll=0x75880000, SizeOfImage=0x46000, EntryPoint=0x75887478)) returned 1 [0256.643] CoTaskMemAlloc (cb=0x804) returned 0x3f8670 [0256.643] GetModuleBaseNameW (in: hProcess=0x2f0, hModule=0x75880000, lpBaseName=0x3f8670, nSize=0x800 | out: lpBaseName="KERNELBASE.dll") returned 0xe [0256.643] CoTaskMemFree (pv=0x3f8670) [0256.643] CoTaskMemAlloc (cb=0x804) returned 0x3f8670 [0256.643] GetModuleFileNameExW (in: hProcess=0x2f0, hModule=0x75880000, lpFilename=0x3f8670, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\KERNELBASE.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll")) returned 0x22 [0256.643] CoTaskMemFree (pv=0x3f8670) [0256.643] GetModuleInformation (in: hProcess=0x2f0, hModule=0x77690000, lpmodinfo=0x2ac5120, cb=0xc | out: lpmodinfo=0x2ac5120*(lpBaseOfDll=0x77690000, SizeOfImage=0xa0000, EntryPoint=0x776a49e5)) returned 1 [0256.643] CoTaskMemAlloc (cb=0x804) returned 0x3f8670 [0256.643] GetModuleBaseNameW (in: hProcess=0x2f0, hModule=0x77690000, lpBaseName=0x3f8670, nSize=0x800 | out: lpBaseName="ADVAPI32.dll") returned 0xc [0256.644] CoTaskMemFree (pv=0x3f8670) [0256.644] CoTaskMemAlloc (cb=0x804) returned 0x3f8670 [0256.644] GetModuleFileNameExW (in: hProcess=0x2f0, hModule=0x77690000, lpFilename=0x3f8670, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\ADVAPI32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll")) returned 0x20 [0256.644] CoTaskMemFree (pv=0x3f8670) [0256.644] GetModuleInformation (in: hProcess=0x2f0, hModule=0x75a60000, lpmodinfo=0x2ac7234, cb=0xc | out: lpmodinfo=0x2ac7234*(lpBaseOfDll=0x75a60000, SizeOfImage=0xac000, EntryPoint=0x75a6a472)) returned 1 [0256.644] CoTaskMemAlloc (cb=0x804) returned 0x3f8670 [0256.644] GetModuleBaseNameW (in: hProcess=0x2f0, hModule=0x75a60000, lpBaseName=0x3f8670, nSize=0x800 | out: lpBaseName="msvcrt.dll") returned 0xa [0256.644] CoTaskMemFree (pv=0x3f8670) [0256.644] CoTaskMemAlloc (cb=0x804) returned 0x3f8670 [0256.644] GetModuleFileNameExW (in: hProcess=0x2f0, hModule=0x75a60000, lpFilename=0x3f8670, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll")) returned 0x1e [0256.644] CoTaskMemFree (pv=0x3f8670) [0256.644] GetModuleInformation (in: hProcess=0x2f0, hModule=0x76b50000, lpmodinfo=0x2ac9340, cb=0xc | out: lpmodinfo=0x2ac9340*(lpBaseOfDll=0x76b50000, SizeOfImage=0x19000, EntryPoint=0x76b54975)) returned 1 [0256.645] CoTaskMemAlloc (cb=0x804) returned 0x3f8670 [0256.645] GetModuleBaseNameW (in: hProcess=0x2f0, hModule=0x76b50000, lpBaseName=0x3f8670, nSize=0x800 | out: lpBaseName="sechost.dll") returned 0xb [0256.645] CoTaskMemFree (pv=0x3f8670) [0256.645] CoTaskMemAlloc (cb=0x804) returned 0x3f8670 [0256.645] GetModuleFileNameExW (in: hProcess=0x2f0, hModule=0x76b50000, lpFilename=0x3f8670, nSize=0x800 | out: lpFilename="C:\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll")) returned 0x1f [0256.645] CoTaskMemFree (pv=0x3f8670) [0256.645] GetModuleInformation (in: hProcess=0x2f0, hModule=0x77210000, lpmodinfo=0x2acb44c, cb=0xc | out: lpmodinfo=0x2acb44c*(lpBaseOfDll=0x77210000, SizeOfImage=0xf0000, EntryPoint=0x77220569)) returned 1 [0256.645] CoTaskMemAlloc (cb=0x804) returned 0x3f8670 [0256.645] GetModuleBaseNameW (in: hProcess=0x2f0, hModule=0x77210000, lpBaseName=0x3f8670, nSize=0x800 | out: lpBaseName="RPCRT4.dll") returned 0xa [0256.646] CoTaskMemFree (pv=0x3f8670) [0256.646] CoTaskMemAlloc (cb=0x804) returned 0x3f8670 [0256.646] GetModuleFileNameExW (in: hProcess=0x2f0, hModule=0x77210000, lpFilename=0x3f8670, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\RPCRT4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll")) returned 0x1e [0256.646] CoTaskMemFree (pv=0x3f8670) [0256.646] GetModuleInformation (in: hProcess=0x2f0, hModule=0x75690000, lpmodinfo=0x2acd5a4, cb=0xc | out: lpmodinfo=0x2acd5a4*(lpBaseOfDll=0x75690000, SizeOfImage=0x60000, EntryPoint=0x756aa3b3)) returned 1 [0256.646] CoTaskMemAlloc (cb=0x804) returned 0x3f8670 [0256.646] GetModuleBaseNameW (in: hProcess=0x2f0, hModule=0x75690000, lpBaseName=0x3f8670, nSize=0x800 | out: lpBaseName="SspiCli.dll") returned 0xb [0256.646] CoTaskMemFree (pv=0x3f8670) [0256.646] CoTaskMemAlloc (cb=0x804) returned 0x3f8670 [0256.646] GetModuleFileNameExW (in: hProcess=0x2f0, hModule=0x75690000, lpFilename=0x3f8670, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\SspiCli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll")) returned 0x1f [0256.647] CoTaskMemFree (pv=0x3f8670) [0256.647] GetModuleInformation (in: hProcess=0x2f0, hModule=0x75680000, lpmodinfo=0x2acf6b0, cb=0xc | out: lpmodinfo=0x2acf6b0*(lpBaseOfDll=0x75680000, SizeOfImage=0xc000, EntryPoint=0x756810e1)) returned 1 [0256.647] CoTaskMemAlloc (cb=0x804) returned 0x3f8670 [0256.647] GetModuleBaseNameW (in: hProcess=0x2f0, hModule=0x75680000, lpBaseName=0x3f8670, nSize=0x800 | out: lpBaseName="CRYPTBASE.dll") returned 0xd [0256.647] CoTaskMemFree (pv=0x3f8670) [0256.647] CoTaskMemAlloc (cb=0x804) returned 0x3f8670 [0256.647] GetModuleFileNameExW (in: hProcess=0x2f0, hModule=0x75680000, lpFilename=0x3f8670, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\CRYPTBASE.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll")) returned 0x21 [0256.647] CoTaskMemFree (pv=0x3f8670) [0256.647] GetModuleInformation (in: hProcess=0x2f0, hModule=0x73310000, lpmodinfo=0x2ad17c4, cb=0xc | out: lpmodinfo=0x2ad17c4*(lpBaseOfDll=0x73310000, SizeOfImage=0x78000, EntryPoint=0x7331f7ba)) returned 1 [0256.648] CoTaskMemAlloc (cb=0x804) returned 0x3f8670 [0256.648] GetModuleBaseNameW (in: hProcess=0x2f0, hModule=0x73310000, lpBaseName=0x3f8670, nSize=0x800 | out: lpBaseName="mscoreei.dll") returned 0xc [0256.648] CoTaskMemFree (pv=0x3f8670) [0256.648] CoTaskMemAlloc (cb=0x804) returned 0x3f8670 [0256.648] GetModuleFileNameExW (in: hProcess=0x2f0, hModule=0x73310000, lpFilename=0x3f8670, nSize=0x800 | out: lpFilename="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscoreei.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\mscoreei.dll")) returned 0x3a [0256.656] CoTaskMemFree (pv=0x3f8670) [0256.656] GetModuleInformation (in: hProcess=0x2f0, hModule=0x75b10000, lpmodinfo=0x2ad390c, cb=0xc | out: lpmodinfo=0x2ad390c*(lpBaseOfDll=0x75b10000, SizeOfImage=0x57000, EntryPoint=0x75b29ba6)) returned 1 [0256.656] CoTaskMemAlloc (cb=0x804) returned 0x3f8670 [0256.656] GetModuleBaseNameW (in: hProcess=0x2f0, hModule=0x75b10000, lpBaseName=0x3f8670, nSize=0x800 | out: lpBaseName="SHLWAPI.dll") returned 0xb [0256.657] CoTaskMemFree (pv=0x3f8670) [0256.657] CoTaskMemAlloc (cb=0x804) returned 0x3f8670 [0256.657] GetModuleFileNameExW (in: hProcess=0x2f0, hModule=0x75b10000, lpFilename=0x3f8670, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\SHLWAPI.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll")) returned 0x1f [0256.657] CoTaskMemFree (pv=0x3f8670) [0256.657] GetModuleInformation (in: hProcess=0x2f0, hModule=0x76d70000, lpmodinfo=0x2ad5a18, cb=0xc | out: lpmodinfo=0x2ad5a18*(lpBaseOfDll=0x76d70000, SizeOfImage=0x90000, EntryPoint=0x76d86343)) returned 1 [0256.657] CoTaskMemAlloc (cb=0x804) returned 0x3f8670 [0256.657] GetModuleBaseNameW (in: hProcess=0x2f0, hModule=0x76d70000, lpBaseName=0x3f8670, nSize=0x800 | out: lpBaseName="GDI32.dll") returned 0x9 [0256.657] CoTaskMemFree (pv=0x3f8670) [0256.657] CoTaskMemAlloc (cb=0x804) returned 0x3f8670 [0256.657] GetModuleFileNameExW (in: hProcess=0x2f0, hModule=0x76d70000, lpFilename=0x3f8670, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\GDI32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll")) returned 0x1d [0256.658] CoTaskMemFree (pv=0x3f8670) [0256.658] GetModuleInformation (in: hProcess=0x2f0, hModule=0x77590000, lpmodinfo=0x2ad7b1c, cb=0xc | out: lpmodinfo=0x2ad7b1c*(lpBaseOfDll=0x77590000, SizeOfImage=0x100000, EntryPoint=0x775ab6ed)) returned 1 [0256.658] CoTaskMemAlloc (cb=0x804) returned 0x3f8670 [0256.658] GetModuleBaseNameW (in: hProcess=0x2f0, hModule=0x77590000, lpBaseName=0x3f8670, nSize=0x800 | out: lpBaseName="USER32.dll") returned 0xa [0256.658] CoTaskMemFree (pv=0x3f8670) [0256.658] CoTaskMemAlloc (cb=0x804) returned 0x3f8670 [0256.658] GetModuleFileNameExW (in: hProcess=0x2f0, hModule=0x77590000, lpFilename=0x3f8670, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\USER32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll")) returned 0x1e [0256.659] CoTaskMemFree (pv=0x3f8670) [0256.659] GetModuleInformation (in: hProcess=0x2f0, hModule=0x77060000, lpmodinfo=0x2ad9c28, cb=0xc | out: lpmodinfo=0x2ad9c28*(lpBaseOfDll=0x77060000, SizeOfImage=0xa000, EntryPoint=0x770636a0)) returned 1 [0256.659] CoTaskMemAlloc (cb=0x804) returned 0x3f8670 [0256.659] GetModuleBaseNameW (in: hProcess=0x2f0, hModule=0x77060000, lpBaseName=0x3f8670, nSize=0x800 | out: lpBaseName="LPK.dll") returned 0x7 [0256.659] CoTaskMemFree (pv=0x3f8670) [0256.659] CoTaskMemAlloc (cb=0x804) returned 0x3f8670 [0256.659] GetModuleFileNameExW (in: hProcess=0x2f0, hModule=0x77060000, lpFilename=0x3f8670, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\LPK.dll" (normalized: "c:\\windows\\syswow64\\lpk.dll")) returned 0x1b [0256.660] CoTaskMemFree (pv=0x3f8670) [0256.660] GetModuleInformation (in: hProcess=0x2f0, hModule=0x76ab0000, lpmodinfo=0x2adbd24, cb=0xc | out: lpmodinfo=0x2adbd24*(lpBaseOfDll=0x76ab0000, SizeOfImage=0x9d000, EntryPoint=0x76ae3fd7)) returned 1 [0256.660] CoTaskMemAlloc (cb=0x804) returned 0x3f8670 [0256.660] GetModuleBaseNameW (in: hProcess=0x2f0, hModule=0x76ab0000, lpBaseName=0x3f8670, nSize=0x800 | out: lpBaseName="USP10.dll") returned 0x9 [0256.660] CoTaskMemFree (pv=0x3f8670) [0256.660] CoTaskMemAlloc (cb=0x804) returned 0x3f8670 [0256.660] GetModuleFileNameExW (in: hProcess=0x2f0, hModule=0x76ab0000, lpFilename=0x3f8670, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\USP10.dll" (normalized: "c:\\windows\\syswow64\\usp10.dll")) returned 0x1d [0256.660] CoTaskMemFree (pv=0x3f8670) [0256.660] GetModuleInformation (in: hProcess=0x2f0, hModule=0x756f0000, lpmodinfo=0x2addeb4, cb=0xc | out: lpmodinfo=0x2addeb4*(lpBaseOfDll=0x756f0000, SizeOfImage=0x60000, EntryPoint=0x7570158f)) returned 1 [0256.661] CoTaskMemAlloc (cb=0x804) returned 0x3f8670 [0256.661] GetModuleBaseNameW (in: hProcess=0x2f0, hModule=0x756f0000, lpBaseName=0x3f8670, nSize=0x800 | out: lpBaseName="IMM32.DLL") returned 0x9 [0256.661] CoTaskMemFree (pv=0x3f8670) [0256.661] CoTaskMemAlloc (cb=0x804) returned 0x3f8670 [0256.661] GetModuleFileNameExW (in: hProcess=0x2f0, hModule=0x756f0000, lpFilename=0x3f8670, nSize=0x800 | out: lpFilename="C:\\Windows\\system32\\IMM32.DLL" (normalized: "c:\\windows\\system32\\imm32.dll")) returned 0x1d [0256.661] CoTaskMemFree (pv=0x3f8670) [0256.661] GetModuleInformation (in: hProcess=0x2f0, hModule=0x77420000, lpmodinfo=0x2adffb8, cb=0xc | out: lpmodinfo=0x2adffb8*(lpBaseOfDll=0x77420000, SizeOfImage=0xcc000, EntryPoint=0x7742168b)) returned 1 [0256.662] CoTaskMemAlloc (cb=0x804) returned 0x3f8670 [0256.662] GetModuleBaseNameW (in: hProcess=0x2f0, hModule=0x77420000, lpBaseName=0x3f8670, nSize=0x800 | out: lpBaseName="MSCTF.dll") returned 0x9 [0256.662] CoTaskMemFree (pv=0x3f8670) [0256.662] CoTaskMemAlloc (cb=0x804) returned 0x3f8670 [0256.662] GetModuleFileNameExW (in: hProcess=0x2f0, hModule=0x77420000, lpFilename=0x3f8670, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\MSCTF.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll")) returned 0x1d [0256.663] CoTaskMemFree (pv=0x3f8670) [0256.663] GetModuleInformation (in: hProcess=0x2f0, hModule=0x75650000, lpmodinfo=0x2ae20bc, cb=0xc | out: lpmodinfo=0x2ae20bc*(lpBaseOfDll=0x75650000, SizeOfImage=0x9000, EntryPoint=0x75651220)) returned 1 [0256.663] CoTaskMemAlloc (cb=0x804) returned 0x3f8670 [0256.663] GetModuleBaseNameW (in: hProcess=0x2f0, hModule=0x75650000, lpBaseName=0x3f8670, nSize=0x800 | out: lpBaseName="VERSION.dll") returned 0xb [0256.663] CoTaskMemFree (pv=0x3f8670) [0256.663] CoTaskMemAlloc (cb=0x804) returned 0x3f8670 [0256.663] GetModuleFileNameExW (in: hProcess=0x2f0, hModule=0x75650000, lpFilename=0x3f8670, nSize=0x800 | out: lpFilename="C:\\Windows\\system32\\VERSION.dll" (normalized: "c:\\windows\\system32\\version.dll")) returned 0x1f [0256.664] CoTaskMemFree (pv=0x3f8670) [0256.664] GetModuleInformation (in: hProcess=0x2f0, hModule=0x74fa0000, lpmodinfo=0x2ae41c8, cb=0xc | out: lpmodinfo=0x2ae41c8*(lpBaseOfDll=0x74fa0000, SizeOfImage=0x6a8000, EntryPoint=0x750e7040)) returned 1 [0256.664] CoTaskMemAlloc (cb=0x804) returned 0x3f8670 [0256.664] GetModuleBaseNameW (in: hProcess=0x2f0, hModule=0x74fa0000, lpBaseName=0x3f8670, nSize=0x800 | out: lpBaseName="clr.dll") returned 0x7 [0256.664] CoTaskMemFree (pv=0x3f8670) [0256.664] CoTaskMemAlloc (cb=0x804) returned 0x3f8670 [0256.664] GetModuleFileNameExW (in: hProcess=0x2f0, hModule=0x74fa0000, lpFilename=0x3f8670, nSize=0x800 | out: lpFilename="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\clr.dll")) returned 0x35 [0256.665] CoTaskMemFree (pv=0x3f8670) [0256.665] GetModuleInformation (in: hProcess=0x2f0, hModule=0x74ea0000, lpmodinfo=0x2ae62f8, cb=0xc | out: lpmodinfo=0x2ae62f8*(lpBaseOfDll=0x74ea0000, SizeOfImage=0xf5000, EntryPoint=0x74ef4160)) returned 1 [0256.665] CoTaskMemAlloc (cb=0x804) returned 0x3f8670 [0256.665] GetModuleBaseNameW (in: hProcess=0x2f0, hModule=0x74ea0000, lpBaseName=0x3f8670, nSize=0x800 | out: lpBaseName="MSVCR120_CLR0400.dll") returned 0x14 [0256.665] CoTaskMemFree (pv=0x3f8670) [0256.665] CoTaskMemAlloc (cb=0x804) returned 0x3f8670 [0256.666] GetModuleFileNameExW (in: hProcess=0x2f0, hModule=0x74ea0000, lpFilename=0x3f8670, nSize=0x800 | out: lpFilename="C:\\Windows\\system32\\MSVCR120_CLR0400.dll" (normalized: "c:\\windows\\system32\\msvcr120_clr0400.dll")) returned 0x28 [0256.666] CoTaskMemFree (pv=0x3f8670) [0256.666] GetModuleInformation (in: hProcess=0x2f0, hModule=0x720d0000, lpmodinfo=0x2ae842c, cb=0xc | out: lpmodinfo=0x2ae842c*(lpBaseOfDll=0x720d0000, SizeOfImage=0x122b000, EntryPoint=0x0)) returned 1 [0256.666] CoTaskMemAlloc (cb=0x804) returned 0x3f8670 [0256.666] GetModuleBaseNameW (in: hProcess=0x2f0, hModule=0x720d0000, lpBaseName=0x3f8670, nSize=0x800 | out: lpBaseName="mscorlib.ni.dll") returned 0xf [0256.667] CoTaskMemFree (pv=0x3f8670) [0256.690] CoTaskMemAlloc (cb=0x804) returned 0x3f8670 [0256.690] GetModuleFileNameExW (in: hProcess=0x2f0, hModule=0x720d0000, lpFilename=0x3f8670, nSize=0x800 | out: lpFilename="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\b7a12c4c0032847fcc6b9c710460456f\\mscorlib.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\mscorlib\\b7a12c4c0032847fcc6b9c710460456f\\mscorlib.ni.dll")) returned 0x68 [0256.690] CoTaskMemFree (pv=0x3f8670) [0256.690] GetModuleInformation (in: hProcess=0x2f0, hModule=0x76e70000, lpmodinfo=0x284e91c, cb=0xc | out: lpmodinfo=0x284e91c*(lpBaseOfDll=0x76e70000, SizeOfImage=0x15c000, EntryPoint=0x76ebba3d)) returned 1 [0256.691] CoTaskMemAlloc (cb=0x804) returned 0x3f8670 [0256.691] GetModuleBaseNameW (in: hProcess=0x2f0, hModule=0x76e70000, lpBaseName=0x3f8670, nSize=0x800 | out: lpBaseName="ole32.dll") returned 0x9 [0256.691] CoTaskMemFree (pv=0x3f8670) [0256.691] CoTaskMemAlloc (cb=0x804) returned 0x3f8670 [0256.691] GetModuleFileNameExW (in: hProcess=0x2f0, hModule=0x76e70000, lpFilename=0x3f8670, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll")) returned 0x1d [0256.691] CoTaskMemFree (pv=0x3f8670) [0256.691] GetModuleInformation (in: hProcess=0x2f0, hModule=0x73e10000, lpmodinfo=0x2850a20, cb=0xc | out: lpmodinfo=0x2850a20*(lpBaseOfDll=0x73e10000, SizeOfImage=0x80000, EntryPoint=0x73e237c9)) returned 1 [0256.692] CoTaskMemAlloc (cb=0x804) returned 0x3f8670 [0256.692] GetModuleBaseNameW (in: hProcess=0x2f0, hModule=0x73e10000, lpBaseName=0x3f8670, nSize=0x800 | out: lpBaseName="uxtheme.dll") returned 0xb [0256.692] CoTaskMemFree (pv=0x3f8670) [0256.692] CoTaskMemAlloc (cb=0x804) returned 0x3f8670 [0256.692] GetModuleFileNameExW (in: hProcess=0x2f0, hModule=0x73e10000, lpFilename=0x3f8670, nSize=0x800 | out: lpFilename="C:\\Windows\\system32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll")) returned 0x1f [0256.692] CoTaskMemFree (pv=0x3f8670) [0256.693] GetModuleInformation (in: hProcess=0x2f0, hModule=0x74e20000, lpmodinfo=0x2852b2c, cb=0xc | out: lpmodinfo=0x2852b2c*(lpBaseOfDll=0x74e20000, SizeOfImage=0x7d000, EntryPoint=0x74e21140)) returned 1 [0256.693] CoTaskMemAlloc (cb=0x804) returned 0x3f8670 [0256.693] GetModuleBaseNameW (in: hProcess=0x2f0, hModule=0x74e20000, lpBaseName=0x3f8670, nSize=0x800 | out: lpBaseName="clrjit.dll") returned 0xa [0256.693] CoTaskMemFree (pv=0x3f8670) [0256.693] CoTaskMemAlloc (cb=0x804) returned 0x3f8670 [0256.693] GetModuleFileNameExW (in: hProcess=0x2f0, hModule=0x74e20000, lpFilename=0x3f8670, nSize=0x800 | out: lpFilename="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clrjit.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\clrjit.dll")) returned 0x38 [0256.694] CoTaskMemFree (pv=0x3f8670) [0256.694] GetModuleInformation (in: hProcess=0x2f0, hModule=0x76fd0000, lpmodinfo=0x2854c6c, cb=0xc | out: lpmodinfo=0x2854c6c*(lpBaseOfDll=0x76fd0000, SizeOfImage=0x8f000, EntryPoint=0x76fd3fb1)) returned 1 [0256.694] CoTaskMemAlloc (cb=0x804) returned 0x3f8670 [0256.694] GetModuleBaseNameW (in: hProcess=0x2f0, hModule=0x76fd0000, lpBaseName=0x3f8670, nSize=0x800 | out: lpBaseName="OLEAUT32.dll") returned 0xc [0256.694] CoTaskMemFree (pv=0x3f8670) [0256.694] CoTaskMemAlloc (cb=0x804) returned 0x3f8670 [0256.694] GetModuleFileNameExW (in: hProcess=0x2f0, hModule=0x76fd0000, lpFilename=0x3f8670, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\OLEAUT32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll")) returned 0x20 [0256.695] CoTaskMemFree (pv=0x3f8670) [0256.695] GetModuleInformation (in: hProcess=0x2f0, hModule=0x74470000, lpmodinfo=0x2856d80, cb=0xc | out: lpmodinfo=0x2856d80*(lpBaseOfDll=0x74470000, SizeOfImage=0x9ad000, EntryPoint=0x0)) returned 1 [0256.695] CoTaskMemAlloc (cb=0x804) returned 0x3f8670 [0256.695] GetModuleBaseNameW (in: hProcess=0x2f0, hModule=0x74470000, lpBaseName=0x3f8670, nSize=0x800 | out: lpBaseName="System.ni.dll") returned 0xd [0256.696] CoTaskMemFree (pv=0x3f8670) [0256.696] CoTaskMemAlloc (cb=0x804) returned 0x3f8670 [0256.696] GetModuleFileNameExW (in: hProcess=0x2f0, hModule=0x74470000, lpFilename=0x3f8670, nSize=0x800 | out: lpFilename="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System\\500ffa28b327e171fe664023003e947e\\System.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system\\500ffa28b327e171fe664023003e947e\\system.ni.dll")) returned 0x64 [0256.696] CoTaskMemFree (pv=0x3f8670) [0256.696] GetModuleInformation (in: hProcess=0x2f0, hModule=0x719b0000, lpmodinfo=0x2858f1c, cb=0xc | out: lpmodinfo=0x2858f1c*(lpBaseOfDll=0x719b0000, SizeOfImage=0x716000, EntryPoint=0x0)) returned 1 [0256.697] CoTaskMemAlloc (cb=0x804) returned 0x3f8670 [0256.697] GetModuleBaseNameW (in: hProcess=0x2f0, hModule=0x719b0000, lpBaseName=0x3f8670, nSize=0x800 | out: lpBaseName="System.Core.ni.dll") returned 0x12 [0256.697] CoTaskMemFree (pv=0x3f8670) [0256.697] CoTaskMemAlloc (cb=0x804) returned 0x3f8670 [0256.697] GetModuleFileNameExW (in: hProcess=0x2f0, hModule=0x719b0000, lpFilename=0x3f8670, nSize=0x800 | out: lpFilename="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Core\\386fde9190d499d6645df8b90eb76242\\System.Core.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.core\\386fde9190d499d6645df8b90eb76242\\system.core.ni.dll")) returned 0x6e [0256.698] CoTaskMemFree (pv=0x3f8670) [0256.698] GetModuleInformation (in: hProcess=0x2f0, hModule=0x73c40000, lpmodinfo=0x285b0d8, cb=0xc | out: lpmodinfo=0x285b0d8*(lpBaseOfDll=0x73c40000, SizeOfImage=0x1cb000, EntryPoint=0x0)) returned 1 [0256.698] CoTaskMemAlloc (cb=0x804) returned 0x3f8670 [0256.698] GetModuleBaseNameW (in: hProcess=0x2f0, hModule=0x73c40000, lpBaseName=0x3f8670, nSize=0x800 | out: lpBaseName="Microsoft.VisualBasic.ni.dll") returned 0x1c [0256.699] CoTaskMemFree (pv=0x3f8670) [0256.699] CoTaskMemAlloc (cb=0x804) returned 0x3f8670 [0256.699] GetModuleFileNameExW (in: hProcess=0x2f0, hModule=0x73c40000, lpFilename=0x3f8670, nSize=0x800 | out: lpFilename="C:\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Microsoft.V9921e851#\\cfbddeb6e93e8f421b92229b20e51233\\Microsoft.VisualBasic.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\microsoft.v9921e851#\\cfbddeb6e93e8f421b92229b20e51233\\microsoft.visualbasic.ni.dll")) returned 0x81 [0256.699] CoTaskMemFree (pv=0x3f8670) [0256.699] GetModuleInformation (in: hProcess=0x2f0, hModule=0x74450000, lpmodinfo=0x285d2cc, cb=0xc | out: lpmodinfo=0x285d2cc*(lpBaseOfDll=0x74450000, SizeOfImage=0x13000, EntryPoint=0x744518f0)) returned 1 [0256.699] CoTaskMemAlloc (cb=0x804) returned 0x3f8670 [0256.699] GetModuleBaseNameW (in: hProcess=0x2f0, hModule=0x74450000, lpBaseName=0x3f8670, nSize=0x800 | out: lpBaseName="nlssorting.dll") returned 0xe [0256.700] CoTaskMemFree (pv=0x3f8670) [0256.700] CoTaskMemAlloc (cb=0x804) returned 0x3f8670 [0256.700] GetModuleFileNameExW (in: hProcess=0x2f0, hModule=0x74450000, lpFilename=0x3f8670, nSize=0x800 | out: lpFilename="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\nlssorting.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\nlssorting.dll")) returned 0x3c [0256.700] CoTaskMemFree (pv=0x3f8670) [0256.700] GetModuleInformation (in: hProcess=0x2f0, hModule=0x74430000, lpmodinfo=0x285f41c, cb=0xc | out: lpmodinfo=0x285f41c*(lpBaseOfDll=0x74430000, SizeOfImage=0x16000, EntryPoint=0x74432dc3)) returned 1 [0256.701] CoTaskMemAlloc (cb=0x804) returned 0x3f8670 [0256.701] GetModuleBaseNameW (in: hProcess=0x2f0, hModule=0x74430000, lpBaseName=0x3f8670, nSize=0x800 | out: lpBaseName="CRYPTSP.dll") returned 0xb [0256.701] CoTaskMemFree (pv=0x3f8670) [0256.701] CoTaskMemAlloc (cb=0x804) returned 0x3f8670 [0256.701] GetModuleFileNameExW (in: hProcess=0x2f0, hModule=0x74430000, lpFilename=0x3f8670, nSize=0x800 | out: lpFilename="C:\\Windows\\system32\\CRYPTSP.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll")) returned 0x1f [0256.702] CoTaskMemFree (pv=0x3f8670) [0256.702] GetModuleInformation (in: hProcess=0x2f0, hModule=0x743f0000, lpmodinfo=0x2861528, cb=0xc | out: lpmodinfo=0x2861528*(lpBaseOfDll=0x743f0000, SizeOfImage=0x3b000, EntryPoint=0x743f128d)) returned 1 [0256.702] CoTaskMemAlloc (cb=0x804) returned 0x3f8670 [0256.702] GetModuleBaseNameW (in: hProcess=0x2f0, hModule=0x743f0000, lpBaseName=0x3f8670, nSize=0x800 | out: lpBaseName="rsaenh.dll") returned 0xa [0256.703] CoTaskMemFree (pv=0x3f8670) [0256.703] CoTaskMemAlloc (cb=0x804) returned 0x3f8670 [0256.703] GetModuleFileNameExW (in: hProcess=0x2f0, hModule=0x743f0000, lpFilename=0x3f8670, nSize=0x800 | out: lpFilename="C:\\Windows\\system32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll")) returned 0x1e [0256.703] CoTaskMemFree (pv=0x3f8670) [0256.703] GetModuleInformation (in: hProcess=0x2f0, hModule=0x774f0000, lpmodinfo=0x2863740, cb=0xc | out: lpmodinfo=0x2863740*(lpBaseOfDll=0x774f0000, SizeOfImage=0x5000, EntryPoint=0x774f1438)) returned 1 [0256.704] CoTaskMemAlloc (cb=0x804) returned 0x3f8670 [0256.704] GetModuleBaseNameW (in: hProcess=0x2f0, hModule=0x774f0000, lpBaseName=0x3f8670, nSize=0x800 | out: lpBaseName="psapi.dll") returned 0x9 [0256.704] CoTaskMemFree (pv=0x3f8670) [0256.704] CoTaskMemAlloc (cb=0x804) returned 0x3f8670 [0256.704] GetModuleFileNameExW (in: hProcess=0x2f0, hModule=0x774f0000, lpFilename=0x3f8670, nSize=0x800 | out: lpFilename="C:\\Windows\\syswow64\\psapi.dll" (normalized: "c:\\windows\\syswow64\\psapi.dll")) returned 0x1d [0256.705] CoTaskMemFree (pv=0x3f8670) [0256.705] CloseHandle (hObject=0x2f0) returned 1 [0257.654] SleepEx (dwMilliseconds=0x7d0, bAlertable=1) returned 0x0 [0260.164] SleepEx (dwMilliseconds=0x7d0, bAlertable=1) returned 0x0 [0262.666] SleepEx (dwMilliseconds=0x7d0, bAlertable=1) returned 0x0 [0265.181] SleepEx (dwMilliseconds=0x7d0, bAlertable=1) returned 0x0 [0267.685] SleepEx (dwMilliseconds=0x7d0, bAlertable=1) returned 0x0 [0271.435] SleepEx (dwMilliseconds=0x7d0, bAlertable=1) returned 0x0 [0274.036] SleepEx (dwMilliseconds=0x7d0, bAlertable=1) returned 0x0 [0276.628] SleepEx (dwMilliseconds=0x7d0, bAlertable=1) returned 0x0 [0279.318] SleepEx (dwMilliseconds=0x7d0, bAlertable=1) Thread: id = 76 os_tid = 0x368 Thread: id = 77 os_tid = 0x5c0 [0247.015] CoGetContextToken (in: pToken=0xb7f8dc | out: pToken=0xb7f8dc) returned 0x800401f0 [0247.015] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 Thread: id = 80 os_tid = 0x630 Thread: id = 83 os_tid = 0x798 [0255.230] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0255.256] CoUninitialize () Thread: id = 85 os_tid = 0x7c4 [0255.272] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0255.283] CoUninitialize () Thread: id = 87 os_tid = 0x7d0 [0255.299] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0255.304] CoUninitialize () Thread: id = 89 os_tid = 0x7ec [0255.414] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0255.435] CoUninitialize () Thread: id = 90 os_tid = 0x7a0 [0255.460] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0255.467] CoUninitialize () Thread: id = 92 os_tid = 0x7f4 [0255.479] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0255.484] CoUninitialize () Thread: id = 94 os_tid = 0x298 [0255.495] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0255.500] CoUninitialize () Thread: id = 96 os_tid = 0x7e0 [0255.511] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0255.517] CoUninitialize () Thread: id = 98 os_tid = 0x430 [0255.527] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0255.532] CoUninitialize () Thread: id = 100 os_tid = 0x5d8 [0255.542] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0255.547] CoUninitialize ()